Merge staging-next into staging

doc/builders/images/dockertools.xml

@@ -166,7 +166,7 @@ hello        latest   de2bf4786de6   About a minute ago   25.2MB
   <title>buildLayeredImage</title>
 
   <para>
-   Create a Docker image with many of the store paths being on their own layer to improve sharing between images.
+   Create a Docker image with many of the store paths being on their own layer to improve sharing between images. The image is realized into the Nix store as a gzipped tarball. Depending on the intended usage, many users might prefer to use <function>streamLayeredImage</function> instead, which this function uses internally.
   </para>
 
   <variablelist>
@@ -327,6 +327,27 @@ pkgs.dockerTools.buildLayeredImage {
   </section>
  </section>
 
+ <section xml:id="ssec-pkgs-dockerTools-streamLayeredImage">
+  <title>streamLayeredImage</title>
+
+  <para>
+   Builds a script which, when run, will stream an uncompressed tarball of a Docker image to stdout. The arguments to this function are as for <function>buildLayeredImage</function>. This method of constructing an image does not realize the image into the Nix store, so it saves on IO and disk/cache space, particularly with large images.
+  </para>
+
+  <para>
+    The image produced by running the output script can be piped directly into <command>docker load</command>, to load it into the local docker daemon:
+    <screen><![CDATA[
+$(nix-build) | docker load
+    ]]></screen>
+  </para>
+  <para>
+    Alternatively, the image be piped via <command>gzip</command> into <command>skopeo</command>, e.g. to copy it into a registry:
+    <screen><![CDATA[
+$(nix-build) | gzip --fast | skopeo copy docker-archive:/dev/stdin docker://some_docker_registry/myimage:tag
+    ]]></screen>
+  </para>
+ </section>
+
  <section xml:id="ssec-pkgs-dockerTools-fetchFromRegistry">
   <title>pullImage</title>
 

doc/using/configuration.xml

@@ -85,19 +85,19 @@
   <title>Installing packages on unsupported systems</title>
 
   <para>
-   There are also two ways to try compiling a package which has been marked as unsuported for the given system.
+   There are also two ways to try compiling a package which has been marked as unsupported for the given system.
   </para>
 
   <itemizedlist>
    <listitem>
     <para>
-     For allowing the build of a broken package once, you can use an environment variable for a single invocation of the nix tools:
+     For allowing the build of an unsupported package once, you can use an environment variable for a single invocation of the nix tools:
 <programlisting>$ export NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1</programlisting>
     </para>
    </listitem>
    <listitem>
     <para>
-     For permanently allowing broken packages to be built, you may add <literal>allowUnsupportedSystem = true;</literal> to your user's configuration file, like this:
+     For permanently allowing unsupported packages to be built, you may add <literal>allowUnsupportedSystem = true;</literal> to your user's configuration file, like this:
 <programlisting>
 {
   allowUnsupportedSystem = true;

lib/licenses.nix

@@ -462,6 +462,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
     fullName = "GNU Lesser General Public License v3.0 or later";
   };
 
+  lgpllr = spdx {
+    spdxId = "LGPLLR";
+    fullName = "Lesser General Public License For Linguistic Resources";
+  };
+
   libpng = spdx {
     spdxId = "Libpng";
     fullName = "libpng License";
@@ -482,6 +487,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
     url = "https://opensource.franz.com/preamble.html";
   };
 
+  llvm-exception = spdx {
+    spdxId = "LLVM-exception";
+    fullName = "LLVM Exception"; # LLVM exceptions to the Apache 2.0 License
+  };
+
   lppl12 = spdx {
     spdxId = "LPPL-1.2";
     fullName = "LaTeX Project Public License v1.2";
@@ -545,6 +555,12 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
     fullName = "Non-Profit Open Software License 3.0";
   };
 
+  obsidian = {
+    fullName = "Obsidian End User Agreement";
+    url = "https://obsidian.md/eula";
+    free = false;
+  };
+
   ocamlpro_nc = {
     fullName = "OCamlPro Non Commercial license version 1";
     url = "https://alt-ergo.ocamlpro.com/http/alt-ergo-2.2.0/OCamlPro-Non-Commercial-License.pdf";

maintainers/maintainer-list.nix

@@ -283,6 +283,12 @@
     githubId = 273837;
     name = "Mateusz Czapliński";
   };
+  akamaus = {
+    email = "dmitryvyal@gmail.com";
+    github = "akamaus";
+    githubId = 58955;
+    name = "Dmitry Vyal";
+  };
   akaWolf = {
     email = "akawolf0@gmail.com";
     github = "akaWolf";
@@ -1133,6 +1139,12 @@
     githubId = 7716744;
     name = "Berno Strik";
   };
+  breakds = {
+    email = "breakds@gmail.com";
+    github = "breakds";
+    githubId = 1111035;
+    name = "Break Yang";
+  };
   brettlyons = {
     email = "blyons@fastmail.com";
     github = "brettlyons";
@@ -1598,6 +1610,12 @@
     githubId = 32609395;
     name = "B YI";
   };
+  conradmearns = {
+    email = "conradmearns+github@pm.me";
+    github = "ConradMearns";
+    githubId = 5510514;
+    name = "Conrad Mearns";
+  };
   couchemar = {
     email = "couchemar@yandex.ru";
     github = "couchemar";
@@ -1776,6 +1794,12 @@
     email = "christoph.senjak@googlemail.com";
     name = "Christoph-Simon Senjak";
   };
+  david-sawatzke = {
+    email = "d-nix@sawatzke.dev";
+    github = "david-sawatzke";
+    githubId = 11035569;
+    name = "David Sawatzke";
+  };
   david50407 = {
     email = "me@davy.tw";
     github = "david50407";
@@ -3698,6 +3722,12 @@
     githubId = 41977;
     name = "Joachim Fasting";
   };
+  joachimschmidt557 = {
+    email = "joachim.schmidt557@outlook.com";
+    github = "joachimschmidt557";
+    githubId = 28556218;
+    name = "Joachim Schmidt";
+  };
   joamaki = {
     email = "joamaki@gmail.com";
     github = "joamaki";
@@ -6296,6 +6326,12 @@
       fingerprint = "240B 57DE 4271 2480 7CE3  EAC8 4F74 D536 1C4C A31E";
     }];
   };
+  priegger = {
+    email = "philipp@riegger.name";
+    github = "priegger";
+    githubId = 228931;
+    name = "Philipp Riegger";
+  };
   prikhi = {
     email = "pavan.rikhi@gmail.com";
     github = "prikhi";
@@ -7850,6 +7886,12 @@
     githubId = 1141680;
     name = "Thane Gill";
   };
+  TheBrainScrambler = {
+    email = "esthromeris@riseup.net";
+    github = "TheBrainScrambler";
+    githubId = 34945377;
+    name = "John Smith";
+  };
   thedavidmeister = {
     email = "thedavidmeister@gmail.com";
     github = "thedavidmeister";

maintainers/scripts/luarocks-packages.csv

@@ -74,6 +74,7 @@ moonscript,,,,,arobyn
 nvim-client,,,,,
 penlight,,,,,
 rapidjson,,,,,
+readline,,,,,
 say,,,,,
 std__debug,std._debug,,,,
 std_normalize,std.normalize,,,,

nixos/doc/manual/development/running-nixos-tests-interactively.xml

@@ -38,7 +38,12 @@ starting VDE switch for network 1
  </para>
 
  <para>
-  The machine state is kept across VM restarts in
+   You can re-use the VM states coming from a previous run
-  <filename>/tmp/vm-state-</filename><varname>machinename</varname>.
+   by setting the <command>--keep-vm-state</command> flag.
+<screen>
+<prompt>$ </prompt>./result/bin/nixos-run-vms --keep-vm-state
+</screen>
+  The machine state is stored in the
+  <filename>$TMPDIR/vm-state-</filename><varname>machinename</varname> directory.
  </para>
 </section>

nixos/doc/manual/development/writing-nixos-tests.xml

@@ -360,6 +360,18 @@ start_all()
      </note>
     </listitem>
    </varlistentry>
+   <varlistentry>
+    <term>
+     <methodname>wait_for_console_text</methodname>
+    </term>
+    <listitem>
+     <para>
+      Wait until the supplied regular expressions match a line of the serial
+      console output. This method is useful when OCR is not possibile or
+      accurate enough.
+     </para>
+    </listitem>
+   </varlistentry>
    <varlistentry>
     <term>
      <methodname>wait_for_window</methodname>

nixos/doc/manual/installation/installing.xml

@@ -146,7 +146,7 @@
        partition. It uses the initially reserved 512MiB at the start of the
        disk.
 <screen language="commands"><prompt># </prompt>parted /dev/sda -- mkpart ESP fat32 1MiB 512MiB
-<prompt># </prompt>parted /dev/sda -- set 3 boot on</screen>
+<prompt># </prompt>parted /dev/sda -- set 3 esp on</screen>
       </para>
      </listitem>
     </orderedlist>
@@ -513,7 +513,7 @@ Retype new UNIX password: ***</screen>
 <prompt># </prompt>parted /dev/sda -- mkpart primary 512MiB -8GiB
 <prompt># </prompt>parted /dev/sda -- mkpart primary linux-swap -8GiB 100%
 <prompt># </prompt>parted /dev/sda -- mkpart ESP fat32 1MiB 512MiB
-<prompt># </prompt>parted /dev/sda -- set 3 boot on</screen>
+<prompt># </prompt>parted /dev/sda -- set 3 esp on</screen>
   </example>
 
   <example xml:id="ex-install-sequence">

nixos/doc/manual/release-notes/rl-2009.xml

@@ -504,6 +504,16 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      In the <literal>resilio</literal> module, <xref linkend="opt-services.resilio.httpListenAddr"/> has been changed to listen to <literal>[::1]</literal> instead of <literal>0.0.0.0</literal>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     Radicale's default package has changed from 2.x to 3.x. An upgrade
+     checklist can be found
+     <link xlink:href="https://github.com/Kozea/Radicale/blob/3.0.x/NEWS.md#upgrade-checklist">here</link>.
+     You can use the newer version in the NixOS service by setting the
+     <literal>package</literal> to <literal>radicale3</literal>, which is done
+     automatically if <literal>stateVersion</literal> is 20.09 or higher.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -665,6 +675,12 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      <package>nextcloud18</package> before upgrading to <package>nextcloud19</package>
      since Nextcloud doesn't support upgrades across multiple major versions.
     </para>
+     <para>
+       The <literal>nixos-run-vms</literal> script now deletes the
+       previous run machines states on test startup. You can use the
+       <literal>--keep-vm-state</literal> flag to match the previous
+       behaviour and keep the same VM state between different test runs.
+     </para>
    </listitem>
   </itemizedlist>
  </section>

nixos/lib/make-ext4-fs.nix

@@ -17,7 +17,7 @@
 , e2fsprogs
 , libfaketime
 , perl
-, lkl
+, fakeroot
 }:
 
 let
@@ -26,7 +26,7 @@ in
 pkgs.stdenv.mkDerivation {
   name = "ext4-fs.img${lib.optionalString compressImage ".zst"}";
 
-  nativeBuildInputs = [ e2fsprogs.bin libfaketime perl lkl ]
+  nativeBuildInputs = [ e2fsprogs.bin libfaketime perl fakeroot ]
   ++ lib.optional compressImage zstd;
 
   buildCommand =
@@ -37,32 +37,31 @@ pkgs.stdenv.mkDerivation {
       ${populateImageCommands}
       )
 
-      # Add the closures of the top-level store objects.
+      echo "Preparing store paths for image..."
-      storePaths=$(cat ${sdClosureInfo}/store-paths)
+
+      # Create nix/store before copying path
+      mkdir -p ./rootImage/nix/store
+
+      xargs -I % cp -a --reflink=auto % -t ./rootImage/nix/store/ < ${sdClosureInfo}/store-paths
+      (
+        GLOBIGNORE=".:.."
+        shopt -u dotglob
+        cp -a --reflink=auto ./files/* -t ./rootImage/
+      )
+
+      # Also include a manifest of the closures in a format suitable for nix-store --load-db
+      cp ${sdClosureInfo}/registration ./rootImage/nix-path-registration
 
       # Make a crude approximation of the size of the target image.
       # If the script starts failing, increase the fudge factors here.
-      numInodes=$(find $storePaths ./files | wc -l)
+      numInodes=$(find ./rootImage | wc -l)
-      numDataBlocks=$(du -s -c -B 4096 --apparent-size $storePaths ./files | tail -1 | awk '{ print int($1 * 1.10) }')
+      numDataBlocks=$(du -s -c -B 4096 --apparent-size ./rootImage | tail -1 | awk '{ print int($1 * 1.10) }')
       bytes=$((2 * 4096 * $numInodes + 4096 * $numDataBlocks))
       echo "Creating an EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks)"
 
       truncate -s $bytes $img
-      faketime -f "1970-01-01 00:00:01" mkfs.ext4 -L ${volumeLabel} -U ${uuid} $img
 
-      # Also include a manifest of the closures in a format suitable for nix-store --load-db.
+      faketime -f "1970-01-01 00:00:01" fakeroot mkfs.ext4 -L ${volumeLabel} -U ${uuid} -d ./rootImage $img
-      cp ${sdClosureInfo}/registration nix-path-registration
-      cptofs -t ext4 -i $img nix-path-registration /
-
-      # Create nix/store before copying paths
-      faketime -f "1970-01-01 00:00:01" mkdir -p nix/store
-      cptofs -t ext4 -i $img nix /
-
-      echo "copying store paths to image..."
-      cptofs -t ext4 -i $img $storePaths /nix/store/
-
-      echo "copying files to image..."
-      cptofs -t ext4 -i $img ./files/* /
 
       export EXT2FS_NO_MTAB_OK=yes
       # I have ended up with corrupted images sometimes, I suspect that happens when the build machine's disk gets full during the build.

nixos/lib/test-driver/test-driver.py

@@ -3,7 +3,10 @@ from contextlib import contextmanager, _GeneratorContextManager
 from queue import Queue, Empty
 from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List
 from xml.sax.saxutils import XMLGenerator
+import queue
+import io
 import _thread
+import argparse
 import atexit
 import base64
 import codecs
@@ -671,6 +674,22 @@ class Machine:
         with self.nested("waiting for {} to appear on screen".format(regex)):
             retry(screen_matches)
 
+    def wait_for_console_text(self, regex: str) -> None:
+        self.log("waiting for {} to appear on console".format(regex))
+        # Buffer the console output, this is needed
+        # to match multiline regexes.
+        console = io.StringIO()
+        while True:
+            try:
+                console.write(self.last_lines.get())
+            except queue.Empty:
+                self.sleep(1)
+                continue
+            console.seek(0)
+            matches = re.search(regex, console.read())
+            if matches is not None:
+                return
+
     def send_key(self, key: str) -> None:
         key = CHAR_TO_KEY.get(key, key)
         self.send_monitor_command("sendkey {}".format(key))
@@ -734,11 +753,16 @@ class Machine:
         self.monitor, _ = self.monitor_socket.accept()
         self.shell, _ = self.shell_socket.accept()
 
+        # Store last serial console lines for use
+        # of wait_for_console_text
+        self.last_lines: Queue = Queue()
+
         def process_serial_output() -> None:
             assert self.process.stdout is not None
             for _line in self.process.stdout:
                 # Ignore undecodable bytes that may occur in boot menus
                 line = _line.decode(errors="ignore").replace("\r", "").rstrip()
+                self.last_lines.put(line)
                 eprint("{} # {}".format(self.name, line))
                 self.logger.enqueue({"msg": line, "machine": self.name})
 
@@ -751,6 +775,11 @@ class Machine:
 
         self.log("QEMU running (pid {})".format(self.pid))
 
+    def cleanup_statedir(self) -> None:
+        self.log("delete the VM state directory")
+        if os.path.isfile(self.state_dir):
+            shutil.rmtree(self.state_dir)
+
     def shutdown(self) -> None:
         if not self.booted:
             return
@@ -889,6 +918,15 @@ def subtest(name: str) -> Iterator[None]:
 
 
 if __name__ == "__main__":
+    arg_parser = argparse.ArgumentParser()
+    arg_parser.add_argument(
+        "-K",
+        "--keep-vm-state",
+        help="re-use a VM state coming from a previous run",
+        action="store_true",
+    )
+    (cli_args, vm_scripts) = arg_parser.parse_known_args()
+
     log = Logger()
 
     vlan_nrs = list(dict.fromkeys(os.environ.get("VLANS", "").split()))
@@ -896,8 +934,10 @@ if __name__ == "__main__":
     for nr, vde_socket, _, _ in vde_sockets:
         os.environ["QEMU_VDE_SOCKET_{}".format(nr)] = vde_socket
 
-    vm_scripts = sys.argv[1:]
     machines = [create_machine({"startCommand": s}) for s in vm_scripts]
+    for machine in machines:
+        if not cli_args.keep_vm_state:
+            machine.cleanup_statedir()
     machine_eval = [
         "{0} = machines[{1}]".format(m.name, idx) for idx, m in enumerate(machines)
     ]
@@ -911,7 +951,6 @@ if __name__ == "__main__":
                     continue
                 log.log("killing {} (pid {})".format(machine.name, machine.pid))
                 machine.process.kill()
-
             for _, _, process, _ in vde_sockets:
                 process.terminate()
         log.close()

nixos/lib/testing-python.nix

@@ -114,7 +114,7 @@ rec {
 
       imagemagick_tiff = imagemagick_light.override { inherit libtiff; };
 
-      # Generate onvenience wrappers for running the test driver
+      # Generate convenience wrappers for running the test driver
       # interactively with the specified network, and for starting the
       # VMs from the command line.
       driver = let warn = if skipLint then lib.warn "Linting is disabled!" else lib.id; in warn (runCommand testDriverName

nixos/modules/module-list.nix

@@ -589,6 +589,7 @@
   ./services/networking/autossh.nix
   ./services/networking/bird.nix
   ./services/networking/bitlbee.nix
+  ./services/networking/blockbook-frontend.nix
   ./services/networking/charybdis.nix
   ./services/networking/cjdns.nix
   ./services/networking/cntlm.nix

nixos/modules/programs/fish.nix

@@ -102,6 +102,9 @@ in
 
     programs.fish.shellAliases = mapAttrs (name: mkDefault) cfge.shellAliases;
 
+    # Required for man completions
+    documentation.man.generateCaches = true;
+
     environment.etc."fish/foreign-env/shellInit".text = cfge.shellInit;
     environment.etc."fish/foreign-env/loginShellInit".text = cfge.loginShellInit;
     environment.etc."fish/foreign-env/interactiveShellInit".text = cfge.interactiveShellInit;

nixos/modules/services/continuous-integration/gitlab-runner.nix

@@ -1,14 +1,16 @@
 { config, lib, pkgs, ... }:
+with builtins;
 with lib;
 let
   cfg = config.services.gitlab-runner;
   hasDocker = config.virtualisation.docker.enable;
-  hashedServices = with builtins; (mapAttrs' (name: service: nameValuePair
+  hashedServices = mapAttrs'
-    "${name}_${config.networking.hostName}_${
+    (name: service: nameValuePair
+      "${name}_${config.networking.hostName}_${
         substring 0 12
         (hashString "md5" (unsafeDiscardStringContext (toJSON service)))}"
       service)
-    cfg.services);
+    cfg.services;
   configPath = "$HOME/.gitlab-runner/config.toml";
   configureScript = pkgs.writeShellScriptBin "gitlab-runner-configure" (
     if (cfg.configFile != null) then ''
@@ -76,7 +78,7 @@ let
               ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
               ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
             )
-          ))} && sleep 1
+          ))} && sleep 1 || exit 1
         fi
       '') hashedServices)}
 
@@ -89,8 +91,17 @@ let
 
       # update global options
       remarshal --if toml --of json ${configPath} \
-        | jq -cM '.check_interval = ${toString cfg.checkInterval} |
+        | jq -cM ${escapeShellArg (concatStringsSep " | " [
-                  .concurrent = ${toString cfg.concurrent}' \
+            ".check_interval = ${toJSON cfg.checkInterval}"
+            ".concurrent = ${toJSON cfg.concurrent}"
+            ".sentry_dsn = ${toJSON cfg.sentryDSN}"
+            ".listen_address = ${toJSON cfg.prometheusListenAddress}"
+            ".session_server.listen_address = ${toJSON cfg.sessionServer.listenAddress}"
+            ".session_server.advertise_address = ${toJSON cfg.sessionServer.advertiseAddress}"
+            ".session_server.session_timeout = ${toJSON cfg.sessionServer.sessionTimeout}"
+            "del(.[] | nulls)"
+            "del(.session_server[] | nulls)"
+          ])} \
         | remarshal --if json --of toml \
         | sponge ${configPath}
 
@@ -141,6 +152,66 @@ in
         0 does not mean unlimited.
       '';
     };
+    sentryDSN = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "https://public:private@host:port/1";
+      description = ''
+        Data Source Name for tracking of all system level errors to Sentry.
+      '';
+    };
+    prometheusListenAddress = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "localhost:8080";
+      description = ''
+        Address (<host>:<port>) on which the Prometheus metrics HTTP server
+        should be listening.
+      '';
+    };
+    sessionServer = mkOption {
+      type = types.submodule {
+        options = {
+          listenAddress = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "0.0.0.0:8093";
+            description = ''
+              An internal URL to be used for the session server.
+            '';
+          };
+          advertiseAddress = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "runner-host-name.tld:8093";
+            description = ''
+              The URL that the Runner will expose to GitLab to be used
+              to access the session server.
+              Fallbacks to <option>listenAddress</option> if not defined.
+            '';
+          };
+          sessionTimeout = mkOption {
+            type = types.int;
+            default = 1800;
+            description = ''
+              How long in seconds the session can stay active after
+              the job completes (which will block the job from finishing).
+            '';
+          };
+        };
+      };
+      default = { };
+      example = literalExample ''
+        {
+          listenAddress = "0.0.0.0:8093";
+        }
+      '';
+      description = ''
+        The session server allows the user to interact with jobs
+        that the Runner is responsible for. A good example of this is the
+        <link xlink:href="https://docs.gitlab.com/ee/ci/interactive_web_terminal/index.html">interactive web terminal</link>.
+      '';
+    };
     gracefulTermination = mkOption {
       type = types.bool;
       default = false;

nixos/modules/services/databases/openldap.nix

@@ -5,14 +5,14 @@ with lib;
 let
 
   cfg = config.services.openldap;
-  openldap = pkgs.openldap;
+  openldap = cfg.package;
 
   dataFile = pkgs.writeText "ldap-contents.ldif" cfg.declarativeContents;
   configFile = pkgs.writeText "slapd.conf" ((optionalString cfg.defaultSchemas ''
-    include ${pkgs.openldap.out}/etc/schema/core.schema
+    include ${openldap.out}/etc/schema/core.schema
-    include ${pkgs.openldap.out}/etc/schema/cosine.schema
+    include ${openldap.out}/etc/schema/cosine.schema
-    include ${pkgs.openldap.out}/etc/schema/inetorgperson.schema
+    include ${openldap.out}/etc/schema/inetorgperson.schema
-    include ${pkgs.openldap.out}/etc/schema/nis.schema
+    include ${openldap.out}/etc/schema/nis.schema
   '') + ''
     ${cfg.extraConfig}
     database ${cfg.database}
@@ -46,6 +46,18 @@ in
         ";
       };
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.openldap;
+        description = ''
+          OpenLDAP package to use.
+
+          This can be used to, for example, set an OpenLDAP package
+          with custom overrides to enable modules or other
+          functionality.
+        '';
+      };
+
       user = mkOption {
         type = types.str;
         default = "openldap";
@@ -152,10 +164,10 @@ in
         ";
         example = literalExample ''
             '''
-            include ${pkgs.openldap.out}/etc/schema/core.schema
+            include ${openldap.out}/etc/schema/core.schema
-            include ${pkgs.openldap.out}/etc/schema/cosine.schema
+            include ${openldap.out}/etc/schema/cosine.schema
-            include ${pkgs.openldap.out}/etc/schema/inetorgperson.schema
+            include ${openldap.out}/etc/schema/inetorgperson.schema
-            include ${pkgs.openldap.out}/etc/schema/nis.schema
+            include ${openldap.out}/etc/schema/nis.schema
 
             database bdb
             suffix dc=example,dc=org

nixos/modules/services/hardware/undervolt.nix

@@ -25,8 +25,11 @@ let
 in
 {
   options.services.undervolt = {
-    enable = mkEnableOption
+    enable = mkEnableOption ''
-      "Intel CPU undervolting service (WARNING: may permanently damage your hardware!)";
+       Undervolting service for Intel CPUs.
+
+       Warning: This service is not endorsed by Intel and may permanently damage your hardware. Use at your own risk!
+    '';
 
     verbose = mkOption {
       type = types.bool;

nixos/modules/services/networking/blockbook-frontend.nix

@@ -0,0 +1,272 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  eachBlockbook = config.services.blockbook-frontend;
+
+  blockbookOpts = { config, lib, name, ...}: {
+
+    options = {
+
+      enable = mkEnableOption "blockbook-frontend application.";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.blockbook;
+        description = "Which blockbook package to use.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "blockbook-frontend-${name}";
+        description = "The user as which to run blockbook-frontend-${name}.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "${config.user}";
+        description = "The group as which to run blockbook-frontend-${name}.";
+      };
+
+      certFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/etc/secrets/blockbook-frontend-${name}/certFile";
+        description = ''
+          To enable SSL, specify path to the name of certificate files without extension.
+          Expecting <filename>certFile.crt</filename> and <filename>certFile.key</filename>.
+        '';
+      };
+
+      configFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "${config.dataDir}/config.json";
+        description = "Location of the blockbook configuration file.";
+      };
+
+      coinName = mkOption {
+        type = types.str;
+        default = "Bitcoin";
+        example = "Bitcoin";
+        description = ''
+          See <link xlink:href="https://github.com/trezor/blockbook/blob/master/bchain/coins/blockchain.go#L61"/>
+          for current of coins supported in master (Note: may differ from release).
+        '';
+      };
+
+      cssDir = mkOption {
+        type = types.path;
+        default = "${config.package}/share/css/";
+        example = "${config.dataDir}/static/css/";
+        description = ''
+          Location of the dir with <filename>main.css</filename> CSS file.
+          By default, the one shipped with the package is used.
+        '';
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/blockbook-frontend-${name}";
+        description = "Location of blockbook-frontend-${name} data directory.";
+      };
+
+      debug = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Debug mode, return more verbose errors, reload templates on each request.";
+      };
+
+      internal = mkOption {
+        type = types.nullOr types.str;
+        default = ":9030";
+        example = ":9030";
+        description = "Internal http server binding <literal>[address]:port</literal>.";
+      };
+
+      messageQueueBinding = mkOption {
+        type = types.str;
+        default = "tcp://127.0.0.1:38330";
+        example = "tcp://127.0.0.1:38330";
+        description = "Message Queue Binding <literal>address:port</literal>.";
+      };
+
+      public = mkOption {
+        type = types.nullOr types.str;
+        default = ":9130";
+        example = ":9130";
+        description = "Public http server binding <literal>[address]:port</literal>.";
+      };
+
+      rpc = {
+        url = mkOption {
+          type = types.str;
+          default = "http://127.0.0.1";
+          description = "URL for JSON-RPC connections.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 8030;
+          description = "Port for JSON-RPC connections.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "rpc";
+          example = "rpc";
+          description = "Username for JSON-RPC connections.";
+        };
+
+        password = mkOption {
+          type = types.str;
+          default = "rpc";
+          example = "rpc";
+          description = ''
+            RPC password for JSON-RPC connections.
+            Warning: this is stored in cleartext in the Nix store!!!
+            Use <literal>configFile</literal> or <literal>passwordFile</literal> if needed.
+          '';
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = ''
+            File containing password of the RPC user.
+            Note: This options is ignored when <literal>configFile</literal> is used.
+          '';
+        };
+      };
+
+      sync = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Synchronizes until tip, if together with zeromq, keeps index synchronized.";
+      };
+
+      templateDir = mkOption {
+        type = types.path;
+        default = "${config.package}/share/templates/";
+        example = "${config.dataDir}/templates/static/";
+        description = "Location of the HTML templates. By default, ones shipped with the package are used.";
+      };
+
+      extraConfig = mkOption {
+        type = types.attrs;
+        default = {};
+        example = literalExample '' {
+          alternative_estimate_fee = "whatthefee-disabled";
+          alternative_estimate_fee_params = "{\"url\": \"https://whatthefee.io/data.json\", \"periodSeconds\": 60}";
+          fiat_rates = "coingecko";
+          fiat_rates_params = "{\"url\": \"https://api.coingecko.com/api/v3\", \"coin\": \"bitcoin\", \"periodSeconds\": 60}";
+          coin_shortcut = "BTC";
+          coin_label = "Bitcoin";
+          xpub_magic = 76067358;
+          xpub_magic_segwit_p2sh = 77429938;
+          xpub_magic_segwit_native = 78792518;
+        }'';
+        description = ''
+          Additional configurations to be appended to <filename>coin.conf</filename>.
+          Overrides any already defined configuration options.
+          See <link xlink:href="https://github.com/trezor/blockbook/tree/master/configs/coins"/>
+          for current configuration options supported in master (Note: may differ from release).
+        '';
+      };
+
+      extraCmdLineOptions = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "-workers=1" "-dbcache=0" "-logtosderr" ];
+        description = ''
+          Extra command line options to pass to Blockbook.
+          Run blockbook --help to list all available options.
+        '';
+      };
+    };
+  };
+in
+{
+  # interface
+
+  options = {
+    services.blockbook-frontend = mkOption {
+      type = types.attrsOf (types.submodule blockbookOpts);
+      default = {};
+      description = "Specification of one or more blockbook-frontend instances.";
+    };
+  };
+
+  # implementation
+
+  config = mkIf (eachBlockbook != {}) {
+
+    systemd.services = mapAttrs' (blockbookName: cfg: (
+      nameValuePair "blockbook-frontend-${blockbookName}" (
+        let
+          configFile = if cfg.configFile != null then cfg.configFile else
+            pkgs.writeText "config.conf" (builtins.toJSON ( {
+                coin_name = "${cfg.coinName}";
+                rpc_user = "${cfg.rpc.user}";
+                rpc_pass = "${cfg.rpc.password}";
+                rpc_url = "${cfg.rpc.url}:${toString cfg.rpc.port}";
+                message_queue_binding = "${cfg.messageQueueBinding}";
+              } // cfg.extraConfig)
+            );
+        in {
+          description = "blockbook-frontend-${blockbookName} daemon";
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+          preStart = ''
+            ln -sf ${cfg.templateDir} ${cfg.dataDir}/static/
+            ln -sf ${cfg.cssDir} ${cfg.dataDir}/static/
+            ${optionalString (cfg.rpc.passwordFile != null && cfg.configFile == null) ''
+              CONFIGTMP=$(mktemp)
+              ${pkgs.jq}/bin/jq ".rpc_pass = \"$(cat ${cfg.rpc.passwordFile})\"" ${configFile} > $CONFIGTMP
+              mv $CONFIGTMP ${cfg.dataDir}/${blockbookName}-config.json
+            ''}
+          '';
+          serviceConfig = {
+            User = cfg.user;
+            Group = cfg.group;
+            ExecStart = ''
+               ${cfg.package}/bin/blockbook \
+               ${if (cfg.rpc.passwordFile != null && cfg.configFile == null) then
+               "-blockchaincfg=${cfg.dataDir}/${blockbookName}-config.json"
+               else
+               "-blockchaincfg=${configFile}"
+               } \
+               -datadir=${cfg.dataDir} \
+               ${optionalString (cfg.sync != false) "-sync"} \
+               ${optionalString (cfg.certFile != null) "-certfile=${toString cfg.certFile}"} \
+               ${optionalString (cfg.debug != false) "-debug"} \
+               ${optionalString (cfg.internal != null) "-internal=${toString cfg.internal}"} \
+               ${optionalString (cfg.public != null) "-public=${toString cfg.public}"} \
+               ${toString cfg.extraCmdLineOptions}
+            '';
+            Restart = "on-failure";
+            WorkingDirectory = cfg.dataDir;
+            LimitNOFILE = 65536;
+          };
+        }
+    ) )) eachBlockbook;
+
+    systemd.tmpfiles.rules = flatten (mapAttrsToList (blockbookName: cfg: [
+      "d ${cfg.dataDir} 0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/static 0750 ${cfg.user} ${cfg.group} - -"
+    ]) eachBlockbook);
+
+    users.users = mapAttrs' (blockbookName: cfg: (
+      nameValuePair "blockbook-frontend-${blockbookName}" {
+      name = cfg.user;
+      group = cfg.group;
+      home = cfg.dataDir;
+      isSystemUser = true;
+    })) eachBlockbook;
+
+    users.groups = mapAttrs' (instanceName: cfg: (
+      nameValuePair "${cfg.group}" { })) eachBlockbook;
+  };
+}

nixos/modules/services/networking/corerad.nix

@@ -77,6 +77,8 @@ in {
         AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
         NoNewPrivileges = true;
         DynamicUser = true;
+        Type = "notify";
+        NotifyAccess = "main";
         ExecStart = "${getBin cfg.package}/bin/corerad -c=${cfg.configFile}";
         Restart = "on-failure";
       };

nixos/modules/services/networking/nsd.nix

@@ -11,8 +11,6 @@ let
 
   # build nsd with the options needed for the given config
   nsdPkg = pkgs.nsd.override {
-    configFile = "${configFile}/nsd.conf";
-
     bind8Stats = cfg.bind8Stats;
     ipv6 = cfg.ipv6;
     ratelimit = cfg.ratelimit.enable;
@@ -897,7 +895,10 @@ in
               + "want, please enable 'services.nsd.rootServer'.";
     };
 
-    environment.systemPackages = [ nsdPkg ];
+    environment = {
+      systemPackages = [ nsdPkg ];
+      etc."nsd/nsd.conf".source = "${configFile}/nsd.conf";
+    };
 
     users.groups.${username}.gid = config.ids.gids.nsd;
 

nixos/modules/services/networking/radicale.nix

@@ -8,8 +8,10 @@ let
 
   confFile = pkgs.writeText "radicale.conf" cfg.config;
 
-  # This enables us to default to version 2 while still not breaking configurations of people with version 1
+  defaultPackage = if versionAtLeast config.system.stateVersion "20.09" then {
-  defaultPackage = if versionAtLeast config.system.stateVersion "17.09" then {
+    pkg = pkgs.radicale3;
+    text = "pkgs.radicale3";
+  } else if versionAtLeast config.system.stateVersion "17.09" then {
     pkg = pkgs.radicale2;
     text = "pkgs.radicale2";
   } else {
@@ -35,8 +37,9 @@ in
       defaultText = defaultPackage.text;
       description = ''
         Radicale package to use. This defaults to version 1.x if
-        <literal>system.stateVersion &lt; 17.09</literal> and version 2.x
+        <literal>system.stateVersion &lt; 17.09</literal>, version 2.x if
-        otherwise.
+        <literal>17.09 ≤ system.stateVersion &lt; 20.09</literal>, and
+        version 3.x otherwise.
       '';
     };
 

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -708,6 +708,7 @@ in
         wantedBy = [ "multi-user.target" ];
         wants = concatLists (map (hostOpts: [ "acme-${hostOpts.hostName}.service" "acme-selfsigned-${hostOpts.hostName}.service" ]) vhostsACME);
         after = [ "network.target" "fs.target" ] ++ map (hostOpts: "acme-selfsigned-${hostOpts.hostName}.service") vhostsACME;
+        before = map (hostOpts: "acme-${hostOpts.hostName}.service") vhostsACME;
 
         path = [ pkg pkgs.coreutils pkgs.gnugrep ];
 

nixos/modules/services/web-servers/nginx/default.nix

@@ -693,6 +693,10 @@ in
       wantedBy = [ "multi-user.target" ];
       wants = concatLists (map (vhostConfig: ["acme-${vhostConfig.serverName}.service" "acme-selfsigned-${vhostConfig.serverName}.service"]) acmeEnabledVhosts);
       after = [ "network.target" ] ++ map (vhostConfig: "acme-selfsigned-${vhostConfig.serverName}.service") acmeEnabledVhosts;
+      # Nginx needs to be started in order to be able to request certificates
+      # (it's hosting the acme challenge after all)
+      # This fixes https://github.com/NixOS/nixpkgs/issues/81842
+      before = map (vhostConfig: "acme-${vhostConfig.serverName}.service") acmeEnabledVhosts;
       stopIfChanged = false;
       preStart = ''
         ${cfg.preStart}

nixos/modules/services/web-servers/traefik.nix

@@ -20,10 +20,10 @@ let
     in valueType;
   dynamicConfigFile = if cfg.dynamicConfigFile == null then
     pkgs.runCommand "config.toml" {
-      buildInputs = [ pkgs.yj ];
+      buildInputs = [ pkgs.remarshal ];
       preferLocalBuild = true;
     } ''
-      yj -jt -i \
+      remarshal -if json -of toml \
         < ${
           pkgs.writeText "dynamic_config.json"
           (builtins.toJSON cfg.dynamicConfigOptions)

nixos/modules/system/boot/loader/grub/grub.nix

@@ -55,6 +55,7 @@ let
       storePath = config.boot.loader.grub.storePath;
       bootloaderId = if args.efiBootloaderId == null then "NixOS${efiSysMountPoint'}" else args.efiBootloaderId;
       timeout = if config.boot.loader.timeout == null then -1 else config.boot.loader.timeout;
+      users = if cfg.users == {} || cfg.version != 1 then cfg.users else throw "GRUB version 1 does not support user accounts.";
       inherit efiSysMountPoint;
       inherit (args) devices;
       inherit (efi) canTouchEfiVariables;
@@ -137,6 +138,67 @@ in
         '';
       };
 
+      users = mkOption {
+        default = {};
+        example = {
+          root = { hashedPasswordFile = "/path/to/file"; };
+        };
+        description = ''
+          User accounts for GRUB. When specified, the GRUB command line and
+          all boot options except the default are password-protected.
+          All passwords and hashes provided will be stored in /boot/grub/grub.cfg,
+          and will be visible to any local user who can read this file. Additionally,
+          any passwords and hashes provided directly in a Nix configuration
+          (as opposed to external files) will be copied into the Nix store, and
+          will be visible to all local users.
+        '';
+        type = with types; attrsOf (submodule {
+          options = {
+            hashedPasswordFile = mkOption {
+              example = "/path/to/file";
+              default = null;
+              type = with types; uniq (nullOr str);
+              description = ''
+                Specifies the path to a file containing the password hash
+                for the account, generated with grub-mkpasswd-pbkdf2.
+                This hash will be stored in /boot/grub/grub.cfg, and will
+                be visible to any local user who can read this file.
+              '';
+            };
+            hashedPassword = mkOption {
+              example = "grub.pbkdf2.sha512.10000.674DFFDEF76E13EA...2CC972B102CF4355";
+              default = null;
+              type = with types; uniq (nullOr str);
+              description = ''
+                Specifies the password hash for the account,
+                generated with grub-mkpasswd-pbkdf2.
+                This hash will be copied to the Nix store, and will be visible to all local users.
+              '';
+            };
+            passwordFile = mkOption {
+              example = "/path/to/file";
+              default = null;
+              type = with types; uniq (nullOr str);
+              description = ''
+                Specifies the path to a file containing the
+                clear text password for the account.
+                This password will be stored in /boot/grub/grub.cfg, and will
+                be visible to any local user who can read this file.
+              '';
+            };
+            password = mkOption {
+              example = "Pa$$w0rd!";
+              default = null;
+              type = with types; uniq (nullOr str);
+              description = ''
+                Specifies the clear text password for the account.
+                This password will be copied to the Nix store, and will be visible to all local users.
+              '';
+            };
+          };
+        });
+      };
+
       mirroredBoots = mkOption {
         default = [ ];
         example = [

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -247,6 +247,45 @@ if ($grubVersion == 1) {
 }
 
 else {
+    my @users = ();
+    foreach my $user ($dom->findnodes('/expr/attrs/attr[@name = "users"]/attrs/attr')) {
+        my $name = $user->findvalue('@name') or die;
+        my $hashedPassword = $user->findvalue('./attrs/attr[@name = "hashedPassword"]/string/@value');
+        my $hashedPasswordFile = $user->findvalue('./attrs/attr[@name = "hashedPasswordFile"]/string/@value');
+        my $password = $user->findvalue('./attrs/attr[@name = "password"]/string/@value');
+        my $passwordFile = $user->findvalue('./attrs/attr[@name = "passwordFile"]/string/@value');
+
+        if ($hashedPasswordFile) {
+            open(my $f, '<', $hashedPasswordFile) or die "Can't read file '$hashedPasswordFile'!";
+            $hashedPassword = <$f>;
+            chomp $hashedPassword;
+        }
+        if ($passwordFile) {
+            open(my $f, '<', $passwordFile) or die "Can't read file '$passwordFile'!";
+            $password = <$f>;
+            chomp $password;
+        }
+
+        if ($hashedPassword) {
+            if (index($hashedPassword, "grub.pbkdf2.") == 0) {
+                $conf .= "\npassword_pbkdf2 $name $hashedPassword";
+            }
+            else {
+                die "Password hash for GRUB user '$name' is not valid!";
+            }
+        }
+        elsif ($password) {
+            $conf .= "\npassword $name $password";
+        }
+        else {
+            die "GRUB user '$name' has no password!";
+        }
+        push(@users, $name);
+    }
+    if (@users) {
+        $conf .= "\nset superusers=\"" . join(' ',@users) . "\"\n";
+    }
+
     if ($copyKernels == 0) {
         $conf .= "
             " . $grubStore->search;
@@ -350,7 +389,7 @@ sub copyToKernelsDir {
 }
 
 sub addEntry {
-    my ($name, $path) = @_;
+    my ($name, $path, $options) = @_;
     return unless -e "$path/kernel" && -e "$path/initrd";
 
     my $kernel = copyToKernelsDir(Cwd::abs_path("$path/kernel"));
@@ -396,7 +435,7 @@ sub addEntry {
         $conf .= "  " . ($xen ? "module" : "kernel") . " $kernel $kernelParams\n";
         $conf .= "  " . ($xen ? "module" : "initrd") . " $initrd\n\n";
     } else {
-        $conf .= "menuentry \"$name\" {\n";
+        $conf .= "menuentry \"$name\" " . ($options||"") . " {\n";
         $conf .= $grubBoot->search . "\n";
         if ($copyKernels == 0) {
             $conf .= $grubStore->search . "\n";
@@ -413,7 +452,7 @@ sub addEntry {
 # Add default entries.
 $conf .= "$extraEntries\n" if $extraEntriesBeforeNixOS;
 
-addEntry("NixOS - Default", $defaultConfig);
+addEntry("NixOS - Default", $defaultConfig, "--unrestricted");
 
 $conf .= "$extraEntries\n" unless $extraEntriesBeforeNixOS;
 

nixos/modules/virtualisation/containers.nix

@@ -34,6 +34,25 @@ in
         '';
       };
 
+    containersConf = mkOption {
+      default = {};
+      description = "containers.conf configuration";
+      type = types.submodule {
+        options = {
+
+          extraConfig = mkOption {
+            type = types.lines;
+            default = "";
+            description = ''
+              Extra configuration that should be put in the containers.conf
+              configuration file
+            '';
+
+          };
+        };
+      };
+    };
+
     registries = {
       search = mkOption {
         type = types.listOf types.str;
@@ -93,6 +112,12 @@ in
 
   config = lib.mkIf cfg.enable {
 
+    environment.etc."containers/containers.conf".text = ''
+      [network]
+      cni_plugin_dirs = ["${pkgs.cni-plugins}/bin/"]
+
+    '' + cfg.containersConf.extraConfig;
+
     environment.etc."containers/registries.conf".source = toTOML "registries.conf" {
       registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
     };

nixos/modules/virtualisation/podman.nix

@@ -28,6 +28,10 @@ let
 
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule [ "virtualisation" "podman" "libpod" ] [ "virtualisation" "containers" "containersConf" ])
+  ];
+
   meta = {
     maintainers = lib.teams.podman.members;
   };
@@ -67,25 +71,6 @@ in
       '';
     };
 
-    libpod = mkOption {
-      default = {};
-      description = "Libpod configuration";
-      type = types.submodule {
-        options = {
-
-          extraConfig = mkOption {
-            type = types.lines;
-            default = "";
-            description = ''
-              Extra configuration that should be put in the libpod.conf
-              configuration file
-            '';
-
-          };
-        };
-      };
-    };
-
     package = lib.mkOption {
       type = types.package;
       default = podmanPackage;
@@ -103,11 +88,6 @@ in
     environment.systemPackages = [ cfg.package ]
       ++ lib.optional cfg.dockerCompat dockerCompat;
 
-    environment.etc."containers/libpod.conf".text = ''
-      cni_plugin_dir = ["${pkgs.cni-plugins}/bin/"]
-
-    '' + cfg.libpod.extraConfig;
-
     environment.etc."cni/net.d/87-podman-bridge.conflist".source = copyFile "${pkgs.podman-unwrapped.src}/cni/87-podman-bridge.conflist";
 
     # Enable common /etc/containers configuration

nixos/tests/acme.nix

@@ -48,10 +48,9 @@ in import ./make-test-python.nix ({ lib, ... }: {
       security.acme.certs."standalone.test" = {
         webroot = "/var/lib/acme/acme-challenges";
       };
-      systemd.targets."acme-finished-standalone.test" = {};
+      systemd.targets."acme-finished-standalone.test" = {
-      systemd.services."acme-standalone.test" = {
+        after = [ "acme-standalone.test.service" ];
-        wants = [ "acme-finished-standalone.test.target" ];
+        wantedBy = [ "acme-standalone.test.service" ];
-        before = [ "acme-finished-standalone.test.target" ];
       };
       services.nginx.enable = true;
       services.nginx.virtualHosts."standalone.test" = {
@@ -68,11 +67,9 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
       # A target remains active. Use this to probe the fact that
       # a service fired eventhough it is not RemainAfterExit
-      systemd.targets."acme-finished-a.example.test" = {};
+      systemd.targets."acme-finished-a.example.test" = {
-      systemd.services."acme-a.example.test" = {
+        after = [ "acme-a.example.test.service" ];
-        wants = [ "acme-finished-a.example.test.target" ];
+        wantedBy = [ "acme-a.example.test.service" ];
-        before = [ "acme-finished-a.example.test.target" ];
-        after = [ "nginx.service" ];
       };
 
       services.nginx.enable = true;
@@ -89,11 +86,9 @@ in import ./make-test-python.nix ({ lib, ... }: {
       security.acme.server = "https://acme.test/dir";
 
       specialisation.second-cert.configuration = {pkgs, ...}: {
-        systemd.targets."acme-finished-b.example.test" = {};
+        systemd.targets."acme-finished-b.example.test" = {
-        systemd.services."acme-b.example.test" = {
+          after = [ "acme-b.example.test.service" ];
-          wants = [ "acme-finished-b.example.test.target" ];
+          wantedBy = [ "acme-b.example.test.service" ];
-          before = [ "acme-finished-b.example.test.target" ];
-          after = [ "nginx.service" ];
         };
         services.nginx.virtualHosts."b.example.test" = {
           enableACME = true;
@@ -104,6 +99,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
           '';
         };
       };
+
       specialisation.dns-01.configuration = {pkgs, config, nodes, lib, ...}: {
         security.acme.certs."example.test" = {
           domain = "*.example.test";
@@ -115,10 +111,12 @@ in import ./make-test-python.nix ({ lib, ... }: {
           user = config.services.nginx.user;
           group = config.services.nginx.group;
         };
-        systemd.targets."acme-finished-example.test" = {};
+        systemd.targets."acme-finished-example.test" = {
+          after = [ "acme-example.test.service" ];
+          wantedBy = [ "acme-example.test.service" ];
+        };
         systemd.services."acme-example.test" = {
-          wants = [ "acme-finished-example.test.target" ];
+          before = [ "nginx.service" ];
-          before = [ "acme-finished-example.test.target" "nginx.service" ];
           wantedBy = [ "nginx.service" ];
         };
         services.nginx.virtualHosts."c.example.test" = {
@@ -132,6 +130,26 @@ in import ./make-test-python.nix ({ lib, ... }: {
           '';
         };
       };
+
+      # When nginx depends on a service that is slow to start up, requesting used to fail
+      # certificates fail.  Reproducer for https://github.com/NixOS/nixpkgs/issues/81842
+      specialisation.slow-startup.configuration = { pkgs, config, nodes, lib, ...}: {
+        systemd.services.my-slow-service = {
+          wantedBy = [ "multi-user.target" "nginx.service" ];
+          before = [ "nginx.service" ];
+          preStart = "sleep 5";
+          script = "${pkgs.python3}/bin/python -m http.server";
+        };
+        systemd.targets."acme-finished-d.example.com" = {
+          after = [ "acme-d.example.com.service" ];
+          wantedBy = [ "acme-d.example.com.service" ];
+        };
+        services.nginx.virtualHosts."d.example.com" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/".proxyPass = "http://localhost:8000";
+        };
+      };
     };
 
     client = {nodes, lib, ...}: {
@@ -207,5 +225,15 @@ in import ./make-test-python.nix ({ lib, ... }: {
           client.succeed(
               "curl --cacert /tmp/ca.crt https://c.example.test/ | grep -qF 'hello world'"
           )
+
+      with subtest("Can request certificate of nginx when startup is delayed"):
+          webserver.succeed(
+              "${switchToNewServer}"
+          )
+          webserver.succeed(
+              "/run/current-system/specialisation/slow-startup/bin/switch-to-configuration test"
+          )
+          webserver.wait_for_unit("acme-finished-d.example.com.target")
+          client.succeed("curl --cacert /tmp/ca.crt https://d.example.com/")
     '';
 })

nixos/tests/all-tests.nix

@@ -33,6 +33,7 @@ in
   bees = handleTest ./bees.nix {};
   bind = handleTest ./bind.nix {};
   bittorrent = handleTest ./bittorrent.nix {};
+  blockbook-frontend = handleTest ./blockbook-frontend.nix {};
   buildkite-agents = handleTest ./buildkite-agents.nix {};
   boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
   boot-stage1 = handleTest ./boot-stage1.nix {};
@@ -125,6 +126,7 @@ in
   grafana = handleTest ./grafana.nix {};
   graphite = handleTest ./graphite.nix {};
   graylog = handleTest ./graylog.nix {};
+  grub = handleTest ./grub.nix {};
   gvisor = handleTest ./gvisor.nix {};
   hadoop.hdfs = handleTestOn [ "x86_64-linux" ] ./hadoop/hdfs.nix {};
   hadoop.yarn = handleTestOn [ "x86_64-linux" ] ./hadoop/yarn.nix {};

nixos/tests/blockbook-frontend.nix

@@ -0,0 +1,28 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "blockbook-frontend";
+  meta = with pkgs.stdenv.lib; {
+    maintainers = with maintainers; [ maintainers."1000101" ];
+  };
+
+  machine = { ... }: {
+    services.blockbook-frontend."test" = {
+      enable = true;
+    };
+    services.bitcoind = {
+      enable = true;
+      rpc = {
+        port = 8030;
+        users.rpc.passwordHMAC = "acc2374e5f9ba9e62a5204d3686616cf$53abdba5e67a9005be6a27ca03a93ce09e58854bc2b871523a0d239a72968033";
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("blockbook-frontend-test.service")
+
+    machine.wait_for_open_port(9030)
+
+    machine.succeed("curl -sSfL http://localhost:9030 | grep 'Blockbook'")
+  '';
+})

nixos/tests/consul.nix

@@ -55,30 +55,33 @@ let
 
   server = index: { pkgs, ... }:
     let
-      ip = builtins.elemAt allConsensusServerHosts index;
+      numConsensusServers = builtins.length allConsensusServerHosts;
+      thisConsensusServerHost = builtins.elemAt allConsensusServerHosts index;
+      ip = thisConsensusServerHost; # since we already use IPs to identify servers
     in
       {
         networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-          { address = builtins.elemAt allConsensusServerHosts index; prefixLength = 16; }
+          { address = ip; prefixLength = 16; }
         ];
         networking.firewall = firewallSettings;
 
         services.consul =
-          let
-            thisConsensusServerHost = builtins.elemAt allConsensusServerHosts index;
-          in
           assert builtins.elem thisConsensusServerHost allConsensusServerHosts;
           {
             enable = true;
             inherit webUi;
             extraConfig = defaultExtraConfig // {
               server = true;
-              bootstrap_expect = builtins.length allConsensusServerHosts;
+              bootstrap_expect = numConsensusServers;
+              # Tell Consul that we never intend to drop below this many servers.
+              # Ensures to not permanently lose consensus after temporary loss.
+              # See https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040
+              autopilot.min_quorum = numConsensusServers;
               retry_join =
                 # If there's only 1 node in the network, we allow self-join;
                 # otherwise, the node must not try to join itself, and join only the other servers.
                 # See https://github.com/hashicorp/consul/issues/2868
-                if builtins.length allConsensusServerHosts == 1
+                if numConsensusServers == 1
                   then allConsensusServerHosts
                   else builtins.filter (h: h != thisConsensusServerHost) allConsensusServerHosts;
               bind_addr = ip;
@@ -104,40 +107,123 @@ in {
     for m in machines:
         m.wait_for_unit("consul.service")
 
-    for m in machines:
+
-        m.wait_until_succeeds("[ $(consul members | grep -o alive | wc -l) == 5 ]")
+    def wait_for_healthy_servers():
+        # See https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040
+        # for why the `Voter` column of `list-peers` has that info.
+        # TODO: The `grep true` relies on the fact that currently in
+        #       the output like
+        #           # consul operator raft list-peers
+        #           Node     ID   Address           State     Voter  RaftProtocol
+        #           server3  ...  192.168.1.3:8300  leader    true   3
+        #           server2  ...  192.168.1.2:8300  follower  true   3
+        #           server1  ...  192.168.1.1:8300  follower  false  3
+        #       `Voter`is the only boolean column.
+        #       Change this to the more reliable way to be defined by
+        #       https://github.com/hashicorp/consul/issues/8118
+        #       once that ticket is closed.
+        for m in machines:
+            m.wait_until_succeeds(
+                "[ $(consul operator raft list-peers | grep true | wc -l) == 3 ]"
+            )
+
+
+    def wait_for_all_machines_alive():
+        """
+        Note that Serf-"alive" does not mean "Raft"-healthy;
+        see `wait_for_healthy_servers()` for that instead.
+        """
+        for m in machines:
+            m.wait_until_succeeds("[ $(consul members | grep -o alive | wc -l) == 5 ]")
+
+
+    wait_for_healthy_servers()
+    # Also wait for clients to be alive.
+    wait_for_all_machines_alive()
 
     client1.succeed("consul kv put testkey 42")
     client2.succeed("[ $(consul kv get testkey) == 42 ]")
 
-    # Test that the cluster can tolearate failures of any single server:
-    for server in servers:
-        server.crash()
 
-        # For each client, wait until they have connection again
+    def rolling_reboot_test(proper_rolling_procedure=True):
-        # using `kv get -recurse` before issuing commands.
+        """
-        client1.wait_until_succeeds("consul kv get -recurse")
+        Tests that the cluster can tolearate failures of any single server,
-        client2.wait_until_succeeds("consul kv get -recurse")
+        following the recommended rolling upgrade procedure from
+        https://www.consul.io/docs/upgrading#standard-upgrades.
 
-        # Do some consul actions while one server is down.
+        Optionally, `proper_rolling_procedure=False` can be given
-        client1.succeed("consul kv put testkey 43")
+        to wait only for each server to be back `Healthy`, not `Stable`
-        client2.succeed("[ $(consul kv get testkey) == 43 ]")
+        in the Raft consensus, see Consul setting `ServerStabilizationTime` and
-        client2.succeed("consul kv delete testkey")
+        https://github.com/hashicorp/consul/issues/8118#issuecomment-645330040.
+        """
 
-        # Restart crashed machine.
+        for server in servers:
-        server.start()
+            server.crash()
+
+            # For each client, wait until they have connection again
+            # using `kv get -recurse` before issuing commands.
+            client1.wait_until_succeeds("consul kv get -recurse")
+            client2.wait_until_succeeds("consul kv get -recurse")
+
+            # Do some consul actions while one server is down.
+            client1.succeed("consul kv put testkey 43")
+            client2.succeed("[ $(consul kv get testkey) == 43 ]")
+            client2.succeed("consul kv delete testkey")
+
+            # Restart crashed machine.
+            server.start()
+
+            if proper_rolling_procedure:
+                # Wait for recovery.
+                wait_for_healthy_servers()
+            else:
+                # NOT proper rolling upgrade procedure, see above.
+                wait_for_all_machines_alive()
+
+            # Wait for client connections.
+            client1.wait_until_succeeds("consul kv get -recurse")
+            client2.wait_until_succeeds("consul kv get -recurse")
+
+            # Do some consul actions with server back up.
+            client1.succeed("consul kv put testkey 44")
+            client2.succeed("[ $(consul kv get testkey) == 44 ]")
+            client2.succeed("consul kv delete testkey")
+
+
+    def all_servers_crash_simultaneously_test():
+        """
+        Tests that the cluster will eventually come back after all
+        servers crash simultaneously.
+        """
+
+        for server in servers:
+            server.crash()
+
+        for server in servers:
+            server.start()
 
         # Wait for recovery.
-        for m in machines:
+        wait_for_healthy_servers()
-            m.wait_until_succeeds("[ $(consul members | grep -o alive | wc -l) == 5 ]")
 
         # Wait for client connections.
         client1.wait_until_succeeds("consul kv get -recurse")
         client2.wait_until_succeeds("consul kv get -recurse")
 
-        # Do some consul actions with server back up.
+        # Do some consul actions with servers back up.
         client1.succeed("consul kv put testkey 44")
         client2.succeed("[ $(consul kv get testkey) == 44 ]")
         client2.succeed("consul kv delete testkey")
+
+
+    # Run the tests.
+
+    print("rolling_reboot_test()")
+    rolling_reboot_test()
+
+    print("all_servers_crash_simultaneously_test()")
+    all_servers_crash_simultaneously_test()
+
+    print("rolling_reboot_test(proper_rolling_procedure=False)")
+    rolling_reboot_test(proper_rolling_procedure=False)
   '';
 })

nixos/tests/docker.nix

@@ -43,7 +43,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     docker.fail("sudo -u noprivs docker ps")
     docker.succeed("docker stop sleeping")
 
-    # Must match version twice to ensure client and server versions are correct
+    # Must match version 4 times to ensure client and server git commits and versions are correct
-    docker.succeed('[ $(docker version | grep ${pkgs.docker.version} | wc -l) = "2" ]')
+    docker.succeed('[ $(docker version | grep ${pkgs.docker.version} | wc -l) = "4" ]')
   '';
 })

nixos/tests/dokuwiki.nix

@@ -32,8 +32,9 @@ let
 
 in {
   name = "dokuwiki";
-  meta.maintainers = with pkgs.lib.maintainers; [ "1000101" ];
+  meta = with pkgs.stdenv.lib; {
-
+    maintainers = with maintainers; [ maintainers."1000101" ];
+  };
   machine = { ... }: {
     services.dokuwiki."site1.local" = {
       aclUse = false;

nixos/tests/graphite.nix

@@ -1,11 +1,6 @@
 import ./make-test-python.nix ({ pkgs, ... } :
 {
   name = "graphite";
-  meta = {
-    # Fails on dependency `python-2.7-Twisted`'s test suite
-    # complaining `ImportError: No module named zope.interface`.
-    broken = true;
-  };
   nodes = {
     one =
       { ... }: {
@@ -21,7 +16,7 @@ import ./make-test-python.nix ({ pkgs, ... } :
           api = {
             enable = true;
             port = 8082;
-            finders = [ pkgs.python3Packages.influxgraph ];
+            finders = [ ];
           };
           carbon.enableCache = true;
           seyren.enable = false;  # Implicitely requires openssl-1.0.2u which is marked insecure
@@ -41,10 +36,14 @@ import ./make-test-python.nix ({ pkgs, ... } :
     # even if they're still in preStart (which takes quite long for graphiteWeb).
     # Wait for ports to open so we're sure the services are up and listening.
     one.wait_for_open_port(8080)
+    one.wait_for_open_port(8082)
     one.wait_for_open_port(2003)
     one.succeed('echo "foo 1 `date +%s`" | nc -N localhost 2003')
     one.wait_until_succeeds(
         "curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2"
     )
+    one.wait_until_succeeds(
+        "curl 'http://localhost:8082/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2"
+    )
   '';
 })

nixos/tests/grub.nix

@@ -0,0 +1,60 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "grub";
+
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  machine = { ... }: {
+    virtualisation.useBootLoader = true;
+
+    boot.loader.timeout = null;
+    boot.loader.grub = {
+      enable = true;
+      users.alice.password = "supersecret";
+
+      # OCR is not accurate enough
+      extraConfig = "serial; terminal_output serial";
+    };
+  };
+
+  testScript = ''
+    def grub_login_as(user, password):
+        """
+        Enters user and password to log into GRUB
+        """
+        machine.wait_for_console_text("Enter username:")
+        machine.send_chars(user + "\n")
+        machine.wait_for_console_text("Enter password:")
+        machine.send_chars(password + "\n")
+
+
+    def grub_select_all_configurations():
+        """
+        Selects "All configurations" from the GRUB menu
+        to trigger a login request.
+        """
+        machine.send_monitor_command("sendkey down")
+        machine.send_monitor_command("sendkey ret")
+
+
+    machine.start()
+
+    # wait for grub screen
+    machine.wait_for_console_text("GNU GRUB")
+
+    grub_select_all_configurations()
+    with subtest("Invalid credentials are rejected"):
+        grub_login_as("wronguser", "wrongsecret")
+        machine.wait_for_console_text("error: access denied.")
+
+    grub_select_all_configurations()
+    with subtest("Valid credentials are accepted"):
+        grub_login_as("alice", "supersecret")
+        machine.send_chars("\n")  # press enter to boot
+        machine.wait_for_console_text("Linux version")
+
+    with subtest("Machine boots correctly"):
+        machine.wait_for_unit("multi-user.target")
+  '';
+})

nixos/tests/lorri/default.nix

@@ -18,7 +18,7 @@ import ../make-test-python.nix {
     machine.wait_until_succeeds("grep --fixed-strings 'ready' lorri.stdout")
 
     # Ping the daemon
-    machine.succeed("lorri internal__ping shell.nix")
+    machine.succeed("lorri internal ping shell.nix")
 
     # Wait for the daemon to finish the build
     machine.wait_until_succeeds("grep --fixed-strings 'Completed' lorri.stdout")

nixos/tests/podman.nix

@@ -71,7 +71,7 @@ import ./make-test-python.nix (
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
           podman.succeed(
               su_cmd(
-                  "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+                  "podman run --cgroup-manager=cgroupfs --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
               )
           )
           podman.succeed(su_cmd("podman ps | grep sleeping"))

nixos/tests/radicale.nix

@@ -14,9 +14,6 @@ let
 
         [storage]
         filesystem_folder = /tmp/collections
-
-        [logging]
-        debug = True
       '';
     };
     # WARNING: DON'T DO THIS IN PRODUCTION!
@@ -49,13 +46,18 @@ in
         services.radicale.extraArgs = [
           "--export-storage" "/tmp/collections-new"
         ];
+        system.stateVersion = "17.03";
       };
       radicale2_verify = lib.recursiveUpdate radicale2 {
-        services.radicale.extraArgs = [ "--verify-storage" ];
+        services.radicale.extraArgs = [ "--debug" "--verify-storage" ];
+        system.stateVersion = "17.09";
       };
       radicale2 = lib.recursiveUpdate (common args) {
         system.stateVersion = "17.09";
       };
+      radicale3 = lib.recursiveUpdate (common args) {
+        system.stateVersion = "20.09";
+      };
     };
 
     # This tests whether the web interface is accessible to an authenticated user
@@ -117,6 +119,22 @@ in
               retcode == 0 and "VCALENDAR" in output
           ), "Could not read calendar from Radicale 2"
 
-      radicale.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")
+          radicale.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")
+
+      with subtest("Check Radicale 3 functionality"):
+          radicale.succeed(
+              "${switchToConfig "radicale3"} >&2"
+          )
+          radicale.wait_for_unit("radicale.service")
+          radicale.wait_for_open_port(${port})
+
+          (retcode, output) = radicale.execute(
+              "curl --fail http://${user}:${password}@localhost:${port}/someuser/calendar.ics/"
+          )
+          assert (
+              retcode == 0 and "VCALENDAR" in output
+          ), "Could not read calendar from Radicale 3"
+
+          radicale.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")
     '';
 })

nixos/tests/trezord.nix

@@ -1,9 +1,8 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "trezord";
-  meta = with pkgs.stdenv.lib.maintainers; {
+  meta = with pkgs.stdenv.lib; {
-    maintainers = [ mmahut "1000101" ];
+    maintainers = with maintainers; [ mmahut maintainers."1000101" ];
   };
-
   nodes = {
     machine = { ... }: {
       services.trezord.enable = true;

nixos/tests/trickster.nix

@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "trickster";
-  meta = with pkgs.stdenv.lib.maintainers; {
+  meta = with pkgs.stdenv.lib; {
-    maintainers = [ "1000101" ];
+    maintainers = with maintainers; [ maintainers."1000101" ];
   };
 
   nodes = {

pkgs/applications/audio/cava/default.nix

@@ -3,7 +3,7 @@
 
 stdenv.mkDerivation rec {
   pname = "cava";
-  version = "0.6.1";
+  version = "0.7.1";
 
   buildInputs = [
     alsaLib
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     owner = "karlstav";
     repo = "cava";
     rev = version;
-    sha256 = "1kvhqgijs29909w3sq9m0bslx2zxxn4b3i07kdz4hb0dqkppxpjy";
+    sha256 = "0p2g3xxl2n425bghs1qnff30jaj9cba94j2gbhgxmwaxhz26vbk7";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/applications/audio/flacon/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flacon";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "flacon";
     repo = "flacon";
     rev = "v${version}";
-    sha256 = "0p5z6rwckda0lkljrrvx6i90fazj53cxg9pasfmi8154j1z72dj2";
+    sha256 = "04yp3aym7h70xjni9ancqv5lc4zds5a8dgw3fzgqs8k5nmh074gv";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];

pkgs/applications/audio/foo-yc20/default.nix

@@ -18,12 +18,12 @@ stdenv.mkDerivation {
   # remove lv2 until https://github.com/sampov2/foo-yc20/issues/6 is resolved
   postInstallFixup = "rm -rf $out/lib/lv2";
 
-  meta = {
+  meta = with stdenv.lib; {
     broken = true; # see: https://github.com/sampov2/foo-yc20/issues/7
     description = "A Faust implementation of a 1969 designed Yamaha combo organ, the YC-20";
     homepage = "https://github.com/sampov2/foo-yc20";
-    license     = "BSD";
+    license     = with licenses; [ bsd3 lgpl21 mpl11 ] ;
-    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+    maintainers = [ maintainers.magnetophon ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/audio/ft2-clone/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.25_fix";
+  version = "1.26";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "0q2mcp3xpgwilmiwzr9nnxlyg9c1kynh6cxzlyd95n520j00s6i7";
+    sha256 = "0fqb4415qy2nwjz7ahi43nk795ifswb2b37sc7p5n9m4yc8h53wv";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/audio/giada/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "giada";
-  version = "0.16.2.2";
+  version = "0.16.3";
 
   src = fetchFromGitHub {
     owner = "monocasual";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0rpg5qmw3b76xcra869shb8fwk5wfzpzw216n96hxa5s6k69cm0p";
+    sha256 = "1sysv5d0wq6ib47bqsn3wdzkqzjpzjrgzg15bkllbm67hiz9abhh";
   };
 
   configureFlags = [

pkgs/applications/audio/gpodder/default.nix

@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gpodder";
-  version = "3.10.15";
+  version = "3.10.16";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "0ghbanj142n0hgydzfjmnkdgri2kswsjal3mn10c723kih4ir4yr";
+    sha256 = "0pbpaasd7kj6y25nm45y1qyb9sxd4570f7g6zkfcpf6pa3nx7qkq";
   };
 
   patches = [

pkgs/applications/audio/industrializer/default.nix

@@ -0,0 +1,50 @@
+{ stdenv
+, fetchurl
+, alsaLib
+, audiofile
+, autoconf
+, automake
+, gnome2
+, gtk2
+, libjack2
+, libtool
+, libxml2
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "industrializer";
+  version = "0.2.6";
+  src = fetchurl {
+    url = "mirror://sourceforge/project/${pname}/ps${pname}-${version}.tar.bz2";
+    sha256 = "0vls94hqpkk8h17da6fddgqbl5dgm6250av3raimhhzwvm5r1gfi";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    alsaLib
+    audiofile
+    autoconf
+    automake
+    gnome2.gtkglext
+    gtk2
+    libjack2
+    libtool
+    libxml2
+  ];
+
+  preConfigure = "./autogen.sh";
+
+  meta = {
+    description = "This program generates synthesized percussion sounds using physical modelling";
+    longDescription = ''
+      The range of sounds possible include but is not limited to cymbal sounds, metallic noises, bubbly sounds, and chimes.
+      After a sound is rendered, it can be played and then saved to a .WAV file.
+    '';
+    homepage = "https://sourceforge.net/projects/industrializer/";
+    license = stdenv.lib.licenses.gpl2Plus;
+    maintainers = [ stdenv.lib.maintainers.magnetophon ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}

pkgs/applications/audio/ncspot/default.nix

@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
-    rev = "v${version}";
+    rev = version;
-    sha256 = "144a7wn5l64fhvj8vgwl7z4bp8lbq0pb0dl38x9y4wkqmdh6wrli";
+    sha256 = "02g2lamabkwayhm56498pfvl9g0xx2vsan2j48ssrwjx6rwmlh7n";
   };
 
-  cargoSha256 = "19gn0v7j1ly3ywgflfj27pnrwjiiy17m3g1z0kzagxpjy2xi2qxy";
+  cargoSha256 = "07gw2az11lpldwpb792l64b7xlarvx77364rn4i8g6a5271zahz3";
 
   cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
 

pkgs/applications/audio/pt2-clone/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.19";
+  version = "1.20";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "0lr8gq4immc5cx1wr5ng6ccxs9afbd2dk6i0n5np25z14dvbvk3k";
+    sha256 = "0s4yk8w19qa58n5p558n6m7d5mslr9h9z5q3ayrgqcchdlm8cfky";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/blockchains/dcrd.nix

@@ -1,34 +1,24 @@
-{ stdenv, lib, go, buildGoPackage, dep, fetchgit, git, cacert }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "dcrd";
-  version = "1.1.2";
+  version = "1.5.1";
-  rev = "refs/tags/v${version}";
-  goPackagePath = "github.com/decred/dcrd";
 
-  buildInputs = [ go git dep cacert ];
+  src = fetchFromGitHub {
-
+    owner = "decred";
-  GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    repo = "dcrd";
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    rev = "refs/tags/release-v${version}";
-
+    sha256 = "1ggw289y1f4dqvj3w60q9bahq8bblbfjymn5xy04ldylr3qlxm9x";
-  src = fetchgit {
-    inherit rev;
-    url = "https://${goPackagePath}";
-    sha256 = "0xcynipdn9zmmralxj0hjrwyanvhkwfj2b1vvjk5zfc95s2xc1q9";
   };
 
-  preBuild = ''
+  vendorSha256 = "03aw6mcvp1vr01ppxy673jf5hdryd5032cxndlkaiwg005mxp1dy";
-    export CWD=$(pwd)
+
-    cd go/src/github.com/decred/dcrd
+  subPackages = [ "." "cmd/dcrctl" "cmd/promptsecret" ];
-    dep ensure
-    go install . ./cmd/...
-    cd $CWD
-  '';
 
   meta = {
     homepage = "https://decred.org";
     description = "Decred daemon in Go (golang)";
     license = with lib.licenses; [ isc ];
-    broken = stdenv.isLinux; # 2018-04-10
+    maintainers = with lib.maintainers; [ juaningan ];
   };
 }

pkgs/applications/blockchains/dcrwallet.nix

@@ -1,43 +1,24 @@
-{ stdenv, lib, go, buildGoPackage, dep, fetchgit, git, cacert }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "dcrwallet";
-  version = "1.1.2";
+  version = "1.5.1";
-  rev = "refs/tags/v${version}";
-  goPackagePath = "github.com/decred/dcrwallet";
 
-  buildInputs = [ go git dep cacert ];
+  src = fetchFromGitHub {
-
+    owner = "decred";
-  GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    repo = "dcrwallet";
-  NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    rev = "refs/tags/v${version}";
-
+    sha256 = "0ij2mwvdxg78p9qbdf9wm7aaphfg4j8lqgrjyjsj3kyi1l458ds9";
-  src = fetchgit {
-    inherit rev;
-    url = "https://${goPackagePath}";
-    sha256 = "058im4vmcmxcl5ir14h17wik5lagp2ay0p8qc3r99qmpfwvvz39x";
   };
 
-  preBuild = ''
+  vendorSha256 = "0qrrr92cad399xwr64qa9h41wqqaj0dy5mw248g5v53zars541w7";
-    export CWD=$(pwd)
-    cd go/src/github.com/decred/dcrwallet
-    dep ensure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-    go build
-  '';
-
-  installPhase = ''
-    mkdir -pv $out/bin
-    cp -v dcrwallet $out/bin
-  '';
 
+  subPackages = [ "." ];
 
   meta = {
     homepage = "https://decred.org";
-    description = "Decred daemon in Go (golang)";
+    description = "A secure Decred wallet daemon written in Go (golang)";
     license = with lib.licenses; [ isc ];
-    broken = stdenv.isLinux; # 2018-04-10
+    maintainers = with lib.maintainers; [ juaningan ];
   };
 }

pkgs/applications/blockchains/ergo/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "3.2.6";
+  version = "3.2.7";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "1a38j7dy6ax9xvcjbdkiz0z33ln4rlmgrxznvqhdf11j70g1sr6x";
+    sha256 = "1ng2q9yp03j8p2xh7rlqad5h4p82ks1l00401pq7m0y02q90szr8";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.3.2";
+  version = "2.6.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "0xd3w564zij614ajg57n1qlvz0hd9l7219qxx81ai6b02b9a5g9h";
+    sha256 = "0c58bx6fgykz0fl2yjbpbg6h5bv31zmjwgd1m3qi8afqryf52m5w";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/editors/eclipse/default.nix

@@ -99,6 +99,18 @@ in rec {
       };
   };
 
+  ### Eclipse Committers
+
+  eclipse-committers = buildEclipse {
+    name = "eclipse-committers-${platform_major}.${platform_minor}";
+    description = "Eclipse IDE for Eclipse Committers and Eclipse Platform Plugin Developers";
+    src =
+      fetchurl {
+        url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-committers-${year}-${month}-R-linux-gtk-x86_64.tar.gz";
+        sha512 = "1l0gc7srpvn3r0yrbrp1pjv1a3n1y7q5fqww5fmzyw1d6j3hjkqj74c9bff16579cpf7z6d4wmj6kr7z89p0ignrx319gc8p0hivi1y";
+      };
+  };
+
   ### Environments
 
   # Function that assembles a complete Eclipse environment from an

pkgs/applications/editors/jetbrains/default.nix

@@ -268,12 +268,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0136hmknkxrsgbygxqzrq1836kg02p14hmv5mzbpp79yglhv2xml"; /* updated by script */
+      sha256 = "0q5bnb0rmsgks7brrdpgah83s2ixa4pyhw8jvg9p2g48b582rmf7"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -281,12 +281,12 @@ in
 
   datagrip = buildDataGrip rec {
     name = "datagrip-${version}";
-    version = "2020.1.3"; /* updated by script */
+    version = "2020.1.5"; /* updated by script */
     description = "Your Swiss Army Knife for Databases and SQL";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "0ivnicpn67mfyhmiwbx80pq5l2xa4g1cpp79mh7rgm2c5klmf201"; /* updated by script */
+      sha256 = "0605d772156lzlz5904px2spdijc92yz6rjvmpyg6vk5zv5k2wm9"; /* updated by script */
     };
     wmClass = "jetbrains-datagrip";
     update-channel = "DataGrip RELEASE";
@@ -294,12 +294,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0v6vi6m94fwzsg5s357ymh8604zkv6q0zhyqfh9sj4ynzi7l4fyv"; /* updated by script */
+      sha256 = "0pqwj4gc23gf10xqciwndimb4ml7djmx8m5rh52c07m77y4aniyn"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
@@ -307,12 +307,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0q848swfg9mjiini5bbjdj1f0qpd1n4glxdpncjj7mbpvp7s2h5k"; /* updated by script */
+      sha256 = "07gfqyp6blbf7v8p106ngpq7c5p0llcjahi205yg2jgzkhshn7ld"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -320,12 +320,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "13khjc7fp28mpcdn74msdw57nzhicg32xrrvj7s7na2qd9gqz0hf"; /* updated by script */
+      sha256 = "13qj8n5daz0z0pjizyfsvbbr1gxp5479ar3a68ygi0vrpmbdbssd"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -346,12 +346,12 @@ in
 
   phpstorm = buildPhpStorm rec {
     name = "phpstorm-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description = "Professional IDE for Web and PHP developers";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "16gclbczd9czqhply0xb2ykv0bw4bgv85fihy1n2szc4rp643qdw"; /* updated by script */
+      sha256 = "00c8vlp125j56v9g9d4rc5g4dhgvl1bhi6qrzvpaf6x77jbq4fv4"; /* updated by script */
     };
     wmClass = "jetbrains-phpstorm";
     update-channel = "PhpStorm RELEASE";
@@ -359,12 +359,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0p2q01yragab7c15aicpmaby075y7mpf6iavdfipi033q4gnlnki"; /* updated by script */
+      sha256 = "1s04b9w7sydix1sjqzmby63nwcvzs6iw28wz7441kxgryl9qg0qw"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
@@ -372,12 +372,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1lq97aqnibvg483ww7wi8slh302gydd2kdkw6p2516rjcmm6n324"; /* updated by script */
+      sha256 = "1ysj00qbn5ik6i5953b9mln4g456fmn3phdln9m5jmcb0126y235"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";
@@ -385,12 +385,12 @@ in
 
   rider = buildRider rec {
     name = "rider-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0flwq61p7827f8nmldqgfpxbfl422imclksw6w97mgzqqhcbgksd"; /* updated by script */
+      sha256 = "1zzkd3b5j3q6jqrvibxz33a4fcm7pgqfx91bqjs615v3499ncng7"; /* updated by script */
     };
     wmClass = "jetbrains-rider";
     update-channel = "Rider RELEASE";
@@ -398,12 +398,12 @@ in
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "0xhx3n2xdk0k0qx7hdiyfga16hjf2j95k219wh7mh0cys20hkrg8"; /* updated by script */
+      sha256 = "1ycwml7fyhjajjfy1fhggmx0mcdcjidkxll7357rv2z51r0yhc9h"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "RubyMine RELEASE";
@@ -411,12 +411,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2020.1.1"; /* updated by script */
+    version = "2020.1.2"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0d543g06bxpw4q2p19vmvrxpbhqsvspjbs3sqnw6hxni7wcflhkg"; /* updated by script */
+      sha256 = "1szgiccimfk99z9x1k99lgic6ix81fdahf1k3a88rddl8hhncjwv"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WebStorm RELEASE";

pkgs/applications/editors/lite/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lite";
-  version = "1.05";
+  version = "1.06";
 
   src = fetchFromGitHub {
     owner = "rxi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0xh29ddl5h92n1c4nlh4kx9mchwkzn4r3l16kklix3a1jm1c878a";
+    sha256 = "1lw4a6xv8pdlgwnhh870caij4iyzxdyjw4qmm4fswja9mbqkj32f";
   };
 
   nativeBuildInputs = [ makeWrapper pkg-config ];

pkgs/applications/editors/quartus-prime/default.nix

@@ -24,7 +24,7 @@ let
   ) deviceIds;
 
   quartus = stdenv.mkDerivation rec {
-    version = "19.1.0.670";
+    version = "20.1.0.711";
     pname = "quartus-prime-lite-unwrapped";
 
     src = let
@@ -34,12 +34,12 @@ let
       };
 
       hashes = {
-        "arria_lite" = "1flj9w0vb2p9f9zll136izr6qvmxn0lg72bvaqxs3sxc9vj06wm1";
+        "arria_lite" = "09g2knq23h3vj0s5y7hsdnqbbkr3pnv53dzpqcw2lq9mb5zfs9r0";
-        "cyclonev" = "0bqxpvjgph0y6slk0jq75mcqzglmqkm0jsx10y9xz5llm6zxzqab";
+        "cyclonev" = "05hrpysasyfb7xhxg68spdffxyvxcx0iagibd5jz643b7n6aalpa";
-        "cyclone" = "0pzs8y4s3snxg4g6lrb21qi88abm48g279xzd98qv17qxb2z82rr";
+        "cyclone" = "1x3rnwsvzrb5kwdz35sbcabxmcvj8xxpnjlpcjwfc69ybiyr6sgz";
-        "cyclone10lp" = "1ccxq8n20y40y47zddkijcv41w3cddvydddr3m4844q31in3nxha";
+        "cyclone10lp" = "1x6d4hm697mjgzaxixrw5va8anr6ihhx96x2524r6axpwqf6wcja";
-        "max" = "1cxzbqscxvlcy74dpqmvlnxjyyxfwcx3spygpvpwi6dfj3ipgm2z";
+        "max" = "060b7v0xh86kkjyiix7akfkzhx2kl1b3q117kp7xibnz6yrzwmy3";
-        "max10" = "14k83javivbk65mpb17wdwsyb8xk7x9gzj9x0wnd24mmijrvdy9s";
+        "max10" = "05840l9pmqa4i1b3ajfaxkqz1hppls556vbq16a42acz2qs2g578";
       };
 
       devicePackages = map (id: {
@@ -48,10 +48,10 @@ let
       }) (lib.attrValues supportedDeviceIds);
     in map require ([{
       name = "QuartusLiteSetup-${version}-linux.run";
-      sha256 = "15vxvqxqdk29ahlw3lkm1nzxyhzy4626wb9s5f2h6sjgq64r8m7f";
+      sha256 = "07ssrv8p8kacal6xd80n4h7l5xz13aw1m1gfqqaxig0ivsj971z5";
     } {
       name = "ModelSimSetup-${version}-linux.run";
-      sha256 = "0j1vfr91jclv88nam2plx68arxmz4g50sqb840i60wqd5b0l3y6r";
+      sha256 = "0smxasrmr1c8k6hy378knskpjmz4cgpgb35v5jclns0kx68y3c42";
     }] ++ devicePackages);
 
     nativeBuildInputs = [ unstick ];
@@ -81,9 +81,6 @@ let
         --disable-components ${lib.concatStringsSep "," disabledComponents} \
         --mode unattended --installdir $out --accept_eula 1
 
-      # This patch is from https://wiki.archlinux.org/index.php/Altera_Design_Software
-      patch --force --strip 0 --directory $out < ${./vsim.patch}
-
       rm -r $out/uninstall $out/logs
     '';
 

pkgs/applications/editors/quartus-prime/vsim.patch

@@ -1,11 +0,0 @@
---- modelsim_ase/vco     	1970-01-01 01:00:01.000000000 +0100
-+++ modelsim_ase/vco      	1970-01-01 01:00:01.000000000 +0100
-@@ -207,7 +207,7 @@
-           2.[5-9]*)         vco="linux" ;;
-           2.[1-9][0-9]*)    vco="linux" ;;
-           3.[0-9]*)    		vco="linux" ;;
--          *)                vco="linux_rh60" ;;
-+          *)                vco="linux" ;;
-         esac
-         if [ ! -x "$dir/$vco/vsim" ]; then
-           if [ -x "$dir/linuxle/vsim" ]; then

pkgs/applications/editors/tiled/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "tiled";
-  version = "1.3.5";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d1bs909vga1k494xnggq1mcjfxjrwa4acc0mj5rv73xqkc9mb2s";
+    sha256 = "1x8jymmc56di1c1wxalsp6qhcban2hahn70ndd097b8mx52gckjr";
   };
 
   nativeBuildInputs = [ pkgconfig qmake ];

pkgs/applications/editors/vscode/vscode.nix

@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0hmmqdamsjhjy1q8m85bs081cwmskpsp57rkj7vc2wj918wgissm";
+    x86_64-linux = "1c8gi2001p2f0zc165cqwwf9f8ls34fgg040qn9l08za7djb9hyv";
-    x86_64-darwin = "00xwvi53h9rnwyba12jmsp6grkymmn6vjibypaxb96q7q7p894gh";
+    x86_64-darwin = "06n17s3qa2jkmg5qx3zvshz6rvdx33dhxn65j0x5mi62dv93gjgg";
   }.${system};
 in
   callPackage ./generic.nix rec {
@@ -21,7 +21,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.46.0";
+    version = "1.46.1";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";

pkgs/applications/editors/vscode/vscodium.nix

@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "088nsflscak315704vqnh8m4q7601fczglbhdz5i70kfyg89ar4w";
+    x86_64-linux = "0l9sg2d0657k9dacy7k2jn8z07z50v8d1czgy4bkzbrj9vz7c6a7";
-    x86_64-darwin = "0fxpx1ydsag4gyn2kq5ddq55lpw15w176p3fypk80fyfix4kziqf";
+    x86_64-darwin = "0mnq0ykahwfrgs28rdy1jl366qyclipsr3apnmhym1xsylk0mpfx";
   }.${system};
 
   sourceRoot = {
@@ -27,7 +27,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.46.0";
+    version = "1.46.1";
     pname = "vscodium";
 
     executableName = "codium";

pkgs/applications/graphics/akira/default.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "akira";
-  version = "2019-10-12";
+  version = "2020-05-01";
 
   src = fetchFromGitHub {
     owner = "akiraux";
     repo = "Akira";
-    rev = "cab952dee4591b6bde34d670c1f853f5a3ff6b19";
+    rev = "87c495fa0a686b1e9b84aff7d9c0a9553da2c466";
-    sha256 = "1fp3a79hkh6xwwqqdrx4zqq2zhsm236c6fhhl5f2nmi108yxz04q";
+    sha256 = "0ikz6dyx0z2wqskas628hbrbhx3z5gy7i4acrvspfhhg6rk88aqd";
   };
 
   nativeBuildInputs = [
@@ -59,8 +59,6 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [ "-Dprofile=default" ];
 
-  patches = [ ./fix-build-with-vala-0-44-or-later.patch ];
-
   postPatch = ''
     chmod +x build-aux/meson/post_install.py
     patchShebangs build-aux/meson/post_install.py

pkgs/applications/graphics/akira/fix-build-with-vala-0-44-or-later.patch

@@ -1,88 +0,0 @@
-From bcda8fd53f6f232db0b6411269ba108af551629f Mon Sep 17 00:00:00 2001
-From: Alberto Fanjul <albertofanjul@gmail.com>
-Date: Tue, 9 Apr 2019 09:45:36 +0200
-Subject: [PATCH] Build on vala >= 0.44.2
-
----
- src/FileFormat/JsonObject.vala        |  2 +-
- src/FileFormat/JsonObjectArray.vala   |  2 +-
- src/FileFormat/ZipArchiveHandler.vala | 18 +++++++++++++++++-
- 3 files changed, 19 insertions(+), 3 deletions(-)
-
-diff --git a/src/FileFormat/JsonObject.vala b/src/FileFormat/JsonObject.vala
-index 7bfe46f..805fbad 100644
---- a/src/FileFormat/JsonObject.vala
-+++ b/src/FileFormat/JsonObject.vala
-@@ -31,7 +31,7 @@ public abstract class Akira.FileFormat.JsonObject : GLib.Object {
- 
-     private ObjectClass obj_class;
- 
--    public JsonObject.from_object (Json.Object object) {
-+    protected JsonObject.from_object (Json.Object object) {
-         Object (object: object);
-     }
- 
-diff --git a/src/FileFormat/JsonObjectArray.vala b/src/FileFormat/JsonObjectArray.vala
-index 4f6e573..d0a7dad 100644
---- a/src/FileFormat/JsonObjectArray.vala
-+++ b/src/FileFormat/JsonObjectArray.vala
-@@ -31,7 +31,7 @@ public abstract class Akira.FileFormat.JsonObjectArray : Object {
-      *
-      * Your JsonObject implementation should have it's own list of items
-      */
--    public JsonObjectArray (Json.Object object, string property_name) {
-+    protected JsonObjectArray (Json.Object object, string property_name) {
-         Object (object: object, property_name: property_name);
-     }
- 
-diff --git a/src/FileFormat/ZipArchiveHandler.vala b/src/FileFormat/ZipArchiveHandler.vala
-index ca60dd0..5d65aa2 100644
---- a/src/FileFormat/ZipArchiveHandler.vala
-+++ b/src/FileFormat/ZipArchiveHandler.vala
-@@ -262,11 +262,17 @@ public class Akira.FileFormat.ZipArchiveHandler : GLib.Object {
-                 continue;
-             }
- 
-+            Posix.off_t offset;
-+#if VALA_0_42
-+            uint8[] buffer;
-+            while (archive.read_data_block (out buffer, out offset) == Archive.Result.OK) {
-+                if (extractor.write_data_block (buffer, offset) != Archive.Result.OK) {
-+#else
-             void* buffer = null;
-             size_t buffer_length;
--            Posix.off_t offset;
-             while (archive.read_data_block (out buffer, out buffer_length, out offset) == Archive.Result.OK) {
-                 if (extractor.write_data_block (buffer, buffer_length, offset) != Archive.Result.OK) {
-+#endif
-                     break;
-                 }
-             }
-@@ -316,9 +322,15 @@ public class Akira.FileFormat.ZipArchiveHandler : GLib.Object {
-                     // Add an entry to the archive
-                     Archive.Entry entry = new Archive.Entry ();
-                     entry.set_pathname (initial_folder.get_relative_path (current_file));
-+#if VALA_0_42
-+                    entry.set_size ((Archive.int64_t) file_info.get_size ());
-+                    entry.set_filetype (Archive.FileType.IFREG);
-+                    entry.set_perm (Archive.FileType.IFREG);
-+#else
-                     entry.set_size (file_info.get_size ());
-                     entry.set_filetype ((uint) Posix.S_IFREG);
-                     entry.set_perm (0644);
-+#endif
- 
-                     if (archive.write_header (entry) != Archive.Result.OK) {
-                         critical ("Error writing '%s': %s (%d)", current_file.get_path (), archive.error_string (), archive.errno ());
-@@ -333,7 +345,11 @@ public class Akira.FileFormat.ZipArchiveHandler : GLib.Object {
-                             break;
-                         }
- 
-+#if VALA_0_42
-+                        archive.write_data (buffer[0:bytes_read]);
-+#else
-                         archive.write_data (buffer, bytes_read);
-+#endif
-                     }
-                 }
-             }

pkgs/applications/graphics/cloudcompare/default.nix

@@ -0,0 +1,82 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, dxflib
+, eigen
+, flann
+, gdal
+, LASzip
+, libLAS
+, pdal
+, qtbase
+, qtsvg
+, qttools
+, tbb
+, xercesc
+}:
+
+mkDerivation rec {
+  pname = "cloudcompare";
+  version = "2.11.0";
+
+  src = fetchFromGitHub {
+    owner = "CloudCompare";
+    repo = "CloudCompare";
+    rev = "v${version}";
+    sha256 = "02ahhhivgb9k1aygw1m35wdvhaizag1r98mb0r6zzrs5p4y64wlb";
+    # As of writing includes (https://github.com/CloudCompare/CloudCompare/blob/a1c589c006fc325e8b560c77340809b9c7e7247a/.gitmodules):
+    # * libE57Format
+    # * PoissonRecon
+    # In > 2.11 it will also contain
+    # * CCCoreLib
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    eigen # header-only
+  ];
+
+  buildInputs = [
+    dxflib
+    flann
+    gdal
+    LASzip
+    libLAS
+    pdal
+    qtbase
+    qtsvg
+    qttools
+    tbb
+    xercesc
+  ];
+
+  cmakeFlags = [
+    # TODO: This will become -DCCCORELIB_USE_TBB=ON in > 2.11.0, see
+    #       https://github.com/CloudCompare/CloudCompare/commit/f5a0c9fd788da26450f3fa488b2cf0e4a08d255f
+    "-DCOMPILE_CC_CORE_LIB_WITH_TBB=ON"
+    "-DOPTION_USE_DXF_LIB=ON"
+    "-DOPTION_USE_GDAL=ON"
+    "-DOPTION_USE_SHAPE_LIB=ON"
+
+    "-DPLUGIN_GL_QEDL=ON"
+    "-DPLUGIN_GL_QSSAO=ON"
+    "-DPLUGIN_IO_QADDITIONAL=ON"
+    "-DPLUGIN_IO_QCORE=ON"
+    "-DPLUGIN_IO_QCSV_MATRIX=ON"
+    "-DPLUGIN_IO_QE57=ON"
+    "-DPLUGIN_IO_QFBX=OFF" # Autodesk FBX SDK is gratis+proprietary; not packaged in nixpkgs
+    "-DPLUGIN_IO_QPDAL=ON" # required for .las/.laz support
+    "-DPLUGIN_IO_QPHOTOSCAN=ON"
+    "-DPLUGIN_IO_QRDB=OFF" # Riegl rdblib is proprietary; not packaged in nixpkgs
+  ];
+
+  meta = with lib; {
+    description = "3D point cloud and mesh processing software";
+    homepage = "https://cloudcompare.org";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ nh2 ];
+    platforms = with platforms; linux; # only tested here; might work on others
+  };
+}

pkgs/applications/graphics/pdfcpu/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "09z4z2csp7ld47q36x2id5zadaihisbnk7bkdvci826hwm8km7sl";
+    sha256 = "00c4psgfh4hia144zsdhrq83bw3fqda1ancv2gkn5ymxkbpnpyrn";
   };
 
   vendorSha256 = "09alkpfyxapycv6zsaz7prgbr0a1jzd78n7w2mh01mg4hhb2j3k7";

pkgs/applications/graphics/processing/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "processing";
-  version = "3.5.3";
+  version = "3.5.4";
 
   src = fetchFromGitHub {
     owner = "processing";
     repo = "processing";
-    rev = "processing-0269-${version}";
+    rev = "processing-0270-${version}";
-    sha256 = "0ajniy3a0i0rx7is46r85yh3ah4zm4ra1gbllmihw9pmnfjgfajn";
+    sha256 = "0cvv8jda9y8qnfcsziasyv3w7h3w22q78ihr23cm4an63ghxci58";
   };
 
   nativeBuildInputs = [ ant rsync makeWrapper ];
@@ -22,8 +22,10 @@ stdenv.mkDerivation rec {
     # do not download a file during build
     ${xmlstarlet}/bin/xmlstarlet ed --inplace -P -d '//get[@src="http://download.processing.org/reference.zip"]' build/build.xml
     install -D -m0444 ${fetchurl {
-                          url    = "http://download.processing.org/reference.zip";
+                          # Use archive.org link for reproducibility until the following issue is fixed:
-                          sha256 = "198bpk8mzns6w5h0zdf50wr6iv7sgdi6v7jznj5rbsnpgyilxz35";
+                          # https://github.com/processing/processing/issues/5711
+                          url = "https://web.archive.org/web/20200406132357/https://download.processing.org/reference.zip";
+                          sha256 = "093hc7kc9wfxqgf5dzfmfp68pbsy8x647cj0a25vgjm1swi61zbi";
                         }
                        } ./java/reference.zip
 

pkgs/applications/misc/ArchiSteamFarm/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.2.1";
+  version = "4.2.3.3";
 
   src = fetchurl {
     url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
-    sha256 = "0pr9rrhi44yl99c2i12rimmc4mhbh0ma9jn17cgsh8p0kbj8sq94";
+    sha256 = "0v69rrs5fr1n5llfx42xkiish52al7kb36fjy3ng0j9qfp3g8pj7";
   };
 
   nativeBuildInputs = [ unzip makeWrapper jq ];

pkgs/applications/misc/audio/wavesurfer/default.nix

@@ -20,9 +20,9 @@ stdenv.mkDerivation {
                  --prefix PATH : "${stdenv.lib.makeBinPath [ tcl tk ]}"
   '';
 
-  meta = { 
+  meta = {
     description = "Tool for recording, playing, editing, viewing and labeling of audio";
     homepage = "http://www.speech.kth.se/wavesurfer/";
-    license = "BSD";
+    license = stdenv.lib.licenses.bsd0;
   };
 }

pkgs/applications/misc/ausweisapp2/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "AusweisApp2";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = "${version}";
-    sha256 = "0qkwdaxhig4qjim7h20j6ln6w76ycppfc786nd8l69bd1qv46m40";
+    sha256 = "17ify6v4z8i8ps3s8qabnrqfkj0my4yzyqwk3q3nhrqilbnhr40x";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];

pkgs/applications/misc/batsignal/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, libnotify, pkg-config, glib }:
+
+stdenv.mkDerivation rec {
+  pname = "batsignal";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "electrickite";
+    repo = "batsignal";
+    rev = "${version}";
+    sha256 = "wy7YhgKfz07u0bp7rWpze+KmSdooOkmU7giaBX3wWkY=";
+  };
+
+  buildInputs = [ libnotify glib ];
+  nativeBuildInputs = [ pkg-config ];
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/electrickite/batsignal";
+    description = "Lightweight battery daemon written in C";
+    license = licenses.isc;
+    maintainers = with maintainers; [ SlothOfAnarchy ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/blender/default.nix

@@ -17,11 +17,11 @@ let python = python3Packages.python; in
 
 stdenv.mkDerivation rec {
   pname = "blender";
-  version = "2.83.0";
+  version = "2.83.1";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    sha256 = "07rzm4xaj94pjxy2vlqfhi1adsqpshfkrzrq8kljmcbnw22vrqhl";
+    sha256 = "1kd74nzqvpcpsb4lghnjj9z3ps93lzqbhkv3lp5p79rqs8y64i23";
   };
 
   patches = lib.optional stdenv.isDarwin ./darwin.patch;
@@ -57,6 +57,10 @@ stdenv.mkDerivation rec {
         --replace '${"$"}{LIBDIR}/python' \
                   '${python}'
       substituteInPlace build_files/cmake/platform/platform_apple.cmake \
+        --replace 'set(PYTHON_VERSION 3.7)' \
+                  'set(PYTHON_VERSION ${python.pythonVersion})' \
+        --replace '${"$"}{PYTHON_VERSION}m' \
+                  '${"$"}{PYTHON_VERSION}' \
         --replace '${"$"}{LIBDIR}/python' \
                   '${python}' \
         --replace '${"$"}{LIBDIR}/opencollada' \

pkgs/applications/misc/cheat/default.nix

@@ -3,13 +3,13 @@
 
 buildGoModule rec {
   pname = "cheat";
-  version = "3.10.1";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "cheat";
     repo = "cheat";
     rev = version;
-    sha256 = "0indvycj972wng979mvia8mrb7bwdfay7wxq3lnj05qyxqafj5h2";
+    sha256 = "0j9w2rm8imb15njj7334xl6w0fgjvfqnrfvdq4zfsrwzl67ds86l";
   };
 
   subPackages = [ "cmd/cheat" ];

pkgs/applications/misc/cherrytree/default.nix

@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "cherrytree";
-  version = "0.39.3";
+  version = "0.39.4";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "1k9i7acpphx0if6ij2p9fkmj638ry6hcyr1rdr039a8zi8hq98gz";
+    sha256 = "1wycgn1f3b858qb6kn2bsaabak8n52qkpd24w54xz6fjizlnw7x0";
 
   };
 

pkgs/applications/misc/clight/clightd.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clightd";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clightd";
     rev = version;
-    sha256 = "0pqnn52nn22k49f5cw4jcr8vcbff28n56i8fizg1mmfshy8pn891";
+    sha256 = "07z1m1x7nnczd51sg7m2lb6rb2c37c8glsnbrlq44hx176sj9cmj";
   };
 
   # dbus-1.pc has datadir=/etc

pkgs/applications/misc/ddcui/default.nix

@@ -0,0 +1,42 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, pkg-config
+, qtbase
+, qttools
+, ddcutil
+}:
+
+mkDerivation rec {
+  pname = "ddcui";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "rockowitz";
+    repo = "ddcui";
+    rev = "v${version}";
+    sha256 = "0myma1zw6dlygv3xbin662d91zcnwss10syf12q2fppkrd8qdgqf";
+  };
+
+  nativeBuildInputs = [
+    # Using cmake instead of the also-supported qmake because ddcui's qmake
+    # file is not currently written to support PREFIX installations.
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    qtbase
+    qttools
+    ddcutil
+  ];
+
+  meta = with lib; {
+    description = "Graphical user interface for ddcutil - control monitor settings";
+    homepage = "https://www.ddcutil.com/ddcui_main/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ nh2 ];
+    platforms = with platforms; linux;
+  };
+}

pkgs/applications/misc/fbmenugen/default.nix

@@ -11,13 +11,13 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "fbmenugen";
-  version = "2020-05-20";
+  version = "0.85";
 
   src = fetchFromGitHub {
     owner = "trizen";
     repo = pname;
-    rev = "ed9a680546edbb5b05086971b6a9f42a37cb485f";
+    rev = version;
-    sha256 = "1fikdl08a0s8d6k1ls1pzmw2rcwkfbbczsjfx6lr12ngd2bz222h";
+    sha256 = "1pmms3wzkm8h41a8zrkpn6gq9m9yy5wr5rrzmb84lbacprqq6q7q";
   };
 
   patches = [

pkgs/applications/misc/gmrun/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
       ./gmrun-0.9.2-xdg.patch
     ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Gnome Completion-Run Utility";
     longDescription = ''
       A simple program which provides a "run program" window, featuring a bash-like TAB completion.
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
       Running commands in a terminal with CTRL-Enter. URL handlers.
     '';
     homepage = "https://sourceforge.net/projects/gmrun/";
-    license = "GPL";
+    license = licenses.gpl2;
     maintainers = [];
-    platforms = stdenv.lib.platforms.all;
+    platforms = platforms.all;
   };
 }

pkgs/applications/misc/gpxsee/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "gpxsee";
-  version = "7.30";
+  version = "7.31";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "09gajwqc30r9a2sn972qdx3gx0gki9n0zafq986hn6zsr3z43mfs";
+    sha256 = "0y60h66p8ydkinxk9x4sp4cm6gq66nc9jcavy135vmycsiq9gphn";
   };
 
   patches = [

pkgs/applications/misc/k4dirstat/default.nix

@@ -0,0 +1,33 @@
+{ mkDerivation
+, extra-cmake-modules
+, fetchFromGitHub
+, kdoctools
+, kiconthemes
+, kio
+, kjobwidgets
+, kxmlgui
+, stdenv
+}:
+
+mkDerivation rec {
+  pname = "k4dirstat";
+  version = "3.2.1";
+
+  src = fetchFromGitHub {
+    owner = "jeromerobert";
+    repo = pname;
+    rev = version;
+    sha256 = "15xjb80jq6vhzvzx4l341f40d8a23w1334qh6cczqm9adfnzycp7";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [ kiconthemes kio kjobwidgets kxmlgui ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/jeromerobert/k4dirstat";
+    description = "A small utility program that sums up disk usage for directory trees";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.raboof ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/kanboard/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kanboard";
-  version = "1.2.14";
+  version = "1.2.15";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     rev = "v${version}";
-    sha256 = "11bwajzidnyagdyip7i8rwni1f66acv0k4lybdm0mc4195anivjh";
+    sha256 = "0lib2qlc8a59i9dak0g1j5hymwbq9vhflp5srhcjislxypfvrizs";
   };
 
   dontBuild = true;

pkgs/applications/misc/lutris/chrootenv.nix

@@ -97,7 +97,7 @@ in buildFHSUserEnv {
     libcap libtiff libva libgphoto2 libxslt libsndfile giflib zlib glib
     alsaLib zziplib bash dbus keyutils zip cabextract freetype unzip coreutils
     readline gcc SDL SDL2 curl graphite2 gtk2 gtk3 udev ncurses wayland libglvnd
-    vulkan-loader xdg_utils sqlite gnutls libbsd
+    vulkan-loader xdg_utils sqlite gnutls p11-kit libbsd
 
     # PCSX2 // TODO: "libgobject-2.0.so.0: wrong ELF class: ELFCLASS64"
 

pkgs/applications/misc/lutris/default.nix

@@ -1,9 +1,42 @@
 { buildPythonApplication, lib, fetchFromGitHub, fetchpatch
-, wrapGAppsHook, gobject-introspection, glib-networking, gnome-desktop, libnotify, libgnome-keyring, pango
+
-, gdk-pixbuf, atk, webkitgtk, gst_all_1
+# build inputs
-, dbus-python, evdev, pyyaml, pygobject3, requests, pillow
+, atk
-, xrandr, pciutils, psmisc, glxinfo, vulkan-tools, xboxdrv, pulseaudio, p7zip, xgamma
+, gdk-pixbuf
-, libstrangle, wine, fluidsynth, xorgserver
+, glib-networking
+, gnome-desktop
+, gobject-introspection
+, gst_all_1
+, gtk3
+, libgnome-keyring
+, libnotify
+, pango
+, webkitgtk
+, wrapGAppsHook
+
+# python dependencies
+, dbus-python
+, distro
+, evdev
+, pillow
+, pygobject3
+, pyyaml
+, requests
+
+# commands that lutris needs
+, xrandr
+, pciutils
+, psmisc
+, glxinfo
+, vulkan-tools
+, xboxdrv
+, pulseaudio
+, p7zip
+, xgamma
+, libstrangle
+, wine
+, fluidsynth
+, xorgserver
 }:
 
 let
@@ -25,34 +58,52 @@ let
   ];
 
   gstDeps = with gst_all_1; [
-    gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly
     gst-libav
+    gst-plugins-bad
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-ugly
+    gstreamer
   ];
 
 in buildPythonApplication rec {
   pname = "lutris-original";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "lutris";
     repo = "lutris";
     rev = "v${version}";
-    sha256 = "1g093g0difnkjmnm91p20issdsxn9ri4c56zzddj5wfrbmhwdfag";
+    sha256 = "1f78qhyy8xqdg0rhxcwkap1bmg5mfxhb8qw1vbpxr6g62ajpwksa";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
   buildInputs = [
-    gobject-introspection glib-networking gnome-desktop libnotify libgnome-keyring pango
+    atk
-    gdk-pixbuf atk webkitgtk
+    gdk-pixbuf
+    glib-networking
+    gnome-desktop
+    gobject-introspection
+    gtk3
+    libgnome-keyring
+    libnotify
+    pango
+    webkitgtk
   ] ++ gstDeps;
 
-  makeWrapperArgs = [
+  propagatedBuildInputs = [
-    "--prefix PATH : ${binPath}"
+    evdev distro pyyaml pygobject3 requests pillow dbus-python
   ];
 
-  propagatedBuildInputs = [
+  # avoid double wrapping
-    evdev pyyaml pygobject3 requests pillow dbus-python
+  dontWrapGApps = true;
+  makeWrapperArgs = [
+    "--prefix PATH : ${binPath}"
+    ''''${gappsWrapperArgs[@]}''
   ];
+  # needed for glib-schemas to work correctly (will crash on dialogues otherwise)
+  # see https://github.com/NixOS/nixpkgs/issues/56943
+  strictDeps = false;
 
   preCheck = "export HOME=$PWD";
 

pkgs/applications/misc/mrxvt/default.nix

@@ -27,14 +27,14 @@ stdenv.mkDerivation {
     sha256 = "1mqhmnlz32lvld9rc6c1hyz7gjw4anwf39yhbsjkikcgj1das0zl";
   };
 
-  meta = { 
+  meta = with stdenv.lib; {
     description = "Lightweight multitabbed feature-rich X11 terminal emulator";
     longDescription = "
-    	Multitabbed lightweight terminal emulator based on rxvt. 
+    	Multitabbed lightweight terminal emulator based on rxvt.
 	Supports transparency, backgroundimages, freetype fonts, ...
     ";
     homepage = "https://sourceforge.net/projects/materm";
-    license = "GPL";
+    license = licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/misc/nimmm/default.nix

@@ -0,0 +1,57 @@
+{ stdenv, fetchFromGitHub, nim, termbox, pcre }:
+
+let
+  noise = fetchFromGitHub {
+    owner = "jangko";
+    repo = "nim-noise";
+    rev = "db1e86e312413e4348fa82c02340784316a89cc1";
+    sha256 = "0n9l2dww5smrsl1xfqxjnxz3f1srb72lc1wl3pdvs6xfyf44qzlh";
+  };
+
+  nimbox = fetchFromGitHub {
+    owner = "dom96";
+    repo = "nimbox";
+    rev = "6a56e76c01481176f16ae29b7d7c526bd83f229b";
+    sha256 = "15x1sdfxa1xcqnr68705jfnlv83lm0xnp2z9iz3pgc4bz5vwn4x1";
+  };
+
+  lscolors = fetchFromGitHub {
+    owner = "joachimschmidt557";
+    repo = "nim-lscolors";
+    rev = "v0.3.3";
+    sha256 = "0526hqh46lcfsvymb67ldsc8xbfn24vicn3b8wrqnh6mag8wynf4";
+  };
+
+in stdenv.mkDerivation rec {
+  pname = "nimmm";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "joachimschmidt557";
+    repo = "nimmm";
+    rev = "v${version}";
+    sha256 = "1zpq181iz6g7yfi298gjwv33b89l4fpnkjprimykah7py5cpw67w";
+  };
+
+  nativeBuildInputs = [ nim ];
+  buildInputs = [ termbox pcre ];
+
+  NIX_LDFLAGS = "-lpcre";
+
+  buildPhase = ''
+    export HOME=$TMPDIR;
+    nim -p:${noise} -p:${nimbox} -p:${lscolors}/src c -d:release src/nimmm.nim
+  '';
+
+  installPhase = ''
+    install -Dt $out/bin src/nimmm
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Terminal file manager written in nim";
+    homepage = "https://github.com/joachimschmidt557/nimmm";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.joachimschmidt557 ];
+  };
+}

pkgs/applications/misc/obsidian/default.nix

@@ -0,0 +1,32 @@
+{ appimageTools, fetchurl, lib, gsettings-desktop-schemas, gtk3}:
+
+let
+  pname = "obsidian";
+  version = "0.7.3";
+in
+
+appimageTools.wrapType2 rec {
+
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/Obsidian-${version}.AppImage";
+    sha256 = "1qiag5szagalik72j8s2dmp7075g48jxgcdy0wgd02kfv90ai0y6";
+  };
+
+  profile = ''
+    export LC_ALL=C.UTF-8
+    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+  '';
+
+  # Strip version from binary name.
+  extraInstallCommands = "mv $out/bin/{${name},${pname}}";
+
+  meta = with lib; {
+    description = "Obsidian is a powerful knowledge base that works on top of a local folder of plain text Markdown files.";
+    homepage = "https://obsidian.md";
+    license = licenses.obsidian;
+    maintainers = with maintainers; [ conradmearns ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/misc/octoprint/default.nix

@@ -16,11 +16,17 @@ let
   py = python3.override {
     self = py;
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
-      (mkOverride "flask"       "0.12.5" "fac2b9d443e49f7e7358a444a3db5950bdd0324674d92ba67f8f1f15f876b14f")
+      (mkOverride "flask"            "0.12.5" "fac2b9d443e49f7e7358a444a3db5950bdd0324674d92ba67f8f1f15f876b14f")
-      (mkOverride "flaskbabel"  "0.12.2" "11jwp8vvq1gnm31qh6ihy2h393hy18yn9yjp569g60r0wj1x2sii")
+      (mkOverride "flask_assets"     "0.12"   "0ivqsihk994rxw58vdgzrx4d77d7lpzjm4qxb38hjdgvi5xm4cb0")
-      (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
+      (mkOverride "flaskbabel"       "0.12.2" "11jwp8vvq1gnm31qh6ihy2h393hy18yn9yjp569g60r0wj1x2sii")
-      (mkOverride "psutil"      "5.6.7"  "ffad8eb2ac614518bbe3c0b8eb9dffdb3a8d2e3a7d5da51c5b974fb723a5c5aa")
+      (mkOverride "flask_login"      "0.4.1"  "1v2j8zd558xfmgn3rfbw0xz4vizjcnk8kqw52q4f4d9ygfnc25f8")
-      (mkOverride "watchdog"    "0.9.0"  "07cnvvlpif7a6cg4rav39zq8fxa5pfqawchr46433pij0y6napwn")
+      (mkOverride "markdown"         "3.1.1"  "2e50876bcdd74517e7b71f3e7a76102050edec255b3983403f1a63e7c8a41e7a")
+      (mkOverride "tornado"          "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
+      (mkOverride "psutil"           "5.6.7"  "ffad8eb2ac614518bbe3c0b8eb9dffdb3a8d2e3a7d5da51c5b974fb723a5c5aa")
+      (mkOverride "watchdog"         "0.9.0"  "07cnvvlpif7a6cg4rav39zq8fxa5pfqawchr46433pij0y6napwn")
+      (mkOverride "werkzeug"         "0.16.1" "010zmhyfbp4d56c1rgalwi188imjlkv9g7rm25jrvify6xnqalxk")
+      (mkOverride "websocket_client" "0.56.0" "0fpxjyr74klnyis3yf6m54askl0h5dchxcwbfjsq92xng0455m8z")
+      (mkOverride "wrapt"            "1.11.2" "1q81762dgsgrd12f8qc39zk8s5wll3m5xc32jdmlf6cls4gh4njn")
 
       # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
       # This old version does not have updated test config for pytest 4,

pkgs/applications/misc/osmium-tool/default.nix

@@ -1,18 +1,47 @@
-{ stdenv, fetchFromGitHub, cmake, libosmium, protozero, boost, bzip2, zlib, expat }:
+{ stdenv
+, fetchFromGitHub
+, cmake
+, installShellFiles
+, pandoc
+, boost
+, bzip2
+, expat
+, libosmium
+, protozero
+, zlib
+}:
 
 stdenv.mkDerivation rec {
   pname = "osmium-tool";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "osmcode";
     repo = "osmium-tool";
     rev = "v${version}";
-    sha256 = "18afn5qzdjpip176kk5pr04mj0p7dv70dbz1n36qmqnq3gyms10q";
+    sha256 = "13142hj8gfgj6w51a62hjzfmzic90xgrnnlnb70hpdqjy86bxv7j";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
-  buildInputs = [ libosmium protozero boost bzip2 zlib expat ];
+    cmake
+    installShellFiles
+    pandoc
+  ];
+
+  buildInputs = [
+    boost
+    bzip2
+    expat
+    libosmium
+    protozero
+    zlib
+  ];
+
+  doCheck = true;
+
+  postInstall = ''
+    installShellCompletion --zsh ../zsh_completion/_osmium
+  '';
 
   meta = with stdenv.lib; {
     description = "Multipurpose command line tool for working with OpenStreetMap data based on the Osmium library";

pkgs/applications/misc/sbagen/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Binaural sound generator";
     homepage = "http://uazu.net/sbagen";
-    license = "GPL";
+    license = stdenv.lib.licenses.gpl2;
     platforms = [ "i686-linux" ];
   };
 }

pkgs/applications/misc/sequeler/default.nix

@@ -11,13 +11,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "sequeler";
-  version = "0.7.91";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "Alecaddd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "071vfx7bdf7hfa4784xz97vrj9x5aipgjbp30r00kg2zhg8wa2ls";
+    sha256 = "090plqnby2wxzr1waq5kz89w3269j363mgxwfz9g7qg55lddaahz";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig vala gettext wrapGAppsHook python3 desktop-file-utils ];

pkgs/applications/misc/simplenote/default.nix

@@ -16,10 +16,10 @@ let
 
   pname = "simplenote";
 
-  version = "1.17.0";
+  version = "1.19.0";
 
   sha256 = {
-    x86_64-linux = "14kjx4y3kvw7h8wk8mmkpx1288jscmd8bgl10bw6kcfigcwahpw3";
+    x86_64-linux = "1bvg8xlf2y9nz7dzs5jkr5b48hwmvhvb6m4ia1fyvnqqq46nz9wb";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {

pkgs/applications/misc/thinking-rock/default.nix

@@ -32,10 +32,10 @@ stdenv.mkDerivation {
 
   installPhase = ":";
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Task management system";
     homepage = "http://www.thinkingrock.com.au/";
-    license = "CDDL"; # Common Development and Distribution License
+    license = licenses.cddl;
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
   };
 }

pkgs/applications/misc/tilda/default.nix

@@ -7,13 +7,13 @@ with stdenv.lib;
 stdenv.mkDerivation rec {
 
   pname = "tilda";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "lanoxx";
     repo = "tilda";
     rev = "${pname}-${version}";
-    sha256 = "1kk69sg7ph906yr5jagkjx0qfkhr5w2nyx407wl2dsjimbps44rd";
+    sha256 = "0psq0f4s0s92bba6wwcf6b0j7i59b76svqxhvpavwv53yvhmmamn";
   };
 
   nativeBuildInputs = [ autoreconfHook makeWrapper pkgconfig ];

pkgs/applications/misc/tint2/default.nix

@@ -1,7 +1,25 @@
-{ stdenv, fetchFromGitLab, pkgconfig, cmake, gettext, cairo, pango, pcre
+{ stdenv
-, glib, imlib2, gtk2, libXinerama, libXrender, libXcomposite, libXdamage
+, fetchFromGitLab
-, libX11, libXrandr, librsvg, libpthreadstubs, libXdmcp
+, pkg-config
-, libstartup_notification, wrapGAppsHook
+, cmake
+, gettext
+, cairo
+, pango
+, pcre
+, glib
+, imlib2
+, gtk2
+, libXinerama
+, libXrender
+, libXcomposite
+, libXdamage
+, libX11
+, libXrandr
+, librsvg
+, libpthreadstubs
+, libXdmcp
+, libstartup_notification
+, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -15,13 +33,35 @@ stdenv.mkDerivation rec {
     sha256 = "1937z0kixb6r82izj12jy4x8z4n96dfq1hx05vcsvsg1sx3wxgb0";
   };
 
-  enableParallelBuilding = true;
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    gettext
+    wrapGAppsHook
+  ];
 
-  nativeBuildInputs = [ pkgconfig cmake gettext wrapGAppsHook ];
+  buildInputs = [
+    cairo
+    pango
+    pcre
+    glib
+    imlib2
+    gtk2
+    libXinerama
+    libXrender
+    libXcomposite
+    libXdamage
+    libX11
+    libXrandr
+    librsvg
+    libpthreadstubs
+    libXdmcp
+    libstartup_notification
+  ];
 
-  buildInputs = [ cairo pango pcre glib imlib2 gtk2 libXinerama libXrender
+  cmakeFlags = [
-    libXcomposite libXdamage libX11 libXrandr librsvg libpthreadstubs
+    "-Ddocdir=share/doc/${pname}"
-    libXdmcp libstartup_notification ];
+  ];
 
   postPatch = ''
     for f in ./src/launcher/apps-common.c \

pkgs/applications/misc/toot/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
-  version = "0.26.0";
+  version = "0.27.0";
   name    = "toot-${version}";
 
   src = fetchFromGitHub {
     owner  = "ihabunek";
     repo   = "toot";
     rev    = version;
-    sha256 = "146jj83jixahgxwh12bbkfvci2wrz398h5x01kgppdy59m4pa4pl";
+    sha256 = "197g9lvwg8qnsf18kifcqdj3cpfdnxz9vay766rn9bi4nfz0s6j2";
   };
 
   checkInputs = with python3Packages; [ pytest ];
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication rec {
   meta = with stdenv.lib; {
     description = "Mastodon CLI interface";
     homepage    = "https://github.com/ihabunek/toot";
-    license     = licenses.mit;
+    license     = licenses.gpl3;
     maintainers = [ maintainers.matthiasbeyer ];
   };
 

pkgs/applications/misc/tut/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "tut";
-  version = "0.0.9";
+  version = "0.0.10";
 
   goPackagePath = "github.com/RasmusLindroth/tut";
   goDeps = ./deps.nix;
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "19y6brw1d6dlp2gnkdpbp261662h5j46rmiqg73cxhrlws0y0kfk";
+    sha256 = "09l6dmzrvcpix3wg4djs6zk3ql6b6lfhd8z9aglbi6fix4pm8565";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/misc/xpdf/libxpdf.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     url = "ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02.tar.gz";
     sha256 = "000zq4ddbwyxiki4vdwpmxbnw5n9hsg9hvwra2p33hslyib7sfmk";
   };
-  
+
   patches = [
     (fetchurl {
       url = "ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl1.patch";
@@ -39,14 +39,15 @@ stdenv.mkDerivation {
     cp -v goo/libGoo.a $out/lib/goo
     cp -v fofi/libfofi.a $out/lib/fofi
     cp -v xpdf/libxpdf.a $out/lib/xpdf
-    
+
     cp -v *.h $out/include
     cp -v goo/*.h $out/include
     cp -v fofi/*.h $out/include
     cp -v xpdf/*.h $out/include
   '';
-    
+
-  meta = {
+  meta = with stdenv.lib; {
-    platforms = stdenv.lib.platforms.unix;
+    platforms = platforms.unix;
+    license = licenses.gpl2;
   };
 }

pkgs/applications/networking/browsers/castor/default.nix

@@ -21,7 +21,6 @@ rustPlatform.buildRustPackage rec {
   };
 
   cargoSha256 = "04w49wka1vkb295lk6fzd6c5rwhzrqkp26hd5d94rx7bhcjmmb9w";
-  verifyCargoDeps = true;
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/networking/browsers/elinks/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, xlibsWrapper, bzip2, zlib, openssl
+{ stdenv, fetchurl, fetchpatch, ncurses, xlibsWrapper, bzip2, zlib, openssl
 , gpm
 , # Incompatible licenses, LGPLv3 - GPLv2
   enableGuile        ? false,                                         guile ? null
@@ -10,11 +10,12 @@
 assert enableGuile -> guile != null;
 assert enablePython -> python != null;
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "elinks-0.12pre6";
+  pname = "elinks";
+  version = "0.12pre6";
 
   src = fetchurl {
-    url = "http://elinks.or.cz/download/elinks-0.12pre6.tar.bz2";
+    url = "http://elinks.or.cz/download/${pname}-${version}.tar.bz2";
     sha256 = "1nnakbi01g7yd3zqwprchh5yp45br8086b0kbbpmnclabcvlcdiq";
   };
 
@@ -23,7 +24,15 @@ stdenv.mkDerivation {
     ./openssl-1.1.patch
   ];
 
-  buildInputs = [ ncurses xlibsWrapper bzip2 zlib openssl spidermonkey gpm ]
+  postPatch = (stdenv.lib.optional stdenv.isDarwin) ''
+    patch -p0 < ${fetchpatch {
+      url = "https://raw.githubusercontent.com/macports/macports-ports/72bed7749e76b9092ddd8d9fe2d8449c5afb1d71/www/elinks/files/patch-perl.diff";
+      sha256 = "14q9hk3kg2n2r5b062hvrladp7b4yzysvhq07903w9kpg4zdbyqh";
+    }}
+  '';
+
+  buildInputs = [ ncurses xlibsWrapper bzip2 zlib openssl spidermonkey ]
+    ++ stdenv.lib.optional stdenv.isLinux gpm
     ++ stdenv.lib.optional enableGuile guile
     ++ stdenv.lib.optional enablePython python
     ++ stdenv.lib.optional enablePerl perl
@@ -44,10 +53,10 @@ stdenv.mkDerivation {
     ++ stdenv.lib.optional enableSpidermonkey "--with-spidermonkey=${spidermonkey}"
     ;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Full-featured text-mode web browser";
     homepage = "http://elinks.or.cz";
-    license = stdenv.lib.licenses.gpl2;
+    license = licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }

pkgs/applications/networking/browsers/kristall/default.nix

@@ -2,12 +2,12 @@
 
 mkDerivation rec {
   pname = "kristall";
-  version = "0.2";
+  version = "0.3";
   src = fetchFromGitHub {
     owner = "MasterQ32";
     repo = "kristall";
     rev = "V" + version;
-    sha256 = "08k3rg0sa91ra0nzla5rw806nnncnyvq1s7k09k5i74fvcsnpqyp";
+    sha256 = "07nf7w6ilzs5g6isnvsmhh4qa1zsprgjyf0zy7rhpx4ikkj8c8zq";
   };
 
   buildInputs = [ qtbase qtmultimedia ];
@@ -25,6 +25,7 @@ mkDerivation rec {
         "Graphical small-internet client, supports gemini, http, https, gopher, finger";
       homepage = "https://random-projects.net/projects/kristall.gemini";
       maintainers = with maintainers; [ ehmry ];
+      license = licenses.gpl3;
       inherit (qtmultimedia.meta) platforms;
     };
 }