Revert "Merge master into staging-next"

I merged master into staging-next but accidentally pushed it to master. This should get us back to 87a19e9048. This reverts commit ac241fb7a5, reversing changes made to 76a439239e.
2020-02-05 19:18:11 +01:00 · 2020-02-05 19:18:11 +01:00 · 0be87c7979
commit 0be87c7979
parent ac241fb7a5
28 changed files with 422 additions and 297 deletions
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -244,7 +244,7 @@ rec {
     Also note that Nix treats strings as a list of bytes and thus doesn't
     handle unicode.

-     Type: stringToCharacters :: string -> [string]
+     Type: stringtoCharacters :: string -> [string]

     Example:
       stringToCharacters ""
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -569,18 +569,14 @@ in
      };

    fileSystems."/nix/store" =
-      { fsType = "overlay";
-        device = "overlay";
-        options = [
-          "lowerdir=/nix/.ro-store"
-          "upperdir=/nix/.rw-store/store"
-          "workdir=/nix/.rw-store/work"
-        ];
+      { fsType = "unionfs-fuse";
+        device = "unionfs";
+        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
      };

-    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" "overlay" ];
+    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" ];

-    boot.initrd.kernelModules = [ "loop" "overlay" ];
+    boot.initrd.kernelModules = [ "loop" ];

    # Closures to be copied to the Nix store on the CD, namely the init
    # script and the top-level system configuration directory.
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@ -50,18 +50,14 @@ with lib;
      };

    fileSystems."/nix/store" =
-      { fsType = "overlay";
-        device = "overlay";
-        options = [
-          "lowerdir=/nix/.ro-store"
-          "upperdir=/nix/.rw-store/store"
-          "workdir=/nix/.rw-store/work"
-        ];
+      { fsType = "unionfs-fuse";
+        device = "unionfs";
+        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
      };

-    boot.initrd.availableKernelModules = [ "squashfs" "overlay" ];
+    boot.initrd.availableKernelModules = [ "squashfs" ];

-    boot.initrd.kernelModules = [ "loop" "overlay" ];
+    boot.initrd.kernelModules = [ "loop" ];

    # Closures to be copied to the Nix store, namely the init
    # script and the top-level system configuration directory.
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -299,7 +299,7 @@ in
      couchpotato = 267;
      gogs = 268;
      pdns-recursor = 269;
-      #kresd = 270; # switched to "knot-resolver" with dynamic ID
+      kresd = 270;
      rpc = 271;
      geoip = 272;
      fcron = 273;
@ -600,7 +600,7 @@ in
      headphones = 266;
      couchpotato = 267;
      gogs = 268;
-      #kresd = 270; # switched to "knot-resolver" with dynamic ID
+      kresd = 270;
      #rpc = 271; # unused
      #geoip = 272; # unused
      fcron = 273;
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@ -3,34 +3,12 @@
 with lib;

 let
+
  cfg = config.services.kresd;
-
-  # Convert systemd-style address specification to kresd config line(s).
-  # On Nix level we don't attempt to precisely validate the address specifications.
-  mkListen = kind: addr: let
-    al_v4 = builtins.match "([0-9.]\+):([0-9]\+)" addr;
-    al_v6 = builtins.match "\\[(.\+)]:([0-9]\+)" addr;
-    al_portOnly = builtins.match "()([0-9]\+)" addr;
-    al = findFirst (a: a != null)
-      (throw "services.kresd.*: incorrect address specification '${addr}'")
-      [ al_v4 al_v6 al_portOnly ];
-    port = last al;
-    addrSpec = if al_portOnly == null then "'${head al}'" else "{'::', '127.0.0.1'}";
-    in # freebind is set for compatibility with earlier kresd services;
-       # it could be configurable, for example.
-      ''
-        net.listen(${addrSpec}, ${port}, { kind = '${kind}', freebind = true })
-      '';
-
-  configFile = pkgs.writeText "kresd.conf" (
-    optionalString (cfg.listenDoH != []) ''
-      modules.load('http')
-    ''
-    + concatMapStrings (mkListen "dns") cfg.listenPlain
-    + concatMapStrings (mkListen "tls") cfg.listenTLS
-    + concatMapStrings (mkListen "doh") cfg.listenDoH
-    + cfg.extraConfig
-  );
+  configFile = pkgs.writeText "kresd.conf" ''
+    ${optionalString (cfg.listenDoH != []) "modules.load('http')"}
+    ${cfg.extraConfig};
+  '';

  package = pkgs.knot-resolver.override {
    extraFeatures = cfg.listenDoH != [];
@ -47,7 +25,6 @@ in {
          value
      )
    )
-    (mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
  ];

  ###### interface
@ -58,8 +35,8 @@ in {
      description = ''
        Whether to enable knot-resolver domain name server.
        DNSSEC validation is turned on by default.
-        You can run <literal>sudo nc -U /run/knot-resolver/control/1</literal>
-        and give commands interactively to kresd@1.service.
+        You can run <literal>sudo nc -U /run/kresd/control</literal>
+        and give commands interactively to kresd.
      '';
    };
    extraConfig = mkOption {
@ -69,10 +46,16 @@ in {
        Extra lines to be added verbatim to the generated configuration file.
      '';
    };
+    cacheDir = mkOption {
+      type = types.path;
+      default = "/var/cache/kresd";
+      description = ''
+        Directory for caches.  They are intended to survive reboots.
+      '';
+    };
    listenPlain = mkOption {
      type = with types; listOf str;
      default = [ "[::1]:53" "127.0.0.1:53" ];
-      example = [ "53" ];
      description = ''
        What addresses and ports the server should listen on.
        For detailed syntax see ListenStream in man systemd.socket.
@ -92,54 +75,91 @@ in {
      default = [];
      example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
      description = ''
-        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 8484).
+        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 7858).
        For detailed syntax see ListenStream in man systemd.socket.
      '';
    };
-    instances = mkOption {
-      type = types.ints.unsigned;
-      default = 1;
-      description = ''
-        The number of instances to start.  They will be called kresd@{1,2,...}.service.
-        Knot Resolver uses no threads, so this is the way to scale.
-        You can dynamically start/stop them at will, so this is just system default.
-      '';
-    };
    # TODO: perhaps options for more common stuff like cache size or forwarding
  };

  ###### implementation
  config = mkIf cfg.enable {
-    environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
+    environment.etc."kresd.conf".source = configFile; # not required

-    users.users.knot-resolver =
-      { isSystemUser = true;
-        group = "knot-resolver";
+    users.users.kresd =
+      { uid = config.ids.uids.kresd;
+        group = "kresd";
        description = "Knot-resolver daemon user";
      };
-    users.groups.knot-resolver.gid = null;
+    users.groups.kresd.gid = config.ids.gids.kresd;

-    systemd.packages = [ package ]; # the units are patched inside the package a bit
-
-    systemd.targets.kresd = { # configure units started by default
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "kres-cache-gc.service" ]
-        ++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
-    };
-    systemd.services."kresd@".serviceConfig = {
-      ExecStart = "${package}/bin/kresd --noninteractive "
-        + "-c ${package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
-      # Ensure correct ownership in case UID or GID changes.
-      CacheDirectory = "knot-resolver";
-      CacheDirectoryMode = "0750";
+    systemd.sockets.kresd = rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      listenStreams = cfg.listenPlain;
+      socketConfig = {
+        ListenDatagram = listenStreams;
+        FreeBind = true;
+        FileDescriptorName = "dns";
+      };
    };

-    environment.etc."tmpfiles.d/knot-resolver.conf".source =
-      "${package}/lib/tmpfiles.d/knot-resolver.conf";
+    systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      partOf = [ "kresd.socket" ];
+      listenStreams = cfg.listenTLS;
+      socketConfig = {
+        FileDescriptorName = "tls";
+        FreeBind = true;
+        Service = "kresd.service";
+      };
+    };

-    # Try cleaning up the previously default location of cache file.
-    # Note that /var/cache/* should always be safe to remove.
-    # TODO: remove later, probably between 20.09 and 21.03
-    systemd.tmpfiles.rules = [ "R /var/cache/kresd" ];
+    systemd.sockets.kresd-doh = mkIf (cfg.listenDoH != []) rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      partOf = [ "kresd.socket" ];
+      listenStreams = cfg.listenDoH;
+      socketConfig = {
+        FileDescriptorName = "doh";
+        FreeBind = true;
+        Service = "kresd.service";
+      };
+    };
+
+    systemd.sockets.kresd-control = rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      partOf = [ "kresd.socket" ];
+      listenStreams = [ "/run/kresd/control" ];
+      socketConfig = {
+        FileDescriptorName = "control";
+        Service = "kresd.service";
+        SocketMode = "0660"; # only root user/group may connect and control kresd
+      };
+    };
+
+    systemd.tmpfiles.rules = [ "d '${cfg.cacheDir}' 0770 kresd kresd - -" ];
+
+    systemd.services.kresd = {
+      description = "Knot-resolver daemon";
+
+      serviceConfig = {
+        User = "kresd";
+        Type = "notify";
+        WorkingDirectory = cfg.cacheDir;
+        Restart = "on-failure";
+        Sockets = [ "kresd.socket" "kresd-control.socket" ]
+          ++ optional (cfg.listenTLS != []) "kresd-tls.socket";
+      };
+
+      # Trust anchor goes from dns-root-data by default.
+      script = ''
+        exec '${package}/bin/kresd' --config '${configFile}' --forks=1
+      '';
+
+      requires = [ "kresd.socket" ];
+    };
  };
 }
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -334,10 +334,8 @@ mountFS() {

    # Filter out x- options, which busybox doesn't do yet.
    local optionsFiltered="$(IFS=,; for i in $options; do if [ "${i:0:2}" != "x-" ]; then echo -n $i,; fi; done)"
-    # Prefix (lower|upper|work)dir with /mnt-root (overlayfs)
-    local optionsPrefixed="$( echo "$optionsFiltered" | sed -E 's#\<(lowerdir|upperdir|workdir)=#\1=/mnt-root#g' )"

-    echo "$device /mnt-root$mountPoint $fsType $optionsPrefixed" >> /etc/fstab
+    echo "$device /mnt-root$mountPoint $fsType $optionsFiltered" >> /etc/fstab

    checkFS "$device" "$fsType"

@ -356,11 +354,10 @@ mountFS() {
            ;;
    esac

-    # Create backing directories for overlayfs
-    if [ "$fsType" = overlay ]; then
-        for i in upper work; do
-             dir="$( echo "$optionsPrefixed" | grep -o "${i}dir=[^,]*" )"
-             mkdir -m 0700 -p "${dir##*=}"
+    # Create backing directories for unionfs-fuse.
+    if [ "$fsType" = unionfs-fuse ]; then
+        for i in $(IFS=:; echo ${options##*,dirs=}); do
+            mkdir -m 0700 -p /mnt-root"${i%=*}"
        done
    fi

--- a/nixos/tests/lorri/default.nix
+++ b/nixos/tests/lorri/default.nix
@ -15,12 +15,12 @@ import ../make-test-python.nix {

    # Start the daemon and wait until it is ready
    machine.execute("lorri daemon > lorri.stdout 2> lorri.stderr &")
-    machine.wait_until_succeeds("grep --fixed-strings 'ready' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'lorri: ready' lorri.stdout")

    # Ping the daemon
-    machine.succeed("lorri internal__ping shell.nix")
+    machine.execute("lorri ping_ $(readlink -f shell.nix)")

    # Wait for the daemon to finish the build
-    machine.wait_until_succeeds("grep --fixed-strings 'Completed' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'OutputPaths' lorri.stdout")
  '';
 }
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -1,5 +1,9 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, qtbase , qttools, python
-, libGLU, libGL , libXt, qtx11extras, qtxmlpatterns , mkDerivation }:
+{
+stdenv, fetchFromGitHub, cmake, makeWrapper
+,qtbase, qttools, python, libGLU, libGL
+,libXt, qtx11extras, qtxmlpatterns
+, mkDerivation
+}:

 mkDerivation rec {
  pname = "paraview";
@ -49,20 +53,20 @@ mkDerivation rec {

  # Paraview links into the Python library, resolving symbolic links on the way,
  # so we need to put the correct sitePackages (with numpy) back on the path
-  preFixup = ''
-    wrapQtApp $out/bin/paraview \
+  postInstall = ''
+    wrapProgram $out/bin/paraview \
      --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapQtApp $out/bin/pvbatch \
+    wrapProgram $out/bin/pvbatch \
      --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapQtApp $out/bin/pvpython \
+    wrapProgram $out/bin/pvpython \
      --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
  '';

-  meta = with stdenv.lib; {
+  meta = {
    homepage = http://www.paraview.org/;
    description = "3D Data analysis and visualization application";
-    license = licenses.free;
-    maintainers = with maintainers; [ guibert ];
-    platforms = platforms.linux;
+    license = stdenv.lib.licenses.free;
+    maintainers = with stdenv.lib.maintainers; [guibert];
+    platforms = with stdenv.lib.platforms; linux;
  };
 }
--- a/pkgs/applications/science/biology/spades/default.nix
+++ b/pkgs/applications/science/biology/spades/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "SPAdes";
-  version = "3.14.0";
+  version = "3.13.1";

  src = fetchurl {
    url = "http://cab.spbu.ru/files/release${version}/${pname}-${version}.tar.gz";
-    sha256 = "1ffxswd2ngkpy1d6l3lb6a9cmyy1fglbdsws00b3m1k22zaqv60q";
+    sha256 = "0giayz197lmq2108filkn9izma3i803sb3iskv9hs5snzdr9p8ld";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@ -1,28 +1,19 @@
-{ stdenv, fetchurl
-# Image file formats
-, libjpeg, libtiff, giflib, libpng, libwebp
-# imlib2 can load images from ID3 tags.
-, libid3tag
-, freetype , bzip2, pkgconfig
-, x11Support ? true, xlibsWrapper ? null
-}:
+{ stdenv, fetchurl, libjpeg, libtiff, giflib, libpng, bzip2, pkgconfig
+, freetype, libid3tag
+, x11Support ? true, xlibsWrapper ? null }:
+
+with stdenv.lib;

-let
-  inherit (stdenv.lib) optional;
-in
 stdenv.mkDerivation rec {
-  pname = "imlib2";
-  version = "1.6.1";
+  name = "imlib2-1.5.1";

  src = fetchurl {
-    url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.bz2";
-    sha256 = "0v8n3dswx7rxqfd0q03xwc7j2w1mv8lv18rdxv487a1xw5vklfad";
+    url = "mirror://sourceforge/enlightenment/${name}.tar.bz2";
+    sha256 = "1bms2iwmvnvpz5jqq3r52glarqkafif47zbh1ykz8hw85d2mfkps";
  };

-  buildInputs = [
-    libjpeg libtiff giflib libpng libwebp
-    bzip2 freetype libid3tag
-  ] ++ optional x11Support xlibsWrapper;
+  buildInputs = [ libjpeg libtiff giflib libpng bzip2 freetype libid3tag ]
+    ++ optional x11Support xlibsWrapper;

  nativeBuildInputs = [ pkgconfig ];

@ -44,7 +35,7 @@ stdenv.mkDerivation rec {
    moveToOutput bin/imlib2-config "$dev"
  '';

-  meta = with stdenv.lib; {
+  meta = {
    description = "Image manipulation library";

    longDescription = ''
@ -55,8 +46,8 @@ stdenv.mkDerivation rec {
      easily, without sacrificing speed.
    '';

-    homepage = "https://docs.enlightenment.org/api/imlib2/html";
-    license = licenses.mit;
+    homepage = http://docs.enlightenment.org/api/imlib2/html;
+    license = licenses.free;
    platforms = platforms.unix;
    maintainers = with maintainers; [ spwhitt ];
  };
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "dask";
-  version = "2.10.1";
+  version = "2.9.1";

  disabled = pythonOlder "3.5";

@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "dask";
    repo = pname;
    rev = version;
-    sha256 = "035mr7385yf5ng5wf60qxr80529h8dsla5hymkyg68dxhkd0jvbr";
+    sha256 = "1xayr4gkp4slvmh2ksdr0d196giz3yhknqjjg1vw2j0la9gwfwxs";
  };

  checkInputs = [
--- a/pkgs/development/tools/electron/5.x.nix
+++ b/pkgs/development/tools/electron/5.x.nix
@ -0,0 +1,86 @@
+{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }:
+
+let
+  version = "5.0.8";
+  name = "electron-${version}";
+
+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
+  meta = with stdenv.lib; {
+    description = "Cross platform desktop application shell";
+    homepage = https://github.com/electron/electron;
+    license = licenses.mit;
+    maintainers = with maintainers; [ travisbhartwell manveru ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
+  };
+
+  linux = {
+    inherit name version meta;
+    src = {
+      i686-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
+        sha256 = "1blw38x4fp4w2vs6r1d0jz3pg0m78417i0q9bvwpnwbn6wil857y";
+      };
+      x86_64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
+        sha256 = "1gz5n8gkgka7343qcwckagd4ply1lxwiaccdjv16srk2wwc9bc9m";
+      };
+      armv7l-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
+        sha256 = "1y8yna6z7xc378k6hsgngv9v98yjwq36knnr4qan0pw26paw1m82";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
+        sha256 = "1ha4ajvi0z051b6npigw6w4xi3bj3hhpxfr3xw4fgx6g6bvf1vpx";
+      };
+    }.${stdenv.hostPlatform.system} or throwSystem;
+
+    buildInputs = [ gtk3 ];
+
+    nativeBuildInputs = [
+      unzip
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
+
+    buildCommand = ''
+      mkdir -p $out/lib/electron $out/bin
+      unzip -d $out/lib/electron $src
+      ln -s $out/lib/electron/electron $out/bin
+
+      fixupPhase
+
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk at-spi2-core ]}:$out/lib/electron" \
+        $out/lib/electron/electron
+
+      wrapProgram $out/lib/electron/electron \
+        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
+        "''${gappsWrapperArgs[@]}"
+    '';
+  };
+
+  darwin = {
+    inherit name version meta;
+
+    src = fetchurl {
+      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
+      sha256 = "1h7i2ik6wms5v6ji0mp33kzfh9sd89m7w3m2nm6wrjny7m0b43ww";
+    };
+
+    buildInputs = [ unzip ];
+
+    buildCommand = ''
+      mkdir -p $out/Applications
+      unzip $src
+      mv Electron.app $out/Applications
+      mkdir -p $out/bin
+      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
+    '';
+  };
+in
+
+  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
--- a/pkgs/development/tools/electron/generic.nix
+++ b/pkgs/development/tools/electron/generic.nix
@ -1,9 +1,11 @@
 { stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core}:

-version: hashes:
 let
+  version = "6.0.1";
  name = "electron-${version}";

+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
  meta = with stdenv.lib; {
    description = "Cross platform desktop application shell";
    homepage = https://github.com/electron/electron;
@ -12,28 +14,27 @@ let
    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
  };

-  fetcher = vers: tag: hash: fetchurl {
-    url = "https://github.com/electron/electron/releases/download/v${vers}/electron-v${vers}-${tag}.zip";
-    sha256 = hash;
-  };
-
-  tags = {
-    i686-linux = "linux-ia32";
-    x86_64-linux = "linux-x64";
-    armv7l-linux = "linux-armv7l";
-    aarch64-linux = "linux-arm64";
-    x86_64-darwin = "darwin-x64";
-  };
-
-  get = as: platform: as.${platform.system} or
-    "Unsupported system: ${platform.system}";
-
-  common = platform: {
-    inherit name version meta;
-    src = fetcher version (get tags platform) (get hashes platform);
-  };
-
  linux = {
+    inherit name version meta;
+    src = {
+      i686-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
+        sha256 = "0ly6mjcljw0axkkrz7dsvfywmjb3pmspalfk2259gyqqxj8a37pb";
+      };
+      x86_64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
+        sha256 = "0l8k6v16ynikf6x59w5byzhji0d6mqp2q0kjlrby56546qzyfkh6";
+      };
+      armv7l-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
+        sha256 = "0c2xl8dm9fmj0d92w53zbn2np2fiwr88hw0dqjdn1rwczhw7zqss";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
+        sha256 = "0iyq229snm7z411xxfsv7f0bqg6hbw2l8y6ymys110f83hp01f8a";
+      };
+    }.${stdenv.hostPlatform.system} or throwSystem;
+
    buildInputs = [ gtk3 ];

    nativeBuildInputs = [
@ -63,6 +64,13 @@ let
  };

  darwin = {
+    inherit name version meta;
+
+    src = fetchurl {
+      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
+      sha256 = "0m8v5fs69kanrd1yk6smbmaaj9gb5j3q487z3wicifry0xn381i2";
+    };
+
    buildInputs = [ unzip ];

    buildCommand = ''
@ -74,7 +82,5 @@ let
    '';
  };
 in
-  stdenv.mkDerivation (
-    (common stdenv.hostPlatform) //
-    (if stdenv.isDarwin then darwin else linux)
-  )
+
+  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@ -1,46 +1,86 @@
-{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }@args:
+{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk }:

 let
-  mkElectron = import ./generic.nix args;
+  version = "4.2.8";
+  name = "electron-${version}";
+
+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
+  meta = with stdenv.lib; {
+    description = "Cross platform desktop application shell";
+    homepage = https://github.com/electron/electron;
+    license = licenses.mit;
+    maintainers = with maintainers; [ travisbhartwell manveru ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
+  };
+
+  linux = {
+    inherit name version meta;
+    src = {
+      i686-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
+        sha256 = "1sikxr0pfpi3wrf1d7fia1vhb1gacsy9pr7qc0fycgnzsy2nvf8n";
+      };
+      x86_64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
+        sha256 = "0wc954cjc13flvdh8rkmnifdx6nirf273v1n76lsklbsq6c73i4h";
+      };
+      armv7l-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
+        sha256 = "0370ygpsm42drm70gj12i6mg960wchhqis7zz8i9is2ax1b2xjp5";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
+        sha256 = "0vl90lsjcsgcxivbaq526ffbx3lsh6axfmpkfxl8cj2jlbsg593k";
+      };
+    }.${stdenv.hostPlatform.system} or throwSystem;
+
+    buildInputs = [ gtk3 ];
+
+    nativeBuildInputs = [
+      unzip
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
+
+    buildCommand = ''
+      mkdir -p $out/lib/electron $out/bin
+      unzip -d $out/lib/electron $src
+      ln -s $out/lib/electron/electron $out/bin
+
+      fixupPhase
+
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk ]}:$out/lib/electron" \
+        $out/lib/electron/electron
+
+      wrapProgram $out/lib/electron/electron \
+        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
+        "''${gappsWrapperArgs[@]}"
+    '';
+  };
+
+  darwin = {
+    inherit name version meta;
+
+    src = fetchurl {
+      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
+      sha256 = "083v8k17b596fa63a7qrwyn2k8pd5vmg9yijbqbnpfcg4ja3bjx9";
+    };
+
+    buildInputs = [ unzip ];
+
+    buildCommand = ''
+      mkdir -p $out/Applications
+      unzip $src
+      mv Electron.app $out/Applications
+      mkdir -p $out/bin
+      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
+    '';
+  };
 in
-{
-  electron_4 = mkElectron "4.2.12" {
-    x86_64-linux = "72c5319c92baa7101bea3254a036c0cd3bcf257f4a03a0bb153668b7292ee2dd";
-    x86_64-darwin = "89b0e16bb9b7072ed7ed1906fccd08540acdd9f42dd8a29c97fa17d811b8c5e5";
-    i686-linux = "bf96b1736141737bb064e48bdb543302fd259de634b1790b7cf930525f47859f";
-    armv7l-linux = "2d970b3020627e5381fd4916dd8fa50ca9556202c118ab4cba09c293960689e9";
-    aarch64-linux = "938b7cc5f917247a120920df30374f86414b0c06f9f3dc7ab02be1cadc944e55";
-  };

-  electron_5 = mkElectron "5.0.13" {
-    x86_64-linux = "8ded43241c4b7a6f04f2ff21c75ae10e4e6db1794e8b1b4f7656c0ed21667f8f";
-    x86_64-darwin = "589834815fb9667b3c1c1aa6ccbd87d50e5660ecb430f6b475168b772b9857cd";
-    i686-linux = "ccf4a5ed226928a30bd3ea830913d99853abb089bd4a6299ffa9fa0daa8d026a";
-    armv7l-linux = "96ad83802bc61d87bb952027d49e5dd297f58e4493e66e393b26e51e09065add";
-    aarch64-linux = "01f0fd313b060fb28a1022d68fb224d415fa22986e2a8f4aded6424b65e35add";
-  };
-
-  electron_6 = mkElectron "6.1.7" {
-    x86_64-linux = "7fe94fc1edebe2f5645056a4300fc642c04155e55da8dd4ee058a0c0ef835ae8";
-    x86_64-darwin = "1c790a4cbda05f1c136d18fa6a09bdb09a1941f521207466756a3e95e343c485";
-    i686-linux = "1afd8ea79acb2b4782fb459e084549ed4cd4ead779764829b1d862148359eae5";
-    armv7l-linux = "14f2ea0459f0dda8c566b0fa4a2fe755f4220bbae313ea0c453861ac2f803196";
-    aarch64-linux = "80e05c1a0b51c335483666e959c1631a089246986b7fc3a4f9ee1288a57a602a";
-  };
-
-  electron_7 = mkElectron "7.1.10" {
-    x86_64-linux = "296f034ac9a00afa4dc99ed145410c015af3f59cd7e9becc7709d70a4f8a9ebf";
-    x86_64-darwin = "10eb453c2b19948777a6f404fbdbdd48464a4cd63db16bd3ce66b60dda016724";
-    i686-linux = "681b6440d4f0f7ffa29a34610ef41103d72937d6e524d81fd2d0fa8d9eb67936";
-    armv7l-linux = "2c09e9a77f1da152d766dc2e43719e2852b70f917229466a2ac457416d1374f7";
-    aarch64-linux = "1dad780b872bbc069eb1cac9ff4ec8f0b8d200153ab7f51397e27219094db1f0";
-  };
-
-  electron_8 = mkElectron "8.0.0" {
-    x86_64-linux = "b457a2ece83bb8a2efea42e75403740cbba051a64e325288760046b8999dd1c9";
-    x86_64-darwin = "3f96dfa1d4e0313d11b9e5c66e2df161cfdb30685ee9dadcc779bcad2fb3876e";
-    i686-linux = "0633ac2b6b6d00302e0e5df224d0e808e4ea9ecc14643e8534027e49b20436fb";
-    armv7l-linux = "8d1f3daa86c77e7aceb8c8e4491c094e789951c7d475fc536b85fe7d279794bf";
-    aarch64-linux = "484c04204478e8594d66f8bd332529c0c5eecfd71ee1705cc0478fa59c6818ee";
-  };
-}
+  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
--- a/pkgs/development/tools/electron/print-hashes.sh
+++ b/pkgs/development/tools/electron/print-hashes.sh
@ -19,15 +19,11 @@ SYSTEMS=(
    [x86_64-darwin]=darwin-x64
 )

-hashfile="$(nix-prefetch-url --print-path "https://github.com/electron/electron/releases/download/v${VERSION}/SHASUMS256.txt" 2>/dev/null | tail -n1)"
-
-echo "Entry similar to the following goes in default.nix:"
-echo
-echo "  electron_${VERSION%%.*} = mkElectron \"${VERSION}\" {"
-
 for S in "${!SYSTEMS[@]}"; do
-  hash="$(grep " *electron-v${VERSION}-${SYSTEMS[$S]}.zip$" "$hashfile"|cut -f1 -d' ')"
-  echo "    $S = \"$hash\";"
+  HASHES["$S"]=$(nix-prefetch-url "https://github.com/electron/electron/releases/download/v${VERSION}/electron-v${VERSION}-${SYSTEMS[$S]}.zip")
 done

-echo "  };"
+for S in "${!HASHES[@]}"; do
+    echo "$S"
+    echo "sha256 = \"${HASHES[$S]}\";"
+done
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@ -1,13 +1,12 @@
 { stdenv, lib, fetchurl, buildRubyGem, bundlerEnv, ruby, libarchive
-, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux, fetchpatch
-}:
+, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux }:

 let
  # NOTE: bumping the version and updating the hash is insufficient;
  # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.7";
+  version = "2.2.6";
  url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "1z31y1nqiyj6rml9lz8gcbr29myhs5wcap8jsvgm3pb7p9p9y8m9";
+  sha256 = "0nssq2i4riif0q72h5qp7dlxd4shqcyvm1bx9adppcacb77gpnhv";

  deps = bundlerEnv rec {
    name = "${pname}-${version}";
@ -54,13 +53,6 @@ in buildRubyGem rec {
    ./unofficial-installation-nowarn.patch
    ./use-system-bundler-version.patch
    ./0004-Support-system-installed-plugins.patch
-
-    # fix deprecation warning on ruby 2.6.5.
-    # See also https://github.com/hashicorp/vagrant/pull/11307
-    (fetchpatch {
-      url = "https://github.com/hashicorp/vagrant/commit/d18ed567aaa5da23c9e91ab87f360e7bf6760f13.patch";
-      sha256 = "0f61qj41rc3fdggmnha4jrqg4pzmfiriwpsz4fcgf7c0bx6qha7q";
-    })
  ];

  postPatch = ''
@ -118,7 +110,7 @@ in buildRubyGem rec {
    description = "A tool for building complete development environments";
    homepage = https://www.vagrantup.com/;
    license = licenses.mit;
-    maintainers = with maintainers; [ aneeshusa ma27 ];
+    maintainers = with maintainers; [ aneeshusa ];
    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@ -14,10 +14,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
+      sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
      type = "gem";
    };
-    version = "3.2.4";
+    version = "3.2.3";
  };
  childprocess = {
    dependencies = ["ffi"];
@ -86,10 +86,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
+      sha256 = "06mvxpjply8qh4j3fj9wh08kdzwkbnvsiysh0vrhlk5cwxzjmblh";
      type = "gem";
    };
-    version = "1.12.2";
+    version = "1.11.1";
  };
  gssapi = {
    dependencies = ["ffi"];
@ -150,10 +150,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
+      sha256 = "1gcp1m1p6dpasycfz2sj82ci9ggz7lsskz9c9q6gvfwxrl8y9dx7";
      type = "gem";
    };
-    version = "1.8.2";
+    version = "1.1.1";
  };
  listen = {
    dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
@ -203,10 +203,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      sha256 = "0g7l18igjb9z7q4b2ykvyxyvjxlx5pwsmx5z3ibdbr6372xgfglk";
      type = "gem";
    };
-    version = "3.3.1";
+    version = "3.3";
  };
  mime-types-data = {
    groups = ["default"];
@ -296,10 +296,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1jm76h8f8hji38z3ggf4bzi8vps6p7sagxn3ab57qc0xyga64005";
+      sha256 = "1fs7hxm9g6ywv2yih83b879klhc4fs8i0p9166z795qmd77dk0a4";
      type = "gem";
    };
-    version = "0.10.1";
+    version = "0.10.0";
  };
  rb-kqueue = {
    dependencies = ["ffi"];
@ -348,10 +348,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1qxc2zxwwipm6kviiar4gfhcakpx1jdcs89v6lvzivn5hq1xk78l";
+      sha256 = "0i5dhyiavmk2yc7xyfwzp3m476f7d9mhigibsw37jqpdq4vmi4cv";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.2.4";
  };
  unf = {
    dependencies = ["unf_ext"];
@ -401,10 +401,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "13c0vf32vinkp3ia86rvq779dacl37v4v2814v4g9qrk3liv0dym";
+      sha256 = "1sl14qdshkmficdsy9z57xmdp5z9riv7jc5lv005n0h04mg7d47b";
      type = "gem";
    };
-    version = "2.3.4";
+    version = "2.3.3";
  };
  winrm-elevated = {
    dependencies = ["erubi" "winrm" "winrm-fs"];
@ -412,10 +412,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12fzg9liydl244xq6r7x0wy06zn1n4czdbnjavy3150c3qsnv71a";
+      sha256 = "13d0pjzffbqicg08fsx4dsl6ibsqda5vx5d9f6hsds2z6mdilrab";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.1.2";
  };
  winrm-fs = {
    dependencies = ["erubi" "logging" "rubyzip" "winrm"];
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:

 buildLinux (args // rec {
-  version = "4.4.213";
+  version = "4.4.212";
  extraMeta.branch = "4.4";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1cmwn9zvz14jqjy6qkszglhs2p5h6yh82b2269cbzvibg8y3rxq0";
+    sha256 = "0mx3qyj6w6h7gw7drsfsgl4iyz1695sjnf9hqh4kczci48kw5rj7";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:

 buildLinux (args // rec {
-  version = "4.9.213";
+  version = "4.9.212";
  extraMeta.branch = "4.9";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0r7bqpvbpiiniwsm338b38mv6flfgm1r09avxqsakhkh8rvgz1dg";
+    sha256 = "0c5yjilaq86j6i2hzlxbp2ia7jhnf7kv952ffv7jxdf90sk3irxd";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.5.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "5.5.2";
+  version = "5.5.1";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "17pr9v04g3lrar585l1zpnsmrivryqxwyfvjc3qp8wrkn21z7x94";
+    sha256 = "1n9hwzbhp43a4lvmyb0mbayfnb9s1h6nbg23i93wzg7391hr28q3";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";

 stdenv.mkDerivation rec {
  pname = "wireguard";
-  version = "0.0.20200205";
+  version = "0.0.20200128";

  src = fetchzip {
    url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "084bvjhfqxvbh5wv7a2cj8k1i1lfix2l9972xwr36hw9kvqpynnm";
+    sha256 = "05iz0pl0znx5yham8qzpym2ggc9babh36xaa504k99qqvddg8b11";
  };

  preConfigure = ''
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch
+{ stdenv, fetchurl
 # native deps.
 , runCommand, pkgconfig, meson, ninja, makeWrapper
 # build+runtime deps.
@ -11,38 +11,31 @@ let # un-indented, over the whole file

 result = if extraFeatures then wrapped-full else unwrapped;

-inherit (stdenv.lib) optional optionals;
+inherit (stdenv.lib) optional optionals concatStringsSep;
 lua = luajitPackages;

+# FIXME: remove these usages once resolving
+# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
+exportLuaPathsFor = luaPkgs: ''
+  export LUA_PATH='${ concatStringsSep ";" (map lua.getLuaPath  luaPkgs)}'
+  export LUA_CPATH='${concatStringsSep ";" (map lua.getLuaCPath luaPkgs)}'
+'';
+
 unwrapped = stdenv.mkDerivation rec {
  pname = "knot-resolver";
-  version = "5.0.1";
+  version = "4.3.0";

  src = fetchurl {
    url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "4a93264ad0cda7ea2252d1ba057e474722f77848165f2893e0c76e21ae406415";
+    sha256 = "0ca0f171ae2b2d76830967a5150eb0fa496b48b2a48f41b2be65d3743aaece25";
  };

  outputs = [ "out" "dev" ];

-  # Path fixups for the NixOS service.
-  postPatch = ''
-    patch meson.build <<EOF
-    @@ -50,2 +50,2 @@
-    -systemd_work_dir = join_paths(prefix, get_option('localstatedir'), 'lib', 'knot-resolver')
-    -systemd_cache_dir = join_paths(prefix, get_option('localstatedir'), 'cache', 'knot-resolver')
-    +systemd_work_dir  = '/var/lib/knot-resolver'
-    +systemd_cache_dir = '/var/cache/knot-resolver'
-    EOF
-
-    # ExecStart can't be overwritten in overrides.
-    # We need that to use wrapped executable and correct config file.
-    sed '/^ExecStart=/d' -i systemd/kresd@.service.in
-  '';
-
  preConfigure = ''
    patchShebangs scripts/
-  '';
+  ''
+    + stdenv.lib.optionalString doInstallCheck (exportLuaPathsFor [ lua.cqueues lua.basexx ]);

  nativeBuildInputs = [ pkgconfig meson ninja ];

@ -60,17 +53,16 @@ unwrapped = stdenv.mkDerivation rec {
  ]
  ++ optional doInstallCheck "-Dunit_tests=enabled"
  ++ optional (doInstallCheck && !stdenv.isDarwin) "-Dconfig_tests=enabled"
-  ++ optional stdenv.isLinux "-Dsystemd_files=enabled" # used by NixOS service
    #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
  ;

  postInstall = ''
    rm "$out"/lib/libkres.a
-    rm "$out"/lib/knot-resolver/upgrade-4-to-5.lua # not meaningful on NixOS
  '';

-  doInstallCheck = with stdenv; hostPlatform == buildPlatform;
-  installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx ];
+  # aarch64: see https://github.com/wahern/cqueues/issues/223
+  doInstallCheck = with stdenv; hostPlatform == buildPlatform && !hostPlatform.isAarch64;
+  installCheckInputs = [ cmocka which cacert ];
  installCheckPhase = ''
    meson test --print-errorlogs
  '';
@ -84,31 +76,37 @@ unwrapped = stdenv.mkDerivation rec {
  };
 };

-wrapped-full = runCommand unwrapped.name
+# FIXME: revert this back after resolving
+# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
+wrapped-full =
+  with stdenv.lib;
+  with luajitPackages;
+  let
+    luaPkgs = [
+      luasec luasocket # trust anchor bootstrap, prefill module
+      luafilesystem # prefill module
+      http # for http module; brings lots of deps; some are useful elsewhere
+      cqueues fifo lpeg lpeg_patterns luaossl compat53 basexx binaryheap
+    ];
+  in runCommand unwrapped.name
  {
    nativeBuildInputs = [ makeWrapper ];
-    buildInputs = with luajitPackages; [
-      # For http module, prefill module, trust anchor bootstrap.
-      # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
-      http
-      # psl isn't in nixpkgs yet, but policy.slice_randomize_psl() seems not important.
-    ];
    preferLocalBuild = true;
    allowSubstitutes = false;
  }
-  ''
-    mkdir -p "$out"/bin
+  (exportLuaPathsFor luaPkgs
+  + ''
+    mkdir -p "$out"/{bin,share}
    makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
      --set LUA_PATH  "$LUA_PATH" \
      --set LUA_CPATH "$LUA_CPATH"

-    ln -sr '${unwrapped}/share' "$out"/
-    ln -sr '${unwrapped}/lib'   "$out"/ # useful in NixOS service
+    ln -sr '${unwrapped}/share/man' "$out"/share/
    ln -sr "$out"/{bin,sbin}

    echo "Checking that 'http' module loads, i.e. lua search paths work:"
    echo "modules.load('http')" > test-http.lua
    echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-  '';
+  '');

 in result
--- a/pkgs/servers/documize-community/default.nix
+++ b/pkgs/servers/documize-community/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "documize-community";
-  version = "3.7.0";
+  version = "3.6.0";

  src = fetchFromGitHub {
    owner = "documize";
    repo = "community";
    rev = "v${version}";
-    sha256 = "1pcldf9lqvpb2h2a3kr3mahj2v1jasjwrszj6czjmkyml7x2sz7c";
+    sha256 = "0wic4j7spw9ya1m6yz0mkpqi1px6jd2vk60w8ldx0m0k606wy6ir";
  };

  modSha256 = "1z0v7n8klaxcqv7mvzf3jzgrp78zb4yiibx899ppk6i5qnj4xiv0";
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
  version = "2020-02-04";
  pname = "oh-my-zsh";
-  rev = "77aa1795d2f05583d4fc63a63abb0144beb5ecff";
+  rev = "6bebc254e88ac9b7fdaa7491d031f82ec107e418";

  src = fetchgit { inherit rev;
    url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "0n36wpdlr1w4gr0cja48mcywi8av71p3diigkiv3n45a9hh94fxx";
+    sha256 = "1lmg1givymr4hgmvmngklm7q3g7dpqwm7aj5xild72cdhx0g5qqw";
  };

  pathsToLink = [ "/share/oh-my-zsh" ];
--- a/pkgs/tools/misc/lorri/default.nix
+++ b/pkgs/tools/misc/lorri/default.nix
@ -14,7 +14,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "lorri";
-  version = "1.0";
+  version = "unstable-2020-01-09";

  meta = with stdenv.lib; {
    description = "Your project's nix-env";
@ -27,11 +27,11 @@ rustPlatform.buildRustPackage rec {
    owner = "target";
    repo = pname;
    # Run `eval $(nix-build -A lorri.updater)` after updating the revision!
-    rev = "88c680c9abf0f04f2e294436d20073ccf26f0781";
-    sha256 = "1415mhdr0pwvshs04clfz1ys76r5qf9jz8jchm63l6llaj6m7mrv";
+    rev = "7b84837b9988d121dd72178e81afd440288106c5";
+    sha256 = "0rkga944jl6i0051vbsddfqbvzy12168cbg4ly2ng1rk0x97dbr8";
  };

-  cargoSha256 = "1kdpzbn3353yk7i65hll480fcy16wdvppdr6xgfh06x88xhim4mp";
+  cargoSha256 = "0k7l0zhk2vzf4nlwv4xr207irqib2dqjxfdjk1fprff84c4kblx8";
  doCheck = false;

  BUILD_REV_COUNT = src.revCount or 1;
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@ -9,16 +9,16 @@ assert pythonSupport -> pythonPackages != null;

 rustPlatform.buildRustPackage rec {
  pname = "sequoia";
-  version = "0.13.0";
+  version = "0.11.0";

  src = fetchFromGitLab {
    owner = "sequoia-pgp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0hxdjzd2qjwf9pbnkzrnzlg0xa8vf1f65aryq7pd9895bpnk7740";
+    sha256 = "1k0pr3vn77fpfzyvbg7xb4jwm6srsiws9bsd8q7i3hl6j56a880i";
  };

-  cargoSha256 = "0w968ynxqkznp9g1ah040iv6ghwqwqjk1cjlr2f0j5fs57rspzf2";
+  cargoSha256 = "15bhg7b88rq8p0bn6y5wwv2l42kqb1qyx2s3kw0r0v0wadf823q3";

  nativeBuildInputs = [
    pkgconfig
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "sudo";
-  version = "1.8.31";
+  version = "1.8.30";

  src = fetchurl {
    url = "ftp://ftp.sudo.ws/pub/sudo/${pname}-${version}.tar.gz";
-    sha256 = "0ks5mm9hda5idivncyfpiz4lrd8fv0dpmsl711788k7f7ixdka3y";
+    sha256 = "1rvrqlqrrjsd06dczgj9cwjdkpkqil5zzlwh87h06ms6qzfx6nm3";
  };

  prePatch = ''
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -9667,8 +9667,11 @@ in

  aws-adfs = with python3Packages; toPythonApplication aws-adfs;

-  inherit (callPackages ../development/tools/electron { })
-    electron_4 electron_5 electron_6 electron_7 electron_8;
+  electron_6 = callPackage ../development/tools/electron/6.x.nix { };
+
+  electron_5 = callPackage ../development/tools/electron/5.x.nix { };
+
+  electron_4 = callPackage ../development/tools/electron { };

  electron_3 = callPackage ../development/tools/electron/3.x.nix { };
  electron = electron_4;