Merge branch 'master' into staging-next

Rebuilds due to haskell/hackage update.

maintainers/maintainer-list.nix

@@ -4924,6 +4924,12 @@
     githubId = 1202012;
     name = "Ignat Loskutov";
   };
+  lostnet = {
+    email = "lost.networking@gmail.com";
+    github = "lostnet";
+    githubId = 1422781;
+    name = "Will Young";
+  };
   louisdk1 = {
     email = "louis@louis.dk";
     github = "louisdk1";

nixos/modules/installer/tools/tools.nix

@@ -22,7 +22,11 @@ let
     src = ./nixos-install.sh;
     inherit (pkgs) runtimeShell;
     nix = config.nix.package.out;
-    path = makeBinPath [ pkgs.nixUnstable nixos-enter ];
+    path = makeBinPath [ 
+      pkgs.nixUnstable 
+      pkgs.jq
+      nixos-enter 
+    ];
   };
 
   nixos-rebuild =

nixos/modules/services/databases/couchdb.nix

@@ -11,7 +11,13 @@ let
       database_dir = ${cfg.databaseDir}
       uri_file = ${cfg.uriFile}
       view_index_dir = ${cfg.viewIndexDir}
-    '' + (if useVersion2 then
+    '' + (if cfg.adminPass != null then
+    ''
+      [admins]
+      ${cfg.adminUser} = ${cfg.adminPass}
+    '' else
+    ''
+    '') + (if useVersion2 then
     ''
       [chttpd]
     '' else
@@ -54,6 +60,23 @@ in {
         '';
       };
 
+      adminUser = mkOption {
+        type = types.str;
+        default = "admin";
+        description = ''
+          Couchdb (i.e. fauxton) account with permission for all dbs and
+          tasks.
+        '';
+      };
+
+      adminPass = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Couchdb (i.e. fauxton) account with permission for all dbs and
+          tasks.
+        '';
+      };
 
       user = mkOption {
         type = types.str;

nixos/modules/services/databases/victoriametrics.nix

@@ -49,8 +49,8 @@ let cfg = config.services.victoriametrics; in
         ExecStart = ''
           ${cfg.package}/bin/victoria-metrics \
               -storageDataPath=/var/lib/victoriametrics \
-              -httpListenAddr ${cfg.listenAddress}
+              -httpListenAddr ${cfg.listenAddress} \
-              -retentionPeriod ${toString cfg.retentionPeriod}
+              -retentionPeriod ${toString cfg.retentionPeriod} \
               ${lib.escapeShellArgs cfg.extraOptions}
         '';
       };

nixos/modules/services/network-filesystems/samba.nix

@@ -248,7 +248,7 @@ in
         };
 
         security.pam.services.samba = {};
-
+        environment.systemPackages = [ config.services.samba.package ];
       })
     ];
 

nixos/modules/services/x11/display-managers/gdm.nix

@@ -64,13 +64,9 @@ in
 
     services.xserver.displayManager.gdm = {
 
-      enable = mkEnableOption ''
+      enable = mkEnableOption "GDM, the GNOME Display Manager";
-        GDM, the GNOME Display Manager
-      '';
 
-      debug = mkEnableOption ''
+      debug = mkEnableOption "debugging messages in GDM";
-        debugging messages in GDM
-      '';
 
       # Auto login options specific to GDM
       autoLogin.delay = mkOption {

nixos/tests/couchdb.nix

@@ -1,4 +1,19 @@
-import ./make-test-python.nix ({ pkgs, lib, ...}:
+let
+
+  makeNode = couchpkg: user: passwd:
+    { pkgs, ... } :
+
+      { environment.systemPackages = with pkgs; [ jq ];
+        services.couchdb.enable = true;
+        services.couchdb.package = couchpkg;
+        services.couchdb.adminUser = user;
+        services.couchdb.adminPass = passwd;
+      };
+  testuser = "testadmin";
+  testpass = "cowabunga";
+  testlogin = "${testuser}:${testpass}@";
+
+in import ./make-test-python.nix ({ pkgs, lib, ...}:
 
 with lib;
 
@@ -9,26 +24,15 @@ with lib;
   };
 
   nodes = {
-    couchdb1 =
+    couchdb1 = makeNode pkgs.couchdb testuser testpass;
-      { pkgs, ... }:
+    couchdb2 = makeNode pkgs.couchdb2 testuser testpass;
-
+    couchdb3 = makeNode pkgs.couchdb3 testuser testpass;
-      { environment.systemPackages = with pkgs; [ jq ];
-        services.couchdb.enable = true;
-      };
-
-    couchdb2 =
-      { pkgs, ... }:
-
-      { environment.systemPackages = with pkgs; [ jq ];
-        services.couchdb.enable = true;
-        services.couchdb.package = pkgs.couchdb2;
-      };
   };
 
   testScript = let
-    curlJqCheck = action: path: jqexpr: result:
+    curlJqCheck = login: action: path: jqexpr: result:
       pkgs.writeScript "curl-jq-check-${action}-${path}.sh" ''
-        RESULT=$(curl -X ${action} http://127.0.0.1:5984/${path} | jq -r '${jqexpr}')
+        RESULT=$(curl -X ${action} http://${login}127.0.0.1:5984/${path} | jq -r '${jqexpr}')
         echo $RESULT >&2
         if [ "$RESULT" != "${result}" ]; then
           exit 1
@@ -39,38 +43,56 @@ with lib;
 
     couchdb1.wait_for_unit("couchdb.service")
     couchdb1.wait_until_succeeds(
-        "${curlJqCheck "GET" "" ".couchdb" "Welcome"}"
+        "${curlJqCheck "" "GET" "" ".couchdb" "Welcome"}"
     )
     couchdb1.wait_until_succeeds(
-        "${curlJqCheck "GET" "_all_dbs" ". | length" "2"}"
+        "${curlJqCheck "" "GET" "_all_dbs" ". | length" "2"}"
     )
-    couchdb1.succeed("${curlJqCheck "PUT" "foo" ".ok" "true"}")
+    couchdb1.succeed("${curlJqCheck testlogin "PUT" "foo" ".ok" "true"}")
     couchdb1.succeed(
-        "${curlJqCheck "GET" "_all_dbs" ". | length" "3"}"
+        "${curlJqCheck "" "GET" "_all_dbs" ". | length" "3"}"
     )
     couchdb1.succeed(
-        "${curlJqCheck "DELETE" "foo" ".ok" "true"}"
+        "${curlJqCheck testlogin "DELETE" "foo" ".ok" "true"}"
     )
     couchdb1.succeed(
-        "${curlJqCheck "GET" "_all_dbs" ". | length" "2"}"
+        "${curlJqCheck "" "GET" "_all_dbs" ". | length" "2"}"
     )
 
     couchdb2.wait_for_unit("couchdb.service")
     couchdb2.wait_until_succeeds(
-        "${curlJqCheck "GET" "" ".couchdb" "Welcome"}"
+        "${curlJqCheck "" "GET" "" ".couchdb" "Welcome"}"
     )
     couchdb2.wait_until_succeeds(
-        "${curlJqCheck "GET" "_all_dbs" ". | length" "0"}"
+        "${curlJqCheck "" "GET" "_all_dbs" ". | length" "0"}"
     )
-    couchdb2.succeed("${curlJqCheck "PUT" "foo" ".ok" "true"}")
+    couchdb2.succeed("${curlJqCheck testlogin "PUT" "foo" ".ok" "true"}")
     couchdb2.succeed(
-        "${curlJqCheck "GET" "_all_dbs" ". | length" "1"}"
+        "${curlJqCheck "" "GET" "_all_dbs" ". | length" "1"}"
     )
     couchdb2.succeed(
-        "${curlJqCheck "DELETE" "foo" ".ok" "true"}"
+        "${curlJqCheck testlogin "DELETE" "foo" ".ok" "true"}"
     )
     couchdb2.succeed(
-        "${curlJqCheck "GET" "_all_dbs" ". | length" "0"}"
+        "${curlJqCheck "" "GET" "_all_dbs" ". | length" "0"}"
+    )
+
+    couchdb3.wait_for_unit("couchdb.service")
+    couchdb3.wait_until_succeeds(
+        "${curlJqCheck testlogin "GET" "" ".couchdb" "Welcome"}"
+    )
+    couchdb3.wait_until_succeeds(
+        "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "0"}"
+    )
+    couchdb3.succeed("${curlJqCheck testlogin "PUT" "foo" ".ok" "true"}")
+    couchdb3.succeed(
+        "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "1"}"
+    )
+    couchdb3.succeed(
+        "${curlJqCheck testlogin "DELETE" "foo" ".ok" "true"}"
+    )
+    couchdb3.succeed(
+        "${curlJqCheck testlogin "GET" "_all_dbs" ". | length" "0"}"
     )
   '';
 })

pkgs/applications/audio/jackmix/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, sconsPackages, qt4, lash, libjack2, jack ? libjack2 }:
+{ stdenv, fetchurl, pkgconfig, sconsPackages, qt4, lash, libjack2, jack ? libjack2, alsaLib }:
 
 stdenv.mkDerivation {
   name = "jackmix-0.5.2";
@@ -14,6 +14,7 @@ stdenv.mkDerivation {
     qt4
     lash
     jack
+    alsaLib
   ];
 
   installPhase = ''

pkgs/applications/version-management/commitizen/default.nix

@@ -0,0 +1,17 @@
+{ pkgs, nodejs, stdenv, lib, ... }:
+
+let
+  nodePackages = import ./node-composition.nix {
+    inherit pkgs nodejs;
+    inherit (stdenv.hostPlatform) system;
+  };
+in
+nodePackages.commitizen.override {
+  meta = with lib; {
+    description = "The commitizen command line utility";
+    homepage = "https://commitizen.github.io/cz-cli";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.mit;
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

pkgs/applications/version-management/commitizen/generate-dependencies.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nodePackages.node2nix
+
+node2nix \
+  --node-env node-env.nix \
+  --development \
+  --input package.json \
+  --output node-packages.nix \
+  --composition node-composition.nix

pkgs/applications/version-management/commitizen/node-composition.nix

@@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.8.0. Do not edit!
+
+{pkgs ? import <nixpkgs> {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-12_x"}:
+
+let
+  nodeEnv = import ./node-env.nix {
+    inherit (pkgs) stdenv python2 utillinux runCommand writeTextFile;
+    inherit nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages.nix {
+  inherit (pkgs) fetchurl fetchgit;
+  inherit nodeEnv;
+}

pkgs/applications/version-management/commitizen/node-env.nix

@@ -0,0 +1,542 @@
+# This file originates from node2nix
+
+{stdenv, nodejs, python2, utillinux, libtool, runCommand, writeTextFile}:
+
+let
+  python = if nodejs ? python then nodejs.python else python2;
+
+  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
+  tarWrapper = runCommand "tarWrapper" {} ''
+    mkdir -p $out/bin
+
+    cat > $out/bin/tar <<EOF
+    #! ${stdenv.shell} -e
+    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
+    EOF
+
+    chmod +x $out/bin/tar
+  '';
+
+  # Function that generates a TGZ file from a NPM project
+  buildNodeSourceDist =
+    { name, version, src, ... }:
+
+    stdenv.mkDerivation {
+      name = "node-tarball-${name}-${version}";
+      inherit src;
+      buildInputs = [ nodejs ];
+      buildPhase = ''
+        export HOME=$TMPDIR
+        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
+      '';
+      installPhase = ''
+        mkdir -p $out/tarballs
+        mv $tgzFile $out/tarballs
+        mkdir -p $out/nix-support
+        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
+      '';
+    };
+
+  includeDependencies = {dependencies}:
+    stdenv.lib.optionalString (dependencies != [])
+      (stdenv.lib.concatMapStrings (dependency:
+        ''
+          # Bundle the dependencies of the package
+          mkdir -p node_modules
+          cd node_modules
+
+          # Only include dependencies if they don't exist. They may also be bundled in the package.
+          if [ ! -e "${dependency.name}" ]
+          then
+              ${composePackage dependency}
+          fi
+
+          cd ..
+        ''
+      ) dependencies);
+
+  # Recursively composes the dependencies of a package
+  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
+      DIR=$(pwd)
+      cd $TMPDIR
+
+      unpackFile ${src}
+
+      # Make the base dir in which the target dependency resides first
+      mkdir -p "$(dirname "$DIR/${packageName}")"
+
+      if [ -f "${src}" ]
+      then
+          # Figure out what directory has been unpacked
+          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
+
+          # Restore write permissions to make building work
+          find "$packageDir" -type d -exec chmod u+x {} \;
+          chmod -R u+w "$packageDir"
+
+          # Move the extracted tarball into the output folder
+          mv "$packageDir" "$DIR/${packageName}"
+      elif [ -d "${src}" ]
+      then
+          # Get a stripped name (without hash) of the source directory.
+          # On old nixpkgs it's already set internally.
+          if [ -z "$strippedName" ]
+          then
+              strippedName="$(stripHash ${src})"
+          fi
+
+          # Restore write permissions to make building work
+          chmod -R u+w "$strippedName"
+
+          # Move the extracted directory into the output folder
+          mv "$strippedName" "$DIR/${packageName}"
+      fi
+
+      # Unset the stripped name to not confuse the next unpack step
+      unset strippedName
+
+      # Include the dependencies of the package
+      cd "$DIR/${packageName}"
+      ${includeDependencies { inherit dependencies; }}
+      cd ..
+      ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+    '';
+
+  pinpointDependencies = {dependencies, production}:
+    let
+      pinpointDependenciesFromPackageJSON = writeTextFile {
+        name = "pinpointDependencies.js";
+        text = ''
+          var fs = require('fs');
+          var path = require('path');
+
+          function resolveDependencyVersion(location, name) {
+              if(location == process.env['NIX_STORE']) {
+                  return null;
+              } else {
+                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
+
+                  if(fs.existsSync(dependencyPackageJSON)) {
+                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
+
+                      if(dependencyPackageObj.name == name) {
+                          return dependencyPackageObj.version;
+                      }
+                  } else {
+                      return resolveDependencyVersion(path.resolve(location, ".."), name);
+                  }
+              }
+          }
+
+          function replaceDependencies(dependencies) {
+              if(typeof dependencies == "object" && dependencies !== null) {
+                  for(var dependency in dependencies) {
+                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
+
+                      if(resolvedVersion === null) {
+                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
+                      } else {
+                          dependencies[dependency] = resolvedVersion;
+                      }
+                  }
+              }
+          }
+
+          /* Read the package.json configuration */
+          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
+
+          /* Pinpoint all dependencies */
+          replaceDependencies(packageObj.dependencies);
+          if(process.argv[2] == "development") {
+              replaceDependencies(packageObj.devDependencies);
+          }
+          replaceDependencies(packageObj.optionalDependencies);
+
+          /* Write the fixed package.json file */
+          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
+        '';
+      };
+    in
+    ''
+      node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
+
+      ${stdenv.lib.optionalString (dependencies != [])
+        ''
+          if [ -d node_modules ]
+          then
+              cd node_modules
+              ${stdenv.lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
+              cd ..
+          fi
+        ''}
+    '';
+
+  # Recursively traverses all dependencies of a package and pinpoints all
+  # dependencies in the package.json file to the versions that are actually
+  # being used.
+
+  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
+    ''
+      if [ -d "${packageName}" ]
+      then
+          cd "${packageName}"
+          ${pinpointDependencies { inherit dependencies production; }}
+          cd ..
+          ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+      fi
+    '';
+
+  # Extract the Node.js source code which is used to compile packages with
+  # native bindings
+  nodeSources = runCommand "node-sources" {} ''
+    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
+    mv node-* $out
+  '';
+
+  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
+  addIntegrityFieldsScript = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      function augmentDependencies(baseDir, dependencies) {
+          for(var dependencyName in dependencies) {
+              var dependency = dependencies[dependencyName];
+
+              // Open package.json and augment metadata fields
+              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
+              var packageJSONPath = path.join(packageJSONDir, "package.json");
+
+              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
+                  console.log("Adding metadata fields to: "+packageJSONPath);
+                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
+
+                  if(dependency.integrity) {
+                      packageObj["_integrity"] = dependency.integrity;
+                  } else {
+                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
+                  }
+
+                  if(dependency.resolved) {
+                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
+                  } else {
+                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
+                  }
+
+                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
+                      packageObj["_from"] = dependency.from;
+                  }
+
+                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
+              }
+
+              // Augment transitive dependencies
+              if(dependency.dependencies !== undefined) {
+                  augmentDependencies(packageJSONDir, dependency.dependencies);
+              }
+          }
+      }
+
+      if(fs.existsSync("./package-lock.json")) {
+          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
+
+          if(packageLock.lockfileVersion !== 1) {
+             process.stderr.write("Sorry, I only understand lock file version 1!\n");
+             process.exit(1);
+          }
+
+          if(packageLock.dependencies !== undefined) {
+              augmentDependencies(".", packageLock.dependencies);
+          }
+      }
+    '';
+  };
+
+  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
+  reconstructPackageLock = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      var packageObj = JSON.parse(fs.readFileSync("package.json"));
+
+      var lockObj = {
+          name: packageObj.name,
+          version: packageObj.version,
+          lockfileVersion: 1,
+          requires: true,
+          dependencies: {}
+      };
+
+      function augmentPackageJSON(filePath, dependencies) {
+          var packageJSON = path.join(filePath, "package.json");
+          if(fs.existsSync(packageJSON)) {
+              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
+              dependencies[packageObj.name] = {
+                  version: packageObj.version,
+                  integrity: "sha1-000000000000000000000000000=",
+                  dependencies: {}
+              };
+              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
+          }
+      }
+
+      function processDependencies(dir, dependencies) {
+          if(fs.existsSync(dir)) {
+              var files = fs.readdirSync(dir);
+
+              files.forEach(function(entry) {
+                  var filePath = path.join(dir, entry);
+                  var stats = fs.statSync(filePath);
+
+                  if(stats.isDirectory()) {
+                      if(entry.substr(0, 1) == "@") {
+                          // When we encounter a namespace folder, augment all packages belonging to the scope
+                          var pkgFiles = fs.readdirSync(filePath);
+
+                          pkgFiles.forEach(function(entry) {
+                              if(stats.isDirectory()) {
+                                  var pkgFilePath = path.join(filePath, entry);
+                                  augmentPackageJSON(pkgFilePath, dependencies);
+                              }
+                          });
+                      } else {
+                          augmentPackageJSON(filePath, dependencies);
+                      }
+                  }
+              });
+          }
+      }
+
+      processDependencies("node_modules", lockObj.dependencies);
+
+      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
+    '';
+  };
+
+  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
+    let
+      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
+    in
+    ''
+        # Pinpoint the versions of all dependencies to the ones that are actually being used
+        echo "pinpointing versions of dependencies..."
+        source $pinpointDependenciesScriptPath
+
+        # Patch the shebangs of the bundled modules to prevent them from
+        # calling executables outside the Nix store as much as possible
+        patchShebangs .
+
+        # Deploy the Node.js package by running npm install. Since the
+        # dependencies have been provided already by ourselves, it should not
+        # attempt to install them again, which is good, because we want to make
+        # it Nix's responsibility. If it needs to install any dependencies
+        # anyway (e.g. because the dependency parameters are
+        # incomplete/incorrect), it fails.
+        #
+        # The other responsibilities of NPM are kept -- version checks, build
+        # steps, postprocessing etc.
+
+        export HOME=$TMPDIR
+        cd "${packageName}"
+        runHook preRebuild
+
+        ${stdenv.lib.optionalString bypassCache ''
+          ${stdenv.lib.optionalString reconstructLock ''
+            if [ -f package-lock.json ]
+            then
+                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
+                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
+                rm package-lock.json
+            else
+                echo "No package-lock.json file found, reconstructing..."
+            fi
+
+            node ${reconstructPackageLock}
+          ''}
+
+          node ${addIntegrityFieldsScript}
+        ''}
+
+        npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} rebuild
+
+        if [ "''${dontNpmInstall-}" != "1" ]
+        then
+            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
+            rm -f npm-shrinkwrap.json
+
+            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} install
+        fi
+    '';
+
+  # Builds and composes an NPM package including all its dependencies
+  buildNodePackage =
+    { name
+    , packageName
+    , version
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , preRebuild ? ""
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" ];
+    in
+    stdenv.mkDerivation ({
+      name = "node_${name}-${version}";
+      buildInputs = [ tarWrapper python nodejs ]
+        ++ stdenv.lib.optional (stdenv.isLinux) utillinux
+        ++ stdenv.lib.optional (stdenv.isDarwin) libtool
+        ++ buildInputs;
+
+      inherit nodejs;
+
+      inherit dontStrip; # Stripping may fail a build for some package deployments
+      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
+
+      compositionScript = composePackage args;
+      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
+
+      installPhase = ''
+        # Create and enter a root node_modules/ folder
+        mkdir -p $out/lib/node_modules
+        cd $out/lib/node_modules
+
+        # Compose the package and all its dependencies
+        source $compositionScriptPath
+
+        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+        # Create symlink to the deployed executable folder, if applicable
+        if [ -d "$out/lib/node_modules/.bin" ]
+        then
+            ln -s $out/lib/node_modules/.bin $out/bin
+        fi
+
+        # Create symlinks to the deployed manual page folders, if applicable
+        if [ -d "$out/lib/node_modules/${packageName}/man" ]
+        then
+            mkdir -p $out/share
+            for dir in "$out/lib/node_modules/${packageName}/man/"*
+            do
+                mkdir -p $out/share/man/$(basename "$dir")
+                for page in "$dir"/*
+                do
+                    ln -s $page $out/share/man/$(basename "$dir")
+                done
+            done
+        fi
+
+        # Run post install hook, if provided
+        runHook postInstall
+      '';
+    } // extraArgs);
+
+  # Builds a development shell
+  buildNodeShell =
+    { name
+    , packageName
+    , version
+    , src
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
+
+      nodeDependencies = stdenv.mkDerivation ({
+        name = "node-dependencies-${name}-${version}";
+
+        buildInputs = [ tarWrapper python nodejs ]
+          ++ stdenv.lib.optional (stdenv.isLinux) utillinux
+          ++ stdenv.lib.optional (stdenv.isDarwin) libtool
+          ++ buildInputs;
+
+        inherit dontStrip; # Stripping may fail a build for some package deployments
+        inherit dontNpmInstall unpackPhase buildPhase;
+
+        includeScript = includeDependencies { inherit dependencies; };
+        pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
+
+        installPhase = ''
+          mkdir -p $out/${packageName}
+          cd $out/${packageName}
+
+          source $includeScriptPath
+
+          # Create fake package.json to make the npm commands work properly
+          cp ${src}/package.json .
+          chmod 644 package.json
+          ${stdenv.lib.optionalString bypassCache ''
+            if [ -f ${src}/package-lock.json ]
+            then
+                cp ${src}/package-lock.json .
+            fi
+          ''}
+
+          # Go to the parent folder to make sure that all packages are pinpointed
+          cd ..
+          ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+          # Expose the executables that were installed
+          cd ..
+          ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          mv ${packageName} lib
+          ln -s $out/lib/node_modules/.bin $out/bin
+        '';
+      } // extraArgs);
+    in
+    stdenv.mkDerivation {
+      name = "node-shell-${name}-${version}";
+
+      buildInputs = [ python nodejs ] ++ stdenv.lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
+      buildCommand = ''
+        mkdir -p $out/bin
+        cat > $out/bin/shell <<EOF
+        #! ${stdenv.shell} -e
+        $shellHook
+        exec ${stdenv.shell}
+        EOF
+        chmod +x $out/bin/shell
+      '';
+
+      # Provide the dependencies in a development shell through the NODE_PATH environment variable
+      inherit nodeDependencies;
+      shellHook = stdenv.lib.optionalString (dependencies != []) ''
+        export NODE_PATH=${nodeDependencies}/lib/node_modules
+        export PATH="${nodeDependencies}/bin:$PATH"
+      '';
+    };
+in
+{
+  buildNodeSourceDist = stdenv.lib.makeOverridable buildNodeSourceDist;
+  buildNodePackage = stdenv.lib.makeOverridable buildNodePackage;
+  buildNodeShell = stdenv.lib.makeOverridable buildNodeShell;
+}

pkgs/applications/version-management/commitizen/package.json

@@ -0,0 +1,3 @@
+[
+  "commitizen"
+]

pkgs/applications/video/mpv/scripts/autoload.nix

@@ -0,0 +1,20 @@
+{ stdenv, fetchurl, mpv-unwrapped, lib }:
+
+stdenv.mkDerivation rec {
+  pname = "mpv-autoload";
+  version = mpv-unwrapped.version;
+  src = "${mpv-unwrapped.src.outPath}/TOOLS/lua/autoload.lua";
+  dontBuild = true;
+  dontUnpack = true;
+  installPhase = ''
+    install -Dm644 ${src} $out/share/mpv/scripts/autoload.lua
+  '';
+  passthru.scriptName = "autoload.lua";
+
+  meta = {
+    description = "This script automatically loads playlist entries before and after the the currently played file";
+    homepage = "https://github.com/mpv-player/mpv/blob/master/TOOLS/lua/autoload.lua";
+    maintainers = [ lib.maintainers.dawidsowa ];
+    license = lib.licenses.gpl2Plus;
+  };
+}

pkgs/development/compilers/cudatoolkit/common.nix

@@ -154,8 +154,9 @@ stdenv.mkDerivation rec {
 
     # Remove OpenCL libraries as they are provided by ocl-icd and driver.
     rm -f $out/lib64/libOpenCL*
-    ${lib.optionalString (lib.versionAtLeast version "10.1") ''
+    ${lib.optionalString (lib.versionAtLeast version "10.1" && (lib.versionOlder version "11")) ''
       mv $out/lib64 $out/lib
+      mv $out/extras/CUPTI/lib64/libcupti* $out/lib
     ''}
 
     # Set compiler for NVCC.

pkgs/development/compilers/nim/default.nix

@@ -1,7 +1,7 @@
 # https://nim-lang.github.io/Nim/packaging.html
 
 { stdenv, lib, fetchgit, fetchurl, makeWrapper, gdb, openssl, pcre, readline
-, boehmgc, sqlite, nim-unwrapped, nim-stdlib, nim }:
+, boehmgc, sqlite, nim-unwrapped, nim }:
 
 let
   version = "1.2.6";
@@ -106,7 +106,6 @@ let
     };
 
     unwrapped = stdenv.mkDerivation {
-      # https://nim-lang.github.io/Nim/packaging.html
       pname = "nim-unwrapped";
       inherit version src;
 
@@ -147,31 +146,13 @@ let
       installPhase = ''
         runHook preInstall
         install -Dt $out/bin bin/*
+        ln -sf $out/nim/bin/nim $out/bin/nim
+        ./install.sh $out
         runHook postInstall
       '';
 
       inherit meta;
     };
-
-    stdlib = stdenv.mkDerivation {
-      pname = "nim-stdlib";
-      inherit (nim-unwrapped) version src patches;
-
-      dontConfigure = true;
-      dontBuild = true;
-
-      installPhase = ''
-        runHook preInstall
-        touch bin/nim
-        ./install.sh $TMPDIR
-        cp -r $TMPDIR/nim/lib $out
-        runHook postInstall
-      '';
-
-      meta = meta // {
-        description = meta.description + " (standard library)";
-      };
-    };
   };
 
   wrapped = let
@@ -197,8 +178,12 @@ let
       "--prefix PATH : ${lib.makeBinPath [ stdenv.cc gdb ]}:${
         placeholder "out"
       }/bin"
-      "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ stdenv.cc.libc openssl ]}"
+      "--prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [ stdenv.cc.libc openssl ]
+      }"
       "--set NIM_CONFIG_PATH ${placeholder "out"}/etc/nim"
+      ''--set NIX_HARDENING_ENABLE "''${NIX_HARDENING_ENABLE/fortify}"''
+      # Fortify hardening appends -O2 to gcc flags which is unwanted for unoptimized nim builds.
     ];
 
     buildPhase = with stdenv;
@@ -227,20 +212,19 @@ let
 
         for binpath in ${nim}/bin/nim?*; do
           local binname=`basename $binpath`
-          makeWrapper $binpath $out/bin/${targetPlatform.config}-$binname \
+          makeWrapper \
+            $binpath $out/bin/${targetPlatform.config}-$binname \
             $wrapperArgs
           ln -s $out/bin/${targetPlatform.config}-$binname $out/bin/$binname
         done
 
-        makeWrapper ${nim}/bin/nim $out/bin/${targetPlatform.config}-nim \
+        makeWrapper \
-          $wrapperArgs \
+          ${nim}/nim/bin/nim $out/bin/${targetPlatform.config}-nim \
-          --set NIX_HARDENING_ENABLE "''${NIX_HARDENING_ENABLE/fortify}" \
+          $wrapperArgs
-          --add-flags --lib:${nim-stdlib}
         ln -s $out/bin/${targetPlatform.config}-nim $out/bin/nim
 
         runHook postBuild
-                '';
+      '';
-    # Fortify hardening appends -O2 to gcc flags which is unwanted for unoptimized nim builds.
 
     dontInstall = true;
 

pkgs/development/haskell-modules/configuration-common.nix

@@ -69,7 +69,7 @@ self: super: {
       name = "git-annex-${super.git-annex.version}-src";
       url = "git://git-annex.branchable.com/";
       rev = "refs/tags/" + super.git-annex.version;
-      sha256 = "1d24080xh7gl197i0y5bkn3j94hvh8zqyg9gfcnx2qdlxfca1knb";
+      sha256 = "19ipaalp9g25zhg44rialwhp2fv5n8q5fzqw72rfcjcca5iy6r72";
     };
   }).override {
     dbus = if pkgs.stdenv.isLinux then self.dbus else null;
@@ -923,7 +923,7 @@ self: super: {
   dhall-json = generateOptparseApplicativeCompletions ["dhall-to-json" "dhall-to-yaml"] super.dhall-json;
   dhall-nix = generateOptparseApplicativeCompletion "dhall-to-nix" (
     super.dhall-nix.overrideScope (self: super: {
-      dhall = super.dhall_1_34_0;
+      dhall = super.dhall_1_35_0;
       repline = self.repline_0_4_0_0;
       haskeline = self.haskeline_0_8_1_0;
     }));
@@ -1211,7 +1211,7 @@ self: super: {
   # we need an override because ghcide is tracking haskell-lsp closely.
   ghcide = dontCheck (appendPatch (super.ghcide.override {
     hie-bios = dontCheck super.hie-bios_0_7_1;
-    lsp-test = dontCheck self.lsp-test_0_11_0_4;
+    lsp-test = dontCheck self.lsp-test_0_11_0_5;
   }) (pkgs.fetchpatch {
     # This patch loosens the hie-bios upper bound.
     # It is already merged into upstream and won‘t be needed for ghcide 0.4.0
@@ -1340,7 +1340,7 @@ self: super: {
   # 2020-08-14: gi-pango from stackage is to old for the C libs it links against in nixpkgs.
   # That's why we need to bump a ton of dependency versions to unbreak them.
   gi-pango = assert super.gi-pango.version == "1.0.22"; self.gi-pango_1_0_23;
-  haskell-gi-base = assert super.haskell-gi-base.version == "0.23.0"; addBuildDepends (self.haskell-gi-base_0_24_2) [ pkgs.gobject-introspection ];
+  haskell-gi-base = assert super.haskell-gi-base.version == "0.23.0"; addBuildDepends (self.haskell-gi-base_0_24_3) [ pkgs.gobject-introspection ];
   haskell-gi = assert super.haskell-gi.version == "0.23.1"; self.haskell-gi_0_24_4;
   gi-cairo = assert super.gi-cairo.version == "1.0.23"; self.gi-cairo_1_0_24;
   gi-glib = assert super.gi-glib.version == "2.0.23"; self.gi-glib_2_0_24;
@@ -1459,43 +1459,47 @@ self: super: {
 
   # We want the latest version of cryptonite. This is a first step towards
   # resolving https://github.com/NixOS/nixpkgs/issues/81915.
-  cryptonite = self.cryptonite_0_27;
+  cryptonite = doDistribute self.cryptonite_0_27;
 
   # We want the latest version of Pandoc.
-  hslua = self.hslua_1_1_2;
+  hslua = doDistribute self.hslua_1_1_2;
-  jira-wiki-markup = self.jira-wiki-markup_1_3_2;
+  jira-wiki-markup = doDistribute self.jira-wiki-markup_1_3_2;
-  pandoc = self.pandoc_2_10_1;
+  pandoc = doDistribute self.pandoc_2_10_1;
-  pandoc-citeproc = self.pandoc-citeproc_0_17_0_2;
+  pandoc-citeproc = doDistribute self.pandoc-citeproc_0_17_0_2;
-  pandoc-plot = self.pandoc-plot_0_9_2_0;
+  pandoc-plot = doDistribute self.pandoc-plot_0_9_2_0;
-  pandoc-types = self.pandoc-types_1_21;
+  pandoc-types = doDistribute self.pandoc-types_1_21;
-  rfc5051 = self.rfc5051_0_2;
+  rfc5051 = doDistribute self.rfc5051_0_2;
 
+  # Upstream forgot to change the Cabal version bounds in the test suite.
+  # See: https://github.com/jaspervdj/stylish-haskell/pull/297
+  # Will be fixed whenever they next bump the version number
+  stylish-haskell = appendPatch super.stylish-haskell (pkgs.fetchpatch {
+    url = "https://github.com/jaspervdj/stylish-haskell/commit/9550aa1cd177aa6fe271d075177109d66a79e67f.patch";
+    sha256 = "1ffnbd2s4fx0ylnnlcyyag119yxb32p5r20b38l39lsa0jwv229f";
+  });
   # INSERT NEW OVERRIDES ABOVE THIS LINE
 
 } // (let
-  inherit (self) hls-ghcide;
+  inherit (self) hls-ghcide hls-brittany;
   hlsScopeOverride = self: super: {
     # haskell-language-server uses its own fork of ghcide
     # Test disabled: it seems to freeze (is it just that it takes a long time ?)
-    ghcide = hls-ghcide;
+    ghcide = dontCheck hls-ghcide;
     # we are faster than stack here
     hie-bios = dontCheck super.hie-bios_0_7_1;
-    lsp-test = dontCheck super.lsp-test_0_11_0_4;
+    lsp-test = dontCheck super.lsp-test_0_11_0_5;
     # fourmolu can‘t compile with an older aeson
     aeson = dontCheck super.aeson_1_5_2_0;
     # brittany has an aeson upper bound of 1.5
-    brittany = doJailbreak super.brittany;
+    brittany = hls-brittany;
+    data-tree-print = doJailbreak super.data-tree-print;
+    ghc-exactprint = dontCheck super.ghc-exactprint_0_6_3_2;
   };
   in {
     # jailbreaking for hie-bios 0.7.0 (upstream PR: https://github.com/haskell/haskell-language-server/pull/357)
     haskell-language-server = dontCheck (doJailbreak (super.haskell-language-server.overrideScope hlsScopeOverride));
-    hls-ghcide = appendPatch (dontCheck (super.hls-ghcide.overrideScope hlsScopeOverride))
+    hls-ghcide = dontCheck (super.hls-ghcide.overrideScope hlsScopeOverride);
-      (pkgs.fetchpatch {
+    hls-brittany = dontCheck (super.hls-brittany.overrideScope hlsScopeOverride);
-        # This patch loosens the hie-bios upper bound.
+    fourmolu = dontCheck (super.fourmolu.overrideScope hlsScopeOverride);
-        # It is already merged into upstream and won‘t be needed for ghcide 0.4.0
-        url = "https://github.com/haskell/ghcide/commit/3e1b3620948870a4da8808ca0c0897fbd3ecad16.patch";
-        sha256 = "1jwn7jgi740x6wwv1k0mz9d4z0b9p3mzs54pdg4nfq0h2v7zxchz";
-      });
-    fourmolu = super.fourmolu.overrideScope hlsScopeOverride;
   }
 )  // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super

pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix

@@ -66,7 +66,7 @@ self: super: {
   unliftio-core = doJailbreak super.unliftio-core;
 
   # Use the latest version to fix the build.
-  dhall = self.dhall_1_34_0;
+  dhall = self.dhall_1_35_0;
   lens = self.lens_4_19_2;
   optics = self.optics_0_3;
   optics-core = self.optics-core_0_3_0_1;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -72,7 +72,7 @@ default-package-overrides:
   # gi-gdkx11-4.x requires gtk-4.x, which is still under development and
   # not yet available in Nixpkgs
   - gi-gdkx11 < 4
-  # LTS Haskell 16.12
+  # LTS Haskell 16.13
   - abstract-deque ==0.3
   - abstract-par ==0.3.3
   - AC-Angle ==1.0
@@ -489,7 +489,7 @@ default-package-overrides:
   - concurrent-split ==0.0.1.1
   - concurrent-supply ==0.1.8
   - cond ==0.4.1.1
-  - conduit ==1.3.2
+  - conduit ==1.3.2.1
   - conduit-algorithms ==0.0.11.0
   - conduit-combinators ==1.3.0
   - conduit-concurrent-map ==0.1.1
@@ -504,7 +504,7 @@ default-package-overrides:
   - config-ini ==0.2.4.0
   - configurator ==0.3.0.0
   - configurator-export ==0.1.0.1
-  - configurator-pg ==0.2.3
+  - configurator-pg ==0.2.4
   - connection ==0.3.1
   - connection-pool ==0.2.2
   - console-style ==0.0.2.1
@@ -733,7 +733,7 @@ default-package-overrides:
   - errors ==2.3.0
   - errors-ext ==0.4.2
   - ersatz ==0.4.8
-  - esqueleto ==3.3.3.2
+  - esqueleto ==3.3.3.3
   - essence-of-live-coding ==0.1.0.3
   - essence-of-live-coding-gloss ==0.1.0.3
   - essence-of-live-coding-pulse ==0.1.0.3
@@ -1092,14 +1092,14 @@ default-package-overrides:
   - hslua-module-doclayout ==0.1.0
   - hslua-module-system ==0.2.2
   - hslua-module-text ==0.2.1
-  - HsOpenSSL ==0.11.4.18
+  - HsOpenSSL ==0.11.4.19
   - hsp ==0.10.0
-  - hspec ==2.7.2
+  - hspec ==2.7.4
   - hspec-attoparsec ==0.1.0.2
   - hspec-checkers ==0.1.0.2
   - hspec-contrib ==0.5.1
-  - hspec-core ==2.7.2
+  - hspec-core ==2.7.4
-  - hspec-discover ==2.7.2
+  - hspec-discover ==2.7.4
   - hspec-expectations ==0.8.2
   - hspec-expectations-lifted ==0.10.0
   - hspec-expectations-pretty-diff ==0.7.2.5
@@ -1385,13 +1385,13 @@ default-package-overrides:
   - mainland-pretty ==0.7.0.1
   - main-tester ==0.2.0.1
   - makefile ==1.1.0.0
-  - managed ==1.0.7
+  - managed ==1.0.8
   - markdown ==0.1.17.4
   - markdown-unlit ==0.5.0
   - markov-chain ==0.0.3.4
-  - massiv ==0.5.3.2
+  - massiv ==0.5.4.0
   - massiv-io ==0.2.1.0
-  - massiv-test ==0.1.3.1
+  - massiv-test ==0.1.4
   - mathexpr ==0.3.0.0
   - math-extras ==0.1.1.0
   - math-functions ==0.3.4.1
@@ -1433,7 +1433,7 @@ default-package-overrides:
   - midi ==0.2.2.2
   - mighty-metropolis ==2.0.0
   - mime-mail ==0.5.0
-  - mime-mail-ses ==0.4.2
+  - mime-mail-ses ==0.4.3
   - mime-types ==0.1.0.9
   - mini-egison ==1.0.0
   - minimal-configuration ==0.1.4
@@ -1963,7 +1963,7 @@ default-package-overrides:
   - servant-checked-exceptions-core ==2.2.0.0
   - servant-client ==0.16.0.1
   - servant-client-core ==0.16
-  - servant-conduit ==0.15
+  - servant-conduit ==0.15.1
   - servant-docs ==0.11.4
   - servant-docs-simple ==0.2.0.1
   - servant-elm ==0.7.2
@@ -1972,9 +1972,9 @@ default-package-overrides:
   - servant-js ==0.9.4.2
   - servant-JuicyPixels ==0.3.0.5
   - servant-lucid ==0.9
-  - servant-machines ==0.15
+  - servant-machines ==0.15.1
   - servant-mock ==0.8.5
-  - servant-pipes ==0.15.1
+  - servant-pipes ==0.15.2
   - servant-purescript ==0.10.0.0
   - servant-rawm ==0.3.2.0
   - servant-server ==0.16.2
@@ -2118,7 +2118,7 @@ default-package-overrides:
   - stringsearch ==0.3.6.6
   - string-transform ==1.1.1
   - stripe-concepts ==1.0.2.4
-  - stripe-signature ==1.0.0.4
+  - stripe-signature ==1.0.0.6
   - strive ==5.0.12
   - structs ==0.1.3
   - structured ==0.1
@@ -2145,7 +2145,7 @@ default-package-overrides:
   - system-fileio ==0.3.16.4
   - system-filepath ==0.4.14
   - system-info ==0.5.1
-  - tabular ==0.2.2.7
+  - tabular ==0.2.2.8
   - taffybar ==3.2.2
   - tagchup ==0.4.1.1
   - tagged ==0.8.6
@@ -2182,7 +2182,7 @@ default-package-overrides:
   - TCache ==0.12.1
   - tce-conf ==1.3
   - tdigest ==0.2.1
-  - template-haskell-compat-v0208 ==0.1.4
+  - template-haskell-compat-v0208 ==0.1.5
   - temporary ==1.3
   - temporary-rc ==1.2.0.3
   - temporary-resourcet ==0.1.0.1
@@ -2474,7 +2474,7 @@ default-package-overrides:
   - xdg-basedir ==0.2.2
   - xdg-desktop-entry ==0.1.1.1
   - xdg-userdirs ==0.1.0.2
-  - xeno ==0.4.1
+  - xeno ==0.4.2
   - xls ==0.1.3
   - xlsx ==0.8.1
   - xlsx-tabular ==0.2.2.1
@@ -3971,6 +3971,7 @@ broken-packages:
   - compdata-automata
   - compdata-dags
   - compdata-param
+  - compdoc
   - competition
   - compilation
   - complexity
@@ -3978,6 +3979,7 @@ broken-packages:
   - composite-aeson
   - composite-aeson-path
   - composite-aeson-refined
+  - composite-aeson-throw
   - composite-binary
   - composite-ekg
   - composite-opaleye

pkgs/development/haskell-modules/non-hackage-packages.nix

@@ -23,6 +23,7 @@ self: super: {
   # both are auto-generated by pkgs/development/tools/haskell/haskell-language-server/update.sh
   haskell-language-server = self.callPackage ../tools/haskell/haskell-language-server { };
   hls-ghcide = self.callPackage ../tools/haskell/haskell-language-server/hls-ghcide.nix { };
+  hls-brittany = self.callPackage ../tools/haskell/haskell-language-server/hls-brittany.nix { };
 
   # cabal2nix --revision <rev> https://github.com/hasura/ci-info-hs.git
   ci-info = self.callPackage ../misc/haskell/hasura/ci-info {};

pkgs/development/libraries/exiv2/default.nix

@@ -17,9 +17,7 @@ stdenv.mkDerivation rec {
   pname = "exiv2";
   version = "0.27.3";
 
-  # Disabled since splitting the outputs leads to issues, see
+  outputs = [ "out" "dev" "doc" "man" ];
-  # https://github.com/NixOS/nixpkgs/pull/97161#issuecomment-689426419
-  # outputs = [ "out" "dev" "doc" "man" ];
 
   src = fetchFromGitHub {
     owner = "exiv2";
@@ -39,10 +37,14 @@ stdenv.mkDerivation rec {
     # Use correct paths with multiple outputs
     # https://github.com/Exiv2/exiv2/pull/1275
     (fetchpatch {
-      name = "cmake-fix-aarch64.patch";
       url = "https://github.com/Exiv2/exiv2/commit/48f2c9dbbacc0ef84c8ebf4cb1a603327f0b8750.patch";
       sha256 = "vjB3+Ld4c/2LT7nq6uatYwfHTh+HeU5QFPFXuNLpIPA=";
     })
+    # https://github.com/Exiv2/exiv2/pull/1294
+    (fetchpatch {
+      url = "https://github.com/Exiv2/exiv2/commit/306c8a6fd4ddd70e76043ab255734720829a57e8.patch";
+      sha256 = "0D/omxYxBPGUu3uSErlf48dc6Ukwc2cEN9/J3e7a9eU=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/qtstyleplugins/default.nix

@@ -10,6 +10,8 @@ mkDerivation {
     sha256 = "085wyn85nrmzr8nv5zv7fi2kqf8rp1gnd30h72s30j55xvhmxvmy";
   };
 
+  patches = [ ./fix-build-against-Qt-5.15.patch ];
+
   nativeBuildInputs = [ pkgconfig qmake ];
   buildInputs = [ gtk2 ];
 

pkgs/development/libraries/qtstyleplugins/fix-build-against-Qt-5.15.patch

@@ -0,0 +1,44 @@
+From 335dbece103e2cbf6c7cf819ab6672c2956b17b3 Mon Sep 17 00:00:00 2001
+From: Fabian Vogt <fvogt@suse.de>
+Date: Thu, 28 May 2020 12:35:42 +0200
+Subject: [PATCH] fix build against Qt 5.15
+
+With 0a93db4d82c051164923a10e4382b12de9049b45 ("Unify application
+palette handling between QGuiApplication and QApplication")
+QApplicationPrivate::setSystemPalette is no longer used and necessary.
+---
+ src/plugins/styles/gtk2/qgtkstyle.cpp   | 2 ++
+ src/plugins/styles/gtk2/qgtkstyle_p.cpp | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/src/plugins/styles/gtk2/qgtkstyle.cpp b/src/plugins/styles/gtk2/qgtkstyle.cpp
+index 36169c9..2544593 100644
+--- a/src/plugins/styles/gtk2/qgtkstyle.cpp
++++ b/src/plugins/styles/gtk2/qgtkstyle.cpp
+@@ -440,7 +440,9 @@ void QGtkStyle::polish(QApplication *app)
+     // not supported as these should be entirely determined by
+     // current Gtk settings
+     if (app->desktopSettingsAware() && d->isThemeAvailable()) {
++#if QT_VERSION < QT_VERSION_CHECK(5, 15, 0)
+         QApplicationPrivate::setSystemPalette(standardPalette());
++#endif
+         QApplicationPrivate::setSystemFont(d->getThemeFont());
+         d->applyCustomPaletteHash();
+         if (!d->isKDE4Session())
+diff --git a/src/plugins/styles/gtk2/qgtkstyle_p.cpp b/src/plugins/styles/gtk2/qgtkstyle_p.cpp
+index e57b3d8..e71beb0 100644
+--- a/src/plugins/styles/gtk2/qgtkstyle_p.cpp
++++ b/src/plugins/styles/gtk2/qgtkstyle_p.cpp
+@@ -508,7 +508,9 @@ void QGtkStyleUpdateScheduler::updateTheme()
+       if (oldTheme != QGtkStylePrivate::getThemeName()) {
+           oldTheme = QGtkStylePrivate::getThemeName();
+           QPalette newPalette = qApp->style()->standardPalette();
++#if QT_VERSION < QT_VERSION_CHECK(5, 15, 0)
+           QApplicationPrivate::setSystemPalette(newPalette);
++#endif
+           QApplication::setPalette(newPalette);
+           if (!QGtkStylePrivate::instances.isEmpty()) {
+               QGtkStylePrivate::instances.last()->initGtkWidgets();
+-- 
+2.26.2
+

pkgs/development/tools/buildah/default.nix

@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
-    rev = "V${version}";
+    rev = "v${version}";
-    sha256 = "0z9fblxm3pk2jqw7h36clmj8k4k39n6ab536lyh0rp6p7hz5a988";
+    sha256 = "0nndm936g0i18ly6395y5s4h1f6cfbg602cvlg7c6w007f2j15hq";
   };
 
   outputs = [ "out" "man" ];

pkgs/development/tools/haskell/haskell-language-server/default.nix

@@ -14,8 +14,8 @@ mkDerivation {
   version = "0.4.0.0";
   src = fetchgit {
     url = "https://github.com/haskell/haskell-language-server.git";
-    sha256 = "157bsq6i824bl6krw7znp0byd8ibaqsq7mfwnkl741dmrflsxpa9";
+    sha256 = "1fh9k9b3880m6ql4i10yn2yanskk9xhrakrrddqvainhcf2ik8hl";
-    rev = "cb861b878ae01911b066182ff0d8080050c3b2d6";
+    rev = "c4576992f443a9abe48ffcfa0e2d2b9bce15d7ae";
     fetchSubmodules = true;
   };
   isLibrary = true;

pkgs/development/tools/haskell/haskell-language-server/hls-brittany.nix

@@ -0,0 +1,36 @@
+{ mkDerivation, aeson, base, butcher, bytestring, cmdargs
+, containers, czipwith, data-tree-print, deepseq, directory, extra
+, fetchgit, filepath, ghc, ghc-boot-th, ghc-exactprint, ghc-paths
+, hspec, monad-memo, mtl, multistate, parsec, pretty, random, safe
+, semigroups, stdenv, strict, syb, text, transformers, uniplate
+, unsafe, yaml
+}:
+mkDerivation {
+  pname = "brittany";
+  version = "0.12.1.1";
+  src = fetchgit {
+    url = "https://github.com/bubba/brittany";
+    sha256 = "1rkk09f8750qykrmkqfqbh44dbx1p8aq1caznxxlw8zqfvx39cxl";
+    rev = "c59655f10d5ad295c2481537fc8abf0a297d9d1c";
+    fetchSubmodules = true;
+  };
+  isLibrary = true;
+  isExecutable = true;
+  libraryHaskellDepends = [
+    aeson base butcher bytestring cmdargs containers czipwith
+    data-tree-print deepseq directory extra filepath ghc ghc-boot-th
+    ghc-exactprint ghc-paths monad-memo mtl multistate pretty random
+    safe semigroups strict syb text transformers uniplate unsafe yaml
+  ];
+  executableHaskellDepends = [ base ];
+  testHaskellDepends = [
+    aeson base butcher bytestring cmdargs containers czipwith
+    data-tree-print deepseq directory extra filepath ghc ghc-boot-th
+    ghc-exactprint ghc-paths hspec monad-memo mtl multistate parsec
+    pretty safe semigroups strict syb text transformers uniplate unsafe
+    yaml
+  ];
+  homepage = "https://github.com/lspitzner/brittany/";
+  description = "Haskell source code formatter";
+  license = stdenv.lib.licenses.agpl3;
+}

pkgs/development/tools/haskell/haskell-language-server/hls-ghcide.nix

@@ -5,21 +5,20 @@
 , ghc-boot-th, ghc-check, ghc-paths, ghc-typelits-knownnat, gitrev
 , haddock-library, hashable, haskell-lsp, haskell-lsp-types
 , hie-bios, hslogger, lens, lsp-test, mtl, network-uri
-, opentelemetry, optparse-applicative, prettyprinter
+, optparse-applicative, prettyprinter, prettyprinter-ansi-terminal
-, prettyprinter-ansi-terminal, process, QuickCheck
+, process, QuickCheck, quickcheck-instances, regex-tdfa
-, quickcheck-instances, regex-tdfa, rope-utf16-splay, safe
+, rope-utf16-splay, safe, safe-exceptions, shake, sorted-list
-, safe-exceptions, shake, sorted-list, stdenv, stm, syb, tasty
+, stdenv, stm, syb, tasty, tasty-expected-failure, tasty-hunit
-, tasty-expected-failure, tasty-hunit, tasty-quickcheck
+, tasty-quickcheck, tasty-rerun, text, time, transformers, unix
-, tasty-rerun, text, time, transformers, unix, unordered-containers
+, unordered-containers, utf8-string, yaml
-, utf8-string, yaml
 }:
 mkDerivation {
   pname = "ghcide";
-  version = "0.2.0";
+  version = "0.3.0";
   src = fetchgit {
     url = "https://github.com/haskell/ghcide";
-    sha256 = "1zq7ngaak8il91a309rl51dghzasnk4m2sm3av6d93cyqyra1hfc";
+    sha256 = "15v3g3i5v0xbq50lfvl4bv3rx01nixiqx02sddqi5lj2idgmg24g";
-    rev = "078e3d3c0d319f83841ccbcdc60ff5f0e243f6be";
+    rev = "96cf8c53d0bdc16d3d2cd0559b74962593ce6dc5";
     fetchSubmodules = true;
   };
   isLibrary = true;
@@ -29,10 +28,10 @@ mkDerivation {
     containers cryptohash-sha1 data-default deepseq directory extra
     filepath fuzzy ghc ghc-boot ghc-boot-th ghc-check ghc-paths
     haddock-library hashable haskell-lsp haskell-lsp-types hie-bios
-    hslogger mtl network-uri opentelemetry prettyprinter
+    hslogger mtl network-uri prettyprinter prettyprinter-ansi-terminal
-    prettyprinter-ansi-terminal regex-tdfa rope-utf16-splay safe
+    regex-tdfa rope-utf16-splay safe safe-exceptions shake sorted-list
-    safe-exceptions shake sorted-list stm syb text time transformers
+    stm syb text time transformers unix unordered-containers
-    unix unordered-containers utf8-string
+    utf8-string
   ];
   executableHaskellDepends = [
     aeson base bytestring containers data-default directory extra
@@ -52,7 +51,7 @@ mkDerivation {
     aeson base Chart Chart-diagrams diagrams diagrams-svg directory
     extra filepath shake text yaml
   ];
-  homepage = "https://github.com/digital-asset/ghcide#readme";
+  homepage = "https://github.com/haskell/ghcide#readme";
   description = "The core of an IDE";
   license = stdenv.lib.licenses.asl20;
 }

pkgs/development/tools/haskell/haskell-language-server/update.sh

@@ -7,6 +7,8 @@
 # Note that you should always try building haskell-language-server after updating it here, since
 # some of the overrides in pkgs/development/haskell/configuration-nix.nix may
 # need to be updated/changed.
+#
+# Remember to split out different updates into multiple commits
 
 set -eo pipefail
 
@@ -31,6 +33,22 @@ echo "Running cabal2nix and outputting to ${ghcide_derivation_file}..."
 
 cabal2nix --revision "$ghcide_new_version" "https://github.com/haskell/ghcide" > "$ghcide_derivation_file"
 
+# ===========================
+# HLS maintainer's Brittany fork
+# ===========================
+
+# brittany derivation created with cabal2nix.
+brittany_derivation_file="${script_dir}/hls-brittany.nix"
+
+# This is the current revision of the brittany fork in Nixpkgs.
+brittany_old_version="$(sed -En 's/.*\bversion = "(.*?)".*/\1/p' "$brittany_derivation_file")"
+
+brittany_new_version=$(curl --silent "https://api.github.com/repos/bubba/brittany/commits/ghc-8.10.1" | jq '.sha' --raw-output)
+
+echo "Updating haskell-language-server's brittany from old version $brittany_old_version to new version $brittany_new_version."
+echo "Running cabal2nix and outputting to ${brittany_derivation_file}..."
+
+cabal2nix --revision "$brittany_new_version" "https://github.com/bubba/brittany" > "$brittany_derivation_file"
 
 # ===========================
 # HLS

pkgs/development/web/lucky-cli/default.nix

@@ -2,13 +2,13 @@
 
 crystal.buildCrystalPackage rec {
   pname = "lucky-cli";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "luckyframework";
     repo = "lucky_cli";
     rev = "v${version}";
-    sha256 = "1qggbczrnrfjba6ipzjkqp6ni4rjc79pxy3vhgd7nq88ipa1sygk";
+    sha256 = "0xj7mcmz1rxv3ff530q8c5y1y7hccsmr8azk9nhmrk1q355vnxfw";
   };
 
   # the integration tests will try to clone a remote repos

pkgs/development/web/newman/default.nix

@@ -0,0 +1,19 @@
+{ pkgs, nodejs, stdenv, lib, ... }:
+
+let
+
+  packageName = with lib; concatStrings (map (entry: (concatStrings (mapAttrsToList (key: value: "${key}-${value}") entry))) (importJSON ./package.json));
+
+  nodePackages = import ./node-composition.nix {
+    inherit pkgs nodejs;
+    inherit (stdenv.hostPlatform) system;
+  };
+in
+nodePackages.newman.override {
+  meta = with lib; {
+    homepage = "https://www.getpostman.com";
+    description = "Newman is a command-line collection runner for Postman";
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.asl20;
+  };
+}

pkgs/development/web/newman/generate-dependencies.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nodePackages.node2nix
+
+node2nix \
+  --node-env node-env.nix \
+  --development \
+  --input package.json \
+  --output node-packages.nix \
+  --composition node-composition.nix

pkgs/development/web/newman/node-composition.nix

@@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.8.0. Do not edit!
+
+{pkgs ? import <nixpkgs> {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-12_x"}:
+
+let
+  nodeEnv = import ./node-env.nix {
+    inherit (pkgs) stdenv python2 utillinux runCommand writeTextFile;
+    inherit nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages.nix {
+  inherit (pkgs) fetchurl fetchgit;
+  inherit nodeEnv;
+}

pkgs/development/web/newman/node-env.nix

@@ -0,0 +1,542 @@
+# This file originates from node2nix
+
+{stdenv, nodejs, python2, utillinux, libtool, runCommand, writeTextFile}:
+
+let
+  python = if nodejs ? python then nodejs.python else python2;
+
+  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
+  tarWrapper = runCommand "tarWrapper" {} ''
+    mkdir -p $out/bin
+
+    cat > $out/bin/tar <<EOF
+    #! ${stdenv.shell} -e
+    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
+    EOF
+
+    chmod +x $out/bin/tar
+  '';
+
+  # Function that generates a TGZ file from a NPM project
+  buildNodeSourceDist =
+    { name, version, src, ... }:
+
+    stdenv.mkDerivation {
+      name = "node-tarball-${name}-${version}";
+      inherit src;
+      buildInputs = [ nodejs ];
+      buildPhase = ''
+        export HOME=$TMPDIR
+        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
+      '';
+      installPhase = ''
+        mkdir -p $out/tarballs
+        mv $tgzFile $out/tarballs
+        mkdir -p $out/nix-support
+        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
+      '';
+    };
+
+  includeDependencies = {dependencies}:
+    stdenv.lib.optionalString (dependencies != [])
+      (stdenv.lib.concatMapStrings (dependency:
+        ''
+          # Bundle the dependencies of the package
+          mkdir -p node_modules
+          cd node_modules
+
+          # Only include dependencies if they don't exist. They may also be bundled in the package.
+          if [ ! -e "${dependency.name}" ]
+          then
+              ${composePackage dependency}
+          fi
+
+          cd ..
+        ''
+      ) dependencies);
+
+  # Recursively composes the dependencies of a package
+  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
+      DIR=$(pwd)
+      cd $TMPDIR
+
+      unpackFile ${src}
+
+      # Make the base dir in which the target dependency resides first
+      mkdir -p "$(dirname "$DIR/${packageName}")"
+
+      if [ -f "${src}" ]
+      then
+          # Figure out what directory has been unpacked
+          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
+
+          # Restore write permissions to make building work
+          find "$packageDir" -type d -exec chmod u+x {} \;
+          chmod -R u+w "$packageDir"
+
+          # Move the extracted tarball into the output folder
+          mv "$packageDir" "$DIR/${packageName}"
+      elif [ -d "${src}" ]
+      then
+          # Get a stripped name (without hash) of the source directory.
+          # On old nixpkgs it's already set internally.
+          if [ -z "$strippedName" ]
+          then
+              strippedName="$(stripHash ${src})"
+          fi
+
+          # Restore write permissions to make building work
+          chmod -R u+w "$strippedName"
+
+          # Move the extracted directory into the output folder
+          mv "$strippedName" "$DIR/${packageName}"
+      fi
+
+      # Unset the stripped name to not confuse the next unpack step
+      unset strippedName
+
+      # Include the dependencies of the package
+      cd "$DIR/${packageName}"
+      ${includeDependencies { inherit dependencies; }}
+      cd ..
+      ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+    '';
+
+  pinpointDependencies = {dependencies, production}:
+    let
+      pinpointDependenciesFromPackageJSON = writeTextFile {
+        name = "pinpointDependencies.js";
+        text = ''
+          var fs = require('fs');
+          var path = require('path');
+
+          function resolveDependencyVersion(location, name) {
+              if(location == process.env['NIX_STORE']) {
+                  return null;
+              } else {
+                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
+
+                  if(fs.existsSync(dependencyPackageJSON)) {
+                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
+
+                      if(dependencyPackageObj.name == name) {
+                          return dependencyPackageObj.version;
+                      }
+                  } else {
+                      return resolveDependencyVersion(path.resolve(location, ".."), name);
+                  }
+              }
+          }
+
+          function replaceDependencies(dependencies) {
+              if(typeof dependencies == "object" && dependencies !== null) {
+                  for(var dependency in dependencies) {
+                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
+
+                      if(resolvedVersion === null) {
+                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
+                      } else {
+                          dependencies[dependency] = resolvedVersion;
+                      }
+                  }
+              }
+          }
+
+          /* Read the package.json configuration */
+          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
+
+          /* Pinpoint all dependencies */
+          replaceDependencies(packageObj.dependencies);
+          if(process.argv[2] == "development") {
+              replaceDependencies(packageObj.devDependencies);
+          }
+          replaceDependencies(packageObj.optionalDependencies);
+
+          /* Write the fixed package.json file */
+          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
+        '';
+      };
+    in
+    ''
+      node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
+
+      ${stdenv.lib.optionalString (dependencies != [])
+        ''
+          if [ -d node_modules ]
+          then
+              cd node_modules
+              ${stdenv.lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
+              cd ..
+          fi
+        ''}
+    '';
+
+  # Recursively traverses all dependencies of a package and pinpoints all
+  # dependencies in the package.json file to the versions that are actually
+  # being used.
+
+  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
+    ''
+      if [ -d "${packageName}" ]
+      then
+          cd "${packageName}"
+          ${pinpointDependencies { inherit dependencies production; }}
+          cd ..
+          ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+      fi
+    '';
+
+  # Extract the Node.js source code which is used to compile packages with
+  # native bindings
+  nodeSources = runCommand "node-sources" {} ''
+    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
+    mv node-* $out
+  '';
+
+  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
+  addIntegrityFieldsScript = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      function augmentDependencies(baseDir, dependencies) {
+          for(var dependencyName in dependencies) {
+              var dependency = dependencies[dependencyName];
+
+              // Open package.json and augment metadata fields
+              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
+              var packageJSONPath = path.join(packageJSONDir, "package.json");
+
+              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
+                  console.log("Adding metadata fields to: "+packageJSONPath);
+                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
+
+                  if(dependency.integrity) {
+                      packageObj["_integrity"] = dependency.integrity;
+                  } else {
+                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
+                  }
+
+                  if(dependency.resolved) {
+                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
+                  } else {
+                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
+                  }
+
+                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
+                      packageObj["_from"] = dependency.from;
+                  }
+
+                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
+              }
+
+              // Augment transitive dependencies
+              if(dependency.dependencies !== undefined) {
+                  augmentDependencies(packageJSONDir, dependency.dependencies);
+              }
+          }
+      }
+
+      if(fs.existsSync("./package-lock.json")) {
+          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
+
+          if(packageLock.lockfileVersion !== 1) {
+             process.stderr.write("Sorry, I only understand lock file version 1!\n");
+             process.exit(1);
+          }
+
+          if(packageLock.dependencies !== undefined) {
+              augmentDependencies(".", packageLock.dependencies);
+          }
+      }
+    '';
+  };
+
+  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
+  reconstructPackageLock = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      var packageObj = JSON.parse(fs.readFileSync("package.json"));
+
+      var lockObj = {
+          name: packageObj.name,
+          version: packageObj.version,
+          lockfileVersion: 1,
+          requires: true,
+          dependencies: {}
+      };
+
+      function augmentPackageJSON(filePath, dependencies) {
+          var packageJSON = path.join(filePath, "package.json");
+          if(fs.existsSync(packageJSON)) {
+              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
+              dependencies[packageObj.name] = {
+                  version: packageObj.version,
+                  integrity: "sha1-000000000000000000000000000=",
+                  dependencies: {}
+              };
+              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
+          }
+      }
+
+      function processDependencies(dir, dependencies) {
+          if(fs.existsSync(dir)) {
+              var files = fs.readdirSync(dir);
+
+              files.forEach(function(entry) {
+                  var filePath = path.join(dir, entry);
+                  var stats = fs.statSync(filePath);
+
+                  if(stats.isDirectory()) {
+                      if(entry.substr(0, 1) == "@") {
+                          // When we encounter a namespace folder, augment all packages belonging to the scope
+                          var pkgFiles = fs.readdirSync(filePath);
+
+                          pkgFiles.forEach(function(entry) {
+                              if(stats.isDirectory()) {
+                                  var pkgFilePath = path.join(filePath, entry);
+                                  augmentPackageJSON(pkgFilePath, dependencies);
+                              }
+                          });
+                      } else {
+                          augmentPackageJSON(filePath, dependencies);
+                      }
+                  }
+              });
+          }
+      }
+
+      processDependencies("node_modules", lockObj.dependencies);
+
+      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
+    '';
+  };
+
+  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
+    let
+      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
+    in
+    ''
+        # Pinpoint the versions of all dependencies to the ones that are actually being used
+        echo "pinpointing versions of dependencies..."
+        source $pinpointDependenciesScriptPath
+
+        # Patch the shebangs of the bundled modules to prevent them from
+        # calling executables outside the Nix store as much as possible
+        patchShebangs .
+
+        # Deploy the Node.js package by running npm install. Since the
+        # dependencies have been provided already by ourselves, it should not
+        # attempt to install them again, which is good, because we want to make
+        # it Nix's responsibility. If it needs to install any dependencies
+        # anyway (e.g. because the dependency parameters are
+        # incomplete/incorrect), it fails.
+        #
+        # The other responsibilities of NPM are kept -- version checks, build
+        # steps, postprocessing etc.
+
+        export HOME=$TMPDIR
+        cd "${packageName}"
+        runHook preRebuild
+
+        ${stdenv.lib.optionalString bypassCache ''
+          ${stdenv.lib.optionalString reconstructLock ''
+            if [ -f package-lock.json ]
+            then
+                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
+                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
+                rm package-lock.json
+            else
+                echo "No package-lock.json file found, reconstructing..."
+            fi
+
+            node ${reconstructPackageLock}
+          ''}
+
+          node ${addIntegrityFieldsScript}
+        ''}
+
+        npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} rebuild
+
+        if [ "''${dontNpmInstall-}" != "1" ]
+        then
+            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
+            rm -f npm-shrinkwrap.json
+
+            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} install
+        fi
+    '';
+
+  # Builds and composes an NPM package including all its dependencies
+  buildNodePackage =
+    { name
+    , packageName
+    , version
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , preRebuild ? ""
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" ];
+    in
+    stdenv.mkDerivation ({
+      name = "node_${name}-${version}";
+      buildInputs = [ tarWrapper python nodejs ]
+        ++ stdenv.lib.optional (stdenv.isLinux) utillinux
+        ++ stdenv.lib.optional (stdenv.isDarwin) libtool
+        ++ buildInputs;
+
+      inherit nodejs;
+
+      inherit dontStrip; # Stripping may fail a build for some package deployments
+      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
+
+      compositionScript = composePackage args;
+      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
+
+      installPhase = ''
+        # Create and enter a root node_modules/ folder
+        mkdir -p $out/lib/node_modules
+        cd $out/lib/node_modules
+
+        # Compose the package and all its dependencies
+        source $compositionScriptPath
+
+        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+        # Create symlink to the deployed executable folder, if applicable
+        if [ -d "$out/lib/node_modules/.bin" ]
+        then
+            ln -s $out/lib/node_modules/.bin $out/bin
+        fi
+
+        # Create symlinks to the deployed manual page folders, if applicable
+        if [ -d "$out/lib/node_modules/${packageName}/man" ]
+        then
+            mkdir -p $out/share
+            for dir in "$out/lib/node_modules/${packageName}/man/"*
+            do
+                mkdir -p $out/share/man/$(basename "$dir")
+                for page in "$dir"/*
+                do
+                    ln -s $page $out/share/man/$(basename "$dir")
+                done
+            done
+        fi
+
+        # Run post install hook, if provided
+        runHook postInstall
+      '';
+    } // extraArgs);
+
+  # Builds a development shell
+  buildNodeShell =
+    { name
+    , packageName
+    , version
+    , src
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
+
+      nodeDependencies = stdenv.mkDerivation ({
+        name = "node-dependencies-${name}-${version}";
+
+        buildInputs = [ tarWrapper python nodejs ]
+          ++ stdenv.lib.optional (stdenv.isLinux) utillinux
+          ++ stdenv.lib.optional (stdenv.isDarwin) libtool
+          ++ buildInputs;
+
+        inherit dontStrip; # Stripping may fail a build for some package deployments
+        inherit dontNpmInstall unpackPhase buildPhase;
+
+        includeScript = includeDependencies { inherit dependencies; };
+        pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
+
+        installPhase = ''
+          mkdir -p $out/${packageName}
+          cd $out/${packageName}
+
+          source $includeScriptPath
+
+          # Create fake package.json to make the npm commands work properly
+          cp ${src}/package.json .
+          chmod 644 package.json
+          ${stdenv.lib.optionalString bypassCache ''
+            if [ -f ${src}/package-lock.json ]
+            then
+                cp ${src}/package-lock.json .
+            fi
+          ''}
+
+          # Go to the parent folder to make sure that all packages are pinpointed
+          cd ..
+          ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
+
+          # Expose the executables that were installed
+          cd ..
+          ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+
+          mv ${packageName} lib
+          ln -s $out/lib/node_modules/.bin $out/bin
+        '';
+      } // extraArgs);
+    in
+    stdenv.mkDerivation {
+      name = "node-shell-${name}-${version}";
+
+      buildInputs = [ python nodejs ] ++ stdenv.lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
+      buildCommand = ''
+        mkdir -p $out/bin
+        cat > $out/bin/shell <<EOF
+        #! ${stdenv.shell} -e
+        $shellHook
+        exec ${stdenv.shell}
+        EOF
+        chmod +x $out/bin/shell
+      '';
+
+      # Provide the dependencies in a development shell through the NODE_PATH environment variable
+      inherit nodeDependencies;
+      shellHook = stdenv.lib.optionalString (dependencies != []) ''
+        export NODE_PATH=${nodeDependencies}/lib/node_modules
+        export PATH="${nodeDependencies}/bin:$PATH"
+      '';
+    };
+in
+{
+  buildNodeSourceDist = stdenv.lib.makeOverridable buildNodeSourceDist;
+  buildNodePackage = stdenv.lib.makeOverridable buildNodePackage;
+  buildNodeShell = stdenv.lib.makeOverridable buildNodeShell;
+}

pkgs/development/web/newman/package.json

@@ -0,0 +1,3 @@
+[
+  "newman"
+]

pkgs/games/steam/fhsenv.nix

@@ -44,7 +44,7 @@ let
 
   # Zachtronics and a few other studios expect STEAM_LD_LIBRARY_PATH to be present
   exportLDPath = ''
-    export LD_LIBRARY_PATH=/lib32:/lib64:${lib.concatStringsSep ":" ldPath}\''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=/lib32:/lib64:${lib.concatStringsSep ":" ldPath}''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
     export STEAM_LD_LIBRARY_PATH="$STEAM_LD_LIBRARY_PATH''${STEAM_LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
   '';
 

pkgs/servers/http/couchdb/3.nix

@@ -0,0 +1,38 @@
+{ stdenv, fetchurl, erlang, icu, openssl, spidermonkey
+, coreutils, bash, makeWrapper, python3 }:
+
+stdenv.mkDerivation rec {
+  pname = "couchdb";
+  version = "3.1.0";
+
+
+  # when updating this, please consider bumping the erlang/OTP version
+  # in all-packages.nix
+  src = fetchurl {
+    url = "mirror://apache/couchdb/source/${version}/apache-${pname}-${version}.tar.gz";
+    sha256 = "1vgqj3zsrkdqgnwzji3mqkapnfd6kq466f5xnya0fvzzl6bcfrs8";
+  };
+
+  buildInputs = [ erlang icu openssl spidermonkey (python3.withPackages(ps: with ps; [ requests ]))];
+  postPatch = ''
+    substituteInPlace src/couch/rebar.config.script --replace '/usr/include/mozjs-68' "${spidermonkey.dev}/include/mozjs-68"
+    patchShebangs bin/rebar
+  '';
+
+  dontAddPrefix= "True";
+  configureFlags = ["--spidermonkey-version=68"];
+  buildFlags = ["release"];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r rel/couchdb/* $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A database that uses JSON for documents, JavaScript for MapReduce queries, and regular HTTP for an API";
+    homepage = "http://couchdb.apache.org";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ lostnet ];
+  };
+}

pkgs/servers/http/openresty/default.nix

@@ -8,12 +8,12 @@
 
 callPackage ../nginx/generic.nix args rec {
   pname = "openresty";
-  nginxVersion = "1.15.8";
+  nginxVersion = "1.17.8";
-  version = "${nginxVersion}.3";
+  version = "${nginxVersion}.2";
 
   src = fetchurl {
     url = "https://openresty.org/download/openresty-${version}.tar.gz";
-    sha256 = "1a1la7vszv1parsnhphydblz64ffhycazncn3ividnvqg2mg735n";
+    sha256 = "1813w33hjm1hcqvl3b3f67qgi5zfjiqg6s01hiy12a5j3jqilcig";
   };
 
   fixPatch = patch: let name = patch.name or (builtins.baseNameOf patch); in

pkgs/servers/oauth2_proxy/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "oauth2-proxy";
-  version = "6.0.0";
+  version = "6.1.1";
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "oauth2-proxy";
-    sha256 = "0mbjg0d0w173xpq69frjdvgyx5k74pkrfx3phc3lq8snvhnf1c2n";
+    sha256 = "10vvib4089yywd10kigjszsfxkzv8xzj7dy3wr5df8h80rcfa74n";
     rev = "v${version}";
   };
 
-  vendorSha256 = "1hrk3h729kcc77fq44kiywmyzk5a78v7bm5d2yl76lfxxdcdric7";
+  vendorSha256 = "0z8ibmpil899xvjaw7siswy22shjhx17a6lnjpr62paqdxy1sfwc";
 
   # Taken from https://github.com/oauth2-proxy/oauth2-proxy/blob/master/Makefile
   buildFlagsArray = ("-ldflags=-X main.VERSION=${version}");

pkgs/tools/networking/openfortivpn/default.nix

@@ -29,6 +29,6 @@ in stdenv.mkDerivation {
     homepage = "https://github.com/adrienverge/openfortivpn";
     license = stdenv.lib.licenses.gpl3;
     maintainers = [ stdenv.lib.maintainers.madjar ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
   };
 }

pkgs/tools/typesetting/tex/texlive/default.nix

@@ -2,7 +2,7 @@
   - source: ../../../../../doc/languages-frameworks/texlive.xml
   - current html: https://nixos.org/nixpkgs/manual/#sec-language-texlive
 */
-{ stdenv, lib, fetchurl, runCommand, writeText, buildEnv
+{ stdenv, lib, fetchurl, fetchpatch, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
 , makeWrapper, python, ruby, perl
 , useFixedHashes ? true
@@ -57,6 +57,21 @@ let
       collection-plaingeneric = orig.collection-plaingeneric // {
         deps = orig.collection-plaingeneric.deps // { inherit (tl) xdvi; };
       };
+
+      # TODO revert for texlive 2020
+      arara = lib.recursiveUpdate orig.arara {
+        postUnpack = let
+          arara_jar_fix = fetchpatch {
+            url = "https://github.com/TeX-Live/texlive-source/commit/dbaf12f4a47dcd62bcc96346f65493fda3fec2c8.diff";
+            sha256 = "148knr8k6sm6fpyj31kdq85yxvzvwp1prjha3f07q24kbar2l830";
+          };
+        in ''
+          if [ -f "$out"/scripts/arara/arara.sh ]; then
+            cd "$out"/scripts/
+            patch -p4 <${arara_jar_fix}
+          fi
+        '';
+      };
     }); # overrides
 
     # tl =

pkgs/tools/typesetting/tex/texlive/fixedHashes.nix

@@ -553,7 +553,7 @@
 "adhocfilelist-2019"="l8ayz7mqaa5lma2bvqb2brc879y0viij";
 "adhocfilelist.doc-2019"="gm20nhwq88s1cmch3pcgkqnyahb5gnri";
 "adhocfilelist.source-2019"="3qx23im0z07cnk2bd5vrskl153zxy6ff";
-"arara-4.0.6"="qk5dq5f0il52m1gp8ckd7ilqbmpkvfmj";
+"arara-4.0.6"="6jhbdl9kh0d7iaq9qrl71kqzrmvvx9ya";
 "arara.doc-4.0.6"="rvkrcair91scrk763igaj9mmi23n5j7x";
 "arara.source-4.0.6"="s7rlspqx9dqsbixbnmnaz9hh7gwkmkfi";
 "asymptote-2.49"="ka921kxzvyq3hi5frln4hh7qg1kfgch7";

pkgs/tools/virtualization/xva-img/default.nix

@@ -0,0 +1,24 @@
+{ stdenv, lib, cmake, fetchFromGitHub, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "xva-img";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "eriklax";
+    repo = "xva-img";
+    rev = version;
+    sha256 = "1w3wrbrlgv7h2gdix2rmrmpjyla365kam5621a1aqjzwjqhjkwyq";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ openssl ];
+
+  meta = {
+    maintainers = with lib.maintainers; [ lheckemann willibutz globin ];
+    description = "Tool for converting Xen images to raw and back";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/top-level/all-packages.nix

@@ -1622,6 +1622,8 @@ in
 
   colpack = callPackage ../applications/science/math/colpack { };
 
+  commitizen = callPackage ../applications/version-management/commitizen {};
+
   compactor = callPackage ../applications/networking/compactor { };
 
   consul = callPackage ../servers/consul { };
@@ -9465,7 +9467,7 @@ in
 
   nim = callPackage ../development/compilers/nim { };
   nim-unwrapped = nim.unwrapped;
-  nim-stdlib = nim.stdlib;
+
   nrpl = callPackage ../development/tools/nrpl { };
 
   neko = callPackage ../development/compilers/neko { };
@@ -14456,6 +14458,8 @@ in
 
   nettle = callPackage ../development/libraries/nettle { };
 
+  newman = callPackage ../development/web/newman {};
+
   newt = callPackage ../development/libraries/newt { };
 
   nghttp2 = callPackage ../development/libraries/nghttp2 { };
@@ -16256,6 +16260,11 @@ in
     erlang = erlangR21;
   };
 
+  couchdb3 = callPackage ../servers/http/couchdb/3.nix {
+    spidermonkey = spidermonkey_68;
+    erlang = erlangR22;
+  };
+
   couchpotato = callPackage ../servers/couchpotato {};
 
   dex-oidc = callPackage ../servers/dex { };
@@ -21963,6 +21972,7 @@ in
   mpv = wrapMpv mpv-unwrapped {};
 
   mpvScripts = recurseIntoAttrs {
+    autoload = callPackage ../applications/video/mpv/scripts/autoload.nix {};
     convert = callPackage ../applications/video/mpv/scripts/convert.nix {};
     mpris = callPackage ../applications/video/mpv/scripts/mpris.nix {};
     simple-mpv-webui = callPackage ../applications/video/mpv/scripts/simple-mpv-webui.nix {};
@@ -27599,6 +27609,8 @@ in
 
   xteddy = callPackage ../applications/misc/xteddy { };
 
+  xva-img = callPackage ../tools/virtualization/xva-img { };
+
   xwiimote = callPackage ../misc/drivers/xwiimote { };
 
   xzoom = callPackage ../tools/X11/xzoom {};