Merge master into staging-next

2019-10-16 11:15:36 +02:00 · 2019-10-16 11:15:36 +02:00 · 22bbaf09fe
commit 22bbaf09fe
parent b5697c6954 d2c13034fb
430 changed files with 6260 additions and 4754 deletions
--- a/doc/configuration.xml
+++ b/doc/configuration.xml
@ -45,7 +45,7 @@
  However, this does not allow unfree software for individual users. Their configurations are managed separately.
 </para>
 <para>
-  A user's of nixpkgs configuration is stored in a user-specific configuration file located at <filename>~/.config/nixpkgs/config.nix</filename>. For example:
+  A user's nixpkgs configuration is stored in a user-specific configuration file located at <filename>~/.config/nixpkgs/config.nix</filename>. For example:
 <programlisting>
 {
  allowUnfree = true;
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -850,9 +850,8 @@ Note: There is a boolean value `lib.inNixShell` set to `true` if nix-shell is in
 Packages inside nixpkgs are written by hand. However many tools exist in
 community to help save time. No tool is preferred at the moment.

- [python2nix](https://github.com/proger/python2nix) by Vladimir Kirillov
- [pypi2nix](https://github.com/garbas/pypi2nix) by Rok Garbas
- [pypi2nix](https://github.com/offlinehacker/pypi2nix) by Jaka Hudoklin
+- [pypi2nix](https://github.com/nix-community/pypi2nix): Generate Nix expressions for your Python project. Note that [sharing derivations from pypi2nix with nixpkgs is possible but not encouraged](https://github.com/nix-community/pypi2nix/issues/222#issuecomment-443497376).
+- [python2nix](https://github.com/proger/python2nix) by Vladimir Kirillov.

 ### Deterministic builds

--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@ -1692,7 +1692,7 @@ someVar=$(stripHash $name)
    </term>
    <listitem>
     <para>
-      Convenience function for <literal>makeWrapper</literal> that automatically creates a sane wrapper file It takes all the same arguments as <literal>makeWrapper</literal>, except for <literal>--argv0</literal>.
+      Convenience function for <literal>makeWrapper</literal> that automatically creates a sane wrapper file. It takes all the same arguments as <literal>makeWrapper</literal>, except for <literal>--argv0</literal>.
     </para>
     <para>
      It cannot be applied multiple times, since it will overwrite the wrapper file.
@ -1869,7 +1869,7 @@ addEnvHooks "$hostOffset" myBashFunction
  </para>

  <para>
-   Here are some more packages that provide a setup hook. Since the list of hooks is extensible, this is not an exhaustive list the mechanism is only to be used as a last resort, it might cover most uses.
+   Here are some more packages that provide a setup hook. Since the list of hooks is extensible, this is not an exhaustive list. The mechanism is only to be used as a last resort, so it might cover most uses.
   <variablelist>
    <varlistentry>
     <term>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -137,6 +137,11 @@
    githubId = 2321000;
    name = "Ruslan Babayev";
  };
+  acairncross = {
+    email = "acairncross@gmail.com";
+    github = "acairncross";
+    name = "Aiken Cairncross";
+  };
  acowley = {
    email = "acowley@gmail.com";
    github = "acowley";
@ -546,6 +551,12 @@
    githubId = 56009;
    name = "Arcadio Rubio García";
  };
+  arcnmx = {
+    email = "arcnmx@users.noreply.github.com";
+    github = "arcnmx";
+    githubId = 13426784;
+    name = "arcnmx";
+  };
  ardumont = {
    email = "eniotna.t@gmail.com";
    github = "ardumont";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -37,6 +37,7 @@ lua-zlib,,,,,koral
 lua_cliargs,,,,,
 luabitop,,,,,
 luacheck,,,,,
+luacov,,,,,
 luadbi,,,,,
 luadbi-mysql,,,,,
 luadbi-postgresql,,,,,
--- a/maintainers/scripts/update-discord
+++ b/maintainers/scripts/update-discord
@ -6,7 +6,7 @@ exec >${1:?usage: $0 <output-file>}

 cat <<EOF
 { branch ? "stable", pkgs }:
-
+# Generated by /maintainers/scripts/update-discord
 let
  inherit (pkgs) callPackage fetchurl;
 in {
@ -16,7 +16,7 @@ for branch in "" ptb canary; do
    url=$(curl -sI "https://discordapp.com/api/download${branch:+/}${branch}?platform=linux&format=tar.gz" | grep -oP 'location: \K\S+')
    version=${url##https://dl*.discordapp.net/apps/linux/}
    version=${version%%/*.tar.gz}
-    echo "  ${branch:-stable} = callPackage ./base.nix {"
+    echo "  ${branch:-stable} = callPackage ./base.nix rec {"
    echo "    pname = \"discord${branch:+-}${branch}\";"
    case $branch in
        "") suffix="" ;;
@ -27,7 +27,7 @@ for branch in "" ptb canary; do
    echo "    desktopName = \"Discord${suffix:+ }${suffix}\";"
    echo "    version = \"${version}\";"
    echo "    src = fetchurl {"
-    echo "      url = \"${url}\";"
+    echo "      url = \"${url//${version}/\$\{version\}}\";"
    echo "      sha256 = \"$(nix-prefetch-url "$url")\";"
    echo "    };"
    echo "  };"
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@ -532,6 +532,8 @@
       is set to <literal>/var/lib/gitlab/state</literal>, <literal>gitlab</literal> and all parent directories
       must be owned by either <literal>root</literal> or the user specified in <option>services.gitlab.user</option>.
     </para>
+   </listitem>
+   <listitem>
     <para>
      The <option>networking.useDHCP</option> option is unsupported in combination with
      <option>networking.useNetworkd</option> in anticipation of defaulting to it by default.
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -36,6 +36,19 @@
     quirk in the boot menu.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       By default zfs pools will now be trimmed on a weekly basis.
+       Trimming is only done on supported devices (i.e. NVME or SSDs)
+       and should improve throughput and lifetime of these devices.
+       It is controlled by the <varname>services.zfs.trim.enable</varname> varname.
+       The zfs scrub service (<varname>services.zfs.autoScrub.enable</varname>)
+       and the zfs autosnapshot service (<varname>services.zfs.autoSnapshot.enable</varname>)
+       are now only enabled if zfs is set in <varname>config.boot.initrd.supportedFilesystems</varname> or
+       <varname>config.boot.supportedFilesystems</varname>. These lists will automatically contain
+       zfs as soon as any zfs mountpoint is configured in <varname>fileSystems</varname>.
+     </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/config/system-environment.nix
+++ b/nixos/modules/config/system-environment.nix
@ -88,6 +88,13 @@ in
          (mapAttrsToList pamVariable
          (zipAttrsWith (n: concatLists)
            [
+              # Make sure security wrappers are prioritized without polluting
+              # shell environments with an extra entry. Sessions which depend on
+              # pam for its environment will otherwise have eg. broken sudo. In
+              # particular Gnome Shell sometimes fails to source a proper
+              # environment from a shell.
+              { PATH = [ config.security.wrapperDir ]; }
+
              (mapAttrs (n: toList) cfg.sessionVariables)
              suffixedVariables
            ]));
--- a/nixos/modules/programs/environment.nix
+++ b/nixos/modules/programs/environment.nix
@ -21,8 +21,6 @@ in
        PAGER = mkDefault "less -R";
        EDITOR = mkDefault "nano";
        XDG_CONFIG_DIRS = [ "/etc/xdg" ]; # needs to be before profile-relative paths to allow changes through environment.etc
-        GTK_DATA_PREFIX = "${config.system.path}"; # needed for gtk2 apps to find themes
-        GTK_EXE_PREFIX = "${config.system.path}";
      };

    environment.profiles = mkAfter
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@ -8,7 +8,7 @@ let
    builtins.substring 0 1 x == "/"      # absolute path
    || builtins.substring 0 1 x == "."   # relative path
    || builtins.match "[.*:.*]" == null; # not machine:path
- 
+
  mkExcludeFile = cfg:
    # Write each exclude pattern to a new line
    pkgs.writeText "excludefile" (concatStringsSep "\n" cfg.exclude);
@ -104,12 +104,12 @@ let
      install = "install -o ${cfg.user} -g ${cfg.group}";
    in
      nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''
-        # Eensure that the home directory already exists
+        # Ensure that the home directory already exists
        # We can't assert createHome == true because that's not the case for root
-        cd "${config.users.users.${cfg.user}.home}"                                                                                                         
+        cd "${config.users.users.${cfg.user}.home}"
        ${install} -d .config/borg
        ${install} -d .cache/borg
-      '' + optionalString (isLocalPath cfg.repo) ''
+      '' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''
        ${install} -d ${escapeShellArg cfg.repo}
      ''));

@ -163,6 +163,13 @@ let
      + " without at least one public key";
  };

+  mkRemovableDeviceAssertions = name: cfg: {
+    assertion = !(isLocalPath cfg.repo) -> !cfg.removableDevice;
+    message = ''
+      borgbackup.repos.${name}: repo isn't a local path, thus it can't be a removable device!
+    '';
+  };
+
 in {
  meta.maintainers = with maintainers; [ dotlambda ];

@ -202,6 +209,12 @@ in {
            example = "user@machine:/path/to/repo";
          };

+          removableDevice = mkOption {
+            type = types.bool;
+            default = false;
+            description = "Whether the repo (which must be local) is a removable device.";
+          };
+
          archiveBaseName = mkOption {
            type = types.strMatching "[^/{}]+";
            default = "${globalConfig.networking.hostName}-${name}";
@ -511,7 +524,6 @@ in {
    type = types.attrsOf (types.submodule (
      { ... }: {
        options = {
-          
          path = mkOption {
            type = types.path;
            description = ''
@ -598,7 +610,8 @@ in {
    (with config.services.borgbackup; {
      assertions =
        mapAttrsToList mkPassAssertion jobs
-        ++ mapAttrsToList mkKeysAssertion repos;
+        ++ mapAttrsToList mkKeysAssertion repos
+        ++ mapAttrsToList mkRemovableDeviceAssertions jobs;

      system.activationScripts = mapAttrs' mkActivationScript jobs;

--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@ -272,8 +272,13 @@ in
      port = ${toString cfg.port}
      datadir = ${cfg.dataDir}
      ${optionalString (cfg.bind != null) "bind-address = ${cfg.bind}" }
-      ${optionalString (cfg.replication.role == "master" || cfg.replication.role == "slave") "log-bin=mysql-bin"}
-      ${optionalString (cfg.replication.role == "master" || cfg.replication.role == "slave") "server-id = ${toString cfg.replication.serverId}"}
+      ${optionalString (cfg.replication.role == "master" || cfg.replication.role == "slave")
+      ''
+        log-bin=mysql-bin-${toString cfg.replication.serverId}
+        log-bin-index=mysql-bin-${toString cfg.replication.serverId}.index
+        relay-log=mysql-relay-bin
+        server-id = ${toString cfg.replication.serverId}
+      ''}
      ${optionalString (cfg.ensureUsers != [])
      ''
        plugin-load-add = auth_socket.so
@ -381,6 +386,7 @@ in

                        ( echo "stop slave;"
                          echo "change master to master_host='${cfg.replication.masterHost}', master_user='${cfg.replication.masterUser}', master_password='${cfg.replication.masterPassword}';"
+                          echo "set global slave_exec_mode='IDEMPOTENT';"
                          echo "start slave;"
                        ) | ${mysql}/bin/mysql -u root -N
                      ''}
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -79,7 +79,11 @@ turn_user_lifetime: "${cfg.turn_user_lifetime}"
 user_creation_max_duration: ${cfg.user_creation_max_duration}
 bcrypt_rounds: ${cfg.bcrypt_rounds}
 allow_guest_access: ${boolToString cfg.allow_guest_access}
-trusted_third_party_id_servers: ${builtins.toJSON cfg.trusted_third_party_id_servers}
+
+account_threepid_delegates:
+  ${optionalString (cfg.account_threepid_delegates.email != null) "email: ${cfg.account_threepid_delegates.email}"}
+  ${optionalString (cfg.account_threepid_delegates.msisdn != null) "msisdn: ${cfg.account_threepid_delegates.msisdn}"}
+
 room_invite_state_types: ${builtins.toJSON cfg.room_invite_state_types}
 ${optionalString (cfg.macaroon_secret_key != null) ''
  macaroon_secret_key: "${cfg.macaroon_secret_key}"
@ -102,6 +106,7 @@ perspectives:
    '') cfg.servers)}
    }
  }
+redaction_retention_period: ${toString cfg.redaction_retention_period}
 app_service_config_files: ${builtins.toJSON cfg.app_service_config_files}

 ${cfg.extraConfig}
@ -552,14 +557,18 @@ in {
          accessible to anonymous users.
        '';
      };
-      trusted_third_party_id_servers = mkOption {
-        type = types.listOf types.str;
-        default = [
-          "matrix.org"
-          "vector.im"
-        ];
+      account_threepid_delegates.email = mkOption {
+        type = types.nullOr types.str;
+        default = null;
        description = ''
-          The list of identity servers trusted to verify third party identifiers by this server.
+          Delegate email sending to https://example.org
+        '';
+      };
+      account_threepid_delegates.msisdn = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Delegate SMS sending to this local process (https://localhost:8090)
        '';
      };
      room_invite_state_types = mkOption {
@ -600,6 +609,13 @@ in {
          A list of application service config file to use
        '';
      };
+      redaction_retention_period = mkOption {
+        type = types.int;
+        default = 7;
+        description = ''
+          How long to keep redacted events in unredacted form in the database.
+        '';
+      };
      extraConfig = mkOption {
        type = types.lines;
        default = "";
@ -699,4 +715,12 @@ in {
      };
    };
  };
+
+  imports = [
+    (mkRemovedOptionModule [ "services" "matrix-synapse" "trusted_third_party_id_servers" ] ''
+      The `trusted_third_party_id_servers` option as been removed in `matrix-synapse` v1.4.0
+      as the behavior is now obsolete.
+    '')
+  ];
+
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -30,6 +30,7 @@ let
    "json"
    "mail"
    "minio"
+    "nextcloud"
    "nginx"
    "node"
    "postfix"
--- a/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
@ -0,0 +1,58 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.nextcloud;
+in
+{
+  port = 9205;
+  extraOpts = {
+    url = mkOption {
+      type = types.str;
+      example = "https://domain.tld";
+      description = ''
+        URL to the Nextcloud serverinfo page.
+        Adding the path to the serverinfo API is optional, it defaults
+        to <literal>/ocs/v2.php/apps/serverinfo/api/v1/info</literal>.
+      '';
+    };
+    username = mkOption {
+      type = types.str;
+      default = "nextcloud-exporter";
+      description = ''
+        Username for connecting to Nextcloud.
+        Note that this account needs to have admin privileges in Nextcloud.
+      '';
+    };
+    passwordFile = mkOption {
+      type = types.path;
+      example = "/path/to/password-file";
+      description = ''
+        File containing the password for connecting to Nextcloud.
+        Make sure that this file is readable by the exporter user.
+      '';
+    };
+    timeout = mkOption {
+      type = types.str;
+      default = "5s";
+      description = ''
+        Timeout for getting server info document.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      DynamicUser = false;
+      ExecStart = ''
+        ${pkgs.prometheus-nextcloud-exporter}/bin/nextcloud-exporter \
+          -a ${cfg.listenAddress}:${toString cfg.port} \
+          -u ${cfg.username} \
+          -t ${cfg.timeout} \
+          -l ${cfg.url} \
+          -p @${cfg.passwordFile} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
@ -6,6 +6,10 @@ let
  cfg = config.services.prometheus.exporters.wireguard;
 in {
  port = 9586;
+  imports = [
+    (mkRenamedOptionModule [ "addr" ] [ "listenAddress" ])
+    ({ options.warnings = options.warnings; options.assertions = options.assertions; })
+  ];
  extraOpts = {
    verbose = mkEnableOption "Verbose logging mode for prometheus-wireguard-exporter";

@ -42,14 +46,6 @@ in {
        Whether or not the remote IP of a WireGuard peer should be exposed via prometheus.
      '';
    };
-
-    addr = mkOption {
-      type = types.str;
-      default = "0.0.0.0";
-      description = ''
-        IP address of the exporter.
-      '';
-    };
  };
  serviceOpts = {
    path = [ pkgs.wireguard-tools ];
@ -59,7 +55,7 @@ in {
      ExecStart = ''
        ${pkgs.prometheus-wireguard-exporter}/bin/prometheus_wireguard_exporter \
          -p ${toString cfg.port} \
-          -l ${cfg.addr} \
+          -l ${cfg.listenAddress} \
          ${optionalString cfg.verbose "-v"} \
          ${optionalString cfg.singleSubnetPerField "-s"} \
          ${optionalString cfg.withRemoteIp "-r"} \
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -170,8 +170,9 @@ in
      "plymouth-start.service"
    ];
    systemd.services.display-manager.conflicts = [
-      "getty@tty${gdm.initialVT}.service"
-      "plymouth-quit.service"
+       "getty@tty${gdm.initialVT}.service"
+       # TODO: Add "plymouth-quit.service" so GDM can control when plymouth quits.
+       # Currently this breaks switching configurations while using plymouth.
    ];
    systemd.services.display-manager.onFailure = [
      "plymouth-quit.service"
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -16,9 +16,7 @@ let
  inInitrd = any (fs: fs == "zfs") config.boot.initrd.supportedFilesystems;
  inSystem = any (fs: fs == "zfs") config.boot.supportedFilesystems;

-  enableAutoSnapshots = cfgSnapshots.enable;
-  enableAutoScrub = cfgScrub.enable;
-  enableZfs = inInitrd || inSystem || enableAutoSnapshots || enableAutoScrub;
+  enableZfs = inInitrd || inSystem;

  kernel = config.boot.kernelPackages;

@ -392,10 +390,11 @@ in
      };

      environment.etc."zfs/zed.d".source = "${packages.zfsUser}/etc/zfs/zed.d/";
+      environment.etc."zfs/zpool.d".source = "${packages.zfsUser}/etc/zfs/zpool.d/";

      system.fsPackages = [ packages.zfsUser ]; # XXX: needed? zfs doesn't have (need) a fsck
      environment.systemPackages = [ packages.zfsUser ]
-        ++ optional enableAutoSnapshots autosnapPkg; # so the user can run the command to see flags
+        ++ optional cfgSnapshots.enable autosnapPkg; # so the user can run the command to see flags

      services.udev.packages = [ packages.zfsUser ]; # to hook zvol naming, etc.
      systemd.packages = [ packages.zfsUser ];
@ -487,7 +486,7 @@ in
      systemd.targets.zfs.wantedBy = [ "multi-user.target" ];
    })

-    (mkIf enableAutoSnapshots {
+    (mkIf (enableZfs && cfgSnapshots.enable) {
      systemd.services = let
                           descr = name: if name == "frequent" then "15 mins"
                                    else if name == "hourly" then "hour"
@ -525,7 +524,7 @@ in
                            }) snapshotNames);
    })

-    (mkIf enableAutoScrub {
+    (mkIf (enableZfs && cfgScrub.enable) {
      systemd.services.zfs-scrub = {
        description = "ZFS pools scrubbing";
        after = [ "zfs-import.target" ];
@ -552,15 +551,13 @@ in
      };
    })

-    (mkIf cfgTrim.enable {
+    (mkIf (enableZfs && cfgTrim.enable) {
      systemd.services.zpool-trim = {
        description = "ZFS pools trim";
        after = [ "zfs-import.target" ];
        path = [ packages.zfsUser ];
        startAt = cfgTrim.interval;
-        script = ''
-          zpool list -H -o name | xargs -n1 zpool trim
-        '';
+        serviceConfig.ExecStart = "${pkgs.runtimeShell} -c 'zpool list -H -o name | xargs --no-run-if-empty -n1 zpool trim'";
      };
    })
  ];
--- a/nixos/tests/gnome3-xorg.nix
+++ b/nixos/tests/gnome3-xorg.nix
@ -29,7 +29,7 @@ import ./make-test.nix ({ pkgs, ...} : {
      $machine->waitForUnit("default.target","alice");

      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");

      $machine->succeed("su - alice -c 'DISPLAY=:0.0 gnome-terminal &'");
      $machine->succeed("xauth merge ~alice/.Xauthority");
--- a/nixos/tests/gnome3.nix
+++ b/nixos/tests/gnome3.nix
@ -44,7 +44,7 @@ import ./make-test.nix ({ pkgs, ...} : {
      $machine->waitForUnit("default.target","alice");

      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");

      # Wait for the wayland server
      $machine->waitForFile("/run/user/1000/wayland-0");
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@ -48,12 +48,12 @@ import ./make-test.nix ({ pkgs, latestKernel ? false, ... }:
      # Check whether systemd gives and removes device ownership as
      # needed.
      subtest "device permissions", sub {
-          $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+          $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
          $machine->sendKeys("alt-f1");
          $machine->waitUntilSucceeds("[ \$(fgconsole) = 1 ]");
-          $machine->fail("getfacl /dev/snd/timer | grep -q alice");
+          $machine->fail("getfacl -p /dev/snd/timer | grep -q alice");
          $machine->succeed("chvt 2");
-          $machine->waitUntilSucceeds("getfacl /dev/snd/timer | grep -q alice");
+          $machine->waitUntilSucceeds("getfacl -p /dev/snd/timer | grep -q alice");
      };

      # Log out.
--- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix
+++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix
@ -36,49 +36,16 @@ in {
      };

      services.redis = {
-        unixSocket = "/var/run/redis/redis.sock";
        enable = true;
-        extraConfig = ''
-          unixsocketperm 770
-        '';
-      };
-
-      systemd.services.redis = {
-        preStart = ''
-          mkdir -p /var/run/redis
-          chown ${config.services.redis.user}:${config.services.nginx.group} /var/run/redis
-        '';
-        serviceConfig.PermissionsStartOnly = true;
      };

      systemd.services.nextcloud-setup= {
        requires = ["postgresql.service"];
        after = [
          "postgresql.service"
-          "chown-redis-socket.service"
        ];
      };

-      # At the time of writing, redis creates its socket with the "nobody"
-      # group.  I figure this is slightly less bad than making the socket world
-      # readable.
-      systemd.services.chown-redis-socket = {
-        enable = true;
-        script = ''
-          until ${pkgs.redis}/bin/redis-cli ping; do
-            echo "waiting for redis..."
-            sleep 1
-          done
-          chown ${config.services.redis.user}:${config.services.nginx.group} /var/run/redis/redis.sock
-        '';
-        after = [ "redis.service" ];
-        requires = [ "redis.service" ];
-        wantedBy = [ "redis.service" ];
-        serviceConfig = {
-          Type = "oneshot";
-        };
-      };
-
      services.postgresql = {
        enable = true;
        ensureDatabases = [ "nextcloud" ];
@ -94,8 +61,8 @@ in {
  testScript = let
    configureRedis = pkgs.writeScript "configure-redis" ''
      #!${pkgs.stdenv.shell}
-      nextcloud-occ config:system:set redis 'host' --value '/var/run/redis/redis.sock' --type string
-      nextcloud-occ config:system:set redis 'port' --value 0 --type integer
+      nextcloud-occ config:system:set redis 'host' --value 'localhost' --type string
+      nextcloud-occ config:system:set redis 'port' --value 6379 --type integer
      nextcloud-occ config:system:set memcache.local --value '\OC\Memcache\Redis' --type string
      nextcloud-occ config:system:set memcache.locking --value '\OC\Memcache\Redis' --type string
    '';
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@ -42,7 +42,7 @@ import ./make-test.nix ({ pkgs, ...} :
    $machine->waitForWindow(qr/plank/);

    # Check that logging in has given the user ownership of devices.
-    $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+    $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");

    # Open elementary terminal
    $machine->execute("su - alice -c 'DISPLAY=:0.0 io.elementary.terminal &'");
--- a/nixos/tests/plasma5.nix
+++ b/nixos/tests/plasma5.nix
@ -48,7 +48,7 @@ import ./make-test.nix ({ pkgs, ...} :
    $machine->waitForWindow("^Desktop ");

    # Check that logging in has given the user ownership of devices.
-    $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+    $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");

    $machine->execute("su - alice -c 'DISPLAY=:0.0 dolphin &'");
    $machine->waitForWindow(" Dolphin");
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -229,6 +229,40 @@ let
      '';
    };

+    nextcloud = {
+      exporterConfig = {
+        enable = true;
+        passwordFile = "/var/nextcloud-pwfile";
+        url = "http://localhost/negative-space.xml";
+      };
+      metricProvider = {
+        systemd.services.nc-pwfile = let
+          passfile = (pkgs.writeText "pwfile" "snakeoilpw");
+        in {
+          requiredBy = [ "prometheus-nextcloud-exporter.service" ];
+          before = [ "prometheus-nextcloud-exporter.service" ];
+          serviceConfig.ExecStart = ''
+            ${pkgs.coreutils}/bin/install -o nextcloud-exporter -m 0400 ${passfile} /var/nextcloud-pwfile
+          '';
+        };
+        services.nginx = {
+          enable = true;
+          virtualHosts."localhost" = {
+            basicAuth.nextcloud-exporter = "snakeoilpw";
+            locations."/" = {
+              root = "${pkgs.prometheus-nextcloud-exporter.src}/serverinfo/testdata";
+            };
+          };
+        };
+      };
+      exporterTest = ''
+        waitForUnit("nginx.service")
+        waitForUnit("prometheus-nextcloud-exporter.service")
+        waitForOpenPort(9205)
+        succeed("curl -sSf http://localhost:9205/metrics | grep -q 'nextcloud_up 1'")
+      '';
+    };
+
    nginx = {
      exporterConfig = {
        enable = true;
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@ -32,7 +32,7 @@ import ./make-test.nix ({ pkgs, ...} : {
      $machine->sleep(10);

      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");

      $machine->succeed("su - alice -c 'DISPLAY=:0.0 xfce4-terminal &'");
      $machine->waitForWindow(qr/Terminal/);
--- a/nixos/tests/xfce4-14.nix
+++ b/nixos/tests/xfce4-14.nix
@ -14,7 +14,7 @@ import ./make-test.nix ({ pkgs, ...} : {
      services.xserver.desktopManager.xfce4-14.enable = true;

      hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
-  
+
      virtualisation.memorySize = 1024;
    };

@ -27,7 +27,7 @@ import ./make-test.nix ({ pkgs, ...} : {
      $machine->sleep(10);

      # Check that logging in has given the user ownership of devices.
-      $machine->succeed("getfacl /dev/snd/timer | grep -q alice");
+      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");

      $machine->succeed("su - alice -c 'DISPLAY=:0.0 xfce4-terminal &'");
      $machine->waitForWindow(qr/Terminal/);
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "drumkv1";
-  version = "0.9.9";
+  version = "0.9.10";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/${pname}-${version}.tar.gz";
-    sha256 = "02sa29fdjgwcf7izly685gxvga3bxyyqvskvfiisgm2xg3h9r983";
+    sha256 = "0h08r6vq23dlnag67fcfcpx83wampx4fag82v4bgkqg2sdh64p3n";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
--- a/pkgs/applications/audio/mopidy/iris.nix
+++ b/pkgs/applications/audio/mopidy/iris.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  pname = "Mopidy-Iris";
-  version = "3.40.0";
+  version = "3.41.1";

  src = pythonPackages.fetchPypi {
    inherit pname version;
-    sha256 = "1cn68zmyvig114dsw7vhx761v9c1za3wnbq4y2z0f0cbl958n49v";
+    sha256 = "1bdcxsvb756rchyp9cj1y5x1w0w6p2hp7grgar5c4cyh3kshc2kj";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "5.981";
+  version = "5.983";

  src = fetchurl {
    url = "https://www.reaper.fm/files/${stdenv.lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_x86_64.tar.xz";
-    sha256 = "0v4347i0pgzlinas4431dfbv1h9fk6vihvahh73valxvhydyxr8q";
+    sha256 = "16xw3gsxgjfdxd1ldm8zxd48qh6lgxacnj9yjryy0brhw51dw1q4";
  };

  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
--- a/pkgs/applications/audio/setbfree/default.nix
+++ b/pkgs/applications/audio/setbfree/default.nix
@ -1,17 +1,17 @@
-{ stdenv, fetchurl, alsaLib, freetype, ftgl, libjack2, libX11, lv2
+{ stdenv, fetchzip, alsaLib, freetype, ftgl, libjack2, libX11, lv2
 , libGLU_combined, pkgconfig, ttf_bitstream_vera
 }:

 stdenv.mkDerivation  rec {
  pname = "setbfree";
-  version = "0.8.8";
+  version = "0.8.9";

-  src = fetchurl {
+  src = fetchzip {
    url = "https://github.com/pantherb/setBfree/archive/v${version}.tar.gz";
-    sha256 = "1ldxwds99azingkjh246kz7x3j7307jhr0fls5rjjbcfchpg7v99";
+    sha256 = "097bby2da47zlkaqy2jl8j6q0h5pxaq67lz473ygadqs5ic3nhc1";
  };

-  patchPhase = ''
+  postPatch = ''
    sed 's#/usr/local#$(out)#g' -i common.mak
    sed 's#/usr/share/fonts/truetype/ttf-bitstream-vera#${ttf_bitstream_vera}/share/fonts/truetype#g' \
      -i b_synth/Makefile
@ -25,9 +25,9 @@ stdenv.mkDerivation  rec {

  meta = with stdenv.lib; {
    description = "A DSP tonewheel organ emulator";
-    homepage = http://setbfree.org;
+    homepage = "http://setbfree.org";
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" "i686-linux" ]; # fails on ARM and Darwin
    maintainers = [ maintainers.goibhniu ];
  };
 }
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@ -6,11 +6,11 @@ assert stdenv ? glibc;

 stdenv.mkDerivation  rec {
  pname = "yoshimi";
-  version = "1.5.11.3";
+  version = "1.6.0.1";

  src = fetchurl {
    url = "mirror://sourceforge/yoshimi/${pname}-${version}.tar.bz2";
-    sha256 = "00w0ll94dpss9f1rnaxjmw6mgjx5q2dz8w4mc3wyrk4s4gbd7154";
+    sha256 = "140f2k4akj39pny8c7i794q125415gyvmy4rday0il5ncp3glik4";
  };

  buildInputs = [
--- a/pkgs/applications/blockchains/jormungandr/default.nix
+++ b/pkgs/applications/blockchains/jormungandr/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jormungandr";
-  version = "0.5.6";
+  version = "0.6.1";

  src = fetchgit {
    url = "https://github.com/input-output-hk/${pname}";
-    rev = "v${version}+lock";
-    sha256 = "0l6rxr1xjp5hfkf0qfx8qsa1slxn0ly28akci1rwgdhlzjn43zqr";
+    rev = "v${version}";
+    sha256 = "1w0xcx1h09wv25qdyybamxxl8sqd2npja12n3vpvz0sgv88c3mix";
    fetchSubmodules = true;
  };

-  cargoSha256 = "0590gsghr25bzfmxfyrpg58a0l77y88jwnrkgjxf06x3d66kkn3l";
+  cargoSha256 = "0pflam5am760z4pz3j1ga4arsixmay2487sgpqrhrkiaws4nxy57";

  nativeBuildInputs = [ pkgconfig protobuf ];
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
--- a/pkgs/applications/display-managers/lightdm/default.nix
+++ b/pkgs/applications/display-managers/lightdm/default.nix
@ -1,8 +1,32 @@
-{ stdenv, fetchFromGitHub, pam, pkgconfig, autoconf, automake, libtool, libxcb
-, glib, libXdmcp, itstool, intltool, libxklavier, libgcrypt, audit, busybox
-, polkit, accountsservice, gtk-doc, gnome3, gobject-introspection, vala, fetchpatch
-, withQt4 ? false, qt4
-, withQt5 ? false, qtbase
+{ stdenv
+, fetchFromGitHub
+, substituteAll
+, plymouth
+, pam
+, pkgconfig
+, autoconf
+, automake
+, libtool
+, libxcb
+, glib
+, libXdmcp
+, itstool
+, intltool
+, libxklavier
+, libgcrypt
+, audit
+, busybox
+, polkit
+, accountsservice
+, gtk-doc
+, gnome3
+, gobject-introspection
+, vala
+, fetchpatch
+, withQt4 ? false
+, qt4
+, withQt5 ? false
+, qtbase
 }:

 with stdenv.lib;
@ -53,11 +77,20 @@ stdenv.mkDerivation rec {
      url = "https://src.fedoraproject.org/rpms/lightdm/raw/4cf0d2bed8d1c68970b0322ccd5dbbbb7a0b12bc/f/lightdm-1.25.1-disable_dmrc.patch";
      sha256 = "06f7iabagrsiws2l75sx2jyljknr9js7ydn151p3qfi104d1541n";
    })
+
    # Don't use etc/dbus-1/system.d
    (fetchpatch {
      url = "https://github.com/canonical/lightdm/commit/a99376f5f51aa147aaf81287d7ce70db76022c47.patch";
      sha256 = "1zyx1qqajrmqcf9hbsapd39gmdanswd9l78rq7q6rdy4692il3yn";
    })
+
+    # Hardcode plymouth to fix transitions.
+    # For some reason it can't find `plymouth`
+    # even when it's in PATH in environment.systemPackages.
+    (substituteAll {
+      src = ./fix-paths.patch;
+      plymouth = "${plymouth}/bin/plymouth";
+    })
  ];

  preConfigure = "NOCONFIGURE=1 ./autogen.sh";
@ -83,6 +116,10 @@ stdenv.mkDerivation rec {
      --replace /bin/rm ${busybox}/bin/rm
  '';

+  postInstall = ''
+    rm -rf $out/etc/apparmor.d $out/etc/init $out/etc/pam.d
+  '';
+
  meta = {
    homepage = https://github.com/CanonicalLtd/lightdm;
    description = "A cross-desktop display manager";
--- a/pkgs/applications/display-managers/lightdm/fix-paths.patch
+++ b/pkgs/applications/display-managers/lightdm/fix-paths.patch
@ -0,0 +1,13 @@
+diff --git a/src/plymouth.c b/src/plymouth.c
+index d1ed91f4..318f9409 100644
+--- a/src/plymouth.c
+++ b/src/plymouth.c
+@@ -24,7 +24,7 @@ static gboolean has_active_vt = FALSE;
+ static gboolean
+ plymouth_run_command (const gchar *command, gint *exit_status)
+ {
+-    g_autofree gchar *command_line = g_strdup_printf ("plymouth %s", command);
+    g_autofree gchar *command_line = g_strdup_printf ("@plymouth@ %s", command);
+     g_autoptr(GError) error = NULL;
+     gboolean result = g_spawn_command_line_sync (command_line, NULL, NULL, exit_status, &error);
+ 
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -13,8 +13,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "6.9.9-34";
-    sha256 = "0sqrgyfi7i7x1akna95c1qhk9sxxswzm3pkssfi4w6v7bn24g25g";
+    version = "6.9.10-68";
+    sha256 = "0ldkw6j4x0k7l6ykgpx9hz9cs7dmlapz2lv3lbrgz2nn9znqswxk";
    patches = [];
  }
    # Freeze version on mingw so we don't need to port the patch too often.
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@ -10,11 +10,11 @@

 mkDerivation rec {
  pname = "krita";
-  version = "4.2.6";
+  version = "4.2.7.1";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0qdaw8xx3h91v8iw6nw2h276ka8hflaq4r4qwz5mqfd3h254jzym";
+    sha256 = "1sx4j4brk71bas3cpqzk4bd8bknyl3x4fdg5pv4r7pcfd3vpq2vy";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip makeWrapper ];
--- a/pkgs/applications/graphics/rapid-photo-downloader/default.nix
+++ b/pkgs/applications/graphics/rapid-photo-downloader/default.nix
@ -6,11 +6,11 @@

 mkDerivationWith python3Packages.buildPythonApplication rec {
  pname = "rapid-photo-downloader";
-  version = "0.9.16";
+  version = "0.9.17";

  src = fetchurl {
    url = "https://launchpad.net/rapid/pyqt/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "0ij3li17jcqjx79ldv6zg2ckn8m2l9n4xvvq2x79y4q8yx9fqg85";
+    sha256 = "10vqbi9rcg8r0jxpx2kn8xmahwgdcal28wpix2fg6nkp5rfwxnr6";
  };

  # Disable version check and fix install tests
--- a/pkgs/applications/graphics/viewnior/default.nix
+++ b/pkgs/applications/graphics/viewnior/default.nix
@ -18,10 +18,6 @@ stdenv.mkDerivation rec {
      shared-mime-info glib gdk-pixbuf perl
    ];

-  preFixup = ''
-    rm $out/share/icons/*/icon-theme.cache
-  '';
-
  meta = {
    description = "Fast and simple image viewer";
    longDescription =
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/applications/19.08.1/ )
+WGET_ARGS=( https://download.kde.org/stable/applications/19.08.2/ )
--- a/pkgs/applications/kde/spectacle.nix
+++ b/pkgs/applications/kde/spectacle.nix
@ -4,7 +4,7 @@
  ki18n, xcb-util-cursor,
  kconfig, kcoreaddons, kdbusaddons, kdeclarative, kio, kipi-plugins,
  knotifications, kscreen, kwidgetsaddons, kwindowsystem, kxmlgui, libkipi,
-  qtx11extras, knewstuff, qttools
+  qtx11extras, knewstuff, kwayland, qttools
 }:

 mkDerivation {
@ -14,7 +14,7 @@ mkDerivation {
  buildInputs = [
    kconfig kcoreaddons kdbusaddons kdeclarative ki18n kio knotifications
    kscreen kwidgetsaddons kwindowsystem kxmlgui libkipi qtx11extras xcb-util-cursor
-    knewstuff
+    knewstuff kwayland
  ];
  postPatch = ''
    substituteInPlace desktop/org.kde.spectacle.desktop \
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/almanah/default.nix
+++ b/pkgs/applications/misc/almanah/default.nix
@ -1,19 +1,59 @@
-{ stdenv, fetchurl, pkgconfig, intltool
-, libxml2, desktop-file-utils, wrapGAppsHook, evolution-data-server, gtkspell3, gpgme, libcryptui
-, glib, gtk3, gtksourceview3, sqlite, cairo, atk, gcr, gnome3 }:
+{ stdenv
+, fetchurl
+, atk
+, cairo
+, desktop-file-utils
+, evolution-data-server
+, gcr
+, gettext
+, glib
+, gnome3
+, gpgme
+, gtk3
+, gtksourceview3
+, gtkspell3
+, libcryptui
+, libxml2
+, meson
+, ninja
+, pkgconfig
+, sqlite
+, wrapGAppsHook
+}:

 stdenv.mkDerivation rec {
  pname = "almanah";
-  version = "0.11.1";
+  version = "0.12.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1g0fyykq8bs3x1xqc0l0bk9zazcrxja784m68myymv1zfqqnp9h0";
+    sha256 = "09rxx4s4c34d1axza6ayss33v78p44r9bpx058shllh1sf5avpcb";
  };

-  nativeBuildInputs = [ pkgconfig intltool libxml2 desktop-file-utils wrapGAppsHook ];
+  nativeBuildInputs = [
+    desktop-file-utils
+    gettext
+    libxml2
+    meson
+    ninja
+    pkgconfig
+    wrapGAppsHook
+  ];

-  buildInputs = [ glib gtk3 gtksourceview3 sqlite cairo atk gcr gtkspell3 evolution-data-server gnome3.evolution gpgme libcryptui ];
+  buildInputs = [
+    atk
+    cairo
+    evolution-data-server
+    gcr
+    glib
+    gnome3.evolution
+    gpgme
+    gtk3
+    gtksourceview3
+    gtkspell3
+    libcryptui
+    sqlite
+  ];

  passthru = {
    updateScript = gnome3.updateScript {
--- a/pkgs/applications/misc/cura/default.nix
+++ b/pkgs/applications/misc/cura/default.nix
@ -8,7 +8,7 @@ mkDerivation rec {
    owner = "Ultimaker";
    repo = "Cura";
    rev = version;
-    sha256 = "1qnai8vmgy5lx3lapw96j41i8mw9p6r99i3qzs709l9yzrix6l86";
+    sha256 = "1wf60qr0wqsci5skp55qr8h56s3x5s2icxbn58ia9s4a5hhvnsmf";
  };

  materials = fetchFromGitHub {
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  pname = "exercism";
-  version = "3.0.11";
+  version = "3.0.12";

  goPackagePath = "github.com/exercism/cli";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "exercism";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "1wg23bvibsk6j4iqwyw35wl9plfwdqxiql81zci7r1x4d5cp26av";
+    sha256 = "1xvxcl7j5izx5lgmjd97zd28lg2sydwgbgn2cnisz5r0d27pj3ra";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/misc/nnn/default.nix
+++ b/pkgs/applications/misc/nnn/default.nix
@ -4,13 +4,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "nnn";
-  version = "2.5";
+  version = "2.7";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0hvb0q6jg2nmvb40q43jj7v45afkjgcq6q9ldmmrh5558d0n65cw";
+    sha256 = "19kiikjblkq3bx2j6h3f2d467p2v582albqr7nbrm9c1yg4qx38z";
  };

  configFile = optionalString (conf!=null) (builtins.toFile "nnn.h" conf);
@ -23,9 +23,9 @@ stdenv.mkDerivation rec {

  # shell completions
  postInstall = ''
-    install -Dm555 scripts/auto-completion/bash/nnn-completion.bash $out/share/bash-completion/completions/nnn.bash
-    install -Dm555 scripts/auto-completion/zsh/_nnn -t $out/share/zsh/site-functions
-    install -Dm555 scripts/auto-completion/fish/nnn.fish -t $out/share/fish/vendor_completions.d
+    install -Dm555 misc/auto-completion/bash/nnn-completion.bash $out/share/bash-completion/completions/nnn.bash
+    install -Dm555 misc/auto-completion/zsh/_nnn -t $out/share/zsh/site-functions
+    install -Dm555 misc/auto-completion/fish/nnn.fish -t $out/share/fish/vendor_completions.d
  '';

  meta = {
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, cmake, pkgconfig
-, boost, curl, expat, glew, libpng, tbb, wxGTK30
+, boost, cereal, curl, eigen, expat, glew, libpng, tbb, wxGTK30
 , gtest, nlopt, xorg, makeDesktopItem
 }:
 let
@ -9,7 +9,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "prusa-slicer";
-  version = "2.0.0";
+  version = "2.1.0";

  enableParallelBuilding = true;

@ -19,11 +19,11 @@ stdenv.mkDerivation rec {
    pkgconfig
  ];

-  # We could add Eigen, but it doesn't currently compile with the version in
-  # nixpkgs.
  buildInputs = [
    boost
+    cereal
    curl
+    eigen
    expat
    glew
    libpng
@ -40,10 +40,15 @@ stdenv.mkDerivation rec {
  # We need to set the path via the NLOPT environment variable instead.
  NLOPT = nlopt;

+  # Disable compiler warnings that clutter the build log
+  # It seems to be a known issue for Eigen:
+  # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221
+  NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";
+
  prePatch = ''
    # In nix ioctls.h isn't available from the standard kernel-headers package
-    # on other distributions. As the copy in glibc seems to be identical to the
-    # one in the kernel, we use that one instead.
+    # like in other distributions. The copy in glibc seems to be identical to the
+    # one in the kernel though, so we use that one instead.
    sed -i 's|"/usr/include/asm-generic/ioctls.h"|<asm-generic/ioctls.h>|g' src/libslic3r/GCodeSender.cpp
  '' + lib.optionalString (lib.versionOlder "2.5" nloptVersion) ''
    # Since version 2.5.0 of nlopt we need to link to libnlopt, as libnlopt_cxx
@ -54,7 +59,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "PrusaSlicer";
-    sha256 = "135wn2sza2f2kvbja1haxil5kx1b74lc1i7dsa35i1y3phabykhz";
+    sha256 = "172nz01iiqfjzkpcbl78j6almq6av70l71jgrzrcdw6ham1wqnpr";
    rev = "version_${version}";
  };

--- a/pkgs/applications/misc/rescuetime/default.nix
+++ b/pkgs/applications/misc/rescuetime/default.nix
@ -1,21 +1,21 @@
-{ stdenv, lib, fetchurl, dpkg, patchelf, qt5, libXtst, libXext, libX11, makeWrapper, libXScrnSaver }:
+{ stdenv, lib, fetchurl, dpkg, patchelf, qt5, libXtst, libXext, libX11, mkDerivation, makeWrapper, libXScrnSaver }:

 let
  src =
    if stdenv.hostPlatform.system == "i686-linux" then fetchurl {
      name = "rescuetime-installer.deb";
      url = "https://www.rescuetime.com/installers/rescuetime_current_i386.deb";
-      sha256 = "03bky9vja7fijz45n44b6gawd6q8yd30nx6nya9lqdlxd1bkqmji";
+      sha256 = "0mw8dh9z7pqan0yrhycmv39h5c1sc4mbw5l02cfnn17cy75xdiay";
    } else fetchurl {
      name = "rescuetime-installer.deb";
      url = "https://www.rescuetime.com/installers/rescuetime_current_amd64.deb";
-      sha256 = "03bky9vja7fijz45n44b6gawd6q8yd30nx6nya9lqdlxd1bkqmji";
+      sha256 = "1a6pc8vi2ab721kzyhvg6bmw24dr85dgmx2m9j9vbf3jyr85fv10";
    };
-in stdenv.mkDerivation {
+in mkDerivation {
  # https://www.rescuetime.com/updates/linux_release_notes.html
-  name = "rescuetime-2.14.3.1";
+  name = "rescuetime-2.14.5.2";
  inherit src;
-  buildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ dpkg ];
  # avoid https://github.com/NixOS/patchelf/issues/99
  dontStrip = true;
  unpackPhase = ''
--- a/pkgs/applications/misc/tootle/default.nix
+++ b/pkgs/applications/misc/tootle/default.nix
@ -1,14 +1,25 @@
-{ stdenv, fetchFromGitHub
-, vala, meson, ninja, pkgconfig, python3, libgee, gsettings-desktop-schemas
-, gnome3, pantheon, gobject-introspection, wrapGAppsHook
-, gtk3, json-glib, glib, glib-networking
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, vala
+, meson
+, ninja
+, pkgconfig
+, python3
+, libgee
+, gsettings-desktop-schemas
+, gnome3
+, pantheon
+, wrapGAppsHook
+, gtk3
+, json-glib
+, glib
+, glib-networking
 }:

-let
+stdenv.mkDerivation rec {
  pname = "tootle";
  version = "0.2.0";
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";

  src = fetchFromGitHub {
    owner = "bleakgrey";
@ -18,7 +29,6 @@ in stdenv.mkDerivation {
  };

  nativeBuildInputs = [
-    gobject-introspection
    meson
    ninja
    pkgconfig
@ -26,20 +36,36 @@ in stdenv.mkDerivation {
    vala
    wrapGAppsHook
  ];
+
  buildInputs = [
-    gtk3 pantheon.granite json-glib glib glib-networking
-    libgee gnome3.libsoup gsettings-desktop-schemas
+    glib
+    glib-networking
+    gnome3.libsoup
+    gsettings-desktop-schemas
+    gtk3
+    json-glib
+    libgee
+    pantheon.granite
+  ];
+
+  patches = [
+    # Fix build with Vala 0.46
+    # https://github.com/bleakgrey/tootle/pull/164
+    (fetchpatch {
+      url = "https://github.com/worldofpeace/tootle/commit/0a88bdad6d969ead1e4058b1a19675c9d6857b16.patch";
+      sha256 = "0xyx00pgswnhxxbsxngsm6khvlbfcl6ic5wv5n64x7klk8rzh6cm";
+    })
  ];

  postPatch = ''
-    chmod +x ./meson/post_install.py
-    patchShebangs ./meson/post_install.py
+    chmod +x meson/post_install.py
+    patchShebangs meson/post_install.py
  '';

  meta = with stdenv.lib; {
    description = "Simple Mastodon client designed for elementary OS";
-    homepage    = https://github.com/bleakgrey/tootle;
-    license     = licenses.gpl3;
+    homepage = https://github.com/bleakgrey/tootle;
+    license = licenses.gpl3;
    maintainers = with maintainers; [ dtzWill ];
  };
 }
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@ -45,11 +45,11 @@ let

  flash = stdenv.mkDerivation rec {
    pname = "flashplayer-ppapi";
-    version = "32.0.0.255";
+    version = "32.0.0.270";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1rqb54kqxq66vvqk5yrr3rsy3wcj9r9wnkngk27c7jayzm6bwgvv";
+      sha256 = "1z8nfw7b3dsy79gb50bmmdjz66j5gx6m0hkw1abp35xdgh2sz2ak";
      stripRoot = false;
    };

@ -81,7 +81,11 @@ let

    dontStrip = true;

-    meta.platforms = platforms.x86_64;
+    meta = {
+      license = stdenv.lib.licenses.unfree;
+      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      platforms = platforms.x86_64;
+    };
  };

 in {
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "flashplayer";
-  version = "32.0.0.255";
+  version = "32.0.0.270";

  src = fetchurl {
    url =
@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
    sha256 =
      if debug then
        if arch == "x86_64" then
-          "1hd5z8qmki36k2wdwgg3v4sj32g8590r5563gdrjrk7bmrqfjnji"
+          "1c3dn4gkl40i5sjkvpbkn9fl82vjhy1v7dhrayk3ncfsxcyvbcm0"
        else
-          "0y13bxdgkxaqsyab09skiqj8dfjw76n2lr7p525ba8lbfbc8xj52"
+          "1g7i9mihn5g9i71xyf805k19yk41vsr85gzk87gm426m0hcgg89i"
      else
        if arch == "x86_64" then
-          "0qkslkaiw3c9xk1rjcl4x9d0fi6i91k7g01mf0gq28wgzcyz4cw7"
+          "16lxgkbr2hg49vhc7414zkh1kblhysf779854faay308ml3i5kdw"
        else
-          "0qblmaa3nq1g7825yhvz98pvd1591q3q7bsrhv5bbhdbmb9c1qd5";
+          "0jrdzm8pw7aq32w7m4rvkhj7mmqyddh5yxpj7q3d9hxrwshkikvj";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@ -50,7 +50,7 @@

 stdenv.mkDerivation {
  pname = "flashplayer-standalone";
-  version = "32.0.0.255";
+  version = "32.0.0.270";

  src = fetchurl {
    url =
@ -60,9 +60,9 @@ stdenv.mkDerivation {
        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
    sha256 =
      if debug then
-        "1igc23mljmw1bw6fwx3rwpz7kxiy8n5znkng20w3yin2zh8qw8sy"
+        "0k5azrl92hkbn7adjz7s2lv8h59n7gsjrcprqdc485i4f7sjmkwj"
      else
-        "0rfvgx1g0s8wswwpmfjx6p59yh1cxya3x3bczbissrq4rcb1v315";
+        "1la5s4wxchfpl8in576xj675yrg84pify22pwf063h0jg3rdgi68";
  };

  nativeBuildInputs = [ unzip ];
@ -97,7 +97,7 @@ stdenv.mkDerivation {
    description = "Adobe Flash Player standalone executable";
    homepage = https://www.adobe.com/support/flashplayer/debug_downloads.html;
    license = stdenv.lib.licenses.unfree;
-    maintainers = [];
+    maintainers = with stdenv.lib.maintainers; [ taku0 ];
    platforms = [ "x86_64-linux" ];
    # Application crashed with an unhandled SIGSEGV
    # Not on all systems, though. Video driver problem?
--- a/pkgs/applications/networking/browsers/next/default.nix
+++ b/pkgs/applications/networking/browsers/next/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
    pname = "next";
-    version = "1.3.1";
+    version = "1.3.4";

    src = fetchFromGitHub {
      owner = "atlas-engineer";
      repo = "next";
      rev = version;
-      sha256 = "01fn1f080ydk0wj1bwkyakqz93bdq9xb5x8qz820jpl9id17bqgj";
+      sha256 = "00iqv4xarabl98gdl1rzqkc5v0vfljx1nawsxqsx9x3a9mnxmgxi";
    };

    # Stripping destroys the generated SBCL image
@ -25,32 +25,38 @@ stdenv.mkDerivation rec {
        --replace "next-gtk-webkit" "${next-gtk-webkit}/bin/next-gtk-webkit"
    '';

-    nativeBuildInputs = [ sbcl makeWrapper ];
+    nativeBuildInputs =
+      [ sbcl makeWrapper ] ++ (with lispPackages;
+      [ prove-asdf trivial-features ]);
+
    buildInputs = with lispPackages; [
-      trivial-features
-      trivial-garbage
      alexandria
      bordeaux-threads
+      cl-annot
+      cl-ansi-text
+      cl-css
+      cl-hooks
      cl-json
      cl-markup
      cl-ppcre
      cl-ppcre-unicode
+      cl-prevalence
      closer-mop
+      dbus
      dexador
      ironclad
+      local-time
+      log4cl
      lparallel
+      mk-string-metrics
      parenscript
      quri
-      cl-css
-      log4cl
-      mk-string-metrics
      sqlite
      str
      swank
      trivia
      trivial-clipboard
      unix-opts
-      dbus
    ];
    propagatedBuildInputs = [ next-gtk-webkit ];

--- a/pkgs/applications/networking/browsers/surf/default.nix
+++ b/pkgs/applications/networking/browsers/surf/default.nix
@ -1,6 +1,7 @@
-{ stdenv, fetchurl
+{ lib, stdenv, fetchurl
 , pkgconfig, wrapGAppsHook
 , glib, glib-networking, gsettings-desktop-schemas, gtk, libsoup, webkitgtk
+, xorg, dmenu, findutils, gnused, coreutils
 , patches ? null
 }:

@ -20,6 +21,16 @@ stdenv.mkDerivation rec {

  installFlags = [ "PREFIX=$(out)" ];

+  # Add run-time dependencies to PATH. Append them to PATH so the user can
+  # override the dependencies with their own PATH.
+  preFixup = let
+    depsPath = lib.makeBinPath [ xorg.xprop dmenu findutils gnused coreutils ];
+  in ''
+    gappsWrapperArgs+=(
+      --suffix PATH : ${depsPath}
+    )
+  '';
+
  meta = with stdenv.lib; {
    description = "A simple web browser based on WebKit/GTK";
    longDescription = ''
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -17,11 +17,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "2.8.1664.40-1";
+  version = "2.8.1664.44-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "07v7p3r9yc566xkwhiazd80pj2d6rcvs3xnbnwjambi1rajbs5sx";
+    sha256 = "0z1d03zw0jhvi14n06qfdr1n63idq56ly7mgiv27s21zvdma887k";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/cluster/terraform-providers/data.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/data.nix
@ -714,4 +714,11 @@
      version = "0.2.0";
      sha256  = "0ic5b9djhnb1bs2bz3zdprgy3r55dng09xgc4d9l9fyp85g2amaz";
    };
+  wavefront =
+    {
+      owner   = "spaceapegames";
+      repo    = "terraform-provider-wavefront";
+      version = "2.1.0";
+      sha256  = "1ir2wkg5mfng7h5544kar1arkjb5ffjhki5qr25a5x0rpwlg99sx";
+    };
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.txt
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.txt
@ -20,3 +20,6 @@ tweag/terraform-provider-secret

 # include terraform-provider-segment
 ajbosco/terraform-provider-segment
+
+# include terraform-provider-wavefront
+spaceapegames/terraform-provider-wavefront
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@ -3,14 +3,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "newsboat";
-  version = "2.16.1";
+  version = "2.17.1";

  src = fetchurl {
    url = "https://newsboat.org/releases/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0lxdsfcwa4byhfnn0gv34w3rr531f4nfqgi8j4qqmh3gncbwh8s0";
+    sha256 = "15qr2y35yvl0hzsf34d863n8v042v78ks6ksh5p1awvi055x5sy1";
  };

-  cargoSha256 = "0ck2dgfk4fay4cjl66wqkbnq4rqrd717jl63l1mvqmvad9i19igm";
+  cargoSha256 = "0db4j6y43gacazrvcmq823fzl5pdfdlg8mkjpysrw6h9fxisq83f";

  postPatch = ''
    substituteInPlace Makefile --replace "|| true" ""
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@ -16,6 +16,7 @@
 , libpcap
 , libyaml
 , luajit
+, lz4
 , nspr
 , nss
 , pcre
@ -29,11 +30,11 @@
 in
 stdenv.mkDerivation rec {
  pname = "suricata";
-  version = "4.1.4";
+  version = "4.1.5";

  src = fetchurl {
    url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    sha256 = "02901wjf90171rhkymcgp0h48hkn3wv8iwrhz4d8ppraz68hv99d";
+    sha256 = "0jy738rs3ds1gbn8hv26ck23z9k6pjrjxdpavkyn7znpbi9zdrff";
  };

  nativeBuildInputs = [
@ -54,6 +55,7 @@ stdenv.mkDerivation rec {
    libpcap
    libyaml
    luajit
+    lz4
    nspr
    nss
    pcre
@ -86,7 +88,7 @@ stdenv.mkDerivation rec {
    "--with-libnet-libraries=${libnet}/lib"
  ]
  ++ lib.optional hyperscanSupport [
-    "--with-libhs-includes=${hyperscan}/include"
+    "--with-libhs-includes=${hyperscan.dev}/include/hs"
    "--with-libhs-libraries=${hyperscan}/lib"
  ]
  ++ lib.optional redisSupport [ "--enable-hiredis" ]
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -1,36 +1,36 @@
 { branch ? "stable", pkgs }:
-
+# Generated by /maintainers/scripts/update-discord
 let
  inherit (pkgs) callPackage fetchurl;
 in {
-  stable = callPackage ./base.nix {
+  stable = callPackage ./base.nix rec {
    pname = "discord";
    binaryName = "Discord";
    desktopName = "Discord";
    version = "0.0.9";
    src = fetchurl {
-      url = "https://dl.discordapp.net/apps/linux/0.0.9/discord-0.0.9.tar.gz";
+      url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
      sha256 = "1i0f8id10rh2fx381hx151qckvvh8hbznfsfav8w0dfbd1bransf";
    };
  };
-  ptb = callPackage ./base.nix {
+  ptb = callPackage ./base.nix rec {
    pname = "discord-ptb";
    binaryName = "DiscordPTB";
    desktopName = "Discord PTB";
    version = "0.0.16";
    src = fetchurl {
-      url = "https://dl-ptb.discordapp.net/apps/linux/0.0.16/discord-ptb-0.0.16.tar.gz";
+      url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
      sha256 = "1ia94xvzygim9rx1sjnnss518ggw0i20mhp9pby33q70ha35n0aq";
    };
  };
-  canary = callPackage ./base.nix {
+  canary = callPackage ./base.nix rec {
    pname = "discord-canary";
    binaryName = "DiscordCanary";
    desktopName = "Discord Canary";
-    version = "0.0.96";
+    version = "0.0.97";
    src = fetchurl {
-      url = "https://dl-canary.discordapp.net/apps/linux/0.0.96/discord-canary-0.0.96.tar.gz";
-      sha256 = "1fxyh9v5xglwbgr5sidn0cv70qpzcd2q240wsv87k3nawhvfcwsp";
+      url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
+      sha256 = "17kwgk2kwrfqgjqmfv055gvlqq144gz7bywwrs6i2x7mimz4345x";
    };
  };
 }.${branch}
--- a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
@ -1,24 +1,25 @@
 { stdenv, fetchFromGitHub, cmake
-, qt5, libidn, qca2-qt5, libXScrnSaver, hunspell
+, qtbase, qtmultimedia, qtx11extras, qttools, qtwebengine
+, libidn, qca2-qt5, qtkeychain, libXScrnSaver, hunspell
 , libgcrypt, libotr, html-tidy, libgpgerror, libsignal-protocol-c
 }:

 stdenv.mkDerivation rec {
  pname = "psi-plus";
-  version = "1.4.504";
+  version = "1.4.904";

  src = fetchFromGitHub {
    owner = "psi-plus";
    repo = "psi-plus-snapshots";
    rev = version;
-    sha256 = "1nv1ynad2gcn7r8mm2w3kixmahaql7xax1lccsqyxqmj1r0klk8q";
+    sha256 = "1bs7yk3qp91sm8nb9gna8vm59381afn1wfs7aii9yi29bhx6fw9h";
  };

  resources = fetchFromGitHub {
    owner = "psi-plus";
    repo = "resources";
-    rev = "d623f57db35eb5af81ccdf69b2cbe1c437190f29";
-    sha256 = "024cyazyxka5vcbjrkkw32c5zw6aa70n50fdp6zh5v5c51d9ci8k";
+    rev = "182c92ca0bcc055579d8c91bccba9efe157e77a9";
+    sha256 = "06k7q63cxpifpzjnlw1snclkr2mwf9fh71cgfd40n7jgzswzwhpb";
  };

  postUnpack = ''
@ -32,8 +33,8 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake ];

  buildInputs = [
-    qt5.qtbase qt5.qtmultimedia qt5.qtx11extras qt5.qttools qt5.qtwebkit
-    libidn qca2-qt5 libXScrnSaver hunspell
+    qtbase qtmultimedia qtx11extras qttools qtwebengine
+    libidn qca2-qt5 qtkeychain libXScrnSaver hunspell
    libgcrypt libotr html-tidy libgpgerror libsignal-protocol-c
  ];

@ -44,6 +45,5 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ orivej ];
    license = licenses.gpl2;
    platforms = platforms.linux;
-    broken = true;
  };
 }
--- a/pkgs/applications/office/flexibee/default.nix
+++ b/pkgs/applications/office/flexibee/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, makeWrapper, jre }:

 let
-  version = "2019.2.5";
+  version = "2019.3.0.3";
  majorVersion = builtins.substring 0 6 version;
 in

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://download.flexibee.eu/download/${majorVersion}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0k94y4x6lj1vcb89a95v9mzl95mkpwp9n4a2gwvq0g90zpbnn493";
+    sha256 = "1ivhqh1rl4ll0af9nfgfm7f647vc9zk61aplinvz73xb3grb4j6f";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/office/spice-up/default.nix
+++ b/pkgs/applications/office/spice-up/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , gdk-pixbuf
 , gtk3
@ -37,6 +38,7 @@ stdenv.mkDerivation rec {
    vala
    wrapGAppsHook
  ];
+
  buildInputs = [
    pantheon.elementary-icon-theme
    pantheon.granite
@ -49,6 +51,15 @@ stdenv.mkDerivation rec {
    libsoup
  ];

+  patches = [
+    # Fix build with Vala 0.46
+    # https://github.com/Philip-Scott/Spice-up/pull/288
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/Philip-Scott/Spice-up/pull/288.patch";
+      sha256 = "0kyfd8v2sk4cvcq1j8ysp64snfjhnpr3iz7l04lx7if7h372xj39";
+    })
+  ];
+
  meta = with stdenv.lib; {
    description = "Create simple and beautiful presentations";
    homepage = https://github.com/Philip-Scott/Spice-up;
--- a/pkgs/applications/radio/tqsl/default.nix
+++ b/pkgs/applications/radio/tqsl/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "tqsl";
-  version = "2.4.3";
+  version = "2.4.7";

  src = fetchurl {
    url = "https://www.arrl.org/files/file/LoTW%20Instructions/${pname}-${version}.tar.gz";
-    sha256 = "0f8pa5wnp0x0mjjr5kanka9hirgmp5wf6jsb95dc6hjlzlvy6kz9";
+    sha256 = "1i33bk3annz4rnjc58knprfajq1pbyjqyrhygqybvl7bsp70c5ri";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/science/biology/star/default.nix
+++ b/pkgs/applications/science/biology/star/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "star";
-  version = "2.7.1a";
+  version = "2.7.2b";

  src = fetchFromGitHub {
    repo = "STAR";
    owner = "alexdobin";
    rev = version;
-    sha256 = "0n6g4s4hgw7qygs1z97j7a2dgz8gfaa4cv5pjvvvmarvk0x07hyg";
+    sha256 = "1fb63n3jm1l8k60wdjbq9asv4l1kf7algxxs1aqzvvidx3a8fvzq";
  };

  sourceRoot = "source/source";
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@ -28,11 +28,11 @@ let
 in stdenv.mkDerivation rec {
  pname = "kicad";
  series = "5.0";
-  version = "5.1.2";
+  version = "5.1.4";

  src = fetchurl {
    url = "https://launchpad.net/kicad/${series}/${version}/+download/kicad-${version}.tar.xz";
-    sha256 = "12kp82ms2dwqkhilmh3mbhg5rsj5ykk99pnkhp4sx89nni86qdw4";
+    sha256 = "1r60dgh6aalbpq1wsmpyxkz0nn4ck8ydfdjcrblpl69k5rks5k2j";
  };

  postPatch = ''
@ -73,22 +73,22 @@ in stdenv.mkDerivation rec {
  dontWrapGApps = true;

  passthru = {
-    i18n = mkLib version "i18n" "08a8lpz2j7bhwn155s0ii538qlynnnvq6fmdw1dxjfgmfy7y3r66" {
+    i18n = mkLib version "i18n" "1dk7wis4cncmihl8fnic3jyhqcdzpifchzsp7hmf214h0vp199zr" {
      buildInputs = [
        gettext
      ];
      meta.license = licenses.gpl2; # https://github.com/KiCad/kicad-i18n/issues/3
    };
-    symbols = mkLib version "symbols" "0l5r53wcv0518x2kl0fh1zi0d50cckc7z1739fp9z3k5a4ddk824" {
+    symbols = mkLib version "symbols" "1lna4xlvzrxif3569pkp6mrg7fj62z3a3ri5j97lnmnnzhiddnh3" {
      meta.license = licenses.cc-by-sa-40;
    };
-    footprints = mkLib version "footprints" "0q7y7m10pav6917ri37pzjvyh71c8lf4lh9ch258pdpl3w481zk6" {
+    footprints = mkLib version "footprints" "0c0kcywxlaihzzwp9bi0dsr2v9j46zcdr85xmfpivmrk19apss6a" {
      meta.license = licenses.cc-by-sa-40;
    };
-    templates = mkLib version "templates" "1nva4ckq0l2lrah0l05355cawlwd7qfxcagcv32m8hcrn781455q" {
+    templates = mkLib version "templates" "1bagb0b94cjh7zp9z0h23b60j45kwxbsbb7b2bdk98dmph8lmzbb" {
      meta.license = licenses.cc-by-sa-40;
    };
-    packages3d = mkLib version "packages3d" "0xla9k1rnrs00fink90y9qz766iks5lyqwnf1h2i508djqhqm5zi" {
+    packages3d = mkLib version "packages3d" "0h2qjj8vf33jz6jhqdz90c80h5i1ydgfqnns7rn0fqphlnscb45g" {
      hydraPlatforms = []; # this is a ~1 GiB download, occupies ~5 GiB in store
      meta.license = licenses.cc-by-sa-40;
    };
@ -107,7 +107,7 @@ in stdenv.mkDerivation rec {
    buildPythonPath "$out $pythonPath"
    gappsWrapperArgs+=(--set PYTHONPATH "$program_PYTHONPATH")

-    wrapGApp "$out/bin/kicad"
+    wrapGApp "$out/bin/kicad" --prefix LD_LIBRARY_PATH : "${libngspice}/lib"
  '';

  meta = {
@ -116,5 +116,6 @@ in stdenv.mkDerivation rec {
    license = licenses.gpl2;
    maintainers = with maintainers; [ berce ];
    platforms = with platforms; linux;
+    broken = stdenv.isAarch64;
  };
 }
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -7,8 +7,9 @@

 { stdenv, fetchFromGitHub, writeText, pkgconfig
 , ocamlPackages, ncurses
-, buildIde ? true
+, buildIde ? !stdenv.lib.versionAtLeast version "8.10" # lablgtk3 cannot be built with GTK3 at version 3.24.11
 , glib, gnome3, wrapGAppsHook
+, darwin
 , csdp ? null
 , version
 }:
@ -28,7 +29,7 @@ let
   "8.8.2" = "1lip3xja924dm6qblisk1bk0x8ai24s5xxqxphbdxj6djglj68fd";
   "8.9.0" = "1dkgdjc4n1m15m1p724hhi5cyxpqbjw6rxc5na6fl3v4qjjfnizh";
   "8.9.1" = "1xrq6mkhpq994bncmnijf8jwmwn961kkpl4mwwlv7j3dgnysrcv2";
-   "8.10+beta3" = "08c7q97jyblsf7dhk8jf1fx1cp9qr3dr5s42wigx10wh7i6j7pca";
+   "8.10.0" = "138jw94wp4mg5dgjc2asn8ng09ayz1mxdznq342n0m469j803gzg";
  }.${version};
  coq-version = stdenv.lib.versions.majorMinor version;
  versionAtLeast = stdenv.lib.versionAtLeast coq-version;
@ -101,10 +102,13 @@ self = stdenv.mkDerivation {
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ncurses ] ++ (with ocamlPackages; [ ocaml findlib camlp5 num ])
+  buildInputs = [ ncurses ocamlPackages.ocaml ocamlPackages.findlib ]
+  ++ stdenv.lib.optional (!versionAtLeast "8.10") ocamlPackages.camlp5
+  ++ [ ocamlPackages.num ]
  ++ stdenv.lib.optionals buildIde
    (if versionAtLeast "8.10"
     then [ ocamlPackages.lablgtk3-sourceview3 glib gnome3.defaultIconTheme wrapGAppsHook ]
+     ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa
     else [ ocamlPackages.lablgtk ]);

  postPatch = ''
--- a/pkgs/applications/science/logic/monosat/default.nix
+++ b/pkgs/applications/science/logic/monosat/default.nix
@ -8,11 +8,11 @@ with stdenv.lib;
 let
  boolToCmake = x: if x then "ON" else "OFF";

-  rev    = "2deeadeff214e975c9f7508bc8a24fa05a1a0c32";
-  sha256 = "09yhym2lxmn3xbhw5fcxawnmvms5jd9fw9m7x2wzil7yvy4vwdjn";
+  rev    = "1.8.0";
+  sha256 = "0q3a8x3iih25xkp2bm842sm2hxlb8hxlls4qmvj7vzwrh4lvsl7b";

  pname   = "monosat";
-  version = substring 0 7 sha256;
+  version = rev;

  src = fetchFromGitHub {
    owner = "sambayless";
@ -25,7 +25,11 @@ let
    inherit src;
    buildInputs = [ cmake zlib gmp jdk8 ];

-    cmakeFlags = [ "-DJAVA=${boolToCmake includeJava}" "-DGPL=${boolToCmake includeGplCode}" ];
+    cmakeFlags = [
+      "-DBUILD_STATIC=OFF"
+      "-DJAVA=${boolToCmake includeJava}"
+      "-DGPL=${boolToCmake includeGplCode}"
+    ];

    postInstall = optionalString includeJava ''
      mkdir -p $out/share/java
@ -39,7 +43,7 @@ let
      platforms   = platforms.unix;
      license     = if includeGplCode then licenses.gpl2 else licenses.mit;
      homepage    = https://github.com/sambayless/monosat;
-      broken = true;
+      maintainers = [ maintainers.acairncross ];
    };
  };

@ -51,18 +55,15 @@ let

    propagatedBuildInputs = [ core cython ];

-    # This tells setup.py to use cython
+    # This tells setup.py to use cython, which should produce faster bindings
    MONOSAT_CYTHON = true;

    # The relative paths here don't make sense for our Nix build
-    # Also, let's use cython since it should produce faster bindings
    # TODO: do we want to just reference the core monosat library rather than copying the
    # shared lib? The current setup.py copies the .dylib/.so...
    postPatch = ''
-
      substituteInPlace setup.py \
-        --replace '../../../../libmonosat.dylib' '${core}/lib/libmonosat.dylib' \
-        --replace '../../../../libmonosat.so'  '${core}/lib/libmonosat.so'
+        --replace 'library_dir = "../../../../"' 'library_dir = "${core}/lib/"'
    '';
  };
 in core
--- a/pkgs/applications/science/misc/simgrid/default.nix
+++ b/pkgs/applications/science/misc/simgrid/default.nix
@ -18,14 +18,14 @@ in

 stdenv.mkDerivation rec {
  pname = "simgrid";
-  version = "3.23";
+  version = "3.24";

  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "068xg5ps4j4v2sqqyl4vf83nfazp54gsy84gvlw52h94c4mj4xmp";
+    sha256 = "1r9zgfx5npjw4mk0ywxx07jyi1m1b1i06j0m60n3dsrz75492x6m";
  };

  nativeBuildInputs = [ cmake perl python3 boost valgrind ]
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -74,6 +74,8 @@ let

  git-annex-remote-rclone = callPackage ./git-annex-remote-rclone { };

+  git-annex-utils = callPackage ./git-annex-utils { };
+
  git-bug = callPackage ./git-bug { };

  # support for bugzilla
--- a/pkgs/applications/version-management/git-and-tools/git-annex-utils/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-utils/default.nix
@ -0,0 +1,25 @@
+{ stdenv, fetchgit, autoconf, automake, libtool, gmp }:
+
+stdenv.mkDerivation rec {
+  pname = "git-annex-utils";
+  version = "0.04-3-g531bb33";
+  src = fetchgit {
+    url = http://git.mysteryvortex.com/repositories/git-annex-utils.git;
+    rev = "531bb33";
+    sha256 = "1sv7s2ykc840cjwbfn7ayy743643x9i1lvk4cd55w9l052xvzj65";
+  };
+  buildInputs = [ autoconf automake libtool gmp ];
+  preConfigure = "./autogen.sh";
+
+  meta = {
+    description = "gadu, a du like utility for annexed files";
+    longDescription = ''
+      This is a set of utilities that are handy to use with git-annex repositories.
+      Currently there is only one utility gadu, a du like utility for annexed files.
+    '';
+    homepage = http://git-annex.mysteryvortex.com/git-annex-utils.html;
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = with stdenv.lib.maintainers; [ woffs ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
--- a/pkgs/applications/virtualization/charliecloud/default.nix
+++ b/pkgs/applications/virtualization/charliecloud/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {

-  version = "0.9.8";
+  version = "0.11";
  pname = "charliecloud";

  src = fetchFromGitHub {
    owner = "hpc";
    repo = "charliecloud";
    rev = "v${version}";
-    sha256 = "1w1wy4sj9zqfysrpf04shhppcf5ap4rp7i3ja81sv2fm27k4m9nl";
+    sha256 = "10dzas5fyh2lpa0kf1xv8z9c4g4cf0zlmnpilyvpcyccyfjf6cp2";
  };

  buildInputs = [ python ];
--- a/pkgs/data/fonts/cherry/default.nix
+++ b/pkgs/data/fonts/cherry/default.nix
@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, bdftopcf }:
+{ stdenv, fetchFromGitHub, fonttosfnt, mkfontdir }:

 stdenv.mkDerivation rec {
  pname = "cherry";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "turquoise-hexagon";
    repo = pname;
    rev = version;
-    sha256 = "1zaiqspf6y0hpszhihdsvsyw33d3ffdap4dym7w45wfrhdpvpi0p";
+    sha256 = "13zkxwp6r6kcxv4x459vwscr0n0sik4a3kcz5xnmlpvcdnbxi586";
  };

-  nativeBuildInputs = [ bdftopcf ];
+  nativeBuildInputs = [ fonttosfnt mkfontdir ];

  buildPhase = ''
    patchShebangs make.sh
@ -20,7 +20,10 @@ stdenv.mkDerivation rec {

  installPhase = ''
    mkdir -p $out/share/fonts/misc
-    cp *.pcf $out/share/fonts/misc
+    cp *.otb $out/share/fonts/misc
+
+    # create fonts.dir so NixOS xorg module adds to fp
+    mkfontdir $out/share/fonts/misc
  '';

  meta = with stdenv.lib; {
--- a/pkgs/data/fonts/spleen/default.nix
+++ b/pkgs/data/fonts/spleen/default.nix
@ -1,8 +1,8 @@
-{ lib, fetchurl }:
+{ lib, fetchurl, mkfontdir }:

 let
  pname = "spleen";
-  version = "1.3.0";
+  version = "1.5.0";
 in fetchurl {
  name = "${pname}-${version}";
  url = "https://github.com/fcambus/spleen/releases/download/${version}/spleen-${version}.tar.gz";
@ -12,11 +12,13 @@ in fetchurl {
  postFetch = ''
    tar xvf $downloadedFile --strip=1
    d="$out/share/fonts/X11/misc/spleen"
-    gzip -n9 *.pcf
    install -Dm644 *.{pcf.gz,psfu,bdf} -t $d
    install -m644 fonts.alias-spleen $d/fonts.alias
+
+    # create fonts.dir so NixOS xorg module adds to fp
+    ${mkfontdir}/bin/mkfontdir $d
  '';
-  sha256 = "1l1ksl8xnz1yh7jl8h2g25a7wfm9xgj3lay8ddqzlxzydkkm110q";
+  sha256 = "13ndyw1m6c778k7jr7qwbfg28gqmpcgksprn2mjgsv75wvy51z19";

  meta = with lib; {
    description = "Monospaced bitmap fonts";
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "papirus-icon-theme";
-  version = "20190919";
+  version = "20191009";

  src = fetchFromGitHub {
    owner = "PapirusDevelopmentTeam";
    repo = pname;
    rev = version;
-    sha256 = "1pykrvh232b12wlhc56yd992vl4p3j2ap21mhhcwyxml06riwvki";
+    sha256 = "1ljbaq0c6rhvfwj5q2kvd6rxbjykb0sbgcpjrxrzpdy08zr1kdvd";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/desktops/mate/mate-netbook/default.nix
+++ b/pkgs/desktops/mate/mate-netbook/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-netbook";
-  version = "1.22.1";
+  version = "1.22.2";

  src = fetchurl {
    url = "http://pub.mate-desktop.org/releases/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "00n162bskbvxhy4k2w14f9zwlsg3wgi43228ssx7sc2p95psmm64";
+    sha256 = "0m38v2276s2d3zs7smxyf70nyl7bcwp5665zgva28lvs8ip3gijx";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@ -4,20 +4,11 @@
 let
  fetchElmDeps = import ./fetchElmDeps.nix { inherit stdenv lib fetchurl; };

-  patchBinwrap = import ./packages/patch-binwrap.nix { inherit lib writeScriptBin stdenv; };
-
-  elmNodePackages =
-    import ./packages/node-composition.nix {
-      inherit nodejs pkgs;
-      inherit (stdenv.hostPlatform) system;
-    };
-
  hsPkgs = haskell.packages.ghc865.override {
    overrides = self: super: with haskell.lib;
      let elmPkgs = rec {
            elm = overrideCabal (self.callPackage ./packages/elm.nix { }) (drv: {
              # sadly with parallelism most of the time breaks compilation
-              # also compilation is slower with increasing number of cores anyway (Tested on Ryzen 7 and i7)
              enableParallelBuilding = false;
              preConfigure = self.fetchElmDeps {
                elmPackages = (import ./packages/elm-srcs.nix);
@ -42,25 +33,10 @@ let
            `package/nix/build.sh`
            */
            elm-format = justStaticExecutables (doJailbreak (self.callPackage ./packages/elm-format.nix {}));
-
            elmi-to-json = justStaticExecutables (self.callPackage ./packages/elmi-to-json.nix {});

            inherit fetchElmDeps;
            elmVersion = elmPkgs.elm.version;
-
-            /*
-            Node/NPM based dependecies can be upgraded using script
-            `packages/generate-node-packages.sh`.
-            Packages which rely on `bin-wrap` will fail by default
-            and can be patched using `patchBinwrap` function defined in `packages/patch-binwrap.nix`.
-            */
-            elm-test = patchBinwrap [elmi-to-json] elmNodePackages.elm-test;
-            elm-verify-examples = patchBinwrap [elmi-to-json] elmNodePackages.elm-verify-examples;
-            elm-language-server = elmNodePackages."@elm-tooling/elm-language-server";
-
-            # elm-analyse@0.16.4 build is not working
-            elm-analyse = elmNodePackages."elm-analyse-0.16.3";
-            inherit (elmNodePackages) elm-doc-preview elm-live elm-upgrade elm-xref;
          };
      in elmPkgs // {
        inherit elmPkgs;
@ -69,4 +45,31 @@ let
        indents = self.callPackage ./packages/indents.nix {};
      };
  };
-in hsPkgs.elmPkgs
+
+  /*
+  Node/NPM based dependecies can be upgraded using script
+  `packages/generate-node-packages.sh`.
+  Packages which rely on `bin-wrap` will fail by default
+  and can be patched using `patchBinwrap` function defined in `packages/patch-binwrap.nix`.
+  */
+  elmNodePackages =
+    let
+      nodePkgs = import ./packages/node-composition.nix {
+          inherit nodejs pkgs;
+          inherit (stdenv.hostPlatform) system;
+        };
+    in with hsPkgs.elmPkgs; {
+      elm-test = patchBinwrap [elmi-to-json] nodePkgs.elm-test;
+      elm-verify-examples = patchBinwrap [elmi-to-json] nodePkgs.elm-verify-examples;
+      elm-language-server = nodePkgs."@elm-tooling/elm-language-server";
+
+      # elm-analyse@0.16.4 build is not working
+      elm-analyse = nodePkgs."elm-analyse-0.16.3";
+      inherit (nodePkgs) elm-doc-preview elm-live elm-upgrade elm-xref;
+    };
+
+  patchBinwrap = import ./packages/patch-binwrap.nix { inherit lib writeScriptBin stdenv; };
+
+in hsPkgs.elmPkgs // elmNodePackages // {
+  lib = { inherit patchBinwrap; };
+}
--- a/pkgs/development/compilers/go/1.12.nix
+++ b/pkgs/development/compilers/go/1.12.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, tzdata, iana-etc, runCommand
+{ stdenv, fetchurl, tzdata, iana-etc, runCommand
 , perl, which, pkgconfig, patch, procps, pcre, cacert, Security, Foundation
 , mailcap, runtimeShell
 , buildPackages, pkgsTargetTarget
@ -96,6 +96,12 @@ stdenv.mkDerivation rec {
    # Disable cgo lookup tests not works, they depend on resolver
    rm src/net/cgo_unix_test.go

+    # Disable TestGcSys because it's flakey in our tests, but the failure is not
+    # reproducible by multiple people in other environments.
+    # See https://github.com/NixOS/nixpkgs/issues/68361#issuecomment-537849272 and following
+    # NOTE: Try re-enabling for releases newer than 1.12.9
+    sed -i '/TestGcSys/areturn' src/runtime/gc_test.go
+
  '' + optionalString stdenv.isLinux ''
    sed -i 's,/usr/share/zoneinfo/,${tzdata}/share/zoneinfo/,' src/time/zoneinfo_unix.go
  '' + optionalString stdenv.isAarch32 ''
@ -137,11 +143,6 @@ stdenv.mkDerivation rec {
    ./skip-nohup-tests.patch
    # breaks under load: https://github.com/golang/go/issues/25628
    ./skip-test-extra-files-on-386.patch
-    (fetchpatch { # probably included in >= 1.12.10
-      url = "https://github.com/golang/go/commit/aae0b5b0b.diff";
-      name = "TestGcSys-too-much-memory.diff";
-      sha256 = "1bl9d2pl6n99n9g65cq91sygmp1iva5rmrxbprwn4xd0ql36psa8";
-    })
  ];

  postPatch = ''
--- a/pkgs/development/compilers/pakcs/default.nix
+++ b/pkgs/development/compilers/pakcs/default.nix
@ -4,13 +4,13 @@
 , curl, git, unzip, gnutar, coreutils, sqlite }:

 let
-  name = "pakcs-2.1.1";
+  name = "pakcs-2.1.2";

  # Don't switch to development release without a reason, because its
  # source updates without version bump. Prefer current release instead.
  src = fetchurl {
    url = "https://www.informatik.uni-kiel.de/~pakcs/download/${name}-src.tar.gz";
-    sha256 = "112v9ynqfbbm4x770mcfrai9v5bh7c3zn7jka80pv6v4y65r778c";
+    sha256 = "0i0nprli3knc7zlp5qkqkpiq3ny36v52hnvgph376l3ajjds7wf6";
  };

  curry-frontend = (haskellPackages.override {
@ -43,9 +43,14 @@ in stdenv.mkDerivation {
    # Since we can't expand $out in `makeFlags`
    #makeFlags="$makeFlags PAKCSINSTALLDIR=$out/pakcs"

-    substituteInPlace currytools/cpm/src/CPM/Repository.curry \
-      --replace "/bin/rm" "rm"
-  '';
+    for file in currytools/cpm/src/CPM/Repository.curry \
+                currytools/cpm/src/CPM/Repository/CacheDB.curry \
+                scripts/compile-all-libs.sh \
+                scripts/cleancurry.sh \
+                examples/test.sh testsuite/test.sh lib/test.sh; do
+        substituteInPlace $file --replace "/bin/rm" "rm"
+    done
+  '' ;

  # cypm new: EXISTENCE ERROR: source_sink
  # "/tmp/nix-build-pakcs-2.0.2.drv-0/pakcs-2.0.2/currytools/cpm/templates/LICENSE"
--- a/pkgs/development/compilers/swi-prolog/default.nix
+++ b/pkgs/development/compilers/swi-prolog/default.nix
@ -2,12 +2,14 @@
 , libarchive, db, pcre, libedit, libossp_uuid, libXpm
 , libSM, libXt, freetype, pkgconfig, fontconfig, makeWrapper ? stdenv.isDarwin
 , git, cacert, cmake, libyaml
+, libjpeg, libX11, libXext, libXft, libXinerama
 , extraLibraries ? [ jdk unixODBC libXpm libSM libXt freetype fontconfig ]
 , extraPacks     ? []
+, withGui ? false
 }:

 let
-  version = "8.1.4";
+  version = "8.1.15";
  packInstall = swiplPath: pack:
    ''${swiplPath}/bin/swipl -g "pack_install(${pack}, [package_directory(\"${swiplPath}/lib/swipl/pack\"), silent(true), interactive(false)])." -t "halt."
    '';
@ -19,12 +21,13 @@ stdenv.mkDerivation {
  src = fetchgit {
    url = "https://github.com/SWI-Prolog/swipl-devel";
    rev = "V${version}";
-    sha256 = "0qxa6f5dypwczxajlf0l736adbjb17cbak3qsh5g04hpv2bxm6dh";
+    sha256 = "0czbrscx2s4079nmwvipp9cnwfny16m3fpnp823llm7wyljchgvq";
  };

  buildInputs = [ cacert git cmake gmp readline openssl
    libarchive libyaml db pcre libedit libossp_uuid
    zlib pkgconfig ]
+  ++ stdenv.lib.optionals (withGui && !stdenv.isDarwin) [ libXpm libX11 libXext libXft libXinerama libjpeg ]
  ++ extraLibraries
  ++ stdenv.lib.optional stdenv.isDarwin makeWrapper;

@ -68,7 +71,7 @@ stdenv.mkDerivation {
    description = "A Prolog compiler and interpreter";
    license = "LGPL";

-    platforms = stdenv.lib.platforms.unix;
+    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.optionals (!withGui) stdenv.lib.platforms.darwin;
    maintainers = [ stdenv.lib.maintainers.meditans ];
  };
 }
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@ -1,10 +1,10 @@
 { stdenv, fetchFromGitHub, which, coq }:

 let params = {
-  "8.10" = {
-    version = "master";
-    rev = "bc7134deba1aacc7ecd2f5d1032bdf05b125c568";
-    sha256 = "188avk9irwjsbs5ya4ka01mpk3vw4397kv2rmsncqrrrsa1pdddk";
+  "8.10" = rec {
+    version = "1.1.0";
+    rev = "v${version}";
+    sha256 = "06jyw7n27ylg02jvlaa3hs13hg8qgx47yn4dxhg9as1xri9a2rvm";
  };
 };
  param = params.${coq.coq-version};
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -69,7 +69,7 @@ self: super: {
      name = "git-annex-${super.git-annex.version}-src";
      url = "git://git-annex.branchable.com/";
      rev = "refs/tags/" + super.git-annex.version;
-      sha256 = "1ackqjkwkfm3kazlyy4nwdjf6wwjlajql1hrznaki5138nw4gxs4";
+      sha256 = "0v3wgx3qbillmnn3amnl568ls113y3qlyf3k7y5b9lmz22k93680";
    };
  }).override {
    dbus = if pkgs.stdenv.isLinux then self.dbus else null;
@ -145,6 +145,8 @@ self: super: {
    then addBuildDepend super.halive pkgs.darwin.apple_sdk.frameworks.AppKit
    else super.halive;

+  barbly = addBuildDepend super.barbly pkgs.darwin.apple_sdk.frameworks.AppKit;
+
  # Hakyll's tests are broken on Darwin (3 failures); and they require util-linux
  hakyll = if pkgs.stdenv.isDarwin
    then dontCheck (overrideCabal super.hakyll (drv: {
@ -1200,7 +1202,7 @@ self: super: {
  hlint = super.hlint.override { ghc-lib-parser = self.ghc-lib-parser_8_8_1; };

  # https://github.com/sol/hpack/issues/366
-  hpack = self.hpack_0_32_0;
+  hpack = self.hpack_0_33_0;

  # QuickCheck >=2.3 && <2.13, hspec >=2.1 && <2.7
  graphviz = dontCheck super.graphviz;
@ -1248,4 +1250,8 @@ self: super: {
    postFetch = "sed -i -e s,gtk.cabal-renamed,gtk.cabal, $out";
  });

+  # Version bounds for http-client are too strict:
+  # https://github.com/bitnomial/prometheus/issues/34
+  prometheus = doJailbreak super.prometheus;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
--- a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@ -77,10 +77,7 @@ self: super: {
  regex-posix = self.regex-posix_0_96_0_0;
  regex-tdfa = self.regex-tdfa_1_3_0;
  shelly = self.shelly_1_9_0;
-  string-qq = self.string-qq_0_0_4;
  tls = self.tls_1_5_1;
-  vector-th-unbox = self.vector-th-unbox_0_2_1_7;
-  X11 = self.X11_1_9_1;
  xmonad-contrib = self.xmonad-contrib_0_16;

  # These packages don't work and need patching and/or an update.
@ -88,10 +85,6 @@ self: super: {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/hackage-security-0.5.3.0.patch";
    sha256 = "0l8x0pbsn18fj5ak5q0g5rva4xw1s9yc4d86a1pfyaz467b9i5a4";
  });
-  socks = appendPatch (doJailbreak super.socks) (pkgs.fetchpatch {
-    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/socks-0.6.0.patch";
-    sha256 = "1dsqmx0sw62x4glh43c0sbizd2y00v5xybiqadn96v6pmfrap5cp";
-  });
  polyparse = appendPatch (doJailbreak super.polyparse) (pkgs.fetchpatch {
    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/polyparse-1.12.1.patch";
    sha256 = "01b2gnsq0x4fd9na8zpk6pajym55mbz64hgzawlwxdw0y6681kr5";
@ -101,10 +94,6 @@ self: super: {
    url = "https://gitlab.haskell.org/ghc/head.hackage/raw/master/patches/haskell-src-meta-0.8.3.patch";
    sha256 = "1asl932mibr5y057xx8v1a7n3qy87lcnclsfh8pbxq1m3iwjkxy8";
  });
-  asn1-encoding = appendPatch (dontCheck (doJailbreak super.asn1-encoding)) (pkgs.fetchpatch {
-    url = "https://gitlab.haskell.org/ghc/head.hackage/raw/master/patches/asn1-encoding-0.9.5.patch";
-    sha256 = "0a3159rnaw6shjzdm46799crd4pxh33s23qy51xa7z6nv5q8wsb5";
-  });
  vault = dontHaddock super.vault;
  monad-par = dontCheck super.monad-par;   # test suite does not compile in monad-par-0.3.4.8

@ -114,12 +103,6 @@ self: super: {
    sha256 = "1v40gmnw4lqyk271wngdwz8whpfdhmza58srbkka8icwwwrck3l5";
  });

-  # https://github.com/sol/hpack/issues/371
-  hpack = appendPatch super.hpack (pkgs.fetchpatch {
-    url = "https://gitlab.haskell.org/ghc/head.hackage/raw/master/patches/hpack-0.32.0.patch";
-    sha256 = "11ccl9f7vwbf5cpzknlyvrwgkzpajk4vq9jk9yb5f9la9ggwb244";
-  });
-
  # Upstream ships a broken Setup.hs file.
  csv = overrideCabal super.csv (drv: { prePatch = "rm Setup.hs"; });

--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -97,7 +97,10 @@ self: super: builtins.intersectAttrs super {
  # profiling is disabled to allow C++/C mess to work, which is fixed in GHC 8.8
  cachix = disableLibraryProfiling super.cachix;

+  # avoid compiling twice by providing executable as a separate output (with small closure size)
  niv = enableSeparateBinOutput super.niv;
+  ormolu = enableSeparateBinOutput super.ormolu;
+  ghcid = enableSeparateBinOutput super.ghcid;

  # Ensure the necessary frameworks for Darwin.
  OpenAL = if pkgs.stdenv.isDarwin
@ -109,7 +112,6 @@ self: super: builtins.intersectAttrs super {
    then addExtraLibrary super.proteaaudio pkgs.darwin.apple_sdk.frameworks.AudioToolbox
    else super.proteaaudio;

-  ghcid = enableSeparateBinOutput super.ghcid;

  hzk = overrideCabal super.hzk (drv: {
    preConfigure = "sed -i -e /include-dirs/d hzk.cabal";
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@ -133,7 +133,7 @@ let
      installPhase = ''
        export HOME="$TMP"
        mkdir -p "$out"
-        cabal2nix --compiler=${self.ghc.haskellCompilerName} --system=${hostPlatform.system} ${sha256Arg} "${src}" ${extraCabal2nixOptions} > "$out/default.nix"
+        cabal2nix --compiler=${self.ghc.haskellCompilerName} --system=${hostPlatform.config} ${sha256Arg} "${src}" ${extraCabal2nixOptions} > "$out/default.nix"
      '';
  };

--- a/pkgs/development/interpreters/elixir/1.9.nix
+++ b/pkgs/development/interpreters/elixir/1.9.nix
@ -1,7 +1,7 @@
 { mkDerivation }:

 mkDerivation {
-  version = "1.9.1";
-  sha256 = "106s2a3dykc5iwfrd5icqd737yfzaz1dw4x5v1j5z2fvf46h96dx";
+  version = "1.9.2";
+  sha256 = "19yn6nx6r627f5zbyc7ckgr96d6b45sgwx95n2gp2imqwqvpj8wc";
  minimumOTPVersion = "20";
 }
--- a/pkgs/development/interpreters/luajit/2.0.nix
+++ b/pkgs/development/interpreters/luajit/2.0.nix
@ -4,7 +4,8 @@ callPackage ./default.nix {
  version = "2.0.5";
  isStable = true;
  sha256 = "0yg9q4q6v028bgh85317ykc9whgxgysp76qzaqgq55y6jy11yjw7";
-  extraMeta = {
-    platforms = lib.filter (p: p != "aarch64-linux") lib.meta.platforms;
+  extraMeta = { # this isn't precise but it at least stops the useless Hydra build
+    platforms = with lib; filter (p: p != "aarch64-linux")
+      (platforms.linux ++ platforms.darwin);
  };
 }
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@ -62,12 +62,12 @@ stdenv.mkDerivation rec {
    interpreter = "${self}/bin/lua";
  };

-  meta = with stdenv.lib; extraMeta // {
+  meta = with stdenv.lib; {
    description = "High-performance JIT compiler for Lua 5.1";
    homepage    = http://luajit.org;
    license     = licenses.mit;
    platforms   = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ thoughtpolice smironov vcunat andir ];
-  };
+  } // extraMeta;
 }

--- a/pkgs/development/interpreters/metamath/default.nix
+++ b/pkgs/development/interpreters/metamath/default.nix
@ -2,21 +2,23 @@

 stdenv.mkDerivation {
  pname = "metamath";
-  version = "0.172";
+  version = "0.178";

  buildInputs = [ autoreconfHook ];

-  # This points to my own repository because there is no official repository
-  # for metamath; there's a download location but it gets updated in place with
-  # no permanent link. See discussion at
-  # https://groups.google.com/forum/#!topic/metamath/N4WEWQQVUfY
  src = fetchFromGitHub {
-    owner = "Taneb";
-    repo = "metamath";
-    rev = "43141cd17638f8efb409dc5d46e7de6a6c39ec42";
-    sha256 = "07c7df0zl0wsb0pvdgkwikpr8kz7fi3mshxzk61vkamyp68djjb5";
+    owner = "metamath";
+    repo = "metamath-exe";
+    rev = "4f59d60aeb03f92aea3cc7ecf5a2c0fcf08900a5";
+    sha256 = "0nrl4nzp6rm2sn365xyjf3g5l5fl58kca7rq08lqyz5gla0wgfcf";
  };

+  # the files necessary to build the DATA target are not in this distribution
+  # luckily, they're not really needed so we don't build it.
+  makeFlags = [ "DATA=" ];
+
+  installTargets = "install-exec";
+
  meta = with stdenv.lib; {
    description = "Interpreter for the metamath proof language";
    longDescription = ''
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -100,7 +100,7 @@ in with passthru; stdenv.mkDerivation {
  ] ++ optionals isPy35 [
    # Backports support for LD_LIBRARY_PATH from 3.6
    ./3.5/ld_library_path.patch
-  ] ++ optionals isPy37 [
+  ] ++ optionals (isPy37 || isPy38) [
    # Fix darwin build https://bugs.python.org/issue34027
    (fetchpatch {
      url = https://bugs.python.org/file47666/darwin-libutil.patch;
@ -114,7 +114,7 @@ in with passthru; stdenv.mkDerivation {
    (
      if isPy35 then
        ./3.5/python-3.x-distutils-C++.patch
-      else if isPy37 then
+      else if isPy37 || isPy38 then
        ./3.7/python-3.x-distutils-C++.patch
      else
        fetchpatch {
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -28,6 +28,7 @@ with pkgs;
        isPy35 = pythonVersion == "3.5";
        isPy36 = pythonVersion == "3.6";
        isPy37 = pythonVersion == "3.7";
+        isPy38 = pythonVersion == "3.8";
        isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
        isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
        isPy3k = isPy3;
@ -104,9 +105,9 @@ in {
      major = "3";
      minor = "8";
      patch = "0";
-      suffix = "rc1";
+      suffix = "";
    };
-    sha256 = "08d8j3dsv6yz5zxkqvsa71scxjjzdwarfk6hsjfhaw2xrxndyi5f";
+    sha256 = "110d0did9rxn7rg85kf2fwli5hqq44xv2d8bi7d92m7v2d728mmk";
    inherit (darwin) CF configd;
    inherit passthruFun;
  };
--- a/pkgs/development/interpreters/renpy/default.nix
+++ b/pkgs/development/interpreters/renpy/default.nix
@ -7,7 +7,7 @@ with pythonPackages;

 stdenv.mkDerivation rec {
  pname = "renpy";
-  version = "7.3.2";
+  version = "7.3.3";

  meta = with stdenv.lib; {
    description = "Ren'Py Visual Novel Engine";
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://www.renpy.org/dl/${version}/renpy-${version}-source.tar.bz2";
-    sha256 = "1i7s9s8invsm5bavw2jlk965pb5h5vgwyk1nhw0z1d22spmj4a4m";
+    sha256 = "0wwsm0vg6zd07xmkqrqprymahdl4ifg7bc1lpbrh0qlfs1pvjlss";
  };

  patches = [
--- a/pkgs/development/libraries/accounts-qt/default.nix
+++ b/pkgs/development/libraries/accounts-qt/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "accounts-qt";
-  version = "1.15";
+  version = "1.16";

  src = fetchFromGitLab {
-    sha256 = "0cnra7g2mcgzh8ykrj1dpb4khkx676pzdr4ia1bvsp0cli48691w";
+    sha256 = "1vmpjvysm0ld8dqnx8msa15hlhrkny02cqycsh4k2azrnijg0xjz";
    rev = "VERSION_${version}";
    repo = "libaccounts-qt";
    owner = "accounts-sso";
--- a/pkgs/development/libraries/aspell/dictionaries.nix
+++ b/pkgs/development/libraries/aspell/dictionaries.nix
@ -298,10 +298,10 @@ in rec {

  en = buildOfficialDict {
    language = "en";
-    version = "2018.04.16-0";
+    version = "2019.10.06-0";
    fullName = "English";
    filename = "aspell6";
-    sha256 = "0bxxdzkk9g27plg22y9qzsx9cfjw3aa29w5bmzs561qc9gkp247i";
+    sha256 = "1zai9wrqwgb9z9vfgb22qhrvxvg73jg0ix44j1khm2f6m96lncr4";
  };

  eo = buildOfficialDict {
@ -919,12 +919,12 @@ in rec {

    src1 = fetchurl {
      url = http://jpetrie.net/wp-content/uploads/custom_scientific_US.txt;
-      sha256 = "1psqm094zl4prk2f8h18jv0d471hxykzd1zdnrlx7gzrzy6pz5r3";
+      sha256 = "1nf4py2mg0mlv9s5a7had2wn29z2v6bcca0fs6rbpdn4nqc4s7dm";
    };

    src2 = fetchurl {
      url = http://jpetrie.net/wp-content/uploads/custom_scientific_UK.txt;
-      sha256 = "17ss1sdr3k70zbyx2z9xf74345slrp41gbkpih8axrmg4x92fgm1";
+      sha256 = "0f88il1ds6qazy1ghxviqcwsywrbf6pzl2lmzf4f3qvhdfb6f1y0";
    };

    langInputs = [ en ];
--- a/pkgs/development/libraries/assimp/default.nix
+++ b/pkgs/development/libraries/assimp/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "assimp";
-  version = "4.1.0";
+  version = "5.0.0";

  src = fetchFromGitHub{
    owner = "assimp";
    repo = "assimp";
    rev = "v${version}";
-    sha256 = "00g61g3ixmfszzjncpvm8x7gp2livaj4lmhbycjmrw4x3gfqlc4r";
+    sha256 = "17y5q5hbygmb0cgf96gd3v8sal5g69cp8hmh1cs3yz7v00kjysmz";
  };

  buildInputs = [ cmake boost zlib ];
--- a/pkgs/development/libraries/cereal/default.nix
+++ b/pkgs/development/libraries/cereal/default.nix
@ -0,0 +1,23 @@
+{ stdenv, fetchFromGitHub, cmake }:
+stdenv.mkDerivation rec {
+  pname = "cereal";
+  version = "1.2.2";
+
+  nativeBuildInputs = [ cmake ];
+
+  src = fetchFromGitHub {
+    owner = "USCiLab";
+    repo = "cereal";
+    rev = "v${version}";
+    sha256 = "1ckr8r03ggg5pyzg8yw40d5ssq40h5najvyqlnxc85fxxp8rnrx4";
+  };
+
+  cmakeFlagsArray = [ "-DJUST_INSTALL_CEREAL=yes" ];
+
+  meta = with stdenv.lib; {
+    description = "A header-only C++11 serialization library";
+    homepage    = https://uscilab.github.io/cereal/;
+    platforms   = platforms.all;
+    license     = licenses.mit;
+  };
+}
--- a/pkgs/development/libraries/dqlite/default.nix
+++ b/pkgs/development/libraries/dqlite/default.nix
@ -1,24 +1,36 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libuv, sqlite-replication }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, file, libco-canonical
+, libuv, raft-canonical, sqlite-replication }:

 with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "dqlite";
-  version = "0.2.6";
+  version = "1.0.0";

  src = fetchFromGitHub {
-    owner = "CanonicalLtd";
+    owner = "canonical";
    repo = pname;
    rev = "v${version}";
-    sha256 = "13l7na5858v2ah1vim6lafmzajgkymfi5rd6bk14cm4vcnxc40wb";
+    sha256 = "0670c1c84lcf5vl3h6mlff00fz2fnm766bzlk526sjjzysx3zjya";
  };

-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook file pkgconfig ];
+  buildInputs = [ libco-canonical.dev libuv raft-canonical.dev 
+                  sqlite-replication ];

-  buildInputs = [ libuv sqlite-replication ];
+  preConfigure= ''
+    substituteInPlace configure --replace /usr/bin/ " "
+  '';
+
+  doCheck = true;
+
+  outputs = [ "dev" "out" ];

  meta = {
-    description = "Expose a SQLite database over the network and replicate it across a cluster of peers";
+    description = ''
+      Expose a SQLite database over the network and replicate it across a
+      cluster of peers
+    '';
    homepage = https://github.com/CanonicalLtd/dqlite/;
    license = licenses.asl20;
    maintainers = with maintainers; [ joko ];
--- a/pkgs/development/libraries/flatpak/default.nix
+++ b/pkgs/development/libraries/flatpak/default.nix
@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
  configureFlags = [
    "--with-system-bubblewrap=${bubblewrap}/bin/bwrap"
    "--with-system-dbus-proxy=${xdg-dbus-proxy}/bin/xdg-dbus-proxy"
-    "--dbus_config_dir=${placeholder "out"}/share/dbus-1/system.d"
+    "--with-dbus-config-dir=${placeholder "out"}/share/dbus-1/system.d"
    "--localstatedir=/var"
    "--enable-installed-tests"
  ];
--- a/Show More
+++ b/Show More