Merge master into staging-next

.github/PULL_REQUEST_TEMPLATE.md

@@ -18,4 +18,6 @@
 - [ ] Ensured that relevant documentation is up to date
 - [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
 
----
+###### Notify maintainers
+
+cc @

lib/types.nix

@@ -111,7 +111,7 @@ rec {
         name = "int";
         description = "signed integer";
         check = isInt;
-        merge = mergeOneOption;
+        merge = mergeEqualOption;
       };
 
     # Specialized subdomains of int
@@ -176,14 +176,14 @@ rec {
         name = "float";
         description = "floating point number";
         check = isFloat;
-        merge = mergeOneOption;
+        merge = mergeEqualOption;
     };
 
     str = mkOptionType {
       name = "str";
       description = "string";
       check = isString;
-      merge = mergeOneOption;
+      merge = mergeEqualOption;
     };
 
     strMatching = pattern: mkOptionType {
@@ -243,7 +243,7 @@ rec {
       name = "path";
       # Hacky: there is no ‘isPath’ primop.
       check = x: builtins.substring 0 1 (toString x) == "/";
-      merge = mergeOneOption;
+      merge = mergeEqualOption;
     };
 
     # drop this in the future:
@@ -415,7 +415,7 @@ rec {
         name = "enum";
         description = "one of ${concatMapStringsSep ", " show values}";
         check = flip elem values;
-        merge = mergeOneOption;
+        merge = mergeEqualOption;
         functor = (defaultFunctor name) // { payload = values; binOp = a: b: unique (a ++ b); };
       };
 

maintainers/maintainer-list.nix

@@ -2156,6 +2156,11 @@
     github = "hlolli";
     name = "Hlodver Sigurdsson";
   };
+  hugoreeves = {
+    email = "hugolreeves@gmail.com";
+    github = "hugoreeves";
+    name = "Hugo Reeves";
+  };
   hodapp = {
     email = "hodapp87@gmail.com";
     github = "Hodapp87";

nixos/doc/manual/release-notes/rl-1909.xml

@@ -163,7 +163,8 @@
      Most of the httpd subservices packaged with NixOS have been replaced with
      full NixOS modules including LimeSurvey, WordPress, and Zabbix. These
      modules can be enabled using the <option>services.limesurvey.enable</option>,
-     <option>services.wordpress.enable</option>, and <option>services.zabbixWeb.enable</option> options.
+     <option>services.mediawiki.enable</option>, <option>services.wordpress.enable</option>,
+     and <option>services.zabbixWeb.enable</option> options.
     </para>
    </listitem>
    <listitem>

nixos/modules/config/xdg/portal.nix

@@ -1,10 +1,12 @@
 { config, pkgs ,lib ,... }:
+
 with lib;
+
 {
   options.xdg.portal = {
     enable =
       mkEnableOption "<link xlink:href='https://github.com/flatpak/xdg-desktop-portal'>xdg desktop integration</link>"//{
-        default = config.services.xserver.enable;
+        default = false;
       };
 
     extraPortals = mkOption {
@@ -19,6 +21,17 @@ with lib;
         environments you probably want to add them yourself.
       '';
     };
+
+    gtkUsePortal = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Sets environment variable <literal>GTK_USE_PORTAL</literal> to <literal>1</literal>.
+        This is needed for packages ran outside Flatpak to respect and use XDG Desktop Portals.
+        For example, you'd need to set this for non-flatpak Firefox to use native filechoosers.
+        Defaults to <literal>false</literal> to respect its opt-in nature.
+      '';
+    };
   };
 
   config =
@@ -28,10 +41,17 @@ with lib;
 
     in mkIf cfg.enable {
 
+      assertions = [
+        { assertion = (cfg.gtkUsePortal -> cfg.extraPortals != []);
+          message = "Setting xdg.portal.gtkUsePortal to true requires a portal implementation in xdg.portal.extraPortals such as xdg-desktop-portal-gtk or xdg-desktop-portal-kde.";
+        }
+      ];
+
       services.dbus.packages  = packages;
       systemd.packages = packages;
+
       environment.variables = {
-        GTK_USE_PORTAL = "1";
+        GTK_USE_PORTAL = optional cfg.gtkUsePortal "1";
         XDG_DESKTOP_PORTAL_PATH = map (p: "${p}/share/xdg-desktop-portal/portals") cfg.extraPortals;
       };
     };

nixos/modules/module-list.nix

@@ -519,6 +519,7 @@
   ./services/monitoring/systemhealth.nix
   ./services/monitoring/teamviewer.nix
   ./services/monitoring/telegraf.nix
+  ./services/monitoring/thanos.nix
   ./services/monitoring/ups.nix
   ./services/monitoring/uptime.nix
   ./services/monitoring/vnstat.nix
@@ -780,6 +781,7 @@
   ./services/web-apps/icingaweb2/module-monitoring.nix
   ./services/web-apps/limesurvey.nix
   ./services/web-apps/mattermost.nix
+  ./services/web-apps/mediawiki.nix
   ./services/web-apps/miniflux.nix
   ./services/web-apps/nextcloud.nix
   ./services/web-apps/nexus.nix

nixos/modules/profiles/hardened.nix

@@ -26,6 +26,8 @@ with lib;
 
   security.allowSimultaneousMultithreading = mkDefault false;
 
+  security.forcePageTableIsolation = mkDefault true;
+
   security.virtualisation.flushL1DataCache = mkDefault "always";
 
   security.apparmor.enable = mkDefault true;
@@ -42,9 +44,6 @@ with lib;
 
     # Disable legacy virtual syscalls
     "vsyscall=none"
-
-    # Enable PTI even if CPU claims to be safe from meltdown
-    "pti=on"
   ];
 
   boot.blacklistedKernelModules = [

nixos/modules/programs/shell.nix

@@ -12,7 +12,7 @@ with lib;
       ''
         # Set up the per-user profile.
         mkdir -m 0755 -p "$NIX_USER_PROFILE_DIR"
-        if [ "$(stat --printf '%u' "$NIX_USER_PROFILE_DIR")" != "$(id -u)" ]; then
+        if [ "$(stat -c '%u' "$NIX_USER_PROFILE_DIR")" != "$(id -u)" ]; then
             echo "WARNING: the per-user profile dir $NIX_USER_PROFILE_DIR should belong to user id $(id -u)" >&2
         fi
 
@@ -34,7 +34,7 @@ with lib;
           # Create the per-user garbage collector roots directory.
           NIX_USER_GCROOTS_DIR="/nix/var/nix/gcroots/per-user/$USER"
           mkdir -m 0755 -p "$NIX_USER_GCROOTS_DIR"
-          if [ "$(stat --printf '%u' "$NIX_USER_GCROOTS_DIR")" != "$(id -u)" ]; then
+          if [ "$(stat -c '%u' "$NIX_USER_GCROOTS_DIR")" != "$(id -u)" ]; then
               echo "WARNING: the per-user gcroots dir $NIX_USER_GCROOTS_DIR should belong to user id $(id -u)" >&2
           fi
 

nixos/modules/programs/ssh.nix

@@ -21,7 +21,7 @@ let
 
   knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
     (h: assert h.hostNames != [];
-      concatStringsSep "," h.hostNames + " "
+      optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
       + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
     )) + "\n";
 
@@ -128,6 +128,14 @@ in
         default = {};
         type = types.loaOf (types.submodule ({ name, ... }: {
           options = {
+            certAuthority = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                This public key is an SSH certificate authority, rather than an
+                individual host's key.
+              '';
+            };
             hostNames = mkOption {
               type = types.listOf types.str;
               default = [];

nixos/modules/programs/xonsh.nix

@@ -26,6 +26,7 @@ in
 
       package = mkOption {
         type = types.package;
+        default = pkgs.xonsh;
         example = literalExample "pkgs.xonsh.override { configFile = \"/path/to/xonshrc\"; }";
         description = ''
           xonsh package to use.
@@ -46,11 +47,11 @@ in
 
     environment.etc."xonshrc".text = cfg.config;
 
-    environment.systemPackages = [ pkgs.xonsh ];
+    environment.systemPackages = [ cfg.package ];
 
     environment.shells =
       [ "/run/current-system/sw/bin/xonsh"
-        "${pkgs.xonsh}/bin/xonsh"
+        "${cfg.package}/bin/xonsh"
       ];
 
   };

nixos/modules/security/misc.nix

@@ -54,6 +54,18 @@ with lib;
       '';
     };
 
+    security.forcePageTableIsolation = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to force-enable the Page Table Isolation (PTI) Linux kernel
+        feature even on CPU models that claim to be safe from Meltdown.
+
+        This hardening feature is most beneficial to systems that run untrusted
+        workloads that rely on address space isolation for security.
+      '';
+    };
+
     security.virtualisation.flushL1DataCache = mkOption {
       type = types.nullOr (types.enum [ "never" "cond" "always" ]);
       default = null;
@@ -114,6 +126,10 @@ with lib;
       boot.kernelParams = [ "nosmt" ];
     })
 
+    (mkIf config.security.forcePageTableIsolation {
+      boot.kernelParams = [ "pti=on" ];
+    })
+
     (mkIf (config.security.virtualisation.flushL1DataCache != null) {
       boot.kernelParams = [ "kvm-intel.vmentry_l1d_flush=${config.security.virtualisation.flushL1DataCache}" ];
     })

nixos/modules/services/desktops/flatpak.nix

@@ -22,6 +22,12 @@ in {
   ###### implementation
   config = mkIf cfg.enable {
 
+    assertions = [
+      { assertion = (config.xdg.portal.enable == true);
+        message = "To use Flatpak you must enable XDG Desktop Portals with xdg.portal.enable.";
+      }
+    ];
+
     environment.systemPackages = [ pkgs.flatpak ];
 
     services.dbus.packages = [ pkgs.flatpak ];

nixos/modules/services/misc/nix-daemon.nix

@@ -467,7 +467,7 @@ in
         fi
       '';
 
-    nix.nrBuildUsers = mkDefault (lib.max 32 cfg.maxJobs);
+    nix.nrBuildUsers = mkDefault (lib.max 32 (if cfg.maxJobs == "auto" then 0 else cfg.maxJobs));
 
     users.users = nixbldUsers;
 

nixos/modules/services/misc/taskserver/default.nix

@@ -411,7 +411,7 @@ in {
         } else {
           cert = "${cfg.pki.manual.server.cert}";
           key = "${cfg.pki.manual.server.key}";
-          crl = "${cfg.pki.manual.server.crl}";
+          ${mapNullable (_: "crl") cfg.pki.manual.server.crl} = "${cfg.pki.manual.server.crl}";
         });
 
         ca.cert = if needToCreateCA then "${cfg.dataDir}/keys/ca.cert"

nixos/modules/services/monitoring/thanos.nix

@@ -0,0 +1,801 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.thanos;
+
+  nullOpt = type: description: mkOption {
+    type = types.nullOr type;
+    default = null;
+    inherit description;
+  };
+
+  optionToArgs = opt: v  : optional (v != null)  ''--${opt}="${toString v}"'';
+  flagToArgs   = opt: v  : optional v            ''--${opt}'';
+  listToArgs   = opt: vs : map               (v: ''--${opt}="${v}"'') vs;
+  attrsToArgs  = opt: kvs: mapAttrsToList (k: v: ''--${opt}=${k}=\"${v}\"'') kvs;
+
+  mkParamDef = type: default: description: mkParam type (description + ''
+
+    Defaults to <literal>${toString default}</literal> in Thanos
+    when set to <literal>null</literal>.
+  '');
+
+  mkParam = type: description: {
+    toArgs = optionToArgs;
+    option = nullOpt type description;
+  };
+
+  mkFlagParam = description: {
+    toArgs = flagToArgs;
+    option = mkOption {
+      type = types.bool;
+      default = false;
+      inherit description;
+    };
+  };
+
+  mkListParam = opt: description: {
+    toArgs = _opt: listToArgs opt;
+    option = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      inherit description;
+    };
+  };
+
+  mkAttrsParam = opt: description: {
+    toArgs = _opt: attrsToArgs opt;
+    option = mkOption {
+      type = types.attrsOf types.str;
+      default = {};
+      inherit description;
+    };
+  };
+
+  mkStateDirParam = opt: default: description: {
+    toArgs = _opt: stateDir: optionToArgs opt "/var/lib/${stateDir}";
+    option = mkOption {
+      type = types.str;
+      inherit default;
+      inherit description;
+    };
+  };
+
+  toYAML = name: attrs: pkgs.runCommandNoCC name {
+    preferLocalBuild = true;
+    json = builtins.toFile "${name}.json" (builtins.toJSON attrs);
+    nativeBuildInputs = [ pkgs.remarshal ];
+  } ''json2yaml -i $json -o $out'';
+
+  thanos = cmd: "${cfg.package}/bin/thanos ${cmd}" +
+    (let args = cfg."${cmd}".arguments;
+     in optionalString (length args != 0) (" \\\n  " +
+         concatStringsSep " \\\n  " args));
+
+  argumentsOf = cmd: concatLists (collect isList
+    (flip mapParamsRecursive params."${cmd}" (path: param:
+      let opt = concatStringsSep "." path;
+          v = getAttrFromPath path cfg."${cmd}";
+      in param.toArgs opt v)));
+
+  mkArgumentsOption = cmd: mkOption {
+    type = types.listOf types.str;
+    default = argumentsOf cmd;
+    description = ''
+      Arguments to the <literal>thanos ${cmd}</literal> command.
+
+      Defaults to a list of arguments formed by converting the structured
+      options of <option>services.thanos.${cmd}</option> to a list of arguments.
+
+      Overriding this option will cause none of the structured options to have
+      any effect. So only set this if you know what you're doing!
+    '';
+  };
+
+  mapParamsRecursive =
+    let noParam = attr: !(attr ? "toArgs" && attr ? "option");
+    in mapAttrsRecursiveCond noParam;
+
+  paramsToOptions = mapParamsRecursive (_path: param: param.option);
+
+  params = {
+
+    log = {
+
+      log.level = mkParamDef (types.enum ["debug" "info" "warn" "error" "fatal"]) "info" ''
+        Log filtering level.
+      '';
+
+      log.format = mkParam types.str ''
+        Log format to use.
+      '';
+    };
+
+    tracing = cfg: {
+      tracing.config-file = {
+        toArgs = _opt: path: optionToArgs "tracing.config-file" path;
+        option = mkOption {
+          type = with types; nullOr str;
+          default = if cfg.tracing.config == null then null
+                    else toString (toYAML "tracing.yaml" cfg.tracing.config);
+          defaultText = ''
+            if config.services.thanos.<cmd>.tracing.config == null then null
+            else toString (toYAML "tracing.yaml" config.services.thanos.<cmd>.tracing.config);
+          '';
+          description = ''
+            Path to YAML file that contains tracing configuration.
+          '';
+        };
+      };
+
+      tracing.config =
+        {
+          toArgs = _opt: _attrs: [];
+          option = nullOpt types.attrs ''
+            Tracing configuration.
+
+            When not <literal>null</literal> the attribute set gets converted to
+            a YAML file and stored in the Nix store. The option
+            <option>tracing.config-file</option> will default to its path.
+
+            If <option>tracing.config-file</option> is set this option has no effect.
+          '';
+        };
+    };
+
+    common = cfg: params.log // params.tracing cfg // {
+
+      http-address = mkParamDef types.str "0.0.0.0:10902" ''
+        Listen <literal>host:port</literal> for HTTP endpoints.
+      '';
+
+      grpc-address = mkParamDef types.str "0.0.0.0:10901" ''
+        Listen <literal>ip:port</literal> address for gRPC endpoints (StoreAPI).
+
+        Make sure this address is routable from other components.
+      '';
+
+      grpc-server-tls-cert = mkParam types.str ''
+        TLS Certificate for gRPC server, leave blank to disable TLS
+      '';
+
+      grpc-server-tls-key = mkParam types.str ''
+        TLS Key for the gRPC server, leave blank to disable TLS
+      '';
+
+      grpc-server-tls-client-ca = mkParam types.str ''
+        TLS CA to verify clients against.
+
+        If no client CA is specified, there is no client verification on server side.
+        (tls.NoClientCert)
+      '';
+    };
+
+    objstore = cfg: {
+
+      objstore.config-file = {
+        toArgs = _opt: path: optionToArgs "objstore.config-file" path;
+        option = mkOption {
+          type = with types; nullOr str;
+          default = if cfg.objstore.config == null then null
+                    else toString (toYAML "objstore.yaml" cfg.objstore.config);
+          defaultText = ''
+            if config.services.thanos.<cmd>.objstore.config == null then null
+            else toString (toYAML "objstore.yaml" config.services.thanos.<cmd>.objstore.config);
+          '';
+          description = ''
+            Path to YAML file that contains object store configuration.
+          '';
+        };
+      };
+
+      objstore.config =
+        {
+          toArgs = _opt: _attrs: [];
+          option = nullOpt types.attrs ''
+            Object store configuration.
+
+            When not <literal>null</literal> the attribute set gets converted to
+            a YAML file and stored in the Nix store. The option
+            <option>objstore.config-file</option> will default to its path.
+
+            If <option>objstore.config-file</option> is set this option has no effect.
+          '';
+        };
+    };
+
+    sidecar = params.common cfg.sidecar // params.objstore cfg.sidecar // {
+
+      prometheus.url = mkParamDef types.str "http://localhost:9090" ''
+        URL at which to reach Prometheus's API.
+
+        For better performance use local network.
+      '';
+
+      tsdb.path = {
+        toArgs = optionToArgs;
+        option = mkOption {
+          type = types.str;
+          default = "/var/lib/${config.services.prometheus2.stateDir}/data";
+          defaultText = "/var/lib/\${config.services.prometheus2.stateDir}/data";
+          description = ''
+            Data directory of TSDB.
+          '';
+        };
+      };
+
+      reloader.config-file = mkParam types.str ''
+        Config file watched by the reloader.
+      '';
+
+      reloader.config-envsubst-file = mkParam types.str ''
+        Output file for environment variable substituted config file.
+      '';
+
+      reloader.rule-dirs = mkListParam "reloader.rule-dir" ''
+        Rule directories for the reloader to refresh.
+      '';
+
+    };
+
+    store = params.common cfg.store // params.objstore cfg.store // {
+
+      stateDir = mkStateDirParam "data-dir" "thanos-store" ''
+        Data directory relative to <literal>/var/lib</literal>
+        in which to cache remote blocks.
+      '';
+
+      index-cache-size = mkParamDef types.str "250MB" ''
+        Maximum size of items held in the index cache.
+      '';
+
+      chunk-pool-size = mkParamDef types.str "2GB" ''
+        Maximum size of concurrently allocatable bytes for chunks.
+      '';
+
+      store.grpc.series-sample-limit = mkParamDef types.int 0 ''
+        Maximum amount of samples returned via a single Series call.
+
+        <literal>0</literal> means no limit.
+
+        NOTE: for efficiency we take 120 as the number of samples in chunk (it
+        cannot be bigger than that), so the actual number of samples might be
+        lower, even though the maximum could be hit.
+      '';
+
+      store.grpc.series-max-concurrency = mkParamDef types.int 20 ''
+        Maximum number of concurrent Series calls.
+      '';
+
+      sync-block-duration = mkParamDef types.str "3m" ''
+        Repeat interval for syncing the blocks between local and remote view.
+      '';
+
+      block-sync-concurrency = mkParamDef types.int 20 ''
+        Number of goroutines to use when syncing blocks from object storage.
+      '';
+    };
+
+    query = params.common cfg.query // {
+
+      grpc-client-tls-secure = mkFlagParam ''
+        Use TLS when talking to the gRPC server
+      '';
+
+      grpc-client-tls-cert = mkParam types.str ''
+        TLS Certificates to use to identify this client to the server
+      '';
+
+      grpc-client-tls-key = mkParam types.str ''
+        TLS Key for the client's certificate
+      '';
+
+      grpc-client-tls-ca = mkParam types.str ''
+        TLS CA Certificates to use to verify gRPC servers
+      '';
+
+      grpc-client-server-name = mkParam types.str ''
+        Server name to verify the hostname on the returned gRPC certificates.
+        See <link xlink:href="https://tools.ietf.org/html/rfc4366#section-3.1"/>
+      '';
+
+      web.route-prefix = mkParam types.str ''
+        Prefix for API and UI endpoints.
+
+        This allows thanos UI to be served on a sub-path. This option is
+        analogous to <option>web.route-prefix</option> of Promethus.
+      '';
+
+      web.external-prefix = mkParam types.str ''
+        Static prefix for all HTML links and redirect URLs in the UI query web
+        interface.
+
+        Actual endpoints are still served on / or the
+        <option>web.route-prefix</option>. This allows thanos UI to be served
+        behind a reverse proxy that strips a URL sub-path.
+      '';
+
+      web.prefix-header = mkParam types.str ''
+        Name of HTTP request header used for dynamic prefixing of UI links and
+        redirects.
+
+        This option is ignored if the option
+        <literal>web.external-prefix</literal> is set.
+
+        Security risk: enable this option only if a reverse proxy in front of
+        thanos is resetting the header.
+
+        The setting <literal>web.prefix-header="X-Forwarded-Prefix"</literal>
+        can be useful, for example, if Thanos UI is served via Traefik reverse
+        proxy with <literal>PathPrefixStrip</literal> option enabled, which
+        sends the stripped prefix value in <literal>X-Forwarded-Prefix</literal>
+        header. This allows thanos UI to be served on a sub-path.
+      '';
+
+      query.timeout = mkParamDef types.str "2m" ''
+        Maximum time to process query by query node.
+      '';
+
+      query.max-concurrent = mkParamDef types.int 20 ''
+        Maximum number of queries processed concurrently by query node.
+      '';
+
+      query.replica-label = mkParam types.str ''
+        Label to treat as a replica indicator along which data is
+        deduplicated.
+
+        Still you will be able to query without deduplication using
+        <literal>dedup=false</literal> parameter.
+      '';
+
+      selector-labels = mkAttrsParam "selector-label" ''
+        Query selector labels that will be exposed in info endpoint.
+      '';
+
+      store.addresses = mkListParam "store" ''
+        Addresses of statically configured store API servers.
+
+        The scheme may be prefixed with <literal>dns+</literal> or
+        <literal>dnssrv+</literal> to detect store API servers through
+        respective DNS lookups.
+      '';
+
+      store.sd-files = mkListParam "store.sd-files" ''
+        Path to files that contain addresses of store API servers. The path
+        can be a glob pattern.
+      '';
+
+      store.sd-interval = mkParamDef types.str "5m" ''
+        Refresh interval to re-read file SD files. It is used as a resync fallback.
+      '';
+
+      store.sd-dns-interval = mkParamDef types.str "30s" ''
+        Interval between DNS resolutions.
+      '';
+
+      store.unhealthy-timeout = mkParamDef types.str "5m" ''
+        Timeout before an unhealthy store is cleaned from the store UI page.
+      '';
+
+      query.auto-downsampling = mkFlagParam ''
+        Enable automatic adjustment (step / 5) to what source of data should
+        be used in store gateways if no
+        <literal>max_source_resolution</literal> param is specified.
+      '';
+
+      query.partial-response = mkFlagParam ''
+        Enable partial response for queries if no
+        <literal>partial_response</literal> param is specified.
+      '';
+
+      query.default-evaluation-interval = mkParamDef types.str "1m" ''
+        Set default evaluation interval for sub queries.
+      '';
+
+      store.response-timeout = mkParamDef types.str "0ms" ''
+        If a Store doesn't send any data in this specified duration then a
+        Store will be ignored and partial data will be returned if it's
+        enabled. <literal>0</literal> disables timeout.
+      '';
+    };
+
+    rule = params.common cfg.rule // params.objstore cfg.rule // {
+
+      labels = mkAttrsParam "label" ''
+        Labels to be applied to all generated metrics.
+
+        Similar to external labels for Prometheus,
+        used to identify ruler and its blocks as unique source.
+      '';
+
+      stateDir = mkStateDirParam "data-dir" "thanos-rule" ''
+        Data directory relative to <literal>/var/lib</literal>.
+      '';
+
+      rule-files = mkListParam "rule-file" ''
+        Rule files that should be used by rule manager. Can be in glob format.
+      '';
+
+      eval-interval = mkParamDef types.str "30s" ''
+        The default evaluation interval to use.
+      '';
+
+      tsdb.block-duration = mkParamDef types.str "2h" ''
+        Block duration for TSDB block.
+      '';
+
+      tsdb.retention = mkParamDef types.str "48h" ''
+        Block retention time on local disk.
+      '';
+
+      alertmanagers.urls = mkListParam "alertmanagers.url" ''
+        Alertmanager replica URLs to push firing alerts.
+
+        Ruler claims success if push to at least one alertmanager from
+        discovered succeeds. The scheme may be prefixed with
+        <literal>dns+</literal> or <literal>dnssrv+</literal> to detect
+        Alertmanager IPs through respective DNS lookups. The port defaults to
+        <literal>9093</literal> or the SRV record's value. The URL path is
+        used as a prefix for the regular Alertmanager API path.
+      '';
+
+      alertmanagers.send-timeout = mkParamDef types.str "10s" ''
+        Timeout for sending alerts to alertmanager.
+      '';
+
+      alert.query-url = mkParam types.str ''
+        The external Thanos Query URL that would be set in all alerts 'Source' field.
+      '';
+
+      alert.label-drop = mkListParam "alert.label-drop" ''
+        Labels by name to drop before sending to alertmanager.
+
+        This allows alert to be deduplicated on replica label.
+
+        Similar Prometheus alert relabelling
+      '';
+
+      web.route-prefix = mkParam types.str ''
+        Prefix for API and UI endpoints.
+
+        This allows thanos UI to be served on a sub-path.
+
+        This option is analogous to <literal>--web.route-prefix</literal> of Promethus.
+      '';
+
+      web.external-prefix = mkParam types.str ''
+        Static prefix for all HTML links and redirect URLs in the UI query web
+        interface.
+
+        Actual endpoints are still served on / or the
+        <option>web.route-prefix</option>. This allows thanos UI to be served
+        behind a reverse proxy that strips a URL sub-path.
+      '';
+
+      web.prefix-header = mkParam types.str ''
+        Name of HTTP request header used for dynamic prefixing of UI links and
+        redirects.
+
+        This option is ignored if the option
+        <option>web.external-prefix</option> is set.
+
+        Security risk: enable this option only if a reverse proxy in front of
+        thanos is resetting the header.
+
+        The header <literal>X-Forwarded-Prefix</literal> can be useful, for
+        example, if Thanos UI is served via Traefik reverse proxy with
+        <literal>PathPrefixStrip</literal> option enabled, which sends the
+        stripped prefix value in <literal>X-Forwarded-Prefix</literal>
+        header. This allows thanos UI to be served on a sub-path.
+      '';
+
+      query.addresses = mkListParam "query" ''
+        Addresses of statically configured query API servers.
+
+        The scheme may be prefixed with <literal>dns+</literal> or
+        <literal>dnssrv+</literal> to detect query API servers through
+        respective DNS lookups.
+      '';
+
+      query.sd-files = mkListParam "query.sd-files" ''
+        Path to file that contain addresses of query peers.
+        The path can be a glob pattern.
+      '';
+
+      query.sd-interval = mkParamDef types.str "5m" ''
+        Refresh interval to re-read file SD files. (used as a fallback)
+      '';
+
+      query.sd-dns-interval = mkParamDef types.str "30s" ''
+        Interval between DNS resolutions.
+      '';
+    };
+
+    compact = params.log // params.tracing cfg.compact // params.objstore cfg.compact // {
+
+      http-address = mkParamDef types.str "0.0.0.0:10902" ''
+        Listen <literal>host:port</literal> for HTTP endpoints.
+      '';
+
+      stateDir = mkStateDirParam "data-dir" "thanos-compact" ''
+        Data directory relative to <literal>/var/lib</literal>
+        in which to cache blocks and process compactions.
+      '';
+
+      consistency-delay = mkParamDef types.str "30m" ''
+        Minimum age of fresh (non-compacted) blocks before they are being
+        processed. Malformed blocks older than the maximum of consistency-delay
+        and 30m0s will be removed.
+      '';
+
+      retention.resolution-raw = mkParamDef types.str "0d" ''
+        How long to retain raw samples in bucket.
+
+        <literal>0d</literal> - disables this retention
+      '';
+
+      retention.resolution-5m = mkParamDef types.str "0d" ''
+        How long to retain samples of resolution 1 (5 minutes) in bucket.
+
+        <literal>0d</literal> - disables this retention
+      '';
+
+      retention.resolution-1h = mkParamDef types.str "0d" ''
+        How long to retain samples of resolution 2 (1 hour) in bucket.
+
+        <literal>0d</literal> - disables this retention
+      '';
+
+      startAt = {
+        toArgs = _opt: startAt: flagToArgs "wait" (startAt == null);
+        option = nullOpt types.str ''
+          When this option is set to a <literal>systemd.time</literal>
+          specification the Thanos compactor will run at the specified period.
+
+          When this option is <literal>null</literal> the Thanos compactor service
+          will run continuously. So it will not exit after all compactions have
+          been processed but wait for new work.
+        '';
+      };
+
+      block-sync-concurrency = mkParamDef types.int 20 ''
+        Number of goroutines to use when syncing block metadata from object storage.
+      '';
+
+      compact.concurrency = mkParamDef types.int 1 ''
+        Number of goroutines to use when compacting groups.
+      '';
+    };
+
+    downsample = params.log // params.tracing cfg.downsample // params.objstore cfg.downsample // {
+
+      stateDir = mkStateDirParam "data-dir" "thanos-downsample" ''
+        Data directory relative to <literal>/var/lib</literal>
+        in which to cache blocks and process downsamplings.
+      '';
+
+    };
+
+    receive = params.common cfg.receive // params.objstore cfg.receive // {
+
+      remote-write.address = mkParamDef types.str "0.0.0.0:19291" ''
+        Address to listen on for remote write requests.
+      '';
+
+      stateDir = mkStateDirParam "tsdb.path" "thanos-receive" ''
+        Data directory relative to <literal>/var/lib</literal> of TSDB.
+      '';
+
+      labels = mkAttrsParam "labels" ''
+        External labels to announce.
+
+        This flag will be removed in the future when handling multiple tsdb
+        instances is added.
+      '';
+
+      tsdb.retention = mkParamDef types.str "15d" ''
+        How long to retain raw samples on local storage.
+
+        <literal>0d</literal> - disables this retention
+      '';
+    };
+
+  };
+
+  assertRelativeStateDir = cmd: {
+    assertions = [
+      {
+        assertion = !hasPrefix "/" cfg."${cmd}".stateDir;
+        message =
+          "The option services.thanos.${cmd}.stateDir should not be an absolute directory." +
+          " It should be a directory relative to /var/lib.";
+      }
+    ];
+  };
+
+in {
+
+  options.services.thanos = {
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.thanos;
+      defaultText = "pkgs.thanos";
+      description = ''
+        The thanos package that should be used.
+      '';
+    };
+
+    sidecar = paramsToOptions params.sidecar // {
+      enable = mkEnableOption
+        "the Thanos sidecar for Prometheus server";
+      arguments = mkArgumentsOption "sidecar";
+    };
+
+    store = paramsToOptions params.store // {
+      enable = mkEnableOption
+        "the Thanos store node giving access to blocks in a bucket provider.";
+      arguments = mkArgumentsOption "store";
+    };
+
+    query = paramsToOptions params.query // {
+      enable = mkEnableOption
+        ("the Thanos query node exposing PromQL enabled Query API " +
+         "with data retrieved from multiple store nodes");
+      arguments = mkArgumentsOption "query";
+    };
+
+    rule = paramsToOptions params.rule // {
+      enable = mkEnableOption
+        ("the Thanos ruler service which evaluates Prometheus rules against" +
+        " given Query nodes, exposing Store API and storing old blocks in bucket");
+      arguments = mkArgumentsOption "rule";
+    };
+
+    compact = paramsToOptions params.compact // {
+      enable = mkEnableOption
+        "the Thanos compactor which continuously compacts blocks in an object store bucket";
+      arguments = mkArgumentsOption "compact";
+    };
+
+    downsample = paramsToOptions params.downsample // {
+      enable = mkEnableOption
+        "the Thanos downsampler which continuously downsamples blocks in an object store bucket";
+      arguments = mkArgumentsOption "downsample";
+    };
+
+    receive = paramsToOptions params.receive // {
+      enable = mkEnableOption
+        ("the Thanos receiver which accept Prometheus remote write API requests " +
+         "and write to local tsdb (EXPERIMENTAL, this may change drastically without notice)");
+      arguments = mkArgumentsOption "receive";
+    };
+  };
+
+  config = mkMerge [
+
+    (mkIf cfg.sidecar.enable {
+      assertions = [
+        {
+          assertion = config.services.prometheus2.enable;
+          message =
+            "Please enable services.prometheus2 when enabling services.thanos.sidecar.";
+        }
+        {
+          assertion = !(config.services.prometheus2.globalConfig.external_labels == null ||
+                        config.services.prometheus2.globalConfig.external_labels == {});
+          message =
+            "services.thanos.sidecar requires uniquely identifying external labels " +
+            "to be configured in the Prometheus server. " +
+            "Please set services.prometheus2.globalConfig.external_labels.";
+        }
+      ];
+      systemd.services.thanos-sidecar = {
+        wantedBy = [ "multi-user.target" ];
+        after    = [ "network.target" "prometheus2.service" ];
+        serviceConfig = {
+          User = "prometheus";
+          Restart = "always";
+          ExecStart = thanos "sidecar";
+        };
+      };
+    })
+
+    (mkIf cfg.store.enable (mkMerge [
+      (assertRelativeStateDir "store")
+      {
+        systemd.services.thanos-store = {
+          wantedBy = [ "multi-user.target" ];
+          after    = [ "network.target" ];
+          serviceConfig = {
+            DynamicUser = true;
+            StateDirectory = cfg.store.stateDir;
+            Restart = "always";
+            ExecStart = thanos "store";
+          };
+        };
+      }
+    ]))
+
+    (mkIf cfg.query.enable {
+      systemd.services.thanos-query = {
+        wantedBy = [ "multi-user.target" ];
+        after    = [ "network.target" ];
+        serviceConfig = {
+          DynamicUser = true;
+          Restart = "always";
+          ExecStart = thanos "query";
+        };
+      };
+    })
+
+    (mkIf cfg.rule.enable (mkMerge [
+      (assertRelativeStateDir "rule")
+      {
+        systemd.services.thanos-rule = {
+          wantedBy = [ "multi-user.target" ];
+          after    = [ "network.target" ];
+          serviceConfig = {
+            DynamicUser = true;
+            StateDirectory = cfg.rule.stateDir;
+            Restart = "always";
+            ExecStart = thanos "rule";
+          };
+        };
+      }
+    ]))
+
+    (mkIf cfg.compact.enable (mkMerge [
+      (assertRelativeStateDir "compact")
+      {
+        systemd.services.thanos-compact =
+          let wait = cfg.compact.startAt == null; in {
+            wantedBy = [ "multi-user.target" ];
+            after    = [ "network.target" ];
+            serviceConfig = {
+              Type    = if wait then "simple" else "oneshot";
+              Restart = if wait then "always" else "no";
+              DynamicUser = true;
+              StateDirectory = cfg.compact.stateDir;
+              ExecStart = thanos "compact";
+            };
+          } // optionalAttrs (!wait) { inherit (cfg.compact) startAt; };
+      }
+    ]))
+
+    (mkIf cfg.downsample.enable (mkMerge [
+      (assertRelativeStateDir "downsample")
+      {
+        systemd.services.thanos-downsample = {
+          wantedBy = [ "multi-user.target" ];
+          after    = [ "network.target" ];
+          serviceConfig = {
+            DynamicUser = true;
+            StateDirectory = cfg.downsample.stateDir;
+            Restart = "always";
+            ExecStart = thanos "downsample";
+          };
+        };
+      }
+    ]))
+
+    (mkIf cfg.receive.enable (mkMerge [
+      (assertRelativeStateDir "receive")
+      {
+        systemd.services.thanos-receive = {
+          wantedBy = [ "multi-user.target" ];
+          after    = [ "network.target" ];
+          serviceConfig = {
+            DynamicUser = true;
+            StateDirectory = cfg.receive.stateDir;
+            Restart = "always";
+            ExecStart = thanos "receive";
+          };
+        };
+      }
+    ]))
+
+  ];
+}

nixos/modules/services/networking/networkmanager.nix

@@ -177,7 +177,7 @@ in {
       basePackages = mkOption {
         type = types.attrsOf types.package;
         default = { inherit (pkgs)
-                            networkmanager modemmanager wpa_supplicant
+                            networkmanager modemmanager wpa_supplicant crda
                             networkmanager-openvpn networkmanager-vpnc
                             networkmanager-openconnect networkmanager-fortisslvpn
                             networkmanager-l2tp networkmanager-iodine; };

nixos/modules/services/networking/wpa_supplicant.nix

@@ -204,6 +204,7 @@ in {
     environment.systemPackages =  [ pkgs.wpa_supplicant ];
 
     services.dbus.packages = [ pkgs.wpa_supplicant ];
+    services.udev.packages = [ pkgs.crda ];
 
     # FIXME: start a separate wpa_supplicant instance per interface.
     systemd.services.wpa_supplicant = let

nixos/modules/services/web-apps/mediawiki.nix

@@ -0,0 +1,473 @@
+{ config, pkgs, lib, ... }:
+
+let
+
+  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption;
+  inherit (lib) concatStringsSep literalExample mapAttrsToList optional optionals optionalString types;
+
+  cfg = config.services.mediawiki;
+  fpm = config.services.phpfpm.pools.mediawiki;
+  user = "mediawiki";
+  group = config.services.httpd.group;
+  cacheDir = "/var/cache/mediawiki";
+  stateDir = "/var/lib/mediawiki";
+
+  pkg = pkgs.stdenv.mkDerivation rec {
+    pname = "mediawiki-full";
+    version = src.version;
+    src = cfg.package;
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
+
+      rm -rf $out/share/mediawiki/skins/*
+      rm -rf $out/share/mediawiki/extensions/*
+
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: ''
+        ln -s ${v} $out/share/mediawiki/skins/${k}
+      '') cfg.skins)}
+
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: ''
+        ln -s ${v} $out/share/mediawiki/extensions/${k}
+      '') cfg.extensions)}
+    '';
+  };
+
+  mediawikiScripts = pkgs.runCommand "mediawiki-scripts" {
+    buildInputs = [ pkgs.makeWrapper ];
+    preferLocalBuild = true;
+  } ''
+    mkdir -p $out/bin
+    for i in changePassword.php createAndPromote.php userOptions.php edit.php nukePage.php update.php; do
+      makeWrapper ${pkgs.php}/bin/php $out/bin/mediawiki-$(basename $i .php) \
+        --set MEDIAWIKI_CONFIG ${mediawikiConfig} \
+        --add-flags ${pkg}/share/mediawiki/maintenance/$i
+    done
+  '';
+
+  mediawikiConfig = pkgs.writeText "LocalSettings.php" ''
+    <?php
+      # Protect against web entry
+      if ( !defined( 'MEDIAWIKI' ) ) {
+        exit;
+      }
+
+      $wgSitename = "${cfg.name}";
+      $wgMetaNamespace = false;
+
+      ## The URL base path to the directory containing the wiki;
+      ## defaults for all runtime URL paths are based off of this.
+      ## For more information on customizing the URLs
+      ## (like /w/index.php/Page_title to /wiki/Page_title) please see:
+      ## https://www.mediawiki.org/wiki/Manual:Short_URL
+      $wgScriptPath = "";
+
+      ## The protocol and server name to use in fully-qualified URLs
+      $wgServer = "${if cfg.virtualHost.enableSSL then "https" else "http"}://${cfg.virtualHost.hostName}";
+
+      ## The URL path to static resources (images, scripts, etc.)
+      $wgResourceBasePath = $wgScriptPath;
+
+      ## The URL path to the logo.  Make sure you change this from the default,
+      ## or else you'll overwrite your logo when you upgrade!
+      $wgLogo = "$wgResourceBasePath/resources/assets/wiki.png";
+
+      ## UPO means: this is also a user preference option
+
+      $wgEnableEmail = true;
+      $wgEnableUserEmail = true; # UPO
+
+      $wgEmergencyContact = "${if cfg.virtualHost.adminAddr != null then cfg.virtualHost.adminAddr else config.services.httpd.adminAddr}";
+      $wgPasswordSender = $wgEmergencyContact;
+
+      $wgEnotifUserTalk = false; # UPO
+      $wgEnotifWatchlist = false; # UPO
+      $wgEmailAuthentication = true;
+
+      ## Database settings
+      $wgDBtype = "${cfg.database.type}";
+      $wgDBserver = "${cfg.database.host}:${if cfg.database.socket != null then cfg.database.socket else toString cfg.database.port}";
+      $wgDBname = "${cfg.database.name}";
+      $wgDBuser = "${cfg.database.user}";
+      ${optionalString (cfg.database.passwordFile != null) "$wgDBpassword = file_get_contents(\"${cfg.database.passwordFile}\");"}
+
+      ${optionalString (cfg.database.type == "mysql" && cfg.database.tablePrefix != null) ''
+        # MySQL specific settings
+        $wgDBprefix = "${cfg.database.tablePrefix}";
+      ''}
+
+      ${optionalString (cfg.database.type == "mysql") ''
+        # MySQL table options to use during installation or update
+        $wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
+      ''}
+
+      ## Shared memory settings
+      $wgMainCacheType = CACHE_NONE;
+      $wgMemCachedServers = [];
+
+      ${optionalString (cfg.uploadsDir != null) ''
+        $wgEnableUploads = true;
+        $wgUploadDirectory = "${cfg.uploadsDir}";
+      ''}
+
+      $wgUseImageMagick = true;
+      $wgImageMagickConvertCommand = "${pkgs.imagemagick}/bin/convert";
+
+      # InstantCommons allows wiki to use images from https://commons.wikimedia.org
+      $wgUseInstantCommons = false;
+
+      # Periodically send a pingback to https://www.mediawiki.org/ with basic data
+      # about this MediaWiki instance. The Wikimedia Foundation shares this data
+      # with MediaWiki developers to help guide future development efforts.
+      $wgPingback = true;
+
+      ## If you use ImageMagick (or any other shell command) on a
+      ## Linux server, this will need to be set to the name of an
+      ## available UTF-8 locale
+      $wgShellLocale = "C.UTF-8";
+
+      ## Set $wgCacheDirectory to a writable directory on the web server
+      ## to make your wiki go slightly faster. The directory should not
+      ## be publically accessible from the web.
+      $wgCacheDirectory = "${cacheDir}";
+
+      # Site language code, should be one of the list in ./languages/data/Names.php
+      $wgLanguageCode = "en";
+
+      $wgSecretKey = file_get_contents("${stateDir}/secret.key");
+
+      # Changing this will log out all existing sessions.
+      $wgAuthenticationTokenVersion = "";
+
+      ## For attaching licensing metadata to pages, and displaying an
+      ## appropriate copyright notice / icon. GNU Free Documentation
+      ## License and Creative Commons licenses are supported so far.
+      $wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright
+      $wgRightsUrl = "";
+      $wgRightsText = "";
+      $wgRightsIcon = "";
+
+      # Path to the GNU diff3 utility. Used for conflict resolution.
+      $wgDiff = "${pkgs.diffutils}/bin/diff";
+      $wgDiff3 = "${pkgs.diffutils}/bin/diff3";
+
+      # Enabled skins.
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: "wfLoadSkin('${k}');") cfg.skins)}
+
+      # Enabled extensions.
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: "wfLoadExtension('${k}');") cfg.extensions)}
+
+
+      # End of automatically generated settings.
+      # Add more configuration options below.
+
+      ${cfg.extraConfig}
+  '';
+
+in
+{
+  # interface
+  options = {
+    services.mediawiki = {
+
+      enable = mkEnableOption "MediaWiki";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.mediawiki;
+        description = "Which MediaWiki package to use.";
+      };
+
+      name = mkOption {
+        default = "MediaWiki";
+        example = "Foobar Wiki";
+        description = "Name of the wiki.";
+      };
+
+      uploadsDir = mkOption {
+        type = types.nullOr types.path;
+        default = "${stateDir}/uploads";
+        description = ''
+          This directory is used for uploads of pictures. The directory passed here is automatically
+          created and permissions adjusted as required.
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.path;
+        description = "A file containing the initial password for the admin user.";
+        example = "/run/keys/mediawiki-password";
+      };
+
+      skins = mkOption {
+        default = {};
+        type = types.attrsOf types.path;
+        description = ''
+          List of paths whose content is copied to the 'skins'
+          subdirectory of the MediaWiki installation.
+        '';
+      };
+
+      extensions = mkOption {
+        default = {};
+        type = types.attrsOf types.path;
+        description = ''
+          List of paths whose content is copied to the 'extensions'
+          subdirectory of the MediaWiki installation.
+        '';
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "mysql" "postgres" "sqlite" "mssql" "oracle" ];
+          default = "mysql";
+          description = "Database engine to use. MySQL/MariaDB is the database of choice by MediaWiki developers.";
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "localhost";
+          description = "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 3306;
+          description = "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "mediawiki";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = "mediawiki";
+          description = "Database user.";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/mediawiki-dbpassword";
+          description = ''
+            A file containing the password corresponding to
+            <option>database.user</option>.
+          '';
+        };
+
+        tablePrefix = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            If you only have access to a single database and wish to install more than
+            one version of MediaWiki, or have other applications that also use the
+            database, you can give the table names a unique prefix to stop any naming
+            conflicts or confusion.
+            See <link xlink:href='https://www.mediawiki.org/wiki/Manual:$wgDBprefix'/>.
+          '';
+        };
+
+        socket = mkOption {
+          type = types.nullOr types.path;
+          default = if cfg.database.createLocally then "/run/mysqld/mysqld.sock" else null;
+          defaultText = "/run/mysqld/mysqld.sock";
+          description = "Path to the unix socket file to use for authentication.";
+        };
+
+        createLocally = mkOption {
+          type = types.bool;
+          default = cfg.database.type == "mysql";
+          defaultText = "true";
+          description = ''
+            Create the database and database user locally.
+            This currently only applies if database type "mysql" is selected.
+          '';
+        };
+      };
+
+      virtualHost = mkOption {
+        type = types.submodule ({
+          options = import ../web-servers/apache-httpd/per-server-options.nix {
+            inherit lib;
+            forMainServer = false;
+          };
+        });
+        example = literalExample ''
+          {
+            hostName = "mediawiki.example.org";
+            enableSSL = true;
+            adminAddr = "webmaster@example.org";
+            sslServerCert = "/var/lib/acme/mediawiki.example.org/full.pem";
+            sslServerKey = "/var/lib/acme/mediawiki.example.org/key.pem";
+          }
+        '';
+        description = ''
+          Apache configuration can be done by adapting <option>services.httpd.virtualHosts</option>.
+          See <xref linkend="opt-services.httpd.virtualHosts"/> for further information.
+        '';
+      };
+
+      poolConfig = mkOption {
+        type = types.lines;
+        default = ''
+          pm = dynamic
+          pm.max_children = 32
+          pm.start_servers = 2
+          pm.min_spare_servers = 2
+          pm.max_spare_servers = 4
+          pm.max_requests = 500
+        '';
+        description = ''
+          Options for MediaWiki's PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+          for details on configuration directives.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        description = ''
+          Any additional text to be appended to MediaWiki's
+          LocalSettings.php configuration file. For configuration
+          settings, see <link xlink:href="https://www.mediawiki.org/wiki/Manual:Configuration_settings"/>.
+        '';
+        default = "";
+        example = ''
+          $wgEnableEmail = false;
+        '';
+      };
+
+    };
+  };
+
+  # implementation
+  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = cfg.database.createLocally -> cfg.database.type == "mysql";
+        message = "services.mediawiki.createLocally is currently only supported for database type 'mysql'";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+        message = "services.mediawiki.database.user must be set to ${user} if services.mediawiki.database.createLocally is set true";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.socket != null;
+        message = "services.mediawiki.database.socket must be set if services.mediawiki.database.createLocally is set to true";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = "a password cannot be specified if services.mediawiki.database.createLocally is set to true";
+      }
+    ];
+
+    services.mediawiki.skins = {
+      MonoBook = "${cfg.package}/share/mediawiki/skins/MonoBook";
+      Timeless = "${cfg.package}/share/mediawiki/skins/Timeless";
+      Vector = "${cfg.package}/share/mediawiki/skins/Vector";
+    };
+
+    services.mysql = mkIf cfg.database.createLocally {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    services.phpfpm.pools.mediawiki = {
+      listen = "/run/phpfpm/mediawiki.sock";
+      extraConfig = ''
+        listen.owner = ${config.services.httpd.user}
+        listen.group = ${config.services.httpd.group}
+        user = ${user}
+        group = ${group}
+
+        env[MEDIAWIKI_CONFIG] = ${mediawikiConfig}
+
+        ${cfg.poolConfig}
+      '';
+    };
+
+    services.httpd = {
+      enable = true;
+      adminAddr = mkDefault cfg.virtualHost.adminAddr;
+      extraModules = [ "proxy_fcgi" ];
+      virtualHosts = [ (mkMerge [
+        cfg.virtualHost {
+          documentRoot = mkForce "${pkg}/share/mediawiki";
+          extraConfig = ''
+            <Directory "${pkg}/share/mediawiki">
+              <FilesMatch "\.php$">
+                <If "-f %{REQUEST_FILENAME}">
+                  SetHandler "proxy:unix:${fpm.listen}|fcgi://localhost/"
+                </If>
+              </FilesMatch>
+
+              Require all granted
+              DirectoryIndex index.php
+              AllowOverride All
+            </Directory>
+          '' + optionalString (cfg.uploadsDir != null) ''
+            Alias "/images" "${cfg.uploadsDir}"
+            <Directory "${cfg.uploadsDir}">
+              Require all granted
+            </Directory>
+          '';
+        }
+      ]) ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${stateDir}' 0750 ${user} ${group} - -"
+      "d '${cacheDir}' 0750 ${user} ${group} - -"
+    ] ++ optionals (cfg.uploadsDir != null) [
+      "d '${cfg.uploadsDir}' 0750 ${user} ${group} - -"
+      "Z '${cfg.uploadsDir}' 0750 ${user} ${group} - -"
+    ];
+
+    systemd.services.mediawiki-init = {
+      wantedBy = [ "multi-user.target" ];
+      before = [ "phpfpm-mediawiki.service" ];
+      after = optional cfg.database.createLocally "mysql.service";
+      script = ''
+        if ! test -e "${stateDir}/secret.key"; then
+          tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
+        fi
+
+        echo "exit( wfGetDB( DB_MASTER )->tableExists( 'user' ) ? 1 : 0 );" | \
+        ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/eval.php --conf ${mediawikiConfig} && \
+        ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/install.php \
+          --confpath /tmp \
+          --scriptpath / \
+          --dbserver ${cfg.database.host}${optionalString (cfg.database.socket != null) ":${cfg.database.socket}"} \
+          --dbport ${toString cfg.database.port} \
+          --dbname ${cfg.database.name} \
+          ${optionalString (cfg.database.tablePrefix != null) "--dbprefix ${cfg.database.tablePrefix}"} \
+          --dbuser ${cfg.database.user} \
+          ${optionalString (cfg.database.passwordFile != null) "--dbpassfile ${cfg.database.passwordFile}"} \
+          --passfile ${cfg.passwordFile} \
+          ${cfg.name} \
+          admin
+
+        ${pkgs.php}/bin/php ${pkg}/share/mediawiki/maintenance/update.php --conf ${mediawikiConfig} --quick
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = user;
+        Group = group;
+        PrivateTmp = true;
+      };
+    };
+
+    systemd.services.httpd.after = optional (cfg.database.createLocally && cfg.database.type == "mysql") "mysql.service";
+
+    users.users.${user}.group = group;
+
+    environment.systemPackages = [ mediawikiScripts ];
+  };
+}

nixos/modules/services/web-servers/apache-httpd/mediawiki.nix

@@ -1,349 +0,0 @@
-{ config, lib, pkgs, serverInfo, php, ... }:
-
-with lib;
-
-let
-
-  httpd = serverInfo.serverConfig.package;
-
-  version24 = !versionOlder httpd.version "2.4";
-
-  allGranted = if version24 then ''
-    Require all granted
-  '' else ''
-    Order allow,deny
-    Allow from all
-  '';
-
-  mediawikiConfig = pkgs.writeText "LocalSettings.php"
-    ''
-      <?php
-        # Copied verbatim from the default (generated) LocalSettings.php.
-        if( defined( 'MW_INSTALL_PATH' ) ) {
-                $IP = MW_INSTALL_PATH;
-        } else {
-                $IP = dirname( __FILE__ );
-        }
-
-        $path = array( $IP, "$IP/includes", "$IP/languages" );
-        set_include_path( implode( PATH_SEPARATOR, $path ) . PATH_SEPARATOR . get_include_path() );
-
-        require_once( "$IP/includes/DefaultSettings.php" );
-
-        if ( $wgCommandLineMode ) {
-                if ( isset( $_SERVER ) && array_key_exists( 'REQUEST_METHOD', $_SERVER ) ) {
-                        die( "This script must be run from the command line\n" );
-                }
-        }
-
-        $wgScriptPath = "${config.urlPrefix}";
-
-        # We probably need to set $wgSecretKey and $wgCacheEpoch.
-
-        # Paths to external programs.
-        $wgDiff3 = "${pkgs.diffutils}/bin/diff3";
-        $wgDiff = "${pkgs.diffutils}/bin/diff";
-        $wgImageMagickConvertCommand = "${pkgs.imagemagick.out}/bin/convert";
-
-        #$wgDebugLogFile = "/tmp/mediawiki_debug_log.txt";
-
-        # Database configuration.
-        $wgDBtype = "${config.dbType}";
-        $wgDBserver = "${config.dbServer}";
-        $wgDBuser = "${config.dbUser}";
-        $wgDBpassword = "${config.dbPassword}";
-        $wgDBname = "${config.dbName}";
-
-        # E-mail.
-        $wgEmergencyContact = "${config.emergencyContact}";
-        $wgPasswordSender = "${config.passwordSender}";
-
-        $wgSitename = "${config.siteName}";
-
-        ${optionalString (config.logo != "") ''
-          $wgLogo = "${config.logo}";
-        ''}
-
-        ${optionalString (config.articleUrlPrefix != "") ''
-          $wgArticlePath = "${config.articleUrlPrefix}/$1";
-        ''}
-
-        ${optionalString config.enableUploads ''
-          $wgEnableUploads = true;
-          $wgUploadDirectory = "${config.uploadDir}";
-        ''}
-
-        ${optionalString (config.defaultSkin != "") ''
-          $wgDefaultSkin = "${config.defaultSkin}";
-        ''}
-
-        ${config.extraConfig}
-      ?>
-    '';
-
-  # Unpack Mediawiki and put the config file in its root directory.
-  mediawikiRoot = pkgs.stdenv.mkDerivation rec {
-    name= "mediawiki-1.31.1";
-
-    src = pkgs.fetchurl {
-      url = "https://releases.wikimedia.org/mediawiki/1.31/${name}.tar.gz";
-      sha256 = "13x48clij21cmysjkpnx68vggchrdasqp7b290j87xlfgjhdhnnf";
-    };
-
-    skins = config.skins;
-    extensions = config.extensions;
-
-    buildPhase =
-      ''
-        for skin in $skins; do
-          cp -prvd $skin/* skins/
-        done
-        for extension in $extensions; do
-          cp -prvd $extension/* extensions/
-        done
-      ''; # */
-
-    installPhase =
-      ''
-        mkdir -p $out
-        cp -r * $out
-        cp ${mediawikiConfig} $out/LocalSettings.php
-        sed -i \
-        -e 's|/bin/bash|${pkgs.bash}/bin/bash|g' \
-        -e 's|/usr/bin/timeout|${pkgs.coreutils}/bin/timeout|g' \
-          $out/includes/shell/limit.sh \
-          $out/includes/GlobalFunctions.php
-      '';
-  };
-
-  mediawikiScripts = pkgs.runCommand "mediawiki-${config.id}-scripts" {
-      buildInputs = [ pkgs.makeWrapper ];
-      preferLocalBuild = true;
-    } ''
-      mkdir -p $out/bin
-      for i in changePassword.php createAndPromote.php userOptions.php edit.php nukePage.php update.php; do
-        makeWrapper ${php}/bin/php $out/bin/mediawiki-${config.id}-$(basename $i .php) \
-          --add-flags ${mediawikiRoot}/maintenance/$i
-      done
-    '';
-
-in
-
-{
-
-  extraConfig =
-    ''
-      ${optionalString config.enableUploads ''
-        Alias ${config.urlPrefix}/images ${config.uploadDir}
-
-        <Directory ${config.uploadDir}>
-            ${allGranted}
-            Options -Indexes
-        </Directory>
-      ''}
-
-      ${if config.urlPrefix != "" then "Alias ${config.urlPrefix} ${mediawikiRoot}" else ''
-        RewriteEngine On
-        RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-f
-        RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-d
-        ${concatMapStringsSep "\n" (u: "RewriteCond %{REQUEST_URI} !^${u.urlPath}") serverInfo.vhostConfig.servedDirs}
-        ${concatMapStringsSep "\n" (u: "RewriteCond %{REQUEST_URI} !^${u.urlPath}") serverInfo.vhostConfig.servedFiles}
-        RewriteRule ${if config.enableUploads
-          then "!^/images"
-          else "^.*\$"
-        } %{DOCUMENT_ROOT}/${if config.articleUrlPrefix == ""
-          then ""
-          else "${config.articleUrlPrefix}/"
-        }index.php [L]
-      ''}
-
-      <Directory ${mediawikiRoot}>
-          ${allGranted}
-          DirectoryIndex index.php
-      </Directory>
-
-      ${optionalString (config.articleUrlPrefix != "") ''
-        Alias ${config.articleUrlPrefix} ${mediawikiRoot}/index.php
-      ''}
-    '';
-
-  documentRoot = if config.urlPrefix == "" then mediawikiRoot else null;
-
-  enablePHP = true;
-
-  options = {
-
-    id = mkOption {
-      default = "main";
-      description = ''
-        A unique identifier necessary to keep multiple MediaWiki server
-        instances on the same machine apart.  This is used to
-        disambiguate the administrative scripts, which get names like
-        mediawiki-$id-change-password.
-      '';
-    };
-
-    dbType = mkOption {
-      default = "postgres";
-      example = "mysql";
-      description = "Database type.";
-    };
-
-    dbName = mkOption {
-      default = "mediawiki";
-      description = "Name of the database that holds the MediaWiki data.";
-    };
-
-    dbServer = mkOption {
-      default = ""; # use a Unix domain socket
-      example = "10.0.2.2";
-      description = ''
-        The location of the database server.  Leave empty to use a
-        database server running on the same machine through a Unix
-        domain socket.
-      '';
-    };
-
-    dbUser = mkOption {
-      default = "mediawiki";
-      description = "The user name for accessing the database.";
-    };
-
-    dbPassword = mkOption {
-      default = "";
-      example = "foobar";
-      description = ''
-        The password of the database user.  Warning: this is stored in
-        cleartext in the Nix store!
-      '';
-    };
-
-    emergencyContact = mkOption {
-      default = serverInfo.serverConfig.adminAddr;
-      example = "admin@example.com";
-      description = ''
-        Emergency contact e-mail address.  Defaults to the Apache
-        admin address.
-      '';
-    };
-
-    passwordSender = mkOption {
-      default = serverInfo.serverConfig.adminAddr;
-      example = "password@example.com";
-      description = ''
-        E-mail address from which password confirmations originate.
-        Defaults to the Apache admin address.
-      '';
-    };
-
-    siteName = mkOption {
-      default = "MediaWiki";
-      example = "Foobar Wiki";
-      description = "Name of the wiki";
-    };
-
-    logo = mkOption {
-      default = "";
-      example = "/images/logo.png";
-      description = "The URL of the site's logo (which should be a 135x135px image).";
-    };
-
-    urlPrefix = mkOption {
-      default = "/w";
-      description = ''
-        The URL prefix under which the Mediawiki service appears.
-      '';
-    };
-
-    articleUrlPrefix = mkOption {
-      default = "/wiki";
-      example = "";
-      description = ''
-        The URL prefix under which article pages appear,
-        e.g. http://server/wiki/Page.  Leave empty to use the main URL
-        prefix, e.g. http://server/w/index.php?title=Page.
-      '';
-    };
-
-    enableUploads = mkOption {
-      default = false;
-      description = "Whether to enable file uploads.";
-    };
-
-    uploadDir = mkOption {
-      default = throw "You must specify `uploadDir'.";
-      example = "/data/mediawiki-upload";
-      description = "The directory that stores uploaded files.";
-    };
-
-    defaultSkin = mkOption {
-      default = "";
-      example = "nostalgia";
-      description = "Set this value to change the default skin used by MediaWiki.";
-    };
-
-    skins = mkOption {
-      default = [];
-      type = types.listOf types.path;
-      description =
-        ''
-          List of paths whose content is copied to the ‘skins’
-          subdirectory of the MediaWiki installation.
-        '';
-    };
-
-    extensions = mkOption {
-      default = [];
-      type = types.listOf types.path;
-      description =
-        ''
-          List of paths whose content is copied to the 'extensions'
-          subdirectory of the MediaWiki installation.
-        '';
-    };
-
-    extraConfig = mkOption {
-      type = types.lines;
-      default = "";
-      example =
-        ''
-          $wgEnableEmail = false;
-        '';
-      description = ''
-        Any additional text to be appended to MediaWiki's
-        configuration file.  This is a PHP script.  For configuration
-        settings, see <link xlink:href='https://www.mediawiki.org/wiki/Manual:Configuration_settings'/>.
-      '';
-    };
-
-  };
-
-  extraPath = [ mediawikiScripts ];
-
-  # !!! Need to specify that Apache has a dependency on PostgreSQL!
-
-  startupScript = pkgs.writeScript "mediawiki_startup.sh"
-    # Initialise the database automagically if we're using a Postgres
-    # server on localhost.
-    (optionalString (config.dbType == "postgres" && config.dbServer == "") ''
-      if ! ${pkgs.postgresql}/bin/psql -l | grep -q ' ${config.dbName} ' ; then
-          ${pkgs.postgresql}/bin/createuser --no-superuser --no-createdb --no-createrole "${config.dbUser}" || true
-          ${pkgs.postgresql}/bin/createdb "${config.dbName}" -O "${config.dbUser}"
-          ( echo 'CREATE LANGUAGE plpgsql;'
-            cat ${mediawikiRoot}/maintenance/postgres/tables.sql
-            echo 'CREATE TEXT SEARCH CONFIGURATION public.default ( COPY = pg_catalog.english );'
-            echo COMMIT
-          ) | ${pkgs.postgresql}/bin/psql -U "${config.dbUser}" "${config.dbName}"
-      fi
-      ${php}/bin/php ${mediawikiRoot}/maintenance/update.php
-    '');
-
-  robotsEntries = optionalString (config.articleUrlPrefix != "")
-    ''
-      User-agent: *
-      Disallow: ${config.urlPrefix}/
-      Disallow: ${config.articleUrlPrefix}/Special:Search
-      Disallow: ${config.articleUrlPrefix}/Special:Random
-    '';
-
-}

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -154,6 +154,7 @@ in {
     services.hardware.bolt.enable = mkDefault true;
     services.xserver.libinput.enable = mkDefault true; # for controlling touchpad settings via gnome control center
     systemd.packages = [ pkgs.gnome3.vino ];
+    xdg.portal.enable = true;
     xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
     # If gnome3 is installed, build vim for gtk3 too.
@@ -229,7 +230,7 @@ in {
 
     # Use the correct gnome3 packageSet
     networking.networkmanager.basePackages =
-      { inherit (pkgs) networkmanager modemmanager wpa_supplicant;
+      { inherit (pkgs) networkmanager modemmanager wpa_supplicant crda;
         inherit (pkgs.gnome3) networkmanager-openvpn networkmanager-vpnc
                               networkmanager-openconnect networkmanager-fortisslvpn
                               networkmanager-iodine networkmanager-l2tp; };

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -147,7 +147,7 @@ in
 
     networking.networkmanager.enable = mkDefault true;
     networking.networkmanager.basePackages =
-      { inherit (pkgs) networkmanager modemmanager wpa_supplicant;
+      { inherit (pkgs) networkmanager modemmanager wpa_supplicant crda;
         inherit (pkgs.gnome3) networkmanager-openvpn networkmanager-vpnc
                               networkmanager-openconnect networkmanager-fortisslvpn
                               networkmanager-iodine networkmanager-l2tp; };

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -170,7 +170,7 @@ in
 
           xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
         ]
-        
+
         # Phonon audio backend
         ++ lib.optional (cfg.phononBackend == "gstreamer") libsForQt5.phonon-backend-gstreamer
         ++ lib.optional (cfg.phononBackend == "gstreamer" && cfg.enableQt4Support) pkgs.phonon-backend-gstreamer
@@ -233,6 +233,7 @@ in
       security.pam.services.sddm.enableKwallet = true;
       security.pam.services.slim.enableKwallet = true;
 
+      xdg.portal.enable = true;
       xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-kde ];
 
       # Update the start menu for each user that is currently logged in

nixos/modules/services/x11/xserver.nix

@@ -14,6 +14,9 @@ let
     # Alias so people can keep using "virtualbox" instead of "vboxvideo".
     virtualbox = { modules = [ xorg.xf86videovboxvideo ]; driverName = "vboxvideo"; };
 
+    # Alias so that "radeon" uses the xf86-video-ati driver.
+    radeon = { modules = [ xorg.xf86videoati ]; driverName = "ati"; };
+
     # modesetting does not have a xf86videomodesetting package as it is included in xorgserver
     modesetting = {};
   };
@@ -241,7 +244,7 @@ in
       videoDrivers = mkOption {
         type = types.listOf types.str;
         # !!! We'd like "nv" here, but it segfaults the X server.
-        default = [ "ati" "cirrus" "vesa" "vmware" "modesetting" ];
+        default = [ "radeon" "cirrus" "vesa" "vmware" "modesetting" ];
         example = [
           "ati_unfree" "amdgpu" "amdgpu-pro"
           "nv" "nvidia" "nvidiaLegacy390" "nvidiaLegacy340" "nvidiaLegacy304"

nixos/modules/tasks/filesystems/xfs.nix

@@ -18,6 +18,7 @@ in
     boot.initrd.extraUtilsCommands = mkIf inInitrd
       ''
         copy_bin_and_libs ${pkgs.xfsprogs.bin}/bin/fsck.xfs
+        copy_bin_and_libs ${pkgs.xfsprogs.bin}/bin/xfs_repair
       '';
 
     # Trick just to set 'sh' after the extraUtils nuke-refs.

nixos/tests/all-tests.nix

@@ -85,6 +85,7 @@ in
   flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {};
   flatpak = handleTest ./flatpak.nix {};
   flatpak-builder = handleTest ./flatpak-builder.nix {};
+  fluentd = handleTest ./fluentd.nix {};
   fsck = handleTest ./fsck.nix {};
   fwupd = handleTestOn ["x86_64-linux"] ./fwupd.nix {}; # libsmbios is unsupported on aarch64
   gdk-pixbuf = handleTest ./gdk-pixbuf.nix {};
@@ -146,6 +147,7 @@ in
   mailcatcher = handleTest ./mailcatcher.nix {};
   mathics = handleTest ./mathics.nix {};
   matrix-synapse = handleTest ./matrix-synapse.nix {};
+  mediawiki = handleTest ./mediawiki.nix {};
   memcached = handleTest ./memcached.nix {};
   mesos = handleTest ./mesos.nix {};
   miniflux = handleTest ./miniflux.nix {};

nixos/tests/flatpak-builder.nix

@@ -9,6 +9,7 @@ import ./make-test.nix ({ pkgs, ... }:
 
   machine = { pkgs, ... }: {
     services.flatpak.enable = true;
+    xdg.portal.enable = true;
     environment.systemPackages = with pkgs; [ gnome-desktop-testing flatpak-builder ] ++ flatpak-builder.installedTestsDependencies;
     virtualisation.diskSize = 2048;
   };

nixos/tests/fluentd.nix

@@ -0,0 +1,46 @@
+import ./make-test.nix ({ pkgs, lib, ... }: {
+  name = "fluentd";
+
+  machine = { pkgs, ... }: {
+    services.fluentd = {
+      enable = true;
+      config = ''
+        <source>
+          @type http
+          port 9880
+        </source>
+
+        <match **>
+          type copy
+          <store>
+            @type file
+            format json
+            path /tmp/fluentd
+            symlink_path /tmp/current-log
+          </store>
+          <store>
+            @type stdout
+          </store>
+        </match>
+      '';
+    };
+  };
+
+  testScript = let
+    testMessage = "an example log message";
+
+    payload = pkgs.writeText "test-message.json" (builtins.toJSON {
+      inherit testMessage;
+    });
+  in ''
+    $machine->start;
+    $machine->waitForUnit('fluentd.service');
+    $machine->waitForOpenPort(9880);
+
+    $machine->succeed("curl -fsSL -X POST -H 'Content-type: application/json' -d @${payload} http://localhost:9880/test.tag");
+
+    $machine->succeed("systemctl stop fluentd"); # blocking flush
+
+    $machine->succeed("grep '${testMessage}' /tmp/current-log");
+  '';
+})

nixos/tests/mediawiki.nix

@@ -0,0 +1,19 @@
+import ./make-test.nix ({ pkgs, lib, ... }: {
+  name = "mediawiki";
+  meta.maintainers = [ lib.maintainers.aanderse ];
+
+  machine =
+    { ... }:
+    { services.mediawiki.enable = true;
+      services.mediawiki.virtualHost.hostName = "localhost";
+      services.mediawiki.virtualHost.adminAddr = "root@example.com";
+      services.mediawiki.passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
+    };
+
+  testScript = ''
+    startAll;
+
+    $machine->waitForUnit('phpfpm-mediawiki.service');
+    $machine->succeed('curl -L http://localhost/') =~ /MediaWiki has been installed/ or die;
+  '';
+})

nixos/tests/prometheus-2.nix

@@ -1,9 +1,44 @@
-import ./make-test.nix {
+let
+  grpcPort   = 19090;
+  queryPort  =  9090;
+  minioPort  =  9000;
+  pushgwPort =  9091;
+
+  s3 = {
+    accessKey = "BKIKJAA5BMMU2RHO6IBB";
+    secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+  };
+
+  objstore.config = {
+    type = "S3";
+    config = {
+      bucket = "thanos-bucket";
+      endpoint = "s3:${toString minioPort}";
+      region =  "us-east-1";
+      access_key = s3.accessKey;
+      secret_key = s3.secretKey;
+      insecure = true;
+      signature_version2 = false;
+      encrypt_sse =  false;
+      put_user_metadata = {};
+      http_config = {
+        idle_conn_timeout = "0s";
+        insecure_skip_verify = false;
+      };
+      trace = {
+        enable = false;
+      };
+    };
+  };
+
+in import ./make-test.nix {
   name = "prometheus-2";
 
   nodes = {
-    one = { pkgs, ... }: {
+    prometheus = { pkgs, ... }: {
+      virtualisation.diskSize = 2 * 1024;
       environment.systemPackages = [ pkgs.jq ];
+      networking.firewall.allowedTCPPorts = [ grpcPort ];
       services.prometheus2 = {
         enable = true;
         scrapeConfigs = [
@@ -11,7 +46,7 @@ import ./make-test.nix {
             job_name = "prometheus";
             static_configs = [
               {
-                targets = [ "127.0.0.1:9090" ];
+                targets = [ "127.0.0.1:${toString queryPort}" ];
                 labels = { instance = "localhost"; };
               }
             ];
@@ -21,7 +56,7 @@ import ./make-test.nix {
             scrape_interval = "1s";
             static_configs = [
               {
-                targets = [ "127.0.0.1:9091" ];
+                targets = [ "127.0.0.1:${toString pushgwPort}" ];
               }
             ];
           }
@@ -35,33 +70,170 @@ import ./make-test.nix {
                     expr: count(up{job="prometheus"})
           ''
         ];
+        globalConfig = {
+          external_labels = {
+            some_label = "required by thanos";
+          };
+        };
+        extraFlags = [
+          # Required by thanos
+          "--storage.tsdb.min-block-duration=5s"
+          "--storage.tsdb.max-block-duration=5s"
+        ];
       };
       services.prometheus.pushgateway = {
         enable = true;
+        web.listen-address = ":${toString pushgwPort}";
         persistMetrics = true;
         persistence.interval = "1s";
         stateDir = "prometheus-pushgateway";
       };
+      services.thanos = {
+        sidecar = {
+          enable = true;
+          grpc-address = "0.0.0.0:${toString grpcPort}";
+          inherit objstore;
+        };
+
+        # TODO: Add some tests for these services:
+        #rule = {
+        #  enable = true;
+        #  http-address = "0.0.0.0:19194";
+        #  grpc-address = "0.0.0.0:19193";
+        #  query.addresses = [
+        #    "localhost:19191"
+        #  ];
+        #  labels = {
+        #    just = "some";
+        #    nice = "labels";
+        #  };
+        #};
+        #
+        #receive = {
+        #  http-address = "0.0.0.0:19195";
+        #  enable = true;
+        #  labels = {
+        #    just = "some";
+        #    nice = "labels";
+        #  };
+        #};
+      };
+    };
+
+    query = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.jq ];
+      services.thanos.query = {
+        enable = true;
+        http-address = "0.0.0.0:${toString queryPort}";
+        store.addresses = [
+          "prometheus:${toString grpcPort}"
+        ];
+      };
+    };
+
+    store = { pkgs, ... }: {
+      virtualisation.diskSize = 2 * 1024;
+      environment.systemPackages = with pkgs; [ jq thanos ];
+      services.thanos.store = {
+        enable = true;
+        http-address = "0.0.0.0:10902";
+        grpc-address = "0.0.0.0:${toString grpcPort}";
+        inherit objstore;
+        sync-block-duration = "1s";
+      };
+      services.thanos.compact = {
+        enable = true;
+        http-address = "0.0.0.0:10903";
+        inherit objstore;
+        consistency-delay = "5s";
+      };
+      services.thanos.query = {
+        enable = true;
+        http-address = "0.0.0.0:${toString queryPort}";
+        store.addresses = [
+          "localhost:${toString grpcPort}"
+        ];
+      };
+    };
+
+    s3 = { pkgs, ... } : {
+      # Minio requires at least 1GiB of free disk space to run.
+      virtualisation.diskSize = 2 * 1024;
+      networking.firewall.allowedTCPPorts = [ minioPort ];
+
+      services.minio = {
+        enable = true;
+        inherit (s3) accessKey secretKey;
+      };
+
+      environment.systemPackages = [ pkgs.minio-client ];
     };
   };
 
-  testScript = ''
-    startAll;
-    $one->waitForUnit("prometheus2.service");
-    $one->waitForOpenPort(9090);
-    $one->succeed("curl -s http://127.0.0.1:9090/metrics");
+  testScript = { nodes, ... } : ''
+    # Before starting the other machines we first make sure that our S3 service is online
+    # and has a bucket added for thanos:
+    $s3->start;
+    $s3->waitForUnit("minio.service");
+    $s3->waitForOpenPort(${toString minioPort});
+    $s3->succeed(
+      "mc config host add minio " .
+      "http://localhost:${toString minioPort} ${s3.accessKey} ${s3.secretKey} S3v4");
+    $s3->succeed("mc mb minio/thanos-bucket");
 
-    # Let's test if pushing a metric to the pushgateway succeeds
-    # and whether that metric gets ingested by prometheus.
-    $one->waitForUnit("pushgateway.service");
-    $one->succeed(
+    # Now that s3 has started we can start the other machines:
+    $prometheus->start;
+    $query->start;
+    $store->start;
+
+    # Check if prometheus responds to requests:
+    $prometheus->waitForUnit("prometheus2.service");
+    $prometheus->waitForOpenPort(${toString queryPort});
+    $prometheus->succeed("curl -s http://127.0.0.1:${toString queryPort}/metrics");
+
+    # Let's test if pushing a metric to the pushgateway succeeds:
+    $prometheus->waitForUnit("pushgateway.service");
+    $prometheus->succeed(
       "echo 'some_metric 3.14' | " .
-      "curl --data-binary \@- http://127.0.0.1:9091/metrics/job/some_job");
-    $one->waitUntilSucceeds(
-      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=some_metric' " .
-      "| jq '.data.result[0].value[1]' | grep '\"3.14\"'");
+      "curl --data-binary \@- http://127.0.0.1:${toString pushgwPort}/metrics/job/some_job");
+
+    # Now check whether that metric gets ingested by prometheus.
+    # Since we'll check for the metric several times on different machines
+    # we abstract the test using the following function:
+
+    # Function to check if the metric "some_metric" has been received and returns the correct value.
+    local *Machine::waitForMetric = sub {
+      my ($self) = @_;
+      $self->waitUntilSucceeds(
+        "curl -sf 'http://127.0.0.1:${toString queryPort}/api/v1/query?query=some_metric' " .
+        "| jq '.data.result[0].value[1]' | grep '\"3.14\"'");
+    };
+
+    $prometheus->waitForMetric;
 
     # Let's test if the pushgateway persists metrics to the configured location.
-    $one->waitUntilSucceeds("test -e /var/lib/prometheus-pushgateway/metrics");
+    $prometheus->waitUntilSucceeds("test -e /var/lib/prometheus-pushgateway/metrics");
+
+    # Test thanos
+    $prometheus->waitForUnit("thanos-sidecar.service");
+
+    # Test if the Thanos query service can correctly retrieve the metric that was send above.
+    $query->waitForUnit("thanos-query.service");
+    $query->waitForMetric;
+
+    # Test if the Thanos sidecar has correctly uploaded its TSDB to S3, if the
+    # Thanos storage service has correctly downloaded it from S3 and if the Thanos
+    # query service running on $store can correctly retrieve the metric:
+    $store->waitForUnit("thanos-store.service");
+    $store->waitForMetric;
+
+    $store->waitForUnit("thanos-compact.service");
+
+    # Test if the Thanos bucket command is able to retrieve blocks from the S3 bucket
+    # and check if the blocks have the correct labels:
+    $store->succeed(
+      "thanos bucket ls" .
+      " --objstore.config-file=${nodes.store.config.services.thanos.store.objstore.config-file}" .
+      " --output=json | jq .thanos.labels.some_label | grep 'required by thanos'");
   '';
 }

pkgs/applications/altcoins/jormungandr/default.nix

@@ -0,0 +1,38 @@
+{ stdenv
+, fetchgit
+, rustPlatform
+, openssl
+, pkgconfig
+, protobuf
+, rustup
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "jormungandr";
+  version = "0.3.1";
+
+  src = fetchgit {
+    url = "https://github.com/input-output-hk/${pname}";
+    rev = "v${version}";
+    sha256 = "0ys8sw73c7binxnl79dqi7sxva62bgifbhgyzvvjvmjjdxgq4kfp";
+    fetchSubmodules = true;
+  };
+
+  cargoSha256 = "0fphjzz78ym15qbka01idnq6vkyf4asrnhrhvxngwc3bifmnj937";
+
+  nativeBuildInputs = [ pkgconfig protobuf rustup ];
+  buildInputs = [ openssl ];
+
+  PROTOC = "${protobuf}/bin/protoc";
+
+  # Disabling integration tests
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "An aspiring blockchain node";
+    homepage = "https://input-output-hk.github.io/jormungandr/";
+    license = licenses.mit;
+    maintainers = [ maintainers.mmahut ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix

@@ -3,11 +3,11 @@
 
 bitwig-studio1.overrideAttrs (oldAttrs: rec {
   name = "bitwig-studio-${version}";
-  version = "3.0";
+  version = "3.0.1";
 
   src = fetchurl {
     url = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
-    sha256 = "0p7wi1srfzalb0rl94vqppfbnxdfwqzgg5blkdwkf4sx977aihpv";
+    sha256 = "0k25p1j4kgnhm7p90qp1cz79xddgi6nh1nx1y5wz42x8qrpxya0s";
   };
 
   runtimeDependencies = [

pkgs/applications/audio/chuck/clang.patch

@@ -1,58 +0,0 @@
-diff --git a/src/ugen_osc.cpp b/src/ugen_osc.cpp
-index 6b93c6b..dbefe4f 100644
---- a/src/ugen_osc.cpp
-+++ b/src/ugen_osc.cpp
-@@ -1232,7 +1232,7 @@ CK_DLL_CTRL( gen5_coeffs )
-     Chuck_Array8 * in_args = (Chuck_Array8 *)GET_CK_OBJECT(ARGS);
-     
-     // fprintf(stdout, "calling gen10coeffs, %d\n", weights);
--    if(in_args<0) return;
-+    if(in_args!=0) return;
-     size = in_args->size();
-     if(size >= genX_MAX_COEFFS) size = genX_MAX_COEFFS - 1;
-     
-@@ -1287,7 +1287,7 @@ CK_DLL_CTRL( gen7_coeffs )
-     Chuck_Array8 * in_args = (Chuck_Array8 *)GET_CK_OBJECT(ARGS);
-     
-     // fprintf(stdout, "calling gen10coeffs, %d\n", weights);
--    if(in_args<0) return;
-+    if(in_args!=0) return;
-     size = in_args->size();
-     if(size >= genX_MAX_COEFFS) size = genX_MAX_COEFFS - 1;
-     
-@@ -1340,7 +1340,7 @@ CK_DLL_CTRL( gen9_coeffs )
-     Chuck_Array8 * weights = (Chuck_Array8 *)GET_CK_OBJECT(ARGS);
-     
-     // fprintf(stdout, "calling gen10coeffs, %d\n", weights);
--    if(weights<0) return;
-+    if(weights!=0) return;
-     size = weights->size();
-     if(size >= genX_MAX_COEFFS) size = genX_MAX_COEFFS - 1;
-     
-@@ -1390,7 +1390,7 @@ CK_DLL_CTRL( gen10_coeffs )
-     Chuck_Array8 * weights = (Chuck_Array8 *)GET_CK_OBJECT(ARGS);
-     
-     // fprintf(stdout, "calling gen10coeffs, %d\n", weights);
--    if(weights<0) return;
-+    if(weights!=0) return;
-     size = weights->size();
-     if(size >= genX_MAX_COEFFS) size = genX_MAX_COEFFS - 1;
-     
-@@ -1441,7 +1441,7 @@ CK_DLL_CTRL( gen17_coeffs )
-     Chuck_Array8 * weights = (Chuck_Array8 *)GET_CK_OBJECT(ARGS);
-     
-     // fprintf(stdout, "calling gen17coeffs, %d\n", weights);
--    if(weights<0) return;
-+    if(weights!=0) return;
-     size = weights->size();
-     if(size >= genX_MAX_COEFFS) size = genX_MAX_COEFFS - 1;
-     
-@@ -1502,7 +1502,7 @@ CK_DLL_CTRL( curve_coeffs )
-     Chuck_Array8 * weights = (Chuck_Array8 *)GET_CK_OBJECT(ARGS);
-     
-     // fprintf(stdout, "calling gen17coeffs, %d\n", weights);
--    if(weights<0) goto done;
-+    if(weights!=0) goto done;
- 
-     nargs = weights->size();
-     if (nargs < 5 || (nargs % 3) != 2)  {   // check number of args

pkgs/applications/audio/chuck/darwin-limits.patch

@@ -1,5 +1,5 @@
---- a/src/util_string.cpp	2014-10-27 22:52:11.875981552 +0100
-+++ b/src/util_string.cpp	2014-10-27 22:54:18.613001994 +0100
+--- a/src/core/util_string.cpp	2014-10-27 22:52:11.875981552 +0100
++++ b/src/core/util_string.cpp	2014-10-27 22:54:18.613001994 +0100
 @@ -40,6 +40,10 @@
  #include <linux/limits.h>
  #endif // __PLATFORM_LINUX__

pkgs/applications/audio/chuck/default.nix

@@ -3,12 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.5.2";
+  version = "1.4.0.0";
   name = "chuck-${version}";
 
   src = fetchurl {
     url = "http://chuck.cs.princeton.edu/release/files/chuck-${version}.tgz";
-    sha256 = "02z7sglax3j09grj5s1skmw8z6wz7b21hjrm95nrrdpwbxabh079";
+    sha256 = "1b17rsf7bv45gfhyhfmpz9d4rkxn24c0m2hgmpfjz3nlp0rf7bic";
   };
 
   nativeBuildInputs = [ flex bison which ];
@@ -17,16 +17,15 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!stdenv.isDarwin) alsaLib
     ++ lib.optional stdenv.isDarwin [ AppKit Carbon CoreAudio CoreMIDI CoreServices Kernel ];
 
-  patches = [ ./clang.patch ./darwin-limits.patch ];
+  patches = [ ./darwin-limits.patch ];
 
   NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-Wno-missing-sysroot";
   NIX_LDFLAGS = lib.optional stdenv.isDarwin "-framework MultitouchSupport";
 
   postPatch = ''
-    substituteInPlace src/makefile --replace "/usr/bin" "$out/bin"
-    substituteInPlace src/makefile.osx \
+    substituteInPlace src/core/makefile.x/makefile.osx \
       --replace "weak_framework" "framework" \
-      --replace "MACOSX_DEPLOYMENT_TARGET=10.5" "MACOSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET"
+      --replace "MACOSX_DEPLOYMENT_TARGET=10.9" "MACOSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET"
   '';
 
   makeFlags = [ "-C src" "DESTDIR=$(out)/bin" ];
@@ -36,7 +35,7 @@ stdenv.mkDerivation rec {
     description = "Programming language for real-time sound synthesis and music creation";
     homepage = http://chuck.cs.princeton.edu;
     license = licenses.gpl2;
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ ftrvxmtrx ];
   };
 }

pkgs/applications/audio/mopidy/default.nix

@@ -4,13 +4,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "mopidy";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "mopidy";
     repo = "mopidy";
     rev = "v${version}";
-    sha256 = "01vl162c7ssf69b0m65ys9fxnsqnfa1whwbprnc063lkcnrnlkr1";
+    sha256 = "0i9rpnlmgrnkgmr9hyx9sky9gzj2cjhay84a0yaijwcb9nmr8nnc";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];

pkgs/applications/audio/mopidy/iris.nix

@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "Mopidy-Iris";
-  version = "3.38.0";
+  version = "3.39.0";
 
   src = pythonPackages.fetchPypi {
     inherit pname version;
-    sha256 = "0w86g037jdihh6a16x7y82qk8yk30frkj23k9axcj9fjyp30r0x5";
+    sha256 = "1d2g66gvm7yaz4nbxlh23lj2xfkhi3hsg2k646m1za510f8dzlag";
   };
 
   propagatedBuildInputs = [

pkgs/applications/editors/emacs-modes/emacs-libvterm/default.nix

@@ -32,13 +32,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "emacs-libvterm-${version}";
-  version = "unstable-2019-04-28";
+  version = "unstable-2019-07-22";
 
   src = fetchFromGitHub {
     owner = "akermu";
     repo = "emacs-libvterm";
-    rev = "6adcedf3e4aaadeeaff97437044fba17aeb466d4";
-    sha256 = "1j6qr5bmajig3idhwsaa3zm72w13q9zn77z2dlrhhx3p4bbds3f8";
+    rev = "301fe9fdfd5fb2496c8428a11e0812fd8a4c0820";
+    sha256 = "0i1hn5gcxayqcbjrnpgczvbicq2vsyn59646ary3crs0mz9wlbpr";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/graphics/avocode/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "avocode-${version}";
-  version = "3.8.1";
+  version = "3.9.0";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "1akrrnv0ajzvbhflbpmh4ckcqfqrgdjqfp6d4jqvspqi56zmsr83";
+    sha256 = "0fk62farnsxz59q82kxagibxmn9p9ckp6ix0wqg297gvasgad31q";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; [

pkgs/applications/graphics/openscad/default.nix

@@ -1,10 +1,33 @@
-{ stdenv, fetchFromGitHub, qt5, libsForQt5
-, bison, flex, eigen, boost, libGLU_combined, glew, opencsg, cgal
-, mpfr, gmp, glib, pkgconfig, harfbuzz, gettext, freetype, fontconfig
-, double-conversion, lib3mf, libzip
+{ stdenv
+, fetchFromGitHub
+, qtbase
+, qtmultimedia
+, qscintilla
+, bison
+, flex
+, eigen
+, boost
+, libGLU_combined
+, glew
+, opencsg
+, cgal
+, mpfr
+, gmp
+, glib
+, pkgconfig
+, harfbuzz
+, gettext
+, freetype
+, fontconfig
+, double-conversion
+, lib3mf
+, libzip
+, mkDerivation
+, qtmacextras
+, qmake
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "openscad";
   version = "2019.05";
 
@@ -15,14 +38,14 @@ stdenv.mkDerivation rec {
     sha256 = "1qz384jqgk75zxk7sqd22ma9pyd94kh4h6a207ldx7p9rny6vc5l";
   };
 
-  nativeBuildInputs = [ bison flex pkgconfig gettext qt5.qmake ];
+  nativeBuildInputs = [ bison flex pkgconfig gettext qmake ];
 
   buildInputs = [
     eigen boost glew opencsg cgal mpfr gmp glib
     harfbuzz lib3mf libzip double-conversion freetype fontconfig
+    qtbase qtmultimedia qscintilla
   ] ++ stdenv.lib.optional stdenv.isLinux libGLU_combined
-    ++ (with qt5; [qtbase qtmultimedia] ++ stdenv.lib.optional stdenv.isDarwin qtmacextras)
-    ++ (with libsForQt5; [qscintilla])
+    ++ stdenv.lib.optional stdenv.isDarwin qtmacextras
   ;
 
   qmakeFlags = [ "VERSION=${version}" ];

pkgs/applications/misc/calibre/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, poppler_utils, pkgconfig, libpng
 , imagemagick, libjpeg, fontconfig, podofo, qtbase, qmake, icu, sqlite
 , makeWrapper, unrarSupport ? false, chmlib, python2Packages, libusb1, libmtp
-, xdg_utils, makeDesktopItem, wrapGAppsHook, removeReferencesTo
+, xdg_utils, makeDesktopItem, wrapGAppsHook, removeReferencesTo, qt5
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ makeWrapper pkgconfig qmake removeReferencesTo ];
+  nativeBuildInputs = [ makeWrapper pkgconfig qmake removeReferencesTo qt5.wrapQtAppsHook ];
 
   buildInputs = [
     poppler_utils libpng imagemagick libjpeg
@@ -48,6 +48,11 @@ stdenv.mkDerivation rec {
     odfpy
   ]);
 
+  qtWrapperArgs = [
+    "--prefix PYTHONPATH: $PYTHONPATH"
+    "--prefix PATH: ${poppler_utils.out}/bin}"
+  ];
+
   installPhase = ''
     runHook preInstall
 
@@ -70,9 +75,8 @@ stdenv.mkDerivation rec {
     sed -i "s/env python[0-9.]*/python/" $PYFILES
     sed -i "2i import sys; sys.argv[0] = 'calibre'" $out/bin/calibre
 
-    for a in $out/bin/*; do
-      wrapProgram $a --prefix PYTHONPATH : $PYTHONPATH \
-                     --prefix PATH : ${poppler_utils.out}/bin
+    for program in $out/bin/*; do
+      wrapQtApp $program
     done
 
     # Replace @out@ by the output path.
@@ -95,6 +99,10 @@ stdenv.mkDerivation rec {
     remove-references-to -t ${podofo.dev} $out/lib/calibre/calibre/plugins/podofo.so
   '';
 
+  postFixup = ''
+
+  '';
+
   disallowedReferences = [ podofo.dev ];
 
   calibreDesktopItem = makeDesktopItem {

pkgs/applications/misc/gpx-viewer/default.nix

@@ -15,10 +15,10 @@ stdenv.mkDerivation rec {
   };
   patchFlags = [ "-p0" ];
 
+  configureFlags = [ "--disable-database-updates" ];
+
   nativeBuildInputs = [
     intltool pkgconfig
-    shared-mime-info # For update-mime-database
-    desktop-file-utils # For update-desktop-database
     wrapGAppsHook # Fix error: GLib-GIO-ERROR **: No GSettings schemas are installed on the system
   ];
   buildInputs = [ gdl libchamplain gnome3.adwaita-icon-theme libxml2 ];

pkgs/applications/misc/gpxsee/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, qmake, qttools, makeWrapper }:
+{ mkDerivation, lib, fetchFromGitHub, qmake, qttools }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "gpxsee";
-  version = "7.9";
+  version = "7.11";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "029l5dhc9nnxiw7p0s4gyfkcqw709z7lz96aq8krs75mfk4fv07k";
+    sha256 = "1b4ky7m990h3rmam9lb1w6vns1mxd8ri6is3a8qgdl8kd6xcl5d7";
   };
 
-  nativeBuildInputs = [ qmake makeWrapper ];
+  nativeBuildInputs = [ qmake ];
   buildInputs = [ qttools ];
 
   preConfigure = ''
@@ -20,12 +20,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    wrapProgram $out/bin/gpxsee \
-      --prefix XDG_DATA_DIRS ":" $out/share
-  '';
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.gpxsee.org/;
     description = "GPS log file viewer and analyzer";
     longDescription = ''

pkgs/applications/misc/kitty/default.nix

@@ -9,6 +9,7 @@
   IOKit,
   Kernel,
   OpenGL,
+  libcanberra,
   libicns,
   libpng,
   librsvg,
@@ -20,18 +21,19 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.14.2";
+  version = "0.14.3";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "v${version}";
-    sha256 = "15iv3k7iryf10n8n67d37x24pzcarq97a3dr42lbld00k1lx19az";
+    sha256 = "0wi6b6b1nyp16rcpcghk6by62wy6qsamv1xdymyn0zbqgd8h9n6b";
   };
 
   buildInputs = [
-    ncurses harfbuzz
+    harfbuzz
+    ncurses
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
     Cocoa
     CoreGraphics
@@ -43,7 +45,7 @@ buildPythonApplication rec {
     python3
     zlib
   ] ++ stdenv.lib.optionals stdenv.isLinux [
-    fontconfig glfw libunistring libX11
+    fontconfig glfw libunistring libcanberra libX11
     libXrandr libXinerama libXcursor libxkbcommon libXi libXext
     wayland-protocols wayland dbus
   ];

pkgs/applications/misc/kitty/png2icns.patch

@@ -1,19 +1,21 @@
---- a/setup.py
-+++ b/setup.py
-@@ -744,9 +744,15 @@ Categories=System;TerminalEmulator;
-         if not os.path.exists(logo_dir):
-             raise SystemExit('The kitty logo has not been generated, you need to run logo/make.py')
-         subprocess.check_call([
--            'iconutil', '-c', 'icns', logo_dir, '-o',
-+            'png2icns',
-             os.path.join('Resources', os.path.basename(logo_dir).partition('.')[0] + '.icns')
--        ])
-+        ] + [os.path.join(logo_dir, logo) for logo in (
-+            'icon_128x128.png',
-+            'icon_16x16.png',
-+            'icon_256x256.png',
-+            'icon_32x32.png',
-+            'icon_512x512.png',
-+        )])
-     # }}}
- # }}}
+diff -aru a/setup.py b/setup.py
+--- a/setup.py	2019-07-29 11:09:32.000000000 -0400
++++ b/setup.py	2019-07-29 11:11:37.000000000 -0400
+@@ -784,9 +784,15 @@
+ def create_macos_app_icon(where='Resources'):
+     logo_dir = os.path.abspath(os.path.join('logo', appname + '.iconset'))
+     subprocess.check_call([
+-        'iconutil', '-c', 'icns', logo_dir, '-o',
++        'png2icns',
+         os.path.join(where, os.path.basename(logo_dir).partition('.')[0] + '.icns')
+-    ])
++    ] + [os.path.join(logo_dir, logo) for logo in [
++        'icon_128x128.png',
++        'icon_16x16.png',
++        'icon_256x256.png',
++        'icon_32x32.png',
++        'icon_512x512.png',
++    ]])
+ 
+ 
+ def create_minimal_macos_bundle(args, where):

pkgs/applications/misc/mako/default.nix

@@ -1,33 +1,22 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkgconfig, scdoc
 , systemd, pango, cairo, gdk-pixbuf
-, wayland, wayland-protocols
-, fetchpatch }:
+, wayland, wayland-protocols }:
 
 stdenv.mkDerivation rec {
   pname = "mako";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = pname;
     rev = "v${version}";
-    sha256 = "17azdc37xsbmx13fkfp23vg9lznrv9fh6nhagn64wdq3nhsxm3b6";
+    sha256 = "11ymiq6cr2ma0iva1mqybn3j6k73bsc6lv6pcbdq7hkhd4f9b7j9";
   };
 
-  # to be removed with next release
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/emersion/mako/commit/ca8e763f06756136c534b1bbd2e5b536be6b1995.patch";
-      sha256 = "09mi7nn2vwc69igxxc6y2m36n3snhsz0ady99yabhrzl17k4ryds";
-    })
-  ];
-
   nativeBuildInputs = [ meson ninja pkgconfig scdoc wayland-protocols ];
   buildInputs = [ systemd pango cairo gdk-pixbuf wayland ];
 
-  mesonFlags = [
-    "-Dicons=enabled" "-Dman-pages=enabled" "-Dzsh-completions=true"
-  ];
+  mesonFlags = [ "-Dzsh-completions=true" ];
 
   meta = with stdenv.lib; {
     description = "A lightweight Wayland notification daemon";

pkgs/applications/misc/polybar/default.nix

@@ -26,17 +26,18 @@ assert i3GapsSupport -> ! i3Support     && jsoncpp != null && i3-gaps != null;
 
 stdenv.mkDerivation rec {
     pname = "polybar";
-    version = "3.3.1";
+    version = "3.4.0";
 
     src = fetchFromGitHub {
       owner = "jaagr";
       repo = pname;
       rev = version;
-      sha256 = "0qwi6q3qkrz2ip1jd4pxlnsrs2a9ywxyf8rgvbzyilr334rsiywh";
+      sha256 = "1g3zj0788cdlm8inpl19279bw8zjcy7dzj7q4f1l2d8c8g1jhv0m";
       fetchSubmodules = true;
     };
 
     meta = with stdenv.lib; {
+      homepage = "https://polybar.github.io/";
       description = "A fast and easy-to-use tool for creating status bars";
       longDescription = ''
         Polybar aims to help users build beautiful and highly customizable
@@ -68,8 +69,8 @@ stdenv.mkDerivation rec {
     ];
 
     postConfigure = ''
-      substituteInPlace ../include/settings.hpp --replace \
-        "${stdenv.cc}" "${stdenv.cc.name}"
+      substituteInPlace generated-sources/settings.hpp \
+        --replace "${stdenv.cc}" "${stdenv.cc.name}"
     '';
 
     postInstall = if (i3Support || i3GapsSupport) then ''

pkgs/applications/misc/translate-shell/default.nix

@@ -1,15 +1,14 @@
 { stdenv, fetchFromGitHub, makeWrapper, curl, fribidi, rlwrap, gawk, groff, ncurses }:
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
   pname = "translate-shell";
-  version = "0.9.6.10";
+  version = "0.9.6.11";
 
   src = fetchFromGitHub {
     owner = "soimort";
     repo = "translate-shell";
     rev = "v${version}";
-    sha256 = "1dmh3flldfhnqfay3a6c5hanqcjwrmbly1bq8mlk022qfi1fv33y";
+    sha256 = "137fz3ahzf65hfqcs4k7hhrmfjlhlw7wr3gfsvk88bnyqkyw44sm";
   };
 
   buildInputs = [ makeWrapper ];

pkgs/applications/networking/cluster/nomad/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "nomad-${version}";
-  version = "0.9.3";
+  version = "0.9.4";
   rev = "v${version}";
 
   goPackagePath = "github.com/hashicorp/nomad";
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "hashicorp";
     repo = "nomad";
     inherit rev;
-    sha256 = "0hn9rr5v2y2pw0pmn27gz8dx5n964dsaf48sh0jhwc95b5q1rjwr";
+    sha256 = "1jgvnmmrz7ffpm6aamdrvklj94n7b43swk9cycqhlfbnzijianpn";
   };
 
   # We disable Nvidia GPU scheduling on Linux, as it doesn't work there:

pkgs/applications/networking/ids/suricata/default.nix

@@ -0,0 +1,125 @@
+{ stdenv
+, lib
+, fetchurl
+, pkgconfig
+, makeWrapper
+, file
+, geoip
+, hyperscan
+, jansson
+, libcap_ng
+, libevent
+, libnet
+, libnetfilter_log
+, libnetfilter_queue
+, libnfnetlink
+, libpcap
+, libyaml
+, luajit
+, nspr
+, nss
+, pcre
+, python
+, zlib
+, redisSupport ? true, redis, hiredis
+, rustSupport ? true, rustc, cargo
+}: let
+  libmagic = file;
+  hyperscanSupport = stdenv.system == "x86_64-linux" || stdenv.system == "i686-linux";
+in
+stdenv.mkDerivation rec {
+  pname = "suricata";
+  version = "4.1.4";
+
+  src = fetchurl {
+    url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
+    sha256 = "02901wjf90171rhkymcgp0h48hkn3wv8iwrhz4d8ppraz68hv99d";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkgconfig
+  ];
+
+  buildInputs = [
+    geoip
+    jansson
+    libcap_ng
+    libevent
+    libmagic
+    libnet
+    libnetfilter_log
+    libnetfilter_queue
+    libnfnetlink
+    libpcap
+    libyaml
+    luajit
+    nspr
+    nss
+    pcre
+    python
+    zlib
+  ]
+  ++ lib.optional hyperscanSupport [ hyperscan ]
+  ++ lib.optional redisSupport [ redis hiredis ]
+  ++ lib.optional rustSupport [ rustc cargo ]
+  ;
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    "--disable-gccmarch-native"
+    "--enable-afl"
+    "--enable-af-packet"
+    "--enable-gccprotect"
+    "--enable-geoip"
+    "--enable-luajit"
+    "--enable-nflog"
+    "--enable-nfqueue"
+    "--enable-pie"
+    "--disable-prelude"
+    "--enable-python"
+    "--enable-unix-socket"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+    "--with-libnet-includes=${libnet}/include"
+    "--with-libnet-libraries=${libnet}/lib"
+  ]
+  ++ lib.optional hyperscanSupport [
+    "--with-libhs-includes=${hyperscan}/include"
+    "--with-libhs-libraries=${hyperscan}/lib"
+  ]
+  ++ lib.optional redisSupport [ "--enable-hiredis" ]
+  ++ lib.optional rustSupport [
+    "--enable-rust"
+    "--enable-rust-experimental"
+  ];
+
+  installFlags = [
+    "e_localstatedir=\${TMPDIR}"
+    "e_logdir=\${TMPDIR}"
+    "e_logcertsdir=\${TMPDIR}"
+    "e_logfilesdir=\${TMPDIR}"
+    "e_rundir=\${TMPDIR}"
+    "e_sysconfdir=\${out}/etc/suricata"
+    "e_sysconfrulesdir=\${out}/etc/suricata/rules"
+    "localstatedir=\${TMPDIR}"
+    "runstatedir=\${TMPDIR}"
+    "sysconfdir=\${out}/etc"
+  ];
+
+  installTargets = "install install-conf";
+
+  postInstall = ''
+    wrapProgram "$out/bin/suricatasc" \
+      --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath "$out")
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A free and open source, mature, fast and robust network threat detection engine";
+    homepage = "https://suricata-ids.org";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ magenbluten ];
+  };
+}

pkgs/applications/networking/instant-messengers/poezio/default.nix

@@ -1,22 +1,24 @@
-{ lib, buildPythonApplication, fetchurl, pythonOlder
+{ lib, buildPythonApplication, fetchFromGitHub, pythonOlder
 , pytest, aiodns, slixmpp, pyinotify, potr, mpd2, cffi, pkgconfig }:
 buildPythonApplication rec {
-    name = "poezio-${version}";
-    version = "0.12";
+    pname = "poezio";
+    version = "0.12.1";
 
     disabled = pythonOlder "3.4";
 
-    buildInputs = [ pytest ];
+    checkInputs = [ pytest ];
     propagatedBuildInputs = [ aiodns slixmpp pyinotify potr mpd2 cffi ];
     nativeBuildInputs = [ pkgconfig ];
 
-    src = fetchurl {
-      url = "http://dev.louiz.org/attachments/download/129/${name}.tar.gz";
-      sha256 = "11n9x82xyjwbqk28lsfnvqwn8qc9flv6w2c64camh6j3148ykpvz";
+    src = fetchFromGitHub {
+      owner = pname;
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "04qnsr0l12i55k6xl4q4akx317gai9wv5f1wpkfkq01wp181i5ll";
     };
 
     checkPhase = ''
-      py.test
+      pytest
     '';
 
     meta = with lib; {

pkgs/applications/networking/instant-messengers/teamspeak/client.nix

@@ -31,16 +31,13 @@ in
 stdenv.mkDerivation rec {
   name = "teamspeak-client-${version}";
 
-  version = "3.1.10";
+  version = "3.3.0";
 
   src = fetchurl {
-    urls = [
-      "http://dl.4players.de/ts/releases/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run"
-      "http://teamspeak.gameserver.gamed.de/ts3/releases/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run"
-    ];
+    url = "https://files.teamspeak-services.com/releases/client/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run";
     sha256 = if stdenv.is64bit
-                then "17gylj5pxba14c1c98b5rdyyb87c58z8l8yrd1iw5k293wf7iwv3"
-                else "1bkn3ykrc73wr02qaqwpr4garlqm3424y3dm2fjx6lqcfzm3ms2k";
+                then "13286dbjp4qiyfv8my1hfpwzns4szdsnqa11j8ygsh5ikgjk338a"
+                else "04lwclq7nvw73v5fmn9795j5wi54syglc77ldl41caiqqhdqf1i5";
   };
 
   # grab the plugin sdk for the desktop icon
@@ -61,6 +58,7 @@ stdenv.mkDerivation rec {
     ''
       mv ts3client_linux_${arch} ts3client
       echo "patching ts3client..."
+      patchelf --replace-needed libquazip.so ${quazip}/lib/libquazip5.so ts3client
       patchelf \
         --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         --set-rpath ${stdenv.lib.makeLibraryPath deps}:$(cat $NIX_CC/nix-support/orig-cc)/${libDir} \

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -1,18 +1,159 @@
-{ qt5 }:
+{ mkDerivation, lib, fetchFromGitHub, fetchsvn
+, pkgconfig, pythonPackages, cmake, wrapGAppsHook, wrapQtAppsHook, gcc8
+, qtbase, qtimageformats, gtk3, libappindicator-gtk3, libnotify, xdg_utils
+, dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
+}:
 
-let
-  mkTelegram = args: qt5.callPackage (import ./generic.nix args) { };
-  stableVersion = {
-    stable = true;
-    version = "1.7.14";
-    sha256Hash = "1bw804a9kffmn23wv0570wihbvfm7jy9cqmxlv196f4j7bw7zkv3";
-    # svn log svn://svn.archlinux.org/community/telegram-desktop/trunk
-    archPatchesRevision = "487779";
-    archPatchesHash = "0f09hvimb66xqksb2v0zc4ryshx7y7z0rafzjd99x37rpib9f3kq";
+with lib;
+
+mkDerivation rec {
+  name = "telegram-desktop-${version}";
+  version = "1.7.14";
+
+  # Telegram-Desktop with submodules
+  src = fetchFromGitHub {
+    owner = "telegramdesktop";
+    repo = "tdesktop";
+    rev = "v${version}";
+    sha256 = "1bw804a9kffmn23wv0570wihbvfm7jy9cqmxlv196f4j7bw7zkv3";
+    fetchSubmodules = true;
+  };
+
+  # Arch patches (svn export telegram-desktop/trunk)
+  archPatches = fetchsvn {
+    url = "svn://svn.archlinux.org/community/telegram-desktop/trunk";
+    # svn log svn://svn.archlinux.org/community/telegram-desktop/trunk
+    rev = "487779";
+    sha256 = "0f09hvimb66xqksb2v0zc4ryshx7y7z0rafzjd99x37rpib9f3kq";
+  };
+
+  patches = [
+    "${archPatches}/tdesktop.patch"
+    "${archPatches}/no-gtk2.patch"
+    # "${archPatches}/Use-system-wide-font.patch"
+    "${archPatches}/tdesktop_lottie_animation_qtdebug.patch"
+    "${archPatches}/issue6219.patch"
+  ];
+
+  postPatch = ''
+    substituteInPlace Telegram/SourceFiles/platform/linux/linux_libs.cpp \
+      --replace '"appindicator3"' '"${libappindicator-gtk3}/lib/libappindicator3.so"'
+    substituteInPlace Telegram/SourceFiles/platform/linux/linux_libnotify.cpp \
+      --replace '"notify"' '"${libnotify}/lib/libnotify.so"'
+  '';
+
+  nativeBuildInputs = [ pkgconfig pythonPackages.gyp cmake wrapGAppsHook wrapQtAppsHook gcc8 ];
+
+  # We want to run wrapProgram manually (with additional parameters)
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
+  buildInputs = [
+    qtbase qtimageformats gtk3 libappindicator-gtk3
+    dee ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3
+  ];
+
+  enableParallelBuilding = true;
+
+  GYP_DEFINES = concatStringsSep "," [
+    "TDESKTOP_DISABLE_CRASH_REPORTS"
+    "TDESKTOP_DISABLE_AUTOUPDATE"
+    "TDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
+  ];
+
+  NIX_CFLAGS_COMPILE = [
+    "-DTDESKTOP_DISABLE_CRASH_REPORTS"
+    "-DTDESKTOP_DISABLE_AUTOUPDATE"
+    "-DTDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
+    "-I${minizip}/include/minizip"
+    # See Telegram/gyp/qt.gypi
+    "-I${getDev qtbase}/mkspecs/linux-g++"
+  ] ++ concatMap (x: [
+    "-I${getDev qtbase}/include/${x}"
+    "-I${getDev qtbase}/include/${x}/${qtbase.version}"
+    "-I${getDev qtbase}/include/${x}/${qtbase.version}/${x}"
+    "-I${getDev libopus}/include/opus"
+    "-I${getDev alsaLib}/include/alsa"
+    "-I${getDev libpulseaudio}/include/pulse"
+    ]) [ "QtCore" "QtGui" "QtDBus" ];
+  CPPFLAGS = NIX_CFLAGS_COMPILE;
+
+  preConfigure = ''
+    patch -R -Np1 -i "${archPatches}/demibold.patch"
+
+    pushd "Telegram/ThirdParty/libtgvoip"
+    patch -Np1 -i "${archPatches}/libtgvoip.patch"
+    popd
+
+    # disable static-qt for rlottie
+    sed "/RLOTTIE_WITH_STATIC_QT/d" -i "Telegram/gyp/lib_rlottie.gyp"
+
+    sed -i Telegram/gyp/telegram_linux.gypi \
+      -e 's,/usr,/does-not-exist,g' \
+      -e 's,appindicator-0.1,appindicator3-0.1,g' \
+      -e 's,-flto,,g'
+
+    sed -i Telegram/gyp/qt.gypi \
+      -e "s,/usr/include/qt/QtCore/,${qtbase.dev}/include/QtCore/,g" \
+      -e 's,\d+",\d+" | head -n1,g'
+    sed -i Telegram/gyp/qt_moc.gypi \
+      -e "s,/usr/bin/moc,moc,g"
+    sed -i Telegram/gyp/qt_rcc.gypi \
+      -e "s,/usr/bin/rcc,rcc,g"
+
+    # Build system assumes x86, but it works fine on non-x86 if we patch this one flag out
+    sed -i Telegram/ThirdParty/libtgvoip/libtgvoip.gyp \
+      -e "/-msse2/d"
+
+    gyp \
+      -Dapi_id=17349 \
+      -Dapi_hash=344583e45741c457fe1862106095a5eb \
+      -Dbuild_defines=${GYP_DEFINES} \
+      -Gconfig=Release \
+      --depth=Telegram/gyp \
+      --generator-output=../.. \
+      -Goutput_dir=out \
+      --format=cmake \
+      Telegram/gyp/Telegram.gyp
+
+    cd out/Release
+
+    NUM=$((`wc -l < CMakeLists.txt` - 2))
+    sed -i "$NUM r $archPatches/CMakeLists.inj" CMakeLists.txt
+
+    export ASM=$(type -p gcc)
+  '';
+
+  cmakeFlags = [ "-UTDESKTOP_OFFICIAL_TARGET" ];
+
+  installPhase = ''
+    install -Dm755 Telegram $out/bin/telegram-desktop
+
+    mkdir -p $out/share/applications $out/share/kde4/services
+    install -m444 "$src/lib/xdg/telegramdesktop.desktop" "$out/share/applications/telegram-desktop.desktop"
+    sed "s,/usr/bin,$out/bin,g" $archPatches/tg.protocol > $out/share/kde4/services/tg.protocol
+    for icon_size in 16 32 48 64 128 256 512; do
+      install -Dm644 "../../../Telegram/Resources/art/icon''${icon_size}.png" "$out/share/icons/hicolor/''${icon_size}x''${icon_size}/apps/telegram.png"
+    done
+  '';
+
+  postFixup = ''
+    # This is necessary to run Telegram in a pure environment.
+    # We also use gappsWrapperArgs from wrapGAppsHook.
+    wrapProgram $out/bin/telegram-desktop \
+      "''${gappsWrapperArgs[@]}" \
+      "''${qtWrapperArgs[@]}" \
+      --prefix PATH : ${xdg_utils}/bin \
+      --set XDG_RUNTIME_DIR "XDG-RUNTIME-DIR"
+    sed -i $out/bin/telegram-desktop \
+      -e "s,'XDG-RUNTIME-DIR',\"\''${XDG_RUNTIME_DIR:-/run/user/\$(id --user)}\","
+  '';
+
+  meta = {
+    description = "Telegram Desktop messaging app";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    homepage = https://desktop.telegram.org/;
+    maintainers = with maintainers; [ primeos abbradar ];
   };
-in {
-  stable = mkTelegram stableVersion;
-  preview = mkTelegram (stableVersion // {
-    stable = false;
-  });
 }

pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix

@@ -1,161 +0,0 @@
-{ stable, version, sha256Hash, archPatchesRevision, archPatchesHash }:
-
-{ mkDerivation, lib, fetchFromGitHub, fetchsvn
-, pkgconfig, pythonPackages, cmake, wrapGAppsHook, wrapQtAppsHook, gcc8
-, qtbase, qtimageformats, gtk3, libappindicator-gtk3, libnotify, xdg_utils
-, dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
-}:
-
-with lib;
-
-mkDerivation rec {
-  name = "telegram-desktop-${version}";
-  inherit version;
-
-  # Telegram-Desktop with submodules
-  src = fetchFromGitHub {
-    owner = "telegramdesktop";
-    repo = "tdesktop";
-    rev = "v${version}";
-    sha256 = sha256Hash;
-    fetchSubmodules = true;
-  };
-
-  # Arch patches (svn export telegram-desktop/trunk)
-  archPatches = fetchsvn {
-    url = "svn://svn.archlinux.org/community/telegram-desktop/trunk";
-    rev = archPatchesRevision;
-    sha256 = archPatchesHash;
-  };
-
-  patches = [
-    "${archPatches}/tdesktop.patch"
-    "${archPatches}/no-gtk2.patch"
-    # "${archPatches}/Use-system-wide-font.patch"
-    "${archPatches}/tdesktop_lottie_animation_qtdebug.patch"
-    "${archPatches}/issue6219.patch"
-  ];
-
-  postPatch = ''
-    substituteInPlace Telegram/SourceFiles/platform/linux/linux_libs.cpp \
-      --replace '"appindicator3"' '"${libappindicator-gtk3}/lib/libappindicator3.so"'
-    substituteInPlace Telegram/SourceFiles/platform/linux/linux_libnotify.cpp \
-      --replace '"notify"' '"${libnotify}/lib/libnotify.so"'
-  '';
-
-  nativeBuildInputs = [ pkgconfig pythonPackages.gyp cmake wrapGAppsHook wrapQtAppsHook gcc8 ];
-
-  # We want to run wrapProgram manually (with additional parameters)
-  dontWrapGApps = true;
-
-  buildInputs = [
-    qtbase qtimageformats gtk3 libappindicator-gtk3
-    dee ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3
-  ];
-
-  enableParallelBuilding = true;
-
-  GYP_DEFINES = concatStringsSep "," [
-    "TDESKTOP_DISABLE_CRASH_REPORTS"
-    "TDESKTOP_DISABLE_AUTOUPDATE"
-    "TDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
-  ];
-
-  NIX_CFLAGS_COMPILE = [
-    "-DTDESKTOP_DISABLE_CRASH_REPORTS"
-    "-DTDESKTOP_DISABLE_AUTOUPDATE"
-    "-DTDESKTOP_DISABLE_REGISTER_CUSTOM_SCHEME"
-    "-I${minizip}/include/minizip"
-    # See Telegram/gyp/qt.gypi
-    "-I${getDev qtbase}/mkspecs/linux-g++"
-  ] ++ concatMap (x: [
-    "-I${getDev qtbase}/include/${x}"
-    "-I${getDev qtbase}/include/${x}/${qtbase.version}"
-    "-I${getDev qtbase}/include/${x}/${qtbase.version}/${x}"
-    "-I${getDev libopus}/include/opus"
-    "-I${getDev alsaLib}/include/alsa"
-    "-I${getDev libpulseaudio}/include/pulse"
-    ]) [ "QtCore" "QtGui" "QtDBus" ];
-  CPPFLAGS = NIX_CFLAGS_COMPILE;
-
-  preConfigure = ''
-    patch -R -Np1 -i "${archPatches}/demibold.patch"
-
-    pushd "Telegram/ThirdParty/libtgvoip"
-    patch -Np1 -i "${archPatches}/libtgvoip.patch"
-    popd
-
-    # disable static-qt for rlottie
-    sed "/RLOTTIE_WITH_STATIC_QT/d" -i "Telegram/gyp/lib_rlottie.gyp"
-
-    sed -i Telegram/gyp/telegram_linux.gypi \
-      -e 's,/usr,/does-not-exist,g' \
-      -e 's,appindicator-0.1,appindicator3-0.1,g' \
-      -e 's,-flto,,g'
-
-    sed -i Telegram/gyp/qt.gypi \
-      -e "s,/usr/include/qt/QtCore/,${qtbase.dev}/include/QtCore/,g" \
-      -e 's,\d+",\d+" | head -n1,g'
-    sed -i Telegram/gyp/qt_moc.gypi \
-      -e "s,/usr/bin/moc,moc,g"
-    sed -i Telegram/gyp/qt_rcc.gypi \
-      -e "s,/usr/bin/rcc,rcc,g"
-
-    # Build system assumes x86, but it works fine on non-x86 if we patch this one flag out
-    sed -i Telegram/ThirdParty/libtgvoip/libtgvoip.gyp \
-      -e "/-msse2/d"
-
-    gyp \
-      -Dapi_id=17349 \
-      -Dapi_hash=344583e45741c457fe1862106095a5eb \
-      -Dbuild_defines=${GYP_DEFINES} \
-      -Gconfig=Release \
-      --depth=Telegram/gyp \
-      --generator-output=../.. \
-      -Goutput_dir=out \
-      --format=cmake \
-      Telegram/gyp/Telegram.gyp
-
-    cd out/Release
-
-    NUM=$((`wc -l < CMakeLists.txt` - 2))
-    sed -i "$NUM r $archPatches/CMakeLists.inj" CMakeLists.txt
-
-    export ASM=$(type -p gcc)
-  '';
-
-  cmakeFlags = [ "-UTDESKTOP_OFFICIAL_TARGET" ];
-
-  installPhase = ''
-    install -Dm755 Telegram $out/bin/telegram-desktop
-
-    mkdir -p $out/share/applications $out/share/kde4/services
-    install -m444 "$src/lib/xdg/telegramdesktop.desktop" "$out/share/applications/telegram-desktop.desktop"
-    sed "s,/usr/bin,$out/bin,g" $archPatches/tg.protocol > $out/share/kde4/services/tg.protocol
-    for icon_size in 16 32 48 64 128 256 512; do
-      install -Dm644 "../../../Telegram/Resources/art/icon''${icon_size}.png" "$out/share/icons/hicolor/''${icon_size}x''${icon_size}/apps/telegram.png"
-    done
-  '';
-
-  dontWrapQtApps = true;
-  postFixup = ''
-    # This is necessary to run Telegram in a pure environment.
-    # We also use gappsWrapperArgs from wrapGAppsHook.
-    wrapProgram $out/bin/telegram-desktop \
-      "''${gappsWrapperArgs[@]}" \
-      "''${qtWrapperArgs[@]}" \
-      --prefix PATH : ${xdg_utils}/bin \
-      --set XDG_RUNTIME_DIR "XDG-RUNTIME-DIR"
-    sed -i $out/bin/telegram-desktop \
-      -e "s,'XDG-RUNTIME-DIR',\"\''${XDG_RUNTIME_DIR:-/run/user/\$(id --user)}\","
-  '';
-
-  meta = {
-    description = "Telegram Desktop messaging app "
-      + (if stable then "(stable version)" else "(pre-release)");
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    homepage = https://desktop.telegram.org/;
-    maintainers = with maintainers; [ primeos abbradar ];
-  };
-}

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, makeWrapper, makeDesktopItem, autoPatchelfHook, env
+{ stdenv, fetchurl, mkDerivation, makeWrapper, makeDesktopItem, autoPatchelfHook
+, wrapQtAppsHook
 # Dynamic libraries
 , dbus, glib, libGL, libX11, libXfixes, libuuid, libxcb, qtbase, qtdeclarative
 , qtimageformats, qtlocation, qtquickcontrols, qtquickcontrols2, qtscript, qtsvg
@@ -21,23 +22,18 @@ let
     };
   };
 
-  qtDeps = [
-    qtbase qtdeclarative qtlocation qtquickcontrols qtquickcontrols2 qtscript
-    qtwebchannel qtwebengine qtimageformats qtsvg qttools qtwayland
-  ];
-
-  qtEnv = env "zoom-us-qt-${qtbase.version}" qtDeps;
-
-in stdenv.mkDerivation {
+in mkDerivation {
   name = "zoom-us-${version}";
 
   src = srcs.${stdenv.hostPlatform.system};
 
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper wrapQtAppsHook ];
 
   buildInputs = [
-    dbus glib libGL libX11 libXfixes libuuid libxcb qtEnv libjpeg_turbo
-  ] ++ qtDeps;
+    dbus glib libGL libX11 libXfixes libuuid libxcb libjpeg_turbo
+    qtbase qtdeclarative qtlocation qtquickcontrols qtquickcontrols2 qtscript
+    qtwebchannel qtwebengine qtimageformats qtsvg qttools qtwayland
+  ];
 
   runtimeDependencies = optional pulseaudioSupport libpulseaudio;
 
@@ -60,20 +56,12 @@ in stdenv.mkDerivation {
     in ''
       runHook preInstall
 
-      packagePath=$out/share/zoom-us
-      mkdir -p $packagePath $out/bin
+      mkdir -p $out/{bin,share/zoom-us}
 
-      cp -ar ${files} $packagePath
+      cp -ar ${files} $out/share/zoom-us
 
       # TODO Patch this somehow; tries to dlopen './libturbojpeg.so' from cwd
-      ln -s $(readlink -e "${libjpeg_turbo.out}/lib/libturbojpeg.so") $packagePath/libturbojpeg.so
-
-      ln -s ${qtEnv}/bin/qt.conf $packagePath
-
-      makeWrapper $packagePath/zoom $out/bin/zoom-us \
-        --prefix PATH : "${makeBinPath [ coreutils glib.dev pciutils procps qttools.dev utillinux ]}" \
-        --prefix LD_PRELOAD : "${libv4l}/lib/libv4l/v4l2convert.so" \
-        --run "cd $packagePath"
+      ln -s $(readlink -e "${libjpeg_turbo.out}/lib/libturbojpeg.so") $out/share/zoom-us/libturbojpeg.so
 
       runHook postInstall
     '';
@@ -86,7 +74,14 @@ in stdenv.mkDerivation {
     genericName = "Video Conference";
     categories = "Network;Application;";
     mimeType = "x-scheme-handler/zoommtg;";
-  }).buildCommand;
+  }).buildCommand + ''
+    ln -s $out/share/zoom-us/zoom $out/bin/zoom-us
+  '';
+
+  qtWrapperArgs = [
+    ''--prefix PATH : ${makeBinPath [ coreutils glib.dev pciutils procps qttools.dev utillinux ]}''
+    ''--prefix LD_PRELOAD : ${libv4l}/lib/libv4l/v4l2convert.so''
+  ];
 
   passthru.updateScript = ./update.sh;
 

pkgs/applications/networking/mailreaders/aerc/default.nix

@@ -1,15 +1,15 @@
 { stdenv, buildGoModule, fetchurl
-, go, scdoc
+, go, ncurses, scdoc
 , python3, perl, w3m, dante
 }:
 
 buildGoModule rec {
   pname = "aerc";
-  version = "0.1.4";
+  version = "0.2.1";
 
   src = fetchurl {
     url = "https://git.sr.ht/~sircmpwn/aerc/archive/${version}.tar.gz";
-    sha256 = "0vlqgcjbq6yp7ffrfs3zwa9hrm4vyx9245v9pkqdn328xlff3h55";
+    sha256 = "1ky1nl5b54lf5jnac2kb5404fplwnwypjplas8imdlsf517fw32n";
   };
 
   nativeBuildInputs = [
@@ -38,12 +38,13 @@ buildGoModule rec {
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/aerc --prefix PATH ":" "$out/share/aerc/filters"
+    wrapProgram $out/bin/aerc --prefix PATH ":" \
+      "$out/share/aerc/filters:${stdenv.lib.makeBinPath [ ncurses.dev ]}"
     wrapProgram $out/share/aerc/filters/html --prefix PATH ":" \
       ${stdenv.lib.makeBinPath [ w3m dante ]}
   '';
 
-  modSha256 = "0v1b76nax5295bjrq19wdzm2ixiszlk7j1v1k9sjz4la07h5bvfj";
+  modSha256 = "0fc9m1qb8innypc8cxzbqyrfkawawyaqq3gqy7lqwmyh32f300jh";
 
   meta = with stdenv.lib; {
     description = "aerc is an email client for your terminal";

pkgs/applications/radio/dablin/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig
+, mpg123, SDL2, gnome3, faad2, pcre
+} :
+
+stdenv.mkDerivation rec {
+  pname = "dablin";
+  version = "1.11.0";
+
+  src = fetchFromGitHub {
+    owner = "Opendigitalradio";
+    repo = "dablin";
+    rev = "${version}";
+    sha256 = "04ir7yg7psnnb48s1qfppvvx6lak4s8f6fqdg721y2kd9129jm82";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [ faad2 mpg123 SDL2 gnome3.gtkmm pcre ];
+
+  meta = with stdenv.lib; {
+    description = "Play DAB/DAB+ from ETI-NI aligned stream";
+    homepage = https://github.com/Opendigitalradio/dablin;
+    license = with licenses; [ gpl3 lgpl21 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.markuskowa ];
+  };
+}
+

pkgs/applications/radio/dabtools/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig
+, libusb1, rtl-sdr, fftw
+} :
+
+stdenv.mkDerivation rec {
+  pname = "dabtools";
+  version = "20180405";
+
+  src = fetchFromGitHub {
+    owner = "Opendigitalradio";
+    repo = "dabtools";
+    rev = "8b0b2258b02020d314efd4d0d33a56c8097de0d1";
+    sha256 = "18nkdybgg2w6zh56g6xwmg49sifalvraz4rynw8w5d8cqi3dm9sm";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ rtl-sdr fftw libusb1 ];
+
+  meta = with stdenv.lib; {
+    description = "Commandline tools for DAB and DAB+ digital radio broadcasts";
+    homepage = "https://github.com/Opendigitalradio/dabtools";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.markuskowa ];
+  };
+}
+

pkgs/applications/version-management/git-and-tools/git-cola/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pythonPackages, gettext, git }:
+{ stdenv, fetchFromGitHub, pythonPackages, gettext, git, qt5 }:
 
 let
   inherit (pythonPackages) buildPythonApplication pyqt5 sip pyinotify;
@@ -16,9 +16,16 @@ in buildPythonApplication rec {
 
   buildInputs = [ git gettext ];
   propagatedBuildInputs = [ pyqt5 sip pyinotify ];
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
 
   doCheck = false;
 
+  postFixup = ''
+    wrapQtApp bin/git-cola
+    wrapQtApp bin/git-dag
+
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://github.com/git-cola/git-cola;
     description = "A sleek and powerful Git GUI";

pkgs/applications/version-management/gitea/default.nix

@@ -8,13 +8,13 @@ with stdenv.lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.8.3";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     rev = "v${version}";
-    sha256 = "1q3wslf9s4dg7h1f41rh9rb7qlbsqz8k3xffmlzdbbgfdrm7sym1";
+    sha256 = "1z7rkhxkymv7rgc7blh9ps5sqrgl4sryf0rqcp16nh9n5snfm1rm";
     # Required to generate the same checksum on MacOS due to unicode encoding differences
     # More information: https://github.com/NixOS/nixpkgs/pull/48128
     extraPostFetch = ''

pkgs/applications/version-management/gitlab/gitaly/deps.nix

@@ -285,7 +285,7 @@
       type = "git";
       url = "https://github.com/libgit2/git2go";
       rev = "ecaeb7a21d47";
-      sha256 = "1sh30jnzjag7ddhr4if65j8vpcpj4rw93sf1g033jf91flrzyx23";
+      sha256 = "14r7ryff93r49g94f6kg66xc0y6rwb31lj22s3qmzmlgywk0pgvr";
     };
   }
   {
@@ -294,7 +294,7 @@
       type = "git";
       url = "https://github.com/lightstep/lightstep-tracer-go";
       rev = "v0.15.6";
-      sha256 = "0g5bh3xdrsz30npk79h5ia340xyw97424xfrfzv3acqw3qg2sqn8";
+      sha256 = "10n5r66g44s6rnz5kf86s4a3p1g55kc1kxqhnk7bx7mlayndgpmb";
     };
   }
   {
@@ -483,7 +483,7 @@
       type = "git";
       url = "https://github.com/uber/jaeger-client-go";
       rev = "v2.15.0";
-      sha256 = "1qvqkf20dp5fyfg7qd3jc29q1yv0qjz2mkxa02j1v3n8ka134rff";
+      sha256 = "0ki23m9zrf3vxp839fnp9ckr4m28y6mpad8g5s5lr5k8jkl0sfwj";
     };
   }
   {

pkgs/applications/video/k9copy/default.nix

@@ -56,5 +56,8 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
     maintainers = with stdenv.lib.maintainers; [ flosse ];
     platforms = stdenv.lib.platforms.unix;
+    # TODO: The software is deprecated and the build is broken, see:
+    # https://github.com/NixOS/nixpkgs/pull/63260#issuecomment-503506487
+    broken = true;
   };
 }

pkgs/applications/video/makemkv/builder.sh

@@ -1,40 +0,0 @@
-source $stdenv/setup
-set -x
-
-lib=" \
-  makemkv-oss-${ver}/out/libdriveio.so.0 \
-  makemkv-oss-${ver}/out/libmakemkv.so.1 \
-  makemkv-oss-${ver}/out/libmmbd.so.0 \
-  "
-
-bin=" \
-  makemkv-oss-${ver}/out/makemkv \
-  makemkv-bin-${ver}/bin/amd64/makemkvcon \
-  "
-
-tar xzf ${src_bin}
-tar xzf ${src_oss}
-
-(
-  cd makemkv-oss-${ver}
-  ./configure --prefix=$out
-  make
-)
-
-chmod +x ${bin}
-
-libPath="${libPath}:${out}/lib" # XXX: der. This should be in the nix file?
-
-for i in ${bin} ; do
-  patchelf \
-    --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-    --set-rpath $libPath \
-    ${i}
-done 
-
-mkdir -p $out/bin
-mkdir -p $out/lib
-mkdir -p $out/share/MakeMKV
-cp ${lib} ${out}/lib
-cp ${bin} ${out}/bin
-cp makemkv-bin-${ver}/src/share/* $out/share/MakeMKV

pkgs/applications/video/makemkv/default.nix

@@ -1,34 +1,45 @@
-{ stdenv, fetchurl
-, openssl, qt5, libGLU_combined, zlib, pkgconfig, libav
+{ stdenv, mkDerivation, fetchurl, autoPatchelfHook
+, ffmpeg, openssl, qtbase, zlib, pkgconfig
 }:
 
-stdenv.mkDerivation rec {
-  name = "makemkv-${ver}";
-  ver = "1.14.4";
-  builder = ./builder.sh;
-
+let
+  version = "1.14.4";
   # Using two URLs as the first one will break as soon as a new version is released
   src_bin = fetchurl {
     urls = [
-      "http://www.makemkv.com/download/makemkv-bin-${ver}.tar.gz"
-      "http://www.makemkv.com/download/old/makemkv-bin-${ver}.tar.gz"
+      "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
+      "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
     ];
     sha256 = "0vmmvldmwmq9g202abblj6l15kb8z3b0c6mcc03f30s2yci6ij33";
   };
-
   src_oss = fetchurl {
     urls = [
-      "http://www.makemkv.com/download/makemkv-oss-${ver}.tar.gz"
-      "http://www.makemkv.com/download/old/makemkv-oss-${ver}.tar.gz"
+      "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
+      "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
     ];
     sha256 = "0n1nlq17dxcbgk9xqf7nv6zykvh91yhsjqdhq55947wc11fxjqa0";
   };
+in mkDerivation {
+  pname = "makemkv";
+  inherit version;
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [openssl qt5.qtbase libGLU_combined zlib libav];
+  srcs = [ src_bin src_oss ];
 
-  libPath = stdenv.lib.makeLibraryPath [stdenv.cc.cc openssl libGLU_combined qt5.qtbase zlib ]
-          + ":" + stdenv.cc.cc + "/lib64";
+  sourceRoot = "makemkv-oss-${version}";
+
+  nativeBuildInputs = [ autoPatchelfHook pkgconfig ];
+
+  buildInputs = [ ffmpeg openssl qtbase zlib ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 -t $out/bin           out/makemkv ../makemkv-bin-${version}/bin/amd64/makemkvcon
+    install -D     -t $out/lib           out/lib{driveio,makemkv,mmbd}.so.*
+    install -D     -t $out/share/MakeMKV ../makemkv-bin-${version}/src/share/*
+
+    runHook postInstall
+  '';
 
   meta = with stdenv.lib; {
     description = "Convert blu-ray and dvd to mkv";

pkgs/applications/video/obs-studio/default.nix

@@ -1,4 +1,5 @@
 { config, stdenv
+, mkDerivation
 , fetchFromGitHub
 , cmake
 , fdk_aac
@@ -34,7 +35,7 @@
 
 let
   optional = stdenv.lib.optional;
-in stdenv.mkDerivation rec {
+in mkDerivation rec {
   name = "obs-studio-${version}";
   version = "23.2.1";
 

pkgs/applications/video/vdr/default.nix

@@ -16,7 +16,7 @@
 
   postPatch = "substituteInPlace Makefile --replace libsystemd-daemon libsystemd";
 
-  buildInputs = [ fontconfig libjpeg libcap freetype ]
+  buildInputs = [ fontconfig libjpeg libcap freetype perl ]
   ++ lib.optional enableSystemd systemd
   ++ lib.optional enableBidi fribidi;
 

pkgs/applications/video/vlc/default.nix

@@ -9,7 +9,7 @@
 , libass, libva, libdvbpsi, libdc1394, libraw1394, libopus
 , libvdpau, libsamplerate, live555, fluidsynth, wayland, wayland-protocols
 , onlyLibVLC ? false
-, withQt5 ? true, qtbase ? null, qtsvg ? null, qtx11extras ? null
+, withQt5 ? true, qtbase ? null, qtsvg ? null, qtx11extras ? null, wrapQtAppsHook ? null
 , jackSupport ? false
 , removeReferencesTo
 , chromecastSupport ? true, protobuf, libmicrodns
@@ -21,7 +21,7 @@
 
 with stdenv.lib;
 
-assert (withQt5 -> qtbase != null && qtsvg != null && qtx11extras != null);
+assert (withQt5 -> qtbase != null && qtsvg != null && qtx11extras != null && wrapQtAppsHook != null);
 
 stdenv.mkDerivation rec {
   name = "vlc-${version}";
@@ -49,7 +49,8 @@ stdenv.mkDerivation rec {
     ++ optional jackSupport libjack2
     ++ optionals chromecastSupport [ protobuf libmicrodns ];
 
-  nativeBuildInputs = [ autoreconfHook perl pkgconfig removeReferencesTo ];
+  nativeBuildInputs = [ autoreconfHook perl pkgconfig removeReferencesTo ]
+    ++ optionals withQt5 [ wrapQtAppsHook ];
 
   enableParallelBuilding = true;
 

pkgs/applications/virtualization/podman/default.nix

@@ -5,13 +5,13 @@
 
 buildGoPackage rec {
   name = "podman-${version}";
-  version = "1.3.2";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner  = "containers";
     repo   = "libpod";
     rev    = "v${version}";
-    sha256 = "1j5n08273igj6wm9rrwks9nnklv91060bn1yv3ak78csxc05whs3";
+    sha256 = "13qgrvqawrrz4apdcds4amkljyjzx056545962wk8p0d291hqv5a";
   };
 
   goPackagePath = "github.com/containers/libpod";
@@ -39,7 +39,7 @@ buildGoPackage rec {
     homepage = https://podman.io/;
     description = "A program for managing pods, containers and container images";
     license = licenses.asl20;
-    maintainers = with maintainers; [ vdemeester ];
+    maintainers = with maintainers; [ vdemeester saschagrunert ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/window-managers/bspwm/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "bspwm-${version}";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner  = "baskerville";
     repo   = "bspwm";
     rev    = version;
-    sha256 = "17cfvbrvzwwr9r72xgpn144k45xavzi0hnl2qqp9lhxflvirac0c";
+    sha256 = "1vc4pdm4fwb5gz7hyzwvjqkx5087f0vrw11898nq1s7kxzl2lhbx";
   };
 
   buildInputs = [ libxcb libXinerama xcbutil xcbutilkeysyms xcbutilwm ];

pkgs/applications/window-managers/dwm/dwm-status.nix

@@ -9,19 +9,19 @@ in
 
 rustPlatform.buildRustPackage rec {
   name = "dwm-status-${version}";
-  version = "1.6.0";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = "dwm-status";
     rev = version;
-    sha256 = "02gvlxv6ylx4mdkf59crm2zyahiz1zd4cr5zz29dnhx7r7738i9a";
+    sha256 = "16vf7val1isc4227amng2ap9af34xa2va23dxv43px006xhrar78";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
   buildInputs = [ dbus gdk-pixbuf libnotify xorg.libX11 ];
 
-  cargoSha256 = "1r2wczfkdpvjc7iylwajkminraaz1ix6n724in0dvv5klfcdxlxb";
+  cargoSha256 = "0pprf8509d321azg2l51lpxylgpk7290y38z9p5hxgkcwhrhrcss";
 
   postInstall = lib.optionalString (bins != [])  ''
     wrapProgram $out/bin/dwm-status --prefix "PATH" : "${stdenv.lib.makeBinPath bins}"

pkgs/build-support/build-bazel-package/default.nix

@@ -4,7 +4,7 @@
 , lib
 }:
 
-args@{ name, bazelFlags ? [], bazelTarget, buildAttrs, fetchAttrs, ... }:
+args@{ name, bazelFlags ? [], bazelBuildFlags ? [], bazelFetchFlags ? [], bazelTarget, buildAttrs, fetchAttrs, ... }:
 
 let
   fArgs = removeAttrs args [ "buildAttrs" "fetchAttrs" ];
@@ -12,11 +12,11 @@ let
   fFetchAttrs = fArgs // removeAttrs fetchAttrs [ "sha256" ];
 
 in stdenv.mkDerivation (fBuildAttrs // {
-  inherit name bazelFlags bazelTarget;
+  inherit name bazelFlags bazelBuildFlags bazelFetchFlags bazelTarget;
 
   deps = stdenv.mkDerivation (fFetchAttrs // {
     name = "${name}-deps";
-    inherit bazelFlags bazelTarget;
+    inherit bazelFlags bazelBuildFlags bazelFetchFlags bazelTarget;
 
     nativeBuildInputs = fFetchAttrs.nativeBuildInputs or [] ++ [ bazel ];
 
@@ -49,6 +49,7 @@ in stdenv.mkDerivation (fBuildAttrs // {
         fetch \
         --loading_phase_threads=1 \
         $bazelFlags \
+        $bazelFetchFlags \
         $bazelTarget
 
       runHook postBuild
@@ -60,13 +61,10 @@ in stdenv.mkDerivation (fBuildAttrs // {
       # Remove all built in external workspaces, Bazel will recreate them when building
       rm -rf $bazelOut/external/{bazel_tools,\@bazel_tools.marker}
       rm -rf $bazelOut/external/{embedded_jdk,\@embedded_jdk.marker}
-      rm -rf $bazelOut/external/{local_*,\@local_*}
+      rm -rf $bazelOut/external/{local_*,\@local_*.marker}
 
-      # Patching markers to make them deterministic
-      find $bazelOut/external -name '@*\.marker' -exec sed -i \
-        -e 's, -\?[0-9][0-9]*$, 1,' \
-        -e '/^ENV:TMP.*/d' \
-        '{}' \;
+      # Clear markers
+      find $bazelOut/external -name '@*\.marker' -exec sh -c 'echo > {}' \;
 
       # Remove all vcs files
       rm -rf $(find $bazelOut/external -type d -name .git)
@@ -152,6 +150,7 @@ in stdenv.mkDerivation (fBuildAttrs // {
       "''${host_linkopts[@]}" \
       '' + ''
       $bazelFlags \
+      $bazelBuildFlags \
       $bazelTarget
 
     runHook postBuild

pkgs/build-support/docker/default.nix

@@ -1,37 +1,41 @@
 {
-  symlinkJoin,
+  cacert,
+  callPackage,
+  closureInfo,
   coreutils,
   docker,
   e2fsprogs,
   findutils,
   go,
-  jshon,
   jq,
+  jshon,
   lib,
-  pkgs,
-  pigz,
+  moreutils,
   nix,
-  runCommand,
+  pigz,
+  referencesByPopularity,
   rsync,
+  runCommand,
+  runtimeShell,
   shadow,
+  skopeo,
+  stdenv,
   storeDir ? builtins.storeDir,
+  substituteAll,
+  symlinkJoin,
   utillinux,
   vmTools,
   writeReferencesToFile,
-  referencesByPopularity,
   writeScript,
   writeText,
-  closureInfo,
-  substituteAll,
-  runtimeShell
 }:
 
 # WARNING: this API is unstable and may be subject to backwards-incompatible changes in the future.
 
 rec {
 
-  examples = import ./examples.nix {
-    inherit pkgs buildImage pullImage shadowSetup buildImageWithNixDb;
+  examples = callPackage ./examples.nix {
+    inherit buildImage pullImage shadowSetup buildImageWithNixDb;
   };
 
   pullImage = let
@@ -57,13 +61,13 @@ rec {
       inherit imageDigest;
       imageName = finalImageName;
       imageTag = finalImageTag;
-      impureEnvVars = pkgs.stdenv.lib.fetchers.proxyImpureEnvVars;
+      impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars;
       outputHashMode = "flat";
       outputHashAlgo = "sha256";
       outputHash = sha256;
 
-      nativeBuildInputs = lib.singleton (pkgs.skopeo);
-      SSL_CERT_FILE = "${pkgs.cacert.out}/etc/ssl/certs/ca-bundle.crt";
+      nativeBuildInputs = lib.singleton skopeo;
+      SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";
 
       sourceURL = "docker://${imageName}@${imageDigest}";
       destNameTag = "${finalImageName}:${finalImageTag}";
@@ -156,7 +160,8 @@ rec {
     postMount ? "",
     postUmount ? ""
   }:
-    vmTools.runInLinuxVM (
+  let
+    result = vmTools.runInLinuxVM (
       runCommand name {
         preVM = vmTools.createEmptyImage {
           size = diskSize;
@@ -166,8 +171,6 @@ rec {
 
         nativeBuildInputs = [ utillinux e2fsprogs jshon rsync jq ];
       } ''
-      rm -rf $out
-
       mkdir disk
       mkfs /dev/${vmTools.hd}
       mount /dev/${vmTools.hd} disk
@@ -250,6 +253,12 @@ rec {
 
       ${postUmount}
       '');
+    in
+    runCommand name {} ''
+      mkdir -p $out
+      cd ${result}
+      cp layer.tar json VERSION $out
+    '';
 
   exportImage = { name ? fromImage.name, fromImage, fromImageName ? null, fromImageTag ? null, diskSize ? 1024 }:
     runWithOverlay {
@@ -489,7 +498,7 @@ rec {
         (cd layer; ${extraCommandsScript})
 
         echo "Packing layer..."
-        mkdir $out
+        mkdir -p $out
         tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" -cf $out/layer.tar .
 
         # Compute the tar checksum and add it to the output json.
@@ -670,7 +679,7 @@ rec {
                   extraCommands;
         };
       result = runCommand "docker-image-${baseName}.tar.gz" {
-        nativeBuildInputs = [ jshon pigz coreutils findutils jq ];
+        nativeBuildInputs = [ jshon pigz coreutils findutils jq moreutils ];
         # Image name and tag must be lowercase
         imageName = lib.toLower name;
         imageTag = if tag == null then "" else lib.toLower tag;
@@ -784,7 +793,7 @@ rec {
           # originally this used `sed -i "1i$layerID" layer-list`, but
           # would fail if layer-list was completely empty.
           echo "$layerID/layer.tar"
-        ) | ${pkgs.moreutils}/bin/sponge layer-list
+        ) | sponge layer-list
 
         # Create image json and image manifest
         imageJson=$(cat ${baseJson} | jq ". + {\"rootfs\": {\"diff_ids\": [], \"type\": \"layers\"}}")

pkgs/build-support/rust/default.nix

@@ -14,6 +14,7 @@
 , cargoDepsHook ? ""
 , cargoBuildFlags ? []
 , buildType ? "release"
+, meta ? {}
 
 , cargoVendorDir ? null
 , ... } @ args:
@@ -45,7 +46,6 @@ let
   ccForHost="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
   cxxForHost="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
   releaseDir = "target/${stdenv.hostPlatform.config}/${buildType}";
-
 in stdenv.mkDerivation (args // {
   inherit cargoDeps;
 
@@ -103,7 +103,7 @@ in stdenv.mkDerivation (args // {
       "CC_${stdenv.hostPlatform.config}"="${ccForHost}" \
       "CXX_${stdenv.hostPlatform.config}"="${cxxForHost}" \
       cargo build \
-        --${buildType} \
+        ${stdenv.lib.optionalString (buildType == "release") "--release"} \
         --target ${stdenv.hostPlatform.config} \
         --frozen ${concatStringsSep " " cargoBuildFlags}
     )
@@ -147,4 +147,9 @@ in stdenv.mkDerivation (args // {
   '';
 
   passthru = { inherit cargoDeps; } // (args.passthru or {});
+
+  meta = {
+    # default to Rust's platforms
+    platforms = rustc.meta.platforms;
+  } // meta;
 })

pkgs/data/fonts/font-awesome-5/default.nix

@@ -1,30 +1,45 @@
 { lib, fetchFromGitHub }:
-
 let
-  version = "5.9.0";
-in fetchFromGitHub rec {
-  name = "font-awesome-${version}";
+  font-awesome = { version, sha256, rev ? version}: fetchFromGitHub rec {
+    name = "font-awesome-${version}";
 
-  owner = "FortAwesome";
-  repo = "Font-Awesome";
-  rev = version;
 
-  postFetch = ''
-    tar xf $downloadedFile --strip=1
-    install -m444 -Dt $out/share/fonts/opentype otfs/*.otf
-  '';
+    owner = "FortAwesome";
+    repo = "Font-Awesome";
+    inherit rev;
 
-  sha256 = "0sz7mn7g968vp5hszs05grpphd7zr3073az8lyy1lj0096zvjjii";
-
-  meta = with lib; {
-    description = "Font Awesome - OTF font";
-    longDescription = ''
-      Font Awesome gives you scalable vector icons that can instantly be customized.
-      This package includes only the OTF font. For full CSS etc. see the project website.
+    postFetch = ''
+      tar xf $downloadedFile --strip=1
+      install -m444 -Dt $out/share/fonts/opentype {fonts,otfs}/*.otf
     '';
-    homepage = http://fortawesome.github.io/Font-Awesome/;
-    license = licenses.ofl;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ abaldeau ];
+
+    inherit sha256;
+
+    meta = with lib; {
+      description = "Font Awesome - OTF font";
+      longDescription = ''
+        Font Awesome gives you scalable vector icons that can instantly be customized.
+        This package includes only the OTF font. For full CSS etc. see the project website.
+      '';
+      homepage = "http://fortawesome.github.io/Font-Awesome/";
+      license = licenses.ofl;
+      platforms = platforms.all;
+      maintainers = with maintainers; [ abaldeau johnazoidberg ];
+    };
+  };
+in {
+  # Keeping version 4 because version 5 is incompatible for some icons. That
+  # means that projects which depend on it need to actively convert the
+  # symbols. See:
+  # https://github.com/greshake/i3status-rust/issues/130
+  # https://fontawesome.com/how-to-use/on-the-web/setup/upgrading-from-version-4
+  v4 = font-awesome {
+    version = "4.7.0";
+    rev = "v4.7.0";
+    sha256 = "1j8i32dq6rrlv3kf2hnq81iqks06kczaxjks7nw3zyq1231winm9";
+  };
+  v5 = font-awesome {
+    version = "5.10.0";
+    sha256 = "11nga1drlpkrmw307ga6plbj5z1b70cnckr465z8z6vkbcd6jkv3";
   };
 }

pkgs/data/themes/plata/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plata-theme";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitLab {
     owner = "tista500";
     repo = "plata-theme";
     rev = version;
-    sha256 = "1rn51yj7f7bclvrwwqwid4z9cpap4yd0zw0xs08c36zcjmr28426";
+    sha256 = "1xb28s67lnsphj97r15jxlfgydyrxdby1d2z5y3g9wniw6z19i9n";
   };
 
   preferLocalBuild = true;

pkgs/development/compilers/elm/default.nix

@@ -56,7 +56,7 @@ let
             */
             elm-test = patchBinwrap [elmi-to-json] elmNodePackages.elm-test;
             elm-verify-examples = patchBinwrap [elmi-to-json] elmNodePackages.elm-verify-examples;
-            elm-analyse = elmNodePackages."elm-analyse-0.16.3";
+            elm-analyse = elmNodePackages.elm-analyse;
             inherit (elmNodePackages) elm-doc-preview elm-upgrade;
           };
       in elmPkgs // {

pkgs/development/compilers/elm/packages/node-composition.nix

@@ -1,4 +1,4 @@
-# This file has been generated by node2nix 1.6.0. Do not edit!
+# This file has been generated by node2nix 1.7.0. Do not edit!
 
 {pkgs ? import <nixpkgs> {
     inherit system;

pkgs/development/compilers/elm/packages/node-env.nix

@@ -11,7 +11,7 @@ let
 
     cat > $out/bin/tar <<EOF
     #! ${stdenv.shell} -e
-    $(type -p tar) "\$@" --warning=no-unknown-keyword
+    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
     EOF
 
     chmod +x $out/bin/tar
@@ -72,7 +72,7 @@ let
           packageDir="$(find . -maxdepth 1 -type d | tail -1)"
 
           # Restore write permissions to make building work
-          find "$packageDir" -type d -print0 | xargs -0 chmod u+x
+          find "$packageDir" -type d -exec chmod u+x {} \;
           chmod -R u+w "$packageDir"
 
           # Move the extracted tarball into the output folder
@@ -219,7 +219,16 @@ let
                       packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
                   }
 
-                  packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
+                  if(dependency.resolved) {
+                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
+                  } else {
+                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
+                  }
+
+                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
+                      packageObj["_from"] = dependency.from;
+                  }
+
                   fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
               }
 
@@ -308,50 +317,11 @@ let
     '';
   };
 
-  # Builds and composes an NPM package including all its dependencies
-  buildNodePackage =
-    { name
-    , packageName
-    , version
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , preRebuild ? ""
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , ... }@args:
-
+  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
     let
       forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" ];
     in
-    stdenv.mkDerivation ({
-      name = "node-${name}-${version}";
-      buildInputs = [ tarWrapper python nodejs ]
-        ++ stdenv.lib.optional (stdenv.isLinux) utillinux
-        ++ stdenv.lib.optional (stdenv.isDarwin) libtool
-        ++ buildInputs;
-
-      inherit dontStrip; # Stripping may fail a build for some package deployments
-      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
-
-      compositionScript = composePackage args;
-      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
-
-      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
-
-      installPhase = ''
-        # Create and enter a root node_modules/ folder
-        mkdir -p $out/lib/node_modules
-        cd $out/lib/node_modules
-
-        # Compose the package and all its dependencies
-        source $compositionScriptPath
-
+    ''
         # Pinpoint the versions of all dependencies to the ones that are actually being used
         echo "pinpointing versions of dependencies..."
         source $pinpointDependenciesScriptPath
@@ -375,11 +345,18 @@ let
         runHook preRebuild
 
         ${stdenv.lib.optionalString bypassCache ''
-          if [ ! -f package-lock.json ]
-          then
-              echo "No package-lock.json file found, reconstructing..."
-              node ${reconstructPackageLock}
-          fi
+          ${stdenv.lib.optionalString reconstructLock ''
+            if [ -f package-lock.json ]
+            then
+                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
+                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
+                rm package-lock.json
+            else
+                echo "No package-lock.json file found, reconstructing..."
+            fi
+
+            node ${reconstructPackageLock}
+          ''}
 
           node ${addIntegrityFieldsScript}
         ''}
@@ -393,6 +370,53 @@ let
 
             npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} install
         fi
+    '';
+
+  # Builds and composes an NPM package including all its dependencies
+  buildNodePackage =
+    { name
+    , packageName
+    , version
+    , dependencies ? []
+    , buildInputs ? []
+    , production ? true
+    , npmFlags ? ""
+    , dontNpmInstall ? false
+    , bypassCache ? false
+    , reconstructLock ? false
+    , preRebuild ? ""
+    , dontStrip ? true
+    , unpackPhase ? "true"
+    , buildPhase ? "true"
+    , ... }@args:
+
+    let
+      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" ];
+    in
+    stdenv.mkDerivation ({
+      name = "node_${name}-${version}";
+      buildInputs = [ tarWrapper python nodejs ]
+        ++ stdenv.lib.optional (stdenv.isLinux) utillinux
+        ++ stdenv.lib.optional (stdenv.isDarwin) libtool
+        ++ buildInputs;
+
+      inherit dontStrip; # Stripping may fail a build for some package deployments
+      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
+
+      compositionScript = composePackage args;
+      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
+
+      installPhase = ''
+        # Create and enter a root node_modules/ folder
+        mkdir -p $out/lib/node_modules
+        cd $out/lib/node_modules
+
+        # Compose the package and all its dependencies
+        source $compositionScriptPath
+
+        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
 
         # Create symlink to the deployed executable folder, if applicable
         if [ -d "$out/lib/node_modules/.bin" ]
@@ -431,14 +455,13 @@ let
     , npmFlags ? ""
     , dontNpmInstall ? false
     , bypassCache ? false
+    , reconstructLock ? false
     , dontStrip ? true
     , unpackPhase ? "true"
     , buildPhase ? "true"
     , ... }@args:
 
     let
-      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
-
       extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
 
       nodeDependencies = stdenv.mkDerivation ({
@@ -473,39 +496,13 @@ let
             fi
           ''}
 
-          # Pinpoint the versions of all dependencies to the ones that are actually being used
-          echo "pinpointing versions of dependencies..."
+          # Go to the parent folder to make sure that all packages are pinpointed
           cd ..
           ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
 
-          source $pinpointDependenciesScriptPath
-          cd ${packageName}
-
-          # Patch the shebangs of the bundled modules to prevent them from
-          # calling executables outside the Nix store as much as possible
-          patchShebangs .
-
-          export HOME=$PWD
-
-          ${stdenv.lib.optionalString bypassCache ''
-            if [ ! -f package-lock.json ]
-            then
-                echo "No package-lock.json file found, reconstructing..."
-                node ${reconstructPackageLock}
-            fi
-
-            node ${addIntegrityFieldsScript}
-          ''}
-
-          npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} rebuild
-
-          ${stdenv.lib.optionalString (!dontNpmInstall) ''
-            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
-            rm -f npm-shrinkwrap.json
-
-            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${stdenv.lib.optionalString production "--production"} install
-          ''}
+          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
 
+          # Expose the executables that were installed
           cd ..
           ${stdenv.lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
 
@@ -532,6 +529,7 @@ let
       inherit nodeDependencies;
       shellHook = stdenv.lib.optionalString (dependencies != []) ''
         export NODE_PATH=$nodeDependencies/lib/node_modules
+        export PATH="$nodeDependencies/bin:$PATH"
       '';
     };
 in

pkgs/development/compilers/elm/packages/node-packages.json

@@ -2,6 +2,6 @@
     "elm-test",
     "elm-verify-examples",
     "elm-doc-preview",
-    { "elm-analyse": "0.16.3" },
+    "elm-analyse",
     "elm-upgrade"
 ]

pkgs/development/compilers/nim/default.nix

@@ -4,12 +4,12 @@
   boehmgc, sfml, tzdata, coreutils, sqlite }:
 
 stdenv.mkDerivation rec {
-  name = "nim-${version}";
-  version = "0.20.0";
+  pname = "nim";
+  version = "0.20.2";
 
   src = fetchurl {
-    url = "https://nim-lang.org/download/${name}.tar.xz";
-    sha256 = "144sd7icg2p6qsrr29jdnl11hr34daxq4h16ywwrayz866w7kx2i";
+    url = "https://nim-lang.org/download/${pname}-${version}.tar.xz";
+    sha256 = "0pibil10x0c181kw705phlwk8bn8dy5ghqd9h9fm6i9afrz5ryp1";
   };
 
   doCheck = !stdenv.isDarwin;
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Statically typed, imperative programming language";
-    homepage = https://nim-lang.org/;
+    homepage = "https://nim-lang.org/";
     license = licenses.mit;
     maintainers = with maintainers; [ ehmry peterhoeg ];
     platforms = with platforms; linux ++ darwin; # arbitrary

pkgs/development/compilers/vlang/default.nix

@@ -0,0 +1,51 @@
+{ stdenv, fetchFromGitHub, glfw, freetype, curl }:
+
+stdenv.mkDerivation rec {
+  pname = "vlang";
+  version = "0.1.16";
+
+  src = fetchFromGitHub {
+    owner = "vlang";
+    repo = "v";
+    rev = "${version}";
+    sha256 = "08zgwy9ac3wa5ixy8rdw6izpn1n1c3ydb9rl8z8graw0bgv719ma";
+  };
+
+  # V compiler source translated to C for bootstrap.
+  vc = fetchFromGitHub {
+    owner = "vlang";
+    repo = "vc";
+    rev = "${version}";
+    sha256 = "0k6c7v3r3cirypsqbaq10qlgg41v19rsnc1ygam4il2p8rsmfwz3";
+  };
+
+  enableParallelBuilding = true;
+  buildInputs = [ glfw freetype curl ];
+
+  buildPhase = ''
+    runHook preBuild
+    cc -std=gnu11 -w -o v $vc/v.c -lm
+    ./v -prod -o v compiler
+    # -fPIC -pie required for examples/hot_code_reloading
+    make CFLAGS+="-fPIC -pie" thirdparty
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,lib/vlang,share/vlang}
+    cp -r examples $out/share/vlang
+    cp -r {vlib,thirdparty} $out/lib/vlang
+    cp v $out/lib/vlang
+    ln -s $out/lib/vlang/v $out/bin/v
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://vlang.io/";
+    description = "Simple, fast, safe, compiled language for developing maintainable software";
+    license = licenses.mit;
+    maintainers = with maintainers; [ chiiruno ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/go-modules/generic/default.nix

@@ -7,6 +7,9 @@
 , passthru ? {}
 , patches ? []
 
+# A function to override the go-modules derivation
+, overrideModAttrs ? (_oldAttrs : {})
+
 # modSha256 is the sha256 of the vendored dependencies
 , modSha256
 
@@ -27,13 +30,13 @@
 with builtins;
 
 let
-  args = removeAttrs args' [ "modSha256" "disabled" ];
+  args = removeAttrs args' [ "overrideModAttrs" "modSha256" "disabled" ];
 
   removeReferences = [ ] ++ lib.optional (!allowGoReference) go;
 
   removeExpr = refs: ''remove-references-to ${lib.concatMapStrings (ref: " -t ${ref}") refs}'';
 
-  go-modules = go.stdenv.mkDerivation {
+  go-modules = go.stdenv.mkDerivation (let modArgs = {
     name = "${name}-go-modules";
 
     nativeBuildInputs = [ go git cacert ];
@@ -79,7 +82,7 @@ let
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     outputHash = modSha256;
-  };
+  }; in modArgs // overrideModAttrs modArgs);
 
   package = go.stdenv.mkDerivation (args // {
     nativeBuildInputs = [ removeReferencesTo go ] ++ nativeBuildInputs;

pkgs/development/interpreters/python/pypy/default.nix

@@ -151,5 +151,6 @@ in with passthru; stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = [ "i686-linux" "x86_64-linux" ];
     maintainers = with maintainers; [ andersk ];
+    broken = true; # TODO: Tests are failing!
   };
 }

pkgs/development/libraries/ffmpeg-full/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, perl, texinfo, yasm
+{ stdenv, fetchurl, fetchpatch, pkgconfig, perl, texinfo, yasm
 /*
  *  Licensing options (yes some are listed twice, filters and such are not listed)
  */
@@ -234,12 +234,17 @@ assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;
 
 stdenv.mkDerivation rec {
   name = "ffmpeg-full-${version}";
-  version = "4.1.3";
+  version = "4.1.4";
 
   src = fetchurl {
     url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "0gdnprc7gk4b7ckq8wbxbrj7i00r76r9a5g9mj7iln40512j0c0c";
+    sha256 = "1qd7a10gs12ifcp31gramcgqjl77swskjfp7cijibgyg5yl4kw7i";
   };
+  patches = [(fetchpatch { # remove on update
+    name = "fix-hardcoded-tables.diff";
+    url = "http://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/c8232e50074f";
+    sha256 = "0jlksks4fjajby8fjk7rfp414gxfdgd6q9khq26i52xvf4kg2dw6";
+  })];
 
   prePatch = ''
     patchShebangs .

pkgs/development/libraries/ffmpeg/4.nix

@@ -6,7 +6,12 @@
 
 callPackage ./generic.nix (args // rec {
   version = "${branch}";
-  branch = "4.1.3";
-  sha256 = "0aka5pibjhpks1wrsvqpy98v8cbvyvnngwqhh4ajkg6pbdl7k9i9";
+  branch = "4.1.4";
+  sha256 = "01w44ygm5bvc243hlhfnvb2lxfb0blz2cxnphxqgw30vj3c1prx7";
+  patches = [(fetchpatch { # remove on update
+    name = "fix-hardcoded-tables.diff";
+    url = "http://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/c8232e50074f";
+    sha256 = "0jlksks4fjajby8fjk7rfp414gxfdgd6q9khq26i52xvf4kg2dw6";
+  })];
   darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 })

pkgs/development/libraries/kpmcore/default.nix

@@ -28,6 +28,8 @@ in stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-   maintainers = with lib.maintainers; [ peterhoeg ];
+    maintainers = with lib.maintainers; [ peterhoeg ];
+    # The build requires at least Qt 5.12:
+    broken = lib.versionOlder qtbase.version "5.12.0";
   };
 }

pkgs/development/libraries/lib3mf/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, ninja, libuuid, gtest }:
+{ stdenv, fetchFromGitHub, cmake, ninja, libuuid, libossp_uuid, gtest }:
 
 stdenv.mkDerivation rec {
   pname = "lib3mf";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ninja ];
 
-  buildInputs = [ libuuid ];
+  buildInputs = if stdenv.isDarwin then [ libossp_uuid ] else [ libuuid ];
 
   postPatch = ''
     rmdir UnitTests/googletest

pkgs/development/libraries/libblockdev/default.nix

@@ -1,18 +1,18 @@
-{ stdenv, fetchFromGitHub, substituteAll, autoreconfHook, pkgconfig, gtk-doc, libxslt, docbook_xsl
-, docbook_xml_dtd_43, python3, gobject-introspection, glib, udev, kmod, parted, gptfdisk, libyaml
+{ stdenv, fetchFromGitHub, substituteAll, autoreconfHook, pkgconfig, gtk-doc
+, docbook_xml_dtd_43, python3, gobject-introspection, glib, udev, kmod, parted
 , cryptsetup, lvm2, dmraid, utillinux, libbytesize, libndctl, nss, volume_key
+, libxslt, docbook_xsl, gptfdisk, libyaml, autoconf-archive
+, thin-provisioning-tools, makeWrapper
 }:
-
-let
-  version = "2.20";
-in stdenv.mkDerivation rec {
-  name = "libblockdev-${version}";
+stdenv.mkDerivation rec {
+  pname = "libblockdev";
+  version = "2.22";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "libblockdev";
     rev = "${version}-1";
-    sha256 = "13xy8vx2dnnxczpnwapchc5ncigcxb2fhpmrmglbpkjqmhn2zbdj";
+    sha256 = "03y4ps37wbi9p1136q0xzgshfnrjg4lgy8pgm1a3ihfcjnbwrbnq";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -29,18 +29,25 @@ in stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    autoreconfHook pkgconfig gtk-doc libxslt docbook_xsl docbook_xml_dtd_43 python3 gobject-introspection
+    autoreconfHook pkgconfig gtk-doc libxslt docbook_xsl docbook_xml_dtd_43
+    python3 gobject-introspection autoconf-archive makeWrapper
   ];
 
   buildInputs = [
-    glib udev kmod parted gptfdisk cryptsetup lvm2 dmraid utillinux libbytesize libndctl nss volume_key libyaml
+    glib udev kmod parted gptfdisk cryptsetup lvm2 dmraid utillinux libbytesize
+    libndctl nss volume_key libyaml
   ];
 
+  postInstall = ''
+    wrapProgram $out/bin/lvm-cache-stats --prefix PATH : \
+      ${stdenv.lib.makeBinPath [ thin-provisioning-tools ]}
+  '';
+
   meta = with stdenv.lib; {
     description = "A library for manipulating block devices";
-    homepage = http://storaged.org/libblockdev/;
-    license = licenses.lgpl2Plus; # lgpl2Plus for the library, gpl2Plus for the utils
-    maintainers = with maintainers; [];
+    homepage = "http://storaged.org/libblockdev/";
+    license = with licenses; [ lgpl2Plus gpl2Plus ]; # lgpl2Plus for the library, gpl2Plus for the utils
+    maintainers = with maintainers; [ johnazoidberg ];
     platforms = platforms.linux;
   };
 }

pkgs/development/libraries/libelf/default.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   name = "libelf-0.8.13";
 
   src = fetchurl {
-    url = "http://www.mr511.de/software/${name}.tar.gz";
+    url = "https://fossies.org/linux/misc/old/${name}.tar.gz";
     sha256 = "0vf7s9dwk2xkmhb79aigqm0x0yfbw1j0b9ksm51207qwr179n6jr";
   };
 

pkgs/development/libraries/libgdata/default.nix

@@ -1,5 +1,6 @@
 { stdenv
 , fetchurl
+, fetchpatch
 , pkgconfig
 , meson
 , ninja
@@ -31,6 +32,21 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./installed-tests-path.patch
+    (fetchpatch {
+      # Meson fixes
+      url = "https://gitlab.gnome.org/GNOME/libgdata/commit/f6d0e3f3b6fa8e8ee9569372c5709c1fb84af2c1.diff";
+      sha256 = "00yrppn0s21i41r9mwzvrrv7j5dida09kh7i44kv8hrbrlfag7bm";
+    })
+    (fetchpatch {
+      # Meson minor fixes
+      url = "https://gitlab.gnome.org/GNOME/libgdata/commit/b653f602b3c2b518101c5d909e1651534c22757a.diff";
+      sha256 = "1bn0rffsvkzjl59aw8dmq1wil58x1fshz0m6xabpn79ffvbjld8j";
+    })
+    (fetchpatch {
+      # Meson: Fix G_LOG_DOMAIN
+      url = "https://gitlab.gnome.org/GNOME/libgdata/commit/5d318e0bf905d0f1a8b3fe1e47ee7847739082e3.diff";
+      sha256 = "11i2blq811d53433kdq4hhsscgkrq5f50d9ih4ixgs3j47hg7b1w";
+    })
   ];
 
   nativeBuildInputs = [
@@ -45,7 +61,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gcr
     glib
-    gnome3.gnome-online-accounts
     liboauth
     libsoup
     libxml2
@@ -55,6 +70,7 @@ stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [
+    gnome3.gnome-online-accounts
     json-glib
   ];
 

pkgs/development/libraries/libtensorflow/default.nix

@@ -1,80 +0,0 @@
-{ config, stdenv
-, fetchurl
-, patchelf
-, cudaSupport ? config.cudaSupport or false, symlinkJoin, cudatoolkit, cudnn, nvidia_x11
-}:
-with stdenv.lib;
-let
-  tfType = if cudaSupport then "gpu" else "cpu";
-  system =
-    if stdenv.isx86_64
-    then if      stdenv.isLinux  then "linux-x86_64"
-         else if stdenv.isDarwin then "darwin-x86_64" else unavailable
-    else unavailable;
-  unavailable = throw "libtensorflow is not available for this platform!";
-  cudatoolkit_joined = symlinkJoin {
-    name = "unsplit_cudatoolkit";
-    paths = [ cudatoolkit.out
-              cudatoolkit.lib ];};
-  rpath = makeLibraryPath ([stdenv.cc.libc stdenv.cc.cc.lib] ++
-            optionals cudaSupport [ cudatoolkit_joined cudnn nvidia_x11 ]);
-  patchLibs =
-    if stdenv.isDarwin
-    then ''
-      install_name_tool -id $out/lib/libtensorflow.so $out/lib/libtensorflow.so
-      install_name_tool -id $out/lib/libtensorflow_framework.so $out/lib/libtensorflow_framework.so
-    ''
-    else ''
-      ${patchelf}/bin/patchelf --set-rpath "${rpath}:$out/lib" $out/lib/libtensorflow.so
-      ${patchelf}/bin/patchelf --set-rpath "${rpath}" $out/lib/libtensorflow_framework.so
-    '';
-
-in stdenv.mkDerivation rec {
-  pname = "libtensorflow";
-  version = "1.9.0";
-  name = "${pname}-${version}";
-  src = fetchurl {
-    url = "https://storage.googleapis.com/tensorflow/${pname}/${pname}-${tfType}-${system}-${version}.tar.gz";
-    sha256 =
-      if system == "linux-x86_64" then
-        if cudaSupport
-        then "1q3mh06x344im25z7r3vgrfksfdsi8fh8ldn6y2mf86h4d11yxc3"
-        else "0l9ps115ng5ffzdwphlqmj3jhidps2v5afppdzrbpzmy41xz0z21"
-      else if system == "darwin-x86_64" then
-        if cudaSupport
-        then unavailable
-        else "1qj0v1706w6mczycdsh38h2glyv5d25v62kdn98wxd5rw8f9v657"
-      else unavailable;
-  };
-
-  # Patch library to use our libc, libstdc++ and others
-  buildCommand = ''
-    . $stdenv/setup
-    mkdir -pv $out
-    tar -C $out -xzf $src
-    chmod +w $out/lib/libtensorflow.so
-    chmod +w $out/lib/libtensorflow_framework.so
-    ${patchLibs}
-    chmod -w $out/lib/libtensorflow.so
-    chmod -w $out/lib/libtensorflow_framework.so
-
-    # Write pkgconfig file.
-    mkdir $out/lib/pkgconfig
-    cat > $out/lib/pkgconfig/tensorflow.pc << EOF
-    Name: TensorFlow
-    Version: ${version}
-    Description: Library for computation using data flow graphs for scalable machine learning
-    Requires:
-    Libs: -L$out/lib -ltensorflow
-    Cflags: -I$out/include/tensorflow
-    EOF
-  '';
-
-  meta = {
-    description = "C API for TensorFlow";
-    homepage = https://www.tensorflow.org/versions/master/install/install_c;
-    license = licenses.asl20;
-    platforms = with platforms; linux ++ darwin;
-    maintainers = [maintainers.basvandijk];
-  };
-}

pkgs/development/libraries/qt-5/5.12/default.nix

@@ -60,6 +60,7 @@ let
     qtserialport = [ ./qtserialport.patch ];
     qtwebengine = [
       ./qtwebengine-no-build-skip.patch
+      ./qtwebengine-CVE-2019-5786.patch
     ]
       ++ optional stdenv.isDarwin ./qtwebengine-darwin-no-platform-check.patch;
     qtwebkit = [ ./qtwebkit.patch ]

pkgs/development/libraries/qt-5/5.12/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( http://download.qt.io/official_releases/qt/5.12/5.12.3/submodules/ )
+WGET_ARGS=( http://download.qt.io/official_releases/qt/5.12/5.12.0/submodules/ )

pkgs/development/libraries/qt-5/5.12/qtbase.patch

@@ -1,7 +1,8 @@
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/common/mac.conf qtbase-everywhere-src-5.12.3-b/mkspecs/common/mac.conf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/common/mac.conf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/common/mac.conf	2019-07-10 09:35:08.917628566 -0500
-@@ -24,7 +24,7 @@
+diff --git a/mkspecs/common/mac.conf b/mkspecs/common/mac.conf
+index 61bea952b2..9909dae726 100644
+--- a/mkspecs/common/mac.conf
++++ b/mkspecs/common/mac.conf
+@@ -23,7 +23,7 @@ QMAKE_INCDIR_OPENGL     = \
  
  QMAKE_FIX_RPATH         = install_name_tool -id
  
@@ -10,10 +11,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/common/mac.conf qtbase-everywhe
  QMAKE_LFLAGS_GCSECTIONS = -Wl,-dead_strip
  
  QMAKE_LFLAGS_REL_RPATH  =
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/create_cmake.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/create_cmake.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/create_cmake.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/create_cmake.prf	2019-07-10 09:35:08.917628566 -0500
-@@ -21,7 +21,7 @@
+diff --git a/mkspecs/features/create_cmake.prf b/mkspecs/features/create_cmake.prf
+index 2ed708e085..05e60ff45f 100644
+--- a/mkspecs/features/create_cmake.prf
++++ b/mkspecs/features/create_cmake.prf
+@@ -21,7 +21,7 @@ load(cmake_functions)
  # at cmake time whether package has been found via a symlink, and correct
  # that to an absolute path. This is only done for installations to
  # the /usr or / prefix.
@@ -22,7 +24,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/create_cmake.prf qtbas
  contains(CMAKE_INSTALL_LIBS_DIR, ^(/usr)?/lib(64)?.*): CMAKE_USR_MOVE_WORKAROUND = $$CMAKE_INSTALL_LIBS_DIR
  
  CMAKE_OUT_DIR = $$MODULE_BASE_OUTDIR/lib/cmake
-@@ -51,45 +51,20 @@
+@@ -51,45 +51,20 @@ split_incpath {
          $$cmake_extra_source_includes.output
  }
  
@@ -79,7 +81,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/create_cmake.prf qtbas
  
  static|staticlib:CMAKE_STATIC_TYPE = true
  
-@@ -169,7 +144,7 @@
+@@ -169,7 +144,7 @@ contains(CONFIG, plugin) {
        cmake_target_file
  
      cmake_qt5_plugin_file.files = $$cmake_target_file.output
@@ -88,7 +90,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/create_cmake.prf qtbas
      INSTALLS += cmake_qt5_plugin_file
  
      return()
-@@ -318,7 +293,7 @@
+@@ -316,7 +291,7 @@ exists($$cmake_macros_file.input) {
      cmake_qt5_module_files.files += $$cmake_macros_file.output
  }
  
@@ -97,10 +99,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/create_cmake.prf qtbas
  
  # We are generating cmake files. Most developers of Qt are not aware of cmake,
  # so we require automatic tests to be available. The only module which should
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in qtbase-everywhere-src-5.12.3-b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in	2019-07-10 09:35:08.917628566 -0500
-@@ -3,30 +3,6 @@
+diff --git a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+index 3ed6dd5889..4c7c8da21a 100644
+--- a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+@@ -3,30 +3,6 @@ if (CMAKE_VERSION VERSION_LESS 3.1.0)
      message(FATAL_ERROR \"Qt 5 $${CMAKE_MODULE_NAME} module requires at least CMake version 3.1.0\")
  endif()
  
@@ -131,7 +134,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
  !!IF !equals(TEMPLATE, aux)
  # For backwards compatibility only. Use Qt5$${CMAKE_MODULE_NAME}_VERSION instead.
  set(Qt5$${CMAKE_MODULE_NAME}_VERSION_STRING "$$eval(QT.$${MODULE}.VERSION)")
-@@ -52,11 +28,7 @@
+@@ -52,11 +28,7 @@ endmacro()
  macro(_populate_$${CMAKE_MODULE_NAME}_target_properties Configuration LIB_LOCATION IMPLIB_LOCATION)
      set_property(TARGET Qt5::$${CMAKE_MODULE_NAME} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
  
@@ -143,7 +146,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
      _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
      set_target_properties(Qt5::$${CMAKE_MODULE_NAME} PROPERTIES
          \"INTERFACE_LINK_LIBRARIES\" \"${_Qt5$${CMAKE_MODULE_NAME}_LIB_DEPENDENCIES}\"
-@@ -69,11 +41,7 @@
+@@ -69,11 +41,7 @@ macro(_populate_$${CMAKE_MODULE_NAME}_target_properties Configuration LIB_LOCATI
      )
  
  !!IF !isEmpty(CMAKE_WINDOWS_BUILD)
@@ -155,7 +158,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
      _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_implib})
      if(NOT \"${IMPLIB_LOCATION}\" STREQUAL \"\")
          set_target_properties(Qt5::$${CMAKE_MODULE_NAME} PROPERTIES
-@@ -89,24 +57,13 @@
+@@ -89,24 +57,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
  !!IF !no_module_headers
  !!IF !isEmpty(CMAKE_BUILD_IS_FRAMEWORK)
      set(_Qt5$${CMAKE_MODULE_NAME}_OWN_INCLUDE_DIRS
@@ -184,7 +187,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
      )
  !!ELSE
      set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
-@@ -122,7 +79,6 @@
+@@ -122,7 +79,6 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
      set(Qt5$${CMAKE_MODULE_NAME}_PRIVATE_INCLUDE_DIRS \"\")
  !!ENDIF
  !!ENDIF
@@ -192,7 +195,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
  !!IF !isEmpty(CMAKE_ADD_SOURCE_INCLUDE_DIRS)
      include(\"${CMAKE_CURRENT_LIST_DIR}/ExtraSourceIncludes.cmake\" OPTIONAL)
  !!ENDIF
-@@ -272,25 +228,13 @@
+@@ -272,25 +228,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
  !!IF !isEmpty(CMAKE_FIND_OTHER_LIBRARY_BUILD)
  !!IF isEmpty(CMAKE_DEBUG_TYPE)
  !!IF !isEmpty(CMAKE_STATIC_WINDOWS_BUILD)
@@ -218,7 +221,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
          _populate_$${CMAKE_MODULE_NAME}_target_properties(DEBUG \"$${CMAKE_LIB_FILE_LOCATION_DEBUG}\" \"$${CMAKE_IMPLIB_FILE_LOCATION_DEBUG}\" )
  !!ENDIF // CMAKE_STATIC_WINDOWS_BUILD
      endif()
-@@ -309,25 +253,13 @@
+@@ -309,25 +253,13 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
  !!IF !isEmpty(CMAKE_FIND_OTHER_LIBRARY_BUILD)
  !!IF isEmpty(CMAKE_RELEASE_TYPE)
  !!IF !isEmpty(CMAKE_STATIC_WINDOWS_BUILD)
@@ -244,7 +247,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
          _populate_$${CMAKE_MODULE_NAME}_target_properties(RELEASE \"$${CMAKE_LIB_FILE_LOCATION_RELEASE}\" \"$${CMAKE_IMPLIB_FILE_LOCATION_RELEASE}\" )
  !!ENDIF // CMAKE_STATIC_WINDOWS_BUILD
      endif()
-@@ -346,11 +278,7 @@
+@@ -346,11 +278,7 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
      macro(_populate_$${CMAKE_MODULE_NAME}_plugin_properties Plugin Configuration PLUGIN_LOCATION)
          set_property(TARGET Qt5::${Plugin} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
  
@@ -256,17 +259,19 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/data/cmake/Qt5BasicCon
          _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
          set_target_properties(Qt5::${Plugin} PROPERTIES
              \"IMPORTED_LOCATION_${Configuration}\" ${imported_location}
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/default_post.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/mac/default_post.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/default_post.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/mac/default_post.prf	2019-07-10 09:35:08.917628566 -0500
-@@ -64,202 +64,6 @@
+diff --git a/mkspecs/features/mac/default_post.prf b/mkspecs/features/mac/default_post.prf
+index 99f68b78f5..dde69cb7c2 100644
+--- a/mkspecs/features/mac/default_post.prf
++++ b/mkspecs/features/mac/default_post.prf
+@@ -63,199 +63,3 @@ qt {
+         }
      }
  }
- 
+-
 -# Add the same default rpaths as Xcode does for new projects.
 -# This is especially important for iOS/tvOS/watchOS where no other option is possible.
 -!no_default_rpath {
--    QMAKE_RPATHDIR += @executable_path/../Frameworks
+-    QMAKE_RPATHDIR += @executable_path/Frameworks
 -    equals(TEMPLATE, lib):!plugin:lib_bundle: QMAKE_RPATHDIR += @loader_path/Frameworks
 -}
 -
@@ -458,13 +463,10 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/default_post.prf q
 -    xcode_product_bundle_target = ${PRODUCT_NAME:rfc1034identifier}
 -xcode_product_bundle_identifier_setting.value = "$${xcode_product_bundle_identifier_setting.value}.$${xcode_product_bundle_target}"
 -QMAKE_MAC_XCODE_SETTINGS += xcode_product_bundle_identifier_setting
--
- !macx-xcode {
-     generate_xcode_project.commands = @$(QMAKE) -spec macx-xcode $(EXPORT__PRO_FILE_)
-     generate_xcode_project.target = xcodeproj
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/default_pre.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/mac/default_pre.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/default_pre.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/mac/default_pre.prf	2019-07-10 09:35:08.917628566 -0500
+diff --git a/mkspecs/features/mac/default_pre.prf b/mkspecs/features/mac/default_pre.prf
+index e3534561a5..3b01424e67 100644
+--- a/mkspecs/features/mac/default_pre.prf
++++ b/mkspecs/features/mac/default_pre.prf
 @@ -1,60 +1,2 @@
  CONFIG = asset_catalogs rez $$CONFIG
  load(default_pre)
@@ -526,10 +528,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/default_pre.prf qt
 -xcode_copy_phase_strip_setting.name = COPY_PHASE_STRIP
 -xcode_copy_phase_strip_setting.value = NO
 -QMAKE_MAC_XCODE_SETTINGS += xcode_copy_phase_strip_setting
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/sdk.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/mac/sdk.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/sdk.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/mac/sdk.prf	2019-07-10 09:35:08.917628566 -0500
-@@ -1,54 +1 @@
+diff --git a/mkspecs/features/mac/sdk.prf b/mkspecs/features/mac/sdk.prf
+index 8360dd8b38..8b13789179 100644
+--- a/mkspecs/features/mac/sdk.prf
++++ b/mkspecs/features/mac/sdk.prf
+@@ -1,58 +1 @@
  
 -isEmpty(QMAKE_MAC_SDK): \
 -    error("QMAKE_MAC_SDK must be set when using CONFIG += sdk.")
@@ -565,6 +568,10 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/sdk.prf qtbase-eve
 -QMAKE_MAC_SDK_PLATFORM_PATH = $$xcodeSDKInfo(PlatformPath)
 -QMAKE_MAC_SDK_VERSION = $$xcodeSDKInfo(SDKVersion)
 -
+-sysrootified =
+-for(val, QMAKE_INCDIR_OPENGL): sysrootified += $${QMAKE_MAC_SDK_PATH}$$val
+-QMAKE_INCDIR_OPENGL = $$sysrootified
+-
 -QMAKESPEC_NAME = $$basename(QMAKESPEC)
 -
 -# Resolve SDK version of various tools
@@ -584,34 +591,37 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/mac/sdk.prf qtbase-eve
 -    $$tool = $$sysrooted $$member(value, 1, -1)
 -    cache($$tool_variable, set stash, $$tool)
 -}
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qml_module.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qml_module.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qml_module.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qml_module.prf	2019-07-10 09:35:08.917628566 -0500
-@@ -54,7 +54,7 @@
- 
- qmldir.files = $$qmldir_file
+diff --git a/mkspecs/features/qml_module.prf b/mkspecs/features/qml_module.prf
+index 65212b2abf..accd4c07f0 100644
+--- a/mkspecs/features/qml_module.prf
++++ b/mkspecs/features/qml_module.prf
+@@ -52,7 +52,7 @@ qmldir.base = $$_PRO_FILE_PWD_
+ # Tools need qmldir and plugins.qmltypes always installed on the file system
+ qmldir.files = $$qmldir_file $$fq_aux_qml_files
  install_qml_files: qmldir.files += $$fq_qml_files
--qmldir.path = $$[QT_INSTALL_QML]/$$TARGETPATH
+-qmldir.path = $$instbase/$$TARGETPATH
 +qmldir.path = $$NIX_OUTPUT_QML/$$TARGETPATH
  INSTALLS += qmldir
  
- qmlfiles.base = $$_PRO_FILE_PWD_
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qml_plugin.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qml_plugin.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qml_plugin.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qml_plugin.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -50,7 +50,7 @@
+ !debug_and_release|!build_all|CONFIG(release, debug|release) {
+diff --git a/mkspecs/features/qml_plugin.prf b/mkspecs/features/qml_plugin.prf
+index cd6377dcc6..e98bf98151 100644
+--- a/mkspecs/features/qml_plugin.prf
++++ b/mkspecs/features/qml_plugin.prf
+@@ -56,7 +56,7 @@ qml1_target {
+     instbase = $$[QT_INSTALL_QML]
+ }
  
- DESTDIR = $$MODULE_BASE_OUTDIR/qml/$$TARGETPATH
- 
--target.path = $$[QT_INSTALL_QML]/$$TARGETPATH
+-target.path = $$instbase/$$TARGETPATH
 +target.path = $$NIX_OUTPUT_QML/$$TARGETPATH
  INSTALLS += target
  
  # Some final setup
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_app.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_app.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_app.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_app.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -30,7 +30,7 @@
+diff --git a/mkspecs/features/qt_app.prf b/mkspecs/features/qt_app.prf
+index 8354f30eea..62028fef8e 100644
+--- a/mkspecs/features/qt_app.prf
++++ b/mkspecs/features/qt_app.prf
+@@ -30,7 +30,7 @@ host_build:force_bootstrap {
      target.path = $$[QT_HOST_BINS]
  } else {
      !build_pass:qtConfig(debug_and_release): CONFIG += release
@@ -620,10 +630,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_app.prf qtbase-ever
      CONFIG += relative_qt_rpath  # Qt's tools and apps should be relocatable
  }
  INSTALLS += target
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_build_paths.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_build_paths.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_build_paths.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_build_paths.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -24,6 +24,6 @@
+diff --git a/mkspecs/features/qt_build_paths.prf b/mkspecs/features/qt_build_paths.prf
+index 3bb3823a8e..655b7b7db8 100644
+--- a/mkspecs/features/qt_build_paths.prf
++++ b/mkspecs/features/qt_build_paths.prf
+@@ -24,6 +24,6 @@ exists($$MODULE_BASE_INDIR/.git): \
  !force_independent {
      # If the module is not built independently, everything ends up in qtbase.
      # This is the case in non-prefix builds, except for selected modules.
@@ -632,10 +643,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_build_paths.prf qtb
 +    MODULE_BASE_OUTDIR = $$NIX_OUTPUT_OUT
 +    MODULE_QMAKE_OUTDIR = $$NIX_OUTPUT_OUT
  }
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_common.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_common.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_common.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_common.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -34,8 +34,8 @@
+diff --git a/mkspecs/features/qt_common.prf b/mkspecs/features/qt_common.prf
+index 4ad9946ae0..6d66f29c26 100644
+--- a/mkspecs/features/qt_common.prf
++++ b/mkspecs/features/qt_common.prf
+@@ -34,8 +34,8 @@ contains(TEMPLATE, .*lib) {
          qqt_libdir = \$\$\$\$[QT_HOST_LIBS]
          qt_libdir = $$[QT_HOST_LIBS]
      } else {
@@ -646,10 +658,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_common.prf qtbase-e
      }
      contains(QMAKE_DEFAULT_LIBDIRS, $$qt_libdir) {
          lib_replace.match = "[^ ']*$$rplbase/lib"
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_docs.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_docs.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_docs.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_docs.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -45,7 +45,7 @@
+diff --git a/mkspecs/features/qt_docs.prf b/mkspecs/features/qt_docs.prf
+index 3139c443c6..1b4f2fddd8 100644
+--- a/mkspecs/features/qt_docs.prf
++++ b/mkspecs/features/qt_docs.prf
+@@ -45,7 +45,7 @@ QMAKE_DOCS_OUTPUTDIR = $$QMAKE_DOCS_BASE_OUTDIR/$$QMAKE_DOCS_TARGETDIR
  
  QDOC += -outputdir $$shell_quote($$QMAKE_DOCS_OUTPUTDIR)
  !build_online_docs: \
@@ -658,7 +671,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_docs.prf qtbase-eve
  PREP_DOC_INDEXES =
  DOC_INDEXES =
  !isEmpty(QTREPOS) {
-@@ -64,8 +64,8 @@
+@@ -64,8 +64,8 @@ DOC_INDEXES =
          DOC_INDEXES += -indexdir $$shell_quote($$qrep/doc)
  } else {
      prepare_docs: \
@@ -669,7 +682,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_docs.prf qtbase-eve
  }
  
  qtattributionsscanner.target = qtattributionsscanner
-@@ -88,12 +88,12 @@
+@@ -88,12 +88,12 @@ prepare_docs {
      qch_docs.commands = $$QHELPGENERATOR $$shell_quote($$QMAKE_DOCS_OUTPUTDIR/$${QMAKE_DOCS_TARGET}.qhp) -o $$shell_quote($$QMAKE_DOCS_BASE_OUTDIR/$${QMAKE_DOCS_TARGET}.qch)
  
      inst_html_docs.files = $$QMAKE_DOCS_OUTPUTDIR
@@ -684,10 +697,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_docs.prf qtbase-eve
      inst_qch_docs.CONFIG += no_check_exist no_default_install no_build
      INSTALLS += inst_qch_docs
  
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_example_installs.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_example_installs.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_example_installs.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_example_installs.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -88,7 +88,7 @@
+diff --git a/mkspecs/features/qt_example_installs.prf b/mkspecs/features/qt_example_installs.prf
+index 43b58817fe..e635b8f67a 100644
+--- a/mkspecs/features/qt_example_installs.prf
++++ b/mkspecs/features/qt_example_installs.prf
+@@ -88,7 +88,7 @@ sourcefiles += \
      $$SOURCES $$HEADERS $$FORMS $$RESOURCES $$TRANSLATIONS \
      $$DBUS_ADAPTORS $$DBUS_INTERFACES
  addInstallFiles(sources.files, $$sourcefiles)
@@ -696,10 +710,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_example_installs.pr
  INSTALLS += sources
  
  check_examples {
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_functions.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_functions.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_functions.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_functions.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -69,7 +69,7 @@
+diff --git a/mkspecs/features/qt_functions.prf b/mkspecs/features/qt_functions.prf
+index 1903e509c8..ae7b585989 100644
+--- a/mkspecs/features/qt_functions.prf
++++ b/mkspecs/features/qt_functions.prf
+@@ -69,7 +69,7 @@ defineTest(qtHaveModule) {
  defineTest(qtPrepareTool) {
      cmd = $$eval(QT_TOOL.$${2}.binary)
      isEmpty(cmd) {
@@ -708,9 +723,10 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_functions.prf qtbas
          exists($${cmd}.pl) {
              $${1}_EXE = $${cmd}.pl
              cmd = perl -w $$system_path($${cmd}.pl)
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_installs.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_installs.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_installs.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_installs.prf	2019-07-10 09:35:08.918628595 -0500
+diff --git a/mkspecs/features/qt_installs.prf b/mkspecs/features/qt_installs.prf
+index 8f98987b99..21b3bb8b32 100644
+--- a/mkspecs/features/qt_installs.prf
++++ b/mkspecs/features/qt_installs.prf
 @@ -12,16 +12,10 @@
  #library
  !qt_no_install_library {
@@ -730,7 +746,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_installs.prf qtbase
      !static: target.CONFIG = no_dll
      INSTALLS += target
  }
-@@ -29,35 +23,35 @@
+@@ -29,33 +23,33 @@
  #headers
  qt_install_headers {
      gen_headers.files = $$SYNCQT.GENERATED_HEADER_FILES
@@ -746,8 +762,6 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_installs.prf qtbase
      private_headers.files = $$SYNCQT.PRIVATE_HEADER_FILES $$SYNCQT.INJECTED_PRIVATE_HEADER_FILES
 -    private_headers.path = $$[QT_INSTALL_HEADERS]/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/private
 +    private_headers.path = $$NIX_OUTPUT_DEV/include/$$MODULE_INCNAME/$$VERSION/$$MODULE_INCNAME/private
-     generated_privates: \
-         private_headers.CONFIG += no_check_exist
      INSTALLS += private_headers
  
      qpa_headers.files = $$SYNCQT.QPA_HEADER_FILES
@@ -772,10 +786,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_installs.prf qtbase
          privpritarget.files = $$MODULE_PRIVATE_PRI
          INSTALLS += privpritarget
      }
-diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_plugin.prf qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_plugin.prf
---- qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_plugin.prf	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/mkspecs/features/qt_plugin.prf	2019-07-10 09:35:08.918628595 -0500
-@@ -88,7 +88,7 @@
+diff --git a/mkspecs/features/qt_plugin.prf b/mkspecs/features/qt_plugin.prf
+index 40528a65e2..903f795284 100644
+--- a/mkspecs/features/qt_plugin.prf
++++ b/mkspecs/features/qt_plugin.prf
+@@ -88,7 +88,7 @@ CONFIG(static, static|shared)|prefix_build {
      }
  }
  
@@ -784,10 +799,84 @@ diff -aur qtbase-everywhere-src-5.12.3-a/mkspecs/features/qt_plugin.prf qtbase-e
  INSTALLS += target
  
  TARGET = $$qt5LibraryTarget($$TARGET)
-diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/kernel/qcoreapplication.cpp qtbase-everywhere-src-5.12.3-b/src/corelib/kernel/qcoreapplication.cpp
---- qtbase-everywhere-src-5.12.3-a/src/corelib/kernel/qcoreapplication.cpp	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/corelib/kernel/qcoreapplication.cpp	2019-07-10 09:35:08.919628625 -0500
-@@ -2668,6 +2668,15 @@
+diff --git a/src/corelib/Qt5CoreConfigExtras.cmake.in b/src/corelib/Qt5CoreConfigExtras.cmake.in
+index e0652fdcf9..450b2a2d28 100644
+--- a/src/corelib/Qt5CoreConfigExtras.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtras.cmake.in
+@@ -3,7 +3,7 @@ if (NOT TARGET Qt5::qmake)
+     add_executable(Qt5::qmake IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -18,7 +18,7 @@ if (NOT TARGET Qt5::moc)
+     add_executable(Qt5::moc IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -35,7 +35,7 @@ if (NOT TARGET Qt5::rcc)
+     add_executable(Qt5::rcc IMPORTED)
+ 
+ !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
+ !!ENDIF
+@@ -116,7 +116,7 @@ if (NOT TARGET Qt5::WinMain)
+ !!IF !isEmpty(CMAKE_RELEASE_TYPE)
+     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
+ !!ENDIF
+@@ -130,7 +130,7 @@ if (NOT TARGET Qt5::WinMain)
+     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
+ 
+ !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
+-    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
++    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
+ !!ELSE
+     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
+ !!ENDIF
+diff --git a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
+index c357237d0e..6f0c75de3c 100644
+--- a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
+@@ -1,6 +1,6 @@
+ 
+ !!IF isEmpty(CMAKE_HOST_DATA_DIR_IS_ABSOLUTE)
+-set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
++set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
+ !!ELSE
+ set(_qt5_corelib_extra_includes \"$${CMAKE_HOST_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
+ !!ENDIF
+diff --git a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
+index 706304cf34..546420f6ad 100644
+--- a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
++++ b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
+@@ -1,6 +1,6 @@
+ 
+ !!IF isEmpty(CMAKE_INSTALL_DATA_DIR_IS_ABSOLUTE)
+-set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
++set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
+ !!ELSE
+ set(_qt5_corelib_extra_includes \"$${CMAKE_INSTALL_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
+ !!ENDIF
+diff --git a/src/corelib/kernel/qcoreapplication.cpp b/src/corelib/kernel/qcoreapplication.cpp
+index 463e30e1c3..0e1ab669e4 100644
+--- a/src/corelib/kernel/qcoreapplication.cpp
++++ b/src/corelib/kernel/qcoreapplication.cpp
+@@ -2665,6 +2665,15 @@ QStringList QCoreApplication::libraryPaths()
          QStringList *app_libpaths = new QStringList;
          coreappdata()->app_libpaths.reset(app_libpaths);
  
@@ -800,117 +889,14 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/kernel/qcoreapplication.cpp
 +            }
 +        }
 +
-         QString libPathEnv = qEnvironmentVariable("QT_PLUGIN_PATH");
+         const QByteArray libPathEnv = qgetenv("QT_PLUGIN_PATH");
          if (!libPathEnv.isEmpty()) {
-             QStringList paths = libPathEnv.split(QDir::listSeparator(), QString::SkipEmptyParts);
-diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/kernel/qcore_mac_p.h qtbase-everywhere-src-5.12.3-b/src/corelib/kernel/qcore_mac_p.h
---- qtbase-everywhere-src-5.12.3-a/src/corelib/kernel/qcore_mac_p.h	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/corelib/kernel/qcore_mac_p.h	2019-07-10 09:35:08.920628655 -0500
-@@ -212,7 +212,7 @@
- 
- // --------------------------------------------------------------------------
- 
--#if !defined(QT_BOOTSTRAPPED)
-+#if 0
- 
- QT_END_NAMESPACE
- #include <os/activity.h>
-@@ -290,7 +290,19 @@
- 
- #define QT_APPLE_SCOPED_LOG_ACTIVITY(...) QAppleLogActivity scopedLogActivity = QT_APPLE_LOG_ACTIVITY(__VA_ARGS__).enter();
- 
--#endif // !defined(QT_BOOTSTRAPPED)
-+#else // !defined(QT_BOOTSTRAPPED)
-+
-+#define QT_APPLE_LOG_ACTIVITY_WITH_PARENT3(...)
-+#define QT_APPLE_LOG_ACTIVITY_WITH_PARENT2(...)
-+#define QT_APPLE_LOG_ACTIVITY_WITH_PARENT(...)
-+
-+#define QT_APPLE_LOG_ACTIVITY2(...)
-+#define QT_APPLE_LOG_ACTIVITY1(...)
-+#define QT_APPLE_LOG_ACTIVITY(...)
-+
-+#define QT_APPLE_SCOPED_LOG_ACTIVITY(...)
-+
-+#endif
- 
- // -------------------------------------------------------------------------
- 
-Only in qtbase-everywhere-src-5.12.3-b/src/corelib/kernel: qcore_mac_p.h.orig
-diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/Qt5CoreConfigExtras.cmake.in qtbase-everywhere-src-5.12.3-b/src/corelib/Qt5CoreConfigExtras.cmake.in
---- qtbase-everywhere-src-5.12.3-a/src/corelib/Qt5CoreConfigExtras.cmake.in	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/corelib/Qt5CoreConfigExtras.cmake.in	2019-07-10 09:35:08.918628595 -0500
-@@ -3,7 +3,7 @@
-     add_executable(Qt5::qmake IMPORTED)
- 
- !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
--    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
-+    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
- !!ELSE
-     set(imported_location \"$${CMAKE_BIN_DIR}qmake$$CMAKE_BIN_SUFFIX\")
- !!ENDIF
-@@ -18,7 +18,7 @@
-     add_executable(Qt5::moc IMPORTED)
- 
- !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
--    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
-+    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
- !!ELSE
-     set(imported_location \"$${CMAKE_BIN_DIR}moc$$CMAKE_BIN_SUFFIX\")
- !!ENDIF
-@@ -35,7 +35,7 @@
-     add_executable(Qt5::rcc IMPORTED)
- 
- !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
--    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
-+    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
- !!ELSE
-     set(imported_location \"$${CMAKE_BIN_DIR}rcc$$CMAKE_BIN_SUFFIX\")
- !!ENDIF
-@@ -116,7 +116,7 @@
- !!IF !isEmpty(CMAKE_RELEASE_TYPE)
-     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS RELEASE)
- !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
--    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
-+    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
- !!ELSE
-     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_RELEASE}\")
- !!ENDIF
-@@ -130,7 +130,7 @@
-     set_property(TARGET Qt5::WinMain APPEND PROPERTY IMPORTED_CONFIGURATIONS DEBUG)
- 
- !!IF isEmpty(CMAKE_LIB_DIR_IS_ABSOLUTE)
--    set(imported_location \"${_qt5Core_install_prefix}/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
-+    set(imported_location \"$$NIX_OUTPUT_DEV/$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
- !!ELSE
-     set(imported_location \"$${CMAKE_LIB_DIR}$${CMAKE_WINMAIN_FILE_LOCATION_DEBUG}\")
- !!ENDIF
-diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in qtbase-everywhere-src-5.12.3-b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in
---- qtbase-everywhere-src-5.12.3-a/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/corelib/Qt5CoreConfigExtrasMkspecDir.cmake.in	2019-07-10 09:35:08.918628595 -0500
-@@ -1,6 +1,6 @@
- 
- !!IF isEmpty(CMAKE_HOST_DATA_DIR_IS_ABSOLUTE)
--set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
-+set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_HOST_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
- !!ELSE
- set(_qt5_corelib_extra_includes \"$${CMAKE_HOST_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
- !!ENDIF
-diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in qtbase-everywhere-src-5.12.3-b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in
---- qtbase-everywhere-src-5.12.3-a/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/corelib/Qt5CoreConfigExtrasMkspecDirForInstall.cmake.in	2019-07-10 09:35:08.918628595 -0500
-@@ -1,6 +1,6 @@
- 
- !!IF isEmpty(CMAKE_INSTALL_DATA_DIR_IS_ABSOLUTE)
--set(_qt5_corelib_extra_includes \"${_qt5Core_install_prefix}/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
-+set(_qt5_corelib_extra_includes \"$$NIX_OUTPUT_DEV/$${CMAKE_INSTALL_DATA_DIR}/mkspecs/$${CMAKE_MKSPEC}\")
- !!ELSE
- set(_qt5_corelib_extra_includes \"$${CMAKE_INSTALL_DATA_DIR}mkspecs/$${CMAKE_MKSPEC}\")
- !!ENDIF
-diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/tools/qtimezoneprivate_tz.cpp qtbase-everywhere-src-5.12.3-b/src/corelib/tools/qtimezoneprivate_tz.cpp
---- qtbase-everywhere-src-5.12.3-a/src/corelib/tools/qtimezoneprivate_tz.cpp	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/corelib/tools/qtimezoneprivate_tz.cpp	2019-07-10 09:35:08.919628625 -0500
-@@ -70,7 +70,11 @@
+             QStringList paths = QFile::decodeName(libPathEnv).split(QDir::listSeparator(), QString::SkipEmptyParts);
+diff --git a/src/corelib/tools/qtimezoneprivate_tz.cpp b/src/corelib/tools/qtimezoneprivate_tz.cpp
+index bed62a02bd..73158993f7 100644
+--- a/src/corelib/tools/qtimezoneprivate_tz.cpp
++++ b/src/corelib/tools/qtimezoneprivate_tz.cpp
+@@ -70,7 +70,11 @@ typedef QHash<QByteArray, QTzTimeZone> QTzTimeZoneHash;
  // Parse zone.tab table, assume lists all installed zones, if not will need to read directories
  static QTzTimeZoneHash loadTzTimeZones()
  {
@@ -923,7 +909,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/tools/qtimezoneprivate_tz.c
      if (!QFile::exists(path))
          path = QStringLiteral("/usr/lib/zoneinfo/zone.tab");
  
-@@ -644,12 +648,16 @@
+@@ -644,12 +648,16 @@ void QTzTimeZonePrivate::init(const QByteArray &ianaId)
          if (!tzif.open(QIODevice::ReadOnly))
              return;
      } else {
@@ -945,9 +931,10 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/corelib/tools/qtimezoneprivate_tz.c
          }
      }
  
-diff -aur qtbase-everywhere-src-5.12.3-a/src/dbus/Qt5DBusConfigExtras.cmake.in qtbase-everywhere-src-5.12.3-b/src/dbus/Qt5DBusConfigExtras.cmake.in
---- qtbase-everywhere-src-5.12.3-a/src/dbus/Qt5DBusConfigExtras.cmake.in	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/dbus/Qt5DBusConfigExtras.cmake.in	2019-07-10 09:35:08.919628625 -0500
+diff --git a/src/dbus/Qt5DBusConfigExtras.cmake.in b/src/dbus/Qt5DBusConfigExtras.cmake.in
+index 1d947159e2..b36865fc48 100644
+--- a/src/dbus/Qt5DBusConfigExtras.cmake.in
++++ b/src/dbus/Qt5DBusConfigExtras.cmake.in
 @@ -2,11 +2,7 @@
  if (NOT TARGET Qt5::qdbuscpp2xml)
      add_executable(Qt5::qdbuscpp2xml IMPORTED)
@@ -961,7 +948,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/dbus/Qt5DBusConfigExtras.cmake.in q
      _qt5_DBus_check_file_exists(${imported_location})
  
      set_target_properties(Qt5::qdbuscpp2xml PROPERTIES
-@@ -17,11 +13,7 @@
+@@ -17,11 +13,7 @@ endif()
  if (NOT TARGET Qt5::qdbusxml2cpp)
      add_executable(Qt5::qdbusxml2cpp IMPORTED)
  
@@ -974,9 +961,10 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/dbus/Qt5DBusConfigExtras.cmake.in q
      _qt5_DBus_check_file_exists(${imported_location})
  
      set_target_properties(Qt5::qdbusxml2cpp PROPERTIES
-diff -aur qtbase-everywhere-src-5.12.3-a/src/gui/Qt5GuiConfigExtras.cmake.in qtbase-everywhere-src-5.12.3-b/src/gui/Qt5GuiConfigExtras.cmake.in
---- qtbase-everywhere-src-5.12.3-a/src/gui/Qt5GuiConfigExtras.cmake.in	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/gui/Qt5GuiConfigExtras.cmake.in	2019-07-10 09:35:08.919628625 -0500
+diff --git a/src/gui/Qt5GuiConfigExtras.cmake.in b/src/gui/Qt5GuiConfigExtras.cmake.in
+index 07869efd7d..fb4183bada 100644
+--- a/src/gui/Qt5GuiConfigExtras.cmake.in
++++ b/src/gui/Qt5GuiConfigExtras.cmake.in
 @@ -2,7 +2,7 @@
  !!IF !isEmpty(CMAKE_ANGLE_EGL_DLL_RELEASE)
  
@@ -986,7 +974,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/gui/Qt5GuiConfigExtras.cmake.in qtb
  !!ELSE
  set(Qt5Gui_EGL_INCLUDE_DIRS \"$$CMAKE_INCLUDE_DIR/QtANGLE\")
  !!ENDIF
-@@ -17,13 +17,13 @@
+@@ -17,13 +17,13 @@ macro(_populate_qt5gui_gl_target_properties TargetName Configuration LIB_LOCATIO
      set_property(TARGET Qt5::${TargetName} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
  
  !!IF isEmpty(CMAKE_DLL_DIR_IS_ABSOLUTE)
@@ -1002,10 +990,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/gui/Qt5GuiConfigExtras.cmake.in qtb
  !!ELSE
      set(imported_implib \"$${CMAKE_LIB_DIR}${IMPLIB_LOCATION}\")
  !!ENDIF
-diff -aur qtbase-everywhere-src-5.12.3-a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp qtbase-everywhere-src-5.12.3-b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
---- qtbase-everywhere-src-5.12.3-a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp	2019-07-10 09:35:08.919628625 -0500
-@@ -265,12 +265,9 @@
+diff --git a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
+index b5a0a5bbeb..6c20305f4d 100644
+--- a/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
++++ b/src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp
+@@ -265,12 +265,9 @@ void TableGenerator::initPossibleLocations()
      m_possibleLocations.reserve(7);
      if (qEnvironmentVariableIsSet("QTCOMPOSE"))
          m_possibleLocations.append(QString::fromLocal8Bit(qgetenv("QTCOMPOSE")));
@@ -1019,10 +1008,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/plugins/platforminputcontexts/compo
  }
  
  QString TableGenerator::findComposeFile()
-diff -aur qtbase-everywhere-src-5.12.3-a/src/plugins/platforms/xcb/qxcbcursor.cpp qtbase-everywhere-src-5.12.3-b/src/plugins/platforms/xcb/qxcbcursor.cpp
---- qtbase-everywhere-src-5.12.3-a/src/plugins/platforms/xcb/qxcbcursor.cpp	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/plugins/platforms/xcb/qxcbcursor.cpp	2019-07-10 09:35:08.919628625 -0500
-@@ -317,10 +317,10 @@
+diff --git a/src/plugins/platforms/xcb/qxcbcursor.cpp b/src/plugins/platforms/xcb/qxcbcursor.cpp
+index 57629ac03a..8a7f219a98 100644
+--- a/src/plugins/platforms/xcb/qxcbcursor.cpp
++++ b/src/plugins/platforms/xcb/qxcbcursor.cpp
+@@ -316,10 +316,10 @@ QXcbCursor::QXcbCursor(QXcbConnection *conn, QXcbScreen *screen)
  #if QT_CONFIG(xcb_xlib) && QT_CONFIG(library)
      static bool function_ptrs_not_initialized = true;
      if (function_ptrs_not_initialized) {
@@ -1035,10 +1025,10 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/plugins/platforms/xcb/qxcbcursor.cp
              xcursorFound = xcursorLib.load();
          }
          if (xcursorFound) {
-Only in qtbase-everywhere-src-5.12.3-b/src/plugins/platforms/xcb: qxcbcursor.cpp.orig
-diff -aur qtbase-everywhere-src-5.12.3-a/src/plugins/platformthemes/gtk3/main.cpp qtbase-everywhere-src-5.12.3-b/src/plugins/platformthemes/gtk3/main.cpp
---- qtbase-everywhere-src-5.12.3-a/src/plugins/platformthemes/gtk3/main.cpp	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/plugins/platformthemes/gtk3/main.cpp	2019-07-10 09:35:08.919628625 -0500
+diff --git a/src/plugins/platformthemes/gtk3/main.cpp b/src/plugins/platformthemes/gtk3/main.cpp
+index fb1c425d8e..bb8bab9795 100644
+--- a/src/plugins/platformthemes/gtk3/main.cpp
++++ b/src/plugins/platformthemes/gtk3/main.cpp
 @@ -39,6 +39,7 @@
  
  #include <qpa/qplatformthemeplugin.h>
@@ -1047,7 +1037,7 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/plugins/platformthemes/gtk3/main.cp
  
  QT_BEGIN_NAMESPACE
  
-@@ -54,8 +55,22 @@
+@@ -54,8 +55,22 @@ public:
  QPlatformTheme *QGtk3ThemePlugin::create(const QString &key, const QStringList &params)
  {
      Q_UNUSED(params);
@@ -1071,21 +1061,10 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/plugins/platformthemes/gtk3/main.cp
  
      return 0;
  }
-diff -aur qtbase-everywhere-src-5.12.3-a/src/testlib/qappletestlogger.cpp qtbase-everywhere-src-5.12.3-b/src/testlib/qappletestlogger.cpp
---- qtbase-everywhere-src-5.12.3-a/src/testlib/qappletestlogger.cpp	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/testlib/qappletestlogger.cpp	2019-07-10 09:35:08.920628655 -0500
-@@ -43,7 +43,7 @@
- 
- QT_BEGIN_NAMESPACE
- 
--#if defined(QT_USE_APPLE_UNIFIED_LOGGING)
-+#if defined(QT_USE_APPLE_UNIFIED_LOGGING) && 0
- 
- using namespace QTestPrivate;
- 
-diff -aur qtbase-everywhere-src-5.12.3-a/src/testlib/qtestassert.h qtbase-everywhere-src-5.12.3-b/src/testlib/qtestassert.h
---- qtbase-everywhere-src-5.12.3-a/src/testlib/qtestassert.h	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/testlib/qtestassert.h	2019-07-10 09:35:08.919628625 -0500
+diff --git a/src/testlib/qtestassert.h b/src/testlib/qtestassert.h
+index 6498ea84ef..d821ced7fc 100644
+--- a/src/testlib/qtestassert.h
++++ b/src/testlib/qtestassert.h
 @@ -44,10 +44,13 @@
  
  QT_BEGIN_NAMESPACE
@@ -1102,10 +1081,11 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/testlib/qtestassert.h qtbase-everyw
  
  QT_END_NAMESPACE
  
-diff -aur qtbase-everywhere-src-5.12.3-a/src/widgets/Qt5WidgetsConfigExtras.cmake.in qtbase-everywhere-src-5.12.3-b/src/widgets/Qt5WidgetsConfigExtras.cmake.in
---- qtbase-everywhere-src-5.12.3-a/src/widgets/Qt5WidgetsConfigExtras.cmake.in	2019-04-09 04:51:26.000000000 -0500
-+++ qtbase-everywhere-src-5.12.3-b/src/widgets/Qt5WidgetsConfigExtras.cmake.in	2019-07-10 09:35:08.919628625 -0500
-@@ -3,7 +3,7 @@
+diff --git a/src/widgets/Qt5WidgetsConfigExtras.cmake.in b/src/widgets/Qt5WidgetsConfigExtras.cmake.in
+index 99d87e2e46..a4eab2aa72 100644
+--- a/src/widgets/Qt5WidgetsConfigExtras.cmake.in
++++ b/src/widgets/Qt5WidgetsConfigExtras.cmake.in
+@@ -3,7 +3,7 @@ if (NOT TARGET Qt5::uic)
      add_executable(Qt5::uic IMPORTED)
  
  !!IF isEmpty(CMAKE_BIN_DIR_IS_ABSOLUTE)
@@ -1114,3 +1094,63 @@ diff -aur qtbase-everywhere-src-5.12.3-a/src/widgets/Qt5WidgetsConfigExtras.cmak
  !!ELSE
      set(imported_location \"$${CMAKE_BIN_DIR}uic$$CMAKE_BIN_SUFFIX\")
  !!ENDIF
+diff --git a/src/corelib/kernel/qcore_mac_p.h b/src/corelib/kernel/qcore_mac_p.h
+index b14a494296..779c4eda95 100644
+--- a/src/corelib/kernel/qcore_mac_p.h
++++ b/src/corelib/kernel/qcore_mac_p.h
+@@ -211,7 +211,7 @@ private:
+ 
+ // --------------------------------------------------------------------------
+ 
+-#if !defined(QT_BOOTSTRAPPED)
++#if 0
+ 
+ QT_END_NAMESPACE
+ #include <os/activity.h>
+@@ -289,7 +289,19 @@ QT_MAC_WEAK_IMPORT(_os_activity_current);
+ 
+ #define QT_APPLE_SCOPED_LOG_ACTIVITY(...) QAppleLogActivity scopedLogActivity = QT_APPLE_LOG_ACTIVITY(__VA_ARGS__).enter();
+ 
+-#endif // !defined(QT_BOOTSTRAPPED)
++#else // !defined(QT_BOOTSTRAPPED)
++
++#define QT_APPLE_LOG_ACTIVITY_WITH_PARENT3(...)
++#define QT_APPLE_LOG_ACTIVITY_WITH_PARENT2(...)
++#define QT_APPLE_LOG_ACTIVITY_WITH_PARENT(...)
++
++#define QT_APPLE_LOG_ACTIVITY2(...)
++#define QT_APPLE_LOG_ACTIVITY1(...)
++#define QT_APPLE_LOG_ACTIVITY(...)
++
++#define QT_APPLE_SCOPED_LOG_ACTIVITY(...)
++
++#endif
+ 
+ // -------------------------------------------------------------------------
+ 
+diff --git a/src/testlib/qappletestlogger.cpp b/src/testlib/qappletestlogger.cpp
+index 2c1005ad80..244147ea7d 100644
+--- a/src/testlib/qappletestlogger.cpp
++++ b/src/testlib/qappletestlogger.cpp
+@@ -43,7 +43,7 @@
+ 
+ QT_BEGIN_NAMESPACE
+ 
+-#if defined(QT_USE_APPLE_UNIFIED_LOGGING)
++#if defined(QT_USE_APPLE_UNIFIED_LOGGING) && 0
+ 
+ using namespace QTestPrivate;
+ 
+diff --git a/src/testlib/qtestlog.cpp b/src/testlib/qtestlog.cpp
+index 1268730cc6..a50e9b0764 100644
+--- a/src/testlib/qtestlog.cpp
++++ b/src/testlib/qtestlog.cpp
+@@ -524,7 +524,7 @@ void QTestLog::addLogger(LogMode mode, const char *filename)
+ #endif
+     }
+ 
+-#if defined(QT_USE_APPLE_UNIFIED_LOGGING)
++#if defined(QT_USE_APPLE_UNIFIED_LOGGING) && 0
+     // Logger that also feeds messages to AUL. It needs to wrap the existing
+     // logger, as it needs to be able to short circuit the existing logger
+     // in case AUL prints to stderr.

pkgs/development/libraries/qt-5/5.12/qtwebengine-CVE-2019-5786.patch

@@ -0,0 +1,26 @@
+--- a/src/3rdparty/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
++++ b/src/3rdparty/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
+@@ -135,14 +135,16 @@
+   if (!raw_data_ || error_code_)
+     return nullptr;
+ 
+-  DOMArrayBuffer* result = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());
+-  if (finished_loading_) {
+-    array_buffer_result_ = result;
+-    AdjustReportedMemoryUsageToV8(
+-        -1 * static_cast<int64_t>(raw_data_->ByteLength()));
+-    raw_data_.reset();
++  if (!finished_loading_) {
++    return DOMArrayBuffer::Create(
++        ArrayBuffer::Create(raw_data_->Data(), raw_data_->ByteLength()));
+   }
+-  return result;
++  array_buffer_result_ = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());
++  AdjustReportedMemoryUsageToV8(-1 *
++                                static_cast<int64_t>(raw_data_->ByteLength()));
++
++  raw_data_.reset();
++  return array_buffer_result_;
+ }
+ 
+ String FileReaderLoader::StringResult() {

pkgs/development/libraries/qt-5/5.12/srcs.nix

@@ -3,323 +3,323 @@
 
 {
   qt3d = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qt3d-everywhere-src-5.12.3.tar.xz";
-      sha256 = "8997f07c816bbc6dd43fc2171801178bc65e704d35039998530cfa49837eaa7d";
-      name = "qt3d-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qt3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nii8qz8791ripmqd158qah40j2dj50zn7lmqksqz8gz2jfdqam1";
+      name = "qt3d-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtactiveqt-everywhere-src-5.12.3.tar.xz";
-      sha256 = "15a5fde0a069f402bea9f422d8d2c46af440d202122c6307c2a6be642d20dc0f";
-      name = "qtactiveqt-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtactiveqt-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0gkdx3mc6ysqlf0ci77kf9c961dc9sbi4j3z5q237d1w4js7ca52";
+      name = "qtactiveqt-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtandroidextras = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtandroidextras-everywhere-src-5.12.3.tar.xz";
-      sha256 = "866b3fbcfc2cbebdb83b5adec4e5d0bd29b0e0b0762d66fb3fef0b400e37254f";
-      name = "qtandroidextras-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtandroidextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0s083ngvya8bknp0bvgb3hyk6zr8shg8rmkzn98956dqz0xs3agm";
+      name = "qtandroidextras-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtbase = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtbase-everywhere-src-5.12.3.tar.xz";
-      sha256 = "fddfd8852ef7503febeed67b876d1425160869ae2b1ae8e10b3fb0fedc5fe701";
-      name = "qtbase-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtbase-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1jzfx8c0hzch0kmz2m4vkn65s7ikiymnm29lsymil4hfg0fj40sy";
+      name = "qtbase-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtcanvas3d = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtcanvas3d-everywhere-src-5.12.3.tar.xz";
-      sha256 = "c0821f1232c6bcd00648af9a5d1eade8e0397c6bfff60621e0fcdfc75561baea";
-      name = "qtcanvas3d-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtcanvas3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0a61z5amp409aq9v7j0fyk003fbz2i247idl7lgfbl4qqh0ry6xj";
+      name = "qtcanvas3d-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtcharts = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtcharts-everywhere-src-5.12.3.tar.xz";
-      sha256 = "820c94b2bf5d73e921fe99be1e3a03a6f012d96574a08e504d68db237522b3a9";
-      name = "qtcharts-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtcharts-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0l6lrrwqbqaf6agsghaw4ysm2vb6b4n9j5lgrs1i0q8h9i51rmww";
+      name = "qtcharts-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtconnectivity-everywhere-src-5.12.3.tar.xz";
-      sha256 = "01518cee71a8d53b9c2387f8c7facbcc2c4d63ab3b79462edfa06ba3bfeae661";
-      name = "qtconnectivity-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtconnectivity-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1912a4my72wcqmmdyj24wkwq9p9ih4gzzzvgiq75pfwyhnxa3g4f";
+      name = "qtconnectivity-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtdatavis3d-everywhere-src-5.12.3.tar.xz";
-      sha256 = "f6d073c4575542f8ff6de3ac3b6e8dde6ae2d87e98119de7a13bc984aa967313";
-      name = "qtdatavis3d-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdatavis3d-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0czlj088gf2r6w5ahh0p8n36lbwmds86mxqijshmhzax5cspxnjf";
+      name = "qtdatavis3d-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtdeclarative-everywhere-src-5.12.3.tar.xz";
-      sha256 = "839881cd6996e35c351bc7d560372ebb91e61f3688957c33248c4f31ea007fa7";
-      name = "qtdeclarative-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdeclarative-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0yr29hm3bqlwxcmna0bzyxw8k4hw3x8k3k4iiw2sw52p5c85izag";
+      name = "qtdeclarative-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtdoc = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtdoc-everywhere-src-5.12.3.tar.xz";
-      sha256 = "ce5e9d0f48d108c48d742ab2127ead735270d7b525103c6cf409683d7fc8334f";
-      name = "qtdoc-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtdoc-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1k8caa1nmc9nrhb29vq1qzaz608klnjxy509w6ppxlzz2zbpcr9h";
+      name = "qtdoc-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtgamepad = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtgamepad-everywhere-src-5.12.3.tar.xz";
-      sha256 = "5d046869e9646912936e3622efa755d85ccc8eddba91f5b12880cfb5e6489642";
-      name = "qtgamepad-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtgamepad-everywhere-src-5.12.0.tar.xz";
+      sha256 = "14b0np15gm5lzvip33pg6w9dfs065wwdfz18na28bhbxj6wh06ac";
+      name = "qtgamepad-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtgraphicaleffects = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtgraphicaleffects-everywhere-src-5.12.3.tar.xz";
-      sha256 = "772c98a009cc82ac290f868906c5aa719e4608ef3c5905d69ef7402b15924a73";
-      name = "qtgraphicaleffects-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtgraphicaleffects-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0m9l031zhw8il66ld8bj1lwqlc2xx89nl6dvssz1kl2d5nqqy1c1";
+      name = "qtgraphicaleffects-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtimageformats = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtimageformats-everywhere-src-5.12.3.tar.xz";
-      sha256 = "db5a9e784f9c327c1e6830b1550311024cc91202d3b8dde82cd0944164298be2";
-      name = "qtimageformats-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtimageformats-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0bkkk5skpplwfbqv7g41rhgynyxs3khvf8gk2rl2gdixdplpv42z";
+      name = "qtimageformats-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtlocation = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtlocation-everywhere-src-5.12.3.tar.xz";
-      sha256 = "52d589be2852ada0c000b06cc411b61e521cd0797470be567fd1625bcc9d75c6";
-      name = "qtlocation-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtlocation-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0ja4cwj59y1xhwwf4f5gzr0fdrrsxbh14g2x812n03x0yd6i78xh";
+      name = "qtlocation-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtmacextras = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtmacextras-everywhere-src-5.12.3.tar.xz";
-      sha256 = "38dedd29d07ea9e4e92a7ef28f9e03c06cf9a1525aee4f8084310c519f5b47ed";
-      name = "qtmacextras-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtmacextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "00xhkj66i3srwmzzin1mcx9m94l5ns08f93c1za3wl23ani7n2nr";
+      name = "qtmacextras-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtmultimedia-everywhere-src-5.12.3.tar.xz";
-      sha256 = "a30beeb37fb284d93522e29c01fb8d12726f40e9248e80b70b1f8ab60197a301";
-      name = "qtmultimedia-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtmultimedia-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1a96x6c2w9rs6vfsdcnzmmad4w32dxy2dvismldcwmwcq2whqjsw";
+      name = "qtmultimedia-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtnetworkauth-everywhere-src-5.12.3.tar.xz";
-      sha256 = "dd6bf334be29fb82adaeecb184779328b4ad33a069528b9954d9c07f2d889332";
-      name = "qtnetworkauth-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtnetworkauth-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0x877ra8375pf8d8p6hgdkyw8yzjqfca6rgki6vi1q8fyi31j4a1";
+      name = "qtnetworkauth-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtpurchasing = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtpurchasing-everywhere-src-5.12.3.tar.xz";
-      sha256 = "a848f1e1022af38571f5ab0c4ec4b904c12fa6ef19154d44abbcaeb35156753e";
-      name = "qtpurchasing-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtpurchasing-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nk0dp247v1rfbnj84g99zsj6iv86pq32f478r92adz9qcgfs2yr";
+      name = "qtpurchasing-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtquickcontrols = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtquickcontrols-everywhere-src-5.12.3.tar.xz";
-      sha256 = "68ae03b35eaa44a24c3f663b842252053c9f2b00b18841fd39ff7d2150986f46";
-      name = "qtquickcontrols-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtquickcontrols-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0wyd24aphpixi3k9vbxw73z3dy1xnf8hwc99wimr5mpf1cj67yrb";
+      name = "qtquickcontrols-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtquickcontrols2 = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtquickcontrols2-everywhere-src-5.12.3.tar.xz";
-      sha256 = "e855e8369c3cb5a2ebcd2028a2a195ba73945fd9d5bc26134706c2fa14e99b3a";
-      name = "qtquickcontrols2-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtquickcontrols2-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1ikxj32rd9pipnrz81l5ln700lnw8w6bx573w01x424sx0p7wxw9";
+      name = "qtquickcontrols2-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtremoteobjects-everywhere-src-5.12.3.tar.xz";
-      sha256 = "3475a409127739930e0bf833cea5f7f605adc66ab25fac39b72ce4bf3039cc42";
-      name = "qtremoteobjects-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtremoteobjects-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0pwx2m17yw1qqv8qigfndgj1yd5kq8w5cbiaqlw4zdk1m6jd0h09";
+      name = "qtremoteobjects-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtscript = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtscript-everywhere-src-5.12.3.tar.xz";
-      sha256 = "0f37bf032a2370bd08667aad053f5a57717ea49596c16bf6cfb32b0d6e5c1f9e";
-      name = "qtscript-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtscript-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1a7ziipvy8cfmrpw2b868167sw21zrqhfv2la0w9vs6hwli1mzlp";
+      name = "qtscript-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtscxml = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtscxml-everywhere-src-5.12.3.tar.xz";
-      sha256 = "70c4b1f8e23560cf54e69aeb3ded4078434e6f78e1b9573fbad1ddace5fc4b19";
-      name = "qtscxml-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtscxml-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0syx3bx9pxxrsxanfv245ifppjhbj7sbrndh8il86xlrcr9cwvnw";
+      name = "qtscxml-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtsensors = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtsensors-everywhere-src-5.12.3.tar.xz";
-      sha256 = "7f63fedf60fdf110a3fc529568c7226d7acd59cc5eaee908f4d5a969e34005fc";
-      name = "qtsensors-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtsensors-everywhere-src-5.12.0.tar.xz";
+      sha256 = "19n5vlx0j5a0h86mpgs86qzsxbyq8fcrls7yqnjdaw0zga234cf5";
+      name = "qtsensors-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtserialbus = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtserialbus-everywhere-src-5.12.3.tar.xz";
-      sha256 = "792cd2d411d2ebd737f5d09580f8db479cd35f2f7e7cedb4412075ef20fcfe4d";
-      name = "qtserialbus-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtserialbus-everywhere-src-5.12.0.tar.xz";
+      sha256 = "16imi82v17n18a5m0i2fcfj6hqdpnzn2z9kdcf6a8h93fv4qd4kb";
+      name = "qtserialbus-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtserialport = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtserialport-everywhere-src-5.12.3.tar.xz";
-      sha256 = "1faf7df4a1f9028bef1ce79330badb4e5cbbba9f717c53cafc5aea41eed1de51";
-      name = "qtserialport-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtserialport-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1fx9fm0418jq05j2hlb52lblq8nr4m0hj8sizi86p708jmb01m2r";
+      name = "qtserialport-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtspeech = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtspeech-everywhere-src-5.12.3.tar.xz";
-      sha256 = "ed211822765744553fb5abeb97058420668b18a50d985061d949a0e068ee64f5";
-      name = "qtspeech-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtspeech-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1yx4wahl7iaj6lgpvnw8pdi2q4wc2fkpzfidd3j1bc98wpna4f8r";
+      name = "qtspeech-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtsvg = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtsvg-everywhere-src-5.12.3.tar.xz";
-      sha256 = "f666438dbf6816b7534e539b95e3fa4405f11d7e2e2bbcde34f2db5ae0f27dc2";
-      name = "qtsvg-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtsvg-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1kpvqd0p7dblgh26p3a99npqr0wmyg5yv0dcmf78ssrvsy58vrpb";
+      name = "qtsvg-everywhere-src-5.12.0.tar.xz";
     };
   };
   qttools = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qttools-everywhere-src-5.12.3.tar.xz";
-      sha256 = "c9e92d2f0d369e44bb1a60e9fa6d970f8d9893d653212305e04be5e6daec2cd8";
-      name = "qttools-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qttools-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1hyschrj568h65m3kl35xqz25hpk61vr98r08375vkavdr5y6k2p";
+      name = "qttools-everywhere-src-5.12.0.tar.xz";
     };
   };
   qttranslations = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qttranslations-everywhere-src-5.12.3.tar.xz";
-      sha256 = "eefcec0a91c302548f9d948a138b8ec77d78570ce818931bd8475b1bff1205ca";
-      name = "qttranslations-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qttranslations-everywhere-src-5.12.0.tar.xz";
+      sha256 = "023m68vdjj75xnbpc1jflyg85amnjc9i6nwv650k0w4n1dp1hksv";
+      name = "qttranslations-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtvirtualkeyboard-everywhere-src-5.12.3.tar.xz";
-      sha256 = "7b83af4527310de4ab81146622f3a46677daabf05556d0e33a2e25ca2aa13b22";
-      name = "qtvirtualkeyboard-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtvirtualkeyboard-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1nnns0i577zda6qxxd7pxcy06dq0y7lnni8ghn4adh9yl6dvi4yv";
+      name = "qtvirtualkeyboard-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtwayland = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtwayland-everywhere-src-5.12.3.tar.xz";
-      sha256 = "f0b45ad84180730e2d5a1249eb20c6357869b4b78f45eb266c2f2b17f77d86ff";
-      name = "qtwayland-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwayland-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1mvyv4wkcxj4h3q0mqw53zb1d0pahf8mz3r29kckadvk64djsp2m";
+      name = "qtwayland-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtwebchannel-everywhere-src-5.12.3.tar.xz";
-      sha256 = "72d1620bcc94e14caa91ddf344c84cd1288aa9479e00b1bb3b5e51f92efe088a";
-      name = "qtwebchannel-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebchannel-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1w2b31d7xjzdcgwkb4mz3qrl9ci7c9l4c3v4h8y59isip45g66l5";
+      name = "qtwebchannel-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtwebengine = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtwebengine-everywhere-src-5.12.3.tar.xz";
-      sha256 = "3ff3bac12d75aa0f3fd993bb7077fe411f7b0e6a3993af6f8b039d48e3dc4317";
-      name = "qtwebengine-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebengine-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0z38ad25n7ckylxnmqrxy95ds4pn7i5k7qxh856zgq1h18wiwn5x";
+      name = "qtwebengine-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtwebglplugin = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtwebglplugin-everywhere-src-5.12.3.tar.xz";
-      sha256 = "23da63013101e97c4e663bb4f6dbb1c7b4386679c634680d3b8d79bcc59d26b3";
-      name = "qtwebglplugin-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebglplugin-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0bk5dg33kn2l5lmgd6slsrs9xg15x9h9li91lr1q7qs67b8kl8k5";
+      name = "qtwebglplugin-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtwebsockets-everywhere-src-5.12.3.tar.xz";
-      sha256 = "258883225c5e089015c4036f31019aa8f5bb013ecd8eecd193342e606319a577";
-      name = "qtwebsockets-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebsockets-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0gzwfjnlgcijym5bn9gi93qlvzizrhf1q9dq06576419sg0s2ka4";
+      name = "qtwebsockets-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtwebview = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtwebview-everywhere-src-5.12.3.tar.xz";
-      sha256 = "f904e7fd7e755527e5bc4633c6f7c144065a3ffea473bf01fffb730385a983c5";
-      name = "qtwebview-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwebview-everywhere-src-5.12.0.tar.xz";
+      sha256 = "11b16b31bxcazqzg1ag9rzh4gj9pif2cf3jz2mj1sdprxp22ra5p";
+      name = "qtwebview-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtwinextras = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtwinextras-everywhere-src-5.12.3.tar.xz";
-      sha256 = "2b6319f7dd19fc19b028685c163a69f0a10e610d7554411d4660c1b5e42ada3b";
-      name = "qtwinextras-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtwinextras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "1l6s140vrfxb9ar4p1dq9w2gfk3zvgrpqdxbbzs4ngfpwk6mlky6";
+      name = "qtwinextras-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtx11extras = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtx11extras-everywhere-src-5.12.3.tar.xz";
-      sha256 = "85e3ae5177970c2d8656226d7535d0dff5764c100e55a79a59161d80754ba613";
-      name = "qtx11extras-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtx11extras-everywhere-src-5.12.0.tar.xz";
+      sha256 = "114b4akzpcgx57c6gkl558bl0mbasi34r22fmq3ny84dhvlv9m06";
+      name = "qtx11extras-everywhere-src-5.12.0.tar.xz";
     };
   };
   qtxmlpatterns = {
-    version = "5.12.3";
+    version = "5.12.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/5.12/5.12.3/submodules/qtxmlpatterns-everywhere-src-5.12.3.tar.xz";
-      sha256 = "e0b98e7c92cd791a9b354d090788347db78f14c47579384fe22d0b650c1d8a61";
-      name = "qtxmlpatterns-everywhere-src-5.12.3.tar.xz";
+      url = "${mirror}/official_releases/qt/5.12/5.12.0/submodules/qtxmlpatterns-everywhere-src-5.12.0.tar.xz";
+      sha256 = "0xckcw1j6f5l92c269pb8cx77d21sghp7m7dc05jl1dqmyy7jqpk";
+      name = "qtxmlpatterns-everywhere-src-5.12.0.tar.xz";
     };
   };
 }

pkgs/development/libraries/qt-5/modules/qtbase.nix

@@ -229,8 +229,6 @@ stdenv.mkDerivation {
       "-widgets"
       "-opengl desktop"
       "-icu"
-      "-L" "${icu.out}/lib"
-      "-I" "${icu.dev}/include"
       "-pch"
     ]
     ++ lib.optionals (compareVersion "5.11.0" < 0)
@@ -267,18 +265,10 @@ stdenv.mkDerivation {
 
     ++ [
       "-system-zlib"
-      "-L" "${zlib.out}/lib"
-      "-I" "${zlib.dev}/include"
       "-system-libjpeg"
-      "-L" "${libjpeg.out}/lib"
-      "-I" "${libjpeg.dev}/include"
       "-system-harfbuzz"
-      "-L" "${harfbuzz.out}/lib"
-      "-I" "${harfbuzz.dev}/include"
       "-system-pcre"
       "-openssl-linked"
-      "-L" "${openssl.out}/lib"
-      "-I" "${openssl.dev}/include"
       "-system-sqlite"
       ''-${if mysql != null then "plugin" else "no"}-sql-mysql''
       ''-${if postgresql != null then "plugin" else "no"}-sql-psql''
@@ -307,14 +297,10 @@ stdenv.mkDerivation {
           "-system-xcb"
           "-xcb"
           "-qpa xcb"
-          "-L" "${libX11.out}/lib"
-          "-I" "${libX11.out}/include"
-          "-L" "${libXext.out}/lib"
-          "-I" "${libXext.out}/include"
-          "-L" "${libXrender.out}/lib"
-          "-I" "${libXrender.out}/include"
 
+          "-system-xkbcommon"
           "-libinput"
+          "-xkbcommon-evdev"
 
           "-no-eglfs"
           "-no-gbm"
@@ -335,19 +321,6 @@ stdenv.mkDerivation {
           "-no-feature-renameat2"
           "-no-feature-getentropy"
         ]
-        ++ lib.optionals (compareVersion "5.12.1" < 0) [
-          # use -xkbcommon and -xkbcommon-evdev for versions before 5.12.1
-          "-system-xkbcommon"
-          "-xkbcommon-evdev"
-        ]
-        ++ lib.optionals (cups != null) [
-          "-L" "${cups.lib}/lib"
-          "-I" "${cups.dev}/include"
-        ]
-        ++ lib.optionals (mysql != null) [
-          "-L" "${mysql.out}/lib"
-          "-I" "${mysql.out}/include"
-        ]
     );
 
   enableParallelBuilding = true;

pkgs/development/libraries/science/math/tensorflow/bin.nix

@@ -0,0 +1,72 @@
+{ stdenv
+, fetchurl
+, patchelf
+, cudaSupport ? false, symlinkJoin, cudatoolkit, cudnn, nvidia_x11
+}:
+
+with stdenv.lib;
+let
+  unavailable = throw "libtensorflow is not available for this platform!";
+
+  tfType = if cudaSupport then "gpu" else "cpu";
+
+  system = 
+    if      stdenv.isLinux  then "linux"
+    else if stdenv.isDarwin then "darwin"
+    else unavailable;
+
+  platform =
+    if stdenv.isx86_64 then "x86_64"
+    else unavailable;
+
+  rpath = makeLibraryPath ([stdenv.cc.libc stdenv.cc.cc.lib] ++
+            optionals cudaSupport [ cudatoolkit.out cudatoolkit.lib cudnn nvidia_x11 ]);
+
+  packages = import ./binary-hashes.nix;
+  packageName = "${tfType}-${system}-${platform}";
+  url = packages.${packageName} or unavailable;
+
+  patchLibs =
+    if stdenv.isDarwin
+    then ''
+      install_name_tool -id $out/lib/libtensorflow.dylib $out/lib/libtensorflow.dylib
+      install_name_tool -id $out/lib/libtensorflow_framework.dylib $out/lib/libtensorflow_framework.dylib
+    ''
+    else ''
+      patchelf --set-rpath "${rpath}:$out/lib" $out/lib/libtensorflow.so
+      patchelf --set-rpath "${rpath}" $out/lib/libtensorflow_framework.so
+    '';
+
+in stdenv.mkDerivation rec {
+  pname = "libtensorflow";
+  inherit (packages) version;
+
+  src = fetchurl url;
+
+  # Patch library to use our libc, libstdc++ and others
+  buildCommand = ''
+    mkdir -pv $out
+    tar -C $out -xzf $src
+    chmod -R +w $out
+    ${patchLibs}
+
+    # Write pkgconfig file.
+    mkdir $out/lib/pkgconfig
+    cat > $out/lib/pkgconfig/tensorflow.pc << EOF
+    Name: TensorFlow
+    Version: ${version}
+    Description: Library for computation using data flow graphs for scalable machine learning
+    Requires:
+    Libs: -L$out/lib -ltensorflow
+    Cflags: -I$out/include/tensorflow
+    EOF
+  '';
+
+  meta = {
+    description = "C API for TensorFlow";
+    homepage = https://www.tensorflow.org/install/lang_c;
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    maintainers = with maintainers; [ basvandijk ];
+  };
+}

pkgs/development/libraries/science/math/tensorflow/binary-hashes.nix

@@ -0,0 +1,15 @@
+{
+version = "1.14.0";
+"cpu-linux-x86_64" = {
+  url = "https://storage.googleapis.com/tensorflow/libtensorflow/libtensorflow-cpu-linux-x86_64-1.14.0.tar.gz";
+  sha256 = "04bi3ijq4sbb8c5vk964zlv0j9mrjnzzxd9q9knq3h273nc1a36k";
+};
+"gpu-linux-x86_64" = {
+  url = "https://storage.googleapis.com/tensorflow/libtensorflow/libtensorflow-gpu-linux-x86_64-1.14.0.tar.gz";
+  sha256 = "1ffnpyj9jjgwxpjfiyjvq4dm3n6nwiksim5jld9zw7fdswh215x6";
+};
+"cpu-darwin-x86_64" = {
+  url = "https://storage.googleapis.com/tensorflow/libtensorflow/libtensorflow-cpu-darwin-x86_64-1.14.0.tar.gz";
+  sha256 = "0zsd5ils1a17j6jzh0c7q1z56fw46gkzybbnms7h2rgg8al0rh92";
+};
+}

pkgs/development/libraries/science/math/tensorflow/prefetcher.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+version=1.14.0
+hashfile=binary-hashes.nix
+rm -f $hashfile
+echo "{" >> $hashfile
+echo "version = \"$version\";" >> $hashfile
+for sys in "linux" "darwin"; do
+    for tfpref in "cpu" "gpu"; do
+        for platform in "x86_64"; do
+            if [ $sys = "darwin" ] && [ $tfpref = "gpu" ]; then
+               continue
+            fi
+            url=https://storage.googleapis.com/tensorflow/libtensorflow/libtensorflow-$tfpref-$sys-$platform-$version.tar.gz
+            hash=$(nix-prefetch-url $url)
+            echo "\"${tfpref}-${sys}-${platform}\" = {" >> $hashfile
+            echo "  url = \"$url\";" >> $hashfile
+            echo "  sha256 = \"$hash\";" >> $hashfile
+            echo "};" >> $hashfile
+        done
+    done
+done
+echo "}" >> $hashfile
+