Merge master into staging-next

2024-12-26 04:43:09 +03:00 · 2020-09-06 18:14:23 +02:00 · 2020-09-06 18:14:23 +02:00 · d362c0e54e
commit d362c0e54e
parent 08eb704bc3 2dd41576fb
197 changed files with 2092 additions and 832 deletions
--- a/doc/stdenv/multiple-output.xml
+++ b/doc/stdenv/multiple-output.xml
@ -22,39 +22,69 @@
    The reduction effects could be instead achieved by building the parts in completely separate derivations. That would often additionally reduce build-time closures, but it tends to be much harder to write such derivations, as build systems typically assume all parts are being built at once. This compromise approach of single source package producing multiple binary packages is also utilized often by rpm and deb.
   </para>
  </note>
+
+  <para>
+   A number of attributes can be used to work with a derivation with multiple outputs. The attribute <varname>outputs</varname> is a list of strings, which are the names of the outputs. For each of these names, an identically named attribute is created, corresponding to that output. The attribute <varname>meta.outputsToInstall</varname> is used to determine the default set of outputs to install when using the derivation name unqualified.
+  </para>
+
 </section>
 <section xml:id="sec-multiple-outputs-installing">
  <title>Installing a split package</title>

  <para>
-   When installing a package via <varname>systemPackages</varname> or <command>nix-env</command> you have several options:
+   When installing a package with multiple outputs, the package's <varname>meta.outputsToInstall</varname> attribute determines which outputs are actually installed. <varname>meta.outputsToInstall</varname> is a list whose <link xlink:href="https://github.com/NixOS/nixpkgs/blob/f1680774340d5443a1409c3421ced84ac1163ba9/pkgs/stdenv/generic/make-derivation.nix#L310-L320">default installs binaries and the associated man pages</link>. The following sections describe ways to install different outputs.
  </para>

-  <itemizedlist>
-   <listitem>
-    <para>
-     You can install particular outputs explicitly, as each is available in the Nix language as an attribute of the package. The <varname>outputs</varname> attribute contains a list of output names.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     You can let it use the default outputs. These are handled by <varname>meta.outputsToInstall</varname> attribute that contains a list of output names.
-    </para>
-    <para>
-     TODO: more about tweaking the attribute, etc.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     NixOS provides configuration option <varname>environment.extraOutputsToInstall</varname> that allows adding extra outputs of <varname>environment.systemPackages</varname> atop the default ones. It's mainly meant for documentation and debug symbols, and it's also modified by specific options.
-    </para>
-    <note>
+  <section xml:id="sec-multiple-outputs-installing-nixos">
+   <title>Selecting outputs to install via NixOS</title>
+
+   <para>
+    NixOS provides two ways to select the outputs to install for packages listed in <varname>environment.systemPackages</varname>:
+   </para>
+
+   <itemizedlist>
+    <listitem>
     <para>
-      At this moment there is no similar configurability for packages installed by <command>nix-env</command>. You can still use approach from <xref linkend="sec-modify-via-packageOverrides" /> to override <varname>meta.outputsToInstall</varname> attributes, but that's a rather inconvenient way.
+      The configuration option <varname>environment.extraOutputsToInstall</varname> is appended to each package's <varname>meta.outputsToInstall</varname> attribute to determine the outputs to install. It can for example be used to install <literal>info</literal> documentation or debug symbols for all packages.
     </para>
-    </note>
-   </listitem>
-  </itemizedlist>
+    </listitem>
+    <listitem>
+     <para>
+      The outputs can be listed as packages in <varname>environment.systemPackages</varname>. For example, the <literal>"out"</literal> and <literal>"info"</literal> outputs for the <varname>coreutils</varname> package can be installed by including <varname>coreutils</varname> and <varname>coreutils.info</varname> in <varname>environment.systemPackages</varname>.
+     </para>
+    </listitem>
+   </itemizedlist>
+  </section>
+
+  <section xml:id="sec-multiple-outputs-installing-nix-env">
+   <title>Selecting outputs to install via <command>nix-env</command></title>
+
+   <para>
+    <command>nix-env</command> lacks an easy way to select the outputs to install. When installing a package, <command>nix-env</command> always installs the outputs listed in <varname>meta.outputsToInstall</varname>, even when the user explicitly selects an output.
+   </para>
+
+   <warning>
+    <para>
+     <command>nix-env</command> silenty disregards the outputs selected by the user, and instead installs the outputs from <varname>meta.outputsToInstall</varname>. For example,
+    </para>
+<programlisting>$ nix-env -iA nixpkgs.coreutils.info</programlisting>
+    <para>
+     installs the <literal>"out"</literal> output (<varname>coreutils.meta.outputsToInstall</varname> is <literal>[ "out" ]</literal>) instead of the requested <literal>"info"</literal>.
+    </para>
+   </warning>
+
+   <para>
+    The only recourse to select an output with <command>nix-env</command> is to override the package's <varname>meta.outputsToInstall</varname>, using the functions described in <xref linkend="chap-overrides" />. For example, the following overlay adds the <literal>"info"</literal> output for the <varname>coreutils</varname> package:
+   </para>
+
+<programlisting>self: super:
+{
+  coreutils = super.coreutils.overrideAttrs (oldAttrs: {
+    meta = oldAttrs.meta // { outputsToInstall = oldAttrs.meta.outputsToInstall or [ "out" ] ++ [ "info" ]; };
+  });
+}
+</programlisting>
+  </section>
 </section>
 <section xml:id="sec-multiple-outputs-using-split-packages">
  <title>Using a split package</title>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1873,6 +1873,12 @@
    githubId = 1918;
    name = "David Anderson";
  };
+  dandellion = {
+    email = "daniel@dodsorf.as";
+    github = "dali99";
+    githubId = 990767;
+    name = "Daniel Olsen";
+  };
  danharaj = {
    email = "dan@obsidian.systems";
    github = "danharaj";
@ -3633,6 +3639,12 @@
    githubId = 26877687;
    name = "Yurii Izorkin";
  };
+  j0hax = {
+    name = "Johannes Arnold";
+    email = "johannes.arnold@stud.uni-hannover.de";
+    github = "j0hax";
+    githubId = 3802620;
+  };
  jacg = {
    name = "Jacek Generowicz";
    email = "jacg@my-post-office.net";
--- a/nixos/doc/manual/man-nixos-install.xml
+++ b/nixos/doc/manual/man-nixos-install.xml
@ -45,6 +45,10 @@
     <replaceable>path</replaceable>
   </arg>

+   <arg>
+    <option>--flake</option> <replaceable>flake-uri</replaceable>
+   </arg>
+
   <arg>
     <arg choice='plain'>
       <option>--channel</option>
@ -199,6 +203,18 @@
     </para>
    </listitem>
   </varlistentry>
+   <varlistentry>
+    <term>
+     <option>--flake</option> <replaceable>flake-uri</replaceable>#<replaceable>name</replaceable>
+    </term>
+    <listitem>
+     <para>
+      Build the NixOS system from the specified flake.
+      The flake must contain an output named
+      <literal>nixosConfigurations.<replaceable>name</replaceable></literal>.
+     </para>
+    </listitem>
+   </varlistentry>
   <varlistentry>
     <term>
       <option>--channel</option>
--- a/nixos/doc/manual/man-nixos-rebuild.xml
+++ b/nixos/doc/manual/man-nixos-rebuild.xml
@ -521,7 +521,7 @@

   <varlistentry>
    <term>
-     <option>--flake</option> <replaceable>flake-uri</replaceable>[<replaceable>name</replaceable>]
+     <option>--flake</option> <replaceable>flake-uri</replaceable><optional>#<replaceable>name</replaceable></optional>
    </term>
    <listitem>
     <para>
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -1059,6 +1059,12 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
      removed, as it depends on libraries from deepin.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       The <literal>opendkim</literal> module now uses systemd sandboxing features
+       to limit the exposure of the system towards the opendkim service.
+     </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -63,18 +63,12 @@ rec {
          mkdir -p $out

          LOGFILE=/dev/null tests='exec(os.environ["testScript"])' ${driver}/bin/nixos-test-driver
-
-          for i in */xchg/coverage-data; do
-            mkdir -p $out/coverage-data
-            mv $i $out/coverage-data/$(dirname $(dirname $i))
-          done
        '';
    };


  makeTest =
    { testScript
-    , makeCoverageReport ? false
    , enableOCR ? false
    , name ? "unnamed"
    # Skip linting (mainly intended for faster dev cycles)
@ -153,7 +147,6 @@ rec {
      };

      test = passMeta (runTests driver);
-      report = passMeta (releaseTools.gcovReport { coverageRuns = [ test ]; });

      nodeNames = builtins.attrNames nodes;
      invalidNodeNames = lib.filter
@ -169,7 +162,7 @@ rec {
          Please stick to alphanumeric chars and underscores as separation.
        ''
      else
-        (if makeCoverageReport then report else test) // {
+        test // {
          inherit nodes driver test;
        };

--- a/nixos/modules/installer/tools/nixos-install.sh
+++ b/nixos/modules/installer/tools/nixos-install.sh
@ -10,6 +10,7 @@ umask 0022

 # Parse the command line for the -I flag
 extraBuildFlags=()
+flakeFlags=()

 mountPoint=/mnt
 channelPath=
@ -34,6 +35,23 @@ while [ "$#" -gt 0 ]; do
        --system|--closure)
            system="$1"; shift 1
            ;;
+        --flake)
+          flake="$1"
+          flakeFlags=(--experimental-features 'nix-command flakes')
+          shift 1
+          ;;
+        --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
+          lockFlags+=("$i")
+          ;;
+        --update-input)
+          j="$1"; shift 1
+          lockFlags+=("$i" "$j")
+          ;;
+        --override-input)
+          j="$1"; shift 1
+          k="$1"; shift 1
+          lockFlags+=("$i" "$j" "$k")
+          ;;
        --channel)
            channelPath="$1"; shift 1
            ;;
@ -92,14 +110,32 @@ if [[ ${NIXOS_CONFIG:0:1} != / ]]; then
    exit 1
 fi

-if [[ ! -e $NIXOS_CONFIG && -z $system ]]; then
+if [[ -n $flake ]]; then
+    if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
+       flake="${BASH_REMATCH[1]}"
+       flakeAttr="${BASH_REMATCH[2]}"
+    fi
+    if [[ -z "$flakeAttr" ]]; then
+        echo "Please specify the name of the NixOS configuration to be installed, as a URI fragment in the flake-uri."
+        echo "For example, to use the output nixosConfigurations.foo from the flake.nix, append \"#foo\" to the flake-uri."
+        exit 1
+    fi
+    flakeAttr="nixosConfigurations.\"$flakeAttr\""
+fi
+
+# Resolve the flake.
+if [[ -n $flake ]]; then
+    flake=$(nix "${flakeFlags[@]}" flake info --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
+fi
+
+if [[ ! -e $NIXOS_CONFIG && -z $system && -z $flake ]]; then
    echo "configuration file $NIXOS_CONFIG doesn't exist"
    exit 1
 fi

 # A place to drop temporary stuff.
-tmpdir="$(mktemp -d -p $mountPoint)"
-trap "rm -rf $tmpdir" EXIT
+tmpdir="$(mktemp -d -p "$mountPoint")"
+trap 'rm -rf $tmpdir' EXIT

 # store temporary files on target filesystem by default
 export TMPDIR=${TMPDIR:-$tmpdir}
@ -108,12 +144,19 @@ sub="auto?trusted=1"

 # Build the system configuration in the target filesystem.
 if [[ -z $system ]]; then
-    echo "building the configuration in $NIXOS_CONFIG..."
    outLink="$tmpdir/system"
-    nix-build --out-link "$outLink" --store "$mountPoint" "${extraBuildFlags[@]}" \
-        --extra-substituters "$sub" \
-        '<nixpkgs/nixos>' -A system -I "nixos-config=$NIXOS_CONFIG" ${verbosity[@]}
-    system=$(readlink -f $outLink)
+    if [[ -z $flake ]]; then
+        echo "building the configuration in $NIXOS_CONFIG..."
+        nix-build --out-link "$outLink" --store "$mountPoint" "${extraBuildFlags[@]}" \
+            --extra-substituters "$sub" \
+            '<nixpkgs/nixos>' -A system -I "nixos-config=$NIXOS_CONFIG" "${verbosity[@]}"
+    else
+        echo "building the flake in $flake..."
+        nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.toplevel" \
+            --extra-substituters "$sub" "${verbosity[@]}" \
+            "${extraBuildFlags[@]}" "${lockFlags[@]}" --out-link "$outLink"
+    fi
+    system=$(readlink -f "$outLink")
 fi

 # Set the system profile to point to the configuration. TODO: combine
@ -121,7 +164,7 @@ fi
 # a progress bar.
 nix-env --store "$mountPoint" "${extraBuildFlags[@]}" \
        --extra-substituters "$sub" \
-        -p $mountPoint/nix/var/nix/profiles/system --set "$system" ${verbosity[@]}
+        -p "$mountPoint"/nix/var/nix/profiles/system --set "$system" "${verbosity[@]}"

 # Copy the NixOS/Nixpkgs sources to the target as the initial contents
 # of the NixOS channel.
@ -131,12 +174,12 @@ if [[ -z $noChannelCopy ]]; then
    fi
    if [[ -n $channelPath ]]; then
        echo "copying channel..."
-        mkdir -p $mountPoint/nix/var/nix/profiles/per-user/root
+        mkdir -p "$mountPoint"/nix/var/nix/profiles/per-user/root
        nix-env --store "$mountPoint" "${extraBuildFlags[@]}" --extra-substituters "$sub" \
-                -p $mountPoint/nix/var/nix/profiles/per-user/root/channels --set "$channelPath" --quiet \
-                ${verbosity[@]}
-        install -m 0700 -d $mountPoint/root/.nix-defexpr
-        ln -sfn /nix/var/nix/profiles/per-user/root/channels $mountPoint/root/.nix-defexpr/channels
+                -p "$mountPoint"/nix/var/nix/profiles/per-user/root/channels --set "$channelPath" --quiet \
+                "${verbosity[@]}"
+        install -m 0700 -d "$mountPoint"/root/.nix-defexpr
+        ln -sfn /nix/var/nix/profiles/per-user/root/channels "$mountPoint"/root/.nix-defexpr/channels
    fi
 fi

@ -150,7 +193,7 @@ touch "$mountPoint/etc/NIXOS"
 if [[ -z $noBootLoader ]]; then
    echo "installing the boot loader..."
    # Grub needs an mtab.
-    ln -sfn /proc/mounts $mountPoint/etc/mtab
+    ln -sfn /proc/mounts "$mountPoint"/etc/mtab
    NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root "$mountPoint" -- /run/current-system/bin/switch-to-configuration boot
 fi

--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@ -17,6 +17,7 @@ showSyntax() {
 origArgs=("$@")
 extraBuildFlags=()
 lockFlags=()
+flakeFlags=()
 action=
 buildNix=1
 fast=
@ -99,6 +100,7 @@ while [ "$#" -gt 0 ]; do
        ;;
      --flake)
        flake="$1"
+        flakeFlags=(--experimental-features 'nix-command flakes')
        shift 1
        ;;
      --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
@ -281,7 +283,7 @@ fi

 # Resolve the flake.
 if [[ -n $flake ]]; then
-    flake=$(nix flake info --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
+    flake=$(nix "${flakeFlags[@]}" flake info --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
 fi

 # Find configuration.nix and open editor instead of building.
@ -293,7 +295,7 @@ if [ "$action" = edit ]; then
        fi
        exec ${EDITOR:-nano} "$NIXOS_CONFIG"
    else
-        exec nix edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
+        exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
    fi
    exit 1
 fi
@ -419,7 +421,7 @@ if [ -z "$rollback" ]; then
            pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
        else
            outLink=$tmpDir/result
-            nix build "$flake#$flakeAttr.config.system.build.toplevel" \
+            nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.toplevel" \
              "${extraBuildFlags[@]}" "${lockFlags[@]}" --out-link $outLink
            pathToConfig="$(readlink -f $outLink)"
        fi
@ -429,7 +431,7 @@ if [ -z "$rollback" ]; then
        if [[ -z $flake ]]; then
            pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
        else
-            nix build "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}"
+            nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}"
            pathToConfig="$(readlink -f ./result)"
        fi
    elif [ "$action" = build-vm ]; then
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -22,7 +22,7 @@ let
    src = ./nixos-install.sh;
    inherit (pkgs) runtimeShell;
    nix = config.nix.package.out;
-    path = makeBinPath [ nixos-enter ];
+    path = makeBinPath [ pkgs.nixUnstable nixos-enter ];
  };

  nixos-rebuild =
--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@ -25,7 +25,7 @@ let
      exit 0
    fi

-    ${getBin pkgs.tmux}/bin/tmux -S /var/lib/terraria/terraria.sock send-keys Enter exit Enter
+    ${getBin pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/terraria.sock send-keys Enter exit Enter
    ${getBin pkgs.coreutils}/bin/tail --pid="$1" -f /dev/null
  '';
 in
@ -36,7 +36,7 @@ in
        type        = types.bool;
        default     = false;
        description = ''
-          If enabled, starts a Terraria server. The server can be connected to via <literal>tmux -S /var/lib/terraria/terraria.sock attach</literal>
+          If enabled, starts a Terraria server. The server can be connected to via <literal>tmux -S ${cfg.dataDir}/terraria.sock attach</literal>
          for administration by users who are a part of the <literal>terraria</literal> group (use <literal>C-b d</literal> shortcut to detach again).
        '';
      };
@ -111,13 +111,19 @@ in
        default     = false;
        description = "Disables automatic Universal Plug and Play.";
      };
+      dataDir = mkOption {
+        type        = types.str;
+        default     = "/var/lib/terraria";
+        example     = "/srv/terraria";
+        description = "Path to variable state data directory for terraria.";
+      };
    };
  };

  config = mkIf cfg.enable {
    users.users.terraria = {
      description = "Terraria server service user";
-      home        = "/var/lib/terraria";
+      home        = cfg.dataDir;
      createHome  = true;
      uid         = config.ids.uids.terraria;
    };
@ -136,13 +142,13 @@ in
        User    = "terraria";
        Type = "forking";
        GuessMainPID = true;
-        ExecStart = "${getBin pkgs.tmux}/bin/tmux -S /var/lib/terraria/terraria.sock new -d ${pkgs.terraria-server}/bin/TerrariaServer ${concatStringsSep " " flags}";
+        ExecStart = "${getBin pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/terraria.sock new -d ${pkgs.terraria-server}/bin/TerrariaServer ${concatStringsSep " " flags}";
        ExecStop = "${stopScript} $MAINPID";
      };

      postStart = ''
-        ${pkgs.coreutils}/bin/chmod 660 /var/lib/terraria/terraria.sock
-        ${pkgs.coreutils}/bin/chgrp terraria /var/lib/terraria/terraria.sock
+        ${pkgs.coreutils}/bin/chmod 660 ${cfg.dataDir}/terraria.sock
+        ${pkgs.coreutils}/bin/chgrp terraria ${cfg.dataDir}/terraria.sock
      '';
    };
  };
--- a/nixos/modules/services/mail/opendkim.nix
+++ b/nixos/modules/services/mail/opendkim.nix
@ -129,6 +129,36 @@ in {
        User = cfg.user;
        Group = cfg.group;
        RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
+        StateDirectory = "opendkim";
+        StateDirectoryMode = "0700";
+        ReadWritePaths = [ cfg.keyPath ];
+
+        AmbientCapabilities = [];
+        CapabilityBoundingSet = [];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6 AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged @resources" ];
+        UMask = "0077";
      };
    };

--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -783,6 +783,23 @@ in {
      };
    };

+    systemd.services.gitlab-mailroom = mkIf (gitlabConfig.production.incoming_email.enabled or false) {
+      description = "GitLab incoming mail daemon";
+      after = [ "network.target" "redis.service" "gitlab.service" ]; # gitlab.service creates configs
+      wantedBy = [ "multi-user.target" ];
+      environment = gitlabEnv;
+      serviceConfig = {
+        Type = "simple";
+        TimeoutSec = "infinity";
+        Restart = "on-failure";
+
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/bundle exec mail_room -c ${cfg.packages.gitlab}/share/gitlab/config.dist/mail_room.yml";
+        WorkingDirectory = gitlabEnv.HOME;
+      };
+    };
+
    systemd.services.gitlab = {
      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
      requires = [ "gitlab-sidekiq.service" ];
--- a/nixos/modules/services/misc/gitlab.xml
+++ b/nixos/modules/services/misc/gitlab.xml
@ -97,6 +97,12 @@ services.gitlab = {
   state folder.
  </para>

+  <para>
+    When <literal>icoming_mail.enabled</literal> is set to <literal>true</literal>
+    in <link linkend="opt-services.gitlab.extraConfig">extraConfig</link> an additional
+    service called <literal>gitlab-mailroom</literal> is enabled for fetching incoming mail.
+  </para>
+
  <para>
   Refer to <xref linkend="ch-options" /> for all available configuration
   options for the
--- a/nixos/modules/services/network-filesystems/cachefilesd.nix
+++ b/nixos/modules/services/network-filesystems/cachefilesd.nix
@ -43,17 +43,21 @@ in

  config = mkIf cfg.enable {

+    boot.kernelModules = [ "cachefiles" ];
+
    systemd.services.cachefilesd = {
      description = "Local network file caching management daemon";
      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.kmod pkgs.cachefilesd ];
-      script = ''
-        modprobe -qab cachefiles
-        mkdir -p ${cfg.cacheDir}
-        chmod 700 ${cfg.cacheDir}
-        exec cachefilesd -n -f ${cfgFile}
-      '';
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${pkgs.cachefilesd}/bin/cachefilesd -n -f ${cfgFile}";
+        Restart = "on-failure";
+        PrivateTmp = true;
+      };
    };

+    systemd.tmpfiles.rules = [
+      "d ${cfg.cacheDir} 0700 root root - -"
+    ];
  };
 }
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@ -18,6 +18,7 @@ let
    fsWatcherEnabled = folder.watch;
    fsWatcherDelayS = folder.watchDelay;
    ignorePerms = folder.ignorePerms;
+    ignoreDelete = folder.ignoreDelete;
    versioning = folder.versioning;
  }) (filterAttrs (
    _: folder:
@ -284,8 +285,6 @@ in {
                });
              };

-
-
              rescanInterval = mkOption {
                type = types.int;
                default = 3600;
@ -327,6 +326,16 @@ in {
                '';
              };

+              ignoreDelete = mkOption {
+                type = types.bool;
+                default = false;
+                description = ''
+                  Whether to delete files in destination. See <link
+                  xlink:href="https://docs.syncthing.net/advanced/folder-ignoredelete.html">
+                  upstream's docs</link>.
+                '';
+              };
+
            };
          }));
        };
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@ -277,6 +277,7 @@ in {
          ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
          RuntimeDirectory = "phpfpm";
          RuntimeDirectoryPreserve = true; # Relevant when multiple processes are running
+          Restart = "always";
        };
      }
    ) cfg.pools;
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@ -74,15 +74,8 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; };
        # OOM killer randomly get rid of processes, since this leads
        # to failures that are hard to diagnose.
        echo 2 > /proc/sys/vm/panic_on_oom
-
-        # Coverage data is written into /tmp/coverage-data.
-        mkdir -p /tmp/xchg/coverage-data
      '';

-    # If the kernel has been built with coverage instrumentation, make
-    # it available under /proc/gcov.
-    boot.kernelModules = [ "gcov-proc" ];
-
    # Panic if an error occurs in stage 1 (rather than waiting for
    # user intervention).
    boot.kernelParams =
@ -111,8 +104,6 @@ with import ../../lib/qemu-flags.nix { inherit pkgs; };
    networking.defaultGateway = mkOverride 150 "";
    networking.nameservers = mkOverride 150 [ ];

-    systemd.globalEnvironment.GCOV_PREFIX = "/tmp/xchg/coverage-data";
-
    system.requiredKernelConfig = with config.lib.kernelConfig; [
      (isYes "SERIAL_8250_CONSOLE")
      (isYes "SERIAL_8250")
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
@ -2,11 +2,11 @@

 bitwig-studio1.overrideAttrs (oldAttrs: rec {
  name = "bitwig-studio-${version}";
-  version = "3.2.6";
+  version = "3.2.7";

  src = fetchurl {
    url = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
-    sha256 = "00hrbgnjns3s8lbjbabwwqvbwz4dlrg33cs3d1qlpzgi3y72h3nn";
+    sha256 = "1mj9kii4bnk5w2p18hypwy8swkpzkaqw98q5fsjq362x4qm0b3py";
  };

  buildInputs = oldAttrs.buildInputs ++ [ xorg.libXtst ];
--- a/pkgs/applications/audio/csound/default.nix
+++ b/pkgs/applications/audio/csound/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  # When updating, please check if https://github.com/csound/csound/issues/1078
  # has been fixed in the new version so we can use the normal fluidsynth
  # version and remove fluidsynth 1.x from nixpkgs again.
-  version = "6.14.0";
+  version = "6.15.0";

  enableParallelBuilding = true;

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "csound";
    repo = "csound";
    rev = version;
-    sha256 = "1sr9knfhbm2m0wpkjq2l5n471vnl51wy4p6j4m95zqybimzb4s2j";
+    sha256 = "1vld6v55jxvv3ddr21kh41s4cdkhnm5wpffvd097zqrqh1aq08r0";
  };

  cmakeFlags = [ "-DBUILD_CSOUND_AC=0" ] # fails to find Score.hpp
--- a/pkgs/applications/audio/lingot/default.nix
+++ b/pkgs/applications/audio/lingot/default.nix
@ -5,8 +5,10 @@
 , gtk3
 , wrapGAppsHook
 , alsaLib
+, libjack2
 , libpulseaudio
 , fftw
+, jackSupport ? true
 }:

 stdenv.mkDerivation rec {
@ -29,11 +31,9 @@ stdenv.mkDerivation rec {
    alsaLib
    libpulseaudio
    fftw
-  ];
+  ] ++ stdenv.lib.optional jackSupport libjack2;

-  configureFlags = [
-    "--disable-jack"
-  ];
+  configureFlags = stdenv.lib.optional (!jackSupport) "--disable-jack";

  meta = {
    description = "Not a Guitar-Only tuner";
--- a/pkgs/applications/audio/qjackctl/default.nix
+++ b/pkgs/applications/audio/qjackctl/default.nix
@ -1,14 +1,14 @@
 { stdenv, mkDerivation, fetchurl, pkgconfig, alsaLib, libjack2, dbus, qtbase, qttools, qtx11extras }:

 mkDerivation rec {
-  version = "0.6.2";
+  version = "0.6.3";
  pname = "qjackctl";

  # some dependencies such as killall have to be installed additionally

  src = fetchurl {
    url = "mirror://sourceforge/qjackctl/${pname}-${version}.tar.gz";
-    sha256 = "1rjhdyp0wzhlqr4cn80rh1qhby998cpqv81j1bbb9hfsiq77viqy";
+    sha256 = "0zbb4jlx56qvcqyhx34mbagkqf3wbxgj84hk0ppf5cmcrxv67d4x";
  };

  buildInputs = [
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@ -5,13 +5,13 @@

 buildPythonApplication rec {
  pname = "vorta";
-  version = "0.6.26";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "borgbase";
    repo = "vorta";
    rev = "v${version}";
-    sha256 = "189kzwdmissg9142cd7wvxa1rvc2y7lysgr7if99zc7ks59mv6dq";
+    sha256 = "1hz19c0lphwql881n7w0ls39bbl63lccx57c3klwfyzgsxcgdy2j";
  };

  postPatch = ''
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@ -4,12 +4,12 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "kakoune-unwrapped";
-  version = "2020.08.04";
+  version = "2020.09.01";
  src = fetchFromGitHub {
    repo = "kakoune";
    owner = "mawww";
    rev = "v${version}";
-    sha256 = "1cgkis8bywy5k8k6j4i3prikpmhh1p6zyklliyxbc89mj64kvx4s";
+    sha256 = "091qzk0qs7hql0q51hix99srgma35mhdnjfd5ncfba1bmc1h8x5i";
  };
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ ncurses asciidoc docbook_xsl libxslt ];
--- a/pkgs/applications/gis/gmt/default.nix
+++ b/pkgs/applications/gis/gmt/default.nix
@ -9,10 +9,10 @@

 stdenv.mkDerivation rec {
  pname = "gmt";
-  version = "6.1.0";
+  version = "6.1.1";
  src = fetchurl {
    url = "https://github.com/GenericMappingTools/gmt/releases/download/${version}/gmt-${version}-src.tar.gz";
-    sha256 = "0vzxzpvbf1sqma2airsibxvqb9m4sajm7jsfr7rrv6q7924c7ijw";
+    sha256 = "04mdxxcild56jhg9ax522xh78v1wl1x8iqv2f6wv32x9b2lgy1lp";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/graphics/lightburn/default.nix
+++ b/pkgs/applications/graphics/lightburn/default.nix
@ -6,7 +6,7 @@

 stdenv.mkDerivation rec {
  pname = "lightburn";
-  version = "0.9.15";
+  version = "0.9.16";

  nativeBuildInputs = [
    p7zip
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "1dwmrili4jfw55gnlnda3imgli7f4jqz9smwlynf7k87lxrhppmh";
+    sha256 = "0xmpglfzff3jpxbr304czsa24fbp497b69yd8kjkjdp2cd0l70qc";
  };

  buildInputs = [
--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -252,4 +252,42 @@ in {
      maintainers = with maintainers; [ WhittlesJr ];
    };
  };
+
+  displaylayerprogress = buildPlugin rec {
+    pname = "OctoPrint-DisplayLayerProgress";
+    version = "1.23.2";
+
+    src = fetchFromGitHub {
+      owner = "OllisGit";
+      repo = pname;
+      rev = version;
+      sha256 = "0yv8gy5dq0rl7zxkvqa98az391aiixl8wbzkyvbmpjar9r6whdzm";
+    };
+
+    meta = with stdenv.lib; {
+      description = "OctoPrint-Plugin that sends the current progress of a print via M117 command";
+      homepage = "https://github.com/OllisGit/OctoPrint-DisplayLayerProgress";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ j0hax ];
+    };
+  };
+
+  octoprint-dashboard = buildPlugin rec {
+    pname = "OctoPrint-Dashboard";
+    version = "1.13.0";
+
+    src = fetchFromGitHub {
+      owner = "StefanCohen";
+      repo = pname;
+      rev = version;
+      sha256 = "1879l05gkkryvhxkmhr3xvd10d4m7i0cr3jk1gdcv47xwyr6q9pf";
+    };
+
+    meta = with stdenv.lib; {
+      description = "A dashboard for Octoprint";
+      homepage = "https://github.com/StefanCohen/OctoPrint-Dashboard";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ j0hax ];
+    };
+  };
 }
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "timewarrior";
-  version = "1.3.0";
+  version = "1.4.2";

  enableParallelBuilding = true;

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "GothenburgBitFactory";
    repo = "timewarrior";
    rev = "v${version}";
-    sha256 = "1aijh1ad7gpa61cn7b57w24vy7fyjj0zx5k9z8d6m1ldzbw589cl";
+    sha256 = "0qvhpva0hmhybn0c2aajndw5vnxar1jw4pjjajd2k2cr6vax29dw";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@ -1,22 +1,24 @@
-{ stdenv, fetchFromGitHub, rustPlatform, cmake, pkg-config, openssl, CoreServices }:
+{ stdenv, fetchFromGitHub, rustPlatform, cmake, pkg-config, openssl, oniguruma, CoreServices }:

 rustPlatform.buildRustPackage rec {
  pname = "zola";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "getzola";
    repo = pname;
    rev = "v${version}";
-    sha256 = "137ak9gzcn3689fmcb90wa4szw43rh2m51mf26l77a5gksn5y6cn";
+    sha256 = "119ikgall6bv1r6h1pqcmc6nxkxld2lch04gk860zzk54jragbrp";
  };

-  cargoSha256 = "0v40bcqh48dlhdc0kz7wm3q9r3i1m6j9s74bfiv237dqx5dymmsg";
+  cargoSha256 = "1jx5bgfmbv0wljps1yv6yir2pjlb0vwzzba4i2sv32awv9y0q3v6";

  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ openssl ]
+  buildInputs = [ openssl oniguruma ]
    ++ stdenv.lib.optional stdenv.isDarwin CoreServices;

+  RUSTONIG_SYSTEM_LIBONIG = true;
+
  postInstall = ''
    install -D -m 444 completions/zola.bash \
      -t $out/share/bash-completion/completions
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -1,7 +1,7 @@
-{ stdenv, lib, llvmPackages, gnChromium, ninja, which, nodejs, fetchpatch, gnutar
+{ stdenv, lib, llvmPackages, gnChromium, ninja, which, nodejs, fetchpatch, fetchurl

 # default dependencies
-, bzip2, flac, speex, libopus
+, gnutar, bzip2, flac, speex, libopus
 , libevent, expat, libjpeg, snappy
 , libpng, libcap
 , xdg_utils, yasm, nasm, minizip, libwebp
@ -39,6 +39,7 @@
 , cupsSupport ? true
 , pulseSupport ? false, libpulseaudio ? null

+, channel
 , upstream-info
 }:

@ -108,7 +109,7 @@ let
  versionRange = min-version: upto-version:
    let inherit (upstream-info) version;
        result = versionAtLeast version min-version && versionOlder version upto-version;
-        stable-version = (import ./upstream-info.nix).stable.version;
+        stable-version = (importJSON ./upstream-info.json).stable.version;
    in if versionAtLeast stable-version upto-version
       then warn "chromium: stable version ${stable-version} is newer than a patchset bounded at ${upto-version}. You can safely delete it."
            result
@ -116,10 +117,13 @@ let

  base = rec {
    name = "${packageName}-unwrapped-${version}";
-    inherit (upstream-info) channel version;
-    inherit packageName buildType buildPath;
+    inherit (upstream-info) version;
+    inherit channel packageName buildType buildPath;

-    src = upstream-info.main;
+    src = fetchurl {
+      url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
+      inherit (upstream-info) sha256;
+    };

    nativeBuildInputs = [
      ninja which python2Packages.python perl pkgconfig
@ -344,9 +348,11 @@ let
      origRpath="$(patchelf --print-rpath "$chromiumBinary")"
      patchelf --set-rpath "${libGL}/lib:$origRpath" "$chromiumBinary"
    '';
+
+    passthru.updateScript = ./update.py;
  };

 # Remove some extraAttrs we supplied to the base attributes already.
 in stdenv.mkDerivation (base // removeAttrs extraAttrs [
  "name" "gnFlags" "buildTargets"
-])
+] // { passthru = base.passthru // (extraAttrs.passthru or {}); })
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -1,5 +1,5 @@
-{ newScope, config, stdenv, llvmPackages_10, llvmPackages_11
-, makeWrapper, ed, gnugrep, coreutils
+{ newScope, config, stdenv, fetchurl, makeWrapper
+, llvmPackages_10, llvmPackages_11, ed, gnugrep, coreutils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , pipewire_0_2
@ -31,10 +31,11 @@ let
  chromium = rec {
    inherit stdenv llvmPackages;

-    upstream-info = (callPackage ./update.nix {}).getChannel channel;
+    upstream-info = (lib.importJSON ./upstream-info.json).${channel};

    mkChromiumDerivation = callPackage ./common.nix ({
-      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useOzone;
+      inherit channel gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs
+              cupsSupport pulseSupport useOzone;
      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-05-19";
@ -63,22 +64,33 @@ let
    };
  };

+  pkgSuffix = if channel == "dev" then "unstable" else channel;
+  pkgName = "google-chrome-${pkgSuffix}";
+  chromeSrc = fetchurl {
+    urls = map (repo: "${repo}/${pkgName}/${pkgName}_${version}-1_amd64.deb") [
+      "https://dl.google.com/linux/chrome/deb/pool/main/g"
+      "http://95.31.35.30/chrome/pool/main/g"
+      "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
+      "http://repo.fdzh.org/chrome/deb/pool/main/g"
+    ];
+    sha256 = chromium.upstream-info.sha256bin64;
+  };
+
  mkrpath = p: "${lib.makeSearchPathOutput "lib" "lib64" p}:${lib.makeLibraryPath p}";
-  widevineCdm = let upstream-info = chromium.upstream-info; in stdenv.mkDerivation {
+  widevineCdm = stdenv.mkDerivation {
    name = "chrome-widevine-cdm";

-    # The .deb file for Google Chrome
-    src = upstream-info.binary;
+    src = chromeSrc;

    phases = [ "unpackPhase" "patchPhase" "installPhase" "checkPhase" ];

    unpackCmd = let
      widevineCdmPath =
-        if upstream-info.channel == "stable" then
+        if channel == "stable" then
          "./opt/google/chrome/WidevineCdm"
-        else if upstream-info.channel == "beta" then
+        else if channel == "beta" then
          "./opt/google/chrome-beta/WidevineCdm"
-        else if upstream-info.channel == "dev" then
+        else if channel == "dev" then
          "./opt/google/chrome-unstable/WidevineCdm"
        else
          throw "Unknown chromium channel.";
@ -211,6 +223,7 @@ in stdenv.mkDerivation {
  passthru = {
    inherit (chromium) upstream-info browser;
    mkDerivation = chromium.mkChromiumDerivation;
-    inherit sandboxExecutableName;
+    inherit chromeSrc sandboxExecutableName;
+    updateScript = ./update.py;
  };
 }
--- a/pkgs/applications/networking/browsers/chromium/update.nix
+++ b/pkgs/applications/networking/browsers/chromium/update.nix
@ -1,271 +0,0 @@
-let maybePkgs = import ../../../../../. {}; in
-
-{ stdenv     ? maybePkgs.stdenv
-, runCommand ? maybePkgs.runCommand
-, fetchurl   ? maybePkgs.fetchurl
-, writeText  ? maybePkgs.writeText
-, curl       ? maybePkgs.curl
-, cacert     ? maybePkgs.cacert
-, nix        ? maybePkgs.nix
-}:
-
-let
-  inherit (stdenv) lib;
-
-  sources = if builtins.pathExists ./upstream-info.nix
-            then import ./upstream-info.nix
-            else {};
-
-  bucketURL = "https://commondatastorage.googleapis.com/"
-            + "chromium-browser-official";
-
-  mkVerURL = version: "${bucketURL}/chromium-${version}.tar.xz";
-
-  debURL = "https://dl.google.com/linux/chrome/deb/pool/main/g";
-
-  getDebURL = channelName: version: arch: mirror: let
-    packageSuffix = if channelName == "dev" then "unstable" else channelName;
-    packageName = "google-chrome-${packageSuffix}";
-  in "${mirror}/${packageName}/${packageName}_${version}-1_${arch}.deb";
-
-  # Untrusted mirrors, don't try to update from them!
-  debMirrors = [
-    "http://95.31.35.30/chrome/pool/main/g"
-    "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
-    "http://repo.fdzh.org/chrome/deb/pool/main/g"
-  ];
-
-in {
-  getChannel = channel: let
-    chanAttrs = builtins.getAttr channel sources;
-  in {
-    inherit channel;
-    inherit (chanAttrs) version;
-
-    main = fetchurl {
-      url = mkVerURL chanAttrs.version;
-      inherit (chanAttrs) sha256;
-    };
-
-    binary = fetchurl (let
-      mkUrls = arch: let
-        mkURLForMirror = getDebURL channel chanAttrs.version arch;
-      in map mkURLForMirror ([ debURL ] ++ debMirrors);
-    in if stdenv.is64bit && chanAttrs ? sha256bin64 then {
-      urls = mkUrls "amd64";
-      sha256 = chanAttrs.sha256bin64;
-    } else if !stdenv.is64bit && chanAttrs ? sha256bin32 then {
-      urls = mkUrls "i386";
-      sha256 = chanAttrs.sha256bin32;
-    } else throw "No Chrome plugins are available for your architecture.");
-  };
-
-  update = let
-    csv2nix = name: src: import (runCommand "${name}.nix" {
-      src = builtins.fetchurl src;
-    } ''
-      esc() { echo "\"$(echo "$1" | sed -e 's/"\\$/\\&/')\""; } # ohai emacs "
-      IFS=, read -r -a headings <<< "$(head -n1 "$src")"
-      echo "[" > "$out"
-      tail -n +2 "$src" | while IFS=, read -r -a line; do
-        echo "  {"
-        for idx in "''${!headings[@]}"; do
-          echo "    $(esc "''${headings[idx]}") = $(esc ''${line[$idx]});"
-        done
-        echo "  }"
-      done >> "$out"
-      echo "]" >> "$out"
-    '');
-
-    channels = lib.fold lib.recursiveUpdate {} (map (attrs: {
-      ${attrs.os}.${attrs.channel} = attrs // {
-        history = let
-          drvName = "omahaproxy-${attrs.os}.${attrs.channel}-info";
-          history = csv2nix drvName "http://omahaproxy.appspot.com/history";
-          cond = h: attrs.os == h.os && attrs.channel == h.channel
-                 && lib.versionOlder h.version attrs.current_version;
-          # Note that this is a *reverse* sort!
-          sorter = a: b: lib.versionOlder b.version a.version;
-          sorted = builtins.sort sorter (lib.filter cond history);
-        in map (lib.flip removeAttrs ["os" "channel"]) sorted;
-        version = attrs.current_version;
-      };
-    }) (csv2nix "omahaproxy-info" "http://omahaproxy.appspot.com/all?csv=1"));
-
-    /*
-      XXX: This is essentially the same as:
-
-        builtins.tryEval (builtins.fetchurl url)
-
-      ... except that tryEval on fetchurl isn't working and doesn't catch
-      errors for fetchurl, so we go for a different approach.
-
-      We only have fixed-output derivations that can have networking access, so
-      we abuse SHA1 and its weaknesses to forge a fixed-output derivation which
-      is not so fixed, because it emits different contents that have the same
-      SHA1 hash.
-
-      Using this method, we can distinguish whether the URL is available or
-      whether it's not based on the actual content.
-
-      So let's use tryEval as soon as it's working with fetchurl in Nix.
-    */
-    tryFetch = url: let
-      # SHA1 hash collisions from https://shattered.io/static/shattered.pdf:
-      collisions = runCommand "sha1-collisions" {
-        outputs = [ "out" "good" "bad" ];
-        base64 = ''
-          QlpoOTFBWSZTWbL5V5MABl///////9Pv///v////+/////HDdK739/677r+W3/75rUNr4
-          Aa/AAAAAAACgEVTRtQDQAaA0AAyGmjTQGmgAAANGgAaMIAYgGgAABo0AAAAAADQAIAGQ0
-          MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk
-          0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIAN
-          GgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRp
-          o0GIGgBoGQAABVTUExEZATTICnkxNR+p6E09JppoyamjGhkm0ammIyaekbUejU9JiGnqZ
-          qaaDxJ6m0JkZMQ2oaYmJ6gxqMyE2TUzJqfItligtJQJfYbl9Zy9QjQuB5mHQRdSSXCCTH
-          MgmSDYmdOoOmLTBJWiCpOhMQYpQlOYpJjn+wQUJSTCEpOMekaFaaNB6glCC0hKEJdHr6B
-          mUIHeph7YxS8WJYyGwgWnMTFJBDFSxSCCYljiEk7HZgJzJVDHJxMgY6tCEIIWgsKSlSZ0
-          S8GckoIIF+551Ro4RCw260VCEpWJSlpWx/PMrLyVoyhWMAneDilBcUIeZ1j6NCkus0qUC
-          Wnahhk5KT4GpWMh3vm2nJWjTL9Qg+84iExBJhNKpbV9tvEN265t3fu/TKkt4rXFTsV+Nc
-          upJXhOhOhJMQQktrqt4K8mSh9M2DAO2X7uXGVL9YQxUtzQmS7uBndL7M6R7vX869VxqPu
-          renSuHYNq1yTXOfNWLwgvKlRlFYqLCs6OChDp0HuTzCWscmGudLyqUuwVGG75nmyZhKpJ
-          yOE/pOZyHyrZxGM51DYIN+Jc8yVJgAykxKCEtW55MlfudLg3KG6TtozalunXrroSxUpVL
-          StWrWLFihMnVpkyZOrQnUrE6xq1CGtJlbAb5ShMbV1CZgqlKC0wCFCpMmUKSEkvFLaZC8
-          wHOCVAlvzaJQ/T+XLb5Dh5TNM67p6KZ4e4ZSGyVENx2O27LzrTIteAreTkMZpW95GS0CE
-          JYhMc4nToTJ0wQhKEyddaLb/rTqmgJSlkpnALxMhlNmuKEpkEkqhKUoEq3SoKUpIQcDgW
-          lC0rYahMmLuPQ0fHqZaF4v2W8IoJ2EhMhYmSw7qql27WJS+G4rUplToFi2rSv0NSrVvDU
-          pltQ8Lv6F8pXyxmFBSxiLSxglNC4uvXVKmAtusXy4YXGX1ixedEvXF1aX6t8adYnYCpC6
-          rW1ZzdZYlCCxKEv8vpbqdSsXl8v1jCQv0KEPxPTa/5rtWSF1dSgg4z4KjfIMNtgwWoWLE
-          sRhKxsSA9ji7V5LRPwtumeQ8V57UtFSPIUmtQdOQfseI2Ly1DMtk4Jl8n927w34zrWG6P
-          i4jzC82js/46Rt2IZoadWxOtMInS2xYmcu8mOw9PLYxQ4bdfFw3ZPf/g2pzSwZDhGrZAl
-          9lqky0W+yeanadC037xk496t0Dq3ctfmqmjgie8ln9k6Q0K1krb3dK9el4Xsu44LpGcen
-          r2eQZ1s1IhOhnE56WnXf0BLWn9Xz15fMkzi4kpVxiTKGEpffErEEMvEeMZhUl6yD1SdeJ
-          YbxzGNM3ak2TAaglLZlDCVnoM6wV5DRrycwF8Zh/fRsdmhkMfAO1duwknrsFwrzePWeMw
-          l107DWzymxdQwiSXx/lncnn75jL9mUzw2bUDqj20LTgtawxK2SlQg1CCZDQMgSpEqLjRM
-          sykM9zbSIUqil0zNk7Nu+b5J0DKZlhl9CtpGKgX5uyp0idoJ3we9bSrY7PupnUL5eWiDp
-          V5mmnNUhOnYi8xyClkLbNmAXyoWk7GaVrM2umkbpqHDzDymiKjetgzTocWNsJ2E0zPcfh
-          t46J4ipaXGCfF7fuO0a70c82bvqo3HceIcRlshgu73seO8BqlLIap2z5jTOY+T2ucCnBt
-          Atva3aHdchJg9AJ5YdKHz7LoA3VKmeqxAlFyEnQLBxB2PAhAZ8KvmuR6ELXws1Qr13Nd1
-          i4nsp189jqvaNzt+0nEnIaniuP1+/UOZdyfoZh57ku8sYHKdvfW/jYSUks+0rK+qtte+p
-          y8jWL9cOJ0fV8rrH/t+85/p1z2N67p/ZsZ3JmdyliL7lrNxZUlx0MVIl6PxXOUuGOeArW
-          3vuEvJ2beoh7SGyZKHKbR2bBWO1d49JDIcVM6lQtu9UO8ec8pOnXmkcponBPLNM2CwZ9k
-          NC/4ct6rQkPkQHMcV/8XckU4UJCy+VeTA==
-        '';
-      } ''
-        echo "$base64" | base64 -d | tar xj
-        mv good.pdf "$good"
-        mv bad.pdf "$bad"
-        touch "$out"
-      '';
-
-      cacheVal = let
-        urlHash = builtins.hashString "sha256" url;
-        timeSlice = builtins.currentTime / 600;
-      in "${urlHash}-${toString timeSlice}";
-
-    in {
-      success = import (runCommand "check-success" {
-        result = stdenv.mkDerivation {
-          name = "tryfetch-${cacheVal}";
-          inherit url;
-
-          outputHash = "d00bbe65d80f6d53d5c15da7c6b4f0a655c5a86a";
-          outputHashMode = "flat";
-          outputHashAlgo = "sha1";
-
-          nativeBuildInputs = [ curl ];
-          preferLocalBuild = true;
-
-          inherit (collisions) good bad;
-
-          buildCommand = ''
-            if SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt" \
-               curl -s -L -f -I "$url" > /dev/null; then
-              cp "$good" "$out"
-            else
-              cp "$bad" "$out"
-            fi
-          '';
-
-          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-        };
-        inherit (collisions) good;
-      } ''
-        if cmp -s "$result" "$good"; then
-          echo true > "$out"
-        else
-          echo false > "$out"
-        fi
-      '');
-      value = builtins.fetchurl url;
-    };
-
-    fetchLatest = channel: let
-      result = tryFetch (mkVerURL channel.version);
-    in if result.success then result.value else fetchLatest (channel // {
-      version = if channel.history != []
-                then (lib.head channel.history).version
-                else throw "Unfortunately there's no older version than " +
-                           "${channel.version} available for channel " +
-                           "${channel.channel} on ${channel.os}.";
-      history = lib.tail channel.history;
-    });
-
-    getHash = path: import (runCommand "gethash.nix" {
-      inherit path;
-      nativeBuildInputs = [ nix ];
-    } ''
-      sha256="$(nix-hash --flat --base32 --type sha256 "$path")"
-      echo "\"$sha256\"" > "$out"
-    '');
-
-    isLatest = channel: version: let
-      ourVersion = sources.${channel}.version or null;
-    in if ourVersion == null then false
-       else lib.versionOlder version sources.${channel}.version
-         || version == sources.${channel}.version;
-
-    # We only support GNU/Linux right now.
-    linuxChannels = let
-      genLatest = channelName: channel: let
-        newUpstream = {
-          inherit (channel) version;
-          sha256 = getHash (fetchLatest channel);
-        };
-        keepOld = let
-          oldChannel = sources.${channelName};
-        in {
-          inherit (oldChannel) version sha256;
-        } // lib.optionalAttrs (oldChannel ? sha256bin32) {
-          inherit (oldChannel) sha256bin32;
-        } // lib.optionalAttrs (oldChannel ? sha256bin64) {
-          inherit (oldChannel) sha256bin64;
-        };
-      in if isLatest channelName channel.version then keepOld else newUpstream;
-    in lib.mapAttrs genLatest channels.linux;
-
-    getLinuxFlash = channelName: channel: let
-      inherit (channel) version;
-      fetchArch = arch: tryFetch (getDebURL channelName version arch debURL);
-      packages = lib.genAttrs ["i386" "amd64"] fetchArch;
-      isNew = arch: attr: !(builtins.hasAttr attr channel)
-                       && packages.${arch}.success;
-    in channel // lib.optionalAttrs (isNew "i386" "sha256bin32") {
-      sha256bin32 = getHash (packages.i386.value);
-    } // lib.optionalAttrs (isNew "amd64" "sha256bin64") {
-      sha256bin64 = getHash (packages.amd64.value);
-    };
-
-    newChannels = lib.mapAttrs getLinuxFlash linuxChannels;
-
-    dumpAttrs = indent: attrs: let
-      mkVal = val: if lib.isAttrs val then dumpAttrs (indent + 1) val
-                   else "\"${lib.escape ["$" "\\" "\""] (toString val)}\"";
-      mkIndent = level: lib.concatStrings (builtins.genList (_: "  ") level);
-      mkAttr = key: val: "${mkIndent (indent + 1)}${key} = ${mkVal val};\n";
-      attrLines = lib.mapAttrsToList mkAttr attrs;
-    in "{\n" + (lib.concatStrings attrLines) + (mkIndent indent) + "}";
-  in writeText "chromium-new-upstream-info.nix" ''
-    # This file is autogenerated from update.sh in the same directory.
-    ${dumpAttrs 0 newChannels}
-  '';
-}
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@ -0,0 +1,63 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python -p python3 nix
+
+import csv
+import json
+import subprocess
+from codecs import iterdecode
+from os.path import abspath, dirname
+from sys import stderr
+from urllib.request import urlopen
+
+HISTORY_URL = 'https://omahaproxy.appspot.com/history?os=linux'
+DEB_URL = 'https://dl.google.com/linux/chrome/deb/pool/main/g'
+BUCKET_URL = 'https://commondatastorage.googleapis.com/chromium-browser-official'
+
+JSON_PATH = dirname(abspath(__file__)) + '/upstream-info.json'
+
+def load_json(path):
+    with open(path, 'r') as f:
+        return json.load(f)
+
+def nix_prefetch_url(url, algo='sha256'):
+    print(f'nix-prefetch-url {url}')
+    out = subprocess.check_output(['nix-prefetch-url', '--type', algo, url])
+    return out.decode('utf-8').rstrip()
+
+channels = {}
+last_channels = load_json(JSON_PATH)
+
+print(f'GET {HISTORY_URL}', file=stderr)
+with urlopen(HISTORY_URL) as resp:
+    builds = csv.DictReader(iterdecode(resp, 'utf-8'))
+    for build in builds:
+        channel_name = build['channel']
+
+        # If we've already found a newer build for this channel, we're
+        # no longer interested in it.
+        if channel_name in channels:
+            continue
+
+        # If we're back at the last build we used, we don't need to
+        # keep going -- there's no new version available, and we can
+        # just reuse the info from last time.
+        if build['version'] == last_channels[channel_name]['version']:
+            channels[channel_name] = last_channels[channel_name]
+            continue
+
+        channel = {'version': build['version']}
+        suffix = 'unstable' if channel_name == 'dev' else channel_name
+
+        try:
+            channel['sha256'] = nix_prefetch_url(f'{BUCKET_URL}/chromium-{build["version"]}.tar.xz')
+            channel['sha256bin64'] = nix_prefetch_url(f'{DEB_URL}/google-chrome-{suffix}/google-chrome-{suffix}_{build["version"]}-1_amd64.deb')
+        except subprocess.CalledProcessError:
+            # This build isn't actually available yet.  Continue to
+            # the next one.
+            continue
+
+        channels[channel_name] = channel
+
+with open(JSON_PATH, 'w') as out:
+    json.dump(channels, out, indent=2)
+    out.write('\n')
--- a/pkgs/applications/networking/browsers/chromium/update.sh
+++ b/pkgs/applications/networking/browsers/chromium/update.sh
@ -1,4 +0,0 @@
-#!/bin/sh -e
-cd "$(dirname "$0")"
-sp="$(nix-build --builders "" -Q --no-out-link update.nix -A update)"
-cat "$sp" > upstream-info.nix
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -0,0 +1,17 @@
+{
+  "beta": {
+    "version": "86.0.4240.22",
+    "sha256": "1qxacdwknrjwfp44mnqmq24n8sw4yaf0d1qnz39km2m4apc39svp",
+    "sha256bin64": "05qdzkq9daqjliqj7zxsa03903rv3kwaj627192ls6m33bacz9gp"
+  },
+  "dev": {
+    "version": "86.0.4240.8",
+    "sha256": "1x0kbc7xp6599jyn461mbmchbixivnxm0jsyfq0snhxz8x81z55q",
+    "sha256bin64": "0y7drzxxfn0vmfq0m426l8xvkgyajb8pjydi0d7kzk6i92sjf45j"
+  },
+  "stable": {
+    "version": "85.0.4183.83",
+    "sha256": "0fz781bxx1rnjwfix2dgzq5w1lg3x6a9vd9k49gh4z5q092slr10",
+    "sha256bin64": "0fa3la2nvqr0w40j2qkbwnh36924fsp2ajsla6aky6hz08mq2q1g"
+  }
+}
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,18 +0,0 @@
-# This file is autogenerated from update.sh in the same directory.
-{
-  beta = {
-    sha256 = "0fz781bxx1rnjwfix2dgzq5w1lg3x6a9vd9k49gh4z5q092slr10";
-    sha256bin64 = "12nm7h70pbzwc5rc7kcwfwgjs0h8cdnys5wlfjkbq6irwb6m1lm6";
-    version = "85.0.4183.83";
-  };
-  dev = {
-    sha256 = "16yj47x580i8p88m88f5bcs85qmrfwmyp9na7yrnk0lnq06wbj4i";
-    sha256bin64 = "0i81xcfdn65j2i4vfx52v4a9vlar8y9ykqdhshymqfz4qqqk37d1";
-    version = "86.0.4238.0";
-  };
-  stable = {
-    sha256 = "0fz781bxx1rnjwfix2dgzq5w1lg3x6a9vd9k49gh4z5q092slr10";
-    sha256bin64 = "0fa3la2nvqr0w40j2qkbwnh36924fsp2ajsla6aky6hz08mq2q1g";
-    version = "85.0.4183.83";
-  };
-}
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    ffversion = "80.0";
+    ffversion = "80.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "3rw30gs1wvd6m2sgsp1wm29rrbkxyf3jsdy8i0azfz9w7hqcfwnv76j3cdf18xghh954hpn3q6w1hr7pgab3z9zjxzyfcnh2mbabyvc";
+      sha512 = "081sf41r7ickjij3kfrdq29a0d6wz7qv8950kx116kakh8qxgjy8ahk2mfwlcp6digrl4mimi8rl7ns1wjngsmrjh4lvqzh1xglx9cp";
    };

    patches = [
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@ -72,7 +72,7 @@ in stdenv.mkDerivation {

  name = "google-chrome${suffix}-${version}";

-  src = chromium.upstream-info.binary;
+  src = chromium.chromeSrc;

  nativeBuildInputs = [ patchelf makeWrapper ];
  buildInputs = [
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.125.7";
+  version = "0.128.0";

  src = fetchFromGitHub {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "1m030gjrd98z4vbj7l927qi55vgr11czrb8wmw56ifkqwfi6h9hi";
+    sha256 = "1ihvjbh3v91wxny9jq0x9qi3s2zzdpg96w1vrhiim43nnv0ydg1y";
  };

-  vendorSha256 = "0w72nlf26k64cq1hrqycks0pyp18y4wh3h40jpn5qnysi5pb2ndj";
+  vendorSha256 = "181iksfadjqrgsia8zy0zf5lr4h732s7hxjjfkr4gac586dlbj0w";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/jx/default.nix
+++ b/pkgs/applications/networking/cluster/jx/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "jx";
-  version = "2.1.127";
+  version = "2.1.138";

  src = fetchFromGitHub {
    owner = "jenkins-x";
    repo = "jx";
    rev = "v${version}";
-    sha256 = "01dfpnqgbrn8b6h2irq080xdm76b4jx6sd80f8x4zmyaz6hf5vlv";
+    sha256 = "1i45gzaql6rfplliky56lrzwjnm2qzv25kgyq7gvn9c7hjaaq65b";
  };

-  vendorSha256 = "0la92a8720l8my5r4wsbgv74y6m19ikmm0wv3l4m4w5gjyplfsxb";
+  vendorSha256 = "1wvggarakshpw7m8h0x2zvd6bshd2kzbrjynfa113z90pgksvjng";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -11,9 +11,9 @@

 buildGoModule rec {
  pname = "minikube";
-  version = "1.12.3";
+  version = "1.13.0";

-  vendorSha256 = "014zgkh1l6838s5bmcxpvvyap96sd8ammrz5d7fncx0afik7zc4m";
+  vendorSha256 = "09bcp7pqbs9j06z1glpad70dqlsnrf69vn75l00bdjknbrvbzrb9";

  doCheck = false;

@ -21,7 +21,7 @@ buildGoModule rec {
    owner = "kubernetes";
    repo = "minikube";
    rev = "v${version}";
-    sha256 = "0z8hinhx521rphcm0cd5lli5jy09lw1jw63q2a4fqlmhpw39qrj9";
+    sha256 = "1xlz07q0nlsq6js58b5ad0wxajwganaqcvwglj4w6fgmiqm9s1ny";
  };

  nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "rssguard";
-  version = "3.7.0";
+  version = "3.7.2";

  src = fetchFromGitHub {
    owner = "martinrotter";
    repo = pname;
    rev = version;
-    sha256 = "1maiazjsnjalx09rq1l84kd86s48cvljnwynv4rj6cln1h0al030";
+    sha256 = "1l2ra06am6bgwb4q200lhi64sz3np1dzf2vpjh10znxbx0mahbq6";
  };

  buildInputs =  [ qtwebengine qttools ];
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -1,7 +1,7 @@
 { callPackage, libsForQt5 }:

 let
-  stableVersion = "2.2.12";
+  stableVersion = "2.2.13";
  previewVersion = stableVersion;
  addVersion = args:
    let version = if args.stable then stableVersion else previewVersion;
@ -26,8 +26,8 @@ let
  };
  mkGui = args: libsForQt5.callPackage (import ./gui.nix (addVersion args // extraArgs)) { };
  mkServer = args: callPackage (import ./server.nix (addVersion args // extraArgs)) { };
-  guiSrcHash = "05nnil8ljyj6h366yrniv6syznhhbnb7nzjkz5785rb9pzjizs19";
-  serverSrcHash = "0gmfdnymiw4w13qbcsvd71yj3hc9640n43c305vq39hahvsn7rvc";
+  guiSrcHash = "1vhch8hgbzdfmgpxlzgdasv6lxgl7rs96n5v4mn2pcccvfmbqj66";
+  serverSrcHash = "1vlnhlcnjh0kd623zxjjgkvln0rn5zr43zn00vkvbzwc9cgm2jxz";
 in {
  guiStable = mkGui {
    stable = true;
--- a/pkgs/applications/networking/instant-messengers/fractal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal/default.nix
@ -59,6 +59,9 @@ rustPlatform.buildRustPackage rec {
    gst_all_1.gst-editing-services
    gst_all_1.gst-plugins-bad
    gst_all_1.gst-plugins-base
+    (gst_all_1.gst-plugins-good.override {
+      gtkSupport = true;
+    })
    gst_all_1.gstreamer
    gst_all_1.gst-validate
    gtk3
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/applications/office/skrooge/default.nix
@ -7,11 +7,11 @@

 mkDerivation rec {
  pname = "skrooge";
-  version = "2.22.1";
+  version = "2.23.0";

  src = fetchurl {
    url = "http://download.kde.org/stable/skrooge/${pname}-${version}.tar.xz";
-    sha256 = "194vwnc2fi7cgdhasxpr1gxjqqsiqadhadvv43d0lxaxys6f360h";
+    sha256 = "10k3j67x5xm5whsvb84k9p70bkn4jbbbvdfan7q49dh2mmpair5a";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/star/default.nix
+++ b/pkgs/applications/science/biology/star/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "star";
-  version = "2.7.4a";
+  version = "2.7.5c";

  src = fetchFromGitHub {
    repo = "STAR";
    owner = "alexdobin";
    rev = version;
-    sha256 = "1y4g7h6f95pa9g8kv1aihrfglavqymdx4mnqh6ascs50ibm7zdmz";
+    sha256 = "1plx9akrzwjk7f2j94l9ss0apg0asqmrf2bp0728d4bvlhnzmjyy";
  };

  sourceRoot = "source/source";
--- a/pkgs/applications/science/math/geogebra/geogebra6.nix
+++ b/pkgs/applications/science/math/geogebra/geogebra6.nix
@ -2,14 +2,14 @@
 stdenv.mkDerivation rec{

  name = "geogebra-${version}";
-  version = "6-0-598-0";
+  version = "6-0-600-0";

  src = fetchurl {
    urls = [
        "https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
-        "https://web.archive.org/web/20200815132422/https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
+        "https://web.archive.org/web/20200904093945/https://download.geogebra.org/installers/6.0/GeoGebra-Linux64-Portable-${version}.zip"
      ];
-    sha256 = "1klazsgrpmfd6vjzpdcfl5x8qhhbh6vx2g6id4vg16ac4sjdrb0c";
+    sha256 = "1l49rvfkil2cz6r7sa2mi0p6hvb6p66jv3x6xj8hjqls4l3sfhkm";
  };

  dontConfigure = true;
--- a/pkgs/applications/science/misc/rink/default.nix
+++ b/pkgs/applications/science/misc/rink/default.nix
@ -1,17 +1,17 @@
 { stdenv, fetchFromGitHub, rustPlatform, openssl, pkg-config, ncurses }:

 rustPlatform.buildRustPackage rec {
-  version = "0.5.0";
+  version = "0.5.1";
  pname = "rink";

  src = fetchFromGitHub {
    owner = "tiffany352";
    repo = "rink-rs";
    rev = "v${version}";
-    sha256 = "1z51n25hmgqkn4bm9yj18j8p4pk5i1x3f3z70vl1vx3v109jhff0";
+    sha256 = "1s67drjzd4cf93hpm7b2facfd6y1x0s60aq6pygj7i02bm0cb9l9";
  };

-  cargoSha256 = "0p63py8q4iqj5rrsir9saj7dvkrafx63z493k7p5xb2mah7b21lb";
+  cargoSha256 = "1wd70y13lly7nccaqlv7w8znxfal0fzyf9d67y5c3aikj7hkzfin";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ncurses ];
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "delta";
-  version = "0.4.1";
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "dandavison";
    repo = pname;
    rev = version;
-    sha256 = "15vpmalv2195aff3xd85nr99xn2dbc0k1lmlf7xp293s79kibrz7";
+    sha256 = "0g7jg6bxxihplxzq3ixdm24d36xd7xlwpazz8qj040m981cj123i";
  };

-  cargoSha256 = "0vgjijrxpfrgwh17dpxhgq8jdr6f9cj0mkr5ni9m3w8qv545a1ix";
+  cargoSha256 = "0q73adygyddjyajwwbkrhwss4f8ynxsga5yz4ac5fk5rzmda75rv";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -8,11 +8,11 @@ with stdenv.lib;

 buildGoPackage rec {
  pname = "gitea";
-  version = "1.12.3";
+  version = "1.12.4";

  src = fetchurl {
    url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "05z1pp2lnbr82pw97wy0j0qk2vv1qv9c46df13d03xdfsc3gsm50";
+    sha256 = "0zz3mwf1yhncvi6pl52lcwbl7k4kkrqyw8q3476akwszjn79n83c";
  };

  unpackPhase = ''
--- a/pkgs/applications/version-management/gitea/static-root-path.patch
+++ b/pkgs/applications/version-management/gitea/static-root-path.patch
@ -1,13 +1,13 @@
 diff --git a/modules/setting/setting.go b/modules/setting/setting.go
-index 714015c47..a2f85337e 100644
+index 45e55a2..9d18ee4 100644
 --- a/modules/setting/setting.go
 +++ b/modules/setting/setting.go
-@@ -641,7 +641,7 @@ func NewContext() {
- 	PortToRedirect = sec.Key("PORT_TO_REDIRECT").MustString("80")
+@@ -667,7 +667,7 @@ func NewContext() {
 	OfflineMode = sec.Key("OFFLINE_MODE").MustBool()
 	DisableRouterLog = sec.Key("DISABLE_ROUTER_LOG").MustBool()
-	StaticRootPath = sec.Key("STATIC_ROOT_PATH").MustString(AppWorkPath)
-+	StaticRootPath = sec.Key("STATIC_ROOT_PATH").MustString("@data@")
+ 	if len(StaticRootPath) == 0 {
+-		StaticRootPath = AppWorkPath
+		StaticRootPath = "@data@"
+ 	}
+ 	StaticRootPath = sec.Key("STATIC_ROOT_PATH").MustString(StaticRootPath)
 	StaticCacheTime = sec.Key("STATIC_CACHE_TIME").MustDuration(6 * time.Hour)
- 	AppDataPath = sec.Key("APP_DATA_PATH").MustString(path.Join(AppWorkPath, "data"))
- 	EnableGzip = sec.Key("ENABLE_GZIP").MustBool()
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -3,7 +3,7 @@
 , libX11, libXi, libxcb, libXext, libXcursor, glib, libXScrnSaver, libxkbfile, libXtst
 , nss, nspr, cups, fetchzip, expat, gdk-pixbuf, libXdamage, libXrandr, dbus
 , makeDesktopItem, openssl, wrapGAppsHook, at-spi2-atk, at-spi2-core, libuuid
-, e2fsprogs, krb5
+, e2fsprogs, krb5, libdrm, mesa
 }:

 with stdenv.lib;
@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gitkraken";
-  version = "7.2.0";
+  version = "7.3.0";

  src = fetchzip {
    url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-    sha256 = "0nrrcwikx6dx1j1s0b80gh1s932zvxmijpddqp6a1vh3ddc5v1mp";
+    sha256 = "0q9imaka79p3krmcrxvnxzb2gprczybnw8d4y9p4icbmdbyb6h70";
  };

  dontBuild = true;
@ -61,6 +61,8 @@ stdenv.mkDerivation rec {
    libuuid
    e2fsprogs
    krb5
+    libdrm
+    mesa
  ];

  desktopItem = makeDesktopItem {
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@ -1,5 +1,5 @@
-{ stdenv, fetchurl, meson, ninja, pkgconfig
-, wayland, libGL, mesa, libxkbcommon, cairo, libxcb
+{ stdenv, fetchurl, meson, ninja, pkg-config, wayland
+, libGL, mesa, libxkbcommon, cairo, libxcb
 , libXcursor, xlibsWrapper, udev, libdrm, mtdev, libjpeg, pam, dbus, libinput, libevdev
 , colord, lcms2, pipewire ? null
 , pango ? null, libunwind ? null, freerdp ? null, vaapi ? null, libva ? null
@ -10,14 +10,14 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "weston";
-  version = "8.0.0";
+  version = "9.0.0";

  src = fetchurl {
    url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "0j3q0af3595g4wcicldgy749zm2g2b6bswa6ya8k075a5sdv863m";
+    sha256 = "1zlql0xgiqc3pvgbpnnvj4xvpd91pwva8qf83xfb23if377ddxaw";
  };

-  nativeBuildInputs = [ meson ninja pkgconfig ];
+  nativeBuildInputs = [ meson ninja pkg-config wayland ];
  buildInputs = [
    wayland libGL mesa libxkbcommon cairo libxcb libXcursor xlibsWrapper udev libdrm
    mtdev libjpeg pam dbus libinput libevdev pango libunwind freerdp vaapi libva
@ -45,9 +45,19 @@ stdenv.mkDerivation rec {
  passthru.providedSessions = [ "weston" ];

  meta = {
-    description = "Reference implementation of a Wayland compositor";
-    homepage = "https://wayland.freedesktop.org/";
-    license = licenses.mit;
+    description = "A lightweight and functional Wayland compositor";
+    longDescription = ''
+      Weston is the reference implementation of a Wayland compositor, as well
+      as a useful environment in and of itself.
+      Out of the box, Weston provides a very basic desktop, or a full-featured
+      environment for non-desktop uses such as automotive, embedded, in-flight,
+      industrial, kiosks, set-top boxes and TVs. It also provides a library
+      allowing other projects to build their own full-featured environments on
+      top of Weston's core. A small suite of example or demo clients are also
+      provided.
+    '';
+    homepage = "https://gitlab.freedesktop.org/wayland/weston";
+    license = licenses.mit; # Expat version
    platforms = platforms.linux;
    maintainers = with maintainers; [ primeos ];
  };
--- a/pkgs/build-support/release/default.nix
+++ b/pkgs/build-support/release/default.nix
@ -41,10 +41,6 @@ rec {
      doCoverityAnalysis = true;
    } // args);

-  gcovReport = args: import ./gcov-report.nix (
-    { inherit runCommand lcov rsync;
-    } // args);
-
  rpmBuild = args: import ./rpm-build.nix (
    { inherit vmTools;
    } // args);
--- a/pkgs/build-support/release/gcov-report.nix
+++ b/pkgs/build-support/release/gcov-report.nix
@ -1,49 +0,0 @@
-{ runCommand, lcov, rsync, coverageRuns, lcovFilter ? [ "/nix/store/*" ], baseDirHack ? false }:
-
-runCommand "coverage"
-  { buildInputs = [ lcov rsync ];
-    inherit lcovFilter baseDirHack;
-  }
-  ''
-    mkdir -p $TMPDIR/gcov $out/nix-support $out/coverage
-    info=$out/coverage/full.info
-
-    for p in ${toString coverageRuns}; do
-        if [ -f $p/nix-support/hydra-build-products ]; then
-            cat $p/nix-support/hydra-build-products >> $out/nix-support/hydra-build-products
-        fi
-
-        [ ! -e $p/nix-support/failed ] || touch $out/nix-support/failed
-
-        opts=
-        for d in $p/coverage-data/*; do
-            for i in $(cd $d/nix/store && ls); do
-                if ! [ -e /nix/store/$i/.build ]; then continue; fi
-                if [ -e $TMPDIR/gcov/nix/store/$i ]; then continue; fi
-                echo "copying $i..."
-                rsync -a /nix/store/$i/.build/* $TMPDIR/gcov/
-                if [ -n "$baseDirHack" ]; then
-                    opts="-b $TMPDIR/gcov/$(cd /nix/store/$i/.build && ls)"
-                fi
-            done
-
-            for i in $(cd $d/nix/store && ls); do
-                rsync -a $d/nix/store/$i/.build/* $TMPDIR/gcov/ --include '*/' --include '*.gcda' --exclude '*'
-            done
-        done
-
-        chmod -R u+w $TMPDIR/gcov
-
-        echo "producing info..."
-        geninfo --ignore-errors source,gcov $TMPDIR/gcov --output-file $TMPDIR/app.info $opts
-        cat $TMPDIR/app.info >> $info
-    done
-
-    echo "making report..."
-    set -o noglob
-    lcov --remove $info ''$lcovFilter > $info.tmp
-    set +o noglob
-    mv $info.tmp $info
-    genhtml --show-details $info -o $out/coverage
-    echo "report coverage $out/coverage" >> $out/nix-support/hydra-build-products
-  ''
--- a/pkgs/data/icons/iconpack-obsidian/default.nix
+++ b/pkgs/data/icons/iconpack-obsidian/default.nix
@ -1,20 +1,20 @@
-{ stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, hicolor-icon-theme }:
+{ stdenv, fetchFromGitHub, gtk3, gnome-icon-theme, mint-x-icons, hicolor-icon-theme }:

 stdenv.mkDerivation rec {
  pname = "iconpack-obsidian";
-  version = "4.12";
+  version = "4.13";

  src = fetchFromGitHub {
    owner = "madmaxms";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0139ps707mh1zkypaxsqzy58mmsm5whdxxx2nbsmqfswb7qisz2b";
+    sha256 = "1hh0hnd2d08l4n5r73fkngv08f8230pp94k9qq8xgmchvjfg6j8y";
  };

  nativeBuildInputs = [ gtk3 ];

-  propagatedBuildInputs = [ gnome-icon-theme hicolor-icon-theme ];
-  # still missing parent themes: Ambiant-MATE, Mint-X, Faenza-Dark, KFaenza
+  propagatedBuildInputs = [ gnome-icon-theme mint-x-icons hicolor-icon-theme ];
+  # still missing parent themes: Ambiant-MATE, Faenza-Dark, KFaenza

  dontDropIconThemeCache = true;

--- a/pkgs/data/icons/iso-flags/default.nix
+++ b/pkgs/data/icons/iso-flags/default.nix
@ -0,0 +1,47 @@
+{ stdenv
+, fetchFromGitHub
+, perl
+, perlPackages
+, inkscape
+, pngcrush
+, librsvg
+, targets ? [ "all" ]
+}:
+
+stdenv.mkDerivation {
+  pname = "iso-flags";
+  version = "unstable-18012020";
+
+  src = fetchFromGitHub {
+    owner = "joielechong";
+    repo = "iso-country-flags-svg-collection";
+    rev = "9ebbd577b9a70fbfd9a1931be80c66e0d2f31a9d";
+    sha256 = "17bm7w4md56xywixfvp7vr3d6ihvxk3383i9i4rpmgm6qa9dyxdl";
+  };
+
+  nativeBuildInputs = [
+    perl
+    inkscape
+    librsvg
+    (perl.withPackages(pp: with pp; [ JSON XMLLibXML ]))
+  ];
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  buildFlags = targets;
+
+  installPhase = ''
+    mkdir -p $out/share
+    mv build $out/share/iso-flags
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/joielechong/iso-country-flags-svg-collection";
+    description = "248 country flag SVG & PNG icons with different icon styles";
+    license = [ licenses.publicDomain ];
+    platforms = platforms.linux; # the output assets should work anywhere, but unsure about the tools to build them...
+    maintainers = [ maintainers.mkg20001 ];
+  };
+}
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@ -0,0 +1,156 @@
+{ atk
+, autoreconfHook
+, cacert
+, fetchpatch
+, dbus
+, cinnamon-control-center
+, cinnamon-desktop
+, cinnamon-menus
+, cjs
+, fetchFromGitHub
+, gdk-pixbuf
+, libgnomekbd
+, glib
+, gobject-introspection
+, gtk3
+, intltool
+, json-glib
+, callPackage
+, libsoup
+, libstartup_notification
+, libXtst
+, muffin
+, networkmanager
+, pkgconfig
+, polkit
+, stdenv
+, wrapGAppsHook
+, libxml2
+, gtk-doc
+, gnome3
+, python3
+, keybinder3
+, cairo
+, xapps
+, upower
+, nemo
+, libnotify
+, accountsservice
+, gnome-online-accounts
+, glib-networking
+, pciutils
+, timezonemap
+}:
+
+let
+  libcroco = callPackage ./libcroco.nix { };
+in
+stdenv.mkDerivation rec {
+  pname = "cinnamon-common";
+  version = "4.4.1";
+
+  src = fetchFromGitHub {
+    owner = "linuxmint";
+    repo = "cinnamon";
+    rev = version;
+    sha256 = "0sv7nqd1l6c727qj30dcgdkvfh1wxpszpgmbdyh58ilmc8xklnqd";
+  };
+
+  patches = [
+    # remove dbus-glib
+    (fetchpatch {
+      url = "https://github.com/linuxmint/cinnamon/commit/ce99760fa15c3de2e095b9a5372eeaca646fbed1.patch";
+      sha256 = "0p2sbdi5w7sgblqbgisb6f8lcj1syzq5vlk0ilvwaqayxjylg8gz";
+    })
+  ];
+
+  buildInputs = [
+    # TODO: review if we really need this all
+    (python3.withPackages (pp: with pp; [ dbus-python setproctitle pygobject3 pycairo xapp pillow pytz tinycss pam pexpect ]))
+    atk
+    cacert
+    cinnamon-control-center
+    cinnamon-desktop
+    cinnamon-menus
+    cjs
+    dbus
+    gdk-pixbuf
+    glib
+    gtk3
+    json-glib
+    libcroco
+    libsoup
+    libstartup_notification
+    libXtst
+    muffin
+    networkmanager
+    pkgconfig
+    polkit
+    libxml2
+    libgnomekbd
+
+    # bindings
+    cairo
+    gnome3.caribou
+    keybinder3
+    upower
+    xapps
+    timezonemap
+    nemo
+    libnotify
+    accountsservice
+
+    # gsi bindings
+    gnome-online-accounts
+    glib-networking # for goa
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    autoreconfHook
+    wrapGAppsHook
+    intltool
+    gtk-doc
+  ];
+
+  autoreconfPhase = ''
+    GTK_DOC_CHECK=false NOCONFIGURE=1 bash ./autogen.sh
+  '';
+
+  configureFlags = [ "--disable-static" "--with-ca-certificates=${cacert}/etc/ssl/certs/ca-bundle.crt" "--with-libxml=${libxml2.dev}/include/libxml2" "--enable-gtk-doc=no" ];
+
+  postPatch = ''
+    substituteInPlace src/Makefile.am \
+      --replace "\$(libdir)/muffin" "${muffin}/lib/muffin"
+    patchShebangs autogen.sh
+
+    find . -type f -exec sed -i \
+      -e s,/usr/share/cinnamon,$out/share/cinnamon,g \
+      -e s,/usr/share/locale,/run/current-system/sw/share/locale,g \
+      {} +
+
+    sed "s|/usr/share/sounds|/run/current-system/sw/share/sounds|g" -i ./files/usr/share/cinnamon/cinnamon-settings/bin/SettingsWidgets.py
+
+    sed "s|/usr/bin/upload-system-info|${xapps}/bin/upload-system-info|g" -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_info.py
+    sed "s|upload-system-info|${xapps}/bin/upload-system-info|g" -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_info.py
+
+    sed "s|/usr/bin/cinnamon-control-center|${cinnamon-control-center}/bin/cinnamon-control-center|g" -i ./files/usr/bin/cinnamon-settings
+    # this one really IS optional
+    sed "s|/usr/bin/gnome-control-center|/run/current-system/sw/bin/gnome-control-center|g" -i ./files/usr/bin/cinnamon-settings
+
+    sed "s|\"/usr/lib\"|\"${cinnamon-control-center}/lib\"|g" -i ./files/usr/share/cinnamon/cinnamon-settings/bin/capi.py
+
+    # another bunch of optional stuff
+    sed "s|/usr/bin|/run/current-system/sw/bin|g" -i ./files/usr/bin/cinnamon-launcher
+
+    sed 's|"lspci"|"${pciutils}/bin/lspci"|g' -i ./files/usr/share/cinnamon/cinnamon-settings/modules/cs_info.py
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/linuxmint/cinnamon";
+    description = "The Cinnamon desktop environment";
+    license = [ licenses.gpl2 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.mkg20001 ];
+  };
+}
--- a/pkgs/desktops/cinnamon/cinnamon-common/libcroco.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/libcroco.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchurl, pkgconfig, libxml2, glib, gnome3 }:
+
+stdenv.mkDerivation rec {
+  pname = "libcroco";
+  version = "0.6.13";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1m110rbj5d2raxcdp4iz0qp172284945awrsbdlq99ksmqsc4zkn";
+  };
+
+  outputs = [ "out" "dev" ];
+  outputBin = "dev";
+
+  configureFlags = stdenv.lib.optional stdenv.isDarwin "--disable-Bsymbolic";
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libxml2 glib ];
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "GNOME CSS2 parsing and manipulation toolkit";
+    homepage = https://gitlab.gnome.org/GNOME/libcroco;
+    license = licenses.lgpl2;
+    platforms = platforms.unix;
+  };
+}
+
--- a/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-screensaver/default.nix
@ -0,0 +1,111 @@
+{ stdenv
+, fetchFromGitHub
+, pkgconfig
+, autoreconfHook
+, glib
+, dbus
+, gettext
+, cinnamon-desktop
+, cinnamon-common
+, intltool
+, libxslt
+, gtk3
+, libnotify
+, libxkbfile
+, cinnamon-menus
+, libgnomekbd
+, libxklavier
+, networkmanager
+, libwacom
+, gnome3
+, libtool
+, wrapGAppsHook
+, tzdata
+, glibc
+, gobject-introspection
+, python3
+, pam
+, accountsservice
+, cairo
+, xapps
+, xorg
+, iso-flags-png-320x420
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cinnamon-screensaver";
+  version = "4.4.0";
+
+  src = fetchFromGitHub {
+    owner = "linuxmint";
+    repo = pname;
+    rev = version;
+    sha256 = "03v41wk1gmgmyl31j7a3pav52gfv2faibj1jnpj3ycwcv4cch5w5";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig
+    autoreconfHook
+    wrapGAppsHook
+    gettext
+    intltool
+    dbus # for configure.ac
+    libxslt
+    libtool
+  ];
+
+  buildInputs = [
+    # from configure.ac
+    gobject-introspection
+    gtk3
+    glib
+
+    xorg.libXext
+    xorg.libXinerama
+    xorg.libX11
+    xorg.libXrandr
+
+    (python3.withPackages (pp: with pp; [ pygobject3 setproctitle xapp pycairo ]))
+    xapps
+    pam
+    accountsservice
+    cairo
+    cinnamon-desktop
+    cinnamon-common
+    gnome3.libgnomekbd
+    gnome3.caribou
+
+    # things
+    iso-flags-png-320x420
+  ];
+
+  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0"; # TODO: https://github.com/NixOS/nixpkgs/issues/36468
+
+  postPatch = ''
+    patchShebangs autogen.sh
+
+    sed ${stdenv.lib.escapeShellArg "s&DBUS_SESSION_SERVICE_DIR=.*&DBUS_SESSION_SERVICE_DIR=`$PKG_CONFIG --variable session_bus_services_dir dbus-1 | sed -e 's,/usr/share,\${datarootdir},g' | sed 's|^|$out|'`&g"} -i configure.ac
+
+    # cscreensaver hardcodes absolute paths everywhere. Nuke from orbit.
+    find . -type f -exec sed -i \
+      -e s,/usr/share/locale,/run/current-system/sw/share/locale,g \
+      -e s,/usr/lib/cinnamon-screensaver,$out/lib,g \
+      -e s,/usr/share/cinnamon-screensaver,$out/share,g \
+      -e s,/usr/share/iso-flag-png,${iso-flags-png-320x420}/share/iso-flags-png,g \
+      {} +
+
+    sed "s|/usr/share/locale|/run/current-system/sw/share/locale|g" -i ./src/cinnamon-screensaver-main.py
+  '';
+
+  autoreconfPhase = ''
+    NOCONFIGURE=1 bash ./autogen.sh
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/linuxmint/cinnamon-screensaver";
+    description = "The Cinnamon screen locker and screensaver program";
+    license = [ licenses.gpl2 licenses.lgpl2 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.mkg20001 ];
+  };
+}
--- a/pkgs/desktops/cinnamon/default.nix
+++ b/pkgs/desktops/cinnamon/default.nix
@ -1,10 +1,23 @@
 { pkgs, lib }:

 lib.makeScope pkgs.newScope (self: with self; {
+  iso-flags-png-320x420 = pkgs.iso-flags.overrideAttrs(p: p // {
+    buildPhase = "make png-country-320x240-fancy";
+    # installPhase = "mkdir -p $out/share && mv build/png-country-4x2-fancy/res-320x240 $out/share/iso-flags-png-320x420";
+    installPhase = "mkdir -p $out/share && mv build/png-country-4x2-fancy/res-320x240 $out/share/iso-flags-png";
+  });
+
+  iso-flags-svg = pkgs.iso-flags.overrideAttrs(p: p // {
+    buildPhase = "mkdir -p $out/share";
+    installPhase = "mv svg $out/share/iso-flags-svg";
+  });
+
+  cinnamon-common = callPackage ./cinnamon-common { };
  cinnamon-control-center = callPackage ./cinnamon-control-center { };
  cinnamon-desktop = callPackage ./cinnamon-desktop { };
  cinnamon-menus = callPackage ./cinnamon-menus { };
  cinnamon-translations = callPackage ./cinnamon-translations { };
+  cinnamon-screensaver = callPackage ./cinnamon-screensaver { };
  cinnamon-session = callPackage ./cinnamon-session { };
  cinnamon-settings-daemon = callPackage ./cinnamon-settings-daemon { };
  cjs = callPackage ./cjs { };
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "appcenter";
-  version = "3.4.1";
+  version = "3.4.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1bwkjxl4k49hvy88llif82hdancda9692vjwkw4bxy2cbz8444zx";
+    sha256 = "sha256-8r0DlmG8xlCQ1uFHZQjXG2ls4VBrsRzrVY8Ey3/OYAU=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1csxsr2c8qvl97xz9ahwn91z095nzgr0i1mbcb1spljll2sr9lkj";
+    sha256 = "sha256-ctKUtaBU0qvDYquGCPL7tiTwQ7IcqvT7SXRjxETWXbM=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
@ -26,7 +26,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-calendar";
-  version = "5.0.6";
+  version = "5.1.0";

  repoName = "calendar";

@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "0lmadk4yzf1kiiqshwqcxzcyia1haq1avv6pyzvsaywxhqwdsini";
+    sha256 = "sha256-b72BmChl/Ql0ljLRcPMNbJcOV4cVqz5D2j+5BGUi4Go=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "13jg224h2436swd6kdkfs22icg0ja9lshvxwg5bqnb5fshspkjba";
+    sha256 = "sha256-asl5NdSuLItXebxvqGlSEjwWhdButmka12YQAYkQT44=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-code/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-code/default.nix
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "158zrzyyy507rxcbsb5am9768zbakpwrl61ixab57zla7z51l0g0";
+    sha256 = "sha256-4AEayj+K/lOW6jEYmvmdan1kTqqqLL1YzwcU7/3PH5U=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, fetchpatch
 , vala
 , atk
 , cairo
@ -40,6 +41,14 @@ stdenv.mkDerivation rec {
    sha256 = "01vinik73s0vmk56samgf49zr2bl4wjv44x15sz2cmh744llckja";
  };

+  patches = [
+    # Fix double includedir path in plank.pc
+    (fetchpatch {
+      url = "https://github.com/elementary/dock/commit/3bc368e2c4fafcd5b8baca2711c773b0e2441c7c.patch";
+      sha256 = "0gg35phi1cg7ixljc388i0h70w323r1gqzjhanccnsbjpqsgvs3k";
+    })
+  ];
+
  nativeBuildInputs = [
    gettext
    meson
--- a/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-feedback/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "0rc4ifs4hd4cj0v028bzc45v64pwx21xylwrhb20jpw61ainfi8s";
+    sha256 = "sha256-GkVnowqGXwnEgplT34Po/BKzC2F/IQE2kIw0SLSLhGU=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-files/0001-filechooser-module-hardcode-gsettings-for-nixos.patch
+++ b/pkgs/desktops/pantheon/apps/elementary-files/0001-filechooser-module-hardcode-gsettings-for-nixos.patch
@ -0,0 +1,35 @@
+From f51974c9736c3e28755245d15729578214652343 Mon Sep 17 00:00:00 2001
+Message-Id: <f51974c9736c3e28755245d15729578214652343.1599178185.git-series.worldofpeace@protonmail.ch>
+From: worldofpeace <worldofpeace@protonmail.ch>
+Date: Thu,  3 Sep 2020 20:08:15 -0400
+Subject: [PATCH] filechooser-module: hardcode gsettings for nixos
+
+---
+ filechooser-module/FileChooserDialog.vala | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/filechooser-module/FileChooserDialog.vala b/filechooser-module/FileChooserDialog.vala
+index a70fe10..08fde2c 100644
+--- a/filechooser-module/FileChooserDialog.vala
+++ b/filechooser-module/FileChooserDialog.vala
+@@ -60,10 +60,14 @@ public class CustomFileChooserDialog : Object {
+         /* If not local only during creation, strange bug occurs on fresh installs */
+         chooser_dialog.local_only = true;
+ 
+-        var files_preferences = new Settings ("io.elementary.files.preferences");
+        SettingsSchemaSource sss = new SettingsSchemaSource.from_directory ("@ELEMENTARY_FILES_GSETTINGS_PATH@", SettingsSchemaSource.get_default (), true);
+        SettingsSchema preferences_schema = sss.lookup ("io.elementary.files.preferences", false);
+        SettingsSchema chooser_schema = sss.lookup ("io.elementary.files.file-chooser", false);
+
+        var files_preferences = new Settings.full (preferences_schema, null, null);
+         is_single_click = files_preferences.get_boolean ("single-click");
+ 
+-        var chooser_settings = new Settings ("io.elementary.files.file-chooser");
+        var chooser_settings = new Settings.full (chooser_schema, null, null);
+ 
+         assign_container_box ();
+         remove_gtk_widgets ();
+
+base-commit: 57cb89b64fd2d5c08f4aaf23e8c74bfaa5d0384f
+-- 
+git-series 0.9.1
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@ -17,7 +17,7 @@
 , libnotify
 , libunity
 , pango
-, plank
+, elementary-dock
 , bamf
 , sqlite
 , libdbusmenu-gtk3
@ -31,7 +31,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-files";
-  version = "4.4.4";
+  version = "4.5.0";

  repoName = "files";

@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1hsh9kg30l90r2aqrrap1nfmgjf0la8mfd8h4xm6d7acailcnhmb";
+    sha256 = "sha256-wtQW1poX791DAlSFdVV9psnCfBDeVXI2fDZ2GcvvNn8=";
  };

  passthru = {
@ -64,6 +64,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    bamf
+    elementary-dock
    elementary-icon-theme
    granite
    gtk3
@ -75,13 +76,12 @@ stdenv.mkDerivation rec {
    libnotify
    libunity
    pango
-    plank
    sqlite
    zeitgeist
  ];

  patches = [
-    ./hardcode-gsettings.patch
+    ./0001-filechooser-module-hardcode-gsettings-for-nixos.patch
  ];

  postPatch = ''
--- a/pkgs/desktops/pantheon/apps/elementary-files/hardcode-gsettings.patch
+++ b/pkgs/desktops/pantheon/apps/elementary-files/hardcode-gsettings.patch
@ -1,22 +0,0 @@
-diff --git a/filechooser-module/FileChooserDialog.vala b/filechooser-module/FileChooserDialog.vala
-index cb7c3c49..8b1899d1 100644
--- a/filechooser-module/FileChooserDialog.vala
-+++ b/filechooser-module/FileChooserDialog.vala
-@@ -57,10 +57,15 @@ public class CustomFileChooserDialog : Object {
-         chooser_dialog.deletable = false;
-         chooser_dialog.local_only = false;
- 
-        var settings = new Settings ("io.elementary.files.preferences");
-+        SettingsSchemaSource sss = new SettingsSchemaSource.from_directory ("@ELEMENTARY_FILES_GSETTINGS_PATH@", SettingsSchemaSource.get_default (), true);
-+        SettingsSchema preferences_schema = sss.lookup ("io.elementary.files.preferences", false);
-+        SettingsSchema chooser_schema = sss.lookup ("io.elementary.files.file-chooser", false);
-+
-+        var settings = new Settings.full (preferences_schema, null, null);
-+
-         is_single_click = settings.get_boolean ("single-click");
- 
-        var chooser_settings = new Settings ("io.elementary.files.file-chooser");
-+        var chooser_settings = new Settings.full (chooser_schema, null, null);
- 
-         assign_container_box ();
-         remove_gtk_widgets ();
--- a/pkgs/desktops/pantheon/apps/elementary-music/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "0cb0mwsp5w2bmjq8ap9mi0jvaqr9fgq00gfrkj0mzb5x5c26hrnw";
+    sha256 = "sha256-3GZoBCu9rF+BnNk9APBzKWO1JYg1XYWwrEvwcjWvYDE=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "09jjic165rmprc2cszsgj2m3j3f5p8v9pxx5mj66a0gj3ar3hfbd";
+    sha256 = "sha256-bTk4shryAWWMrKX3mza6xQ05qpBPf80Ey7fmYgKLUiY=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-screenshot-tool/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot-tool/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "179ib2ldvhdx3hks5lqyx2cvlkk3j1qccvlfwh2yd2bl79zpk3ma";
+    sha256 = "sha256-qo55fzp0ieYF5I5uxnCQY066mege06InHL3B3ahYMZ0=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-terminal/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "119iwmzbpkj4nmxinqfsh73lx23g8gbl6ha6wc4mc4fq9hpnc9c2";
+    sha256 = "sha256-giVmL0zYEVYJ40ZBQ9dDb4hOx4HaYRt7tUTOu37lMYU=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "07dwhshdc78wia0fsbzz6iv651znzzasfil91w60v29kgc4s2b1i";
+    sha256 = "sha256-MSyhCXsziQ0MD4lGp9X/9odidjT/L+2Aihwd1qCGvB0=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/sideload/default.nix
+++ b/pkgs/desktops/pantheon/apps/sideload/default.nix
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0mlc3nm2navzxm8k1rwpbw4w6mv30lmhqybm8jqxd4v8x7my73vq";
+    sha256 = "sha256-eI/j6+lok9axRHV5DCsFY1fDCV+X5zBR7X8rK6odjFY=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/a11y/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/a11y/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0g8lhdwv9g16kjn7yxnl6x4rscjl2206ljfnghpxc4b5lwhqxxnw";
+    sha256 = "sha256-3PaOIadlEdYvfNZJaoAQVDKdSTfUdn+snCa8tHmDFD0=";
  };

  patches = [
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1zs2qmglh85ami07dnlq3lfwl5ikc4abvz94a35k6fhfs703lay2";
+    sha256 = "sha256-wis6wNEOOjPLUCT9vRRhMxbKHR2Y2nZArKogSF/FQv8=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0wzm390g8di4ks3w637a0wl4j7g89j321xkz5msd9058gksvaaxs";
+    sha256 = "sha256-uiu19XyogNR0LX/2IIZM6B1JKAfqDMOHniQ29EAa9XM=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/bluetooth/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/bluetooth/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0ksxx45mm0cvnb5jphyxsf843rn2rgb0yxv9j0ydh2xp4qgvvyva";
+    sha256 = "sha256-avu9Hya3C9g8kGl3D9bLwuZBkNPdwyvLspuBWgvpXU8=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/datetime/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1kkd75kp24zq84wfmc00brqxximfsi4sqyx8a7rbl7zaspf182xa";
+    sha256 = "sha256-qgsU3NXqH7ryUah7rEnUrsbecV4AsOo4QfgTcWc5bc4=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0ijzm91gycx8iaf3sd8i07b5899gbryxd6klzjh122d952wsyfcs";
+    sha256 = "sha256-mjmvuSipCRGg/HSa1n1eLyVU1gERNT2ciqgz/0KqX0Y=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/0001-Remove-Install-Unlisted-Engines-function.patch
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/0001-Remove-Install-Unlisted-Engines-function.patch
@ -0,0 +1,700 @@
+From 4fd6da39ab33a6eef46ee2c64eb4f5595c7fe633 Mon Sep 17 00:00:00 2001
+Message-Id: <4fd6da39ab33a6eef46ee2c64eb4f5595c7fe633.1599180249.git-series.worldofpeace@protonmail.ch>
+From: worldofpeace <worldofpeace@protonmail.ch>
+Date: Thu,  3 Sep 2020 20:43:25 -0400
+Subject: [PATCH] Remove Install Unlisted Engines function
+
+https://github.com/elementary/switchboard-plug-keyboard/issues/324
+---
+ src/Dialogs/InstallEngineDialog.vala           | 140 +------------------
+ src/Dialogs/ProgressDialog.vala                |  82 +----------
+ src/InputMethod/Installer/InstallList.vala     |  73 +---------
+ src/InputMethod/Installer/UbuntuInstaller.vala | 142 +------------------
+ src/InputMethod/Installer/aptd-client.vala     |  93 +------------
+ src/Widgets/InputMethod/AddEnginesPopover.vala |  12 +--
+ src/Widgets/InputMethod/LanguagesRow.vala      |  43 +-----
+ src/meson.build                                |   6 +-
+ 8 files changed, 591 deletions(-)
+ delete mode 100644 src/Dialogs/InstallEngineDialog.vala
+ delete mode 100644 src/Dialogs/ProgressDialog.vala
+ delete mode 100644 src/InputMethod/Installer/InstallList.vala
+ delete mode 100644 src/InputMethod/Installer/UbuntuInstaller.vala
+ delete mode 100644 src/InputMethod/Installer/aptd-client.vala
+ delete mode 100644 src/Widgets/InputMethod/LanguagesRow.vala
+
+diff --git a/src/Dialogs/InstallEngineDialog.vala b/src/Dialogs/InstallEngineDialog.vala
+deleted file mode 100644
+index ffba3a8..0000000
+--- a/src/Dialogs/InstallEngineDialog.vala
+++ /dev/null
+@@ -1,140 +0,0 @@
+-/*
+-* Copyright 2019-2020 elementary, Inc. (https://elementary.io)
+-*
+-* This program is free software: you can redistribute it and/or modify
+-* it under the terms of the GNU General Public License as published by
+-* the Free Software Foundation, either version 3 of the License, or
+-* (at your option) any later version.
+-*
+-* This program is distributed in the hope that it will be useful,
+-* but WITHOUT ANY WARRANTY; without even the implied warranty of
+-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-* GNU General Public License for more details.
+-*
+-* You should have received a copy of the GNU General Public License
+-* along with this program.  If not, see <https://www.gnu.org/licenses/>.
+-*/
+-
+-public class Pantheon.Keyboard.InputMethodPage.InstallEngineDialog : Granite.MessageDialog {
+-    private InstallList? engines_filter;
+-
+-    public InstallEngineDialog (Gtk.Window parent) {
+-        Object (
+-            primary_text: _("Choose an engine to install"),
+-            secondary_text: _("Select an engine from the list to install and use."),
+-            image_icon: new ThemedIcon ("extension"),
+-            transient_for: parent,
+-            buttons: Gtk.ButtonsType.CANCEL
+-        );
+-    }
+-
+-    construct {
+-        var languages_list = new Gtk.ListBox () {
+-            activate_on_single_click = true,
+-            expand = true,
+-            selection_mode = Gtk.SelectionMode.NONE
+-        };
+-
+-        foreach (var language in InstallList.get_all ()) {
+-            var lang = new LanguagesRow (language);
+-            languages_list.add (lang);
+-        }
+-
+-        var back_button = new Gtk.Button.with_label (_("Languages")) {
+-            halign = Gtk.Align.START,
+-            margin = 6
+-        };
+-        back_button.get_style_context ().add_class (Granite.STYLE_CLASS_BACK_BUTTON);
+-
+-        var language_title = new Gtk.Label ("");
+-
+-        var language_header = new Gtk.Box (Gtk.Orientation.HORIZONTAL, 6);
+-        language_header.pack_start (back_button);
+-        language_header.set_center_widget (language_title);
+-
+-        var listbox = new Gtk.ListBox () {
+-            expand = true
+-        };
+-        listbox.set_filter_func (filter_function);
+-        listbox.set_sort_func (sort_function);
+-
+-        foreach (var language in InstallList.get_all ()) {
+-            foreach (var engine in language.get_components ()) {
+-                listbox.add (new EnginesRow (engine));
+-            }
+-        }
+-
+-        var scrolled = new Gtk.ScrolledWindow (null, null);
+-        scrolled.add (listbox);
+-
+-        var engine_list_grid = new Gtk.Grid () {
+-            orientation = Gtk.Orientation.VERTICAL
+-        };
+-        engine_list_grid.get_style_context ().add_class (Gtk.STYLE_CLASS_VIEW);
+-        engine_list_grid.add (language_header);
+-        engine_list_grid.add (new Gtk.Separator (Gtk.Orientation.HORIZONTAL));
+-        engine_list_grid.add (scrolled);
+-
+-        var stack = new Gtk.Stack () {
+-            height_request = 200,
+-            width_request = 300,
+-            transition_type = Gtk.StackTransitionType.SLIDE_LEFT_RIGHT
+-        };
+-        stack.add (languages_list);
+-        stack.add (engine_list_grid);
+-
+-        var frame = new Gtk.Frame (null);
+-        frame.add (stack);
+-
+-        custom_bin.add (frame);
+-        custom_bin.show_all ();
+-
+-        var install_button = add_button (_("Install"), Gtk.ResponseType.OK);
+-        install_button.sensitive = false;
+-        install_button.get_style_context ().add_class (Gtk.STYLE_CLASS_SUGGESTED_ACTION);
+-
+-        languages_list.row_activated.connect ((row) => {
+-            stack.visible_child = engine_list_grid;
+-            language_title.label = ((LanguagesRow) row).language.get_name ();
+-            engines_filter = ((LanguagesRow) row).language;
+-            listbox.invalidate_filter ();
+-            var adjustment = scrolled.get_vadjustment ();
+-            adjustment.set_value (adjustment.lower);
+-        });
+-
+-        back_button.clicked.connect (() => {
+-            stack.visible_child = languages_list;
+-            install_button.sensitive = false;
+-        });
+-
+-        listbox.selected_rows_changed.connect (() => {
+-            foreach (var engines_row in listbox.get_children ()) {
+-                ((EnginesRow) engines_row).selected = false;
+-            }
+-
+-            ((EnginesRow) listbox.get_selected_row ()).selected = true;
+-            install_button.sensitive = true;
+-        });
+-
+-        response.connect ((response_id) => {
+-            if (response_id == Gtk.ResponseType.OK) {
+-                string engine_to_install = ((EnginesRow) listbox.get_selected_row ()).engine_name;
+-                UbuntuInstaller.get_default ().install (engine_to_install);
+-            }
+-        });
+-    }
+-
+-    [CCode (instance_pos = -1)]
+-    private bool filter_function (Gtk.ListBoxRow row) {
+-        if (InstallList.get_language_from_engine_name (((EnginesRow) row).engine_name) == engines_filter) {
+-            return true;
+-        }
+-
+-        return false;
+-    }
+-
+-    [CCode (instance_pos = -1)]
+-    private int sort_function (Gtk.ListBoxRow row1, Gtk.ListBoxRow row2) {
+-        return ((EnginesRow) row1).engine_name.collate (((EnginesRow) row1).engine_name);
+-    }
+-}
+diff --git a/src/Dialogs/ProgressDialog.vala b/src/Dialogs/ProgressDialog.vala
+deleted file mode 100644
+index f110aca..0000000
+--- a/src/Dialogs/ProgressDialog.vala
+++ /dev/null
+@@ -1,82 +0,0 @@
+-/*
+-* Copyright 2011-2020 elementary, Inc. (https://elementary.io)
+-*
+-* This program is free software: you can redistribute it
+-* and/or modify it under the terms of the GNU Lesser General Public License as
+-* published by the Free Software Foundation, either version 3 of the
+-* License, or (at your option) any later version.
+-*
+-* This program is distributed in the hope that it will be
+-* useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
+-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+-* Public License for more details.
+-*
+-* You should have received a copy of the GNU General Public License along
+-* with this program. If not, see http://www.gnu.org/licenses/.
+-*/
+-
+-public class Pantheon.Keyboard.InputMethodPage.ProgressDialog : Gtk.Dialog {
+-    public int progress {
+-        set {
+-            if (value >= 100) {
+-                destroy ();
+-            }
+-
+-            progress_bar.fraction = value / 100.0;
+-        }
+-    }
+-
+-    private Gtk.ProgressBar progress_bar;
+-
+-    construct {
+-        var image = new Gtk.Image.from_icon_name ("preferences-desktop-locale", Gtk.IconSize.DIALOG) {
+-            valign = Gtk.Align.START
+-        };
+-
+-        var primary_label = new Gtk.Label (null) {
+-            max_width_chars = 50,
+-            wrap = true,
+-            xalign = 0
+-        };
+-        primary_label.get_style_context ().add_class (Granite.STYLE_CLASS_PRIMARY_LABEL);
+-
+-        unowned UbuntuInstaller installer = UbuntuInstaller.get_default ();
+-        switch (installer.transaction_mode) {
+-            case UbuntuInstaller.TransactionMode.INSTALL:
+-                primary_label.label = _("Installing %s").printf (installer.engine_to_address);
+-                break;
+-            case UbuntuInstaller.TransactionMode.REMOVE:
+-                primary_label.label = _("Removing %s").printf (installer.engine_to_address);
+-                break;
+-        }
+-
+-        progress_bar = new Gtk.ProgressBar () {
+-            hexpand = true,
+-            valign = Gtk.Align.START,
+-            width_request = 300
+-        };
+-
+-        var cancel_button = (Gtk.Button) add_button (_("Cancel"), 0);
+-
+-        installer.bind_property ("install-cancellable", cancel_button, "sensitive");
+-
+-        var grid = new Gtk.Grid () {
+-            column_spacing = 12,
+-            margin = 6,
+-            row_spacing = 6
+-        };
+-        grid.attach (image, 0, 0, 1, 2);
+-        grid.attach (primary_label, 1, 0);
+-        grid.attach (progress_bar, 1, 1);
+-        grid.show_all ();
+-
+-        border_width = 6;
+-        deletable = false;
+-        get_content_area ().add (grid);
+-
+-        cancel_button.clicked.connect (() => {
+-            installer.cancel_install ();
+-            destroy ();
+-        });
+-    }
+-}
+diff --git a/src/InputMethod/Installer/InstallList.vala b/src/InputMethod/Installer/InstallList.vala
+deleted file mode 100644
+index 275c302..0000000
+--- a/src/InputMethod/Installer/InstallList.vala
+++ /dev/null
+@@ -1,73 +0,0 @@
+-/*
+-* 2019-2020 elementary, Inc. (https://elementary.io)
+-*
+-* This program is free software: you can redistribute it and/or modify
+-* it under the terms of the GNU General Public License as published by
+-* the Free Software Foundation, either version 3 of the License, or
+-* (at your option) any later version.
+-*
+-* This program is distributed in the hope that it will be useful,
+-* but WITHOUT ANY WARRANTY; without even the implied warranty of
+-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-* GNU General Public License for more details.
+-*
+-* You should have received a copy of the GNU General Public License
+-* along with this program.  If not, see <https://www.gnu.org/licenses/>.
+-*/
+-
+-public enum Pantheon.Keyboard.InputMethodPage.InstallList {
+-    JA,
+-    KO,
+-    ZH;
+-
+-    public string get_name () {
+-        switch (this) {
+-            case JA:
+-                return _("Japanese");
+-            case KO:
+-                return _("Korean");
+-            case ZH:
+-                return _("Chinese");
+-            default:
+-                assert_not_reached ();
+-        }
+-    }
+-
+-    public string[] get_components () {
+-        switch (this) {
+-            case JA:
+-                return { "ibus-anthy", "ibus-mozc", "ibus-skk" };
+-            case KO:
+-                return { "ibus-hangul" };
+-            case ZH:
+-                return { "ibus-cangjie", "ibus-chewing", "ibus-pinyin" };
+-            default:
+-                assert_not_reached ();
+-        }
+-    }
+-
+-    public static InstallList get_language_from_engine_name (string engine_name) {
+-        switch (engine_name) {
+-            case "ibus-anthy":
+-                return JA;
+-            case "ibus-mozc":
+-                return JA;
+-            case "ibus-skk":
+-                return JA;
+-            case "ibus-hangul":
+-                return KO;
+-            case "ibus-cangjie":
+-                return ZH;
+-            case "ibus-chewing":
+-                return ZH;
+-            case "ibus-pinyin":
+-                return ZH;
+-            default:
+-                assert_not_reached ();
+-        }
+-    }
+-
+-    public static InstallList[] get_all () {
+-        return { JA, KO, ZH };
+-    }
+-}
+diff --git a/src/InputMethod/Installer/UbuntuInstaller.vala b/src/InputMethod/Installer/UbuntuInstaller.vala
+deleted file mode 100644
+index b65aa1f..0000000
+--- a/src/InputMethod/Installer/UbuntuInstaller.vala
+++ /dev/null
+@@ -1,142 +0,0 @@
+-/*
+-* Copyright 2011-2020 elementary, Inc. (https://elementary.io)
+-*
+-* This program is free software: you can redistribute it
+-* and/or modify it under the terms of the GNU Lesser General Public License as
+-* published by the Free Software Foundation, either version 3 of the
+-* License, or (at your option) any later version.
+-*
+-* This program is distributed in the hope that it will be
+-* useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
+-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
+-* Public License for more details.
+-*
+-* You should have received a copy of the GNU General Public License along
+-* with this program. If not, see http://www.gnu.org/licenses/.
+-*/
+-
+-public class Pantheon.Keyboard.InputMethodPage.UbuntuInstaller : Object {
+-    private AptdProxy aptd;
+-    private AptdTransactionProxy proxy;
+-
+-    public bool install_cancellable { get; private set; }
+-    public TransactionMode transaction_mode { get; private set; }
+-    public string engine_to_address { get; private set; }
+-
+-    public signal void install_finished (string langcode);
+-    public signal void install_failed ();
+-    public signal void remove_finished (string langcode);
+-    public signal void progress_changed (int progress);
+-
+-    public enum TransactionMode {
+-        INSTALL,
+-        REMOVE,
+-        INSTALL_MISSING,
+-    }
+-
+-    Gee.HashMap<string, string> transactions;
+-
+-    private static GLib.Once<UbuntuInstaller> instance;
+-    public static unowned UbuntuInstaller get_default () {
+-        return instance.once (() => {
+-            return new UbuntuInstaller ();
+-        });
+-    }
+-
+-    private UbuntuInstaller () {}
+-
+-    construct {
+-        transactions = new Gee.HashMap<string, string> ();
+-        aptd = new AptdProxy ();
+-
+-        try {
+-            aptd.connect_to_aptd ();
+-        } catch (Error e) {
+-            warning ("Could not connect to APT daemon");
+-        }
+-    }
+-
+-    public void install (string engine_name) {
+-        transaction_mode = TransactionMode.INSTALL;
+-        engine_to_address = engine_name;
+-        string[] packages = {};
+-        packages += engine_to_address;
+-
+-        foreach (var packet in packages) {
+-            message ("Packet: %s", packet);
+-        }
+-
+-        aptd.install_packages.begin (packages, (obj, res) => {
+-            try {
+-                var transaction_id = aptd.install_packages.end (res);
+-                transactions.@set (transaction_id, "i-" + engine_name);
+-                run_transaction (transaction_id);
+-            } catch (Error e) {
+-                warning ("Could not queue downloads: %s", e.message);
+-            }
+-        });
+-    }
+-
+-    public void cancel_install () {
+-        if (install_cancellable) {
+-            warning ("cancel_install");
+-            try {
+-                proxy.cancel ();
+-            } catch (Error e) {
+-                warning ("cannot cancel installation:%s", e.message);
+-            }
+-        }
+-    }
+-
+-    private void run_transaction (string transaction_id) {
+-        proxy = new AptdTransactionProxy ();
+-        proxy.finished.connect (() => {
+-            on_apt_finshed (transaction_id, true);
+-        });
+-
+-        proxy.property_changed.connect ((prop, val) => {
+-            if (prop == "Progress") {
+-                progress_changed ((int) val.get_int32 ());
+-            }
+-
+-            if (prop == "Cancellable") {
+-                install_cancellable = val.get_boolean ();
+-            }
+-        });
+-
+-        try {
+-            proxy.connect_to_aptd (transaction_id);
+-            proxy.simulate ();
+-
+-            proxy.run ();
+-        } catch (Error e) {
+-            on_apt_finshed (transaction_id, false);
+-            warning ("Could no run transaction: %s", e.message);
+-        }
+-    }
+-
+-    private void on_apt_finshed (string id, bool success) {
+-        if (!success) {
+-            install_failed ();
+-            transactions.unset (id);
+-            return;
+-        }
+-
+-        if (!transactions.has_key (id)) { //transaction already removed
+-            return;
+-        }
+-
+-        var action = transactions.get (id);
+-        var lang = action[2:action.length];
+-
+-        message ("ID %s -> %s", id, success ? "success" : "failed");
+-
+-        if (action[0:1] == "i") { // install
+-            install_finished (lang);
+-        } else {
+-            remove_finished (lang);
+-        }
+-
+-        transactions.unset (id);
+-    }
+-}
+diff --git a/src/InputMethod/Installer/aptd-client.vala b/src/InputMethod/Installer/aptd-client.vala
+deleted file mode 100644
+index ee5c3f5..0000000
+--- a/src/InputMethod/Installer/aptd-client.vala
+++ /dev/null
+@@ -1,93 +0,0 @@
+-/*
+- * Copyright (C) 2012 Canonical Ltd
+- *
+- * This program is free software: you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 3 as
+- * published by the Free Software Foundation.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+- *
+- * Authored by Pawel Stolowski <pawel.stolowski@canonical.com>
+- */
+-
+-namespace Pantheon.Keyboard.InputMethodPage {
+-    private const string APTD_DBUS_NAME = "org.debian.apt";
+-    private const string APTD_DBUS_PATH = "/org/debian/apt";
+-
+-    /**
+-    * Expose a subset of org.debian.apt interfaces -- only what's needed by applications lens.
+-    */
+-    [DBus (name = "org.debian.apt")]
+-    public interface AptdService : GLib.Object {
+-        public abstract async string install_packages (string[] packages) throws GLib.Error;
+-        public abstract async string remove_packages (string[] packages) throws GLib.Error;
+-        public abstract async void quit () throws GLib.Error;
+-    }
+-
+-    [DBus (name = "org.debian.apt.transaction")]
+-    public interface AptdTransactionService : GLib.Object {
+-        public abstract void run () throws GLib.Error;
+-        public abstract void simulate () throws GLib.Error;
+-        public abstract void cancel () throws GLib.Error;
+-        public signal void finished (string exit_state);
+-        public signal void property_changed (string property, Variant val);
+-    }
+-
+-    public class AptdProxy : GLib.Object {
+-        private AptdService _aptd_service;
+-
+-        public void connect_to_aptd () throws GLib.Error {
+-            _aptd_service = Bus.get_proxy_sync (BusType.SYSTEM, APTD_DBUS_NAME, APTD_DBUS_PATH);
+-        }
+-
+-        public async string install_packages (string[] packages) throws GLib.Error {
+-            string res = yield _aptd_service.install_packages (packages);
+-            return res;
+-        }
+-
+-        public async string remove_packages (string[] packages) throws GLib.Error {
+-            string res = yield _aptd_service.remove_packages (packages);
+-            return res;
+-        }
+-
+-        public async void quit () throws GLib.Error {
+-            yield _aptd_service.quit ();
+-        }
+-    }
+-
+-    public class AptdTransactionProxy : GLib.Object {
+-        public signal void finished (string transaction_id);
+-        public signal void property_changed (string property, Variant variant);
+-
+-        private AptdTransactionService _aptd_service;
+-
+-        public void connect_to_aptd (string transaction_id) throws GLib.Error {
+-            _aptd_service = Bus.get_proxy_sync (BusType.SYSTEM, APTD_DBUS_NAME, transaction_id);
+-            _aptd_service.finished.connect ((exit_state) => {
+-                debug ("aptd transaction finished: %s\n", exit_state);
+-                finished (transaction_id);
+-            });
+-            _aptd_service.property_changed.connect ((prop, variant) => {
+-                property_changed (prop, variant);
+-            });
+-        }
+-
+-        public void simulate () throws GLib.Error {
+-            _aptd_service.simulate ();
+-        }
+-
+-        public void run () throws GLib.Error {
+-            _aptd_service.run ();
+-        }
+-
+-        public void cancel () throws GLib.Error {
+-            _aptd_service.cancel ();
+-        }
+-    }
+-}
+diff --git a/src/Widgets/InputMethod/AddEnginesPopover.vala b/src/Widgets/InputMethod/AddEnginesPopover.vala
+index 46e005d..6b56c6b 100644
+--- a/src/Widgets/InputMethod/AddEnginesPopover.vala
+++ b/src/Widgets/InputMethod/AddEnginesPopover.vala
+@@ -49,8 +49,6 @@ public class Pantheon.Keyboard.InputMethodPage.AddEnginesPopover : Gtk.Popover {
+         };
+         scrolled.add (listbox);
+ 
+-        var install_button = new Gtk.Button.with_label (_("Install Unlisted Engines…"));
+-
+         var cancel_button = new Gtk.Button.with_label (_("Cancel"));
+ 
+         var add_button = new Gtk.Button.with_label (_("Add Engine"));
+@@ -61,10 +59,8 @@ public class Pantheon.Keyboard.InputMethodPage.AddEnginesPopover : Gtk.Popover {
+             margin = 12,
+             spacing = 6
+         };
+-        button_box.add (install_button);
+         button_box.add (cancel_button);
+         button_box.add (add_button);
+-        button_box.set_child_secondary (install_button, true);
+ 
+         var grid = new Gtk.Grid ();
+         grid.attach (search_entry, 0, 0);
+@@ -92,14 +88,6 @@ public class Pantheon.Keyboard.InputMethodPage.AddEnginesPopover : Gtk.Popover {
+             listbox.invalidate_filter ();
+         });
+ 
+-        install_button.clicked.connect (() => {
+-            popdown ();
+-
+-            var install_dialog = new InstallEngineDialog ((Gtk.Window) get_toplevel ());
+-            install_dialog.run ();
+-            install_dialog.destroy ();
+-        });
+-
+         cancel_button.clicked.connect (() => {
+             popdown ();
+         });
+diff --git a/src/Widgets/InputMethod/LanguagesRow.vala b/src/Widgets/InputMethod/LanguagesRow.vala
+deleted file mode 100644
+index dc064ae..0000000
+--- a/src/Widgets/InputMethod/LanguagesRow.vala
+++ /dev/null
+@@ -1,43 +0,0 @@
+-/*
+-* 2019-2020 elementary, Inc. (https://elementary.io)
+-*
+-* This program is free software: you can redistribute it and/or modify
+-* it under the terms of the GNU General Public License as published by
+-* the Free Software Foundation, either version 3 of the License, or
+-* (at your option) any later version.
+-*
+-* This program is distributed in the hope that it will be useful,
+-* but WITHOUT ANY WARRANTY; without even the implied warranty of
+-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-* GNU General Public License for more details.
+-*
+-* You should have received a copy of the GNU General Public License
+-* along with this program.  If not, see <https://www.gnu.org/licenses/>.
+-*/
+-
+-public class Pantheon.Keyboard.InputMethodPage.LanguagesRow : Gtk.ListBoxRow {
+-    public InstallList language { get; construct; }
+-
+-    public LanguagesRow (InstallList language) {
+-        Object (language: language);
+-    }
+-
+-    construct {
+-        var label = new Gtk.Label (language.get_name ()) {
+-            halign = Gtk.Align.START,
+-            hexpand = true
+-        };
+-
+-        var caret = new Gtk.Image.from_icon_name ("pan-end-symbolic", Gtk.IconSize.MENU);
+-
+-        var grid = new Gtk.Grid () {
+-            margin = 3,
+-            margin_start = 6,
+-            margin_end = 6
+-        };
+-        grid.add (label);
+-        grid.add (caret);
+-
+-        add (grid);
+-    }
+-}
+diff --git a/src/meson.build b/src/meson.build
+index 28f07c1..a515419 100644
+--- a/src/meson.build
+++ b/src/meson.build
+@@ -16,7 +16,6 @@ plug_files = files(
+     'Widgets/Shortcuts/CustomTree.vala',
+     'Widgets/Layout/Display.vala',
+     'Widgets/Layout/AddLayoutPopover.vala',
+-    'Widgets/InputMethod/LanguagesRow.vala',
+     'Widgets/InputMethod/EnginesRow.vala',
+     'Widgets/InputMethod/AddEnginesPopover.vala',
+     'Views/Shortcuts.vala',
+@@ -36,11 +35,6 @@ plug_files = files(
+     'Layout/AdvancedSettingsGrid.vala',
+     'InputMethod/Utils.vala',
+     'InputMethod/AddEnginesList.vala',
+-    'InputMethod/Installer/UbuntuInstaller.vala',
+-    'InputMethod/Installer/InstallList.vala',
+-    'InputMethod/Installer/aptd-client.vala',
+-    'Dialogs/ProgressDialog.vala',
+-    'Dialogs/InstallEngineDialog.vala',
+     'Dialogs/ConflictDialog.vala',
+ )
+ 
+
+base-commit: 9d9eddeb7da8450a309496c25066f4f78a9d4070
+-- 
+git-series 0.9.1
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
@ -15,20 +15,25 @@
 , libgnomekbd
 , libxklavier
 , xorg
+, ibus
 , switchboard
 }:

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-keyboard";
-  version = "2.3.6";
+  version = "2.4.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "08zpw7ygrqmwwznvxkf4xbrgwbjkbwc95sw1ikikg3143ql9qclp";
+    sha256 = "sha256-iuv5NZ7v+rXyFsKB/PvGa/7hm9MIV8E6JnTzEGROlhM=";
  };

+  patches = [
+    ./0001-Remove-Install-Unlisted-Engines-function.patch
+  ];
+
  passthru = {
    updateScript = nix-update-script {
      attrPath = "pantheon.${pname}";
@ -46,6 +51,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    granite
    gtk3
+    ibus
    libgee
    libgnomekbd
    libxklavier
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0jfykvdpjlymnks8mhlv9957ybq7srqqq23isjvh0jvc2r3cd7sq";
+    sha256 = "sha256-WJ/GRhZsSwC31HEIjHHWBy9/Skqbwor0tNVTedue3kk=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/network/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-network";
-  version = "2.3.1";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1k7925qrgjvh1x8ijhkh3p0z4ypgmx3lg21ygr8qhlp7xr3zm8d5";
+    sha256 = "sha256-PYgewxBblhOfOJQSeRaq8xD7qZ3083EvgUjpi92FqyI=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/notifications/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/notifications/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "02amm2j6blpfc16p5rm64p8shnppzsg49hz4v196mli5xr1r441h";
+    sha256 = "sha256-MBCSQ+4l0mpS2OTDRJ7+91qo0SWm5nJNYO7SZaSoVQk=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "03h8ii8zz59fpp4fwlvyx3m3550096fn7a6w612b1rbj3dqhlmh9";
+    sha256 = "sha256-CVYKcRty5bBEMNyoY51JAJQy6uh+U+7IvS6V/1GMCA4=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/pantheon-shell/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, nix-update-script, pantheon, meson, ninja, pkgconfig, vala, glib
 , libgee, granite, gexiv2, elementary-settings-daemon, gtk3, gnome-desktop
-, gala, wingpanel, plank, switchboard, gettext, bamf, fetchpatch }:
+, gala, wingpanel, elementary-dock, switchboard, gettext, bamf, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-pantheon-shell";
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1nnsv745inbdqk3xnbcaqmj87vr3kzh5hazbh8v3ib33cpi7wy88";
+    sha256 = "sha256-CHl+4mVjrDg2gusrWOCfI++DZMWKLdvHxG3ZWMjZ2to=";
  };

  passthru = {
@ -29,17 +29,17 @@ stdenv.mkDerivation rec {

  buildInputs = [
    bamf
+    elementary-dock
    elementary-settings-daemon
+    gala
    gexiv2
    glib
    gnome-desktop
    granite
    gtk3
    libgee
-    gala
-    wingpanel
-    plank
    switchboard
+    wingpanel
  ];

  meta = with stdenv.lib; {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/power/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/power/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0zbqv3bnwxapp9b442fjg9fizxmndva8vby5qicx0yy7l68in1xk";
+    sha256 = "sha256-swcbkaHHe9BZxMWvjdRutvYfXXrSCUJWuld1btfYeH0=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/printers/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/printers/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1jxpq4rvkrii85imnipbw44zjinq1sc0cq39lssprzfd4g5hjw5n";
+    sha256 = "sha256-tnAJyyPN/Xy1pmlgBpgO2Eb5CeHrRltjQTHmuTPBt8s=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/security-privacy/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/security-privacy/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0177lsly8qpqsfas3qc263as77h2k35avhw9708h1v8bllb3l2sb";
+    sha256 = "sha256-Sws6FqUL7QAROInDrcqYAp6j1TCC4aGV0/hi5Kmm5wQ=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/sharing/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/sharing/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1awkz16nydlgi8a2dd6agfnd3qwl2qsvv6wnn8bhaz1kbv1v9kpw";
+    sha256 = "sha256-/M60w14zfAUXspabvTUWlOPRrHvKtCYUio82b034k6s=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/sound/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/sound/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-sound";
-  version = "2.2.4";
+  version = "2.2.5";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1kwd3cj6kk5dnmhcrmf13adqrhhjv2j6j2i78cpqbi9yv2h7sv9y";
+    sha256 = "sha256-ITgxLZSB4zhSaFKX7Vbf89DGI8ibIcGEQTtLjcGN2tA=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard/default.nix
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "12xir2gssr0x21sgm5m620bvd6b6y8dcm26cj4s1wsn8qb59jx9p";
+    sha256 = "sha256-N3WZysLIah40kcyIyhryZpm2FxCmlvp0EB1krZ/IsYs=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
+++ b/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "0aqq0d21mqgrfiyhpfa8k51wxw2pia0qlsgp0sli79v7nwn3ykbq";
+    sha256 = "sha256-eE0/LLdnpxOpBvdpioGKV/DOQ5lIuQt9dPnhGkQDGCs=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix
+++ b/pkgs/desktops/pantheon/artwork/elementary-icon-theme/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "0rs68cb39r9vq85pr8h3mgmyjpj8bkhkxr5cz4cn5947kf776wg9";
+    sha256 = "sha256-6XFzjpuHpGIZ+azkPuFcSF7p66sDonwLwjvlNBZDRmc=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/artwork/elementary-sound-theme/default.nix
+++ b/pkgs/desktops/pantheon/artwork/elementary-sound-theme/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1dc583lq61c361arjl3s44d2k72c46bqvcqv1c3s69f2ndsnxjdz";
+    sha256 = "sha256-v8ludbPCJaMHCxuzjZchTJwpGiF6UJlVMIMFg+lAhbU=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/pantheon/artwork/elementary-wallpapers/default.nix
+++ b/pkgs/desktops/pantheon/artwork/elementary-wallpapers/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "0c63nds2ylqgcp39s13mfwhipgyw8cirn0bhybp291l5g86ii6s3";
+    sha256 = "sha256-Q5sYDXqFhiTu8nABmyND3L8bIXd1BJ3GZQ9TL3SzwzA=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "00z31alwn2skhksrhp2jk75f6jlaipzk91hclx7na4gbcyrw7ahw";
+    sha256 = "sha256-HKrDs2frEWVPpwyGNP+NikrjyplSXJj1hFMLy6kK4wM=";
  };

  passthru = {
--- a/Show More
+++ b/Show More