Merge staging-next into staging

2020-06-13 11:03:26 +02:00 · 2020-06-13 11:03:26 +02:00 · 2e4b4e3300
commit 2e4b4e3300
parent c8d064eec1 1523382160
343 changed files with 3648 additions and 2203 deletions
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -276,6 +276,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
    fullName = "European Union Public License 1.2";
  };

+  fdl11 = spdx {
+    spdxId = "GFDL-1.1-only";
+    fullName = "GNU Free Documentation License v1.1 only";
+  };
+
  fdl12 = spdx {
    spdxId = "GFDL-1.2-only";
    fullName = "GNU Free Documentation License v1.2 only";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3514,6 +3514,12 @@
    githubId = 1608697;
    name = "Jens Binkert";
  };
+  jeremyschlatter = {
+    email = "github@jeremyschlatter.com";
+    github = "jeremyschlatter";
+    githubId = 5741620;
+    name = "Jeremy Schlatter";
+  };
  jerith666 = {
    email = "github@matt.mchenryfamily.org";
    github = "jerith666";
@ -5027,6 +5033,12 @@
    githubId = 223323;
    name = "Miguel de la Cruz";
  };
+  mgdm = {
+    email = "michael@mgdm.net";
+    github = "mgdm";
+    githubId = 71893;
+    name = "Michael Maclean";
+  };
  mgregoire = {
    email = "gregoire@martinache.net";
    github = "M-Gregoire";
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -181,6 +181,12 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
      <link linkend="opt-security.duosec.integrationKey">security.duosec.integrationKey</link>.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      <literal>vmware</literal> has been removed from the <literal>services.x11.videoDrivers</literal> defaults.
+      For VMWare guests set <literal>virtualisation.vmware.guest.enable</literal> to <literal>true</literal> which will include the appropriate drivers.
+    </para>
+   </listitem>
   <listitem>
    <para>
     The initrd SSH support now uses OpenSSH rather than Dropbear to
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -39,7 +39,7 @@

 , name ? "nixos-disk-image"

-, # Disk image format, one of qcow2, qcow2-compressed, vpc, raw.
+, # Disk image format, one of qcow2, qcow2-compressed, vdi, vpc, raw.
  format ? "raw"
 }:

@ -57,6 +57,7 @@ let format' = format; in let

  filename = "nixos." + {
    qcow2 = "qcow2";
+    vdi   = "vdi";
    vpc   = "vhd";
    raw   = "img";
  }.${format};
--- a/nixos/modules/config/i18n.nix
+++ b/nixos/modules/config/i18n.nix
@ -68,7 +68,8 @@ with lib;
  config = {

    environment.systemPackages =
-      optional (config.i18n.supportedLocales != []) config.i18n.glibcLocales;
+      # We increase the priority a little, so that plain glibc in systemPackages can't win.
+      optional (config.i18n.supportedLocales != []) (lib.setPrio (-1) config.i18n.glibcLocales);

    environment.sessionVariables =
      { LANG = config.i18n.defaultLocale;
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -334,6 +334,7 @@
  ./services/games/minecraft-server.nix
  ./services/games/minetest-server.nix
  ./services/games/openarena.nix
+  ./services/games/teeworlds.nix
  ./services/games/terraria.nix
  ./services/hardware/acpid.nix
  ./services/hardware/actkbd.nix
--- a/nixos/modules/programs/ssmtp.nix
+++ b/nixos/modules/programs/ssmtp.nix
@ -21,9 +21,11 @@ in
    (mkRenamedOptionModule [ "networking" "defaultMailServer" "useTLS" ] [ "services" "ssmtp" "useTLS" ])
    (mkRenamedOptionModule [ "networking" "defaultMailServer" "useSTARTTLS" ] [ "services" "ssmtp" "useSTARTTLS" ])
    (mkRenamedOptionModule [ "networking" "defaultMailServer" "authUser" ] [ "services" "ssmtp" "authUser" ])
-    (mkRenamedOptionModule [ "networking" "defaultMailServer" "authPass" ] [ "services" "ssmtp" "authPass" ])
    (mkRenamedOptionModule [ "networking" "defaultMailServer" "authPassFile" ] [ "services" "ssmtp" "authPassFile" ])
    (mkRenamedOptionModule [ "networking" "defaultMailServer" "setSendmail" ] [ "services" "ssmtp" "setSendmail" ])
+
+    (mkRemovedOptionModule [ "networking" "defaultMailServer" "authPass" ] "authPass has been removed since it leaks the clear-text password into the world-readable store. Use authPassFile instead and make sure it's not a store path")
+    (mkRemovedOptionModule [ "services" "ssmtp" "authPass" ] "authPass has been removed since it leaks the clear-text password into the world-readable store. Use authPassFile instead and make sure it's not a store path")
  ];

  options = {
@ -45,6 +47,21 @@ in
        '';
      };

+      settings = mkOption {
+        type = with types; attrsOf (oneOf [ bool str ]);
+        default = {};
+        description = ''
+          <citerefentry><refentrytitle>ssmtp</refentrytitle><manvolnum>5</manvolnum></citerefentry> configuration. Refer
+          to <link xlink:href="https://linux.die.net/man/5/ssmtp.conf"/> for details on supported values.
+        '';
+        example = literalExample ''
+          {
+            Debug = true;
+            FromLineOverride = false;
+          }
+        '';
+      };
+
      hostName = mkOption {
        type = types.str;
        example = "mail.example.org";
@ -101,18 +118,6 @@ in
        '';
      };

-      authPass = mkOption {
-        type = types.str;
-        default = "";
-        example = "correctHorseBatteryStaple";
-        description = ''
-          Password used for SMTP auth. (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
-
-          It's recommended to use <option>authPassFile</option>
-          which takes precedence over <option>authPass</option>.
-        '';
-      };
-
      authPassFile = mkOption {
        type = types.nullOr types.str;
        default = null;
@ -121,11 +126,6 @@ in
          Path to a file that contains the password used for SMTP auth. The file
          should not contain a trailing newline, if the password does not contain one.
          This file should be readable by the users that need to execute ssmtp.
-
-          <option>authPassFile</option> takes precedence over <option>authPass</option>.
-
-          Warning: when <option>authPass</option> is non-empty <option>authPassFile</option>
-          defaults to a file in the WORLD-READABLE Nix store containing that password.
        '';
      };

@ -142,25 +142,28 @@ in

  config = mkIf cfg.enable {

-    services.ssmtp.authPassFile = mkIf (cfg.authPass != "")
-      (mkDefault (toString (pkgs.writeTextFile {
-        name = "ssmtp-authpass";
-        text = cfg.authPass;
-      })));
+    services.ssmtp.settings = mkMerge [
+      ({
+        MailHub = cfg.hostName;
+        FromLineOverride = mkDefault true;
+        UseTLS = cfg.useTLS;
+        UseSTARTTLS = cfg.useSTARTTLS;
+      })
+      (mkIf (cfg.root != "") { root = cfg.root; })
+      (mkIf (cfg.domain != "") { rewriteDomain = cfg.domain; })
+      (mkIf (cfg.authUser != "") { AuthUser = cfg.authUser; })
+      (mkIf (cfg.authPassFile != null) { AuthPassFile = cfg.authPassFile; })
+    ];

-    environment.etc."ssmtp/ssmtp.conf".text =
-      let yesNo = yes : if yes then "YES" else "NO"; in
-      ''
-        MailHub=${cfg.hostName}
-        FromLineOverride=YES
-        ${optionalString (cfg.root   != "") "root=${cfg.root}"}
-        ${optionalString (cfg.domain != "") "rewriteDomain=${cfg.domain}"}
-        UseTLS=${yesNo cfg.useTLS}
-        UseSTARTTLS=${yesNo cfg.useSTARTTLS}
-        #Debug=YES
-        ${optionalString (cfg.authUser != "")       "AuthUser=${cfg.authUser}"}
-        ${optionalString (cfg.authPassFile != null) "AuthPassFile=${cfg.authPassFile}"}
-      '';
+    environment.etc."ssmtp/ssmtp.conf".source =
+      let
+        toStr = value:
+          if value == true then "YES"
+          else if value == false then "NO"
+          else builtins.toString value
+        ;
+      in
+        pkgs.writeText "ssmtp.conf" (concatStringsSep "\n" (mapAttrsToList (key: value: "${key}=${toStr value}") cfg.settings));

    environment.systemPackages = [pkgs.ssmtp];

--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@ -218,6 +218,7 @@ in
      description = "Redis database user";
      isSystemUser = true;
    };
+    users.groups.redis = {};

    environment.systemPackages = [ cfg.package ];

@ -240,6 +241,7 @@ in
        StateDirectory = "redis";
        Type = "notify";
        User = "redis";
+        Group = "redis";
      };
    };
  };
--- a/nixos/modules/services/games/teeworlds.nix
+++ b/nixos/modules/services/games/teeworlds.nix
@ -0,0 +1,119 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.teeworlds;
+  register = cfg.register;
+
+  teeworldsConf = pkgs.writeText "teeworlds.cfg" ''
+    sv_port ${toString cfg.port}
+    sv_register ${if cfg.register then "1" else "0"}
+    ${optionalString (cfg.name != null) "sv_name ${cfg.name}"}
+    ${optionalString (cfg.motd != null) "sv_motd ${cfg.motd}"}
+    ${optionalString (cfg.password != null) "password ${cfg.password}"}
+    ${optionalString (cfg.rconPassword != null) "sv_rcon_password ${cfg.rconPassword}"}
+    ${concatStringsSep "\n" cfg.extraOptions}
+  '';
+
+in
+{
+  options = {
+    services.teeworlds = {
+      enable = mkEnableOption "Teeworlds Server";
+
+      openPorts = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to open firewall ports for Teeworlds";
+      };
+
+      name = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Name of the server. Defaults to 'unnamed server'.
+        '';
+      };
+
+      register = mkOption {
+        type = types.bool;
+        example = true;
+        default = false;
+        description = ''
+          Whether the server registers as public server in the global server list. This is disabled by default because of privacy.
+        '';
+      };
+
+      motd = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Set the server message of the day text.
+        '';
+      };
+
+      password = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Password to connect to the server.
+        '';
+      };
+
+      rconPassword = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Password to access the remote console. If not set, a randomly generated one is displayed in the server log.
+        '';
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8303;
+        description = ''
+          Port the server will listen on.
+        '';
+      };
+
+      extraOptions = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Extra configuration lines for the <filename>teeworlds.cfg</filename>. See <link xlink:href="https://www.teeworlds.com/?page=docs&amp;wiki=server_settings">Teeworlds Documentation</link>.
+        '';
+        example = [ "sv_map dm1" "sv_gametype dm" ];
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf cfg.openPorts {
+      allowedUDPPorts = [ cfg.port ];
+    };
+
+    systemd.services.teeworlds = {
+      description = "Teeworlds Server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${pkgs.teeworlds}/bin/teeworlds_srv -f ${teeworldsConf}";
+
+        # Hardening
+        CapabilityBoundingSet = false;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -21,6 +21,7 @@ let
  #  `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`

  exporterOpts = genAttrs [
+    "apcupsd"
    "bind"
    "blackbox"
    "collectd"
@ -28,6 +29,8 @@ let
    "dovecot"
    "fritzbox"
    "json"
+    "keylight"
+    "lnd"
    "mail"
    "mikrotik"
    "minio"
--- a/nixos/modules/services/monitoring/prometheus/exporters/apcupsd.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/apcupsd.nix
@ -0,0 +1,38 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.apcupsd;
+in
+{
+  port = 9162;
+  extraOpts = {
+    apcupsdAddress = mkOption {
+      type = types.str;
+      default = ":3551";
+      description = ''
+        Address of the apcupsd Network Information Server (NIS).
+      '';
+    };
+
+    apcupsdNetwork = mkOption {
+      type = types.enum ["tcp" "tcp4" "tcp6"];
+      default = "tcp";
+      description = ''
+        Network of the apcupsd Network Information Server (NIS): one of "tcp", "tcp4", or "tcp6".
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-apcupsd-exporter}/bin/apcupsd_exporter \
+          -telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
+          -apcupsd.addr ${cfg.apcupsdAddress} \
+          -apcupsd.network ${cfg.apcupsdNetwork} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters/keylight.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/keylight.nix
@ -0,0 +1,19 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.keylight;
+in
+{
+  port = 9288;
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-keylight-exporter}/bin/keylight_exporter \
+          -metrics.addr ${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters/lnd.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/lnd.nix
@ -0,0 +1,46 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.lnd;
+in
+{
+  port = 9092;
+  extraOpts = {
+    lndHost = mkOption {
+      type = types.str;
+      default = "localhost:10009";
+      description = ''
+        lnd instance gRPC address:port.
+      '';
+    };
+
+    lndTlsPath = mkOption {
+      type = types.path;
+      description = ''
+        Path to lnd TLS certificate.
+      '';
+    };
+
+    lndMacaroonDir = mkOption {
+      type = types.path;
+      description = ''
+        Path to lnd macaroons.
+      '';
+    };
+  };
+  serviceOpts.serviceConfig = {
+    ExecStart = ''
+      ${pkgs.prometheus-lnd-exporter}/bin/lndmon \
+        --prometheus.listenaddr=${cfg.listenAddress}:${toString cfg.port} \
+        --prometheus.logdir=/var/log/prometheus-lnd-exporter \
+        --lnd.host=${cfg.lndHost} \
+        --lnd.tlspath=${cfg.lndTlsPath} \
+        --lnd.macaroondir=${cfg.lndMacaroonDir} \
+        ${concatStringsSep " \\\n  " cfg.extraFlags}
+    '';
+    LogsDirectory = "prometheus-lnd-exporter";
+    ReadOnlyPaths = [ cfg.lndTlsPath cfg.lndMacaroonDir ];
+  };
+}
--- a/nixos/modules/services/network-filesystems/ipfs.nix
+++ b/nixos/modules/services/network-filesystems/ipfs.nix
@ -1,69 +1,17 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, options, ... }:
 with lib;
 let
-  inherit (pkgs) ipfs runCommand makeWrapper;
-
  cfg = config.services.ipfs;
+  opt = options.services.ipfs;

  ipfsFlags = toString ([
    (optionalString  cfg.autoMount                   "--mount")
-    #(optionalString  cfg.autoMigrate                 "--migrate")
    (optionalString  cfg.enableGC                    "--enable-gc")
    (optionalString (cfg.serviceFdlimit != null)     "--manage-fdlimit=false")
    (optionalString (cfg.defaultMode == "offline")   "--offline")
    (optionalString (cfg.defaultMode == "norouting") "--routing=none")
  ] ++ cfg.extraFlags);

-  defaultDataDir = if versionAtLeast config.system.stateVersion "17.09" then
-    "/var/lib/ipfs" else
-    "/var/lib/ipfs/.ipfs";
-
-  # Wrapping the ipfs binary with the environment variable IPFS_PATH set to dataDir because we can't set it in the user environment
-  wrapped = runCommand "ipfs" { buildInputs = [ makeWrapper ]; preferLocalBuild = true; } ''
-    mkdir -p "$out/bin"
-    makeWrapper "${ipfs}/bin/ipfs" "$out/bin/ipfs" \
-      --set IPFS_PATH ${cfg.dataDir} \
-      --prefix PATH : /run/wrappers/bin
-  '';
-
-
-  commonEnv = {
-    environment.IPFS_PATH = cfg.dataDir;
-    path = [ wrapped ];
-    serviceConfig.User = cfg.user;
-    serviceConfig.Group = cfg.group;
-  };
-
-  baseService = recursiveUpdate commonEnv {
-    wants = [ "ipfs-init.service" ];
-    # NB: migration must be performed prior to pre-start, else we get the failure message!
-    preStart = optionalString cfg.autoMount ''
-      ipfs --local config Mounts.FuseAllowOther --json true
-      ipfs --local config Mounts.IPFS ${cfg.ipfsMountDir}
-      ipfs --local config Mounts.IPNS ${cfg.ipnsMountDir}
-    '' + concatStringsSep "\n" (collect
-          isString
-          (mapAttrsRecursive
-            (path: value:
-            # Using heredoc below so that the value is never improperly quoted
-            ''
-              read value <<EOF
-              ${builtins.toJSON value}
-              EOF
-              ipfs --local config --json "${concatStringsSep "." path}" "$value"
-            '')
-            ({ Addresses.API = cfg.apiAddress;
-               Addresses.Gateway = cfg.gatewayAddress;
-               Addresses.Swarm = cfg.swarmAddress;
-            } //
-            cfg.extraConfig))
-        );
-    serviceConfig = {
-      ExecStart = "${wrapped}/bin/ipfs daemon ${ipfsFlags}";
-      Restart = "on-failure";
-      RestartSec = 1;
-    } // optionalAttrs (cfg.serviceFdlimit != null) { LimitNOFILE = cfg.serviceFdlimit; };
-  };
 in {

  ###### interface
@ -88,7 +36,9 @@ in {

      dataDir = mkOption {
        type = types.str;
-        default = defaultDataDir;
+        default = if versionAtLeast config.system.stateVersion "17.09"
+                  then "/var/lib/ipfs"
+                  else "/var/lib/ipfs/.ipfs";
        description = "The data dir for IPFS";
      };

@ -98,18 +48,6 @@ in {
        description = "systemd service that is enabled by default";
      };

-      /*
-      autoMigrate = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether IPFS should try to migrate the file system automatically.
-
-          The daemon will need to be able to download a binary from https://ipfs.io to perform the migration.
-        '';
-      };
-      */
-
      autoMount = mkOption {
        type = types.bool;
        default = false;
@ -199,13 +137,21 @@ in {
        example = 64*1024;
      };

+      startWhenNeeded = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to use socket activation to start IPFS when needed.";
+      };
+
    };
  };

  ###### implementation

  config = mkIf cfg.enable {
-    environment.systemPackages = [ wrapped ];
+    environment.systemPackages = [ pkgs.ipfs ];
+    environment.variables.IPFS_PATH = cfg.dataDir;
+
    programs.fuse = mkIf cfg.autoMount {
      userAllowOther = true;
    };
@ -234,10 +180,14 @@ in {
      "d '${cfg.ipnsMountDir}' - ${cfg.user} ${cfg.group} - -"
    ];

-    systemd.services.ipfs-init = recursiveUpdate commonEnv {
+    systemd.packages = [ pkgs.ipfs ];
+
+    systemd.services.ipfs-init = {
      description = "IPFS Initializer";

-      before = [ "ipfs.service" "ipfs-offline.service" "ipfs-norouting.service" ];
+      environment.IPFS_PATH = cfg.dataDir;
+
+      path = [ pkgs.ipfs ];

      script = ''
        if [[ ! -f ${cfg.dataDir}/config ]]; then
@ -251,34 +201,63 @@ in {
        fi
      '';

+      wantedBy = [ "default.target" ];
+
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
+        User = cfg.user;
+        Group = cfg.group;
      };
    };

-    # TODO These 3 definitions possibly be further abstracted through use of a function
-    # like: mutexServices "ipfs" [ "", "offline", "norouting" ] { ... shared conf here ... }
+    systemd.services.ipfs = {
+      path = [ "/run/wrappers" pkgs.ipfs ];
+      environment.IPFS_PATH = cfg.dataDir;

-    systemd.services.ipfs = recursiveUpdate baseService {
-      description = "IPFS Daemon";
-      wantedBy = mkIf (cfg.defaultMode == "online") [ "multi-user.target" ];
-      after = [ "network.target" "ipfs-init.service" ];
-      conflicts = [ "ipfs-offline.service" "ipfs-norouting.service"];
+      wants = [ "ipfs-init.service" ];
+      after = [ "ipfs-init.service" ];
+
+      preStart = optionalString cfg.autoMount ''
+        ipfs --local config Mounts.FuseAllowOther --json true
+        ipfs --local config Mounts.IPFS ${cfg.ipfsMountDir}
+        ipfs --local config Mounts.IPNS ${cfg.ipnsMountDir}
+      '' + concatStringsSep "\n" (collect
+            isString
+            (mapAttrsRecursive
+              (path: value:
+              # Using heredoc below so that the value is never improperly quoted
+              ''
+                read value <<EOF
+                ${builtins.toJSON value}
+                EOF
+                ipfs --local config --json "${concatStringsSep "." path}" "$value"
+              '')
+              ({ Addresses.API = cfg.apiAddress;
+                 Addresses.Gateway = cfg.gatewayAddress;
+                 Addresses.Swarm = cfg.swarmAddress;
+              } //
+              cfg.extraConfig))
+          );
+      serviceConfig = {
+        ExecStart = ["" "${pkgs.ipfs}/bin/ipfs daemon ${ipfsFlags}"];
+        User = cfg.user;
+        Group = cfg.group;
+      } // optionalAttrs (cfg.serviceFdlimit != null) { LimitNOFILE = cfg.serviceFdlimit; };
+    } // optionalAttrs (!cfg.startWhenNeeded) {
+      wantedBy = [ "default.target" ];
    };

-    systemd.services.ipfs-offline = recursiveUpdate baseService {
-      description = "IPFS Daemon (offline mode)";
-      wantedBy = mkIf (cfg.defaultMode == "offline") [ "multi-user.target" ];
-      after = [ "ipfs-init.service" ];
-      conflicts = [ "ipfs.service" "ipfs-norouting.service"];
+    systemd.sockets.ipfs-gateway = {
+      wantedBy = [ "sockets.target" ];
+      socketConfig.ListenStream = [ "" ]
+        ++ lib.optional (cfg.gatewayAddress == opt.gatewayAddress.default) [ "127.0.0.1:8080" "[::1]:8080" ];
    };

-    systemd.services.ipfs-norouting = recursiveUpdate baseService {
-      description = "IPFS Daemon (no routing mode)";
-      wantedBy = mkIf (cfg.defaultMode == "norouting") [ "multi-user.target" ];
-      after = [ "ipfs-init.service" ];
-      conflicts = [ "ipfs.service" "ipfs-offline.service"];
+    systemd.sockets.ipfs-api = {
+      wantedBy = [ "sockets.target" ];
+      socketConfig.ListenStream = [ "" "%t/ipfs.sock" ]
+        ++ lib.optional (cfg.apiAddress == opt.apiAddress.default) [ "127.0.0.1:5001" "[::1]:5001" ];
    };

  };
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -246,7 +246,7 @@ in
      videoDrivers = mkOption {
        type = types.listOf types.str;
        # !!! We'd like "nv" here, but it segfaults the X server.
-        default = [ "radeon" "cirrus" "vesa" "vmware" "modesetting" ];
+        default = [ "radeon" "cirrus" "vesa" "modesetting" ];
        example = [
          "ati_unfree" "amdgpu" "amdgpu-pro"
          "nv" "nvidia" "nvidiaLegacy390" "nvidiaLegacy340" "nvidiaLegacy304"
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@ -232,18 +232,22 @@ let
              '';
            preStop = ''
              state="/run/nixos/network/routes/${i.name}"
-              while read cidr; do
-                echo -n "deleting route $cidr... "
-                ip route del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
-              done < "$state"
-              rm -f "$state"
+              if [ -e "$state" ]; then
+                while read cidr; do
+                  echo -n "deleting route $cidr... "
+                  ip route del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
+                done < "$state"
+                rm -f "$state"
+              fi

              state="/run/nixos/network/addresses/${i.name}"
-              while read cidr; do
-                echo -n "deleting address $cidr... "
-                ip addr del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
-              done < "$state"
-              rm -f "$state"
+              if [ -e "$state" ]; then
+                while read cidr; do
+                  echo -n "deleting address $cidr... "
+                  ip addr del "$cidr" dev "${i.name}" >/dev/null 2>&1 && echo "done" || echo "failed"
+                done < "$state"
+                rm -f "$state"
+              fi
            '';
          };

--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -15,7 +15,6 @@ in
  ###### interface

  options = {
-
    virtualisation.lxd = {
      enable = mkOption {
        type = types.bool;
@ -25,12 +24,18 @@ in
          containers. Users in the "lxd" group can interact with
          the daemon (e.g. to start or stop containers) using the
          <command>lxc</command> command line tool, among others.
+
+          Most of the time, you'll also want to start lxcfs, so
+          that containers can "see" the limits:
+          <code>
+            virtualisation.lxc.lxcfs.enable = true;
+          </code>
        '';
      };

      package = mkOption {
        type = types.package;
-        default = pkgs.lxd;
+        default = pkgs.lxd.override { nftablesSupport = config.networking.nftables.enable; };
        defaultText = "pkgs.lxd";
        description = ''
          The LXD package to use.
@ -65,6 +70,7 @@ in
          with nixos.
        '';
      };
+
      recommendedSysctlSettings = mkOption {
        type = types.bool;
        default = false;
@ -83,7 +89,6 @@ in
  ###### implementation

  config = mkIf cfg.enable {
-
    environment.systemPackages = [ cfg.package ];

    security.apparmor = {
@ -115,6 +120,12 @@ in
        LimitNOFILE = "1048576";
        LimitNPROC = "infinity";
        TasksMax = "infinity";
+
+        # By default, `lxd` loads configuration files from hard-coded
+        # `/usr/share/lxc/config` - since this is a no-go for us, we have to
+        # explicitly tell it where the actual configuration files are
+        Environment = mkIf (config.virtualisation.lxc.lxcfs.enable)
+          "LXD_LXC_TEMPLATE_CONFIG=${pkgs.lxcfs}/share/lxc/config";
      };
    };

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -178,6 +178,8 @@ in
  limesurvey = handleTest ./limesurvey.nix {};
  login = handleTest ./login.nix {};
  loki = handleTest ./loki.nix {};
+  lxd = handleTest ./lxd.nix {};
+  lxd-nftables = handleTest ./lxd-nftables.nix {};
  #logstash = handleTest ./logstash.nix {};
  lorri = handleTest ./lorri/default.nix {};
  magnetico = handleTest ./magnetico.nix {};
--- a/nixos/tests/ipfs.nix
+++ b/nixos/tests/ipfs.nix
@ -21,5 +21,12 @@ import ./make-test-python.nix ({ pkgs, ...} : {
    )

    machine.succeed(f"ipfs cat /ipfs/{ipfs_hash.strip()} | grep fnord")
+
+    ipfs_hash = machine.succeed(
+        "echo fnord2 | ipfs --api /unix/run/ipfs.sock add | awk '{ print $2 }'"
+    )
+    machine.succeed(
+        f"ipfs --api /unix/run/ipfs.sock cat /ipfs/{ipfs_hash.strip()} | grep fnord2"
+    )
  '';
 })
--- a/nixos/tests/lxd-nftables.nix
+++ b/nixos/tests/lxd-nftables.nix
@ -0,0 +1,50 @@
+# This test makes sure that lxd stops implicitly depending on iptables when
+# user enabled nftables.
+#
+# It has been extracted from `lxd.nix` for clarity, and because switching from
+# iptables to nftables requires a full reboot, which is a bit hard inside NixOS
+# tests.
+
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "lxd-nftables";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ patryk27 ];
+  };
+
+  machine = { lib, ... }: {
+    virtualisation = {
+      lxd.enable = true;
+    };
+
+    networking = {
+      firewall.enable = false;
+      nftables.enable = true;
+      nftables.ruleset = ''
+        table inet filter {
+          chain incoming {
+            type filter hook input priority 0;
+            policy accept;
+          }
+
+          chain forward {
+            type filter hook forward priority 0;
+            policy accept;
+          }
+
+          chain output {
+            type filter hook output priority 0;
+            policy accept;
+          }
+        }
+      '';
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("network.target")
+
+    with subtest("When nftables are enabled, lxd doesn't depend on iptables anymore"):
+        machine.succeed("lsmod | grep nf_tables")
+        machine.fail("lsmod | grep ip_tables")
+  '';
+})
--- a/nixos/tests/lxd.nix
+++ b/nixos/tests/lxd.nix
@ -0,0 +1,135 @@
+import ./make-test-python.nix ({ pkgs, ...} :
+
+let
+  # Since we don't have access to the internet during the tests, we have to
+  # pre-fetch lxd containers beforehand.
+  #
+  # I've chosen to import Alpine Linux, because its image is turbo-tiny and,
+  # generally, sufficient for our tests.
+
+  alpine-meta = pkgs.fetchurl {
+    url = "https://uk.images.linuxcontainers.org/images/alpine/3.11/i386/default/20200608_13:00/lxd.tar.xz";
+    sha256 = "1hkvaj3rr333zmx1759njy435lps33gl4ks8zfm7m4nqvipm26a0";
+  };
+
+  alpine-rootfs = pkgs.fetchurl {
+    url = "https://uk.images.linuxcontainers.org/images/alpine/3.11/i386/default/20200608_13:00/rootfs.tar.xz";
+    sha256 = "1v82zdra4j5xwsff09qlp7h5vbsg54s0j7rdg4rynichfid3r347";
+  };
+
+  lxd-config = pkgs.writeText "config.yaml" ''
+    storage_pools:
+      - name: default
+        driver: dir
+        config:
+          source: /var/lxd-pool
+
+    networks:
+      - name: lxdbr0
+        type: bridge
+        config:
+          ipv4.address: auto
+          ipv6.address: none
+
+    profiles:
+      - name: default
+        devices:
+          eth0:
+            name: eth0
+            network: lxdbr0
+            type: nic
+          root:
+            path: /
+            pool: default
+            type: disk
+  '';
+
+in {
+  name = "lxd";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ patryk27 ];
+  };
+
+  machine = { lib, ... }: {
+    virtualisation = {
+      # Since we're testing `limits.cpu`, we've gotta have a known number of
+      # cores to lay on
+      cores = 2;
+
+      # Ditto, for `limits.memory`
+      memorySize = 512;
+
+      lxc.lxcfs.enable = true;
+      lxd.enable = true;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("lxd.service")
+
+    # It takes additional second for lxd to settle
+    machine.sleep(1)
+
+    # lxd expects the pool's directory to already exist
+    machine.succeed("mkdir /var/lxd-pool")
+
+    machine.succeed(
+        "cat ${lxd-config} | lxd init --preseed"
+    )
+
+    machine.succeed(
+        "lxc image import ${alpine-meta} ${alpine-rootfs} --alias alpine"
+    )
+
+    with subtest("Containers can be launched and destroyed"):
+        machine.succeed("lxc launch alpine test")
+        machine.succeed("lxc exec test true")
+        machine.succeed("lxc delete -f test")
+
+    with subtest("Containers are being mounted with lxcfs inside"):
+        machine.succeed("lxc launch alpine test")
+
+        ## ---------- ##
+        ## limits.cpu ##
+
+        machine.succeed("lxc config set test limits.cpu 1")
+
+        # Since Alpine doesn't have `nproc` pre-installed, we've gotta resort
+        # to the primal methods
+        assert (
+            "1"
+            == machine.succeed("lxc exec test grep -- -c ^processor /proc/cpuinfo").strip()
+        )
+
+        machine.succeed("lxc config set test limits.cpu 2")
+
+        assert (
+            "2"
+            == machine.succeed("lxc exec test grep -- -c ^processor /proc/cpuinfo").strip()
+        )
+
+        ## ------------- ##
+        ## limits.memory ##
+
+        machine.succeed("lxc config set test limits.memory 64MB")
+
+        assert (
+            "MemTotal:          62500 kB"
+            == machine.succeed("lxc exec test grep -- MemTotal /proc/meminfo").strip()
+        )
+
+        machine.succeed("lxc config set test limits.memory 128MB")
+
+        assert (
+            "MemTotal:         125000 kB"
+            == machine.succeed("lxc exec test grep -- MemTotal /proc/meminfo").strip()
+        )
+
+        machine.succeed("lxc delete -f test")
+
+    with subtest("Unless explicitly changed, lxd leans on iptables"):
+        machine.succeed("lsmod | grep ip_tables")
+        machine.fail("lsmod | grep nf_tables")
+  '';
+})
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -56,6 +56,21 @@ let
 */

  exporterTests = {
+     apcupsd = {
+      exporterConfig = {
+        enable = true;
+      };
+      metricProvider = {
+        services.apcupsd.enable = true;
+      };
+      exporterTest = ''
+        wait_for_unit("apcupsd.service")
+        wait_for_open_port(3551)
+        wait_for_unit("prometheus-apcupsd-exporter.service")
+        wait_for_open_port(9162)
+        succeed("curl -sSf http://localhost:9162/metrics | grep -q 'apcupsd_info'")
+      '';
+    };

    bind = {
      exporterConfig = {
@ -202,6 +217,69 @@ let
      '';
    };

+    keylight = {
+      # A hardware device is required to properly test this exporter, so just
+      # perform a couple of basic sanity checks that the exporter is running
+      # and requires a target, but cannot reach a specified target.
+      exporterConfig = {
+        enable = true;
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-keylight-exporter.service")
+        wait_for_open_port(9288)
+        succeed(
+            "curl -sS --write-out '%{http_code}' -o /dev/null http://localhost:9288/metrics | grep -q '400'"
+        )
+        succeed(
+            "curl -sS --write-out '%{http_code}' -o /dev/null http://localhost:9288/metrics?target=nosuchdevice | grep -q '500'"
+        )
+      '';
+    };
+
+    lnd = {
+      exporterConfig = {
+        enable = true;
+        lndTlsPath = "/var/lib/lnd/tls.cert";
+        lndMacaroonDir = "/var/lib/lnd";
+      };
+      metricProvider = {
+        systemd.services.prometheus-lnd-exporter.serviceConfig.DynamicUser = false;
+        services.bitcoind.enable = true;
+        services.bitcoind.extraConfig = ''
+          rpcauth=bitcoinrpc:e8fe33f797e698ac258c16c8d7aadfbe$872bdb8f4d787367c26bcfd75e6c23c4f19d44a69f5d1ad329e5adf3f82710f7
+          bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332
+          bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333
+        '';
+        systemd.services.lnd = {
+          serviceConfig.ExecStart = ''
+          ${pkgs.lnd}/bin/lnd \
+            --datadir=/var/lib/lnd \
+            --tlscertpath=/var/lib/lnd/tls.cert \
+            --tlskeypath=/var/lib/lnd/tls.key \
+            --logdir=/var/log/lnd \
+            --bitcoin.active \
+            --bitcoin.mainnet \
+            --bitcoin.node=bitcoind \
+            --bitcoind.rpcuser=bitcoinrpc \
+            --bitcoind.rpcpass=hunter2 \
+            --bitcoind.zmqpubrawblock=tcp://127.0.0.1:28332 \
+            --bitcoind.zmqpubrawtx=tcp://127.0.0.1:28333 \
+            --readonlymacaroonpath=/var/lib/lnd/readonly.macaroon
+          '';
+          serviceConfig.StateDirectory = "lnd";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("lnd.service")
+        wait_for_open_port(10009)
+        wait_for_unit("prometheus-lnd-exporter.service")
+        wait_for_open_port(9092)
+        succeed("curl -sSf localhost:9092/metrics | grep -q '^promhttp_metric_handler'")
+      '';
+    };
+
    mail = {
      exporterConfig = {
        enable = true;
--- a/nixos/tests/teeworlds.nix
+++ b/nixos/tests/teeworlds.nix
@ -0,0 +1,55 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  client =
+    { pkgs, ... }:
+
+    { imports = [ ./common/x11.nix ];
+      environment.systemPackages = [ pkgs.teeworlds ];
+    };
+
+in {
+  name = "teeworlds";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ hax404 ];
+  };
+
+  nodes =
+    { server =
+      { services.teeworlds = {
+          enable = true;
+          openPorts = true;
+        };
+      };
+
+      client1 = client;
+      client2 = client;
+    };
+
+    testScript =
+    ''
+      start_all()
+
+      server.wait_for_unit("teeworlds.service")
+      server.wait_until_succeeds("ss --numeric --udp --listening | grep -q 8303")
+
+      client1.wait_for_x()
+      client2.wait_for_x()
+
+      client1.execute("teeworlds 'player_name Alice;connect server'&")
+      server.wait_until_succeeds(
+          'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Alice"'
+      )
+
+      client2.execute("teeworlds 'player_name Bob;connect server'&")
+      server.wait_until_succeeds(
+          'journalctl -u teeworlds -e | grep --extended-regexp -q "team_join player=\'[0-9]:Bob"'
+      )
+
+      server.sleep(10)  # wait for a while to get a nice screenshot
+
+      client1.screenshot("screen_client1")
+      client2.screenshot("screen_client2")
+    '';
+
+})
--- a/pkgs/applications/audio/amarok/default.nix
+++ b/pkgs/applications/audio/amarok/default.nix
@ -3,7 +3,7 @@
 , qca-qt5, qjson, qtquickcontrols2, qtscript, qtwebengine
 , karchive, kcmutils, kconfig, kdnssd, kguiaddons, kinit, kirigami2, knewstuff, knotifyconfig, ktexteditor, kwindowsystem
 , fftw, phonon, plasma-framework, threadweaver
-, curl, ffmpeg, gdk-pixbuf, libaio, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
+, curl, ffmpeg_3, gdk-pixbuf, libaio, libmtp, loudmouth, lzo, lz4, mysql57, pcre, snappy, taglib, taglib_extras
 }:

 mkDerivation rec {
@ -26,7 +26,7 @@ mkDerivation rec {
    qca-qt5 qjson qtquickcontrols2 qtscript qtwebengine
    karchive kcmutils kconfig kdnssd kguiaddons kinit kirigami2 knewstuff knotifyconfig ktexteditor kwindowsystem
    phonon plasma-framework threadweaver
-    curl fftw ffmpeg gdk-pixbuf libaio libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
+    curl fftw ffmpeg_3 gdk-pixbuf libaio libmtp loudmouth lz4 lzo mysql57.server mysql57.server.static
    pcre snappy taglib taglib_extras
  ];

--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@ -8,7 +8,7 @@
 , curl
 , dbus
 , doxygen
-, ffmpeg
+, ffmpeg_3
 , fftw
 , fftwSinglePrec
 , flac
@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
    cppunit
    curl
    dbus
-    ffmpeg
+    ffmpeg_3
    fftw
    fftwSinglePrec
    flac
@ -149,8 +149,8 @@ stdenv.mkDerivation rec {
    sed 's|/usr/include/libintl.h|${glibc.dev}/include/libintl.h|' -i wscript
    patchShebangs ./tools/
    substituteInPlace libs/ardour/video_tools_paths.cc \
-      --replace 'ffmpeg_exe = X_("");' 'ffmpeg_exe = X_("${ffmpeg}/bin/ffmpeg");' \
-      --replace 'ffprobe_exe = X_("");' 'ffprobe_exe = X_("${ffmpeg}/bin/ffprobe");'
+      --replace 'ffmpeg_exe = X_("");' 'ffmpeg_exe = X_("${ffmpeg_3}/bin/ffmpeg");' \
+      --replace 'ffprobe_exe = X_("");' 'ffprobe_exe = X_("${ffmpeg_3}/bin/ffprobe");'
  '';

  postInstall = ''
--- a/pkgs/applications/audio/artyFX/default.nix
+++ b/pkgs/applications/audio/artyFX/default.nix
@ -2,13 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "artyFX";
-  version = "1.3";
+  # Fix build with lv2 1.18: https://github.com/openAVproductions/openAV-ArtyFX/pull/41/commits/492587461b50d140455aa3c98d915eb8673bebf0
+  version = "unstable-2020-04-28";

  src = fetchFromGitHub {
    owner = "openAVproductions";
    repo = "openAV-ArtyFX";
-    rev = "release-${version}";
-    sha256 = "012hcy1mxl7gs2lipfcqp5x0xv1azb9hjrwf0h59yyxnzx96h7c9";
+    rev = "492587461b50d140455aa3c98d915eb8673bebf0";
+    sha256 = "0wwg8ivnpyy0235bapjy4g0ij85zq355jwi6c1nkrac79p4z9ail";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/audacious/default.nix
+++ b/pkgs/applications/audio/audacious/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, wrapGAppsHook, gettext, glib, gtk3
 , libmowgli, dbus-glib, libxml2, xorg, gnome3, alsaLib
 , libpulseaudio, libjack2, fluidsynth, libmad, libogg, libvorbis
-, libcdio, libcddb, flac, ffmpeg, mpg123, libcue, libmms, libbs2b
+, libcdio, libcddb, flac, ffmpeg_3, mpg123, libcue, libmms, libbs2b
 , libsndfile, libmodplug, libsamplerate, soxr, lirc, curl, wavpack
 , neon, faad2, lame, libnotify, libsidplayfp
 }:
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    gettext glib gtk3 libmowgli dbus-glib libxml2
    xorg.libXcomposite gnome3.adwaita-icon-theme alsaLib libjack2
    libpulseaudio fluidsynth libmad libogg libvorbis libcdio
-    libcddb flac ffmpeg mpg123 libcue libmms libbs2b libsndfile
+    libcddb flac ffmpeg_3 mpg123 libcue libmms libbs2b libsndfile
    libmodplug libsamplerate soxr lirc curl wavpack neon faad2
    lame libnotify libsidplayfp
  ];
--- a/pkgs/applications/audio/audacious/qt-5.nix
+++ b/pkgs/applications/audio/audacious/qt-5.nix
@ -2,7 +2,7 @@
  mkDerivation, lib, fetchurl, fetchpatch,
  gettext, pkgconfig,
  qtbase,
-  alsaLib, curl, faad2, ffmpeg, flac, fluidsynth, gdk-pixbuf, lame, libbs2b,
+  alsaLib, curl, faad2, ffmpeg_3, flac, fluidsynth, gdk-pixbuf, lame, libbs2b,
  libcddb, libcdio, libcue, libjack2, libmad, libmms, libmodplug,
  libmowgli, libnotify, libogg, libpulseaudio, libsamplerate, libsidplayfp,
  libsndfile, libvorbis, libxml2, lirc, mpg123, neon, qtmultimedia, soxr,
@ -45,7 +45,7 @@ mkDerivation {
    qtbase

    # Plugin dependencies
-    alsaLib curl faad2 ffmpeg flac fluidsynth gdk-pixbuf lame libbs2b libcddb
+    alsaLib curl faad2 ffmpeg_3 flac fluidsynth gdk-pixbuf lame libbs2b libcddb
    libcdio libcue libjack2 libmad libmms libmodplug libmowgli
    libnotify libogg libpulseaudio libsamplerate libsidplayfp libsndfile
    libvorbis libxml2 lirc mpg123 neon qtmultimedia soxr wavpack
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchzip, wxGTK30, pkgconfig, file, gettext,
  libvorbis, libmad, libjack2, lv2, lilv, serd, sord, sratom, suil, alsaLib, libsndfile, soxr, flac, lame,
-  expat, libid3tag, ffmpeg, soundtouch, /*, portaudio - given up fighting their portaudio.patch */
+  expat, libid3tag, ffmpeg_3, soundtouch, /*, portaudio - given up fighting their portaudio.patch */
  autoconf, automake, libtool
  }:

@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    file gettext wxGTK30 expat alsaLib
    libsndfile soxr libid3tag libjack2 lv2 lilv serd sord sratom suil wxGTK30.gtk
-    ffmpeg libmad lame libvorbis flac soundtouch
+    ffmpeg_3 libmad lame libvorbis flac soundtouch
  ]; #ToDo: detach sbsms

  enableParallelBuilding = true;
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio1.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio1.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, alsaLib, bzip2, cairo, dpkg, freetype, gdk-pixbuf
 , wrapGAppsHook, gtk2, gtk3, harfbuzz, jdk, lib, xorg
-, libbsd, libjack2, libpng, ffmpeg
+, libbsd, libjack2, libpng, ffmpeg_3
 , libxkbcommon
 , makeWrapper, pixman, autoPatchelfHook
 , xdg_utils, zenity, zlib }:
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
  ];

  binPath = lib.makeBinPath [
-    xdg_utils zenity ffmpeg
+    xdg_utils zenity ffmpeg_3
  ];

  installPhase = ''
--- a/pkgs/applications/audio/bs1770gain/default.nix
+++ b/pkgs/applications/audio/bs1770gain/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ffmpeg, sox }:
+{ stdenv, fetchurl, ffmpeg_3, sox }:

 stdenv.mkDerivation rec {
  pname = "bs1770gain";
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "1p6yz5q7czyf9ard65sp4kawdlkg40cfscr3b24znymmhs3p7rbk";
  };

-  buildInputs = [ ffmpeg sox ];
+  buildInputs = [ ffmpeg_3 sox ];

  NIX_CFLAGS_COMPILE = "-Wno-error";

--- a/pkgs/applications/audio/cantata/default.nix
+++ b/pkgs/applications/audio/cantata/default.nix
@ -10,7 +10,7 @@

 , withTaglib ? true, taglib, taglib_extras
 , withHttpStream ? true, qtmultimedia
-, withReplaygain ? true, ffmpeg, speex, mpg123
+, withReplaygain ? true, ffmpeg_3, speex, mpg123
 , withMtp ? true, libmtp
 , withOnlineServices ? true
 , withDevices ? true, udisks2
@ -50,7 +50,7 @@ in mkDerivation {

  buildInputs = [ qtbase qtsvg ]
    ++ lib.optionals withTaglib [ taglib taglib_extras ]
-    ++ lib.optionals withReplaygain [ ffmpeg speex mpg123 ]
+    ++ lib.optionals withReplaygain [ ffmpeg_3 speex mpg123 ]
    ++ lib.optional  withHttpStream qtmultimedia
    ++ lib.optional  withCdda cdparanoia
    ++ lib.optional  withCddb libcddb
--- a/pkgs/applications/audio/carla/default.nix
+++ b/pkgs/applications/audio/carla/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, alsaLib, file, fluidsynth, ffmpeg, jack2,
+{ stdenv, fetchFromGitHub, alsaLib, file, fluidsynth, ffmpeg_3, jack2,
  liblo, libpulseaudio, libsndfile, pkgconfig, python3Packages,
  which, withFrontend ? true,
  withQt ? true, qtbase ? null, wrapQtAppsHook ? null,
@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null;

 stdenv.mkDerivation rec {
  pname = "carla";
-  version = "2.1";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "falkTX";
    repo = pname;
    rev = "v${version}";
-    sha256 = "074y40yrgl3qrdr3a5vn0scsw0qv77r5p5m6gc89zhf20ic8ajzc";
+    sha256 = "0c3y4a6cgi4bv1mg57i3qn5ia6pqjqlaylvkapj6bmpsw71ig22g";
  };

  nativeBuildInputs = [
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  ] ++ optional withFrontend pyqt5;

  buildInputs = [
-    file liblo alsaLib fluidsynth ffmpeg jack2 libpulseaudio libsndfile
+    file liblo alsaLib fluidsynth ffmpeg_3 jack2 libpulseaudio libsndfile
  ] ++ pythonPath
    ++ optional withQt qtbase
    ++ optional withGtk2 gtk2
--- a/pkgs/applications/audio/deadbeef/default.nix
+++ b/pkgs/applications/audio/deadbeef/default.nix
@ -17,7 +17,7 @@
 , aacSupport ? true, faad2 ? null
 , opusSupport ? true, opusfile ? null
 , wavpackSupport ? false, wavpack ? null
-, ffmpegSupport ? false, ffmpeg ? null
+, ffmpegSupport ? false, ffmpeg_3 ? null
 , apeSupport ? true, yasm ? null
 # misc plugins
 , zipSupport ? true, libzip ? null
@ -45,7 +45,7 @@ assert cdaSupport -> (libcdio != null && libcddb != null);
 assert aacSupport -> faad2 != null;
 assert opusSupport -> opusfile != null;
 assert zipSupport -> libzip != null;
-assert ffmpegSupport -> ffmpeg != null;
+assert ffmpegSupport -> ffmpeg_3 != null;
 assert apeSupport -> yasm != null;
 assert artworkSupport -> imlib2 != null;
 assert hotkeysSupport -> libX11 != null;
@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
    ++ optional aacSupport faad2
    ++ optional opusSupport opusfile
    ++ optional zipSupport libzip
-    ++ optional ffmpegSupport ffmpeg
+    ++ optional ffmpegSupport ffmpeg_3
    ++ optional apeSupport yasm
    ++ optional artworkSupport imlib2
    ++ optional hotkeysSupport libX11
--- a/pkgs/applications/audio/dr14_tmeter/default.nix
+++ b/pkgs/applications/audio/dr14_tmeter/default.nix
@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
  };

  propagatedBuildInputs = with pkgs; [
-    python3Packages.numpy flac vorbis-tools ffmpeg faad2 lame
+    python3Packages.numpy flac vorbis-tools ffmpeg_3 faad2 lame
  ];

  # There are no tests
--- a/pkgs/applications/audio/drumgizmo/default.nix
+++ b/pkgs/applications/audio/drumgizmo/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, alsaLib, expat, glib, libjack2, libXext, libX11, libpng
+{ stdenv, fetchurl, fetchpatch, alsaLib, expat, glib, libjack2, libXext, libX11, libpng
 , libpthreadstubs, libsmf, libsndfile, lv2, pkgconfig, zita-resampler
 }:

@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
    sha256 = "0bpbkzcr3znbwfdk79c14n5k5hh80iqlk2nc03q95vhimbadk8k7";
  };

+  patches = [
+    # Fix build for lv2 1.18.0
+    (fetchpatch {
+      url = "http://cgit.drumgizmo.org/plugingizmo.git/patch/?id=be64ddf9da525cd5c6757464efc966052731ba71";
+      sha256 = "17w8g78i5avssc7m8rpw64ka3rai8dff81wfzir9cpxp8s2h44qf";
+      extraPrefix = "plugin/plugingizmo/";
+      stripLen = 1;
+    })
+  ];
+
  configureFlags = [ "--enable-lv2" ];

  buildInputs = [
--- a/pkgs/applications/audio/eq10q/default.nix
+++ b/pkgs/applications/audio/eq10q/default.nix
@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
    })
  ];

+  postPatch = ''
+     # Fix build with lv2 1.18: https://sourceforge.net/p/eq10q/bugs/23/
+     find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+       -exec sed -i {} -e 's/const _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+   '';
+
  installFlags = [ "DESTDIR=$(out)" ];

  fixupPhase = ''
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@ -20,19 +20,19 @@ with stdenv.lib.strings;

 let

-  version = "unstable-2020-03-20";
+  version = "unstable-2020-06-08";

  src = fetchFromGitHub {
    owner = "grame-cncm";
    repo = "faust";
-    rev = "2782088d4485f1c572755f41e7a072b41cb7148a";
-    sha256 = "1l7bi2mq10s5wm8g4cdipg8gndd478x897qv0h7nqi1s2q9nq99p";
+    rev = "f0037e289987818b65d3f6fb1ad943aaad2a2b28";
+    sha256 = "0h08902rgx7rhzpng4h1qw8i2nzv50f79vrlbzdk5d35wa4zibh4";
    fetchSubmodules = true;
  };

  meta = with stdenv.lib; {
    homepage = "http://faust.grame.fr/";
-    downloadPage = "https://sourceforge.net/projects/faudiostream/files/";
+    downloadPage = "https://github.com/grame-cncm/faust/";
    license = licenses.gpl2;
    platforms = platforms.linux;
    maintainers = with maintainers; [ magnetophon pmahoney ];
--- a/pkgs/applications/audio/faust/faust2jack.nix
+++ b/pkgs/applications/audio/faust/faust2jack.nix
@ -12,7 +12,6 @@ faust.wrapWithBuildEnv {

  scripts = [
    "faust2jack"
-    "faust2jackinternal"
    "faust2jackconsole"
  ];

--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@ -1,8 +1,38 @@
-{ stdenv, fetchurl, fetchpatch, faust, gettext, intltool, pkgconfig, python2
-, avahi, bluez, boost, eigen, fftw, glib, glib-networking
-, glibmm, gsettings-desktop-schemas, gtkmm2, libjack2
-, ladspaH, libav, libsndfile, lilv, lrdf, lv2, serd, sord, sratom
-, wrapGAppsHook, zita-convolver, zita-resampler, curl, wafHook
+{ stdenv
+, fetchurl
+, avahi
+, bluez
+, boost
+, curl
+, eigen
+, fftw
+, gettext
+, glib
+, glib-networking
+, glibmm
+, gnome3
+, gsettings-desktop-schemas
+, gtk3
+, gtkmm3
+, hicolor-icon-theme
+, intltool
+, ladspaH
+, libav
+, libjack2
+, libsndfile
+, lilv
+, lrdf
+, lv2
+, pkgconfig
+, python2
+, sassc
+, serd
+, sord
+, sratom
+, wafHook
+, wrapGAppsHook
+, zita-convolver
+, zita-resampler
 , optimizationSupport ? false # Enable support for native CPU extensions
 }:

@ -12,43 +42,67 @@ in

 stdenv.mkDerivation rec {
  pname = "guitarix";
-  version = "0.39.0";
+  version = "0.40.0";

  src = fetchurl {
    url = "mirror://sourceforge/guitarix/guitarix2-${version}.tar.xz";
-    sha256 = "1nn80m1qagfhvv69za60f0w6ck87vmk77qmqarj7fbr8avwg63s9";
+    sha256 = "0q9050499hcj19hvbxb069vxh5yclawjg04vryh46lxm4sfy9g57";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/guitarix-0.39.0-fix_faust_and_lv2_plugins.patch?id=8579b4dfe85e04303ad2d9771ed699f04ea7b7cf";
-      stripLen = 1;
-      sha256 = "0pgkhi4v4vrzjnig0ggmz207q4x5iyk2n6rjj8s5lv15fia7qzp4";
-    })
-  ];
+  # see: https://sourceforge.net/p/guitarix/bugs/105
+  patches = [ ./fix-build.patch ];

-  nativeBuildInputs = [ faust gettext intltool wrapGAppsHook pkgconfig python2 wafHook ];
+  nativeBuildInputs = [
+    gettext
+    hicolor-icon-theme
+    intltool
+    pkgconfig
+    python2
+    wafHook
+    wrapGAppsHook
+  ];

  buildInputs = [
-    avahi bluez boost eigen fftw glib glibmm glib-networking.out
-    gsettings-desktop-schemas gtkmm2 libjack2 ladspaH libav
-    libsndfile lilv lrdf lv2 serd sord sratom zita-convolver
-    zita-resampler curl
+    avahi
+    bluez
+    boost
+    curl
+    eigen
+    fftw
+    glib
+    glib-networking.out
+    glibmm
+    gnome3.adwaita-icon-theme
+    gsettings-desktop-schemas
+    gtk3
+    gtkmm3
+    ladspaH
+    libav
+    libjack2
+    libsndfile
+    lilv
+    lrdf
+    lv2
+    sassc
+    serd
+    sord
+    sratom
+    zita-convolver
+    zita-resampler
  ];

-  postPatch = ''
-    # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
-    find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
-      -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
-  '';
-
+  # this doesnt build, probably because we have the wrong faust version:
+  #       "--faust"
+  # aproved versions are 2.20.2 and 2.15.11
  wafConfigureFlags = [
+    "--no-faust"
+    "--no-font-cache-update"
    "--shared-lib"
    "--no-desktop-update"
    "--enable-nls"
    "--install-roboto-font"
    "--includeresampler"
-    "--convolver-ffmpeg"
+    "--includeconvolver"
  ] ++ optional optimizationSupport "--optimization";

  meta = with stdenv.lib; {
--- a/pkgs/applications/audio/guitarix/fix-build.patch
+++ b/pkgs/applications/audio/guitarix/fix-build.patch
@ -0,0 +1,10 @@
+--- a/src/LV2/xputty/xfilepicker.cpp
+++ b/src/LV2/xputty/xfilepicker.cpp
+@@ -191,6 +191,6 @@
+     filepicker->selected_file = NULL;
+     filepicker->path = NULL;
+     filepicker->filter = NULL;
+-    asprintf(&filepicker->path, path);
+    asprintf(&filepicker->path, "%s", path);
+     assert(filepicker->path != NULL);
+ }
--- a/pkgs/applications/audio/infamousPlugins/default.nix
+++ b/pkgs/applications/audio/infamousPlugins/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cairomm, cmake, lv2, libpthreadstubs, libXdmcp, libXft, ntk, pcre, fftwFloat, zita-resampler }:
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, cairomm, cmake, lv2, libpthreadstubs, libXdmcp, libXft, ntk, pcre, fftwFloat, zita-resampler }:

 stdenv.mkDerivation rec {
  pname = "infamousPlugins";
@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
    sha256 = "1r72agk5nxf5k0mghcc2j90z43j5d9i7rqjmf49jfyqnd443isip";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/ssj71/infamousPlugins/commit/06dd967b4736ea886dc1dc07f882cb1563961582.patch";
+      sha256 = "08xwh6px13y1gykaw103nhvjms7vgbgkcm0avh9f5d2d7aadq0l2";
+    })
+  ];
  nativeBuildInputs = [ pkgconfig cmake ];
  buildInputs = [ cairomm lv2 libpthreadstubs libXdmcp libXft ntk pcre fftwFloat zita-resampler ];

--- a/pkgs/applications/audio/ir.lv2/default.nix
+++ b/pkgs/applications/audio/ir.lv2/default.nix
@ -15,6 +15,13 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [  pkgconfig ];

+  postPatch = ''
+     # Fix build with lv2 1.18: https://github.com/tomszilagyi/ir.lv2/pull/20
+     find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+       -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+   '';
+
+
  postBuild = "make convert4chan";

  installPhase = ''
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl
-, pkgconfig, cmake, python, ffmpeg, phonon, automoc4
+, pkgconfig, cmake, python, ffmpeg_3, phonon, automoc4
 , chromaprint, docbook_xml_dtd_45, docbook_xsl, libxslt
 , id3lib, taglib, mp4v2, flac, libogg, libvorbis
 , zlib, readline , qtbase, qttools, qtmultimedia, qtquickcontrols
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ wrapQtAppsHook ];
  buildInputs = with stdenv.lib;
-  [ pkgconfig cmake python ffmpeg phonon automoc4
+  [ pkgconfig cmake python ffmpeg_3 phonon automoc4
    chromaprint docbook_xml_dtd_45 docbook_xsl libxslt
    id3lib taglib mp4v2 flac libogg libvorbis zlib readline
    qtbase qttools qtmultimedia qtquickcontrols ];
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@ -1,29 +1,19 @@
-{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, makeWrapper
+{ stdenv, fetchFromGitHub, pkgconfig, makeWrapper
 , libsndfile, jack2Full
 , libGLU, libGL, lv2, cairo
 , ladspaH, php }:

 stdenv.mkDerivation rec {
  pname = "lsp-plugins";
-  version = "1.1.19";
+  version = "1.1.22";

  src = fetchFromGitHub {
    owner = "sadko4u";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "1wiph3vxhydc6mr9hn2c6crd4cx592l2zv0wrzgmpnlm1lflzpbg";
+    sha256 = "0s0i0kf5nqxxywckg03fds1w7696ly60rnlljzqvp7qfgzps1r6c";
  };

-  patches = [
-    # Fix build
-    # https://github.com/sadko4u/lsp-plugins/issues/104
-    (fetchpatch {
-      url = "https://github.com/sadko4u/lsp-plugins/commit/4d901135fb82fa95e668b4d55d05e405f5e620d2.patch";
-      excludes = [ "TODO.txt" ];
-      sha256 = "1s028gqvahvwm1px4xxxawrw2zrwyszb1aq93f0kspf3g7lq27f1";
-    })
-  ];
-
  nativeBuildInputs = [ pkgconfig php makeWrapper ];
  buildInputs = [ jack2Full libsndfile libGLU libGL lv2 cairo ladspaH ];

--- a/pkgs/applications/audio/moc/default.nix
+++ b/pkgs/applications/audio/moc/default.nix
@ -14,7 +14,7 @@
 , musepackSupport ? true, libmpc, libmpcdec, taglib
 , vorbisSupport ? true, libvorbis
 , speexSupport ? true, speex
-, ffmpegSupport ? true, ffmpeg
+, ffmpegSupport ? true, ffmpeg_3
 , sndfileSupport ? true, libsndfile
 , wavpackSupport ? true, wavpack
 # Misc
@ -60,7 +60,7 @@ in stdenv.mkDerivation rec {
    ++ stdenv.lib.optionals musepackSupport [ libmpc libmpcdec taglib ]
    ++ opt vorbisSupport libvorbis
    ++ opt speexSupport speex
-    ++ opt (ffmpegSupport && !withffmpeg4) ffmpeg
+    ++ opt (ffmpegSupport && !withffmpeg4) ffmpeg_3
    ++ opt (ffmpegSupport && withffmpeg4) ffmpeg_4
    ++ opt sndfileSupport libsndfile
    ++ opt wavpackSupport wavpack
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@ -12,7 +12,9 @@ stdenv.mkDerivation rec {
  };

  meta = with stdenv.lib; {
+    description = "Lossless audio codec";
    platforms = platforms.linux;
+    license = licenses.lgpl2;
    maintainers = [ ];
  };
 }
--- a/pkgs/applications/audio/mp3blaster/default.nix
+++ b/pkgs/applications/audio/mp3blaster/default.nix
@ -1,13 +1,12 @@
 { stdenv, fetchFromGitHub, ncurses, libvorbis, SDL }:
+
 stdenv.mkDerivation rec {
-
-  version = "3.2.6";
-
  pname = "mp3blaster";
+  version = "3.2.6";

  src = fetchFromGitHub {
    owner = "stragulus";
-    repo = "mp3blaster";
+    repo = pname;
    rev = "v${version}";
    sha256 = "0pzwml3yhysn8vyffw9q9p9rs8gixqkmg4n715vm23ib6wxbliqs";
  };
@ -17,14 +16,17 @@ stdenv.mkDerivation rec {
    libvorbis
  ] ++ stdenv.lib.optional stdenv.isDarwin SDL;

-  buildFlags = [ "CXXFLAGS=-Wno-narrowing" ];
+  NIX_CFLAGS_COMPILE = toString ([
+    "-Wno-narrowing"
+  ] ++ stdenv.lib.optionals stdenv.cc.isClang [
+    "-Wno-reserved-user-defined-literal"
+  ]);

  meta = with stdenv.lib; {
    description = "An audio player for the text console";
    homepage = "http://www.mp3blaster.org/";
    license = licenses.gpl2;
    maintainers = with maintainers; [ earldouglas ];
-    platforms = platforms.all;
+    platforms = with platforms; linux ++ darwin;
  };
-
 }
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@ -4,7 +4,7 @@
 , boost
 , curl
 , fetchFromGitHub
-, ffmpeg
+, ffmpeg_3
 , lame
 , libev
 , libmicrohttpd
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    alsaLib
    boost
    curl
-    ffmpeg
+    ffmpeg_3
    lame
    libev
    libmicrohttpd
--- a/pkgs/applications/audio/pianobar/default.nix
+++ b/pkgs/applications/audio/pianobar/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, libao, json_c, libgcrypt, ffmpeg, curl }:
+{ fetchurl, stdenv, pkgconfig, libao, json_c, libgcrypt, ffmpeg_3, curl }:

 stdenv.mkDerivation rec {
  name = "pianobar-2020.04.05";
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
-    libao json_c libgcrypt ffmpeg curl
+    libao json_c libgcrypt ffmpeg_3 curl
  ];

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@ -4,7 +4,7 @@
 , curl, libmms
 # input plugins
 , libmad, taglib, libvorbis, libogg, flac, libmpcdec, libmodplug, libsndfile
-, libcdio, cdparanoia, libcddb, faad2, ffmpeg, wildmidi
+, libcdio, cdparanoia, libcddb, faad2, ffmpeg_3, wildmidi
 # output plugins
 , alsaLib, libpulseaudio
 # effect plugins
@ -44,7 +44,7 @@ mkDerivation rec {
      curl libmms
      # input plugins
      libmad taglib libvorbis libogg flac libmpcdec libmodplug libsndfile
-      libcdio cdparanoia libcddb faad2 ffmpeg wildmidi
+      libcdio cdparanoia libcddb faad2 ffmpeg_3 wildmidi
      # output plugins
      alsaLib libpulseaudio
      # effect plugins
--- a/pkgs/applications/audio/r128gain/default.nix
+++ b/pkgs/applications/audio/r128gain/default.nix
@ -1,7 +1,7 @@
 { lib
 , fetchFromGitHub
 , substituteAll
-, ffmpeg
+, ffmpeg_3
 , python3Packages
 , sox
 }:
@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
    (
      substituteAll {
        src = ./ffmpeg-location.patch;
-        inherit ffmpeg;
+        ffmpeg = ffmpeg_3;
      }
    )
  ];
--- a/pkgs/applications/audio/rubyripper/default.nix
+++ b/pkgs/applications/audio/rubyripper/default.nix
@ -17,7 +17,9 @@ stdenv.mkDerivation rec {
      --prefix PATH : "${cdparanoia}/bin"
  '';

-  meta = {
-    platforms = stdenv.lib.platforms.linux;
+  meta = with stdenv.lib; {
+    description = "High quality CD audio ripper";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
  };
 }
--- a/pkgs/applications/audio/sorcer/default.nix
+++ b/pkgs/applications/audio/sorcer/default.nix
@ -14,6 +14,12 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ boost cairomm cmake libsndfile lv2 ntk python ];

+  postPatch = ''
+     # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
+     find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+       -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+   '';
+
  installPhase = ''
    make install
    cp -a ../presets/* "$out/lib/lv2"
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@ -2,7 +2,7 @@
 , alsaLib, flac, libmad, libvorbis, mpg123
 , dsdSupport ? true
 , faad2Support ? true, faad2
-, ffmpegSupport ? true, ffmpeg
+, ffmpegSupport ? true, ffmpeg_3
 , opusSupport ? true, opusfile
 , resampleSupport ? true, soxr
 , sslSupport ? true, openssl
@ -35,7 +35,7 @@ in stdenv.mkDerivation {

  buildInputs = [ alsaLib flac libmad libvorbis mpg123 ]
    ++ optional faad2Support faad2
-    ++ optional ffmpegSupport ffmpeg
+    ++ optional ffmpegSupport ffmpeg_3
    ++ optional opusSupport opusfile
    ++ optional resampleSupport soxr
    ++ optional sslSupport openssl;
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, alsaLib, boost, cairo, cmake, fftwSinglePrec, fltk, pcre
+{ stdenv, fetchFromGitHub , alsaLib, boost, cairo, cmake, fftwSinglePrec, fltk, pcre
 , libjack2, libsndfile, libXdmcp, readline, lv2, libGLU, libGL, minixml, pkgconfig, zlib, xorg
 }:

@ -6,13 +6,15 @@ assert stdenv ? glibc;

 stdenv.mkDerivation  rec {
  pname = "yoshimi";
-  version = "1.7.0.1";
+  # Fix build with lv2 1.18: https://github.com/Yoshimi/yoshimi/pull/102/commits/86996cbb235f0fe138ae814a6758c2c8ba1c2a38
+  version = "unstable-2020-05-10";

-  src = fetchurl {
-    url = "mirror://sourceforge/yoshimi/${pname}-${version}.tar.bz2";
-    sha256 = "1pkqrrr51vlxh96vy0c0rf5ijjvymys4brsw9rv1bdp1bb8izw6c";
+  src = fetchFromGitHub {
+    owner = "Yoshimi";
+    repo = pname;
+    rev = "86996cbb235f0fe138ae814a6758c2c8ba1c2a38";
+    sha256 = "0bgcc5fbgwpdjircq00wlii30pakf45yzligpbnf02a554hh4j01";
  };
-
  buildInputs = [
    alsaLib boost cairo fftwSinglePrec fltk libjack2 libsndfile libXdmcp readline lv2 libGLU libGL
    minixml zlib xorg.libpthreadstubs pcre
--- a/pkgs/applications/blockchains/dashpay.nix
+++ b/pkgs/applications/blockchains/dashpay.nix
@ -39,5 +39,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.dash.org";
    maintainers = with maintainers; [ AndersonTorres ];
    platforms = platforms.unix;
+    license = licenses.mit;
  };
 }
--- a/pkgs/applications/editors/jedit/default.nix
+++ b/pkgs/applications/editors/jedit/default.nix
@ -3,11 +3,11 @@
 let
  version = "5.2.0";
  bcpg = fetchurl {
-    url = "http://central.maven.org/maven2/org/bouncycastle/bcpg-jdk16/1.46/bcpg-jdk16-1.46.jar";
+    url = "mirror://maven/org/bouncycastle/bcpg-jdk16/1.46/bcpg-jdk16-1.46.jar";
    sha256 = "16xhmwks4l65m5x150nd23y5lyppha9sa5fj65rzhxw66gbli82d";
  };
  jsr305 = fetchurl {
-    url = "http://central.maven.org/maven2/com/google/code/findbugs/jsr305/2.0.0/jsr305-2.0.0.jar";
+    url = "mirror://maven/com/google/code/findbugs/jsr305/2.0.0/jsr305-2.0.0.jar";
    sha256 = "0s74pv8qjc42c7q8nbc0c3b1hgx0bmk3b8vbk1z80p4bbgx56zqy";
  };
 in
--- a/pkgs/applications/editors/setzer/default.nix
+++ b/pkgs/applications/editors/setzer/default.nix
@ -0,0 +1,60 @@
+{ lib
+, python3
+, fetchFromGitHub
+, meson
+, ninja
+, gettext
+, appstream
+, appstream-glib
+, wrapGAppsHook
+, gobject-introspection
+, gtksourceview4
+, gspell
+, poppler_gi
+, webkitgtk
+, librsvg
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "setzer";
+  version = "0.2.8";
+
+  src = fetchFromGitHub {
+    owner = "cvfosammmm";
+    repo = "Setzer";
+    rev = "v${version}";
+    sha256 = "1llxxjj038nd2p857bjdyyhzskn56826qi259v47vaqlv9hkifil";
+  };
+
+  format = "other";
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    gettext
+    appstream # for appstreamcli
+    appstream-glib
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gtksourceview4
+    gspell
+    poppler_gi
+    webkitgtk
+    librsvg
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pygobject3
+    pyxdg
+  ];
+
+  meta = with lib; {
+    description = "LaTeX editor written in Python with Gtk";
+    homepage = src.meta.homepage;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, flex, bison, pkgconfig, zlib, libtiff, libpng, fftw
-, cairo, readline, ffmpeg, makeWrapper, wxGTK30, netcdf, blas
+, cairo, readline, ffmpeg_3, makeWrapper, wxGTK30, netcdf, blas
 , proj, gdal, geos, sqlite, postgresql, libmysqlclient, python2Packages, libLAS, proj-datumgrid
 }:

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ flex bison zlib proj gdal libtiff libpng fftw sqlite cairo proj
-  readline ffmpeg makeWrapper wxGTK30 netcdf geos postgresql libmysqlclient blas
+  readline ffmpeg_3 makeWrapper wxGTK30 netcdf geos postgresql libmysqlclient blas
  libLAS proj-datumgrid ]
    ++ (with python2Packages; [ python dateutil wxPython30 numpy ]);

--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -13,8 +13,8 @@ let
    else throw "ImageMagick is not supported on this platform.";

  cfg = {
-    version = "7.0.10-14";
-    sha256 = "1qcsq5884iqis1adpfbx3cwki8v4q9wwh70fpcaqnwwmznmqfq4j";
+    version = "7.0.10-17";
+    sha256 = "15cj9qkikx13j6gfqaawi4nh09lnzg3asf5mdcswx6z6yhbf90zx";
    patches = [];
  };
 in
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@ -50,13 +50,13 @@ let
  inherit (python2Packages) pygtk wrapPython python;
 in stdenv.mkDerivation rec {
  pname = "gimp";
-  version = "2.10.18";
+  version = "2.10.20";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "05np26g61fyr72s7qjfrcck8v57r0yswq5ihvqyzvgzfx08y3gv5";
+    sha256 = "4S+fh0saAHxCd7YKqB4LZzML5+YVPldJ6tg5uQL8ezw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/jpeg-archive/default.nix
+++ b/pkgs/applications/graphics/jpeg-archive/default.nix
@ -35,7 +35,7 @@ stdenv.mkDerivation {
  meta = with stdenv.lib; {
    description = "Utilities for archiving photos for saving to long term storage or serving over the web";
    homepage    = "https://github.com/danielgtaylor/jpeg-archive";
-    # license = ...; # mixed?
+    license = licenses.mit;
    maintainers = [ maintainers.srghma ];
    platforms   = platforms.all;
  };
--- a/pkgs/applications/graphics/pqiv/default.nix
+++ b/pkgs/applications/graphics/pqiv/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, pkgconfig
-, ffmpeg, gtk3, imagemagick, libarchive, libspectre, libwebp, poppler
+, ffmpeg_3, gtk3, imagemagick, libarchive, libspectre, libwebp, poppler
 }:

 stdenv.mkDerivation (rec {
@ -14,7 +14,7 @@ stdenv.mkDerivation (rec {
  };

  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ffmpeg gtk3 imagemagick libarchive libspectre libwebp poppler ];
+  buildInputs = [ ffmpeg_3 gtk3 imagemagick libarchive libspectre libwebp poppler ];

  prePatch = "patchShebangs .";

--- a/pkgs/applications/kde/ark/default.nix
+++ b/pkgs/applications/kde/ark/default.nix
@ -9,14 +9,14 @@
  libarchive, libzip,

  # Archive tools
-  lrzip,
+  p7zip, lrzip,

  # Unfree tools
  unfreeEnableUnrar ? false, unrar,
 }:

 let
-  extraTools = [ lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
+  extraTools = [ p7zip lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
 in

 mkDerivation {
--- a/pkgs/applications/kde/ffmpegthumbs.nix
+++ b/pkgs/applications/kde/ffmpegthumbs.nix
@ -1,7 +1,7 @@
 {
  mkDerivation, lib,
  extra-cmake-modules,
-  ffmpeg, kio
+  ffmpeg_3, kio
 }:

 mkDerivation {
@ -11,5 +11,5 @@ mkDerivation {
    maintainers = [ lib.maintainers.ttuegel ];
  };
  nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ ffmpeg kio ];
+  buildInputs = [ ffmpeg_3 kio ];
 }
--- a/pkgs/applications/kde/k3b.nix
+++ b/pkgs/applications/kde/k3b.nix
@ -5,7 +5,7 @@
 , flac, lame, libmad, libmpcdec, libvorbis
 , libsamplerate, libsndfile, taglib
 , cdparanoia, cdrdao, cdrtools, dvdplusrwtools, libburn, libdvdcss, libdvdread, vcdimager
-, ffmpeg, libmusicbrainz3, normalize, sox, transcode, kinit
+, ffmpeg_3, libmusicbrainz3, normalize, sox, transcode, kinit
 }:

 mkDerivation {
@ -28,7 +28,7 @@ mkDerivation {
    # cd/dvd
    cdparanoia libdvdcss libdvdread
    # others
-    ffmpeg libmusicbrainz3 shared-mime-info
+    ffmpeg_3 libmusicbrainz3 shared-mime-info
  ];
  propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
  postFixup =
--- a/pkgs/applications/misc/airtame/default.nix
+++ b/pkgs/applications/misc/airtame/default.nix
@ -1,12 +1,12 @@
 { stdenv, lib, fetchurl, makeDesktopItem, makeWrapper
-, alsaLib, atk, cairo, cups, curl, dbus, expat, ffmpeg, fontconfig, freetype
+, alsaLib, atk, cairo, cups, curl, dbus, expat, ffmpeg_3, fontconfig, freetype
 , gdk-pixbuf, glib, glibc, gnome2, gtk2, libX11, libXScrnSaver, libXcomposite
 , libXcursor, libXdamage, libXext, libXfixes, libXi, libXrandr, libXrender
 , libXtst, libopus, libpulseaudio, libxcb, nspr, nss, pango, udev, x264
 }:

 let libPath = lib.makeLibraryPath [
-  alsaLib atk cairo cups curl dbus expat ffmpeg fontconfig freetype gdk-pixbuf
+  alsaLib atk cairo cups curl dbus expat ffmpeg_3 fontconfig freetype gdk-pixbuf
  glib glibc gnome2.GConf gtk2 libopus nspr nss pango stdenv.cc.cc udev x264
  libX11 libXScrnSaver libXcomposite libXcursor libXdamage libXext libXfixes
  libXi libXrandr libXrender libXtst libpulseaudio libxcb
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -1,4 +1,4 @@
-{ config, stdenv, lib, fetchurl, boost, cmake, ffmpeg, gettext, glew
+{ config, stdenv, lib, fetchurl, boost, cmake, ffmpeg_3, gettext, glew
 , ilmbase, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
 , libtiff, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio2, openjpeg, python3Packages
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ] ++ optional cudaSupport addOpenGLRunpath;
  buildInputs =
-    [ boost ffmpeg gettext glew ilmbase
+    [ boost ffmpeg_3 gettext glew ilmbase
      freetype libjpeg libpng libsamplerate libsndfile libtiff
      opencolorio openexr openimagedenoise openimageio2 openjpeg python zlib fftw jemalloc
      alembic
@ -86,9 +86,9 @@ stdenv.mkDerivation rec {
      "-DWITH_SDL=OFF"
      "-DWITH_OPENCOLORIO=ON"
      "-DWITH_OPENSUBDIV=ON"
-      "-DPYTHON_LIBRARY=${python.libPrefix}m"
+      "-DPYTHON_LIBRARY=${python.libPrefix}"
      "-DPYTHON_LIBPATH=${python}/lib"
-      "-DPYTHON_INCLUDE_DIR=${python}/include/${python.libPrefix}m"
+      "-DPYTHON_INCLUDE_DIR=${python}/include/${python.libPrefix}"
      "-DPYTHON_VERSION=${python.pythonVersion}"
      "-DWITH_PYTHON_INSTALL=OFF"
      "-DWITH_PYTHON_INSTALL_NUMPY=OFF"
--- a/pkgs/applications/misc/gcalcli/default.nix
+++ b/pkgs/applications/misc/gcalcli/default.nix
@ -5,13 +5,13 @@ with python3.pkgs;

 buildPythonApplication rec {
  pname = "gcalcli";
-  version = "4.2.1";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner  = "insanum";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "1xwrgmy2azvr99b7df92m2imj0wy4fh53bn7lvcrnghjbnh7n0l0";
+    sha256 = "0s5fhcmz3n0dwh3vkqr4aigi59q43v03ch5jhh6v75149icwr0df";
  };

  postPatch = lib.optionalString stdenv.isLinux ''
--- a/pkgs/applications/misc/get_iplayer/default.nix
+++ b/pkgs/applications/misc/get_iplayer/default.nix
@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, atomicparsley, flvstreamer, ffmpeg, makeWrapper, perl, perlPackages, rtmpdump}:
+{stdenv, fetchFromGitHub, atomicparsley, flvstreamer, ffmpeg_3, makeWrapper, perl, perlPackages, rtmpdump}:

 with stdenv.lib;

@ -26,7 +26,7 @@ perlPackages.buildPerlPackage rec {
  installPhase = ''
    mkdir -p $out/bin $out/share/man/man1
    cp get_iplayer $out/bin
-    wrapProgram $out/bin/get_iplayer --suffix PATH : ${makeBinPath [ atomicparsley ffmpeg flvstreamer rtmpdump ]} --prefix PERL5LIB : $PERL5LIB
+    wrapProgram $out/bin/get_iplayer --suffix PATH : ${makeBinPath [ atomicparsley ffmpeg_3 flvstreamer rtmpdump ]} --prefix PERL5LIB : $PERL5LIB
    cp get_iplayer.1 $out/share/man/man1
  '';

--- a/pkgs/applications/misc/gitit/default.nix
+++ b/pkgs/applications/misc/gitit/default.nix
@ -0,0 +1,61 @@
+{ lib, haskellPackages, haskell, removeReferencesTo
+# “Plugins” are a fancy way of saying gitit will invoke
+# GHC at *runtime*, which in turn makes it pull GHC
+# into its runtime closure. Only enable if you really need
+# that feature. But if you do you’ll want to use gitit
+# as a library anyway.
+, pluginSupport ? false
+}:
+
+# this is similar to what we do with the pandoc executable
+
+let
+  plain = haskellPackages.gitit;
+  plugins =
+    if pluginSupport
+    then plain
+    else haskell.lib.disableCabalFlag plain "plugins";
+  static = haskell.lib.justStaticExecutables plugins;
+
+in
+  (haskell.lib.overrideCabal static (drv: {
+    buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
+  })).overrideAttrs (drv: {
+
+    # These libraries are still referenced, because they generate
+    # a `Paths_*` module for figuring out their version.
+    # The `Paths_*` module is generated by Cabal, and contains the
+    # version, but also paths to e.g. the data directories, which
+    # lead to a transitive runtime dependency on the whole GHC distribution.
+    # This should ideally be fixed in haskellPackages (or even Cabal),
+    # but a minimal gitit is important enough to patch it manually.
+    disallowedReferences = [
+      haskellPackages.pandoc-types
+      haskellPackages.HTTP
+      haskellPackages.pandoc
+      haskellPackages.happstack-server
+      haskellPackages.filestore
+    ];
+    postInstall = ''
+      remove-references-to \
+        -t ${haskellPackages.pandoc-types} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.HTTP} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.pandoc} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.happstack-server} \
+        $out/bin/gitit
+      remove-references-to \
+        -t ${haskellPackages.filestore} \
+        $out/bin/gitit
+    '';
+
+    meta = drv.meta // {
+      maintainers = drv.meta.maintainers or []
+        ++ [ lib.maintainers.Profpatsch ];
+    };
+  })
--- a/pkgs/applications/misc/goldendict/default.nix
+++ b/pkgs/applications/misc/goldendict/default.nix
@ -4,7 +4,7 @@
 , withCC ? true, opencc
 , withEpwing ? true, libeb
 , withExtraTiff ? true, libtiff
-, withFFmpeg ? true, libao, ffmpeg
+, withFFmpeg ? true, libao, ffmpeg_3
 , withMultimedia ? true
 , withZim ? true, zstd }:

@ -39,7 +39,7 @@ mkDerivation rec {
    ++ stdenv.lib.optional withCC opencc
    ++ stdenv.lib.optional withEpwing libeb
    ++ stdenv.lib.optional withExtraTiff libtiff
-    ++ stdenv.lib.optionals withFFmpeg [ libao ffmpeg ]
+    ++ stdenv.lib.optionals withFFmpeg [ libao ffmpeg_3 ]
    ++ stdenv.lib.optional withZim zstd;

  qmakeFlags = with stdenv.lib; [
--- a/pkgs/applications/misc/gosmore/default.nix
+++ b/pkgs/applications/misc/gosmore/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation {

  patches = [ ./pointer_int_comparison.patch ];
  patchFlags = [ "-p1" "--binary" ]; # patch has dos style eol
-      
+
  meta = with stdenv.lib; {
    description = "Open Street Map viewer";
    homepage = "https://sourceforge.net/projects/gosmore/";
@ -33,5 +33,6 @@ stdenv.mkDerivation {
      raskin
    ];
    platforms = platforms.linux;
+    license = licenses.bsd2;
  };
 }
--- a/pkgs/applications/misc/lutris/chrootenv.nix
+++ b/pkgs/applications/misc/lutris/chrootenv.nix
@ -28,7 +28,7 @@ in buildFHSUserEnv {
    # DGen // TODO: libarchive is broken

    # Dolphin
-    bluez ffmpeg gettext portaudio wxGTK30 miniupnpc mbedtls lzo sfml gsm
+    bluez ffmpeg_3 gettext portaudio wxGTK30 miniupnpc mbedtls lzo sfml gsm
    wavpack orc nettle gmp pcre vulkan-loader

    # DOSBox
--- a/pkgs/applications/misc/megacmd/default.nix
+++ b/pkgs/applications/misc/megacmd/default.nix
@ -5,7 +5,7 @@
 , cryptopp
 , curl
 , fetchFromGitHub
-, ffmpeg
+, ffmpeg_3
 , freeimage
 , gcc-unwrapped
 , libmediainfo
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    c-ares
    cryptopp
    curl
-    ffmpeg
+    ffmpeg_3
    freeimage
    gcc-unwrapped
    libmediainfo
--- a/pkgs/applications/misc/megasync/default.nix
+++ b/pkgs/applications/misc/megasync/default.nix
@ -1,5 +1,5 @@
 { stdenv, autoconf, automake, c-ares, cryptopp, curl, doxygen, fetchFromGitHub
-, fetchpatch, ffmpeg, libmediainfo, libraw, libsodium, libtool, libuv, libzen
+, fetchpatch, ffmpeg_3, libmediainfo, libraw, libsodium, libtool, libuv, libzen
 , lsb-release, mkDerivation, pkgconfig, qtbase, qttools, sqlite, swig, unzip
 , wget }:

@ -21,7 +21,7 @@ mkDerivation rec {
    c-ares
    cryptopp
    curl
-    ffmpeg
+    ffmpeg_3
    libmediainfo
    libraw
    libsodium
--- a/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, perl
 , alsaLib, libevdev, libopus, udev, SDL2
-, ffmpeg, pkgconfig, xorg, libvdpau, libpulseaudio, libcec
+, ffmpeg_3, pkgconfig, xorg, libvdpau, libpulseaudio, libcec
 , curl, expat, avahi, enet, libuuid, libva
 }:

@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake perl ];
  buildInputs = [
    alsaLib libevdev libopus udev SDL2
-    ffmpeg pkgconfig xorg.libxcb libvdpau libpulseaudio libcec
+    ffmpeg_3 pkgconfig xorg.libxcb libvdpau libpulseaudio libcec
    xorg.libpthreadstubs curl expat avahi enet libuuid libva
  ];

--- a/pkgs/applications/misc/sigal/default.nix
+++ b/pkgs/applications/misc/sigal/default.nix
@ -1,4 +1,4 @@
-{ lib, python3Packages, ffmpeg }:
+{ lib, python3Packages, ffmpeg_3 }:

 python3Packages.buildPythonApplication rec {
  version = "2.0";
@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
    blinker
  ];

-  makeWrapperArgs = [ "--prefix PATH : ${ffmpeg}/bin" ];
+  makeWrapperArgs = [ "--prefix PATH : ${ffmpeg_3}/bin" ];

  # No tests included
  doCheck = false;
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@ -16,10 +16,10 @@ let

  pname = "simplenote";

-  version = "1.16.0";
+  version = "1.17.0";

  sha256 = {
-    x86_64-linux = "01nk3dbyhs0p7f6b4bkrng95i29g0x7vxj0rx1qb7sm3n11yi091";
+    x86_64-linux = "14kjx4y3kvw7h8wk8mmkpx1288jscmd8bgl10bw6kcfigcwahpw3";
  }.${system} or throwSystem;

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -20,14 +20,14 @@
 }:

 mkDerivation rec {
-  version = "0.10.9";
+  version = "0.10.10";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${version}";
-    sha256 = "19kni5v9g0p4751bw2xb8dawg5yjkyk39vdy0m93448lsl8cqq04";
+    sha256 = "14nn0igcx4kd7pcna1ggz3yz9xfk1czgy87fxkmn2p91psmy2i18";
  };

  buildInputs = [ qtbase cpp-utilities qtutilities ]
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -16,7 +16,7 @@
 , xorg
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
-, ffmpeg, libxslt, libxml2, at-spi2-core
+, ffmpeg_3, libxslt, libxml2, at-spi2-core
 , jre
 , pipewire_0_2

@ -93,7 +93,7 @@ let
    libpng libcap
    xdg_utils minizip libwebp
    libusb1 re2 zlib
-    ffmpeg libxslt libxml2
+    ffmpeg_3 libxslt libxml2
    # harfbuzz # in versions over 63 harfbuzz and freetype are being built together
               # so we can't build with one from system and other from source
  ] ++ (if (versionRange "0" "84") then [ yasm ] else [ nasm ]);
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@ -48,7 +48,7 @@
 , gnused
 , gnugrep
 , gnupg
-, ffmpeg
+, ffmpeg_3
 , runtimeShell
 , systemLocale ? config.i18n.defaultLocale or "en-US"
 }:
@ -134,7 +134,7 @@ stdenv.mkDerivation {
      libpulseaudio
      (lib.getDev libpulseaudio)
      systemd
-      ffmpeg
+      ffmpeg_3
    ] + ":" + stdenv.lib.makeSearchPathOutput "lib" "lib64" [
      stdenv.cc.cc
    ];
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -35,10 +35,10 @@ rec {

  firefox-esr-68 = common rec {
    pname = "firefox-esr";
-    ffversion = "68.8.0esr";
+    ffversion = "68.9.0esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "2rl5irkamxi8caa8krj0wng93lb82kk9mf09mgci87mj9hy6fxzcrlmiiffp14s03rv0raagrn4w54pbx1336mylq6saxmfhpf676hk";
+      sha512 = "mEMYANgPfGgK757t4p34IXgQkSoxmn9/jC5jfEPs1PTikiOkF6+ypjFegl+XlFP/bmtaV1ZJq6XMY85ZVjdbuA==";
    };

    patches = [
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -1,6 +1,6 @@
 { stdenv, lib, fetchgit, makeDesktopItem
 , pkgconfig, autoconf213, alsaLib, bzip2, cairo
-, dbus, dbus-glib, ffmpeg, file, fontconfig, freetype
+, dbus, dbus-glib, ffmpeg_3, file, fontconfig, freetype
 , gnome2, gnum4, gtk2, hunspell, libevent, libjpeg
 , libnotify, libstartup_notification, makeWrapper
 , libGLU, libGL, perl, python2, libpulseaudio
@ -11,17 +11,17 @@

 let

-  libPath = lib.makeLibraryPath [ ffmpeg ];
+  libPath = lib.makeLibraryPath [ ffmpeg_3 ];
  gtkVersion = if withGTK3 then "3" else "2";

 in stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "28.9.3";
+  version = "28.10.0";

  src = fetchgit {
    url = "https://github.com/MoonchildProductions/Pale-Moon.git";
    rev = "${version}_Release";
-    sha256 = "1f8vfjyihlr2l79mkfgdcvwjnh261n6imkps310x9x3977jiq2wr";
+    sha256 = "0c64vmrp46sbl1dgl9dq2vkmpgz9gvgd59dk02jqwyhx4lln1g2l";
    fetchSubmodules = true;
  };

@ -48,7 +48,7 @@ in stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    alsaLib bzip2 cairo dbus dbus-glib ffmpeg fontconfig freetype
+    alsaLib bzip2 cairo dbus dbus-glib ffmpeg_3 fontconfig freetype
    gnome2.GConf gtk2 hunspell libevent libjpeg libnotify
    libstartup_notification libGLU libGL
    libpulseaudio unzip yasm zip zlib
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -29,7 +29,7 @@

 # Media support (implies audio support)
 , mediaSupport ? true
-, ffmpeg
+, ffmpeg_3

 , gmp

@ -83,7 +83,7 @@ let
  ]
  ++ optionals pulseaudioSupport [ libpulseaudio ]
  ++ optionals mediaSupport [
-    ffmpeg
+    ffmpeg_3
  ];

  # Library search path for the fte transport
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@ -15,7 +15,7 @@
 , glibc
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
-, ffmpeg, libxslt, libxml2, at-spi2-core
+, ffmpeg_3, libxslt, libxml2, at-spi2-core
 , jre

 # optional dependencies
@ -93,7 +93,7 @@ let
    libpng libcap
    xdg_utils yasm minizip libwebp
    libusb1 re2 zlib
-    ffmpeg libxslt libxml2
+    ffmpeg_3 libxslt libxml2
    # harfbuzz # in versions over 63 harfbuzz and freetype are being built together
               # so we can't build with one from system and other from source
  ];
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, zlib, libX11, libXext, libSM, libICE
 , libXfixes, libXt, libXi, libXcursor, libXScrnSaver, libXcomposite, libXdamage, libXtst, libXrandr
-, alsaLib, dbus, cups, libexif, ffmpeg, systemd
+, alsaLib, dbus, cups, libexif, ffmpeg_3, systemd
 , freetype, fontconfig, libXft, libXrender, libxcb, expat
 , libuuid
 , gstreamer, gst-plugins-base, libxml2
@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
  buildInputs = [
    stdenv.cc.cc stdenv.cc.libc zlib libX11 libXt libXext libSM libICE libxcb
    libXi libXft libXcursor libXfixes libXScrnSaver libXcomposite libXdamage libXtst libXrandr
-    atk at-spi2-atk at-spi2-core alsaLib dbus cups gtk3 gdk-pixbuf libexif ffmpeg systemd
+    atk at-spi2-atk at-spi2-core alsaLib dbus cups gtk3 gdk-pixbuf libexif ffmpeg_3 systemd
    freetype fontconfig libXrender libuuid expat glib nss nspr
    gstreamer libxml2 gst-plugins-base pango cairo gnome2.GConf
    libdrm mesa
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@ -1,5 +1,5 @@
 {stdenv, fetchurl, zlib, openssl, libre, librem, pkgconfig, gst_all_1
-, cairo, mpg123, alsaLib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg
+, cairo, mpg123, alsaLib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg_3
 , gsm, speex, portaudio, spandsp, libuuid, ccache, libvpx
 }:
 stdenv.mkDerivation rec {
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
  };
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [zlib openssl libre librem cairo mpg123
-    alsaLib SDL libv4l celt libsndfile srtp ffmpeg gsm speex portaudio spandsp libuuid
+    alsaLib SDL libv4l celt libsndfile srtp ffmpeg_3 gsm speex portaudio spandsp libuuid
    ccache libvpx
  ] ++ (with gst_all_1; [ gstreamer gst-libav gst-plugins-base gst-plugins-bad gst-plugins-good ]);
  makeFlags = [
--- a/pkgs/applications/networking/instant-messengers/discord/base.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/base.nix
@ -1,16 +1,30 @@
 { pname, version, src, binaryName, desktopName
-, stdenv, fetchurl, makeDesktopItem, wrapGAppsHook
-, alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig, freetype
-, gdk-pixbuf, glib, gtk3, libnotify, libX11, libXcomposite, libXcursor, libXdamage, libuuid
-, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst, nspr, nss, libxcb
-, pango, systemd, libXScrnSaver, libcxx, libpulseaudio }:
+, autoPatchelfHook, fetchurl, makeDesktopItem, stdenv, wrapGAppsHook
+, alsaLib, at-spi2-atk, at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig
+, freetype, gdk-pixbuf, glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid
+, libX11, libXScrnSaver, libXcomposite, libXcursor, libXdamage, libXext
+, libXfixes, libXi, libXrandr, libXrender, libXtst, libxcb
+, mesa, nspr, nss, pango, systemd
+}:

 let
  inherit binaryName;
 in stdenv.mkDerivation rec {
  inherit pname version src;

-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [
+    alsaLib
+    autoPatchelfHook
+    cups
+    libdrm
+    libX11
+    libXScrnSaver
+    libXtst
+    libxcb
+    mesa.drivers
+    nss
+    wrapGAppsHook
+  ];

  dontWrapGApps = true;

--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -27,10 +27,10 @@ in {
    pname = "discord-canary";
    binaryName = "DiscordCanary";
    desktopName = "Discord Canary";
-    version = "0.0.103";
+    version = "0.0.104";
    src = fetchurl {
      url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-      sha256 = "1d95q75ak4z6wkxlgcmkl7yk20gl7zf568b0xslz42hwx032fn4z";
+      sha256 = "17np1hqqygjlbmlln0d1ba2qlbjykwj156w5dw7g4lg77kfxicfk";
    };
  };
 }.${branch}
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@ -10,7 +10,7 @@
 , cyrus_sasl
 , fetchFromGitLab
 , fetchurl
-, ffmpeg
+, ffmpeg_3
 , gdk-pixbuf
 , glib
 , gnused
@ -137,7 +137,7 @@ mkDerivation rec {
    bzrtp
    cairo
    cyrus_sasl
-    ffmpeg
+    ffmpeg_3
    gdk-pixbuf
    glib
    gtk2
--- a/pkgs/applications/networking/instant-messengers/poezio/default.nix
+++ b/pkgs/applications/networking/instant-messengers/poezio/default.nix
@ -2,7 +2,7 @@
 , pytest, aiodns, slixmpp, pyinotify, potr, mpd2, cffi, pkgconfig, setuptools }:
 buildPythonApplication rec {
    pname = "poezio";
-    version = "0.13";
+    version = "0.13.1";

    disabled = pythonOlder "3.4";

@ -14,7 +14,7 @@ buildPythonApplication rec {
      owner = pname;
      repo = pname;
      rev = "v${version}";
-      sha256 = "14ig7va0yf5wdhi8hk00f1wni8pj37agggdnvsicvcw2rz1cdw0x";
+      sha256 = "041y61pcbdb86s04qwp8s1g6bp84yskc7vdizwpi2hz18y01x5fy";
    };

    checkPhase = ''
--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@ -2,7 +2,7 @@
 , libtoxcore
 , libpthreadstubs, libXdmcp, libXScrnSaver
 , qtbase, qtsvg, qttools, qttranslations
-, ffmpeg, filter-audio, libexif, libsodium, libopus
+, ffmpeg_3, filter-audio, libexif, libsodium, libopus
 , libvpx, openal, pcre, qrencode, sqlcipher
 , AVFoundation ? null }:

@ -25,7 +25,7 @@ in mkDerivation {
    libtoxcore
    libpthreadstubs libXdmcp libXScrnSaver
    qtbase qtsvg qttranslations
-    ffmpeg filter-audio libexif libopus libsodium
+    ffmpeg_3 filter-audio libexif libopus libsodium
    libvpx openal pcre qrencode sqlcipher
  ] ++ lib.optionals stdenv.isDarwin [ AVFoundation] ;

--- a/pkgs/applications/networking/instant-messengers/ring-daemon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ring-daemon/default.nix
@ -13,7 +13,7 @@
 , libsndfile
 , dbus
 , dbus_cplusplus
-, ffmpeg
+, ffmpeg_3
 , udev
 , pcre
 , gsm
@ -101,7 +101,7 @@ stdenv.mkDerivation {
    libsndfile
    dbus
    dbus_cplusplus
-    ffmpeg
+    ffmpeg_3
    udev
    pcre
    gsm
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -23,7 +23,7 @@ let
      else "");
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "1.34.1"; # Please backport all updates to the stable channel.
+  version = "1.34.2"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0v9mqn43vn1w6wppzydkgpbx2752bp7mmpf50wqgvrmhchnywnkj";
+    sha256 = "0l0i6v6n6iyq1zb2rlgfjnsk37kzjqgglk824vl5kp8qbq0li6b6";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/sky/default.nix
+++ b/pkgs/applications/networking/instant-messengers/sky/default.nix
@ -4,7 +4,7 @@
 , curl, sqlite, openssl
 , libuuid, openh264, libv4l, libxkbfile, libXv, zlib, libXmu
 , libXtst, libXdamage, pam, libXfixes, libXrender, libjpeg_original
-, ffmpeg
+, ffmpeg_3
 }:
 let
   # Sky is linked to the libjpeg 8 version and checks for the version number in the code.
@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    file
    qt5.qtbase
    SDL
-    ffmpeg
+    ffmpeg_3
    sqlite
    openssl
    openh264
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix
@ -1,5 +1,5 @@
 { mkDerivation, lib, fetchFromGitHub, pkg-config, python3, cmake, ninja
-, qtbase, qtimageformats, libsForQt5, hunspell, xdg_utils, ffmpeg, openalSoft
+, qtbase, qtimageformats, libsForQt5, hunspell, xdg_utils, ffmpeg_3, openalSoft
 , lzma, lz4, xxHash, zlib, minizip, openssl, libtgvoip, microsoft_gsl, tl-expected
 , range-v3
 }:
@ -21,7 +21,7 @@ mkDerivation rec {
  nativeBuildInputs = [ pkg-config python3 cmake ninja ];

  buildInputs = [
-    qtbase qtimageformats ffmpeg openalSoft lzma lz4 xxHash libsForQt5.libdbusmenu
+    qtbase qtimageformats ffmpeg_3 openalSoft lzma lz4 xxHash libsForQt5.libdbusmenu
    zlib minizip openssl hunspell libtgvoip microsoft_gsl tl-expected range-v3
  ];

--- a/Show More
+++ b/Show More