Merge master into staging-next

2020-01-10 10:34:04 +01:00 · 2020-01-10 10:34:04 +01:00 · 5ad16cb27f
commit 5ad16cb27f
parent eb1369670b 773494d0ea
141 changed files with 1935 additions and 876 deletions
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@ -17,7 +17,3 @@
 - [ ] Determined the impact on package closure size (by running `nix path-info -S` before and after)
 - [ ] Ensured that relevant documentation is up to date
 - [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
-
-###### Notify maintainers
-
-cc @
--- a/doc/contributing/submitting-changes.xml
+++ b/doc/contributing/submitting-changes.xml
@ -13,7 +13,7 @@
   </listitem>
   <listitem>
    <para>
-     Fork the repository on GitHub.
+     Fork <link xlink:href="https://github.com/nixos/nixpkgs/">the Nixpkgs repository</link> on GitHub.
    </para>
   </listitem>
   <listitem>
@ -22,15 +22,10 @@
     <itemizedlist>
      <listitem>
       <para>
-        You can make branch from a commit of your local <command>nixos-version</command>. That will help you to avoid additional local compilations. Because you will receive packages from binary cache.
-        <itemizedlist>
-         <listitem>
-          <para>
-           For example: <command>nixos-version</command> returns <command>15.05.git.0998212 (Dingo)</command>. So you can do:
-          </para>
-         </listitem>
-        </itemizedlist>
+        You can make branch from a commit of your local <command>nixos-version</command>. That will help you to avoid additional local compilations. Because you will receive packages from binary cache. For example
 <screen>
+<prompt>$ </prompt>nixos-version --hash
+0998212
 <prompt>$ </prompt>git checkout 0998212
 <prompt>$ </prompt>git checkout -b 'fix/pkg-name-update'
 </screen>
@ -47,13 +42,11 @@
   <listitem>
    <para>
     Make commits of logical units.
-     <itemizedlist>
-      <listitem>
-       <para>
-        If you removed pkgs, made some major NixOS changes etc., write about them in <command>nixos/doc/manual/release-notes/rl-unstable.xml</command>.
-       </para>
-      </listitem>
-     </itemizedlist>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     If you removed pkgs or made some major NixOS changes, write about it in the release notes for the next stable release. For example <command>nixos/doc/manual/release-notes/rl-2003.xml</command>.
    </para>
   </listitem>
   <listitem>
@ -178,7 +171,7 @@ Additional information.
   </listitem>
   <listitem>
    <para>
-     Rebase you branch against current <command>master</command>.
+     <link xlink:href="https://git-scm.com/book/en/v2/Git-Branching-Rebasing">Rebase</link> your branch against current <command>master</command>.
    </para>
   </listitem>
  </itemizedlist>
@ -194,36 +187,12 @@ Additional information.
   </listitem>
   <listitem>
    <para>
-     Create pull request:
-     <itemizedlist>
-      <listitem>
-       <para>
-        Write the title in format <command>(pkg-name | nixos/&lt;module>): improvement</command>.
-        <itemizedlist>
-         <listitem>
-          <para>
-           If you update the pkg, write versions <command>from -> to</command>.
-          </para>
-         </listitem>
-        </itemizedlist>
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Write in comment if you have tested your patch. Do not rely much on <command>TravisCI</command>.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        If you make an improvement, write about your motivation.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Notify maintainers of the package. For example add to the message: <command>cc @jagajaga @domenkozar</command>.
-       </para>
-      </listitem>
-     </itemizedlist>
+     Create the pull request
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Follow <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md#submitting-changes">the contribution guidelines</link>.
    </para>
   </listitem>
  </itemizedlist>
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -84,37 +84,36 @@ nix-env -qaP -A nixos.haskellPackages
 nix-env -iA nixos.haskellPackages.cabal-install
 ```

-Our current default compiler is GHC 7.10.x and the `haskellPackages` set
-contains packages built with that particular version. Nixpkgs contains the
-latest major release of every GHC since 6.10.4, however, and there is a whole
-family of package sets available that defines Hackage packages built with each
-of those compilers, too:
+Our current default compiler is GHC 8.6.x and the `haskellPackages` set
+contains packages built with that particular version. Nixpkgs contains the last
+three major releases of GHC and there is a whole family of package sets
+available that defines Hackage packages built with each of those compilers,
+too:
 ```shell
-nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc6123
-nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc763
+nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc844
+nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc882
 ```

 The name `haskellPackages` is really just a synonym for
-`haskell.packages.ghc7102`, because we prefer that package set internally and
+`haskell.packages.ghc865`, because we prefer that package set internally and
 recommend it to our users as their default choice, but ultimately you are free
 to compile your Haskell packages with any GHC version you please. The following
 command displays the complete list of available compilers:
 ```
 $ nix-env -f "<nixpkgs>" -qaP -A haskell.compiler
-haskell.compiler.ghc822                  ghc-8.2.2
-haskell.compiler.integer-simple.ghc822   ghc-8.2.2
+haskell.compiler.ghc8101                 ghc-8.10.0.20191210
+haskell.compiler.integer-simple.ghc8101  ghc-8.10.0.20191210
+haskell.compiler.ghcHEAD                 ghc-8.10.20191119
+haskell.compiler.integer-simple.ghcHEAD  ghc-8.10.20191119
 haskell.compiler.ghc822Binary            ghc-8.2.2-binary
 haskell.compiler.ghc844                  ghc-8.4.4
 haskell.compiler.ghc863Binary            ghc-8.6.3-binary
-haskell.compiler.ghc864                  ghc-8.6.4
-haskell.compiler.integer-simple.ghc864   ghc-8.6.4
 haskell.compiler.ghc865                  ghc-8.6.5
 haskell.compiler.integer-simple.ghc865   ghc-8.6.5
 haskell.compiler.ghc881                  ghc-8.8.1
 haskell.compiler.integer-simple.ghc881   ghc-8.8.1
-haskell.compiler.ghcHEAD                 ghc-8.9.20190601
-haskell.compiler.integer-simple.ghcHEAD  ghc-8.9.20190601
-haskell.compiler.ghcjs84                 ghcjs-8.4.0.1
+haskell.compiler.ghc882                  ghc-8.8.1.20191211
+haskell.compiler.integer-simple.ghc882   ghc-8.8.1.20191211
 haskell.compiler.ghcjs                   ghcjs-8.6.0.1
 ```

--- a/lib/default.nix
+++ b/lib/default.nix
@ -101,7 +101,7 @@ let
      cleanSource sourceByRegex sourceFilesBySuffices
      commitIdFromGitRepo cleanSourceWith pathHasContext
      canCleanSource;
-    inherit (modules) evalModules closeModules unifyModuleSyntax
+    inherit (modules) evalModules unifyModuleSyntax
      applyIfFunction mergeModules
      mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
      pushDownProperties dischargeProperties filterOverrides
@ -110,7 +110,7 @@ let
      mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
      mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
      mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
-      mkAliasOptionModule doRename filterModules;
+      mkAliasOptionModule doRename;
    inherit (options) isOption mkEnableOption mkSinkUndeclaredOptions
      mergeDefaultOption mergeOneOption mergeEqualOption getValues
      getFiles optionAttrSetToDocList optionAttrSetToDocList'
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -59,9 +59,12 @@ rec {
        };
      };

-      closed = closeModules (modules ++ [ internalModule ]) ({ inherit config options lib; } // specialArgs);
+      collected = collectModules
+        (specialArgs.modulesPath or "")
+        (modules ++ [ internalModule ])
+        ({ inherit config options lib; } // specialArgs);

-      options = mergeModules prefix (reverseList (filterModules (specialArgs.modulesPath or "") closed));
+      options = mergeModules prefix (reverseList collected);

      # Traverse options and extract the option values into the final
      # config set.  At the same time, check whether all option
@ -87,31 +90,76 @@ rec {
      result = { inherit options config; };
    in result;

+  # collectModules :: (modulesPath: String) -> (modules: [ Module ]) -> (args: Attrs) -> [ Module ]
+  #
+  # Collects all modules recursively through `import` statements, filtering out
+  # all modules in disabledModules.
+  collectModules = let

- # Filter disabled modules. Modules can be disabled allowing
- # their implementation to be replaced.
- filterModules = modulesPath: modules:
-   let
-     moduleKey = m: if isString m then toString modulesPath + "/" + m else toString m;
-     disabledKeys = map moduleKey (concatMap (m: m.disabledModules) modules);
-   in
-     filter (m: !(elem m.key disabledKeys)) modules;
+      # Like unifyModuleSyntax, but also imports paths and calls functions if necessary
+      loadModule = args: fallbackFile: fallbackKey: m:
+        if isFunction m || isAttrs m then
+          unifyModuleSyntax fallbackFile fallbackKey (applyIfFunction fallbackKey m args)
+        else unifyModuleSyntax (toString m) (toString m) (applyIfFunction (toString m) (import m) args);

-  /* Close a set of modules under the ‘imports’ relation. */
-  closeModules = modules: args:
-    let
-      toClosureList = file: parentKey: imap1 (n: x:
-        if isAttrs x || isFunction x then
-          let key = "${parentKey}:anon-${toString n}"; in
-          unifyModuleSyntax file key (applyIfFunction key x args)
-        else
-          let file = toString x; key = toString x; in
-          unifyModuleSyntax file key (applyIfFunction key (import x) args));
-    in
-      builtins.genericClosure {
-        startSet = toClosureList unknownModule "" modules;
-        operator = m: toClosureList m._file m.key m.imports;
-      };
+      /*
+      Collects all modules recursively into the form
+
+        {
+          disabled = [ <list of disabled modules> ];
+          # All modules of the main module list
+          modules = [
+            {
+              key = <key1>;
+              module = <module for key1>;
+              # All modules imported by the module for key1
+              modules = [
+                {
+                  key = <key1-1>;
+                  module = <module for key1-1>;
+                  # All modules imported by the module for key1-1
+                  modules = [ ... ];
+                }
+                ...
+              ];
+            }
+            ...
+          ];
+        }
+      */
+      collectStructuredModules =
+        let
+          collectResults = modules: {
+            disabled = concatLists (catAttrs "disabled" modules);
+            inherit modules;
+          };
+        in parentFile: parentKey: initialModules: args: collectResults (imap1 (n: x:
+          let
+            module = loadModule args parentFile "${parentKey}:anon-${toString n}" x;
+            collectedImports = collectStructuredModules module._file module.key module.imports args;
+          in {
+            key = module.key;
+            module = module;
+            modules = collectedImports.modules;
+            disabled = module.disabledModules ++ collectedImports.disabled;
+          }) initialModules);
+
+      # filterModules :: String -> { disabled, modules } -> [ Module ]
+      #
+      # Filters a structure as emitted by collectStructuredModules by removing all disabled
+      # modules recursively. It returns the final list of unique-by-key modules
+      filterModules = modulesPath: { disabled, modules }:
+        let
+          moduleKey = m: if isString m then toString modulesPath + "/" + m else toString m;
+          disabledKeys = map moduleKey disabled;
+          keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
+        in map (attrs: attrs.module) (builtins.genericClosure {
+          startSet = keyFilter modules;
+          operator = attrs: keyFilter attrs.modules;
+        });
+
+    in modulesPath: initialModules: args:
+      filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);

  /* Massage a module into canonical form, that is, a set consisting
     of ‘options’, ‘config’ and ‘imports’ attributes. */
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -12,7 +12,7 @@ evalConfig() {
    local attr=$1
    shift;
    local script="import ./default.nix { modules = [ $@ ];}"
-    nix-instantiate --timeout 1 -E "$script" -A "$attr" --eval-only --show-trace
+    nix-instantiate --timeout 1 -E "$script" -A "$attr" --eval-only --show-trace --read-write-mode
 }

 reportFailure() {
@ -177,6 +177,15 @@ checkConfigOutput "true" config.submodule.outer ./declare-submoduleWith-modules.
 # Temporarily disabled until https://github.com/NixOS/nixpkgs/pull/76861
 #checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix

+# Check that disabledModules works recursively and correctly
+checkConfigOutput "true" config.enable ./disable-recursive/main.nix
+checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-foo.nix}
+checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-bar.nix}
+checkConfigError 'The option .* defined in .* does not exist' config.enable ./disable-recursive/{main.nix,disable-foo.nix,disable-bar.nix}
+
+# Check that imports can depend on derivations
+checkConfigOutput "true" config.enable ./import-from-store.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass
--- a/lib/tests/modules/disable-recursive/bar.nix
+++ b/lib/tests/modules/disable-recursive/bar.nix
@ -0,0 +1,5 @@
+{
+  imports = [
+    ../declare-enable.nix
+  ];
+}
--- a/lib/tests/modules/disable-recursive/disable-bar.nix
+++ b/lib/tests/modules/disable-recursive/disable-bar.nix
@ -0,0 +1,7 @@
+{
+
+  disabledModules = [
+    ./bar.nix
+  ];
+
+}
--- a/lib/tests/modules/disable-recursive/disable-foo.nix
+++ b/lib/tests/modules/disable-recursive/disable-foo.nix
@ -0,0 +1,7 @@
+{
+
+  disabledModules = [
+    ./foo.nix
+  ];
+
+}
--- a/lib/tests/modules/disable-recursive/foo.nix
+++ b/lib/tests/modules/disable-recursive/foo.nix
@ -0,0 +1,5 @@
+{
+  imports = [
+    ../declare-enable.nix
+  ];
+}
--- a/lib/tests/modules/disable-recursive/main.nix
+++ b/lib/tests/modules/disable-recursive/main.nix
@ -0,0 +1,8 @@
+{
+  imports = [
+    ./foo.nix
+    ./bar.nix
+  ];
+
+  enable = true;
+}
--- a/lib/tests/modules/import-from-store.nix
+++ b/lib/tests/modules/import-from-store.nix
@ -0,0 +1,17 @@
+{ lib, ... }:
+let
+  drv = derivation {
+    name = "derivation";
+    system = builtins.currentSystem;
+    builder = "/bin/sh";
+    args = [ "-c" "echo {} > $out" ];
+  };
+in {
+
+  imports = [
+    "${drv}"
+    ./declare-enable.nix
+    ./define-enable.nix
+  ];
+
+}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4592,6 +4592,12 @@
    githubId = 3958340;
    name = "Eshin Kunishima";
  };
+  mildlyincompetent = {
+    email = "nix@kch.dev";
+    github = "mildlyincompetent";
+    githubId = 19479662;
+    name = "Kajetan Champlewski";
+  };
  miltador = {
    email = "miltador@yandex.ua";
    name = "Vasiliy Solovey";
@ -6859,6 +6865,11 @@
    githubId = 863327;
    name = "Tyler Benster";
  };
+  tckmn = {
+    email = "andy@tck.mn";
+    github = "tckmn";
+    name = "Andy Tockman";
+  };
  teh = {
    email = "tehunger@gmail.com";
    github = "teh";
--- a/nixos/doc/manual/development/replace-modules.xml
+++ b/nixos/doc/manual/development/replace-modules.xml
@ -6,8 +6,8 @@
 <title>Replace Modules</title>

 <para>
-  Modules that are imported can also be disabled. The option declarations and
-  config implementation of a disabled module will be ignored, allowing another
+  Modules that are imported can also be disabled. The option declarations,
+  config implementation and the imports of a disabled module will be ignored, allowing another
  to take it's place. This can be used to import a set of modules from another
  channel while keeping the rest of the system on a stable release.
 </para>
--- a/nixos/maintainers/scripts/azure/create-azure.sh
+++ b/nixos/maintainers/scripts/azure/create-azure.sh
@ -1,6 +1,6 @@
-#! /bin/sh -e
+#! /bin/sh -eu

-export NIX_PATH=nixpkgs=../../../..
+export NIX_PATH=nixpkgs=$(dirname $(readlink -f $0))/../../../..
 export NIXOS_CONFIG=$(dirname $(readlink -f $0))/../../../modules/virtualisation/azure-image.nix
 export TIMESTAMP=$(date +%Y%m%d%H%M)

--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, baseModules, extraModules, modules, ... }:
+{ config, lib, pkgs, baseModules, extraModules, modules, modulesPath, ... }:

 with lib;

@ -22,7 +22,10 @@ let
        scrubbedEval = evalModules {
          modules = [ { nixpkgs.localSystem = config.nixpkgs.localSystem; } ] ++ manualModules;
          args = (config._module.args) // { modules = [ ]; };
-          specialArgs = { pkgs = scrubDerivations "pkgs" pkgs; };
+          specialArgs = {
+            pkgs = scrubDerivations "pkgs" pkgs;
+            inherit modulesPath;
+          };
        };
        scrubDerivations = namePrefix: pkgSet: mapAttrs
          (name: value:
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -806,6 +806,7 @@
  ./services/web-apps/gotify-server.nix
  ./services/web-apps/icingaweb2/icingaweb2.nix
  ./services/web-apps/icingaweb2/module-monitoring.nix
+  ./services/web-apps/ihatemoney
  ./services/web-apps/limesurvey.nix
  ./services/web-apps/mattermost.nix
  ./services/web-apps/mediawiki.nix
--- a/nixos/modules/programs/screen.nix
+++ b/nixos/modules/programs/screen.nix
@ -27,6 +27,7 @@ in
    environment.etc.screenrc.text = cfg.screenrc;

    environment.systemPackages = [ pkgs.screen ];
+    security.pam.services.screen = {};
  };

 }
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -776,11 +776,8 @@ in
          '';

        # Most of these should be moved to specific modules.
-        cups = {};
-        ftp = {};
        i3lock = {};
        i3lock-color = {};
-        screen = {};
        vlock = {};
        xlock = {};
        xscreensaver = {};
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@ -320,6 +320,8 @@ in
          Type = if hasNotify then "notify" else "simple";
          RuntimeDirectory = "mysqld";
          RuntimeDirectoryMode = "0755";
+          Restart = "on-abort";
+          RestartSec = "5s";
          # The last two environment variables are used for starting Galera clusters
          ExecStart = "${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION";
          ExecStartPost =
--- a/nixos/modules/services/misc/home-assistant.nix
+++ b/nixos/modules/services/misc/home-assistant.nix
@ -11,6 +11,9 @@ let
    (recursiveUpdate defaultConfig cfg.config) else cfg.config));
  configFile = pkgs.runCommand "configuration.yaml" { preferLocalBuild = true; } ''
    ${pkgs.remarshal}/bin/json2yaml -i ${configJSON} -o $out
+    # Hack to support secrets, that are encoded as custom yaml objects,
+    # https://www.home-assistant.io/docs/configuration/secrets/
+    sed -i -e "s/'\!secret \(.*\)'/\!secret \1/" $out
  '';

  lovelaceConfigJSON = pkgs.writeText "ui-lovelace.json"
@ -98,6 +101,10 @@ in {
        {
          homeassistant = {
            name = "Home";
+            latitude = "!secret latitude";
+            longitude = "!secret longitude";
+            elevation = "!secret elevation";
+            unit_system = "metric";
            time_zone = "UTC";
          };
          frontend = { };
@ -108,6 +115,8 @@ in {
      description = ''
        Your <filename>configuration.yaml</filename> as a Nix attribute set.
        Beware that setting this option will delete your previous <filename>configuration.yaml</filename>.
+        <link xlink:href="https://www.home-assistant.io/docs/configuration/secrets/">Secrets</link>
+        are encoded as strings as shown in the example.
      '';
    };

--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -657,8 +657,7 @@ in {
  };

  config = mkIf cfg.enable {
-    users.users.matrix-synapse =
-      { name = "";
+    users.users.matrix-synapse = { 
        group = "matrix-synapse";
        home = cfg.dataDir;
        createHome = true;
--- a/nixos/modules/services/networking/gnunet.nix
+++ b/nixos/modules/services/networking/gnunet.nix
@ -42,6 +42,7 @@ in
    services.gnunet = {

      enable = mkOption {
+        type = types.bool;
        default = false;
        description = ''
          Whether to run the GNUnet daemon.  GNUnet is GNU's anonymous
@ -51,6 +52,7 @@ in

      fileSharing = {
        quota = mkOption {
+          type = types.int;
          default = 1024;
          description = ''
            Maximum file system usage (in MiB) for file sharing.
@ -60,6 +62,7 @@ in

      udp = {
        port = mkOption {
+          type = types.port;
          default = 2086;  # assigned by IANA
          description = ''
            The UDP port for use by GNUnet.
@ -69,6 +72,7 @@ in

      tcp = {
        port = mkOption {
+          type = types.port;
          default = 2086;  # assigned by IANA
          description = ''
            The TCP port for use by GNUnet.
@ -78,6 +82,7 @@ in

      load = {
        maxNetDownBandwidth = mkOption {
+          type = types.int;
          default = 50000;
          description = ''
            Maximum bandwidth usage (in bits per second) for GNUnet
@ -86,6 +91,7 @@ in
        };

        maxNetUpBandwidth = mkOption {
+          type = types.int;
          default = 50000;
          description = ''
            Maximum bandwidth usage (in bits per second) for GNUnet
@ -94,6 +100,7 @@ in
        };

        hardNetUpBandwidth = mkOption {
+          type = types.int;
          default = 0;
          description = ''
            Hard bandwidth limit (in bits per second) when uploading
@ -111,6 +118,7 @@ in
      };

      extraOptions = mkOption {
+        type = types.lines;
        default = "";
        description = ''
          Additional options that will be copied verbatim in `gnunet.conf'.
--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@ -104,7 +104,6 @@ in {

    users.groups.mxisd =
      {
-        name = "";
        gid = config.ids.gids.mxisd;
      };

--- a/nixos/modules/services/security/torify.nix
+++ b/nixos/modules/services/security/torify.nix
@ -25,6 +25,7 @@ in
    services.tor.tsocks = {

      enable = mkOption {
+        type = types.bool;
        default = false;
        description = ''
          Whether to build tsocks wrapper script to relay application traffic via Tor.
@ -40,6 +41,7 @@ in
      };

      server = mkOption {
+        type = types.str;
        default = "localhost:9050";
        example = "192.168.0.20";
        description = ''
@ -48,6 +50,7 @@ in
      };

      config = mkOption {
+        type = types.lines;
        default = "";
        description = ''
          Extra configuration. Contents will be added verbatim to TSocks
--- a/nixos/modules/services/web-apps/ihatemoney/default.nix
+++ b/nixos/modules/services/web-apps/ihatemoney/default.nix
@ -0,0 +1,141 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  cfg = config.services.ihatemoney;
+  user = "ihatemoney";
+  group = "ihatemoney";
+  db = "ihatemoney";
+  python3 = config.services.uwsgi.package.python3;
+  pkg = python3.pkgs.ihatemoney;
+  toBool = x: if x then "True" else "False";
+  configFile = pkgs.writeText "ihatemoney.cfg" ''
+        from secrets import token_hex
+        # load a persistent secret key
+        SECRET_KEY_FILE = "/var/lib/ihatemoney/secret_key"
+        SECRET_KEY = ""
+        try:
+          with open(SECRET_KEY_FILE) as f:
+            SECRET_KEY = f.read()
+        except FileNotFoundError:
+          pass
+        if not SECRET_KEY:
+          print("ihatemoney: generating a new secret key")
+          SECRET_KEY = token_hex(50)
+          with open(SECRET_KEY_FILE, "w") as f:
+            f.write(SECRET_KEY)
+        del token_hex
+        del SECRET_KEY_FILE
+
+        # "normal" configuration
+        DEBUG = False
+        SQLALCHEMY_DATABASE_URI = '${
+          if cfg.backend == "sqlite"
+          then "sqlite:////var/lib/ihatemoney/ihatemoney.sqlite"
+          else "postgresql:///${db}"}'
+        SQLALCHEMY_TRACK_MODIFICATIONS = False
+        MAIL_DEFAULT_SENDER = ("${cfg.defaultSender.name}", "${cfg.defaultSender.email}")
+        ACTIVATE_DEMO_PROJECT = ${toBool cfg.enableDemoProject}
+        ADMIN_PASSWORD = "${toString cfg.adminHashedPassword /*toString null == ""*/}"
+        ALLOW_PUBLIC_PROJECT_CREATION = ${toBool cfg.enablePublicProjectCreation}
+        ACTIVATE_ADMIN_DASHBOARD = ${toBool cfg.enableAdminDashboard}
+
+        ${cfg.extraConfig}
+  '';
+in
+  {
+    options.services.ihatemoney = {
+      enable = mkEnableOption "ihatemoney webapp. Note that this will set uwsgi to emperor mode running as root";
+      backend = mkOption {
+        type = types.enum [ "sqlite" "postgresql" ];
+        default = "sqlite";
+        description = ''
+          The database engine to use for ihatemoney.
+          If <literal>postgresql</literal> is selected, then a database called
+          <literal>${db}</literal> will be created. If you disable this option,
+          it will however not be removed.
+        '';
+      };
+      adminHashedPassword = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "The hashed password of the administrator. To obtain it, run <literal>ihatemoney generate_password_hash</literal>";
+      };
+      uwsgiConfig = mkOption {
+        type = types.attrs;
+        example = {
+          http = ":8000";
+        };
+        description = "Additionnal configuration of the UWSGI vassal running ihatemoney. It should notably specify on which interfaces and ports the vassal should listen.";
+      };
+      defaultSender = {
+        name = mkOption {
+          type = types.str;
+          default = "Budget manager";
+          description = "The display name of the sender of ihatemoney emails";
+        };
+        email = mkOption {
+          type = types.str;
+          default = "ihatemoney@${config.networking.hostName}";
+          description = "The email of the sender of ihatemoney emails";
+        };
+      };
+      enableDemoProject = mkEnableOption "access to the demo project in ihatemoney";
+      enablePublicProjectCreation = mkEnableOption "permission to create projects in ihatemoney by anyone";
+      enableAdminDashboard = mkEnableOption "ihatemoney admin dashboard";
+      extraConfig = mkOption {
+        type = types.str;
+        default = "";
+        description = "Extra configuration appended to ihatemoney's configuration file. It is a python file, so pay attention to indentation.";
+      };
+    };
+    config = mkIf cfg.enable {
+      services.postgresql = mkIf (cfg.backend == "postgresql") {
+        enable = true;
+        ensureDatabases = [ db ];
+        ensureUsers = [ {
+          name = user;
+          ensurePermissions = {
+            "DATABASE ${db}" = "ALL PRIVILEGES";
+          };
+        } ];
+      };
+      systemd.services.postgresql = mkIf (cfg.backend == "postgresql") {
+        wantedBy = [ "uwsgi.service" ];
+        before = [ "uwsgi.service" ];
+      };
+      systemd.tmpfiles.rules = [
+        "d /var/lib/ihatemoney 770 ${user} ${group}"
+      ];
+      users = {
+        users.${user} = {
+          isSystemUser = true;
+          inherit group;
+        };
+        groups.${group} = {};
+      };
+      services.uwsgi = {
+        enable = true;
+        plugins = [ "python3" ];
+        # the vassal needs to be able to setuid
+        user = "root";
+        group = "root";
+        instance = {
+          type = "emperor";
+          vassals.ihatemoney = {
+            type = "normal";
+            strict = true;
+            uid = user;
+            gid = group;
+            # apparently flask uses threads: https://github.com/spiral-project/ihatemoney/commit/c7815e48781b6d3a457eaff1808d179402558f8c
+            enable-threads = true;
+            module = "wsgi:application";
+            chdir = "${pkg}/${pkg.pythonModule.sitePackages}/ihatemoney";
+            env = [ "IHATEMONEY_SETTINGS_FILE_PATH=${configFile}" ];
+            pythonPackages = self: [ self.ihatemoney ];
+          } // cfg.uwsgiConfig;
+        };
+      };
+    };
+  }
+
+
--- a/nixos/modules/services/web-servers/uwsgi.nix
+++ b/nixos/modules/services/web-servers/uwsgi.nix
@ -5,10 +5,6 @@ with lib;
 let
  cfg = config.services.uwsgi;

-  uwsgi = pkgs.uwsgi.override {
-    plugins = cfg.plugins;
-  };
-
  buildCfg = name: c:
    let
      plugins =
@ -23,8 +19,8 @@ let
      python =
        if hasPython2 && hasPython3 then
          throw "`plugins` attribute in UWSGI configuration shouldn't contain both python2 and python3"
-        else if hasPython2 then uwsgi.python2
-        else if hasPython3 then uwsgi.python3
+        else if hasPython2 then cfg.package.python2
+        else if hasPython3 then cfg.package.python3
        else null;

      pythonEnv = python.withPackages (c.pythonPackages or (self: []));
@ -77,6 +73,11 @@ in {
        description = "Where uWSGI communication sockets can live";
      };

+      package = mkOption {
+        type = types.package;
+        internal = true;
+      };
+
      instance = mkOption {
        type = types.attrs;
        default = {
@ -138,7 +139,7 @@ in {
      '';
      serviceConfig = {
        Type = "notify";
-        ExecStart = "${uwsgi}/bin/uwsgi --uid ${cfg.user} --gid ${cfg.group} --json ${buildCfg "server" cfg.instance}/server.json";
+        ExecStart = "${cfg.package}/bin/uwsgi --uid ${cfg.user} --gid ${cfg.group} --json ${buildCfg "server" cfg.instance}/server.json";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
        NotifyAccess = "main";
@ -156,5 +157,9 @@ in {
    users.groups = optionalAttrs (cfg.group == "uwsgi") {
      uwsgi.gid = config.ids.gids.uwsgi;
    };
+
+    services.uwsgi.package = pkgs.uwsgi.override {
+      inherit (cfg) plugins;
+    };
  };
 }
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -171,7 +171,7 @@ in
      "L+ /run/gdm/.config/pulse - - - - ${pulseConfig}"
    ] ++ optionals config.services.gnome3.gnome-initial-setup.enable [
      # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
-      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm yes"
+      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm - yes"
    ];

    systemd.services.display-manager.wants = [
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -122,6 +122,7 @@ in
  i3wm = handleTest ./i3wm.nix {};
  icingaweb2 = handleTest ./icingaweb2.nix {};
  iftop = handleTest ./iftop.nix {};
+  ihatemoney = handleTest ./ihatemoney.nix {};
  incron = handleTest ./incron.nix {};
  influxdb = handleTest ./influxdb.nix {};
  initrd-network-ssh = handleTest ./initrd-network-ssh {};
--- a/nixos/tests/ceph-multi-node.nix
+++ b/nixos/tests/ceph-multi-node.nix
@ -19,6 +19,12 @@ let
      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
      uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
    };
+    osd2 = {
+      name = "2";
+      ip = "192.168.1.4";
+      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
+      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
+    };
  };
  generateCephConfig = { daemonConfig }: {
    enable = true;
@ -72,35 +78,20 @@ let
    };
  }; };

-  networkOsd0 = {
+  networkOsd = osd: {
    dhcpcd.enable = false;
    interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-      { address = cfg.osd0.ip; prefixLength = 24; }
+      { address = osd.ip; prefixLength = 24; }
    ];
    firewall = {
      allowedTCPPortRanges = [ { from = 6800; to = 7300; } ];
    };
  };
-  cephConfigOsd0 = generateCephConfig { daemonConfig = {
-    osd = {
-      enable = true;
-      daemons = [ cfg.osd0.name ];
-    };
-  }; };

-  networkOsd1 = {
-    dhcpcd.enable = false;
-    interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-      { address = cfg.osd1.ip; prefixLength = 24; }
-    ];
-    firewall = {
-      allowedTCPPortRanges = [ { from = 6800; to = 7300; } ];
-    };
-  };
-  cephConfigOsd1 = generateCephConfig { daemonConfig = {
+  cephConfigOsd = osd: generateCephConfig { daemonConfig = {
    osd = {
      enable = true;
-      daemons = [ cfg.osd1.name ];
+      daemons = [ osd.name ];
    };
  }; };

@ -114,6 +105,7 @@ let
    monA.wait_for_unit("network.target")
    osd0.wait_for_unit("network.target")
    osd1.wait_for_unit("network.target")
+    osd2.wait_for_unit("network.target")

    # Bootstrap ceph-mon daemon
    monA.succeed(
@ -145,8 +137,9 @@ let
    monA.succeed("cp /etc/ceph/ceph.client.admin.keyring /tmp/shared")
    osd0.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
    osd1.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    osd2.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")

-    # Bootstrap both OSDs
+    # Bootstrap OSDs
    osd0.succeed(
        "mkfs.xfs /dev/vdb",
        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
@ -161,6 +154,13 @@ let
        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
        'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
    )
+    osd2.succeed(
+        "mkfs.xfs /dev/vdb",
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
+        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
+    )

    # Initialize the OSDs with regular filestore
    osd0.succeed(
@ -173,7 +173,12 @@ let
        "chown -R ceph:ceph /var/lib/ceph/osd",
        "systemctl start ceph-osd-${cfg.osd1.name}",
    )
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    osd2.succeed(
+        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "systemctl start ceph-osd-${cfg.osd2.name}",
+    )
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")

@ -196,16 +201,18 @@ let
    monA.crash()
    osd0.crash()
    osd1.crash()
+    osd2.crash()

    # Start it up
    osd0.start()
    osd1.start()
+    osd2.start()
    monA.start()

    # Ensure the cluster comes back up again
    monA.succeed("ceph -s | grep 'mon: 1 daemons'")
    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
  '';
@ -217,8 +224,9 @@ in {

  nodes = {
    monA = generateHost { pkgs = pkgs; cephConfig = cephConfigMonA; networkConfig = networkMonA; };
-    osd0 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd0; networkConfig = networkOsd0; };
-    osd1 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd1; networkConfig = networkOsd1; };
+    osd0 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd cfg.osd0; networkConfig = networkOsd cfg.osd0; };
+    osd1 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd cfg.osd1; networkConfig = networkOsd cfg.osd1; };
+    osd2 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd cfg.osd2; networkConfig = networkOsd cfg.osd2; };
  };

  testScript = testscript;
--- a/nixos/tests/ceph-single-node.nix
+++ b/nixos/tests/ceph-single-node.nix
@ -17,6 +17,11 @@ let
      key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
      uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
    };
+    osd2 = {
+      name = "2";
+      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
+      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
+    };
  };
  generateCephConfig = { daemonConfig }: {
    enable = true;
@ -30,7 +35,7 @@ let
  generateHost = { pkgs, cephConfig, networkConfig, ... }: {
    virtualisation = {
      memorySize = 512;
-      emptyDiskImages = [ 20480 20480 ];
+      emptyDiskImages = [ 20480 20480 20480 ];
      vlans = [ 1 ];
    };

@ -65,7 +70,7 @@ let
    };
    osd = {
      enable = true;
-      daemons = [ cfg.osd0.name cfg.osd1.name ];
+      daemons = [ cfg.osd0.name cfg.osd1.name cfg.osd2.name ];
    };
  }; };

@ -104,29 +109,36 @@ let
    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")

-    # Bootstrap both OSDs
+    # Bootstrap OSDs
    monA.succeed(
        "mkfs.xfs /dev/vdb",
        "mkfs.xfs /dev/vdc",
+        "mkfs.xfs /dev/vdd",
        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
        "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
        "mount /dev/vdc /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "mount /dev/vdd /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
        'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
        'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
+        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
    )

    # Initialize the OSDs with regular filestore
    monA.succeed(
        "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
        "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
+        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
        "chown -R ceph:ceph /var/lib/ceph/osd",
        "systemctl start ceph-osd-${cfg.osd0.name}",
        "systemctl start ceph-osd-${cfg.osd1.name}",
+        "systemctl start ceph-osd-${cfg.osd2.name}",
    )
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")

@ -161,11 +173,12 @@ let
    monA.wait_for_unit("ceph-mgr-${cfg.monA.name}")
    monA.wait_for_unit("ceph-osd-${cfg.osd0.name}")
    monA.wait_for_unit("ceph-osd-${cfg.osd1.name}")
+    monA.wait_for_unit("ceph-osd-${cfg.osd2.name}")

    # Ensure the cluster comes back up again
    monA.succeed("ceph -s | grep 'mon: 1 daemons'")
    monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
    monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
  '';
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@ -1,11 +1,10 @@
-import ./make-test.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:

 let
  configDir = "/var/lib/foobar";
  apiPassword = "some_secret";
  mqttPassword = "another_secret";
  hassCli = "hass-cli --server http://hass:8123 --password '${apiPassword}'";
-
 in {
  name = "home-assistant";
  meta = with pkgs.stdenv.lib; {
@ -69,36 +68,44 @@ in {
  };

  testScript = ''
-    startAll;
-    $hass->waitForUnit("home-assistant.service");
+    start_all()
+    hass.wait_for_unit("home-assistant.service")
+    with subtest("Check that YAML configuration file is in place"):
+        hass.succeed("test -L ${configDir}/configuration.yaml")
+    with subtest("lovelace config is copied because lovelaceConfigWritable = true"):
+        hass.succeed("test -f ${configDir}/ui-lovelace.yaml")
+    with subtest("Check that Home Assistant's web interface and API can be reached"):
+        hass.wait_for_open_port(8123)
+        hass.succeed("curl --fail http://localhost:8123/states")
+        assert "API running" in hass.succeed(
+            "curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/"
+        )
+    with subtest("Toggle a binary sensor using MQTT"):
+        assert '"state": "off"' in hass.succeed(
+            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
+        )
+        hass.wait_until_succeeds(
+            "mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light"
+        )
+        assert '"state": "on"' in hass.succeed(
+            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
+        )
+    with subtest("Toggle a binary sensor using hass-cli"):
+        assert '"state": "on"' in hass.succeed(
+            "${hassCli} --output json state get binary_sensor.mqtt_binary_sensor"
+        )
+        hass.succeed(
+            "${hassCli} state edit binary_sensor.mqtt_binary_sensor --json='{\"state\": \"off\"}'"
+        )
+        assert '"state": "off"' in hass.succeed(
+            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
+        )
+    with subtest("Print log to ease debugging"):
+        output_log = hass.succeed("cat ${configDir}/home-assistant.log")
+        print("\n### home-assistant.log ###\n")
+        print(output_log + "\n")

-    # The config is specified using a Nix attribute set,
-    # converted from JSON to YAML, and linked to the config dir
-    $hass->succeed("test -L ${configDir}/configuration.yaml");
-    # The lovelace config is copied because lovelaceConfigWritable = true
-    $hass->succeed("test -f ${configDir}/ui-lovelace.yaml");
-
-    # Check that Home Assistant's web interface and API can be reached
-    $hass->waitForOpenPort(8123);
-    $hass->succeed("curl --fail http://localhost:8123/states");
-    $hass->succeed("curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/ | grep -qF 'API running'");
-
-    # Toggle a binary sensor using MQTT
-    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"off\"'");
-    $hass->waitUntilSucceeds("mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light");
-    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"on\"'");
-
-    # Toggle a binary sensor using hass-cli
-    $hass->succeed("${hassCli} --output json state get binary_sensor.mqtt_binary_sensor | grep -qF '\"state\": \"on\"'");
-    $hass->succeed("${hassCli} state edit binary_sensor.mqtt_binary_sensor --json='{\"state\": \"off\"}'");
-    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"off\"'");
-
-    # Print log to ease debugging
-    my $log = $hass->succeed("cat ${configDir}/home-assistant.log");
-    print "\n### home-assistant.log ###\n";
-    print "$log\n";
-
-    # Check that no errors were logged
-    $hass->fail("cat ${configDir}/home-assistant.log | grep -qF ERROR");
+    with subtest("Check that no errors were logged"):
+        assert "ERROR" not in output_log
  '';
 })
--- a/nixos/tests/ihatemoney.nix
+++ b/nixos/tests/ihatemoney.nix
@ -0,0 +1,52 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+let
+  inherit (import ../lib/testing.nix { inherit system pkgs; }) makeTest;
+in
+map (
+  backend: makeTest {
+    name = "ihatemoney-${backend}";
+    machine = { lib, ... }: {
+      services.ihatemoney = {
+        enable = true;
+        enablePublicProjectCreation = true;
+        inherit backend;
+        uwsgiConfig = {
+          http = ":8000";
+        };
+      };
+      boot.cleanTmpDir = true;
+      # ihatemoney needs a local smtp server otherwise project creation just crashes
+      services.opensmtpd = {
+        enable = true;
+        serverConfiguration = ''
+          listen on lo
+          action foo relay
+          match from any for any action foo
+        '';
+      };
+    };
+    testScript = ''
+      $machine->waitForOpenPort(8000);
+      $machine->waitForUnit("uwsgi.service");
+      my $return = $machine->succeed("curl -X POST http://localhost:8000/api/projects -d 'name=yay&id=yay&password=yay&contact_email=yay\@example.com'");
+      die "wrong project id $return" unless "\"yay\"\n" eq $return;
+      my $timestamp = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
+      my $owner = $machine->succeed("stat --printf %U:%G /var/lib/ihatemoney/secret_key");
+      die "wrong ownership for the secret key: $owner, is uwsgi running as the right user ?" unless $owner eq "ihatemoney:ihatemoney";
+      $machine->shutdown();
+      $machine->start();
+      $machine->waitForOpenPort(8000);
+      $machine->waitForUnit("uwsgi.service");
+      # check that the database is really persistent
+      print $machine->succeed("curl --basic -u yay:yay http://localhost:8000/api/projects/yay");
+      # check that the secret key is really persistent
+      my $timestamp2 = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
+      die unless $timestamp eq $timestamp2;
+      $machine->succeed("curl http://localhost:8000 | grep ihatemoney");
+    '';
+  }
+) [ "sqlite" "postgresql" ]
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@ -9,11 +9,11 @@
 stdenv.mkDerivation rec {

  pname = "kid3";
-  version = "3.8.0";
+  version = "3.8.1";

  src = fetchurl {
    url = "mirror://sourceforge/project/kid3/kid3/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1a6ixkkdp1fl3arylx06w73mwf26i0ibyplwwcn2kw5xsfxmbjp6";
+    sha256 = "1d2lr500dx7gnxw2vrvpbhadpn313ly3zyp178864z26dnfkjv8x";
  };

  nativeBuildInputs = [ wrapQtAppsHook ];
--- a/pkgs/applications/audio/qmidinet/default.nix
+++ b/pkgs/applications/audio/qmidinet/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, qt5, alsaLib, libjack2 }:

 stdenv.mkDerivation rec {
-  version = "0.6.0";
+  version = "0.6.1";
  pname = "qmidinet";

  src = fetchurl {
    url = "mirror://sourceforge/qmidinet/${pname}-${version}.tar.gz";
-    sha256 = "07hgk3a8crx262rm1fzggqarz8f1ml910vwgd32mbvlarws5cv0n";
+    sha256 = "1nvbvx3wg2s6s7r4x6m2pm9nx7pdz00ghw9h10wfqi2s474mwip0";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/audio/qsynth/default.nix
+++ b/pkgs/applications/audio/qsynth/default.nix
@ -4,11 +4,11 @@

 mkDerivation  rec {
  pname = "qsynth";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchurl {
    url = "mirror://sourceforge/qsynth/${pname}-${version}.tar.gz";
-    sha256 = "173v0jqybi5szxxvj4n6wyg9sj54rmm6pxwhynx8wkm7nsbh0aij";
+    sha256 = "12jhfan81a10vbqfky5nmam3lk6d0i4654mm192v68q5r867xmcl";
  };

  nativeBuildInputs = [ autoconf pkgconfig ];
--- a/pkgs/applications/audio/setbfree/default.nix
+++ b/pkgs/applications/audio/setbfree/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation  rec {
  pname = "setbfree";
-  version = "0.8.10";
+  version = "0.8.11";

  src = fetchzip {
    url = "https://github.com/pantherb/setBfree/archive/v${version}.tar.gz";
-    sha256 = "1hpj8qb5mhkqm4yy8mzzrrq0ljw22y807qly90vjkg61ascyina4";
+    sha256 = "0c2wc8nkrzsy0yic4y7hjz320m3d20r8152j9dk8nsnmgjmyr2ir";
  };

  postPatch = ''
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "glow";
-  version = "0.1.6";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "glow";
    rev = "v${version}";
-    sha256 = "0q35napi1aa6dfrqz26hvhzijymb9sxsf3mrrn1mh7ssgkhvmqqc";
+    sha256 = "0vhl8d7xxqqyl916nh8sgm1xdaf7xlc3r18464bd2av22q9yz68n";
  };

-  modSha256 = "07imn9p0s79x1h45dk05hjcm6946d84j6k5pnljqrz4zk64hy26c";
+  modSha256 = "0r0yq7kgz7i1wf4gxxihdrn1c8mi4wcyhadncxbln24s9c5apxsf";

  buildFlagsArray = [ "-ldflags=" "-X=main.Version=${version}" ];

--- a/pkgs/applications/graphics/imv/default.nix
+++ b/pkgs/applications/graphics/imv/default.nix
@ -2,18 +2,18 @@
 , freeimage, fontconfig, pkgconfig
 , asciidoc, docbook_xsl, libxslt, cmocka
 , librsvg, pango, libxkbcommon, wayland
-, libGLU
+, libGLU, icu
 }:

 stdenv.mkDerivation rec {
  pname = "imv";
-  version = "4.0.1";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner  = "eXeC64";
    repo   = "imv";
    rev    = "v${version}";
-    sha256 = "sha256:01fbkbwwsyr00k3mwans8jfb9p4gl02v6z62vgx0pkgrzxjkcz07";
+    sha256 = "sha256:0gk8g178i961nn3bls75a8qpv6wvfvav6hd9lxca1skaikd33zdx";
  };

  preBuild = ''
@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
    pango
    pkgconfig
    wayland
+    icu
  ];

  installFlags = [ "PREFIX=$(out)" "CONFIGPREFIX=$(out)/etc" ];
--- a/pkgs/applications/graphics/kodelife/default.nix
+++ b/pkgs/applications/graphics/kodelife/default.nix
@ -9,11 +9,23 @@

 stdenv.mkDerivation rec {
  pname = "kodelife";
-  version = "0.8.7.105";
+  version = "0.8.8.110";
+
+  suffix = {
+    aarch64-linux = "linux-arm64";
+    armv7l-linux  = "linux-armhf";
+    x86_64-darwin = "macos";
+    x86_64-linux  = "linux-x86_64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

  src = fetchzip {
-    url = "https://hexler.net/pub/${pname}/${pname}-${version}-linux-x86_64.zip";
-    sha256 = "0ld4lwigzwlikx04qy3gskqqg0wzlk8m3ccrd704ifl8lsp46n5r";
+    url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.zip";
+    sha256 = {
+      aarch64-linux = "1lcpj1mgkvksq1d08ibh59y0dmdh7zm77wi5ziqhg3p5g9nxyasd";
+      armv7l-linux  = "0sljy06302x567jqw5lagbyhpc3j140jk4wccacxjrbb6hcx3l42";
+      x86_64-darwin = "1b058s9kny026q395nj99v8hggxkgv43nnjkmx1a2siajw0db94c";
+      x86_64-linux  = "1q77cpz4gflrvfz6dm6np8sqbwyr235gq7y4pzs4hnqbrdzd4nwl";
+    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

  dontConfigure = true;
@ -36,7 +48,7 @@ stdenv.mkDerivation rec {
      libGLU libGL
      xorg.libX11
    ];
-  in ''
+  in stdenv.lib.optionalString (!stdenv.isDarwin) ''
    patchelf \
      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
      --set-rpath "${libPath}" \
@ -48,6 +60,6 @@ stdenv.mkDerivation rec {
    description = "Real-time GPU shader editor";
    license = licenses.unfree;
    maintainers = with maintainers; [ prusnak ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "aarch64-linux" "armv7l-linux" "x86_64-darwin" "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@ -5,6 +5,7 @@

  cmake,
  gzip,
+  installShellFiles,
  makeWrapper,
  ncurses,
  pkgconfig,
@ -52,20 +53,21 @@ let
  ];
 in buildRustPackage rec {
  pname = "alacritty";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "jwilm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0adaqdbma6gskb2g14yscrgr9gch5wf2g2clchplv72c2qr1k427";
+    sha256 = "05jcg33ifngpzw2hdhgb614j87ihhhlqgar0kky183rywg0dxikg";
  };

-  cargoSha256 = "1r267g8f986nxh8ms5yhp50qy1yl8gly2jr78p738qqc6frlxlhv";
+  cargoSha256 = "1kc9n10kb4j87x337pzl6wpi0qj5ib2mqmrjag2yld3138dag71n";

  nativeBuildInputs = [
    cmake
    gzip
+    installShellFiles
    makeWrapper
    ncurses
    pkgconfig
@ -93,9 +95,9 @@ in buildRustPackage rec {
    patchelf --set-rpath "${stdenv.lib.makeLibraryPath rpathLibs}" $out/bin/alacritty
  '') + ''

-    install -D extra/completions/_alacritty -t "$out/share/zsh/site-functions/"
-    install -D extra/completions/alacritty.bash -t "$out/etc/bash_completion.d/"
-    install -D extra/completions/alacritty.fish -t "$out/share/fish/vendor_completions.d/"
+    installShellCompletion --zsh extra/completions/_alacritty
+    installShellCompletion --bash extra/completions/alacritty.bash
+    installShellCompletion --fish extra/completions/alacritty.fish

    install -dm 755 "$out/share/man/man1"
    gzip -c extra/alacritty.man > "$out/share/man/man1/alacritty.1.gz"
@ -112,9 +114,9 @@ in buildRustPackage rec {

  meta = with stdenv.lib; {
    description = "GPU-accelerated terminal emulator";
-    homepage = https://github.com/jwilm/alacritty;
-    license = with licenses; [ asl20 ];
+    homepage = "https://github.com/jwilm/alacritty";
+    license = licenses.asl20;
    maintainers = with maintainers; [ filalex77 mic92 ];
-    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@ -2,11 +2,11 @@

 pythonPackages.buildPythonApplication rec {
  pname = "cherrytree";
-  version = "0.38.9";
+  version = "0.38.10";

  src = fetchurl {
    url = "https://www.giuspen.com/software/${pname}-${version}.tar.xz";
-    sha256 = "0xal09ijgxbzvp003s40xbrfnpq3ald1fw8nnpqq3yg7h6g6c5pw";
+    sha256 = "1bj83b7lwqir13fp9slcdn8mgign06vywy42x8zvsp22fjn4p7f7";
  };

  nativeBuildInputs = [ gettext ];
--- a/pkgs/applications/misc/librecad/default.nix
+++ b/pkgs/applications/misc/librecad/default.nix
@ -1,8 +1,23 @@
-{ mkDerivation, lib, fetchFromGitHub, installShellFiles, pkgconfig, runtimeShell
-, qtbase, qtsvg, qttools, qmake
-, boost, muparser }:
+{ boost
+, fetchFromGitHub
+, installShellFiles
+, mkDerivationWith
+, muparser
+, pkgconfig
+, qmake
+, qtbase
+, qtsvg
+, qttools
+, runtimeShell
+, gcc8Stdenv
+}:

-mkDerivation rec {
+let
+  stdenv = gcc8Stdenv;
+in
+
+# Doesn't build with gcc9
+mkDerivationWith stdenv.mkDerivation rec {
  pname = "librecad";
  version = "2.2.0-rc1";

@ -13,7 +28,9 @@ mkDerivation rec {
    sha256 = "0kwj838hqzbw95gl4x6scli9gj3gs72hdmrrkzwq5rjxam18k3f3";
  };

-  patches = [ ./fix_qt_5_11_build.patch ];
+  patches = [
+    ./fix_qt_5_11_build.patch
+  ];

  postPatch = ''
    substituteInPlace scripts/postprocess-unix.sh \
@ -48,17 +65,30 @@ mkDerivation rec {
    runHook postInstall
  '';

-  buildInputs = [ boost muparser qtbase qtsvg ];
+  buildInputs = [
+    boost
+    muparser
+    qtbase
+    qtsvg
+  ];

-  nativeBuildInputs = [ installShellFiles pkgconfig qmake qttools ];
+  nativeBuildInputs = [
+    installShellFiles
+    pkgconfig
+    qmake
+    qttools
+  ];

  enableParallelBuilding = true;

-  meta = with lib; {
+  meta = with stdenv.lib; {
    description = "2D CAD package based on Qt";
    homepage = "https://librecad.org";
    license = licenses.gpl2;
-    maintainers = with maintainers; [ viric ];
+    maintainers = with maintainers; [
+      kiwi
+      viric
+    ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -373,5 +373,12 @@ stdenv.mkDerivation (rec {
 # unfortunately we can't just set this to `false` when we do not want it.
 # See https://github.com/NixOS/nixpkgs/issues/77289 for more details
 lib.optionalAttrs (lib.versionAtLeast ffversion "72") {
+  # Ideally we would figure out how to tell the build system to not
+  # care about changed hashes as we are already doing that when we
+  # fetch the sources. Any further modifications of the source tree
+  # is on purpose by some of our tool (or by accident and a bug?).
  dontFixLibtool = true;
+
+  # on aarch64 this is also required
+  dontUpdateAutotoolsGnuConfigScripts = true;
 })
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -16,10 +16,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    ffversion = "72.0";
+    ffversion = "72.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "3ri375myxn040avylz3xdvbgyb0ixn0q1sszrsc4b9jp620j1732qixylw0lyfym5a0vkhpmihbp5kdjrmc4r26myjar5c9zjzisnd0";
+      sha512 = "37ryimi6yfpcha4c9mcv8gjk38kia1lr5xrj2lglwsr1jai7qxrcd8ljcry8bg87qfwwb9fa13prmn78f5pzpxr7jf8gnsbvr6adxld";
    };

    patches = [
@ -99,10 +99,10 @@ rec {

  firefox-esr-68 = common rec {
    pname = "firefox-esr";
-    ffversion = "68.4.0esr";
+    ffversion = "68.4.1esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "29h0fm929jrk9nbb40bajf6a6s4x9w8zc2qw1hrg5jki1pabx30wdgn372pb51ak371a0q59k8p1vab6j31q7par6xvpwh7aiydfq04";
+      sha512 = "3nqchvyr95c9xvz23z0kcqqyx8lskw0lxa3rahiagc7b71pnrk8l40c7327q1wd4y5g16lix0fg04xiy6lqjfycjsrjlfr2y6b51n4d";
    };

    patches = [
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -93,19 +93,19 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "9.0.2";
+  version = "9.0.3";

  lang = "en-US";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "1xdnqphsj7wzwyv927jwd3fi36srx0minydwl5jg5yyd3m3if9hb";
+      sha256 = "0saipnmhjfqwrx0q8mn3zc9n0j5a754cfipdaizbcqwm9dwd70w9";
    };

    i686-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "1qk9fg5dvyyvbngsqla00by8a974mpvq9pnm2djif54lr2nfivwf";
+      sha256 = "19r6zm81p9fv9ldsck5wilcihvb5bifmd1cms6wdkldz8crnn9l6";
    };
  };
 in
--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@ -14,6 +14,7 @@
 , libpeas
 , dbus
 , vala
+, wrapGAppsHook
 , xorg
 , xvfb_run
 , libxml2
@ -21,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "calls";
-  version = "unstable-2019-10-29";
+  version = "0.1.1";

  src = fetchFromGitLab {
    domain = "source.puri.sm";
    owner = "Librem5";
    repo = "calls";
-    rev = "9fe575053d8f01c3a76a6c20d39f0816166d5afd";
+    rev = "v${version}";
    sha256 = "01inx4mvrzvklwrfryw5hw9p89v8cn78m3qmv97g7a3v0h5c0n35";
  };

@ -37,6 +38,7 @@ stdenv.mkDerivation rec {
    pkgconfig
    desktop-file-utils
    vala
+    wrapGAppsHook
  ];

  buildInputs = [
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -112,8 +112,8 @@ in rec {
  terraform_0_11-full = terraform_0_11.full;

  terraform_0_12 = pluggable (generic {
-    version = "0.12.18";
-    sha256 = "1p2rvs9dw2rzzggf3q2lifwbd82b7xb3jpb4yz5nmggn5g22qlc1";
+    version = "0.12.19";
+    sha256 = "067gzxysz8r2myj3rh0vwrs0pmbgb21jxlmawlf4v0lkjnhj6kwv";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@ -34,11 +34,11 @@
 in
 stdenv.mkDerivation rec {
  pname = "suricata";
-  version = "5.0.0";
+  version = "5.0.1";

  src = fetchurl {
    url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    sha256 = "0qwav4qpvx3i5khkyvdvx42n8b9mza8c4cpxvrf7m4lnf51cqgba";
+    sha256 = "034b0nl0hkh0v26gwbawi2wdv7mb9p54cfg8gc9b8hsw49k3c1wh";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@ -4,11 +4,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "mpop";
-  version = "1.4.6";
+  version = "1.4.7";

  src = fetchurl {
    url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "0q4ifzvl1gcndvqqqk7n9mc599r4s2knxjc7alflwb366fql58gv";
+    sha256 = "0c6n5afn9pr4p7gxkv462lysrw52w9fhvavzm99c78dcp9dj5xnk";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@ -9,11 +9,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "msmtp";
-  version = "1.8.6";
+  version = "1.8.7";

  src = fetchurl {
    url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "1qa260xrm0fzlwxpjvgvq39m4dfkskjlyb7m4y2vlr8c8d3z29b6";
+    sha256 = "1waiiksa57byb7gvx1zmh6srvl6r8rvwqklk0slb3iaf4kfbqlws";
  };

  patches = [
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -3,19 +3,19 @@
 let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
-      version = "1.3.2";
+      version = "1.3.3";
      name = "${stname}-${version}";

      src = fetchFromGitHub {
        owner  = "syncthing";
        repo   = "syncthing";
        rev    = "v${version}";
-        sha256 = "029mym3vdfg616gpmhv6p22iy65h8vff2sq6z70l37bjf3zx1cms";
+        sha256 = "0bcp8kbj8xsnly2dfafnfvj6vl27mbgvj84pjk0wxdjfnr2my9ic";
      };

      goPackagePath = "github.com/syncthing/syncthing";

-      modSha256 = "06anhfi9mswmwhhjyz8mla6h8v83cc7slfr752fvgfaxra1fwgx8";
+      modSha256 = "0kv24bi3w3pvjyjng7ly67brq8wkc1xnhsyha1h7v3jbmj5fgb12";

      patches = [
        ./add-stcli-target.patch
--- a/pkgs/applications/office/vnote/default.nix
+++ b/pkgs/applications/office/vnote/default.nix
@ -3,7 +3,7 @@
 let
  description = "A note-taking application that knows programmers and Markdown better";
 in mkDerivation rec {
-  version = "2.7.2";
+  version = "2.8.2";
  pname = "vnote";

  src = fetchFromGitHub {
@ -11,7 +11,7 @@ in mkDerivation rec {
    repo = "vnote";
    fetchSubmodules = true;
    rev = "v${version}";
-    sha256 = "0mk1ingcyznpwq4bfkxa8nx9yx5y3kgsmr4qffriq7bh1cx9dwjy";
+    sha256 = "18qffq5c2plr5rjb5lafhdz1v5kbbb2wiyacgdhh3xni3khni52l";
  };

  nativeBuildInputs = [ qmake ];
--- a/pkgs/applications/radio/qsstv/default.nix
+++ b/pkgs/applications/radio/qsstv/default.nix
@ -1,13 +1,13 @@
-{ stdenv, fetchurl, qtbase, qmake, makeDesktopItem, openjpeg, pkgconfig, fftw,
+{ mkDerivation, stdenv, fetchurl, qtbase, qmake, openjpeg, pkgconfig, fftw,
  libpulseaudio, alsaLib, hamlib, libv4l, fftwFloat }:

-stdenv.mkDerivation rec {
-  version = "9.2.6";
+mkDerivation rec {
+  version = "9.4.4";
  pname = "qsstv";

  src = fetchurl {
    url = "http://users.telenet.be/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
-    sha256 = "0sx70yk389fq5djvjwnam6ics5knmg9b5x608bk2sjbfxkila108";
+    sha256 = "0f9hx6sy418cb23fadll298pqbc5l2lxsdivi4vgqbkvx7sw58zi";
  };

  enableParallelBuilding = true;
@ -20,27 +20,9 @@ stdenv.mkDerivation rec {
  buildInputs = [ qtbase openjpeg fftw libpulseaudio alsaLib hamlib libv4l
                  fftwFloat ];

-  desktopItem = makeDesktopItem {
-    name = "QSSTV";
-    exec = "qsstv";
-    icon = "qsstv.png";
-    comment = "Qt-based slow-scan TV and fax";
-    desktopName = "QSSTV";
-    genericName = "qsstv";
-    categories = "Application;HamRadio;";
-  };
-
-  installPhase = ''
-    # Install binary to the right location
-    make install INSTALL_ROOT=$out
-    mv $out/usr/bin $out/
-    rm -r $out/usr
-
+  postInstall = ''
    # Install desktop icon
    install -D qsstv/icons/qsstv.png $out/share/pixmaps/qsstv.png
-
-    # Install desktop item
-    cp -rv ${desktopItem}/share $out
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/science/biology/bayescan/default.nix
+++ b/pkgs/applications/science/biology/bayescan/default.nix
@ -0,0 +1,39 @@
+{ stdenv, fetchurl, unzip, llvmPackages }:
+
+stdenv.mkDerivation rec {
+  pname = "bayescan";
+  version = "2.1";
+
+  src = fetchurl {
+    url = "http://cmpg.unibe.ch/software/BayeScan/files/BayeScan${version}.zip";
+    sha256 = "0ismima8j8z0zj9yc267rpf7z90w57b2pbqzjnayhc3ab8mcbfy6";
+  };
+
+  nativeBuildInputs = [ unzip ];
+  buildInputs = stdenv.lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  # Disable FORTIFY_SOURCE or the binary fails with "buffer overflow"
+  hardeningDisable = [ "fortify" ];
+
+  sourceRoot = "BayeScan${version}/source";
+
+  postPatch = ''
+    substituteInPlace Makefile --replace "-static" "" \
+                               --replace "g++" "c++"
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/doc/bayescan
+    cp bayescan_${version} $out/bin
+    cp -r ../*pdf ../input_examples ../"R functions" $out/share/doc/bayescan
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Detecting natural selection from population-based genetic data";
+    homepage = "http://cmpg.unibe.ch/software/BayeScan";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.bzizou ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
--- a/pkgs/applications/science/electronics/ngspice/default.nix
+++ b/pkgs/applications/science/electronics/ngspice/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "ngspice";
-  version = "30";
+  version = "31";

  src = fetchurl {
    url = "mirror://sourceforge/ngspice/ngspice-${version}.tar.gz";
-    sha256 = "15v0jdfy2a2zxp8dmy04fdp7w7a4vwvffcwa688r81b86wphxzh8";
+    sha256 = "10n2lnfrpsv4vyrirkphr4jwjjhy7i617g6za78dwirfjq63npw4";
  };

  nativeBuildInputs = [ flex bison ];
--- a/pkgs/applications/science/electronics/pcb/default.nix
+++ b/pkgs/applications/science/electronics/pcb/default.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "pcb";
-  version = "4.2.0";
+  version = "4.2.1";

  src = fetchurl {
    url = "mirror://sourceforge/pcb/${pname}-${version}.tar.gz";
-    sha256 = "0hwsqmcrnk4wipbmfqx1yckmmgfn8vr37d1gh5srfy27czgkcjyd";
+    sha256 = "1i9zvcj0vgwp2g2hkmvafdq0k39klj90jsdanqx9xl7gl70345cq";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "gmsh";
-  version = "4.4.1";
+  version = "4.5.1";

  src = fetchurl {
    url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "1p7hibmsgv961lfkzdxlgcvmcb0q155m2sp60r97cjsfzhw68g45";
+    sha256 = "0rjwxpz5qwq6dj7ka53mhxlgnp9bs5jphhsamlb0nk3h8kzckisq";
  };

  buildInputs = [ openblasCompat gmm fltk libjpeg zlib libGLU libGL
--- a/pkgs/applications/window-managers/sway/lock-fancy.nix
+++ b/pkgs/applications/window-managers/sway/lock-fancy.nix
@ -0,0 +1,47 @@
+{ stdenv, fetchFromGitHub, coreutils, grim, gawk, swaylock
+, imagemagick, getopt, fontconfig, makeWrapper
+}:
+
+let
+  depsPath = stdenv.lib.makeBinPath [
+    coreutils
+    grim
+    gawk
+    swaylock
+    imagemagick
+    getopt
+    fontconfig
+  ];
+in stdenv.mkDerivation rec {
+  pname = "swaylock-fancy-unstable";
+  version = "2019-03-31";
+
+  src = fetchFromGitHub {
+    owner = "Big-B";
+    repo = pname;
+    rev = "35618ceec70338047355b6b057825e68f16971b5";
+    sha256 = "06fjqwblmj0d9pq6y11rr73mizirna4ixy6xkvblf1c7sn5n8lpc";
+  };
+
+  postPatch = ''
+    substituteInPlace swaylock-fancy \
+      --replace "/usr/share" "$out/share"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/swaylock-fancy \
+      --prefix PATH : "${depsPath}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "This is an swaylock bash script that takes a screenshot of the desktop, blurs the background and adds a lock icon and text";
+    homepage = "https://github.com/Big-B/swaylock-fancy";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ma27 ];
+  };
+}
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -30,13 +30,13 @@ assert (privateBuildPlan != null) -> set != null;
 stdenv.mkDerivation rec {
  pname = if set != null then "iosevka-${set}" else "iosevka";

-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "Iosevka";
    rev = "v${version}";
-    sha256 = "0s0vdvp1sn8p2pi2xm9n05pabk30ki7wjlmr0zz0nkhidb8apw6k";
+    sha256 = "0k7xij473g5g0lwhb6qpn70v3n2d025dww3nlb7jwbpnp03zliz0";
  };

  nativeBuildInputs = [
--- a/pkgs/data/fonts/iosevka/package.json
+++ b/pkgs/data/fonts/iosevka/package.json
@ -1,6 +1,6 @@
 {
 	"name": "iosevka-build-deps",
-	"version": "2.3.2",
+	"version": "2.3.3",
 	"scripts": {
 		"build": "verda -f verdafile.js"
 	},
@ -15,12 +15,12 @@
 		"patrisika-scopes": "^0.11.1",
 		"primitive-quadify-off-curves": "^0.4.0",
 		"stylus": "^0.54.5",
-		"toml": "^2.3.2",
+		"toml": "^3.0.0",
 		"topsort": "0.0.2",
 		"ttf2woff": "^2.0.1",
 		"ttf2woff2": "^2.0.3",
-		"unorm": "^1.4.1",
+		"unorm": "^1.6.0",
 		"verda": "^1.0.0-0",
-		"yargs": "^12.0.0"
+		"yargs": "^14.2.0"
 	}
 }
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "1.007";
+  version = "1.008";
 in fetchzip {
  name = "public-sans-${version}";

@ -16,7 +16,7 @@ in fetchzip {
    unzip -j $downloadedFile binaries/webfonts/\*.woff2 -d $out/share/fonts/woff2
  '';

-  sha256 = "1yzraw08qm1ig7ks850b329xp6zv2znjwl610dppax34kwhqghsm";
+  sha256 = "1s4xmliri3r1gcn1ws3wa6davj6giliqjdbcv0bh9ryg3dfpjz74";

  meta = with lib; {
    description = "A strong, neutral, principles-driven, open source typeface for text or display";
--- a/pkgs/data/themes/amber/default.nix
+++ b/pkgs/data/themes/amber/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "amber-theme";
-  version = "3.34-1";
+  version = "3.34-2";

  src = fetchFromGitHub {
    owner = "lassekongo83";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1fmsjhaxlw2znlbjys3ggmsr7zlfk1wlng7bh54g6b0vjgdbik3r";
+    sha256 = "0809l4r1qrzs9z04kcs1j962dpsvgpwpksnxs09md5722mynn65l";
  };

  nativeBuildInputs = [ meson ninja sassc ];
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "GTK, gnome-shell and Xfce theme based on Ubuntu Ambiance";
-    homepage = https://github.com/lassekongo83/amber-theme;
+    homepage = "https://github.com/lassekongo83/amber-theme";
    license = licenses.gpl3;
    platforms = platforms.linux;
    maintainers = [ maintainers.romildo ];
--- a/pkgs/data/themes/plano/default.nix
+++ b/pkgs/data/themes/plano/default.nix
@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, gdk-pixbuf, gtk_engines, gtk-engine-murrine }:
+{ stdenv, fetchFromGitHub, gdk-pixbuf, gtk_engines, gtk-engine-murrine, librsvg }:

 stdenv.mkDerivation rec {
  pname = "plano-theme";
-  version = "3.34-1";
+  version = "3.34-2";

  src = fetchFromGitHub {
    owner = "lassekongo83";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0fdg4jyc3xv98yg2r6c8rccvbpf8y2l3x79qbpiq6ck9k6d34ycq";
+    sha256 = "0spbyvzb47vyfhcn3gr0z1gdb5xrprynm6442y1z32znai2bgpnd";
  };

-  buildInputs = [ gdk-pixbuf gtk_engines ];
+  buildInputs = [ gdk-pixbuf gtk_engines librsvg ];

  propagatedUserEnvPkgs = [ gtk-engine-murrine ];

@ -20,12 +20,12 @@ stdenv.mkDerivation rec {
  installPhase = ''
    install -dm 755 $out/share/themes/Plano
    cp -a * $out/share/themes/Plano/
-    rm $out/share/themes/Plano/{COPYING.LGPL-2.1,LICENSE,README.md}
+    rm $out/share/themes/Plano/{LICENSE,README.md}
  '';

  meta = with stdenv.lib; {
    description = "Flat theme for GNOME and Xfce";
-    homepage = https://github.com/lassekongo83/plano-theme;
+    homepage = "https://github.com/lassekongo83/plano-theme";
    license = licenses.gpl3;
    platforms = platforms.unix;
    maintainers = [ maintainers.romildo ];
--- a/pkgs/data/themes/stilo/default.nix
+++ b/pkgs/data/themes/stilo/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "stilo-themes";
-  version = "3.34-1";
+  version = "3.34-2";

  src = fetchFromGitHub {
    owner = "lassekongo83";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1qwz7i32jk7wm7m9ah6g1pxldz0rnviancndsr2lqmg55x36rs01";
+    sha256 = "1i5cl61dk8sxa6h61ghynm4wp1qzp3c7kwf4ks0ddzzk9dbvdrhb";
  };

  nativeBuildInputs = [ meson ninja sassc ];
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Minimalistic GTK, gnome shell and Xfce themes";
-    homepage = https://github.com/lassekongo83/stilo-themes;
+    homepage = "https://github.com/lassekongo83/stilo-themes";
    license = licenses.gpl3;
    platforms = platforms.linux;
    maintainers = [ maintainers.romildo ];
--- a/pkgs/data/themes/zuki/default.nix
+++ b/pkgs/data/themes/zuki/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zuki-themes";
-  version = "3.34-1";
+  version = "3.34-2";

  src = fetchFromGitHub {
    owner = "lassekongo83";
    repo = pname;
    rev = "v${version}";
-    sha256 = "19qg60rw5b0caqc542j2nrpkv8d37pai1cr1h0x2nvx0fkc3rmi2";
+    sha256 = "1nc0qh6qai6ybmz3a44q0rirri0gfg7lyqy4k4l1sci5q5ckl7x4";
  };

  nativeBuildInputs = [ meson ninja sassc ];
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Themes for GTK, gnome-shell and Xfce";
-    homepage = https://github.com/lassekongo83/zuki-themes;
+    homepage = "https://github.com/lassekongo83/zuki-themes";
    license = licenses.gpl3;
    platforms = platforms.linux;
    maintainers = [ maintainers.romildo ];
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
  pname = "fasm-bin";

-  version = "1.73.18";
+  version = "1.73.21";

  src = fetchurl {
    url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "0m88vi8ac9mlak430nyrg3nxsj0fzy3yli8kk0mqsw8rqw2pfvqb";
+    sha256 = "143zh7x3q0r2kclshh8n5w4i5pw4lh60si7rspvc725xxjpjkvcv";
  };

  installPhase = ''
--- a/pkgs/development/libraries/SDL2_mixer/default.nix
+++ b/pkgs/development/libraries/SDL2_mixer/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, autoreconfHook, pkgconfig, which
-, SDL2, libogg, libvorbis, smpeg2, flac, libmodplug
+, SDL2, libogg, libvorbis, smpeg2, flac, libmodplug, opusfile
 , CoreServices, AudioUnit, AudioToolbox
 , enableNativeMidi ? false, fluidsynth ? null }:

@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];

-  propagatedBuildInputs = [ SDL2 libogg libvorbis fluidsynth smpeg2 flac libmodplug ];
+  propagatedBuildInputs = [ SDL2 libogg libvorbis fluidsynth smpeg2 flac libmodplug opusfile ];

  configureFlags = [ "--disable-music-ogg-shared" ]
    ++ lib.optional enableNativeMidi "--enable-music-native-midi-gpl"
--- a/pkgs/development/libraries/cereal/default.nix
+++ b/pkgs/development/libraries/cereal/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
  pname = "cereal";
-  version = "1.2.2";
+  version = "1.3.0";

  nativeBuildInputs = [ cmake ];

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    owner = "USCiLab";
    repo = "cereal";
    rev = "v${version}";
-    sha256 = "1ckr8r03ggg5pyzg8yw40d5ssq40h5najvyqlnxc85fxxp8rnrx4";
+    sha256 = "0hc8wh9dwpc1w1zf5lfss4vg5hmgpblqxbrpp1rggicpx9ar831p";
  };

  cmakeFlagsArray = [ "-DJUST_INSTALL_CEREAL=yes" ];
--- a/pkgs/development/libraries/cimg/default.nix
+++ b/pkgs/development/libraries/cimg/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "cimg";
-  version = "2.7.5";
+  version = "2.8.0";

  src = fetchurl {
    url = "http://cimg.eu/files/CImg_${version}.zip";
-    sha256 = "1xhs0j7mfiln9apfcc9cd3cmjj1prm211vih2zn2qi87ialv36cg";
+    sha256 = "1nm9zpx9k3pb1p726ihw13y0d3y3xqafml7mhnx6wrkg9sfgs17n";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-sdk";
-  version = "19.3.1";
+  version = "19.4.0";

  src = fetchurl {
    url = "https://github.com/Intel-Media-SDK/MediaSDK/archive/intel-mediasdk-${version}.tar.gz";
-    sha256 = "12w1f3krcrjyhax4y3hbs7galhf4rabxym2fxjyil8cszx5fh433";
+    sha256 = "1l8wjb933wdl3vyq6r36a9pgf8n6pm9g9vcp3m393hixwzzl16i8";
  };

  # patchelf is needed for binaries in $out/share/samples
--- a/pkgs/development/libraries/java/lombok/default.nix
+++ b/pkgs/development/libraries/java/lombok/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "lombok-1.18.8";
+  name = "lombok-1.18.10";

  src = fetchurl {
    url = "https://projectlombok.org/downloads/${name}.jar";
-    sha256 = "1z14rc3fh03qvn2xkjrb7ha0hddv3f3vsp781xm336sp4cl9b5h3";
+    sha256 = "1ymjwxg01dq8qq89hx23yvk5h46hwfb8ihbqbvabmz1vh9afjdi8";
  };

  buildCommand = ''
--- a/pkgs/development/libraries/libev/default.nix
+++ b/pkgs/development/libraries/libev/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, static ? false }:

 stdenv.mkDerivation rec {
  pname = "libev";
@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
    sha256 = "0nkfqv69wfyy2bpga4d53iqydycpik8jp8x6q70353hia8mmv1gd";
  };

+  configureFlags = stdenv.lib.optional (static) "LDFLAGS=-static";
+
  meta = {
    description = "A high-performance event loop/event model with lots of features";
    maintainers = [ stdenv.lib.maintainers.raskin ];
--- a/pkgs/development/libraries/science/math/primesieve/default.nix
+++ b/pkgs/development/libraries/science/math/primesieve/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "primesieve";
-  version = "7.4";
+  version = "7.5";

  nativeBuildInputs = [cmake];

  src = fetchurl {
    url = "https://github.com/kimwalisch/primesieve/archive/v${version}.tar.gz";
-    sha256 = "16930d021ai8cl3gsnn2v6l30n6mklwwqd53z51cddd3dj69x6zz";
+    sha256 = "0g60br3p8di92jx3pr2bb51xh15gg57l7qvwzwn7xf7l585hgi7v";
  };

  meta = with stdenv.lib; {
--- a/pkgs/development/ocaml-modules/ppxfind/default.nix
+++ b/pkgs/development/ocaml-modules/ppxfind/default.nix
@ -1,4 +1,4 @@
-{ lib, buildDunePackage, fetchurl, ocaml, ocaml-migrate-parsetree }:
+{ stdenv, lib, buildDunePackage, fetchurl, ocaml, ocaml-migrate-parsetree }:

 buildDunePackage (rec {
 	pname = "ppxfind";
@ -12,6 +12,9 @@ buildDunePackage (rec {

 	buildInputs = [ ocaml-migrate-parsetree ];

+  # Don't run the native `strip' when cross-compiling.
+  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
+
 	meta = {
 		homepage = "https://github.com/diml/ppxfind";
 		description = "ocamlfind ppx tool";
--- a/pkgs/development/python-modules/azure-mgmt-iotcentral/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-iotcentral/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-iotcentral";
-  version = "1.0.0";
+  version = "2.0.0";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "9aac88ed1f993965015f4e9986931fc08798e09d7b864928681a7cebff053de8";
+    sha256 = "1fql0j28d2r6slgabb7b438gdga513iskqh4al6c7dsmj1yzdzwa";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/colormath/default.nix
+++ b/pkgs/development/python-modules/colormath/default.nix
@ -0,0 +1,32 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, networkx
+, nose
+, numpy
+, lib
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "colormath";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "gtaylor";
+    rev = "3.0.0";
+    repo = "python-colormath";
+    sha256 = "1nqf5wy8ikx2g684khzvjc4iagkslmbsxxwilbv4jpaznr9lahdl";
+  };
+
+  propagatedBuildInputs = [ networkx numpy ];
+
+  checkInputs = [ nose ];
+  checkPhase = "nosetests";
+
+  meta = with lib; {
+    description = "Color math and conversion library";
+    homepage = "https://github.com/gtaylor/python-colormath";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ jonathanreeve ];
+  };
+}
--- a/pkgs/development/python-modules/coordinates/default.nix
+++ b/pkgs/development/python-modules/coordinates/default.nix
@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "coordinates";
+  version = "0.4.0";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "clbarnes";
+    repo = "coordinates";
+    rev = "v${version}";
+    sha256 = "1zha594rshjg3qjq9mrai2hfldya282ihasp2i3km7b2j4gjdw2b";
+  };
+
+  checkInputs = [ pytest ];
+
+  checkPhase = ''
+    runHook preCheck
+    pytest tests/
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Convenience class for doing maths with explicit coordinates";
+    homepage = https://github.com/clbarnes/coordinates;
+    license = licenses.mit;
+    maintainers = [ maintainers.mildlyincompetent ];
+  };
+}
--- a/pkgs/development/python-modules/dodgy/default.nix
+++ b/pkgs/development/python-modules/dodgy/default.nix
@ -0,0 +1,40 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, lib
+
+# pythonPackages
+, mock
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "dodgy";
+  version = "0.2.1";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "landscapeio";
+    repo = pname;
+    rev = version;
+    sha256 = "0ywwjpz0p6ls3hp1lndjr9ql6s5lkj7dgpll1h87w04kwan70j0x";
+  };
+
+  checkInputs = [
+    mock
+    nose
+  ];
+
+  checkPhase = ''
+    nosetests tests/test_checks.py
+  '';
+
+  meta = with lib; {
+    description = "Looks at Python code to search for things which look \"dodgy\" such as passwords or diffs";
+    homepage = "https://github.com/landscapeio/dodgy";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}
--- a/pkgs/development/python-modules/geoip2/default.nix
+++ b/pkgs/development/python-modules/geoip2/default.nix
@ -7,12 +7,12 @@
 }:

 buildPythonPackage rec {
-  version = "2.9.0";
+  version = "3.0.0";
  pname = "geoip2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1w7cay5q6zawjzivqbwz5cqx1qbdjw6kbriccb7l46p7b39fkzzp";
+    sha256 = "1q1ciqqd0qjkpgwsg9fws8wcqchkcq84gv2g4q3xgh2lpj3yjsaq";
  };

  propagatedBuildInputs = [ requests maxminddb ]
--- a/pkgs/development/python-modules/hydra/default.nix
+++ b/pkgs/development/python-modules/hydra/default.nix
@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, fetchFromGitHub, isPy27, pytest, omegaconf, pathlib2 }:
+
+buildPythonPackage rec {
+  pname = "hydra";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "facebookresearch";
+    repo = pname;
+    rev = version;
+    sha256 = "0plbls65qfrvvigza3qvy0pwjzgkz8ylpgb1im14k3b125ny41ad";
+  };
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ omegaconf ] ++ lib.optional isPy27 pathlib2;
+
+  checkPhase = ''
+    runHook preCheck
+    pytest tests/
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "A framework for configuring complex applications";
+    homepage = https://hydra.cc;
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/ihatemoney/default.nix
+++ b/pkgs/development/python-modules/ihatemoney/default.nix
@ -0,0 +1,92 @@
+{ buildPythonPackage, lib, fetchFromGitHub, isPy27, nixosTests
+, alembic
+, aniso8601
+, Babel
+, blinker
+, click
+, dnspython
+, email_validator
+, flask
+, flask-babel
+, flask-cors
+, flask_mail
+, flask_migrate
+, flask-restful
+, flask_script
+, flask_sqlalchemy
+, flask_wtf
+, idna
+, itsdangerous
+, jinja2
+, Mako
+, markupsafe
+, mock
+, python-dateutil
+, pytz
+, six
+, sqlalchemy
+, werkzeug
+, wtforms
+, psycopg2 # optional, for postgresql support
+, flask_testing
+}:
+
+buildPythonPackage rec {
+  pname = "ihatemoney";
+  version = "4.1";
+
+  src = fetchFromGitHub {
+    owner = "spiral-project";
+    repo = pname;
+    rev = version;
+    sha256 = "1ai7v2i2rvswzv21nwyq51fvp8lr2x2cl3n34p11br06kc1pcmin";
+  };
+
+  propagatedBuildInputs = [
+    alembic
+    aniso8601
+    Babel
+    blinker
+    click
+    dnspython
+    email_validator
+    flask
+    flask-babel
+    flask-cors
+    flask_mail
+    flask_migrate
+    flask-restful
+    flask_script
+    flask_sqlalchemy
+    flask_wtf
+    idna
+    itsdangerous
+    jinja2
+    Mako
+    markupsafe
+    python-dateutil
+    pytz
+    six
+    sqlalchemy
+    werkzeug
+    wtforms
+    psycopg2
+  ];
+
+  checkInputs = [
+    flask_testing
+  ] ++ lib.optionals isPy27 [ mock ];
+
+  passthru.tests = {
+    inherit (nixosTests) ihatemoney;
+  };
+  meta = with lib; {
+    homepage = "https://ihatemoney.org";
+    description = "A simple shared budget manager web application";
+    platforms = platforms.linux;
+    license = licenses.beerware;
+    maintainers = [ maintainers.symphorien ];
+  };
+}
+
+
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@ -10,11 +10,11 @@

 buildPythonPackage rec {
  pname = "jenkins-job-builder";
-  version = "3.1.0";
+  version = "3.2.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1wcmn01md6hykblk5zz8wd5zizyisspspakz446jg2kqfv4y3q03";
+    sha256 = "1njxww53d92cpgrqlr09w2n0pk6wamjcb0mvpns1mr2pn5hy1jhi";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/m3u8/default.nix
+++ b/pkgs/development/python-modules/m3u8/default.nix
@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, python, fetchFromGitHub, requests, iso8601, bottle, pytest, pytestcov }:
+
+buildPythonPackage rec {
+  pname = "m3u8";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "globocom";
+    repo = pname;
+    rev = version;
+    sha256 = "0p6wmwv1nfa5pyakq5d55w9v142z5ja3db3s3qr44kx895d9lhng";
+  };
+
+  checkInputs = [ bottle pytest pytestcov ];
+
+  checkPhase = ''
+    pytest tests/test_{parser,model,variant_m3u8}.py
+  '';
+
+  propagatedBuildInputs = [ requests iso8601 ];
+
+  meta = with lib; {
+    homepage = "https://github.com/globocom/m3u8";
+    description = "Python m3u8 parser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Scriptkiddi ];
+  };
+}
+
--- a/pkgs/development/python-modules/omegaconf/default.nix
+++ b/pkgs/development/python-modules/omegaconf/default.nix
@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
+, pytest, pytestrunner, pyyaml, six, pathlib2, isPy27 }:
+
+buildPythonPackage rec {
+  pname = "omegaconf";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "omry";
+    repo = pname;
+    rev = version;
+    sha256 = "1vpcdjlq54pm8xmkv2hqm2n1ysvz2a9iqgf55x0w6slrb4595cwb";
+  };
+
+  checkInputs = [ pytest ];
+  buildInputs = [ pytestrunner ];
+  propagatedBuildInputs = [ pyyaml six ] ++ stdenv.lib.optional isPy27 pathlib2;
+
+  meta = with stdenv.lib; {
+    description = "A framework for configuring complex applications";
+    homepage = "https://github.com/omry/omegaconf";
+    license = licenses.free;  # prior bsd license (1988)
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@ -84,6 +84,9 @@ in buildPythonPackage rec {
    "io"
    # KeyError Timestamp
    "test_to_excel"
+    # ordering logic has changed
+    "numpy_ufuncs_other"
+    "order_without_freq"
  ] ++ optionals isDarwin [
    "test_locale"
    "test_clipboard"
--- a/pkgs/development/python-modules/pycm/default.nix
+++ b/pkgs/development/python-modules/pycm/default.nix
@ -0,0 +1,35 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, isPy3k, numpy, pytest }:
+
+buildPythonPackage rec {
+  pname = "pycm";
+  version = "2.5";
+
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner  = "sepandhaghighi";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "0zfv20hd7zq95sflsivjk47b0sm7q76w7fv2i2mafn83ficzx0p0";
+  };
+
+  # remove a trivial dependency on the author's `art` Python ASCII art library
+  postPatch = ''
+    rm pycm/__main__.py
+    substituteInPlace setup.py --replace '=get_requires()' '=[]'
+  '';
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ numpy ];
+
+  checkPhase = ''
+    pytest Test/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Multiclass confusion matrix library";
+    homepage = https://pycm.ir;
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/pylint-plugin-utils/default.nix
+++ b/pkgs/development/python-modules/pylint-plugin-utils/default.nix
@ -0,0 +1,38 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, lib
+
+# pythonPackages
+, pylint
+}:
+
+buildPythonPackage rec {
+  pname = "pylint-plugin-utils";
+  version = "0.6";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "PyCQA";
+    repo = pname;
+    rev = version;
+    sha256 = "1zapmbczxs1phrwbd0yvpfxhljd2pyv4pi9rwggaq38lcnc325s7";
+  };
+
+  propagatedBuildInputs = [
+    pylint
+  ];
+
+  checkPhase = ''
+    python tests.py
+  '';
+
+  meta = with lib; {
+    description = "Utilities and helpers for writing Pylint plugins";
+    homepage = "https://github.com/PyCQA/pylint-plugin-utils";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}
--- a/pkgs/development/python-modules/restrictedpython/default.nix
+++ b/pkgs/development/python-modules/restrictedpython/default.nix
@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# Test dependencies
+, pytest, pytest-mock
+}:
+
+buildPythonPackage rec {
+  pname = "RestrictedPython";
+  version = "5.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1g0sffn6ifkl1w8gq15rpaqm8c7l68bsnm77wcd3flyzzydmd050";
+  };
+
+  #propagatedBuildInputs = [ xmltodict requests ifaddr ];
+
+  checkInputs = [
+    pytest pytest-mock
+  ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = {
+    homepage = https://github.com/zopefoundation/RestrictedPython;
+    description = "A restricted execution environment for Python to run untrusted code";
+    license = lib.licenses.zpl21;
+    maintainers = with lib.maintainers; [ juaningan ];
+  };
+}
--- a/pkgs/development/tools/micronaut/default.nix
+++ b/pkgs/development/tools/micronaut/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "micronaut";
-  version = "1.2.6";
+  version = "1.2.8";

  src = fetchzip {
    url = "https://github.com/micronaut-projects/micronaut-core/releases/download/v${version}/${pname}-${version}.zip";
-    sha256 = "0y7qshg6v8s5rwi0fz9xpyhd1yhv8jrw2jhp276a30dfkglx19qn";
+    sha256 = "1znrgmwi11pnanvlaqlrffp5y3pz2ql6vrglbzqx8m9ydvdn1cp1";
  };

  nativeBuildInputs = [ makeWrapper installShellFiles ];
--- a/pkgs/development/tools/misc/kibana/7.x.nix
+++ b/pkgs/development/tools/misc/kibana/7.x.nix
@ -18,12 +18,12 @@ let
  shas =
    if enableUnfree
    then {
-      x86_64-linux  = "0sc5709k3z7lb8qcjpj49s6vfv69ds2wc8319ag9x776nyz1pqxi";
-      x86_64-darwin = "0zh4q46vfdwaihs838ck8fap92i3b4x10wbpmx8mcwyfk5v0fkch";
+      x86_64-linux  = "1wq4fc2fifkg1qz7nxdfb4yi2biay8cgdz7kl5k0p37sxn0sbkja";
+      x86_64-darwin = "06346kj7bv49py49pmmnmh8m24322m88v1af19909pj9cxgd0p6v";
    }
    else {
-      x86_64-linux  = "1pq17fasryharvw4byybvmcf5172hcmy6cp0m8bxhkxagwilprba";
-      x86_64-darwin = "11crpx2qs2nzkzv6fvs1gqn9v4zalxkzsc5br0fy1y02lzm26zbm";
+      x86_64-linux  = "0ygpmcm6wdcnvw8azwqc5257lyic7yw31rqvm2pw3afhpha62lpj";
+      x86_64-darwin = "0xy81g0bhxp47p29kkkh5llfzqkzqzr5dk50ap2hy0hjw33ld6g1";
    };

 in stdenv.mkDerivation rec {
--- a/pkgs/development/tools/pry/Gemfile
+++ b/pkgs/development/tools/pry/Gemfile
@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'pry'
--- a/pkgs/development/tools/pry/Gemfile.lock
+++ b/pkgs/development/tools/pry/Gemfile.lock
@ -0,0 +1,17 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    coderay (1.1.2)
+    method_source (0.9.2)
+    pry (0.12.2)
+      coderay (~> 1.1.0)
+      method_source (~> 0.9.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  pry
+
+BUNDLED WITH
+   1.17.2
--- a/pkgs/development/tools/pry/default.nix
+++ b/pkgs/development/tools/pry/default.nix
@ -0,0 +1,17 @@
+{ lib, bundlerApp, bundlerUpdateScript }:
+
+bundlerApp {
+  pname = "pry";
+  gemdir = ./.;
+  exes = [ "pry" ];
+
+  passthru.updateScript = bundlerUpdateScript "pry";
+
+  meta = with lib; {
+    description = "A Ruby runtime developer console and IRB alternative";
+    homepage    = https://pryrepl.org;
+    license     = licenses.mit;
+    maintainers = [ maintainers.tckmn ];
+    platforms   = platforms.unix;
+  };
+}
--- a/pkgs/development/tools/pry/gemset.nix
+++ b/pkgs/development/tools/pry/gemset.nix
@ -0,0 +1,33 @@
+{
+  coderay = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  method_source = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pviwzvdqd90gn6y7illcdd9adapw8fczml933p5vl739dkvl3lq";
+      type = "gem";
+    };
+    version = "0.9.2";
+  };
+  pry = {
+    dependencies = ["coderay" "method_source"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00rm71x0r1jdycwbs83lf9l6p494m99asakbvqxh8rz7zwnlzg69";
+      type = "gem";
+    };
+    version = "0.12.2";
+  };
+}
--- a/pkgs/games/ivan/default.nix
+++ b/pkgs/games/ivan/default.nix
@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, SDL2, SDL2_mixer, alsaLib, libpng, pcre }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, SDL2, SDL2_mixer, alsaLib, libpng
+, pcre, graphicsmagick, makeDesktopItem }:

 stdenv.mkDerivation rec {

@ -12,7 +13,7 @@ stdenv.mkDerivation rec {
    sha256 = "0mavmwikfsyr5sp65sl8dqknl1yz7c7ds53y1qkma24vsikz3k64";
  };

-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig graphicsmagick ];

  buildInputs = [ SDL2 SDL2_mixer alsaLib libpng pcre ];

@ -24,6 +25,26 @@ stdenv.mkDerivation rec {
  # Help CMake find SDL_mixer.h
  NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";

+  # Create "ivan.desktop" file
+  ivanDesktop = makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = "ivan.png";
+    desktopName = "IVAN";
+    genericName = pname;
+    categories = "Game;AdventureGame;RolePlaying;";
+    comment = meta.description;
+  };
+
+  # Create appropriate directories. Convert "Icon.bmp" to "ivan.png", then copy
+  # it and "ivan.desktop" to these directories.
+  postInstall = ''
+    mkdir -p $out/share/applications
+    mkdir -p $out/share/icons/hicolor/32x32/apps
+    gm convert $src/Graphics/Icon.bmp $out/share/icons/hicolor/32x32/apps/ivan.png
+    cp ${ivanDesktop}/share/applications/* $out/share/applications
+  '';
+
  meta = with stdenv.lib; {
    description = "Graphical roguelike game";
    longDescription = ''
--- a/pkgs/misc/emulators/mupen64plus/default.nix
+++ b/pkgs/misc/emulators/mupen64plus/default.nix
@ -1,15 +1,15 @@
-{stdenv, fetchurl, boost, dash, freetype, libpng, pkgconfig, SDL, which, zlib }:
+{stdenv, fetchurl, boost, dash, freetype, libpng, pkgconfig, SDL, which, zlib, nasm }:

 stdenv.mkDerivation rec {
  pname = "mupen64plus";
-  version = "2.5";
+  version = "2.5.9";

  src = fetchurl {
    url = "https://github.com/mupen64plus/mupen64plus-core/releases/download/${version}/mupen64plus-bundle-src-${version}.tar.gz";
-    sha256 = "0rmsvfn4zfvbhz6gf1xkb7hnwflv6sbklwjz2xk4dlpj4vcbjxcw";
+    sha256 = "1a21n4gqdvag6krwcjm5bnyw5phrlxw6m0mk73jy53iq03f3s96m";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig nasm ];
  buildInputs = [ boost dash freetype libpng SDL which zlib ];

  buildPhase = ''
@ -19,11 +19,11 @@ stdenv.mkDerivation rec {
    dash m64p_install.sh DESTDIR="$out" PREFIX=""
  '';

-  meta = {
+  meta = with stdenv.lib; {
    description = "A Nintendo 64 Emulator";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
    homepage = http://www.mupen64plus.org/;
-    maintainers = [ stdenv.lib.maintainers.sander ];
-    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ maintainers.sander ];
+    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/misc/logging/beats/7.x.nix
+++ b/pkgs/misc/logging/beats/7.x.nix
@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
        owner = "elastic";
        repo = "beats";
        rev = "v${version}";
-        sha256 = "0715fgqw6mqms4zld8wyf6appvvpfb1hglcmcn852c66a8zwr2r2";
+        sha256 = "192ygz3ppfah8d2b811x67jfqhcr5ivz7qh4vwrd729rjfr0bbgb";
      };

      goPackagePath = "github.com/elastic/beats";
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@ -808,6 +808,17 @@ let
    };
  };

+  defx-icons = buildVimPluginFrom2Nix {
+    pname = "defx-icons";
+    version = "2019-11-03";
+    src = fetchFromGitHub {
+      owner = "kristijanhusak";
+      repo = "defx-icons";
+      rev = "1412fd083eb54ffedb4f3ae32ddc7ce28613a144";
+      sha256 = "1x0xpixbmxm15g5nmsslccdngm14sg86ymy6mywg9xfbnrh1vn0p";
+    };
+  };
+
  defx-nvim = buildVimPluginFrom2Nix {
    pname = "defx-nvim";
    version = "2020-01-02";
@ -2179,6 +2190,17 @@ let
    };
  };

+  pear-tree = buildVimPluginFrom2Nix {
+    pname = "pear-tree";
+    version = "2019-12-08";
+    src = fetchFromGitHub {
+      owner = "tmsvg";
+      repo = "pear-tree";
+      rev = "3bb209d9637d6bd7506040b2fcd158c9a7917db3";
+      sha256 = "0n70rzw34lsnnprqna90ssqrka33qx3z0n2kj19ps8yp3j6lsxvk";
+    };
+  };
+
  peskcolor-vim = buildVimPluginFrom2Nix {
    pname = "peskcolor-vim";
    version = "2016-06-11";
@ -3489,6 +3511,17 @@ let
    };
  };

+  vim-dadbod = buildVimPluginFrom2Nix {
+    pname = "vim-dadbod";
+    version = "2020-01-02";
+    src = fetchFromGitHub {
+      owner = "tpope";
+      repo = "vim-dadbod";
+      rev = "59cc0a16970b92afa1c99182c60e35e01cdaa409";
+      sha256 = "0v3jhp33058cl7raqp59704m5ljsibpi9vs1hsiwwxf2pgdjii3f";
+    };
+  };
+
  vim-devicons = buildVimPluginFrom2Nix {
    pname = "vim-devicons";
    version = "2019-11-10";
@ -3643,6 +3676,17 @@ let
    };
  };

+  vim-endwise = buildVimPluginFrom2Nix {
+    pname = "vim-endwise";
+    version = "2019-11-13";
+    src = fetchFromGitHub {
+      owner = "tpope";
+      repo = "vim-endwise";
+      rev = "bf90d8be447de667f4532b934d1a70881be56dd8";
+      sha256 = "1czx891via5783yk222mhki94wvq75hxxp1xk1d5m90vwqb3azfn";
+    };
+  };
+
  vim-eunuch = buildVimPluginFrom2Nix {
    pname = "vim-eunuch";
    version = "2019-11-13";
@ -5679,6 +5723,17 @@ let
    };
  };

+  vista-vim = buildVimPluginFrom2Nix {
+    pname = "vista-vim";
+    version = "2020-01-06";
+    src = fetchFromGitHub {
+      owner = "liuchengxu";
+      repo = "vista.vim";
+      rev = "dcf134c83a6a3f9618a97cafab5b7fb1f1df3f84";
+      sha256 = "0w9q69a2k8a39b8zrd3sildisrdskbk6cgvbkmb3fqsr0zdzjxzv";
+    };
+  };
+
  vundle = buildVimPluginFrom2Nix {
    pname = "vundle";
    version = "2019-08-17";
--- a/Show More
+++ b/Show More