Merge staging-next into staging

2020-05-27 15:27:21 +02:00 · 2020-05-27 15:27:21 +02:00 · 362d88c2b1
commit 362d88c2b1
parent 0367fa630d 1b7204ab3c
277 changed files with 4061 additions and 1435 deletions
--- a/doc/languages-frameworks/agda.section.md
+++ b/doc/languages-frameworks/agda.section.md
@ -42,7 +42,7 @@ $ agda -l standard-library -i . MyFile.agda
 ```
 name: my-library
 include: .
-depends: standard-library
+depend: standard-library
 ```
 - Create the file `~/.agda/defaults` and add any libraries you want to use by default.

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -247,12 +247,6 @@
    githubId = 732652;
    name = "Andreas Herrmann";
  };
-  ahmedtd = {
-    email = "ahmed.taahir@gmail.com";
-    github = "ahmedtd";
-    githubId = 1017202;
-    name = "Taahir Ahmed";
-  };
  ahuzik = {
    email = "ales.guzik@gmail.com";
    github = "alesguzik";
@ -1175,6 +1169,12 @@
    githubId = 510553;
    name = "Jos van Bakel";
  };
+  caadar = {
+    email = "v88m@posteo.net";
+    github = "caadar";
+    githubId = 15320726;
+    name = "Car Cdr";
+  };
  cab404 = {
    email = "cab404@mailbox.org";
    github = "cab404";
@ -4009,6 +4009,12 @@
    githubId = 59667;
    name = "Ahmed Kamal";
  };
+  kimat = {
+    email = "mail@kimat.org";
+    github = "kimat";
+    githubId = 3081769;
+    name = "Kimat Boven";
+  };
  kimburgess = {
    email = "kim@acaprojects.com";
    github = "kimburgess";
@ -4059,6 +4065,16 @@
    github = "klntsky";
    githubId = 18447310;
  };
+  kloenk = {
+    email = "me@kloenk.de";
+    name = "Finn Behrens";
+    github = "kloenk";
+    githubId = 12898828;
+    keys = [{
+      longkeyid = "ed25519/0xB92445CFC9546F9D";
+      fingerprint = "6881 5A95 D715 D429 659B  48A4 B924 45CF C954 6F9D";
+    }];
+  };
  kmcopper = {
    email = "kmcopper@danwin1210.me";
    name = "Kyle Copperfield";
@ -8331,6 +8347,12 @@
    githubId = 6016963;
    name = "Patrick Winter";
  };
+  wishfort36 = {
+    email = "42300264+wishfort36@users.noreply.github.com";
+    github = "wishfort36";
+    githubId = 42300264;
+    name = "wishfort36";
+  };
  wizeman = {
    email = "rcorreia@wizy.org";
    github = "wizeman";
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -400,6 +400,47 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      The rkt module has been removed, it was archived by upstream.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      The <link xlink:href="https://bazaar.canonical.com">Bazaar</link> VCS is
+      unmaintained and, as consequence of the Python 2 EOL, the packages
+      <literal>bazaar</literal> and <literal>bazaarTools</literal> were
+      removed. Breezy, the backward compatible fork of Bazaar (see the
+      <link xlink:href="https://www.jelmer.uk/breezy-intro.html">announcement</link>),
+      was packaged as <literal>breezy</literal> and can be used instead.
+    </para>
+    <para>
+      Regarding Nixpkgs, <literal>fetchbzr</literal>,
+      <literal>nix-prefetch-bzr</literal> and Bazaar support in Hydra will
+      continue to work through Breezy.
+    </para>
+   </listitem>
+   <listitem>
+     <para>
+       In addition to the hostname, the fully qualified domain name (FQDN),
+       which consists of <literal>${cfg.hostName}</literal> and
+       <literal>${cfg.domain}</literal> is now added to
+       <literal>/etc/hosts</literal>, to allow local FQDN resolution, as used by the
+       <literal>hostname --fqdn</literal> command and other applications that
+       try to determine the FQDN. These new entries take precedence over entries
+       from the DNS which could cause regressions in some very specific setups.
+       Additionally the hostname is now resolved to <literal>127.0.0.2</literal>
+       instead of <literal>127.0.1.1</literal> to be consistent with what
+       <literal>nss-myhostname</literal> (from systemd) returns.
+       The old behaviour can e.g. be restored by using
+       <literal>networking.hosts = lib.mkForce { "127.0.1.1" = [ config.networking.hostName ]; };</literal>.
+     </para>
+   </listitem>
+   <listitem>
+     <para>
+       The hostname (<literal>networking.hostName</literal>) must now be a valid
+       DNS label (see RFC 1035) and as such must not contain the domain part.
+       This means that the hostname must start with a letter, end with a letter
+       or digit, and have as interior characters only letters, digits, and
+       hyphen. The maximum length is 63 characters. Additionally it is
+       recommended to only use lower-case characters.
+     </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@ -8,9 +8,6 @@ let

  cfg = config.networking;

-  localhostMapped4 = cfg.hosts ? "127.0.0.1" && elem "localhost" cfg.hosts."127.0.0.1";
-  localhostMapped6 = cfg.hosts ? "::1"       && elem "localhost" cfg.hosts."::1";
-
  localhostMultiple = any (elem "localhost") (attrValues (removeAttrs cfg.hosts [ "127.0.0.1" "::1" ]));

 in
@ -147,12 +144,6 @@ in
  config = {

    assertions = [{
-      assertion = localhostMapped4;
-      message = ''`networking.hosts` doesn't map "127.0.0.1" to "localhost"'';
-    } {
-      assertion = !cfg.enableIPv6 || localhostMapped6;
-      message = ''`networking.hosts` doesn't map "::1" to "localhost"'';
-    } {
      assertion = !localhostMultiple;
      message = ''
        `networking.hosts` maps "localhost" to something other than "127.0.0.1"
@ -161,22 +152,34 @@ in
      '';
    }];

-    networking.hosts = {
-      "127.0.0.1" = [ "localhost" ];
-    } // optionalAttrs (cfg.hostName != "") {
-      "127.0.1.1" = [ cfg.hostName ];
+    # These entries are required for "hostname -f" and to resolve both the
+    # hostname and FQDN correctly:
+    networking.hosts = let
+      hostnames = # Note: The FQDN (canonical hostname) has to come first:
+        optional (cfg.hostName != "" && cfg.domain != null) "${cfg.hostName}.${cfg.domain}"
+        ++ optional (cfg.hostName != "") cfg.hostName; # Then the hostname (without the domain)
+    in {
+      "127.0.0.2" = hostnames;
    } // optionalAttrs cfg.enableIPv6 {
-      "::1" = [ "localhost" ];
+      "::1" = hostnames;
    };

    networking.hostFiles = let
+      # Note: localhostHosts has to appear first in /etc/hosts so that 127.0.0.1
+      # resolves back to "localhost" (as some applications assume) instead of
+      # the FQDN! By default "networking.hosts" also contains entries for the
+      # FQDN so that e.g. "hostname -f" works correctly.
+      localhostHosts = pkgs.writeText "localhost-hosts" ''
+        127.0.0.1 localhost
+        ${optionalString cfg.enableIPv6 "::1 localhost"}
+      '';
      stringHosts =
        let
          oneToString = set: ip: ip + " " + concatStringsSep " " set.${ip} + "\n";
          allToString = set: concatMapStrings (oneToString set) (attrNames set);
        in pkgs.writeText "string-hosts" (allToString (filterAttrs (_: v: v != []) cfg.hosts));
      extraHosts = pkgs.writeText "extra-hosts" cfg.extraHosts;
-    in mkBefore [ stringHosts extraHosts ];
+    in mkBefore [ localhostHosts stringHosts extraHosts ];

    environment.etc =
      { # /etc/services: TCP/UDP port assignments.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -606,6 +606,7 @@
  ./services/networking/dnsmasq.nix
  ./services/networking/ejabberd.nix
  ./services/networking/epmd.nix
+  ./services/networking/ergo.nix
  ./services/networking/eternal-terminal.nix
  ./services/networking/fakeroute.nix
  ./services/networking/ferm.nix
@ -817,6 +818,7 @@
  ./services/torrent/magnetico.nix
  ./services/torrent/opentracker.nix
  ./services/torrent/peerflix.nix
+  ./services/torrent/rtorrent.nix
  ./services/torrent/transmission.nix
  ./services/ttys/agetty.nix
  ./services/ttys/gpm.nix
@ -829,6 +831,7 @@
  ./services/web-apps/cryptpad.nix
  ./services/web-apps/documize.nix
  ./services/web-apps/dokuwiki.nix
+  ./services/web-apps/engelsystem.nix
  ./services/web-apps/frab.nix
  ./services/web-apps/gerrit.nix
  ./services/web-apps/gotify-server.nix
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@ -26,7 +26,7 @@ let
      scm_mercurial_command: ${pkgs.mercurial}/bin/hg
      scm_git_command: ${pkgs.gitAndTools.git}/bin/git
      scm_cvs_command: ${pkgs.cvs}/bin/cvs
-      scm_bazaar_command: ${pkgs.bazaar}/bin/bzr
+      scm_bazaar_command: ${pkgs.breezy}/bin/bzr
      scm_darcs_command: ${pkgs.darcs}/bin/darcs

    ${cfg.extraConfig}
@ -297,7 +297,7 @@ in
      environment.SCHEMA = "${cfg.stateDir}/cache/schema.db";
      path = with pkgs; [
        imagemagick
-        bazaar
+        breezy
        cvs
        darcs
        gitAndTools.git
--- a/nixos/modules/services/networking/ergo.nix
+++ b/nixos/modules/services/networking/ergo.nix
@ -0,0 +1,141 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.ergo;
+
+  inherit (lib) mkEnableOption mkIf mkOption optionalString types;
+
+  configFile = pkgs.writeText "ergo.conf" (''
+ergo {
+  directory = "${cfg.dataDir}"
+  node {
+    mining = false
+  }
+  wallet.secretStorage.secretDir = "${cfg.dataDir}/wallet/keystore"
+}
+
+scorex {
+  network {
+    bindAddress = "${cfg.listen.ip}:${toString cfg.listen.port}"
+  }
+'' + optionalString (cfg.api.keyHash != null) ''
+ restApi {
+    apiKeyHash = "${cfg.api.keyHash}"
+    bindAddress = "${cfg.api.listen.ip}:${toString cfg.api.listen.port}"
+ }
+'' + ''
+}
+'');
+
+in {
+
+  options = {
+
+    services.ergo = {
+      enable = mkEnableOption "Ergo service";
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/ergo";
+        description = "The data directory for the Ergo node.";
+      };
+
+      listen = {
+        ip = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = "IP address on which the Ergo node should listen.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 9006;
+          description = "Listen port for the Ergo node.";
+        };
+      };
+
+      api = {
+       keyHash = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "324dcf027dd4a30a932c441f365a25e86b173defa4b8e58948253471b81b72cf";
+        description = "Hex-encoded Blake2b256 hash of an API key as a 64-chars long Base16 string.";
+       };
+
+       listen = {
+        ip = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = "IP address that the Ergo node API should listen on if <option>api.keyHash</option> is defined.";
+          };
+
+        port = mkOption {
+          type = types.port;
+          default = 9052;
+          description = "Listen port for the API endpoint if <option>api.keyHash</option> is defined.";
+        };
+       };
+      };
+
+      testnet = mkOption {
+         type = types.bool;
+         default = false;
+         description = "Connect to testnet network instead of the default mainnet.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "ergo";
+        description = "The user as which to run the Ergo node.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = cfg.user;
+        description = "The group as which to run the Ergo node.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for the Ergo node as well as the API.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
+    ];
+
+    systemd.services.ergo = {
+      description = "ergo server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = ''${pkgs.ergo}/bin/ergo \
+                      ${optionalString (!cfg.testnet)
+                      "--mainnet"} \
+                      -c ${configFile}'';
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listen.port ] ++ [ cfg.api.listen.port ];
+    };
+
+    users.users.${cfg.user} = {
+      name = cfg.user;
+      group = cfg.group;
+      description = "Ergo daemon user";
+      home = cfg.dataDir;
+      isSystemUser = true;
+    };
+
+    users.groups.${cfg.group} = {};
+
+  };
+}
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -449,6 +449,13 @@ in {

    systemd.services.ModemManager.aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];

+    # override unit as recommended by upstream - see https://github.com/NixOS/nixpkgs/issues/88089
+    # TODO: keep an eye on modem-manager releases as this will eventually be added to the upstream unit
+    systemd.services.ModemManager.serviceConfig.ExecStart = [
+      ""
+      "${pkgs.modemmanager}/sbin/ModemManager --filter-policy=STRICT"
+    ];
+
    systemd.services.NetworkManager-dispatcher = {
      wantedBy = [ "network.target" ];
      restartTriggers = [ configFile ];
--- a/nixos/modules/services/security/fprintd.nix
+++ b/nixos/modules/services/security/fprintd.nix
@ -29,7 +29,6 @@ in
        type = types.package;
        default = pkgs.fprintd;
        defaultText = "pkgs.fprintd";
-        example = "pkgs.fprintd-thinkpad";
        description = ''
          fprintd package to use.
        '';
--- a/nixos/modules/services/security/usbguard.nix
+++ b/nixos/modules/services/security/usbguard.nix
@ -207,6 +207,29 @@ in {
        Type = "simple";
        ExecStart = ''${cfg.package}/bin/usbguard-daemon -P -k -c ${daemonConfFile}'';
        Restart = "on-failure";
+
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "CAP_CHOWN CAP_FOWNER";
+        DeviceAllow = "/dev/null rw";
+        DevicePolicy = "strict";
+        IPAddressDeny = "any";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelModules = true;
+        ProtectSystem = true;
+        ReadOnlyPaths = "-/";
+        ReadWritePaths = "-/dev/shm -${dirOf cfg.auditFilePath} -/tmp -${dirOf cfg.ruleFile}";
+        RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+        UMask = "0077";
      };
    };
  };
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@ -67,9 +67,19 @@ in
      notificationsCommand = mkOption {
        type = types.nullOr types.str;
        default = null;
-        example = "sudo -u example_user DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus notify-send";
        description = ''
-          Command used to send notifications.
+          This option is deprecated and ignored by earlyoom since 1.6.
+          Use <option>services.earlyoom.enableNotifications</option> instead.
+        '';
+      };
+
+      enableNotifications = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Send notifications about killed processes via the system d-bus.
+          To actually see the notifications in your GUI session, you need to have
+          <literal>systembus-notify</literal> running as your user.

          See <link xlink:href="https://github.com/rfjakob/earlyoom#notifications">README</link> for details.
        '';
@ -87,9 +97,13 @@ in
        message = "Both options in conjunction do not make sense"; }
    ];

+    warnings = optional (ecfg.notificationsCommand != null)
+      "`services.earlyoom.notificationsCommand` is deprecated and ignored by earlyoom since 1.6.";
+
    systemd.services.earlyoom = {
      description = "Early OOM Daemon for Linux";
      wantedBy = [ "multi-user.target" ];
+      path = optional ecfg.enableNotifications pkgs.dbus;
      serviceConfig = {
        StandardOutput = "null";
        StandardError = "syslog";
@ -100,10 +114,11 @@ in
          ${optionalString ecfg.useKernelOOMKiller "-k"} \
          ${optionalString ecfg.ignoreOOMScoreAdjust "-i"} \
          ${optionalString ecfg.enableDebugInfo "-d"} \
-          ${optionalString (ecfg.notificationsCommand != null)
-            "-N ${escapeShellArg ecfg.notificationsCommand}"}
+          ${optionalString ecfg.enableNotifications "-n"}
        '';
      };
    };
+
+    environment.systemPackages = optional ecfg.enableNotifications pkgs.systembus-notify;
  };
 }
--- a/nixos/modules/services/torrent/rtorrent.nix
+++ b/nixos/modules/services/torrent/rtorrent.nix
@ -0,0 +1,209 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.rtorrent;
+
+in {
+  options.services.rtorrent = {
+    enable = mkEnableOption "rtorrent";
+
+    dataDir = mkOption {
+      type = types.str;
+      default = "/var/lib/rtorrent";
+      description = ''
+        The directory where rtorrent stores its data files.
+      '';
+    };
+
+    downloadDir = mkOption {
+      type = types.str;
+      default = "${cfg.dataDir}/download";
+      description = ''
+        Where to put downloaded files.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "rtorrent";
+      description = ''
+        User account under which rtorrent runs.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "rtorrent";
+      description = ''
+        Group under which rtorrent runs.
+      '';
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.rtorrent;
+      defaultText = "pkgs.rtorrent";
+      description = ''
+        The rtorrent package to use.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 50000;
+      description = ''
+        The rtorrent port.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for the port in <option>services.rtorrent.port</option>.
+      '';
+    };
+
+    rpcSocket = mkOption {
+      type = types.str;
+      readOnly = true;
+      default = "/run/rtorrent/rpc.sock";
+      description = ''
+        RPC socket path.
+      '';
+    };
+
+    configText = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        The content of <filename>rtorrent.rc</filename>. The <link xlink:href="https://rtorrent-docs.readthedocs.io/en/latest/cookbook.html#modernized-configuration-template">modernized configuration template</link> with the values specified in this module will be prepended using mkBefore. You can use mkForce to overwrite the config completly.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.groups = mkIf (cfg.group == "rtorrent") {
+      rtorrent = {};
+    };
+
+    users.users = mkIf (cfg.user == "rtorrent") {
+      rtorrent = {
+        group = cfg.group;
+        shell = pkgs.bashInteractive;
+        home = cfg.dataDir;
+        description = "rtorrent Daemon user";
+        isSystemUser = true;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf (cfg.openFirewall) [ cfg.port ];
+
+    services.rtorrent.configText = mkBefore ''
+      # Instance layout (base paths)
+      method.insert = cfg.basedir, private|const|string, (cat,"${cfg.dataDir}/")
+      method.insert = cfg.watch,   private|const|string, (cat,(cfg.basedir),"watch/")
+      method.insert = cfg.logs,    private|const|string, (cat,(cfg.basedir),"log/")
+      method.insert = cfg.logfile, private|const|string, (cat,(cfg.logs),(system.time),".log")
+      method.insert = cfg.rpcsock, private|const|string, (cat,"${cfg.rpcSocket}")
+
+      # Create instance directories
+      execute.throw = sh, -c, (cat, "mkdir -p ", (cfg.basedir), "/session ", (cfg.watch), " ", (cfg.logs))
+
+      # Listening port for incoming peer traffic (fixed; you can also randomize it)
+      network.port_range.set = ${toString cfg.port}-${toString cfg.port}
+      network.port_random.set = no
+
+      # Tracker-less torrent and UDP tracker support
+      # (conservative settings for 'private' trackers, change for 'public')
+      dht.mode.set = disable
+      protocol.pex.set = no
+      trackers.use_udp.set = no
+
+      # Peer settings
+      throttle.max_uploads.set = 100
+      throttle.max_uploads.global.set = 250
+
+      throttle.min_peers.normal.set = 20
+      throttle.max_peers.normal.set = 60
+      throttle.min_peers.seed.set = 30
+      throttle.max_peers.seed.set = 80
+      trackers.numwant.set = 80
+
+      protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
+
+      # Limits for file handle resources, this is optimized for
+      # an `ulimit` of 1024 (a common default). You MUST leave
+      # a ceiling of handles reserved for rTorrent's internal needs!
+      network.http.max_open.set = 50
+      network.max_open_files.set = 600
+      network.max_open_sockets.set = 3000
+
+      # Memory resource usage (increase if you have a large number of items loaded,
+      # and/or the available resources to spend)
+      pieces.memory.max.set = 1800M
+      network.xmlrpc.size_limit.set = 4M
+
+      # Basic operational settings (no need to change these)
+      session.path.set = (cat, (cfg.basedir), "session/")
+      directory.default.set = "${cfg.downloadDir}"
+      log.execute = (cat, (cfg.logs), "execute.log")
+      ##log.xmlrpc = (cat, (cfg.logs), "xmlrpc.log")
+      execute.nothrow = sh, -c, (cat, "echo >", (session.path), "rtorrent.pid", " ", (system.pid))
+
+      # Other operational settings (check & adapt)
+      encoding.add = utf8
+      system.umask.set = 0027
+      system.cwd.set = (cfg.basedir)
+      network.http.dns_cache_timeout.set = 25
+      schedule2 = monitor_diskspace, 15, 60, ((close_low_diskspace, 1000M))
+
+      # Watch directories (add more as you like, but use unique schedule names)
+      #schedule2 = watch_start, 10, 10, ((load.start, (cat, (cfg.watch), "start/*.torrent")))
+      #schedule2 = watch_load, 11, 10, ((load.normal, (cat, (cfg.watch), "load/*.torrent")))
+
+      # Logging:
+      #   Levels = critical error warn notice info debug
+      #   Groups = connection_* dht_* peer_* rpc_* storage_* thread_* tracker_* torrent_*
+      print = (cat, "Logging to ", (cfg.logfile))
+      log.open_file = "log", (cfg.logfile)
+      log.add_output = "info", "log"
+      ##log.add_output = "tracker_debug", "log"
+
+      # XMLRPC
+      scgi_local = (cfg.rpcsock)
+      schedule = scgi_group,0,0,"execute.nothrow=chown,\":rtorrent\",(cfg.rpcsock)"
+      schedule = scgi_permission,0,0,"execute.nothrow=chmod,\"g+w,o=\",(cfg.rpcsock)"
+    '';
+
+    systemd = {
+      services = {
+        rtorrent = let
+          rtorrentConfigFile = pkgs.writeText "rtorrent.rc" cfg.configText;
+        in {
+          description = "rTorrent system service";
+          after = [ "network.target" ];
+          path = [ cfg.package pkgs.bash ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            User = cfg.user;
+            Group = cfg.group;
+            Type = "simple";
+            Restart = "on-failure";
+            WorkingDirectory = cfg.dataDir;
+            ExecStartPre=''${pkgs.bash}/bin/bash -c "if test -e ${cfg.dataDir}/session/rtorrent.lock && test -z $(${pkgs.procps}/bin/pidof rtorrent); then rm -f ${cfg.dataDir}/session/rtorrent.lock; fi"'';
+            ExecStart="${cfg.package}/bin/rtorrent -n -o system.daemon.set=true -o import=${rtorrentConfigFile}";
+            RuntimeDirectory = "rtorrent";
+            RuntimeDirectoryMode = 755;
+          };
+        };
+      };
+
+      tmpfiles.rules = [ "d '${cfg.dataDir}' 0750 ${cfg.user} ${cfg.group} -" ];
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/engelsystem.nix
+++ b/nixos/modules/services/web-apps/engelsystem.nix
@ -0,0 +1,186 @@
+{ config, lib, pkgs, utils, ... }:
+
+let
+  inherit (lib) mkDefault mkEnableOption mkIf mkOption types literalExample;
+  cfg = config.services.engelsystem;
+in {
+  options = {
+    services.engelsystem = {
+      enable = mkOption {
+        default = false;
+        example = true;
+        description = ''
+          Whether to enable engelsystem, an online tool for coordinating helpers
+          and shifts on large events.
+        '';
+        type = lib.types.bool;
+      };
+
+      domain = mkOption {
+        type = types.str;
+        example = "engelsystem.example.com";
+        description = "Domain to serve on.";
+      };
+
+      package = mkOption {
+        type = types.package;
+        example = literalExample "pkgs.engelsystem";
+        description = "Engelsystem package used for the service.";
+        default = pkgs.engelsystem;
+      };
+
+      createDatabase = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to create a local database automatically.
+          This will override every database setting in <option>services.engelsystem.config</option>.
+        '';
+      };
+    };
+
+    services.engelsystem.config = mkOption {
+      type = types.attrs;
+      default = {
+        database = {
+          host = "localhost";
+          database = "engelsystem";
+          username = "engelsystem";
+        };
+      };
+      example = {
+        maintenance = false;
+        database = {
+          host = "database.example.com";
+          database = "engelsystem";
+          username = "engelsystem";
+          password._secret = "/var/keys/engelsystem/database";
+        };
+        email = {
+          driver = "smtp";
+          host = "smtp.example.com";
+          port = 587;
+          from.address = "engelsystem@example.com";
+          from.name = "example engelsystem";
+          encryption = "tls";
+          username = "engelsystem@example.com";
+          password._secret = "/var/keys/engelsystem/mail";
+        };
+        autoarrive = true;
+        min_password_length = 6;
+        default_locale = "de_DE";
+      };
+      description = ''
+        Options to be added to config.php, as a nix attribute set. Options containing secret data
+        should be set to an attribute set containing the attribute _secret - a string pointing to a
+        file containing the value the option should be set to. See the example to get a better
+        picture of this: in the resulting config.php file, the email.password key will be set to
+        the contents of the /var/keys/engelsystem/mail file.
+
+        See https://engelsystem.de/doc/admin/configuration/ for available options.
+
+        Note that the admin user login credentials cannot be set here - they always default to
+        admin:asdfasdf. Log in and change them immediately.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # create database
+    services.mysql = mkIf cfg.createDatabase {
+      enable = true;
+      package = mkDefault pkgs.mysql;
+      ensureUsers = [{
+        name = "engelsystem";
+        ensurePermissions = { "engelsystem.*" = "ALL PRIVILEGES"; };
+      }];
+      ensureDatabases = [ "engelsystem" ];
+    };
+
+    environment.etc."engelsystem/config.php".source =
+      pkgs.writeText "config.php" ''
+        <?php
+        return json_decode(file_get_contents("/var/lib/engelsystem/config.json"), true);
+      '';
+
+    services.phpfpm.pools.engelsystem = {
+      user = "engelsystem";
+      settings = {
+        "listen.owner" = config.services.nginx.user;
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.max_requests" = 500;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 5;
+        "php_admin_value[error_log]" = "stderr";
+        "php_admin_flag[log_errors]" = true;
+        "catch_workers_output" = true;
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts."${cfg.domain}".locations = {
+        "/" = {
+          root = "${cfg.package}/share/engelsystem/public";
+          extraConfig = ''
+            index index.php;
+            try_files $uri $uri/ /index.php?$args;
+            autoindex off;
+          '';
+        };
+        "~ \\.php$" = {
+          root = "${cfg.package}/share/engelsystem/public";
+          extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools.engelsystem.socket};
+            fastcgi_index index.php;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            include ${config.services.nginx.package}/conf/fastcgi_params;
+            include ${config.services.nginx.package}/conf/fastcgi.conf;
+          '';
+        };
+      };
+    };
+
+    systemd.services."engelsystem-init" = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = { Type = "oneshot"; };
+      script =
+        let
+          genConfigScript = pkgs.writeScript "engelsystem-gen-config.sh"
+            (utils.genJqSecretsReplacementSnippet cfg.config "config.json");
+        in ''
+          umask 077
+          mkdir -p /var/lib/engelsystem/storage/app
+          mkdir -p /var/lib/engelsystem/storage/cache/views
+          cd /var/lib/engelsystem
+          ${genConfigScript}
+          chmod 400 config.json
+          chown -R engelsystem .
+      '';
+    };
+    systemd.services."engelsystem-migrate" = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "engelsystem";
+        Group = "engelsystem";
+      };
+      script = ''
+        ${cfg.package}/bin/migrate
+      '';
+      after = [ "engelsystem-init.service" "mysql.service" ];
+    };
+    systemd.services."phpfpm-engelsystem".after =
+      [ "engelsystem-migrate.service" ];
+
+    users.users.engelsystem = {
+      isSystemUser = true;
+      createHome = true;
+      home = "/var/lib/engelsystem/storage";
+      group = "engelsystem";
+    };
+    users.groups.engelsystem = { };
+  };
+}
--- a/nixos/modules/services/x11/desktop-managers/cde.nix
+++ b/nixos/modules/services/x11/desktop-managers/cde.nix
@ -8,9 +8,26 @@ let
 in {
  options.services.xserver.desktopManager.cde = {
    enable = mkEnableOption "Common Desktop Environment";
+
+    extraPackages = mkOption {
+      type = with types; listOf package;
+      default = with pkgs.xorg; [
+        xclock bitmap xlsfonts xfd xrefresh xload xwininfo xdpyinfo xwd xwud
+      ];
+      example = literalExample ''
+        with pkgs.xorg; [
+          xclock bitmap xlsfonts xfd xrefresh xload xwininfo xdpyinfo xwd xwud
+        ]
+      '';
+      description = ''
+        Extra packages to be installed system wide.
+      '';
+    };
  };

  config = mkIf (xcfg.enable && cfg.enable) {
+    environment.systemPackages = cfg.extraPackages;
+
    services.rpcbind.enable = true;

    services.xinetd.enable = true;
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -32,15 +32,14 @@ in

  config = mkIf cfg.enable {

-    environment.systemPackages = [
-      e.efl e.enlightenment
-      e.terminology e.econnman
-      pkgs.xorg.xauth # used by kdesu
-      pkgs.gtk2 # To get GTK's themes.
-      pkgs.tango-icon-theme
-
-      pkgs.gnome-icon-theme
-      pkgs.xorg.xcursorthemes
+    environment.systemPackages = with pkgs; [
+      enlightenment.econnman
+      enlightenment.efl
+      enlightenment.enlightenment
+      enlightenment.ephoto
+      enlightenment.rage
+      enlightenment.terminology
+      xorg.xcursorthemes
    ];

    environment.pathsToLink = [
@ -50,11 +49,10 @@ in
      "/share/locale"
    ];

-    services.xserver.desktopManager.session = [
-    { name = "Enlightenment";
-      start = ''
-        export XDG_MENU_PREFIX=e-
+    services.xserver.displayManager.sessionPackages = [ pkgs.enlightenment.enlightenment ];

+    services.xserver.displayManager.sessionCommands = ''
+      if test "$XDG_CURRENT_DESKTOP" = "Enlightenment"; then
        export GST_PLUGIN_PATH="${GST_PLUGIN_PATH}"

        # make available for D-BUS user services
@ -62,12 +60,15 @@ in

        # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
        ${pkgs.xdg-user-dirs}/bin/xdg-user-dirs-update
-
-        exec ${e.enlightenment}/bin/enlightenment_start
+      fi
    '';
-    }];

-    security.wrappers = (import "${e.enlightenment}/e-wrappers.nix").security.wrappers;
+    # Wrappers for programs installed by enlightenment that should be setuid
+    security.wrappers = {
+      enlightenment_ckpasswd.source = "${pkgs.enlightenment.enlightenment}/lib/enlightenment/utils/enlightenment_ckpasswd";
+      enlightenment_sys.source = "${pkgs.enlightenment.enlightenment}/lib/enlightenment/utils/enlightenment_sys";
+      enlightenment_system.source = "${pkgs.enlightenment.enlightenment}/lib/enlightenment/utils/enlightenment_system";
+    };

    environment.etc."X11/xkb".source = xcfg.xkbDir;

--- a/nixos/modules/services/x11/desktop-managers/lumina.nix
+++ b/nixos/modules/services/x11/desktop-managers/lumina.nix
@ -23,12 +23,9 @@ in

  config = mkIf cfg.enable {

-    services.xserver.desktopManager.session = singleton {
-      name = "lumina";
-      start = ''
-        exec ${pkgs.lumina.lumina}/bin/start-lumina-desktop
-      '';
-    };
+    services.xserver.displayManager.sessionPackages = [
+      pkgs.lumina.lumina
+    ];

    environment.systemPackages =
      pkgs.lumina.preRequisitePackages ++
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -376,10 +376,20 @@ in

    networking.hostName = mkOption {
      default = "nixos";
-      type = types.str;
+      # Only allow hostnames without the domain name part (i.e. no FQDNs, see
+      # e.g. "man 5 hostname") and require valid DNS labels (recommended
+      # syntax). Note: We also allow underscores for compatibility/legacy
+      # reasons (as undocumented feature):
+      type = types.strMatching
+        "^[[:alpha:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
      description = ''
-        The name of the machine.  Leave it empty if you want to obtain
-        it from a DHCP server (if using DHCP).
+        The name of the machine. Leave it empty if you want to obtain it from a
+        DHCP server (if using DHCP). The hostname must be a valid DNS label (see
+        RFC 1035 section 2.3.1: "Preferred name syntax") and as such must not
+        contain the domain part. This means that the hostname must start with a
+        letter, end with a letter or digit, and have as interior characters only
+        letters, digits, and hyphen. The maximum length is 63 characters.
+        Additionally it is recommended to only use lower-case characters.
      '';
    };

--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@ -5,6 +5,8 @@ with lib;
 let
  cfg = config.virtualisation.cri-o;

+  crioPackage = (pkgs.cri-o.override { inherit (cfg) extraPackages; });
+
  # Copy configuration files to avoid having the entire sources in the system closure
  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
    cp ${filePath} $out
@ -23,55 +25,90 @@ in
    enable = mkEnableOption "Container Runtime Interface for OCI (CRI-O)";

    storageDriver = mkOption {
-      type = types.enum ["btrfs" "overlay" "vfs"];
+      type = types.enum [ "btrfs" "overlay" "vfs" ];
      default = "overlay";
      description = "Storage driver to be used";
    };

    logLevel = mkOption {
-      type = types.enum ["trace" "debug" "info" "warn" "error" "fatal"];
+      type = types.enum [ "trace" "debug" "info" "warn" "error" "fatal" ];
      default = "info";
      description = "Log level to be used";
    };

    pauseImage = mkOption {
-      type = types.str;
-      default = "k8s.gcr.io/pause:3.1";
-      description = "Pause image for pod sandboxes to be used";
+      type = types.nullOr types.str;
+      default = null;
+      description = "Override the default pause image for pod sandboxes";
+      example = [ "k8s.gcr.io/pause:3.2" ];
    };

    pauseCommand = mkOption {
-      type = types.str;
-      default = "/pause";
-      description = "Pause command to be executed";
+      type = types.nullOr types.str;
+      default = null;
+      description = "Override the default pause command";
+      example = [ "/pause" ];
+    };
+
+    runtime = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Override the default runtime";
+      example = [ "crun" ];
+    };
+
+    extraPackages = mkOption {
+      type = with types; listOf package;
+      default = [ ];
+      example = lib.literalExample ''
+        [
+          pkgs.gvisor
+        ]
+      '';
+      description = ''
+        Extra packages to be installed in the CRI-O wrapper.
+      '';
+    };
+
+    package = lib.mkOption {
+      type = types.package;
+      default = crioPackage;
+      internal = true;
+      description = ''
+        The final CRI-O package (including extra packages).
+      '';
    };
  };

  config = mkIf cfg.enable {
-    environment.systemPackages = with pkgs;
-      [ cri-o cri-tools conmon iptables runc utillinux ];
+    environment.systemPackages = [ cfg.package pkgs.cri-tools ];

-    environment.etc."crictl.yaml".source = copyFile "${pkgs.cri-o.src}/crictl.yaml";
+    environment.etc."crictl.yaml".source = copyFile "${pkgs.cri-o-unwrapped.src}/crictl.yaml";

    environment.etc."crio/crio.conf".text = ''
      [crio]
      storage_driver = "${cfg.storageDriver}"

      [crio.image]
-      pause_image = "${cfg.pauseImage}"
-      pause_command = "${cfg.pauseCommand}"
+      ${optionalString (cfg.pauseImage != null) ''pause_image = "${cfg.pauseImage}"''}
+      ${optionalString (cfg.pauseCommand != null) ''pause_command = "${cfg.pauseCommand}"''}

      [crio.network]
      plugin_dirs = ["${pkgs.cni-plugins}/bin/"]
-      network_dir = "/etc/cni/net.d/"

      [crio.runtime]
-      conmon = "${pkgs.conmon}/bin/conmon"
+      cgroup_manager = "systemd"
      log_level = "${cfg.logLevel}"
-      manage_network_ns_lifecycle = true
+      manage_ns_lifecycle = true
+
+      ${optionalString (cfg.runtime != null) ''
+      default_runtime = "${cfg.runtime}"
+      [crio.runtime.runtimes]
+      [crio.runtime.runtimes.${cfg.runtime}]
+      ''}
    '';

-    environment.etc."cni/net.d/10-crio-bridge.conf".source = copyFile "${pkgs.cri-o.src}/contrib/cni/10-crio-bridge.conf";
+    environment.etc."cni/net.d/10-crio-bridge.conf".source = copyFile "${pkgs.cri-o-unwrapped.src}/contrib/cni/10-crio-bridge.conf";

    # Enable common /etc/containers configuration
    virtualisation.containers.enable = true;
@ -81,10 +118,10 @@ in
      documentation = [ "https://github.com/cri-o/cri-o" ];
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      path = [ pkgs.utillinux pkgs.runc pkgs.iptables ];
+      path = [ cfg.package ];
      serviceConfig = {
        Type = "notify";
-        ExecStart = "${pkgs.cri-o}/bin/crio";
+        ExecStart = "${cfg.package}/bin/crio";
        ExecReload = "/bin/kill -s HUP $MAINPID";
        TasksMax = "infinity";
        LimitNOFILE = "1048576";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -87,8 +87,10 @@ in
  ecryptfs = handleTest ./ecryptfs.nix {};
  ejabberd = handleTest ./xmpp/ejabberd.nix {};
  elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
+  engelsystem = handleTest ./engelsystem.nix {};
  enlightenment = handleTest ./enlightenment.nix {};
  env = handleTest ./env.nix {};
+  ergo = handleTest ./ergo.nix {};
  etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
  etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {};
  fancontrol = handleTest ./fancontrol.nix {};
@ -133,6 +135,7 @@ in
  hitch = handleTest ./hitch {};
  hocker-fetchdocker = handleTest ./hocker-fetchdocker {};
  home-assistant = handleTest ./home-assistant.nix {};
+  hostname = handleTest ./hostname.nix {};
  hound = handleTest ./hound.nix {};
  hydra = handleTest ./hydra {};
  hydra-db-migration = handleTest ./hydra/db-migration.nix {};
--- a/nixos/tests/engelsystem.nix
+++ b/nixos/tests/engelsystem.nix
@ -0,0 +1,41 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  {
+    name = "engelsystem";
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ talyz ];
+    };
+
+    nodes.engelsystem =
+      { ... }:
+      {
+        services.engelsystem = {
+          enable = true;
+          domain = "engelsystem";
+          createDatabase = true;
+        };
+        networking.firewall.allowedTCPPorts = [ 80 443 ];
+        environment.systemPackages = with pkgs; [
+          xmlstarlet
+          libxml2
+        ];
+      };
+
+    testScript = ''
+      engelsystem.start()
+      engelsystem.wait_for_unit("phpfpm-engelsystem.service")
+      engelsystem.wait_until_succeeds("curl engelsystem/login -sS -f")
+      engelsystem.succeed(
+          "curl engelsystem/login -sS -f -c cookie | xmllint -html -xmlout - >login"
+      )
+      engelsystem.succeed(
+          "xml sel -T -t -m \"html/head/meta[@name='csrf-token']\" -v @content login >token"
+      )
+      engelsystem.succeed(
+          "curl engelsystem/login -sS -f -b cookie -F 'login=admin' -F 'password=asdfasdf' -F '_token=<token' -L | xmllint -html -xmlout - >news"
+      )
+      engelsystem.succeed(
+          "test 'News - Engelsystem' = \"$(xml sel -T -t -c html/head/title news)\""
+      )
+    '';
+  })
--- a/nixos/tests/enlightenment.nix
+++ b/nixos/tests/enlightenment.nix
@ -41,28 +41,24 @@ import ./make-test-python.nix ({ pkgs, ...} :

    with subtest("First time wizard"):
        machine.wait_for_text("Default")  # Language
-        machine.succeed("xdotool mousemove 512 185 click 1")  # Default Language
        machine.screenshot("wizard1")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next
+        machine.screenshot("wizard2")

        machine.wait_for_text("English")  # Keyboard (default)
-        machine.screenshot("wizard2")
-        machine.succeed("xdotool mousemove 512 740 click 1")  # Next
-
-        machine.wait_for_text("Standard")  # Profile (default)
        machine.screenshot("wizard3")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

-        machine.wait_for_text("Title")  # Sizing (default)
+        machine.wait_for_text("Standard")  # Profile (default)
        machine.screenshot("wizard4")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

-        machine.wait_for_text("clicked")  # Windows Phocus
-        machine.succeed("xdotool mousemove 512 370 click 1")  # Click
+        machine.wait_for_text("Title")  # Sizing (default)
        machine.screenshot("wizard5")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

-        machine.wait_for_text("bindings")  # Mouse Modifiers (default)
+        machine.wait_for_text("clicked")  # Windows Focus
+        machine.succeed("xdotool mousemove 512 370 click 1")  # Click
        machine.screenshot("wizard6")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

@ -74,7 +70,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
        machine.screenshot("wizard8")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

-        machine.wait_for_text("Compositing")  # Compositing (default)
+        machine.wait_for_text("OpenGL")  # Compositing (default)
        machine.screenshot("wizard9")
        machine.succeed("xdotool mousemove 512 740 click 1")  # Next

--- a/nixos/tests/ergo.nix
+++ b/nixos/tests/ergo.nix
@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "ergo";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
+
+  nodes = {
+    machine = { ... }: {
+      services.ergo.enable = true;
+      services.ergo.api.keyHash = "324dcf027dd4a30a932c441f365a25e86b173defa4b8e58948253471b81b72cf";
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("ergo.service")
+  '';
+})
--- a/nixos/tests/hostname.nix
+++ b/nixos/tests/hostname.nix
@ -0,0 +1,66 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let
+  makeHostNameTest = hostName: domain:
+    let
+      fqdn = hostName + (optionalString (domain != null) ".${domain}");
+    in
+      makeTest {
+        name = "hostname-${fqdn}";
+        meta = with pkgs.stdenv.lib.maintainers; {
+          maintainers = [ primeos blitz ];
+        };
+
+        machine = { lib, ... }: {
+          networking.hostName = hostName;
+          networking.domain = domain;
+
+          environment.systemPackages = with pkgs; [
+            inetutils
+          ];
+        };
+
+        testScript = ''
+          start_all()
+
+          machine = ${hostName}
+
+          machine.wait_for_unit("network-online.target")
+
+          # The FQDN, domain name, and hostname detection should work as expected:
+          assert "${fqdn}" == machine.succeed("hostname --fqdn").strip()
+          assert "${optionalString (domain != null) domain}" == machine.succeed("dnsdomainname").strip()
+          assert (
+              "${hostName}"
+              == machine.succeed(
+                  'hostnamectl status | grep "Static hostname" | cut -d: -f2'
+              ).strip()
+          )
+
+          # 127.0.0.1 and ::1 should resolve back to "localhost":
+          assert (
+              "localhost" == machine.succeed("getent hosts 127.0.0.1 | awk '{print $2}'").strip()
+          )
+          assert "localhost" == machine.succeed("getent hosts ::1 | awk '{print $2}'").strip()
+
+          # 127.0.0.2 should resolve back to the FQDN and hostname:
+          fqdn_and_host_name = "${optionalString (domain != null) "${hostName}.${domain} "}${hostName}"
+          assert (
+              fqdn_and_host_name
+              == machine.succeed("getent hosts 127.0.0.2 | awk '{print $2,$3}'").strip()
+          )
+        '';
+      };
+
+in
+{
+  noExplicitDomain = makeHostNameTest "ahost" null;
+
+  explicitDomain = makeHostNameTest "ahost" "adomain";
+}
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -26,6 +26,10 @@ let

    mopidy-mpd = callPackage ./mpd.nix { };

+    mopidy-mpris = callPackage ./mpris.nix { };
+
+    mopidy-somafm = callPackage ./somafm.nix { };
+
    mopidy-spotify-tunigo = callPackage ./spotify-tunigo.nix { };

    mopidy-youtube = callPackage ./youtube.nix { };
--- a/pkgs/applications/audio/mopidy/gmusic.nix
+++ b/pkgs/applications/audio/mopidy/gmusic.nix
@ -1,19 +1,20 @@
-{ stdenv, fetchurl, pythonPackages, mopidy }:
+{ stdenv, python3Packages, mopidy }:

-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "mopidy-gmusic";
-  version = "3.0.0";
+  version = "4.0.0";

-  src = fetchurl {
-    url = "https://github.com/mopidy/mopidy-gmusic/archive/v${version}.tar.gz";
-    sha256 = "0a2s4xrrhnkv85rx4w5bj6ih9xm34jy0q71fdvbzmi827g9dw5sz";
+  src = python3Packages.fetchPypi {
+    inherit version;
+    pname = "Mopidy-GMusic";
+    sha256 = "14yswmlfs659rs3k595606m77lw9c6pjykb5pikqw21sb97haxl3";
  };

  propagatedBuildInputs = [
    mopidy
-    pythonPackages.requests
-    pythonPackages.gmusicapi
-    pythonPackages.cachetools
+    python3Packages.requests
+    python3Packages.gmusicapi
+    python3Packages.cachetools
  ];

  doCheck = false;
--- a/pkgs/applications/audio/mopidy/mpris.nix
+++ b/pkgs/applications/audio/mopidy/mpris.nix
@ -0,0 +1,27 @@
+{ stdenv, python3Packages, mopidy }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mopidy-mpris";
+  version = "3.0.1";
+
+  src = python3Packages.fetchPypi {
+    inherit version;
+    pname = "Mopidy-MPRIS";
+    sha256 = "0qk46aq5r92qgkldzl41x09naww1gv92l4c4hknyl7yymyvm9lr2";
+  };
+
+  propagatedBuildInputs = [
+    mopidy
+    python3Packages.pydbus
+  ];
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    homepage = https://www.mopidy.com/;
+    description = "Mopidy extension for controlling Mopidy through D-Bus using the MPRIS specification";
+    license = licenses.asl20;
+    maintainers = [ maintainers.nickhu ];
+  };
+}
+
--- a/pkgs/applications/audio/mopidy/somafm.nix
+++ b/pkgs/applications/audio/mopidy/somafm.nix
@ -0,0 +1,26 @@
+{ stdenv, python3Packages, mopidy }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mopidy-somafm";
+  version = "2.0.0";
+
+  src = python3Packages.fetchPypi {
+    inherit version;
+    pname = "Mopidy-SomaFM";
+    sha256 = "1j88rrliys8hqvnb35k1xqw88bvrllcb4rb53lgh82byhscsxlf3";
+  };
+
+  propagatedBuildInputs = [
+    mopidy
+  ];
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    homepage = https://www.mopidy.com/;
+    description = "Mopidy extension for playing music from SomaFM";
+    license = licenses.mit;
+    maintainers = [ maintainers.nickhu ];
+  };
+}
+
--- a/pkgs/applications/audio/mopidy/youtube.nix
+++ b/pkgs/applications/audio/mopidy/youtube.nix
@ -1,17 +1,23 @@
-{ stdenv, fetchFromGitHub, pythonPackages, mopidy }:
+{ stdenv, python3Packages, mopidy }:

-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "mopidy-youtube";
-  version = "2.0.2";
+  version = "3.0";

-  src = fetchFromGitHub {
-    owner = "mopidy";
-    repo = "mopidy-youtube";
-    rev = "v${version}";
-    sha256 = "06r3ikyg2ch5n7fbn3sgj04hk6icpfpk1r856qch41995k3bbfg7";
+  src = python3Packages.fetchPypi {
+    inherit version;
+    pname = "Mopidy-YouTube";
+    sha256 = "0x1q9rfnjx65n6hi8s5rw5ff4xv55h63zy52fwm8aksdnzppr7gd";
  };

-  propagatedBuildInputs = with pythonPackages; [ mopidy pafy ];
+  patchPhase = "sed s/bs4/beautifulsoup4/ -i setup.cfg";
+
+  propagatedBuildInputs = [
+    mopidy
+    python3Packages.beautifulsoup4
+    python3Packages.cachetools
+    python3Packages.youtube-dl
+  ];

  doCheck = false;

--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -1,16 +1,16 @@
 { stdenv, fetchurl, autoPatchelfHook, makeWrapper
-, alsaLib, xorg
+, alsaLib, xorg, libjack2
 , gtk3, pango, gdk-pixbuf, cairo, glib, freetype
 , libpulseaudio, xdg_utils
 }:

 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "5.987";
+  version = "6.10";

  src = fetchurl {
    url = "https://www.reaper.fm/files/${stdenv.lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_x86_64.tar.xz";
-    sha256 = "040k5inzj7mmi75fc6hr0ym18y5xss1675bl5rmhn4sq535m289k";
+    sha256 = "1p54phmsa6xbqxb5cpgwnz7ny4famb8zi25y3cmxwgr4pfy94b2p";
  };

  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    rm $out/opt/REAPER/uninstall-reaper.sh

    wrapProgram $out/opt/REAPER/reaper \
-      --prefix LD_LIBRARY_PATH : ${libpulseaudio}/lib
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ libpulseaudio libjack2 ]}"

    mkdir $out/bin
    ln -s $out/opt/REAPER/reaper $out/bin/
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@ -5,13 +5,13 @@

 buildPythonApplication rec {
  pname = "vorta";
-  version = "0.6.24";
+  version = "0.6.26";

  src = fetchFromGitHub {
    owner = "borgbase";
    repo = "vorta";
    rev = "v${version}";
-    sha256 = "1xc4cng4npc7g739qd909a8wim6s6sn8h8bb1wpxzg4gcnfyin8z";
+    sha256 = "189kzwdmissg9142cd7wvxa1rvc2y7lysgr7if99zc7ks59mv6dq";
  };

  postPatch = ''
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchurl, makeWrapper, jre }:
+
+stdenv.mkDerivation rec {
+  pname = "ergo";
+  version = "3.2.5";
+
+  src = fetchurl {
+    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
+    sha256 = "0vaq6cqz03ps0fg3rvk298jnbf8mazvmyfcj7zsf1cgw41xdjjcf";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    makeWrapper ${jre}/bin/java $out/bin/ergo --add-flags "-jar $src"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Open protocol that implements modern scientific ideas in the blockchain area";
+    homepage = "https://ergoplatform.org/en/";
+    license = licenses.cc0;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ mmahut ];
+  };
+}
--- a/pkgs/applications/editors/gnome-latex/default.nix
+++ b/pkgs/applications/editors/gnome-latex/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, wrapGAppsHook, gsettings-desktop-schemas, gspell, gtksourceview4, libgee
 , tepl, amtk, gnome3, glib, pkgconfig, intltool, itstool, libxml2 }:
 let
-  version = "3.32.0";
+  version = "3.36.0";
  pname = "gnome-latex";
 in stdenv.mkDerivation {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1jdca9yhm7mm1aijd1a5amphgn15142kngky3id2am379ixrq1hg";
+    sha256 = "1869kr1zhcp04mzbi67lwgk497w840dbbc7427i9yh9b9s7j6mqn";
  };

  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
--- a/pkgs/applications/editors/lite/default.nix
+++ b/pkgs/applications/editors/lite/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "lite";
-  version = "1.03";
+  version = "1.05";

  src = fetchFromGitHub {
    owner = "rxi";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1h8z4fav5ns9sm92axs3k9v6jgkqq0vg9mixza14949blr426mlj";
+    sha256 = "0xh29ddl5h92n1c4nlh4kx9mchwkzn4r3l16kklix3a1jm1c878a";
  };

  nativeBuildInputs = [ makeWrapper pkg-config ];
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -20,11 +20,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "nano";
-  version = "4.9.1";
+  version = "4.9.3";

  src = fetchurl {
    url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "0v5s58j3lbg5s6gapl9kjmzph7zgwaam53qspycy2sxaxw65mkaj";
+    sha256 = "1d2i3wvsq5lvpxxinq51dcvd58xx7j0d0c2csz9hgvd06gq3hd3f";
  };

  nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
--- a/pkgs/applications/graphics/avocode/default.nix
+++ b/pkgs/applications/graphics/avocode/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "avocode";
-  version = "4.6.2";
+  version = "4.6.3";

  src = fetchurl {
    url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "1ldvscxfvwpsir8vr1ca9ra0841m6xy331ys31dngcp77nwncjqc";
+    sha256 = "1s8i82963fdx5q4wgh0cn211h0p1r1mzyss0g99bplp8d9ll40kw";
  };

  libPath = stdenv.lib.makeLibraryPath (with xorg; [
--- a/pkgs/applications/graphics/nomacs/default.nix
+++ b/pkgs/applications/graphics/nomacs/default.nix
@ -55,7 +55,7 @@ mkDerivation rec {
  meta = with stdenv.lib; {
    homepage = "https://nomacs.org";
    description = "Qt-based image viewer";
-    maintainers = [maintainers.ahmedtd];
+    maintainers = with stdenv.lib.maintainers; [ mindavi ];
    license = licenses.gpl3Plus;
    repositories.git = "https://github.com/nomacs/nomacs.git";
    inherit (qtbase.meta) platforms;
--- a/pkgs/applications/graphics/nomacs/nomacs-iostream.patch
+++ b/pkgs/applications/graphics/nomacs/nomacs-iostream.patch
@ -1,26 +0,0 @@
-diff --git a/src/DkCore/DkMetaData.cpp b/src/DkCore/DkMetaData.cpp
-index d195757e..affec7be 100644
--- a/src/DkCore/DkMetaData.cpp
-+++ b/src/DkCore/DkMetaData.cpp
-@@ -42,6 +42,8 @@
- #include <QApplication>
- #pragma warning(pop)		// no warnings from includes - end
-
-+#include <iostream>
-+
- namespace nmc {
-
- // DkMetaDataT --------------------------------------------------------------------
-diff --git a/src/DkGui/DkNoMacs.cpp b/src/DkGui/DkNoMacs.cpp
-index 6a412f70..bbfba233 100644
--- a/src/DkGui/DkNoMacs.cpp
-+++ b/src/DkGui/DkNoMacs.cpp
-@@ -96,6 +96,8 @@
- #include <QWinTaskbarButton>
- #endif
-
-+#include <iostream>
-+
- namespace nmc {
-
- DkNomacsOSXEventFilter::DkNomacsOSXEventFilter(QObject *parent) : QObject(parent) {
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -34,8 +34,16 @@ stdenv.mkDerivation rec {
    install -D op $out/bin/op
  '';

+  dontStrip = stdenv.isDarwin;
+
  nativeBuildInputs = stdenv.lib.optionals stdenv.isLinux [ autoPatchelfHook ];

+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    $out/bin/op --version
+  '';
+
  meta = with stdenv.lib; {
    description  = "1Password command-line tool";
    homepage     = "https://support.1password.com/command-line/";
--- a/pkgs/applications/misc/azuredatastudio/default.nix
+++ b/pkgs/applications/misc/azuredatastudio/default.nix
@ -0,0 +1,115 @@
+{ stdenv
+, lib
+, fetchurl
+, makeWrapper
+, libuuid
+, libunwind
+, icu
+, openssl
+, zlib
+, curl
+, at-spi2-core
+, at-spi2-atk
+, gnutar
+, atomEnv
+, kerberos
+}:
+
+# from justinwoo/azuredatastudio-nix
+# https://github.com/justinwoo/azuredatastudio-nix/blob/537c48aa3981cd1a82d5d6e508ab7e7393b3d7c8/default.nix
+
+stdenv.mkDerivation rec {
+
+  pname = "azuredatastudio";
+  version = "1.17.1";
+
+  src = fetchurl {
+    url = "https://azuredatastudiobuilds.blob.core.windows.net/releases/${version}/azuredatastudio-linux-${version}.tar.gz";
+    sha256 = "0px9n9vyjvyddca4x7d0zindd0dim7350vkjg5dd0506fm8dc38k";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libuuid
+    at-spi2-core
+    at-spi2-atk
+  ];
+
+  phases = "unpackPhase fixupPhase";
+
+  # change this to azuredatastudio-insiders for insiders releases
+  edition = "azuredatastudio";
+  targetPath = "$out/${edition}";
+
+  unpackPhase = ''
+    mkdir -p ${targetPath}
+    ${gnutar}/bin/tar xf $src --strip 1 -C ${targetPath}
+  '';
+
+  sqltoolsserviceRpath = stdenv.lib.makeLibraryPath [
+    stdenv.cc.cc
+    libunwind
+    libuuid
+    icu
+    openssl
+    zlib
+    curl
+  ];
+
+  # this will most likely need to be updated when azuredatastudio's version changes
+  sqltoolsservicePath = "${targetPath}/resources/app/extensions/mssql/sqltoolsservice/Linux/2.0.0-release.56";
+
+  rpath = stdenv.lib.concatStringsSep ":" [
+    atomEnv.libPath
+    (
+      stdenv.lib.makeLibraryPath [
+        libuuid
+        at-spi2-core
+        at-spi2-atk
+        stdenv.cc.cc.lib
+        kerberos
+      ]
+    )
+    targetPath
+    sqltoolsserviceRpath
+  ];
+
+  fixupPhase = ''
+    fix_sqltoolsservice()
+    {
+      mv ${sqltoolsservicePath}/$1 ${sqltoolsservicePath}/$1_old
+      patchelf \
+        --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
+        ${sqltoolsservicePath}/$1_old
+
+      makeWrapper \
+        ${sqltoolsservicePath}/$1_old \
+        ${sqltoolsservicePath}/$1 \
+        --set LD_LIBRARY_PATH ${sqltoolsserviceRpath}
+    }
+
+    fix_sqltoolsservice MicrosoftSqlToolsServiceLayer
+    fix_sqltoolsservice MicrosoftSqlToolsCredentials
+    fix_sqltoolsservice SqlToolsResourceProviderService
+
+    patchelf \
+      --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
+      ${targetPath}/${edition}
+
+    mkdir -p $out/bin
+    makeWrapper \
+      ${targetPath}/bin/${edition} \
+      $out/bin/azuredatastudio \
+      --set LD_LIBRARY_PATH ${rpath}
+  '';
+
+  meta = {
+    maintainers = with stdenv.lib.maintainers; [ xavierzwirtz ];
+    description = "A data management tool that enables working with SQL Server, Azure SQL DB and SQL DW";
+    homepage = "https://docs.microsoft.com/en-us/sql/azure-data-studio/download-azure-data-studio";
+    license = lib.licenses.unfreeRedistributable;
+  };
+}
--- a/pkgs/applications/misc/cheat/default.nix
+++ b/pkgs/applications/misc/cheat/default.nix
@ -3,13 +3,13 @@

 buildGoModule rec {
  pname = "cheat";
-  version = "3.10.0";
+  version = "3.10.1";

  src = fetchFromGitHub {
    owner = "cheat";
    repo = "cheat";
    rev = version;
-    sha256 = "1rrhll1i5ibxdchpdifajvsm697pilf82rbq7arn4f4pw5izrhy6";
+    sha256 = "0indvycj972wng979mvia8mrb7bwdfay7wxq3lnj05qyxqafj5h2";
  };

  subPackages = [ "cmd/cheat" ];
@ -17,6 +17,7 @@ buildGoModule rec {
  nativeBuildInputs = [ installShellFiles ];

  postInstall = ''
+    installManPage doc/cheat.1
    installShellCompletion scripts/cheat.{bash,fish,zsh}
  '';

--- a/pkgs/applications/misc/clight/clightd.nix
+++ b/pkgs/applications/misc/clight/clightd.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "clightd";
-  version = "4.0";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "FedeDP";
    repo = "Clightd";
    rev = version;
-    sha256 = "0cskxy3xsy187in5vg8xcs3kwcx2s160qv009v0ahkcalp29ghz4";
+    sha256 = "0pqnn52nn22k49f5cw4jcr8vcbff28n56i8fizg1mmfshy8pn891";
  };

  # dbus-1.pc has datadir=/etc
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.71.0";
+  version = "0.71.1";

  buildInputs = [ libsass ];

@ -10,7 +10,7 @@ buildGoModule rec {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1cjf69y8wvjq7kpncvqzmhc03pmf21nfxqpdnh64v34d14gpa1aa";
+    sha256 = "0kx3q2i5p8k1dfkh02ns5ns97aqqvdcs0kx4bl9d38jk3lw3jrgh";
  };

  golibsass = fetchFromGitHub {
--- a/pkgs/applications/misc/ikiwiki/default.nix
+++ b/pkgs/applications/misc/ikiwiki/default.nix
@ -2,7 +2,7 @@
 , gitSupport ? false, git ? null
 , docutilsSupport ? false, python ? null, docutils ? null
 , monotoneSupport ? false, monotone ? null
-, bazaarSupport ? false, bazaar ? null
+, bazaarSupport ? false, breezy ? null
 , cvsSupport ? false, cvs ? null, cvsps ? null
 , subversionSupport ? false, subversion ? null
 , mercurialSupport ? false, mercurial ? null
@ -12,7 +12,7 @@
 assert docutilsSupport -> (python != null && docutils != null);
 assert gitSupport -> (git != null);
 assert monotoneSupport -> (monotone != null);
-assert bazaarSupport -> (bazaar != null);
+assert bazaarSupport -> (breezy != null);
 assert cvsSupport -> (cvs != null && cvsps != null && perlPackages.Filechdir != null);
 assert subversionSupport -> (subversion != null);
 assert mercurialSupport -> (mercurial != null);
@ -39,7 +39,7 @@ stdenv.mkDerivation {
    ++ lib.optionals docutilsSupport [python docutils]
    ++ lib.optionals gitSupport [git]
    ++ lib.optionals monotoneSupport [monotone]
-    ++ lib.optionals bazaarSupport [bazaar]
+    ++ lib.optionals bazaarSupport [breezy]
    ++ lib.optionals cvsSupport [cvs cvsps perlPackages.Filechdir]
    ++ lib.optionals subversionSupport [subversion]
    ++ lib.optionals mercurialSupport [mercurial];
@ -64,7 +64,7 @@ stdenv.mkDerivation {
      wrapProgram $a --suffix PERL5LIB : $PERL5LIB --prefix PATH : ${perlPackages.perl}/bin:$out/bin \
      ${lib.optionalString gitSupport ''--prefix PATH : ${git}/bin \''}
      ${lib.optionalString monotoneSupport ''--prefix PATH : ${monotone}/bin \''}
-      ${lib.optionalString bazaarSupport ''--prefix PATH : ${bazaar}/bin \''}
+      ${lib.optionalString bazaarSupport ''--prefix PATH : ${breezy}/bin \''}
      ${lib.optionalString cvsSupport ''--prefix PATH : ${cvs}/bin \''}
      ${lib.optionalString cvsSupport ''--prefix PATH : ${cvsps}/bin \''}
      ${lib.optionalString subversionSupport ''--prefix PATH : ${subversion.out}/bin \''}
--- a/pkgs/applications/misc/nnn/default.nix
+++ b/pkgs/applications/misc/nnn/default.nix
@ -4,13 +4,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "nnn";
-  version = "3.1";
+  version = "3.2";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0wvn3jbxjcpdg9jzxkhx5dlc0zx2idky6mb75fpha8ww1jg7qf1g";
+    sha256 = "13p3379c26l57121ymx0kw7afh51zv614p57di311d2a41jaz5cw";
  };

  configFile = optionalString (conf != null) (builtins.toFile "nnn.h" conf);
--- a/pkgs/applications/misc/pastel/default.nix
+++ b/pkgs/applications/misc/pastel/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pastel";
-  version = "0.7.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "sharkdp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1xrg25w175m2iz7q9v7c05a0p0v5rr71vd4m3v6p0lqvij3sih4s";
+    sha256 = "00xxrssa3gbr5w2jsqlf632jlzc0lc2rpybnbv618ndy5lxidnw0";
  };

-  cargoSha256 = "17rw9wp9mfv38h0azdjwl60bxdknb5q84ia0a2r1vi91gz6275cs";
+  cargoSha256 = "1ji64h0f8f2sq12cx33kymypzar9swhaj903gclf3jdwgna77326";

  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;

--- a/pkgs/applications/misc/remarkable/rmapi/default.nix
+++ b/pkgs/applications/misc/remarkable/rmapi/default.nix
@ -0,0 +1,24 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "rmapi";
+  version = "0.0.11";
+
+  src = fetchFromGitHub {
+    owner = "juruen";
+    repo = "rmapi";
+    rev = "v${version}";
+    sha256 = "0zks1pcj2s2pqkmw0hhm41vgdhfgj2r6dmvpsagbmf64578ww349";
+  };
+
+  vendorSha256 = "077s13pcql5w2m6wzls1q06r7p501kazbwzxgfh6akwza15kb4is";
+
+  meta = with stdenv.lib; {
+    description = "A Go app that allows access to the ReMarkable Cloud API programmatically";
+    homepage = "https://github.com/juruen/rmapi";
+    changelog = "https://github.com/juruen/rmapi/blob/v${version}/CHANGELOG.md";
+    license = licenses.agpl3;
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/misc/sleepyhead/default.nix
+++ b/pkgs/applications/misc/sleepyhead/default.nix
@ -1,9 +1,9 @@
-{ stdenv, fetchgit, qt5, zlib, libGLU, libX11 }:
+{ lib, stdenv, mkDerivation, fetchgit, zlib, libGLU, libX11, qtbase, qtwebkit, qtserialport, wrapQtAppsHook }:

 let
  name = "sleepyhead-${version}";
  version = "1.0.0-beta-git";
-in stdenv.mkDerivation {
+in mkDerivation {
  inherit name;

  src = fetchgit {
@ -13,21 +13,30 @@ in stdenv.mkDerivation {
  };

  buildInputs = [
-    qt5.qtbase qt5.qtwebkit qt5.qtserialport
+    qtbase qtwebkit qtserialport
    zlib
    libGLU
    libX11
  ];

+  nativeBuildInputs = [ wrapQtAppsHook ];
+
  patchPhase = ''
    patchShebangs configure
  '';
  
-  installPhase = ''
+  installPhase = if stdenv.isDarwin then ''
+    mkdir -p $out/Applications
+    cp -r sleepyhead/SleepyHead.app $out/Applications
+  '' else ''
    mkdir -p $out/bin
    cp sleepyhead/SleepyHead $out/bin
  '';

+  postFixup = stdenv.lib.optionalString stdenv.isDarwin ''
+    wrapQtApp "$out/Applications/SleepyHead.app/Contents/MacOS/SleepyHead"
+  '';
+
  meta = with stdenv.lib; {
    homepage = "https://sleepyhead.jedimark.net/";
    description = "Review and explore data produced by CPAP and related machines";
@ -37,7 +46,6 @@ in stdenv.mkDerivation {
    license = licenses.gpl3;
    platforms = platforms.all;
    maintainers = [ maintainers.krav ];
-    broken = true;
  };

 }
--- a/pkgs/applications/misc/systembus-notify/default.nix
+++ b/pkgs/applications/misc/systembus-notify/default.nix
@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, systemd }:
+
+stdenv.mkDerivation rec {
+  pname = "systembus-notify";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "rfjakob";
+    repo = "systembus-notify";
+    rev = "v${version}";
+    sha256 = "11zq84qfmbyl51d3r6294l2bjhlgwa9bx7d263g9fkqrwsg0si0y";
+  };
+
+  buildInputs = [ systemd ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 systembus-notify -t $out/bin
+    install -Dm644 systembus-notify.desktop -t $out/etc/xdg/autostart
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "System bus notification daemon";
+    homepage = "https://github.com/rfjakob/systembus-notify";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [];
+  };
+}
--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "zola";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "getzola";
    repo = pname;
    rev = "v${version}";
-    sha256 = "07zg4ia983rgvgvmw4xbi347lr4rxlf1xv8rw72cflc74kyia67n";
+    sha256 = "137ak9gzcn3689fmcb90wa4szw43rh2m51mf26l77a5gksn5y6cn";
  };

-  cargoSha256 = "13lnl01h8k8xv2ls1kjskfnyjmmk8iyk2mvbk01p2wmhp5m876md";
+  cargoSha256 = "0v40bcqh48dlhdc0kz7wm3q9r3i1m6j9s74bfiv237dqx5dymmsg";

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ openssl ]
--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@ -22,14 +22,14 @@

 stdenv.mkDerivation rec {
  pname = "calls";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitLab {
    domain = "source.puri.sm";
    owner = "Librem5";
    repo = "calls";
    rev = "v${version}";
-    sha256 = "0715cap3w8gppxlfaynhiqvc2ss512xgykjcpqq8f5syz2776skh";
+    sha256 = "1wqkczl1fn4d2py00fsb6kh05avmc7c49gi49j3592fqsvi87j18";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "FlexGet";
-  version = "3.1.30";
+  version = "3.1.57";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "453992c6bf8a7b0f83abeddd0e8f989dc10fd59e407e3803b886072cff2576a7";
+    sha256 = "661663726f75b12ba2e67db1276a9abf586b41db1ff313488ca35a439ec5d721";
  };

  postPatch = ''
--- a/pkgs/applications/networking/ids/snort/default.nix
+++ b/pkgs/applications/networking/ids/snort/default.nix
@ -1,16 +1,16 @@
-{stdenv, fetchurl, libpcap, pcre, libdnet, daq, zlib, flex, bison, makeWrapper}:
+{stdenv, pkgconfig, luajit, openssl, fetchurl, libpcap, pcre, libdnet, daq, zlib, flex, bison, makeWrapper}:

 stdenv.mkDerivation rec {
-  version = "2.9.11.1";
+  version = "2.9.16";
  pname = "snort";
  
  src = fetchurl {
    name = "${pname}-${version}.tar.gz";
    url = "https://snort.org/downloads/archive/snort/${pname}-${version}.tar.gz";
-    sha256 = "1ka67zrrhs32c729v4h76mvv2723mij0adxx0iaza2d1qpm3lswz";
+    sha256 = "1mxspk0060f62xp631w589b9ryb21qygn020az3dw2fsy7nxi24n";
  };
  
-  buildInputs = [ makeWrapper libpcap pcre libdnet daq zlib flex bison ];
+  buildInputs = [ makeWrapper pkgconfig luajit openssl libpcap pcre libdnet daq zlib flex bison ];

  enableParallelBuilding = true;

--- a/pkgs/applications/networking/instant-messengers/ripcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
@ -5,12 +5,12 @@

 mkDerivation rec {
  pname = "ripcord";
-  version = "0.4.24";
+  version = "0.4.25";

  src = let
    appimage = fetchurl {
      url = "https://cancel.fm/dl/Ripcord-${version}-x86_64.AppImage";
-      sha256 = "0rscmnwxvbdl0vfx1pz7x5gxs9qsjk905zmcad4f330j5l5m227z";
+      sha256 = "17s4fxqirmzdw0sn9s9zyk90gr00ivsmz4s6i6knsq354zhy5fda";
      name = "${pname}-${version}.AppImage";
    };
  in appimageTools.extract {
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "signal-cli";
-  version = "0.6.7";
+  version = "0.6.8";

  # Building from source would be preferred, but is much more involved.
  src = fetchurl {
    url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    sha256 = "13wz2c0n89aglqjfqlma1z4jr5xnp2qlg8cqng3v9axpkkynk996";
+    sha256 = "0gcyj8r7156zn5zzfnabf0mw3kcaq7v29vsjb6mdvj8cjjm05dvd";
  };

  buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -19,12 +19,12 @@ with lib;

 mkDerivation rec {
  pname = "telegram-desktop";
-  version = "2.1.6";
+  version = "2.1.7";

  # Telegram-Desktop with submodules
  src = fetchurl {
    url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "136c27pfipy9ikwm44nqxx9lqwq8qsfcs591qr8ac05ncgkh001v";
+    sha256 = "0qnabi1g760y5wf4k9vnh78y0kwmni2wxr59rqr0lq3x39zv0i69";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@ -20,13 +20,13 @@ let
  pname = "wire-desktop";

  version = {
-    x86_64-darwin = "3.16.3630";
-    x86_64-linux = "3.16.2923";
+    x86_64-darwin = "3.17.3666";
+    x86_64-linux = "3.17.2924";
  }.${system} or throwSystem;

  sha256 = {
-    x86_64-darwin = "1lnjn45bhd36n9xgx6xx9cggwivvkr2s6r4zai2dwg0aac1bywr5";
-    x86_64-linux = "0c8jmlsg2gnxsvly04xj1al80nj52rg4czfdha58sg14x14lyspz";
+    x86_64-darwin = "0r3ckfrdx0ah6wn364ii1q1laya2nmmfz9jsikc6ss28lijb6ipn";
+    x86_64-linux = "16f8zawdx7dyrb8hp3fd2j821jj7jlan60knmdlrrk84phlc9ldd";
  }.${system} or throwSystem;

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -15,11 +15,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "5.0.408598.0517";
+  version = "5.0.413237.0524";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "1irpnrxl91pc9naz0d9m252scnbfdbdi7yh19hd3arvk3fppjk7w";
+      sha256 = "09hr31pzjgwaa898akl953k7fcshkq8r065i2047mk247bjy278k";
    };
  };

--- a/pkgs/applications/networking/lieer/default.nix
+++ b/pkgs/applications/networking/lieer/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "lieer";
-  version = "1.1";
+  version = "1.2";

  src = fetchFromGitHub {
    owner = "gauteh";
    repo = "lieer";
    rev = "v${version}";
-    sha256 = "19jx3sm925nrzl26km1bxbp6y5gk1mzwadd79vip2jl70b3xk9f8";
+    sha256 = "0qp8sycclzagkiszqk1pw2fr8s8s195bzy8r27dj7f5zx350nxk5";
  };

  propagatedBuildInputs = with python3Packages; [
@ -30,6 +30,6 @@ python3Packages.buildPythonApplication rec {
    homepage         = "https://lieer.gaute.vetsj.com/";
    repositories.git = "https://github.com/gauteh/lieer.git";
    license          = licenses.gpl3Plus;
-    maintainers      = with maintainers; [ kaiha ];
+    maintainers      = with maintainers; [ flokli kaiha ];
  };
 }
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -27,11 +27,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "mutt";
-  version = "1.14.1";
+  version = "1.14.2";

  src = fetchurl {
    url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "09a4hhl9h6y57yfq1gx83fzqxp3wb88y17rl8f54ndpp6p1n9m9m";
+    sha256 = "0cdcls0x6f2w99hkjz48hxhnx86w3bnyxzibchdc9yspih770bz2";
  };

  patches = optional smimeSupport (fetchpatch {
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@ -1,47 +1,81 @@
-{ stdenv, fetchurl, pkgconfig, intltool, file, wrapGAppsHook
-, openssl, curl, libevent, inotify-tools, systemd, zlib
-, enableGTK3 ? false, gtk3
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkgconfig
+, openssl
+, curl
+, libevent
+, inotify-tools
+, systemd
+, zlib
+, pcre
+  # Build options
+, enableGTK3 ? false
+, gnome3
+, xorg
+, wrapGAppsHook
+, enableQt ? false
+, qt5
 , enableSystemd ? stdenv.isLinux
 , enableDaemon ? true
 , enableCli ? true
 }:

-let inherit (stdenv.lib) optional optionals optionalString; in
+let
+  version = "3.00";

-stdenv.mkDerivation rec {
-  name = "transmission-" + optionalString enableGTK3 "gtk-" + version;
-  version = "2.94";
+in stdenv.mkDerivation {
+  pname = "transmission";
+  inherit version;

-  src = fetchurl {
-    url = "https://github.com/transmission/transmission-releases/raw/master/transmission-2.94.tar.xz";
-    sha256 = "0zbbj7rlm6m7vb64x68a64cwmijhsrwx9l63hbwqs7zr9742qi1m";
+  src = fetchFromGitHub {
+    owner = "transmission";
+    repo = "transmission";
+    rev = version;
+    sha256 = "0ccg0km54f700x9p0jsnncnwvfnxfnxf7kcm7pcx1cj0vw78924z";
+    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ pkgconfig ]
-    ++ optionals enableGTK3 [ wrapGAppsHook ];
-  buildInputs = [ intltool file openssl curl libevent zlib ]
-    ++ optionals enableGTK3 [ gtk3 ]
-    ++ optionals enableSystemd [ systemd ]
-    ++ optionals stdenv.isLinux [ inotify-tools ];
+  cmakeFlags =
+    let
+      mkFlag = opt: if opt then "ON" else "OFF";
+    in
+    [
+      "-DENABLE_MAC=OFF" # requires xcodebuild
+      "-DENABLE_GTK=${mkFlag enableGTK3}"
+      "-DENABLE_QT=${mkFlag enableQt}"
+      "-DENABLE_DAEMON=${mkFlag enableDaemon}"
+      "-DENABLE_CLI=${mkFlag enableCli}"
+    ];

-  postPatch = ''
-    substituteInPlace ./configure \
-      --replace "libsystemd-daemon" "libsystemd" \
-      --replace "/usr/bin/file"     "${file}/bin/file" \
-      --replace "test ! -d /Developer/SDKs/MacOSX10.5.sdk" "false"
-  '';
-
-  configureFlags = [
-      ("--enable-cli=" + (if enableCli then "yes" else "no"))
-      ("--enable-daemon=" + (if enableDaemon then "yes" else "no"))
-      "--disable-mac" # requires xcodebuild
+  nativeBuildInputs = [
+    pkgconfig
+    cmake
  ]
-    ++ optional enableSystemd "--with-systemd-daemon"
-    ++ optional enableGTK3 "--with-gtk";
+  ++ lib.optionals enableGTK3 [ wrapGAppsHook ]
+  ++ lib.optionals enableQt [ qt5.wrapQtAppsHook ]
+  ;

-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation";
+  buildInputs = [
+    openssl
+    curl
+    libevent
+    zlib
+    pcre
+  ]
+  ++ lib.optionals enableQt [ qt5.qttools qt5.qtbase ]
+  ++ lib.optionals enableGTK3 [ gnome3.gtk xorg.libpthreadstubs ]
+  ++ lib.optionals enableSystemd [ systemd ]
+  ++ lib.optionals stdenv.isLinux [ inotify-tools ]
+  ;

-  meta = with stdenv.lib; {
+  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-framework CoreFoundation";
+
+  # Reduce the risk of collisions
+  postInstall = "rm -r $out/share/doc";
+
+  meta = {
    description = "A fast, easy and free BitTorrent client";
    longDescription = ''
      Transmission is a BitTorrent client which features a simple interface
@ -55,9 +89,9 @@ stdenv.mkDerivation rec {
        * Full encryption, DHT, and PEX support
    '';
    homepage = "http://www.transmissionbt.com/";
-    license = licenses.gpl2; # parts are under MIT
-    maintainers = with maintainers; [ astsmtl vcunat wizeman ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2; # parts are under MIT
+    maintainers = with lib.maintainers; [ astsmtl vcunat wizeman ];
+    platforms = lib.platforms.unix;
  };
-}

+}
--- a/pkgs/applications/networking/sniffers/sngrep/default.nix
+++ b/pkgs/applications/networking/sniffers/sngrep/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "sngrep";
-  version = "1.4.6";
+  version = "1.4.7";

  src = fetchFromGitHub {
    owner = "irontec";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0fj13pim5bfm3a2nr05apspraf29klpmcnhmycklfmrlncq5xqdf";
+    sha256 = "1dx5l48m4634y0zi6wjky412g80lfxqq1nphv7pi1kwvm1k5m5ri";
  };

  buildInputs = [
--- a/pkgs/applications/office/gnumeric/default.nix
+++ b/pkgs/applications/office/gnumeric/default.nix
@ -7,11 +7,11 @@ let
  inherit (python3Packages) python pygobject3;
 in stdenv.mkDerivation rec {
  pname = "gnumeric";
-  version = "1.12.46";
+  version = "1.12.47";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "9fdc67377af52dfe69a7db4f533938024a75f454fc5d25ab43b8e6739be0b5e1";
+    sha256 = "1khrf72kiq50y8b5prbj2207k9shn36h2b2i588cc4wa28s9y5a0";
  };

  configureFlags = [ "--disable-component" ];
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch, cmake, makeWrapper, itk4, vtk }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, makeWrapper, itk4, vtk_7 }:

 stdenv.mkDerivation rec {
  pname    = "ANTs";
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = [ itk4 vtk ];
+  buildInputs = [ itk4 vtk_7 ];

  cmakeFlags = [ "-DANTS_SUPERBUILD=FALSE" "-DUSE_VTK=TRUE" ];

--- a/pkgs/applications/science/biology/bppsuite/default.nix
+++ b/pkgs/applications/science/biology/bppsuite/default.nix
@ -0,0 +1,21 @@
+{ stdenv, fetchFromGitHub, cmake, bpp-core, bpp-seq, bpp-phyl, bpp-popgen }:
+
+stdenv.mkDerivation rec {
+  pname = "bppsuite";
+
+  inherit (bpp-core) version;
+
+  src = fetchFromGitHub {
+    owner = "BioPP";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1wdwcgczqbc3m116vakvi0129wm3acln3cfc7ivqnalwvi6lrpds";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ bpp-core bpp-seq bpp-phyl bpp-popgen ];
+
+  meta = bpp-core.meta // {
+    changelog = "https://github.com/BioPP/bppsuite/blob/master/ChangeLog";
+  };
+}
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "picard-tools";
-  version = "2.22.7";
+  version = "2.22.8";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "09q66lhjnprkw8azavwzwv9dlhr9b4x0dbz6fym0i2wbhylqp4w6";
+    sha256 = "0g387jlf7r1p2kx8gya3vxksbjy3y2ywxa7yjqmxg3y8725fyixl";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.13.1";
+  version = "3.14.0";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
    repo   = "lean";
    rev    = "v${version}";
-    sha256 = "1ak5l40h5yjlbzz92l724l6bm5q341cg6k1yk13sbwn42l8szsar";
+    sha256 = "1dlzap3j26rh93ick1lqb7g3jkqjpd33gl4gqfcbx22v62258y5b";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/logic/sad/default.nix
+++ b/pkgs/applications/science/logic/sad/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation {
  };
  buildInputs = [ haskell.compiler.ghc844 spass ];
  patches = [
-    ./patch
+    ./patch.patch
    # Since the LTS 12.0 update, <> is an operator in Prelude, colliding with
    # the <> operator with a different meaning defined by this package
    ./monoid.patch
--- a/pkgs/applications/science/logic/sad/patch.patch
+++ b/pkgs/applications/science/logic/sad/patch.patch
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "snakemake";
-  version = "5.16.0";
+  version = "5.17.0";

  propagatedBuildInputs = with python3Packages; [
    appdirs
@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "0jlf3y8b1gdv5xz37yk9b5g2b65zkk45p15x0ypvd2blpzy80537";
+    sha256 = "0y652i3saqq2z61yvk0i6q3lnq2xfrygcxms5gygspj71q2n4f7k";
  };

  doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json
--- a/pkgs/applications/science/physics/xflr5/default.nix
+++ b/pkgs/applications/science/physics/xflr5/default.nix
@ -0,0 +1,23 @@
+{ stdenv, lib, fetchurl, wrapQtAppsHook, qmake }:
+
+stdenv.mkDerivation rec {
+  pname = "xflr5";
+  version = "6.47";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/xflr5/${pname}_v${version}_src.tar.gz";
+    sha256 = "02x3r9iv3ndwxa65mxn9m5dlhcrnjiq7cffi6rmb456gs3v3dnav";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];
+
+  meta = with stdenv.lib; {
+    description = "An analysis tool for airfoils, wings and planes";
+    homepage = https://sourceforge.net/projects/xflr5/;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.esclear ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
+++ b/pkgs/applications/version-management/bazaar/CVE-2017-14176.patch
@ -1,149 +0,0 @@
-diff --git a/bzrlib/tests/test_ssh_transport.py b/bzrlib/tests/test_ssh_transport.py
-index 9e37c3b..fe9f219 100644
--- a/bzrlib/tests/test_ssh_transport.py
-+++ b/bzrlib/tests/test_ssh_transport.py
-@@ -22,6 +22,7 @@ from bzrlib.transport.ssh import (
-     SSHCorpSubprocessVendor,
-     LSHSubprocessVendor,
-     SSHVendorManager,
-+    StrangeHostname,
-     )
- 
- 
-@@ -161,6 +162,19 @@ class SSHVendorManagerTests(TestCase):
- 
- class SubprocessVendorsTests(TestCase):
- 
-+    def test_openssh_command_tricked(self):
-+        vendor = OpenSSHSubprocessVendor()
-+        self.assertEqual(
-+            vendor._get_vendor_specific_argv(
-+                "user", "-oProxyCommand=blah", 100, command=["bzr"]),
-+            ["ssh", "-oForwardX11=no", "-oForwardAgent=no",
-+                "-oClearAllForwardings=yes",
-+                "-oNoHostAuthenticationForLocalhost=yes",
-+                "-p", "100",
-+                "-l", "user",
-+                "--",
-+                "-oProxyCommand=blah", "bzr"])
-+
-     def test_openssh_command_arguments(self):
-         vendor = OpenSSHSubprocessVendor()
-         self.assertEqual(
-@@ -171,6 +185,7 @@ class SubprocessVendorsTests(TestCase):
-                 "-oNoHostAuthenticationForLocalhost=yes",
-                 "-p", "100",
-                 "-l", "user",
-+                "--",
-                 "host", "bzr"]
-             )
- 
-@@ -184,9 +199,16 @@ class SubprocessVendorsTests(TestCase):
-                 "-oNoHostAuthenticationForLocalhost=yes",
-                 "-p", "100",
-                 "-l", "user",
-                "-s", "host", "sftp"]
-+                "-s", "--", "host", "sftp"]
-             )
- 
-+    def test_openssh_command_tricked(self):
-+        vendor = SSHCorpSubprocessVendor()
-+        self.assertRaises(
-+            StrangeHostname,
-+            vendor._get_vendor_specific_argv,
-+                "user", "-oProxyCommand=host", 100, command=["bzr"])
-+
-     def test_sshcorp_command_arguments(self):
-         vendor = SSHCorpSubprocessVendor()
-         self.assertEqual(
-@@ -209,6 +231,13 @@ class SubprocessVendorsTests(TestCase):
-                 "-s", "sftp", "host"]
-             )
- 
-+    def test_lsh_command_tricked(self):
-+        vendor = LSHSubprocessVendor()
-+        self.assertRaises(
-+            StrangeHostname,
-+            vendor._get_vendor_specific_argv,
-+                "user", "-oProxyCommand=host", 100, command=["bzr"])
-+
-     def test_lsh_command_arguments(self):
-         vendor = LSHSubprocessVendor()
-         self.assertEqual(
-@@ -231,6 +260,13 @@ class SubprocessVendorsTests(TestCase):
-                 "--subsystem", "sftp", "host"]
-             )
- 
-+    def test_plink_command_tricked(self):
-+        vendor = PLinkSubprocessVendor()
-+        self.assertRaises(
-+            StrangeHostname,
-+            vendor._get_vendor_specific_argv,
-+                "user", "-oProxyCommand=host", 100, command=["bzr"])
-+
-     def test_plink_command_arguments(self):
-         vendor = PLinkSubprocessVendor()
-         self.assertEqual(
-diff --git a/bzrlib/transport/ssh.py b/bzrlib/transport/ssh.py
-index eecaa26..6f22341 100644
--- a/bzrlib/transport/ssh.py
-+++ b/bzrlib/transport/ssh.py
-@@ -46,6 +46,10 @@ else:
-     from paramiko.sftp_client import SFTPClient
- 
- 
-+class StrangeHostname(errors.BzrError):
-+    _fmt = "Refusing to connect to strange SSH hostname %(hostname)s"
-+
-+
- SYSTEM_HOSTKEYS = {}
- BZR_HOSTKEYS = {}
- 
-@@ -360,6 +364,11 @@ class SubprocessVendor(SSHVendor):
-     # tests, but beware of using PIPE which may hang due to not being read.
-     _stderr_target = None
- 
-+    @staticmethod
-+    def _check_hostname(arg):
-+        if arg.startswith('-'):
-+            raise StrangeHostname(hostname=arg)
-+
-     def _connect(self, argv):
-         # Attempt to make a socketpair to use as stdin/stdout for the SSH
-         # subprocess.  We prefer sockets to pipes because they support
-@@ -424,9 +433,9 @@ class OpenSSHSubprocessVendor(SubprocessVendor):
-         if username is not None:
-             args.extend(['-l', username])
-         if subsystem is not None:
-            args.extend(['-s', host, subsystem])
-+            args.extend(['-s', '--', host, subsystem])
-         else:
-            args.extend([host] + command)
-+            args.extend(['--', host] + command)
-         return args
- 
- register_ssh_vendor('openssh', OpenSSHSubprocessVendor())
-@@ -439,6 +448,7 @@ class SSHCorpSubprocessVendor(SubprocessVendor):
- 
-     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
-                                   command=None):
-+        self._check_hostname(host)
-         args = [self.executable_path, '-x']
-         if port is not None:
-             args.extend(['-p', str(port)])
-@@ -460,6 +470,7 @@ class LSHSubprocessVendor(SubprocessVendor):
- 
-     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
-                                   command=None):
-+        self._check_hostname(host)
-         args = [self.executable_path]
-         if port is not None:
-             args.extend(['-p', str(port)])
-@@ -481,6 +492,7 @@ class PLinkSubprocessVendor(SubprocessVendor):
- 
-     def _get_vendor_specific_argv(self, username, host, port, subsystem=None,
-                                   command=None):
-+        self._check_hostname(host)
-         args = [self.executable_path, '-x', '-a', '-ssh', '-2', '-batch']
-         if port is not None:
-             args.extend(['-P', str(port)])
--- a/pkgs/applications/version-management/bazaar/add_certificates.patch
+++ b/pkgs/applications/version-management/bazaar/add_certificates.patch
@ -1,11 +0,0 @@
-diff -ru orig/bzrlib/transport/http/_urllib2_wrappers.py bzr-2.7.0/bzrlib/transport/http/_urllib2_wrappers.py
--- orig/bzr-2.7.0/bzrlib/transport/http/_urllib2_wrappers.py	2016-02-01 20:49:17.000000000 +0100
-+++ bzr-2.7.0/bzrlib/transport/http/_urllib2_wrappers.py	2016-06-18 23:15:21.089511349 +0200
-@@ -95,6 +95,7 @@
-     u"/usr/local/share/certs/ca-root-nss.crt",  # FreeBSD
-     # XXX: Needs checking, can't trust the interweb ;) -- vila 2012-01-25
-     u'/etc/openssl/certs/ca-certificates.crt',  # Solaris
-+    u'@certPath@',
- ]
-
-
--- a/pkgs/applications/version-management/bazaar/default.nix
+++ b/pkgs/applications/version-management/bazaar/default.nix
@ -1,36 +0,0 @@
-{ stdenv, fetchurl, python2Packages
-, withSFTP ? true
- }:
-
-python2Packages.buildPythonApplication rec {
-  version = "2.7";
-  release = ".0";
-  name = "bazaar-${version}${release}";
-
-  src = fetchurl {
-    url = "https://launchpad.net/bzr/${version}/${version}${release}/+download/bzr-${version}${release}.tar.gz";
-    sha256 = "1cysix5k3wa6y7jjck3ckq3abls4gvz570s0v0hxv805nwki4i8d";
-  };
-
-  doCheck = false;
-
-  propagatedBuildInputs = []
-  ++ stdenv.lib.optionals withSFTP [ python2Packages.paramiko ];
-
-  patches = [
-    # Bazaar can't find the certificates alone
-    ./add_certificates.patch
-    ./CVE-2017-14176.patch
-  ];
-  postPatch = ''
-    substituteInPlace bzrlib/transport/http/_urllib2_wrappers.py \
-      --subst-var-by certPath /etc/ssl/certs/ca-certificates.crt
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = "http://bazaar-vcs.org/";
-    description = "A distributed version control system that Just Works";
-    platforms = platforms.unix;
-    license = licenses.gpl2Plus;
-  };
-}
--- a/pkgs/applications/version-management/bazaar/tools.nix
+++ b/pkgs/applications/version-management/bazaar/tools.nix
@ -1,20 +0,0 @@
-{ stdenv, fetchurl, python2Packages }:
-
-python2Packages.buildPythonApplication rec {
-  pname = "bzr-tools";
-  version = "2.6.0";
-
-  src = fetchurl {
-    url = "https://launchpad.net/bzrtools/stable/${version}/+download/bzrtools-${version}.tar.gz";
-    sha256 = "0n3zzc6jf5866kfhmrnya1vdr2ja137a45qrzsz8vz6sc6xgn5wb";
-  };
-
-  doCheck = false;
-
-  meta = with stdenv.lib; {
-    description = "Bazaar plugins";
-    homepage = "http://wiki.bazaar.canonical.com/BzrTools";
-    platforms = platforms.unix;
-    license = licenses.gpl2;
-  };
-}
--- a/pkgs/applications/version-management/cvs2svn/default.nix
+++ b/pkgs/applications/version-management/cvs2svn/default.nix
@ -1,6 +1,6 @@
 { lib, fetchurl, makeWrapper
 , python2Packages
-, cvs, subversion, git, bazaar
+, cvs, subversion, git, breezy
 }:

 python2Packages.buildPythonApplication  rec {
@ -14,7 +14,7 @@ python2Packages.buildPythonApplication  rec {

  buildInputs = [ makeWrapper ];

-  checkInputs = [ subversion git bazaar ];
+  checkInputs = [ subversion git breezy ];

  checkPhase = "python run-tests.py";

--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -179,6 +179,8 @@ let

  gitflow = callPackage ./gitflow { };

+  gitin = callPackage ./gitin { };
+
  gitstatus = callPackage ./gitstatus { };

  gitui = callPackage ./gitui {
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@ -2,25 +2,27 @@

 buildGoModule rec {
  pname = "gh";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "08fy3677yq52x40rab49ijhw4r25ls2807dbv9wpna6w07n7r8v7";
+    sha256 = "050wqjng0l42ilaiglwm1mzrrmnk0bg9icnzq9sm88axgl4xpmdy";
  };

  vendorSha256 = "0s99bjmsafnzhl3s2lcybxgsw1s4i1h3vh6p40gz4vsfhndidqrq";

-  buildFlagsArray = [
-    "-ldflags=-s -w -X github.com/cli/cli/command.Version=${version}"
-  ];
-
-  subPackages = [ "cmd/gh" ];
-
  nativeBuildInputs = [ installShellFiles ];
-  postInstall = ''
+
+  buildPhase = ''
+    make GH_VERSION=${version} bin/gh manpages
+  '';
+
+  installPhase = ''
+    install -Dm755 bin/gh -t $out/bin
+    installManPage share/man/*/*.[1-9]
+
    for shell in bash fish zsh; do
      $out/bin/gh completion -s $shell > gh.$shell
      installShellCompletion gh.$shell
--- a/pkgs/applications/version-management/git-and-tools/git-absorb/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-absorb/default.nix
@ -2,20 +2,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-absorb";
-  version = "0.6.0";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner  = "tummychow";
    repo   = pname;
    rev    = "refs/tags/${version}";
-    sha256 = "1da6h9hf98dnnqw9jpnj1x2gr7psmsa8219gpamylfg1ifk28rkr";
+    sha256 = "1xjs5yjb0wj0nf3k3mpgh3hm16544gq7954k1y2r5lwammp0fsxk";
  };

  nativeBuildInputs = [ installShellFiles ];

  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];

-  cargoSha256 = "1ba43m5ndyj4hwwfyg0c2hwv3ad7kzhrr7cvymsgaj2dxl7bif4w";
+  cargoSha256 = "194ic3f60gpx35rs665vrnjsc3047f0msx1qp797xsz6pg0jx1zq";

  postInstall = ''
    installManPage Documentation/git-absorb.1
--- a/pkgs/applications/version-management/git-and-tools/gitin/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitin/default.nix
@ -0,0 +1,33 @@
+{ stdenv
+, buildGoPackage
+, fetchFromGitHub
+, pkgconfig
+, libgit2_0_27
+}:
+
+buildGoPackage rec {
+  version = "0.2.3";
+  pname = "gitin";
+
+  goPackagePath = "github.com/isacikgoz/gitin";
+
+  src = fetchFromGitHub {
+    owner = "isacikgoz";
+    repo = "gitin";
+    rev = "v${version}";
+    sha256 = "00z6i0bjk3hdxbc0cy12ss75b41yvzyl5pm6rdrvsjhzavry2fa3";
+  };
+
+  goDeps = ./deps.nix;
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libgit2_0_27 ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/isacikgoz/gitin";
+    description = "Text-based user interface for git";
+    platforms = platforms.all;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ kimat ];
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/gitin/deps.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitin/deps.nix
@ -0,0 +1,121 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
+[
+  {
+    goPackagePath = "github.com/alecthomas/template";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/template";
+      rev = "fb15b899a75114aa79cc930e33c46b577cc664b1";
+      sha256 = "1vlasv4dgycydh5wx6jdcvz40zdv90zz1h7836z7lhsi2ymvii26";
+    };
+  }
+  {
+    goPackagePath = "github.com/alecthomas/units";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alecthomas/units";
+      rev = "f65c72e2690dc4b403c8bd637baf4611cd4c069b";
+      sha256 = "04jyqm7m3m01ppfy1f9xk4qvrwvs78q9zml6llyf2b3v5k6b2bbc";
+    };
+  }
+  {
+    goPackagePath = "github.com/fatih/color";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fatih/color";
+      rev = "daf2830f2741ebb735b21709a520c5f37d642d85";
+      sha256 = "086z8ssmr1fn9ba4mqnw7pnccfpys6l5yfhvycv1gdrsk7n27mvs";
+    };
+  }
+  {
+    goPackagePath = "github.com/isacikgoz/gia";
+    fetch = {
+      type = "git";
+      url = "https://github.com/isacikgoz/gia";
+      rev = "00556493579ec25f4e199b85ee1e2a73c98d15bb";
+      sha256 = "16nqi4z1pgybcw05wbp3qnbbq407smcr56hq7npnhkirngc5j822";
+    };
+  }
+  {
+    goPackagePath = "github.com/jroimartin/gocui";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jroimartin/gocui";
+      rev = "c055c87ae801372cd74a0839b972db4f7697ae5f";
+      sha256 = "1b1cbjg925l1c5v3ls8amni9716190yzf847cqs9wjnj82z8qa47";
+    };
+  }
+  {
+    goPackagePath = "github.com/justincampbell/timeago";
+    fetch = {
+      type = "git";
+      url = "https://github.com/justincampbell/timeago";
+      rev = "027f40306f1dbe89d24087611680ef95543bf876";
+      sha256 = "1p3va1cn9x5pyvq7k64mnvbxp5zy7h9z49syjyglixgg6avdbp1v";
+    };
+  }
+  {
+    goPackagePath = "github.com/kelseyhightower/envconfig";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kelseyhightower/envconfig";
+      rev = "0b417c4ec4a8a82eecc22a1459a504aa55163d61";
+      sha256 = "1a7b35njpqz94gbd7wvsl3wjzpd5y1fj1lrg2sdh00yq0nax1qj9";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "14e809f6d78fcf9f48ff9b70981472b64c05f754";
+      sha256 = "1mvlxcdwr0vwp8b2wqs6y7hk72y28sqh03dz5x0xkg48d4y9cplj";
+    };
+  }
+  {
+    goPackagePath = "github.com/nsf/termbox-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nsf/termbox-go";
+      rev = "38ba6e5628f1d70bac606cfd210b9ad1a16c3027";
+      sha256 = "03xx5vbnavklsk6wykcc7qhmhvn2074sx0ql06b51vqsxwsa6zw2";
+    };
+  }
+  {
+    goPackagePath = "github.com/sahilm/fuzzy";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sahilm/fuzzy";
+      rev = "d88f8cb825ddd46a2ce86b60382e11645220ee33";
+      sha256 = "0nl4l02s3961p11aj1vgajfy28rqlya2z6af2xjncra59gfhqvlq";
+    };
+  }
+  {
+    goPackagePath = "github.com/waigani/diffparser";
+    fetch = {
+      type = "git";
+      url = "https://github.com/waigani/diffparser";
+      rev = "7391f219313d9175703f67561b222fd2a81bca30";
+      sha256 = "0h3y3ivlghdvkyqsh5lcidqdajhc9g7m1xqm73j9a0ayby0sx1ql";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/alecthomas/kingpin.v2";
+      rev = "947dcec5ba9c011838740e680966fd7087a71d0d";
+      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/libgit2/git2go.v27";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/libgit2/git2go.v27";
+      rev = "6cc7d3dc6aec2781fe0239315da215f49c76e2f8";
+      sha256 = "0b2m4rjadngyd675bi1k21pyi9r91dsxngzd4mikacpd7yshgvaq";
+    };
+  }
+]
+
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitLab, fetchFromGitHub, buildGoPackage, ruby,
-  bundlerEnv, pkgconfig, libgit2 }:
+  bundlerEnv, pkgconfig, libgit2_0_27 }:

 let
  rubyEnv = bundlerEnv rec {
@ -18,15 +18,6 @@ let
        };
      };
  };
-  libgit2_0_27 = libgit2.overrideAttrs (oldAttrs: rec {
-    version = "0.27.8";
-    src = fetchFromGitHub {
-      owner = "libgit2";
-      repo = "libgit2";
-      rev = "v${version}";
-      sha256 = "0wzx8nkyy9m7mx6cks58chjd4289vjsw97mxm9w6f1ggqsfnmbr9";
-    };
-  });
 in buildGoPackage rec {
  version = "12.8.10";
  pname = "gitaly";
--- a/pkgs/applications/version-management/reposurgeon/default.nix
+++ b/pkgs/applications/version-management/reposurgeon/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper, python27Packages, git
 , docbook_xml_dtd_412, docbook_xsl, asciidoc, xmlto, pypy
-, bazaar ? null, cvs ? null, darcs ? null, fossil ? null
+, breezy ? null, cvs ? null, darcs ? null, fossil ? null
 , mercurial ? null, monotone ? null, rcs ? null
 , subversion ? null, cvs_fast_export ? null }:

@ -42,7 +42,7 @@ in mkDerivation rec {
    let
      binpath = makeBinPath (
        filter (x: x != null)
-        [ out git bazaar cvs darcs fossil mercurial
+        [ out git breezy cvs darcs fossil mercurial
          monotone rcs src subversion cvs_fast_export ]
      );
      pythonpath = makeSearchPathOutput "lib" python.sitePackages (
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -1,4 +1,4 @@
-{ config, stdenv, fetchurl, fetchFromGitHub, makeWrapper, fetchpatch
+{ config, stdenv, fetchurl, fetchFromGitHub, fetchpatch
 , addOpenGLRunpath, docutils, perl, pkgconfig, python3, wafHook, which
 , ffmpeg_4, freefont_ttf, freetype, libass, libpthreadstubs, mujs
 , nv-codec-headers, lua, libuchardet, libiconv ? null
@ -50,7 +50,6 @@
 , vdpauSupport       ? true,           libvdpau      ? null
 , xineramaSupport    ? stdenv.isLinux, libXinerama   ? null
 , xvSupport          ? stdenv.isLinux, libXv         ? null
-, youtubeSupport     ? true,           youtube-dl    ? null
 , zimgSupport        ? true,           zimg          ? null
 , archiveSupport     ? true,           libarchive    ? null
 , jackaudioSupport   ? false,          libjack2      ? null
@ -91,7 +90,6 @@ assert waylandSupport     -> all available [ wayland wayland-protocols libxkbcom
 assert x11Support         -> all available [ libGLU libGL libX11 libXext libXxf86vm libXrandr ];
 assert xineramaSupport    -> x11Support && available libXinerama;
 assert xvSupport          -> x11Support && available libXv;
-assert youtubeSupport     -> available youtube-dl;
 assert zimgSupport        -> available zimg;

 let
@ -112,6 +110,20 @@ in stdenv.mkDerivation rec {
    patchShebangs ./TOOLS/
  '';

+  passthru = {
+    inherit
+    # The wrapper consults luaEnv and lua.version
+    luaEnv
+    lua
+    # In the wrapper, we want to reference vapoursynth which has the
+    # `python3` passthru attribute (which has the `sitePrefix`
+    # attribute). This way we'll be sure that in the wrapper we'll
+    # use the same python3.sitePrefix used to build vapoursynth.
+    vapoursynthSupport
+    vapoursynth
+    ;
+  };
+
  NIX_LDFLAGS = optionalString x11Support "-lX11 -lXext "
              + optionalString stdenv.isDarwin "-framework CoreFoundation";

@ -135,7 +147,7 @@ in stdenv.mkDerivation rec {
    ++ stdenv.lib.optional (!swiftSupport) "--disable-macos-cocoa-cb";

  nativeBuildInputs = [
-    addOpenGLRunpath docutils makeWrapper perl pkgconfig python3 wafHook which
+    addOpenGLRunpath docutils perl pkgconfig python3 wafHook which
  ]
    ++ optional swiftSupport swift;

@ -164,7 +176,6 @@ in stdenv.mkDerivation rec {
    ++ optional vdpauSupport       libvdpau
    ++ optional xineramaSupport    libXinerama
    ++ optional xvSupport          libXv
-    ++ optional youtubeSupport     youtube-dl
    ++ optional zimgSupport        zimg
    ++ optional stdenv.isDarwin    libiconv
    ++ optional stdenv.isLinux     nv-codec-headers
@ -182,17 +193,6 @@ in stdenv.mkDerivation rec {
    python3 TOOLS/osxbundle.py -s build/mpv
  '';

-  # Ensure youtube-dl is available in $PATH for mpv
-  wrapperFlags =
-    ''--prefix LUA_CPATH ';' "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \'' +
-    ''--prefix LUA_PATH ';' "${luaEnv}/share/lua/${lua.luaversion}/?.lua" \'' +
-    ''--prefix PATH : "${luaEnv}/bin" \''
-  + optionalString youtubeSupport ''
-      --prefix PATH : "${youtube-dl}/bin" \
-  '' + optionalString vapoursynthSupport ''
-      --prefix PYTHONPATH : "${vapoursynth}/lib/${python3.libPrefix}/site-packages:$PYTHONPATH"
-  '';
-
  patches = stdenv.lib.optionals stdenv.isDarwin [
    # Fix cocoa backend. Remove with the next release
    (fetchpatch {
@ -205,24 +205,17 @@ in stdenv.mkDerivation rec {
    # Use a standard font
    mkdir -p $out/share/mpv
    ln -s ${freefont_ttf}/share/fonts/truetype/FreeSans.ttf $out/share/mpv/subfont.ttf
-    wrapProgram "$out/bin/mpv" \
-      ${wrapperFlags}

    cp TOOLS/umpv $out/bin
-    wrapProgram $out/bin/umpv \
-      --set MPV "$out/bin/mpv"
-
  '' + optionalString stdenv.isDarwin ''
    mkdir -p $out/Applications
    cp -r build/mpv.app $out/Applications
-    wrapProgram "$out/Applications/mpv.app/Contents/MacOS/mpv" \
-      ${wrapperFlags}
  '';

  # Set RUNPATH so that libcuda in /run/opengl-driver(-32)/lib can be found.
  # See the explanation in addOpenGLRunpath.
  postFixup = optionalString stdenv.isLinux ''
-    addOpenGLRunpath $out/bin/.mpv-wrapped
+    addOpenGLRunpath $out/bin/mpv
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@ -1,14 +1,83 @@
-{ stdenv, symlinkJoin, makeWrapper, mpv, scripts ? [] }:
+# Arguments that this derivation gets when it is created with `callPackage`
+{ stdenv
+, lib
+, symlinkJoin
+, makeWrapper
+, youtube-dl
+}:

-symlinkJoin {
+# the unwrapped mpv derivation - 1st argument to `wrapMpv`
+mpv:
+
+let
+  # arguments to the function (called `wrapMpv` in all-packages.nix)
+  wrapper = {
+    extraMakeWrapperArgs ? [],
+    youtubeSupport ? true,
+    # a set of derivations (probably from `mpvScripts`) where each is
+    # expected to have a `scriptName` passthru attribute that points to the
+    # name of the script that would reside in the script's derivation's
+    # `$out/share/mpv/scripts/`.
+    scripts ? [],
+    extraUmpvWrapperArgs ? []
+  }:
+  let
+    binPath = lib.makeBinPath ([
+      mpv.luaEnv
+    ] ++ lib.optionals youtubeSupport [
+      youtube-dl
+    ] ++ lib.optionals mpv.vapoursynthSupport [
+      mpv.vapoursynth.python3
+    ]);
+    # All arguments besides the input and output binaries (${mpv}/bin/mpv and
+    # $out/bin/mpv). These are used by the darwin specific makeWrapper call
+    # used to wrap $out/Applications/mpv.app/Contents/MacOS/mpv as well.
+    mostMakeWrapperArgs = builtins.concatStringsSep " " ([ "--argv0" "'$0'"
+      # These are always needed (TODO: Explain why)
+      "--prefix" "LUA_CPATH" "\\;" "${mpv.luaEnv}/lib/lua/${mpv.lua.luaversion}/\\?.so"
+      "--prefix" "LUA_PATH" "\\;" "${mpv.luaEnv}/share/lua/${mpv.lua.luaversion}/\\?.lua"
+    ] ++ lib.optionals mpv.vapoursynthSupport [
+      "--prefix" "PYTHONPATH" ":" "${mpv.vapoursynth}/lib/${mpv.vapoursynth.python3.sitePackages}"
+    ] ++ lib.optionals (binPath != "") [
+      "--prefix" "PATH" ":" binPath
+    ] ++ (lib.lists.flatten (map
+      # For every script in the `scripts` argument, add the necessary flags to the wrapper
+      (script:
+        [
+          "--add-flags"
+          # Here we rely on the existence of the `scriptName` passthru
+          # attribute of the script derivation from the `scripts`
+          "--script=${script}/share/mpv/scripts/${script.scriptName}"
+        ]
+      ) scripts
+    )) ++ extraMakeWrapperArgs)
+    ;
+    umpvWrapperArgs = builtins.concatStringsSep " " ([
+      "--argv0" "'$0'"
+      "--set" "MPV" "$out/bin/mpv"
+    ] ++ extraUmpvWrapperArgs)
+    ;
+  in
+    symlinkJoin {
      name = "mpv-with-scripts-${mpv.version}";

      paths = [ mpv ];

      buildInputs = [ makeWrapper ];

+      passthru.unwrapped = mpv;
+
      postBuild = ''
-    wrapProgram $out/bin/mpv \
-      --add-flags "${stdenv.lib.concatMapStringsSep " " (x: "--script=${x}/share/mpv/scripts/${x.scriptName}") scripts}"
+        # wrapProgram can't operate on symlinks
+        rm "$out/bin/mpv"
+        makeWrapper "${mpv}/bin/mpv" "$out/bin/mpv" ${mostMakeWrapperArgs}
+        rm "$out/bin/umpv"
+        makeWrapper "${mpv}/bin/umpv" "$out/bin/umpv" ${umpvWrapperArgs}
+      '' + lib.optionalString stdenv.isDarwin ''
+        # wrapProgram can't operate on symlinks
+        rm "$out/Applications/mpv.app/Contents/MacOS/mpv"
+        makeWrapper "${mpv}/Applications/mpv.app/Contents/MacOS/mpv" "$out/Applications/mpv.app/Contents/MacOS/mpv" ${mostMakeWrapperArgs}
      '';
-}
+    };
+in
+  lib.makeOverridable wrapper
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "conmon";
-  version = "2.0.16";
+  version = "2.0.17";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0z0hds95mjxm703ig2aisghvpd2l3wn6m72jnnlv8jnz2iq2nc4g";
+    sha256 = "01bicv0qr4aiahkw9cp6igk3jv1fqkbxmsp80nfvq6rxx873v0q7";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/virtualization/cri-o/wrapper.nix
+++ b/pkgs/applications/virtualization/cri-o/wrapper.nix
@ -0,0 +1,53 @@
+{ cri-o-unwrapped
+, runCommand
+, makeWrapper
+, lib
+, extraPackages ? []
+, cri-o
+, runc # Default container runtime
+, crun # Container runtime (default with cgroups v2 for podman/buildah)
+, conmon # Container runtime monitor
+, utillinux # nsenter
+, cni-plugins # not added to path
+, iptables
+, socat
+}:
+
+let
+  cri-o = cri-o-unwrapped;
+
+  binPath = lib.makeBinPath ([
+    runc
+    crun
+    conmon
+    utillinux
+    iptables
+    socat
+  ] ++ extraPackages);
+
+in runCommand cri-o.name {
+  name = "${cri-o.pname}-wrapper-${cri-o.version}";
+  inherit (cri-o) pname version;
+
+  meta = builtins.removeAttrs cri-o.meta [ "outputsToInstall" ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+} ''
+  ln -s ${cri-o.man} $man
+
+  mkdir -p $out/bin
+  ln -s ${cri-o-unwrapped}/share $out/share
+
+  for p in ${cri-o-unwrapped}/bin/*; do
+    makeWrapper $p $out/bin/''${p##*/} \
+      --prefix PATH : ${binPath}
+  done
+''
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@ -5,12 +5,12 @@
 , extraPackages ? []
 , podman # Docker compat
 , runc # Default container runtime
-, crun # Default container runtime (cgroups v2)
+, crun # Container runtime (default with cgroups v2 for podman/buildah)
 , conmon # Container runtime monitor
 , slirp4netns # User-mode networking for unprivileged namespaces
 , fuse-overlayfs # CoW for images, much faster than default vfs
 , utillinux # nsenter
-, cni-plugins
+, cni-plugins # not added to path
 , iptables
 }:

--- a/pkgs/applications/virtualization/qboot/default.nix
+++ b/pkgs/applications/virtualization/qboot/default.nix
@ -1,18 +1,20 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, meson, ninja, fetchFromGitHub }:

 stdenv.mkDerivation {
-  name = "qboot-20170330";
+  name = "qboot-20200423";

  src = fetchFromGitHub {
    owner = "bonzini";
    repo = "qboot";
-    rev = "ac9488f26528394856b94bda0797f5bd9c69a26a";
-    sha256 = "0l83nbjndin1cbcimkqkiqr5df8d76cnhyk26rd3aygb2bf7cspy";
+    rev = "de50b5931c08f5fba7039ddccfb249a5b3b0b18d";
+    sha256 = "1d0h29zz535m0pq18k3aya93q7lqm2858mlcp8mlfkbq54n8c5d8";
  };

+  nativeBuildInputs = [ meson ninja ];
+
  installPhase = ''
    mkdir -p $out
-    cp bios.bin* $out/.
+    cp bios.bin bios.bin.elf $out/.
  '';

  hardeningDisable = [ "stackprotector" "pic" ];
--- a/pkgs/applications/window-managers/picom/default.nix
+++ b/pkgs/applications/window-managers/picom/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "picom";
-  version = "7.5";
+  version = "8";

  src = fetchFromGitHub {
    owner  = "yshui";
    repo   = "picom";
    rev    = "v${version}";
-    sha256 = "1l48fxl04vkzr4r94sl37nbbw7a621rn8sxmkbdv4252i1gjxd4z";
+    sha256 = "04svbv7v73q8yn9la69451rda6l2pgxcphv2zlkdqaxxdbp69195";
    fetchSubmodules = true;
  };

--- a/pkgs/build-support/docker/nix-prefetch-docker
+++ b/pkgs/build-support/docker/nix-prefetch-docker
@ -12,7 +12,6 @@ finalImageTag=
 hashType=$NIX_HASH_ALGO
 hashFormat=$hashFormat
 format=nix
-skopeoCmd="skopeo --insecure-policy --tmpdir=$TMPDIR"

 usage(){
    echo  >&2 "syntax: nix-prefetch-docker [options] [IMAGE_NAME [IMAGE_TAG|IMAGE_DIGEST]]
@ -39,7 +38,7 @@ get_image_digest(){
        imageTag="latest"
    fi

-    "$skopeoCmd" inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
+    skopeo --insecure-policy --tmpdir=$TMPDIR inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
 }

 get_name() {
@ -128,9 +127,9 @@ trap "rm -rf \"$tmpPath\"" EXIT
 tmpFile="$tmpPath/$(get_name $finalImageName $finalImageTag)"

 if test -z "$QUIET"; then
-    "$skopeoCmd" --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag"
+    skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag"
 else
-    "$skopeoCmd" --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" > /dev/null
+    skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" > /dev/null
 fi

 # Compute the hash.
--- a/pkgs/build-support/docker/store-path-to-layer.sh
+++ b/pkgs/build-support/docker/store-path-to-layer.sh
@ -30,12 +30,13 @@ mkdir -p nix/store
 # store path to the absolute store path.
 tarhash=$(
  basename -a "$@" |
-    tar -cp nix \
-      -C /nix/store --verbatim-files-from --files-from - \
+    tar --create --preserve-permissions --absolute-names nix \
+      --directory /nix/store --verbatim-files-from --files-from - \
      --hard-dereference --sort=name \
      --mtime="@$SOURCE_DATE_EPOCH" \
      --owner=0 --group=0 \
-      --transform 's,^nix(/|$),/nix/,' \
+      --transform 's,^nix$,/\0,' \
+      --transform 's,^nix/store$,/\0,' \
      --transform 's,^[^/],/nix/store/\0,rS' |
    tee "$layerPath/layer.tar" |
    tarsum
--- a/pkgs/build-support/fetchbzr/default.nix
+++ b/pkgs/build-support/fetchbzr/default.nix
@ -1,11 +1,11 @@
-{ stdenvNoCC, bazaar }:
+{ stdenvNoCC, breezy }:
 { url, rev, sha256 }:

 stdenvNoCC.mkDerivation {
  name = "bzr-export";

  builder = ./builder.sh;
-  nativeBuildInputs = [ bazaar ];
+  nativeBuildInputs = [ breezy ];

  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
--- a/pkgs/build-support/fetchgitlab/default.nix
+++ b/pkgs/build-support/fetchgitlab/default.nix
@ -12,10 +12,11 @@ let
    ((optional (group != null) group) ++ [ owner repo ]);

  escapedSlug = replaceStrings ["." "/"] ["%2E" "%2F"] slug;
+  escapedRev = replaceStrings ["+"] ["%2B"] rev;
 in

 fetchzip ({
  inherit name;
-  url = "https://${domain}/api/v4/projects/${escapedSlug}/repository/archive.tar.gz?sha=${rev}";
+  url = "https://${domain}/api/v4/projects/${escapedSlug}/repository/archive.tar.gz?sha=${escapedRev}";
  meta.homepage = "https://${domain}/${slug}/";
 } // removeAttrs args [ "domain" "owner" "group" "repo" "rev" ]) // { inherit rev; }
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@ -179,9 +179,9 @@ in ''
       export $env
     done

-     CRATENAME=$(echo ${crateName} | sed -e "s/\(.*\)-sys$/\U\1/")
+     CRATENAME=$(echo ${crateName} | sed -e "s/\(.*\)-sys$/\U\1/" -e "s/-/_/g")
     grep -P "^cargo:(?!(rustc-|warning=|rerun-if-changed=|rerun-if-env-changed))" target/build/${crateName}.opt \
-       | sed -e "s/cargo:\([^=]*\)=\(.*\)/export DEP_$(echo $CRATENAME)_\U\1\E=\2/" > target/env
+       | awk -F= "/^cargo:/ { sub(/^cargo:/, \"\", \$1); gsub(/-/, \"_\", \$1); print \"export \" toupper(\"DEP_$(echo $CRATENAME)_\" \$1) \"=\" \$2 }" > target/env
     set -e
  fi
  runHook postConfigure
--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@ -344,6 +344,40 @@ let
        buildTests = true;
        expectedTestOutputs = [ "test baz_false ... ok" ];
      };
+      # Regression test for https://github.com/NixOS/nixpkgs/pull/88054
+      # Build script output should be rewritten as valid env vars.
+      buildScriptIncludeDirDeps = let
+        depCrate = mkCrate {
+          crateName = "bar";
+          src = symlinkJoin {
+            name = "build-script-and-include-dir-bar";
+            paths = [
+              (mkFile  "src/lib.rs" ''
+                fn main() { }
+              '')
+              (mkFile  "build.rs" ''
+                use std::path::PathBuf;
+                fn main() { println!("cargo:include-dir={}/src", std::env::current_dir().unwrap_or(PathBuf::from(".")).to_str().unwrap()); }
+              '')
+            ];
+          };
+        };
+      in {
+        crateName = "foo";
+        src = symlinkJoin {
+          name = "build-script-and-include-dir-foo";
+          paths = [
+            (mkFile  "src/main.rs" ''
+              fn main() { }
+            '')
+            (mkFile  "build.rs" ''
+              fn main() { assert!(std::env::var_os("DEP_BAR_INCLUDE_DIR").is_some()); }
+            '')
+          ];
+        };
+        buildDependencies = [ depCrate ];
+        dependencies = [ depCrate ];
+      };
      # Regression test for https://github.com/NixOS/nixpkgs/issues/74071
      # Whenevever a build.rs file is generating files those should not be overlayed onto the actual source dir
      buildRsOutDirOverlay = {
--- a/pkgs/data/fonts/recursive/default.nix
+++ b/pkgs/data/fonts/recursive/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "1.051";
+  version = "1.052";
 in
 fetchzip {
  name = "recursive-${version}";
@ -14,7 +14,7 @@ fetchzip {
    unzip -j $downloadedFile \*.woff2 -d $out/share/fonts/woff2
  '';

-  sha256 = "1cqlljbzvrxamswcqx8jbr61q4kji7yil5ic1mh60x4yfsk9x5wn";
+  sha256 = "1kam7wcn0rg89gw52pn174sz0r9lc2kjdz88l0jg20gwa3bjbpc6";

  meta = with lib; {
    homepage = "https://recursive.design/";
--- a/pkgs/data/fonts/tamzen/default.nix
+++ b/pkgs/data/fonts/tamzen/default.nix
@ -0,0 +1,47 @@
+{ fetchFromGitHub, fontforge, mkfontscale, stdenv }:
+
+stdenv.mkDerivation rec {
+  pname = "tamzen-font";
+  version = "1.11.4";
+
+  src = fetchFromGitHub {
+    owner = "sunaku";
+    repo = "tamzen-font";
+    rev = "Tamzen-${version}";
+    sha256 = "17kgmvg6q32mqhx9g44hjvzv0si0mnpprga4z7na930g2zdd8846";
+  };
+
+  nativeBuildInputs = [ fontforge mkfontscale ];
+
+  installPhase = ''
+    # convert pcf fonts to otb
+    for i in pcf/*.pcf; do
+      name=$(basename "$i" .pcf)
+      fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$name.otb\")"
+    done
+
+    install -m 644 -D pcf/*.pcf -t "$out/share/fonts/misc"
+    install -m 644 -D psf/*.psf -t "$out/share/consolefonts"
+    install -m 644 -D *.otb     -t "$otb/share/fonts/misc"
+    mkfontdir "$out/share/fonts/misc"
+    mkfontdir "$otb/share/fonts/misc"
+  '';
+
+  outputs = [ "out" "otb" ];
+
+  meta = with stdenv.lib; {
+    description = "Bitmapped programming font based on Tamsyn";
+    longDescription = ''
+    Tamzen is a monospace bitmap font. It is programatically forked
+    from Tamsyn version 1.11, which backports glyphs from older
+    versions while deleting deliberately empty glyphs to allow
+    secondary/fallback fonts to provide real glyphs at those codepoints.
+    Tamzen also has fonts that additionally provide the Powerline
+    symbols.
+    '';
+    homepage = "https://github.com/sunaku/tamzen-font";
+    license = licenses.free;
+    maintainers = with maintainers; [ wishfort36 ];
+  };
+}
+
--- a/pkgs/data/misc/osinfo-db/default.nix
+++ b/pkgs/data/misc/osinfo-db/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "osinfo-db";
-  version = "20200214";
+  version = "20200515";

  src = fetchurl {
    url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "1fpdb8r8kzwp1k5dc9xyy9jr2jr3haq7n9b6spamm599zvzf8nb6";
+    sha256 = "1m9idmmb1sjf24lp9lgng2m1jj09mn9fa9pnz36fdv5q0lskgscj";
  };

  nativeBuildInputs = [ osinfo-db-tools intltool libxml2 ];
--- a/pkgs/data/themes/matcha/default.nix
+++ b/pkgs/data/themes/matcha/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "matcha-gtk-theme";
-  version = "2020-05-09";
+  version = "2020-05-24";

  src = fetchFromGitHub {
    owner = "vinceliuice";
    repo = pname;
    rev = version;
-    sha256 = "0fp3ijynyvncy2byjjyba573p81x2pl2hdzv17mg40r8d5mjlkww";
+    sha256 = "186ypnkyaqjw671ny363xmixw6zdvrgj9xvmsrdgr8i0h3z8qwr8";
  };

  buildInputs = [ gdk-pixbuf librsvg ];
--- a/pkgs/data/themes/plano/default.nix
+++ b/pkgs/data/themes/plano/default.nix
@ -1,27 +1,40 @@
-{ stdenv, fetchFromGitHub, gdk-pixbuf, gtk_engines, gtk-engine-murrine, librsvg }:
+{ stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, gdk-pixbuf
+, gtk_engines
+, gtk-engine-murrine
+, librsvg
+, sassc
+}:

 stdenv.mkDerivation rec {
  pname = "plano-theme";
-  version = "3.34-2";
+  version = "3.36-1";

  src = fetchFromGitHub {
    owner = "lassekongo83";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0spbyvzb47vyfhcn3gr0z1gdb5xrprynm6442y1z32znai2bgpnd";
+    sha256 = "1rngn5a7hwjqpznbg5kvgs237d2q1anywg37k1cz153ipa96snrv";
  };

-  buildInputs = [ gdk-pixbuf gtk_engines librsvg ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    sassc
+  ];

-  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+  buildInputs = [
+    gdk-pixbuf
+    gtk_engines
+    librsvg
+  ];

-  dontBuild = true;
-
-  installPhase = ''
-    install -dm 755 $out/share/themes/Plano
-    cp -a * $out/share/themes/Plano/
-    rm $out/share/themes/Plano/{LICENSE,README.md}
-  '';
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];

  meta = with stdenv.lib; {
    description = "Flat theme for GNOME and Xfce";
--- a/Show More
+++ b/Show More