Merge master into staging-next

2020-08-07 23:01:57 +02:00 · 2020-08-07 23:01:57 +02:00 · 6a201763b4
commit 6a201763b4
parent 4fee273dda c9c957d476
193 changed files with 4273 additions and 2231 deletions
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@ -11,7 +11,7 @@ jobs:
      with:
        fetch-depth: 0
    - uses: technote-space/get-diff-action@v2.0.3
-    - name: fetch editorconfig-checker
+    - name: Fetch editorconfig-checker
      env:
        VERSION: "2.1.0"
        OS: "linux"
--- a/.github/workflows/wait-ofborg.yml
+++ b/.github/workflows/wait-ofborg.yml
@ -7,8 +7,9 @@ jobs:
    steps:
    - name: Wait for ofborg CI
      run: |
+        # Wait for ofborg ...
        # eval sometimes takes a bit longer on staging.
-        if [[ "$BASE_BRANCH" == "refs/heads/staging" ]]; then
+        if [[ "$BASE_BRANCH" == "staging" ]]; then
          COUNTDOWN=$((COUNTDOWN*2))
        fi
        # ..in future a better fix would be to make ofborg mark CI as pending right away.
@ -30,7 +31,7 @@ jobs:
      if: github.repository_owner == 'NixOS'
      env:
        BASE_BRANCH: ${{ github.base_ref }}
-        COUNTDOWN: 360 # wait for ~30min...
+        COUNTDOWN: 540 # wait for ~45min...
        GITHUB_TOKEN: ${{ github.token }}
        COMMIT: ${{ github.event.pull_request.head.sha }}
        OFBORG_APP_ID: 20500
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -721,6 +721,37 @@ services.postgresql.dataDir = "/var/db/postgresql";
     was removed, as udev gained native support to handle FIDO security tokens.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The <literal>services.transmission</literal> module
+     was enhanced with the new options:
+     <xref linkend="opt-services.transmission.credentialsFile"/>,
+     <xref linkend="opt-services.transmission.openFirewall"/>,
+     and <xref linkend="opt-services.transmission.performanceNetParameters"/>.
+    </para>
+    <para>
+     <literal>transmission-daemon</literal> is now started with additional systemd sandbox/hardening options for better security.
+     Please <link xlink:href="https://github.com/NixOS/nixpkgs/issues">report</link>
+     any use case where this is not working well.
+     In particular, the <literal>RootDirectory</literal> option newly set
+     forbids uploading or downloading a torrent outside of the default directory
+     configured at <link linkend="opt-services.transmission.settings">settings.download-dir</link>.
+     If you really need Transmission to access other directories,
+     you must include those directories into the <literal>BindPaths</literal> of the service:
+<programlisting>
+systemd.services.transmission.serviceConfig.BindPaths = [ "/path/to/alternative/download-dir" ];
+</programlisting>
+    </para>
+    <para>
+     Also, connection to the RPC (Remote Procedure Call) of <literal>transmission-daemon</literal>
+     is now only available on the local network interface by default.
+     Use:
+<programlisting>
+services.transmission.settings.rpc-bind-address = "0.0.0.0";
+</programlisting>
+     to get the previous behavior of listening on all network interfaces.
+    </para>
+   </listitem>
   <listitem>
    <para>
     With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -333,7 +333,7 @@ in
            # Wait for PostgreSQL to be ready to accept connections.
            ExecStartPost =
              let
-                setupScript = pkgs.writeScript "postgresql-setup" ''
+                setupScript = pkgs.writeScript "postgresql-setup" (''
                  #!${pkgs.runtimeShell} -e

                  PSQL="${pkgs.utillinux}/bin/runuser -u ${cfg.superUser} -- psql --port=${toString cfg.port}"
@ -360,7 +360,7 @@ in
                      $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"'
                    '') user.ensurePermissions)}
                  '') cfg.ensureUsers}
-                '';
+                '');
              in
                "+${setupScript}";
          }
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -618,12 +618,19 @@ in {
      enable = true;
      ensureUsers = singleton { name = cfg.databaseUsername; };
    };
+
    # The postgresql module doesn't currently support concepts like
    # objects owners and extensions; for now we tack on what's needed
    # here.
-    systemd.services.postgresql.postStart = mkAfter (optionalString databaseActuallyCreateLocally ''
+    systemd.services.gitlab-postgresql = let pgsql = config.services.postgresql; in mkIf databaseActuallyCreateLocally {
+      after = [ "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pgsql.package ];
+      script = ''
        set -eu

+        PSQL="${pkgs.utillinux}/bin/runuser -u ${pgsql.superUser} -- psql --port=${toString pgsql.port}"
+
        $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
        current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
        if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
@ -637,7 +644,12 @@ in {
            rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
        fi
        $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
-    '');
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };

    # Use postfix to send out mails.
    services.postfix.enable = mkDefault true;
@ -767,7 +779,7 @@ in {
    };

    systemd.services.gitlab = {
-      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "postgresql.service" "redis.service" ];
+      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
      requires = [ "gitlab-sidekiq.service" ];
      wantedBy = [ "multi-user.target" ];
      environment = gitlabEnv;
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -1,52 +1,51 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, options, ... }:

 with lib;

 let
  cfg = config.services.transmission;
+  inherit (config.environment) etc;
  apparmor = config.security.apparmor.enable;
-
-  homeDir = cfg.home;
-  downloadDirPermissions = cfg.downloadDirPermissions;
-  downloadDir = "${homeDir}/Downloads";
-  incompleteDir = "${homeDir}/.incomplete";
-
-  settingsDir = "${homeDir}/config";
-  settingsFile = pkgs.writeText "settings.json" (builtins.toJSON fullSettings);
-
-  # for users in group "transmission" to have access to torrents
-  fullSettings = { umask = 2; download-dir = downloadDir; incomplete-dir = incompleteDir; } // cfg.settings;
-
-  preStart = pkgs.writeScript "transmission-pre-start" ''
-    #!${pkgs.runtimeShell}
-    set -ex
-    cp -f ${settingsFile} ${settingsDir}/settings.json
-  '';
+  rootDir = "/run/transmission";
+  homeDir = "/var/lib/transmission";
+  settingsDir = ".config/transmission-daemon";
+  downloadsDir = "Downloads";
+  incompleteDir = ".incomplete";
+  # TODO: switch to configGen.json once RFC0042 is implemented
+  settingsFile = pkgs.writeText "settings.json" (builtins.toJSON cfg.settings);
 in
 {
  options = {
    services.transmission = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether or not to enable the headless Transmission BitTorrent daemon.
+      enable = mkEnableOption ''the headless Transmission BitTorrent daemon.

        Transmission daemon can be controlled via the RPC interface using
-          transmission-remote or the WebUI (http://localhost:9091/ by default).
+        transmission-remote, the WebUI (http://127.0.0.1:9091/ by default),
+        or other clients like stig or tremc.

-          Torrents are downloaded to ${downloadDir} by default and are
-          accessible to users in the "transmission" group.
-        '';
-      };
+        Torrents are downloaded to ${homeDir}/${downloadsDir} by default and are
+        accessible to users in the "transmission" group'';

-      settings = mkOption {
+      settings = mkOption rec {
+        # TODO: switch to types.config.json as prescribed by RFC0042 once it's implemented
        type = types.attrs;
+        apply = recursiveUpdate default;
        default =
          {
-            download-dir = downloadDir;
-            incomplete-dir = incompleteDir;
+            download-dir = "${cfg.home}/${downloadsDir}";
+            incomplete-dir = "${cfg.home}/${incompleteDir}";
            incomplete-dir-enabled = true;
+            message-level = 1;
+            peer-port = 51413;
+            peer-port-random-high = 65535;
+            peer-port-random-low = 49152;
+            peer-port-random-on-start = false;
+            rpc-bind-address = "127.0.0.1";
+            rpc-port = 9091;
+            script-torrent-done-enabled = false;
+            script-torrent-done-filename = "";
+            umask = 2; # 0o002 in decimal as expected by Transmission
+            utp-enabled = true;
          };
        example =
          {
@ -56,11 +55,12 @@ in
            rpc-whitelist = "127.0.0.1,192.168.*.*";
          };
        description = ''
-          Attribute set whos fields overwrites fields in settings.json (each
-          time the service starts). String values must be quoted, integer and
+          Attribute set whose fields overwrites fields in
+          <literal>.config/transmission-daemon/settings.json</literal>
+          (each time the service starts). String values must be quoted, integer and
          boolean values must not.

-          See https://github.com/transmission/transmission/wiki/Editing-Configuration-Files
+          See <link xlink:href="https://github.com/transmission/transmission/wiki/Editing-Configuration-Files">Transmission's Wiki</link>
          for documentation.
        '';
      };
@ -70,22 +70,32 @@ in
        default = "770";
        example = "775";
        description = ''
-          The permissions to set for download-dir and incomplete-dir.
-          They will be applied on every service start.
+          The permissions set by <literal>systemd.activationScripts.transmission-daemon</literal>
+          on the directories <link linkend="opt-services.transmission.settings">settings.download-dir</link>
+          and <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link>.
+          Note that you may also want to change
+          <link linkend="opt-services.transmission.settings">settings.umask</link>.
        '';
      };

      port = mkOption {
-        type = types.int;
-        default = 9091;
-        description = "TCP port number to run the RPC/web interface.";
+        type = types.port;
+        description = ''
+          TCP port number to run the RPC/web interface.
+
+          If instead you want to change the peer port,
+          use <link linkend="opt-services.transmission.settings">settings.peer-port</link>
+          or <link linkend="opt-services.transmission.settings">settings.peer-port-random-on-start</link>.
+        '';
      };

      home = mkOption {
        type = types.path;
-        default = "/var/lib/transmission";
+        default = homeDir;
        description = ''
-          The directory where transmission will create files.
+          The directory where Transmission will create <literal>${settingsDir}</literal>.
+          as well as <literal>${downloadsDir}/</literal> unless <link linkend="opt-services.transmission.settings">settings.download-dir</link> is changed,
+          and <literal>${incompleteDir}/</literal> unless <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link> is changed.
        '';
      };

@ -100,32 +110,174 @@ in
        default = "transmission";
        description = "Group account under which Transmission runs.";
      };
+
+      credentialsFile = mkOption {
+        type = types.path;
+        description = ''
+          Path to a JSON file to be merged with the settings.
+          Useful to merge a file which is better kept out of the Nix store
+          because it contains sensible data like <link linkend="opt-services.transmission.settings">settings.rpc-password</link>.
+        '';
+        default = "/dev/null";
+        example = "/var/lib/secrets/transmission/settings.json";
+      };
+
+      openFirewall = mkEnableOption "opening of the peer port(s) in the firewall";
+
+      performanceNetParameters = mkEnableOption ''tweaking of kernel parameters
+        to open many more connections at the same time.
+
+        Note that you may also want to increase
+        <link linkend="opt-services.transmission.settings">settings.peer-limit-global</link>.
+        And be aware that these settings are quite aggressive
+        and might not suite your regular desktop use.
+        For instance, SSH sessions may time out more easily'';
    };
  };

  config = mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
-      "d '${homeDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
-      "d '${settingsDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
-      "d '${fullSettings.download-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
-      "d '${fullSettings.incomplete-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
+    # Note that using systemd.tmpfiles would not work here
+    # because it would fail when creating a directory
+    # with a different owner than its parent directory, by saying:
+    # Detected unsafe path transition /home/foo → /home/foo/Downloads during canonicalization of /home/foo/Downloads
+    # when /home/foo is not owned by cfg.user.
+    # Note also that using an ExecStartPre= wouldn't work either
+    # because BindPaths= needs these directories before.
+    system.activationScripts.transmission-daemon = ''
+      install -d -m 700 '${cfg.home}/${settingsDir}'
+      chown -R '${cfg.user}:${cfg.group}' ${cfg.home}/${settingsDir}
+      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.download-dir}'
+      '' + optionalString cfg.settings.incomplete-dir-enabled ''
+      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.incomplete-dir}'
+      '';
+
+    assertions = [
+      { assertion = builtins.match "^/.*" cfg.home != null;
+        message = "`services.transmission.home' must be an absolute path.";
+      }
+      { assertion = types.path.check cfg.settings.download-dir;
+        message = "`services.transmission.settings.download-dir' must be an absolute path.";
+      }
+      { assertion = types.path.check cfg.settings.incomplete-dir;
+        message = "`services.transmission.settings.incomplete-dir' must be an absolute path.";
+      }
+      { assertion = cfg.settings.script-torrent-done-filename == "" || types.path.check cfg.settings.script-torrent-done-filename;
+        message = "`services.transmission.settings.script-torrent-done-filename' must be an absolute path.";
+      }
+      { assertion = types.port.check cfg.settings.rpc-port;
+        message = "${toString cfg.settings.rpc-port} is not a valid port number for `services.transmission.settings.rpc-port`.";
+      }
+      # In case both port and settings.rpc-port are explicitely defined: they must be the same.
+      { assertion = !options.services.transmission.port.isDefined || cfg.port == cfg.settings.rpc-port;
+        message = "`services.transmission.port' is not equal to `services.transmission.settings.rpc-port'";
+      }
    ];

+    services.transmission.settings =
+      optionalAttrs options.services.transmission.port.isDefined { rpc-port = cfg.port; };
+
    systemd.services.transmission = {
      description = "Transmission BitTorrent Service";
      after = [ "network.target" ] ++ optional apparmor "apparmor.service";
-      requires = mkIf apparmor [ "apparmor.service" ];
+      requires = optional apparmor "apparmor.service";
      wantedBy = [ "multi-user.target" ];
+      environment.CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;

-      # 1) Only the "transmission" user and group have access to torrents.
-      # 2) Optionally update/force specific fields into the configuration file.
-      serviceConfig.ExecStartPre = preStart;
-      serviceConfig.ExecStart = "${pkgs.transmission}/bin/transmission-daemon -f --port ${toString config.services.transmission.port} --config-dir ${settingsDir}";
-      serviceConfig.ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-      serviceConfig.User = cfg.user;
-      serviceConfig.Group = cfg.group;
-      # NOTE: transmission has an internal umask that also must be set (in settings.json)
-      serviceConfig.UMask = "0002";
+      serviceConfig = {
+        # Use "+" because credentialsFile may not be accessible to User= or Group=.
+        ExecStartPre = [("+" + pkgs.writeShellScript "transmission-prestart" ''
+          set -eu${lib.optionalString (cfg.settings.message-level >= 3) "x"}
+          ${pkgs.jq}/bin/jq --slurp add ${settingsFile} '${cfg.credentialsFile}' |
+          install -D -m 600 -o '${cfg.user}' -g '${cfg.group}' /dev/stdin \
+           '${cfg.home}/${settingsDir}/settings.json'
+        '')];
+        ExecStart="${pkgs.transmission}/bin/transmission-daemon -f";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        User = cfg.user;
+        Group = cfg.group;
+        # Create rootDir in the host's mount namespace.
+        RuntimeDirectory = [(baseNameOf rootDir)];
+        RuntimeDirectoryMode = "755";
+        # Avoid mounting rootDir in the own rootDir of ExecStart='s mount namespace.
+        InaccessiblePaths = ["-+${rootDir}"];
+        # This is for BindPaths= and BindReadOnlyPaths=
+        # to allow traversal of directories they create in RootDirectory=.
+        UMask = "0066";
+        # Using RootDirectory= makes it possible
+        # to use the same paths download-dir/incomplete-dir
+        # (which appear in user's interfaces) without requiring cfg.user
+        # to have access to their parent directories,
+        # by using BindPaths=/BindReadOnlyPaths=.
+        # Note that TemporaryFileSystem= could have been used instead
+        # but not without adding some BindPaths=/BindReadOnlyPaths=
+        # that would only be needed for ExecStartPre=,
+        # because RootDirectoryStartOnly=true would not help.
+        RootDirectory = rootDir;
+        RootDirectoryStartOnly = true;
+        MountAPIVFS = true;
+        BindPaths =
+          [ "${cfg.home}/${settingsDir}"
+            cfg.settings.download-dir
+          ] ++
+          optional cfg.settings.incomplete-dir-enabled
+            cfg.settings.incomplete-dir;
+        BindReadOnlyPaths = [
+          # No confinement done of /nix/store here like in systemd-confinement.nix,
+          # an AppArmor profile is provided to get a confinement based upon paths and rights.
+          builtins.storeDir
+          "-/etc/hosts"
+          "-/etc/ld-nix.so.preload"
+          "-/etc/localtime"
+          ] ++
+          optional (cfg.settings.script-torrent-done-enabled &&
+                    cfg.settings.script-torrent-done-filename != "")
+            cfg.settings.script-torrent-done-filename;
+        # The following options are only for optimizing:
+        # systemd-analyze security transmission
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateNetwork = mkDefault false;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        # ProtectHome=true would not allow BindPaths= to work accross /home,
+        # and ProtectHome=tmpfs would break statfs(),
+        # preventing transmission-daemon to report the available free space.
+        # However, RootDirectory= is used, so this is not a security concern
+        # since there would be nothing in /home but any BindPaths= wanted by the user.
+        ProtectHome = "read-only";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        # AF_UNIX may become usable one day:
+        # https://github.com/transmission/transmission/issues/441
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = [
+          "@system-service"
+          # Groups in @system-service which do not contain a syscall
+          # listed by perf stat -e 'syscalls:sys_enter_*' transmission-daemon -f
+          # in tests, and seem likely not necessary for transmission-daemon.
+          "~@aio" "~@chown" "~@keyring" "~@memlock" "~@resources" "~@setuid" "~@timer"
+          # In the @privileged group, but reached when querying infos through RPC (eg. with stig).
+          "quotactl"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+      };
    };

    # It's useful to have transmission in path, e.g. for remote control
@ -133,70 +285,153 @@ in

    users.users = optionalAttrs (cfg.user == "transmission") ({
      transmission = {
-        name = "transmission";
        group = cfg.group;
        uid = config.ids.uids.transmission;
        description = "Transmission BitTorrent user";
-        home = homeDir;
-        createHome = true;
+        home = cfg.home;
      };
    });

    users.groups = optionalAttrs (cfg.group == "transmission") ({
      transmission = {
-        name = "transmission";
        gid = config.ids.gids.transmission;
      };
    });

-    # AppArmor profile
+    networking.firewall = mkIf cfg.openFirewall (
+      if cfg.settings.peer-port-random-on-start
+      then
+        { allowedTCPPortRanges =
+            [ { from = cfg.settings.peer-port-random-low;
+                to   = cfg.settings.peer-port-random-high;
+              }
+            ];
+          allowedUDPPortRanges =
+            [ { from = cfg.settings.peer-port-random-low;
+                to   = cfg.settings.peer-port-random-high;
+              }
+            ];
+        }
+      else
+        { allowedTCPPorts = [ cfg.settings.peer-port ];
+          allowedUDPPorts = [ cfg.settings.peer-port ];
+        }
+    );
+
+    boot.kernel.sysctl = mkMerge [
+      # Transmission uses a single UDP socket in order to implement multiple uTP sockets,
+      # and thus expects large kernel buffers for the UDP socket,
+      # https://trac.transmissionbt.com/browser/trunk/libtransmission/tr-udp.c?rev=11956.
+      # at least up to the values hardcoded here:
+      (mkIf cfg.settings.utp-enabled {
+        "net.core.rmem_max" = mkDefault "4194304"; # 4MB
+        "net.core.wmem_max" = mkDefault "1048576"; # 1MB
+      })
+      (mkIf cfg.performanceNetParameters {
+        # Increase the number of available source (local) TCP and UDP ports to 49151.
+        # Usual default is 32768 60999, ie. 28231 ports.
+        # Find out your current usage with: ss -s
+        "net.ipv4.ip_local_port_range" = "16384 65535";
+        # Timeout faster generic TCP states.
+        # Usual default is 600.
+        # Find out your current usage with: watch -n 1 netstat -nptuo
+        "net.netfilter.nf_conntrack_generic_timeout" = 60;
+        # Timeout faster established but inactive connections.
+        # Usual default is 432000.
+        "net.netfilter.nf_conntrack_tcp_timeout_established" = 600;
+        # Clear immediately TCP states after timeout.
+        # Usual default is 120.
+        "net.netfilter.nf_conntrack_tcp_timeout_time_wait" = 1;
+        # Increase the number of trackable connections.
+        # Usual default is 262144.
+        # Find out your current usage with: conntrack -C
+        "net.netfilter.nf_conntrack_max" = 1048576;
+      })
+    ];
+
    security.apparmor.profiles = mkIf apparmor [
      (pkgs.writeText "apparmor-transmission-daemon" ''
-        #include <tunables/global>
+        include <tunables/global>

        ${pkgs.transmission}/bin/transmission-daemon {
-          #include <abstractions/base>
-          #include <abstractions/nameservice>
+          include <abstractions/base>
+          include <abstractions/nameservice>

-          ${getLib pkgs.glibc}/lib/*.so                    mr,
-          ${getLib pkgs.libevent}/lib/libevent*.so*        mr,
-          ${getLib pkgs.curl}/lib/libcurl*.so*             mr,
-          ${getLib pkgs.openssl}/lib/libssl*.so*           mr,
-          ${getLib pkgs.openssl}/lib/libcrypto*.so*        mr,
-          ${getLib pkgs.zlib}/lib/libz*.so*                mr,
-          ${getLib pkgs.libssh2}/lib/libssh2*.so*          mr,
-          ${getLib pkgs.systemd}/lib/libsystemd*.so*       mr,
-          ${getLib pkgs.xz}/lib/liblzma*.so*               mr,
-          ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*      mr,
-          ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so* mr,
-          ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*       mr,
-          ${getLib pkgs.c-ares}/lib/libcares*.so*          mr,
-          ${getLib pkgs.libcap}/lib/libcap*.so*            mr,
-          ${getLib pkgs.attr}/lib/libattr*.so*             mr,
-          ${getLib pkgs.lz4}/lib/liblz4*.so*               mr,
-          ${getLib pkgs.libkrb5}/lib/lib*.so*              mr,
-          ${getLib pkgs.keyutils}/lib/libkeyutils*.so*     mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so.* mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so.* mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so.* mr,
-          ${getLib pkgs.gcc.cc.lib}/lib/libstdc++.so.* mr,
-          ${getLib pkgs.gcc.cc.lib}/lib/libgcc_s.so.* mr,
-
-          @{PROC}/sys/kernel/random/uuid   r,
-          @{PROC}/sys/vm/overcommit_memory r,
-
-          ${pkgs.openssl.out}/etc/**                     r,
-          ${pkgs.transmission}/share/transmission/** r,
-
-          owner ${settingsDir}/** rw,
-
-          ${fullSettings.download-dir}/** rw,
-          ${optionalString fullSettings.incomplete-dir-enabled ''
-            ${fullSettings.incomplete-dir}/** rw,
+          # NOTE: https://github.com/NixOS/nixpkgs/pull/93457
+          # will remove the need for these by fixing <abstractions/base>
+          r ${etc."hosts".source},
+          r /etc/ld-nix.so.preload,
+          ${lib.optionalString (builtins.hasAttr "ld-nix.so.preload" etc) ''
+            r ${etc."ld-nix.so.preload".source},
+            ${concatMapStrings (p: optionalString (p != "") ("mr ${p},\n"))
+              (splitString "\n" config.environment.etc."ld-nix.so.preload".text)}
          ''}
+          r ${etc."ssl/certs/ca-certificates.crt".source},
+          r ${pkgs.tzdata}/share/zoneinfo/**,
+          r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+          r ${pkgs.stdenv.cc.libc}/share/locale/**,
+
+          mr ${getLib pkgs.stdenv.cc.cc}/lib/*.so*,
+          mr ${getLib pkgs.stdenv.cc.libc}/lib/*.so*,
+          mr ${getLib pkgs.attr}/lib/libattr*.so*,
+          mr ${getLib pkgs.c-ares}/lib/libcares*.so*,
+          mr ${getLib pkgs.curl}/lib/libcurl*.so*,
+          mr ${getLib pkgs.keyutils}/lib/libkeyutils*.so*,
+          mr ${getLib pkgs.libcap}/lib/libcap*.so*,
+          mr ${getLib pkgs.libevent}/lib/libevent*.so*,
+          mr ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*,
+          mr ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so*,
+          mr ${getLib pkgs.libkrb5}/lib/lib*.so*,
+          mr ${getLib pkgs.libssh2}/lib/libssh2*.so*,
+          mr ${getLib pkgs.lz4}/lib/liblz4*.so*,
+          mr ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*,
+          mr ${getLib pkgs.openssl}/lib/libcrypto*.so*,
+          mr ${getLib pkgs.openssl}/lib/libssl*.so*,
+          mr ${getLib pkgs.systemd}/lib/libsystemd*.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so*,
+          mr ${getLib pkgs.xz}/lib/liblzma*.so*,
+          mr ${getLib pkgs.zlib}/lib/libz*.so*,
+
+          r @{PROC}/sys/kernel/random/uuid,
+          r @{PROC}/sys/vm/overcommit_memory,
+          # @{pid} is not a kernel variable yet but a regexp
+          #r @{PROC}/@{pid}/environ,
+          r @{PROC}/@{pid}/mounts,
+          rwk /tmp/tr_session_id_*,
+
+          r ${pkgs.openssl.out}/etc/**,
+          r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
+          r ${pkgs.transmission}/share/transmission/**,
+
+          owner rw ${cfg.home}/${settingsDir}/**,
+          rw ${cfg.settings.download-dir}/**,
+          ${optionalString cfg.settings.incomplete-dir-enabled ''
+            rw ${cfg.settings.incomplete-dir}/**,
+          ''}
+          profile dirs {
+            rw ${cfg.settings.download-dir}/**,
+            ${optionalString cfg.settings.incomplete-dir-enabled ''
+              rw ${cfg.settings.incomplete-dir}/**,
+            ''}
+          }
+
+          ${optionalString (cfg.settings.script-torrent-done-enabled &&
+                            cfg.settings.script-torrent-done-filename != "") ''
+            # Stack transmission_directories profile on top of
+            # any existing profile for script-torrent-done-filename
+            # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
+            # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
+            px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+          ''}
+
+          # FIXME: enable customizing using https://github.com/NixOS/nixpkgs/pull/93457
+          # include <local/transmission-daemon>
        }
      '')
    ];
  };

+  meta.maintainers = with lib.maintainers; [ julm ];
 }
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -45,6 +45,12 @@ let
  inherit (config.system) stateVersion;

 in {
+
+  imports = [
+    ( mkRemovedOptionModule [ "services" "nextcloud" "nginx" "enable" ]
+      "The nextcloud module dropped support for other webservers than nginx.")
+  ];
+
  options.services.nextcloud = {
    enable = mkEnableOption "nextcloud";
    hostName = mkOption {
@ -91,16 +97,6 @@ in {
      '';
    };

-    nginx.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to enable nginx virtual host management.
-        Further nginx configuration can be done by adapting <literal>services.nginx.virtualHosts.&lt;name&gt;</literal>.
-        See <xref linkend="opt-services.nginx.virtualHosts"/> for further information.
-      '';
-    };
-
    webfinger = mkOption {
      type = types.bool;
      default = false;
@ -468,10 +464,18 @@ in {
          script = ''
            chmod og+x ${cfg.home}
            ln -sf ${cfg.package}/apps ${cfg.home}/
-            mkdir -p ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps
-            ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php

-            chown -R nextcloud:nginx ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps
+            # create nextcloud directories.
+            # if the directories exist already with wrong permissions, we fix that
+            for dir in ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps; do
+              if [ ! -e $dir ]; then
+                install -o nextcloud -g nextcloud -d $dir
+              elif [ $(stat -c "%G" $dir) != "nextcloud" ]; then
+                chgrp -R nextcloud $dir
+              fi
+            done
+
+            ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php

            # Do not install if already installed
            if [[ ! -e ${cfg.home}/config/config.php ]]; then
@ -484,6 +488,7 @@ in {
            ${occSetTrustedDomainsCmd}
          '';
          serviceConfig.Type = "oneshot";
+          serviceConfig.User = "nextcloud";
        };
        nextcloud-cron = {
          environment.NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config";
@ -502,7 +507,7 @@ in {
      services.phpfpm = {
        pools.nextcloud = {
          user = "nextcloud";
-          group = "nginx";
+          group = "nextcloud";
          phpOptions = phpOptionsStr;
          phpPackage = phpPackage;
          phpEnv = {
@ -510,27 +515,25 @@ in {
            PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin";
          };
          settings = mapAttrs (name: mkDefault) {
-            "listen.owner" = "nginx";
-            "listen.group" = "nginx";
+            "listen.owner" = config.services.nginx.user;
+            "listen.group" = config.services.nginx.group;
          } // cfg.poolSettings;
          extraConfig = cfg.poolConfig;
        };
      };

-      users.extraUsers.nextcloud = {
+      users.users.nextcloud = {
        home = "${cfg.home}";
-        group = "nginx";
+        group = "nextcloud";
        createHome = true;
      };
+      users.groups.nextcloud.members = [ "nextcloud" config.services.nginx.user ];

      environment.systemPackages = [ occ ];
-    }

-    (mkIf cfg.nginx.enable {
-      services.nginx = {
+      services.nginx = mkDefault {
        enable = true;
-        virtualHosts = {
-          ${cfg.hostName} = {
+        virtualHosts.${cfg.hostName} = {
          root = cfg.package;
          locations = {
            "= /robots.txt" = {
@ -630,8 +633,7 @@ in {
          '';
        };
      };
-      };
-    })
+    }
  ]);

  meta.doc = ./nextcloud.xml;
--- a/nixos/modules/services/web-apps/nextcloud.xml
+++ b/nixos/modules/services/web-apps/nextcloud.xml
@ -29,7 +29,6 @@
  services.nextcloud = {
    <link linkend="opt-services.nextcloud.enable">enable</link> = true;
    <link linkend="opt-services.nextcloud.hostName">hostName</link> = "nextcloud.tld";
-    <link linkend="opt-services.nextcloud.nginx.enable">nginx.enable</link> = true;
    config = {
      <link linkend="opt-services.nextcloud.config.dbtype">dbtype</link> = "pgsql";
      <link linkend="opt-services.nextcloud.config.dbuser">dbuser</link> = "nextcloud";
@ -61,9 +60,8 @@
  </para>

  <para>
-   The options <literal>hostName</literal> and <literal>nginx.enable</literal>
-   are used internally to configure an HTTP server using
-   <literal><link xlink:href="https://php-fpm.org/">PHP-FPM</link></literal>
+   The <literal>hostName</literal> option is used internally to configure an HTTP
+   server using <literal><link xlink:href="https://php-fpm.org/">PHP-FPM</link></literal>
   and <literal>nginx</literal>. The <literal>config</literal> attribute set is
   used by the imperative installer and all values are written to an additional file
   to ensure that changes can be applied by changing the module's options.
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@ -2,9 +2,9 @@

 with lib;

-let cfg = config.system.autoUpgrade; in
+let cfg = config.system.autoUpgrade;

-{
+in {

  options = {

@ -21,6 +21,16 @@ let cfg = config.system.autoUpgrade; in
        '';
      };

+      flake = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "github:kloenk/nix";
+        description = ''
+          The Flake URI of the NixOS configuration to build.
+          Disables the option <option>system.autoUpgrade.channel</option>.
+        '';
+      };
+
      channel = mkOption {
        type = types.nullOr types.str;
        default = null;
@ -35,10 +45,20 @@ let cfg = config.system.autoUpgrade; in

      flags = mkOption {
        type = types.listOf types.str;
-        default = [];
-        example = [ "-I" "stuff=/home/alice/nixos-stuff" "--option" "extra-binary-caches" "http://my-cache.example.org/" ];
+        default = [ ];
+        example = [
+          "-I"
+          "stuff=/home/alice/nixos-stuff"
+          "--option"
+          "extra-binary-caches"
+          "http://my-cache.example.org/"
+        ];
        description = ''
          Any additional flags passed to <command>nixos-rebuild</command>.
+
+          If you are using flakes and use a local repo you can add
+          <command>[ "--update-input" "nixpkgs" "--commit-lock-file" ]</command>
+          to update nixpkgs.
        '';
      };

@ -82,11 +102,23 @@ let cfg = config.system.autoUpgrade; in

  config = lib.mkIf cfg.enable {

-    system.autoUpgrade.flags =
-      [ "--no-build-output" ]
-      ++ (if cfg.channel == null
-          then [ "--upgrade" ]
-          else [ "-I" "nixpkgs=${cfg.channel}/nixexprs.tar.xz" ]);
+    assertions = [{
+      assertion = !((cfg.channel != null) && (cfg.flake != null));
+      message = ''
+        The options 'system.autoUpgrade.channels' and 'system.autoUpgrade.flake' cannot both be set.
+      '';
+    }];
+
+    system.autoUpgrade.flags = [ "--no-build-output" ]
+      ++ (if cfg.flake == null then
+        (if cfg.channel == null then
+          [ "--upgrade" ]
+        else [
+          "-I"
+          "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
+        ])
+      else
+        [ "--flake ${cfg.flake}" ]);

    systemd.services.nixos-upgrade = {
      description = "NixOS Upgrade";
@ -96,17 +128,24 @@ let cfg = config.system.autoUpgrade; in

      serviceConfig.Type = "oneshot";

-      environment = config.nix.envVars //
-        { inherit (config.environment.sessionVariables) NIX_PATH;
+      environment = config.nix.envVars // {
+        inherit (config.environment.sessionVariables) NIX_PATH;
        HOME = "/root";
      } // config.networking.proxy.envVars;

-      path = with pkgs; [ coreutils gnutar xz.bin gzip gitMinimal config.nix.package.out ];
+      path = with pkgs; [
+        coreutils
+        gnutar
+        xz.bin
+        gzip
+        gitMinimal
+        config.nix.package.out
+      ];

      script = let
-          nixos-rebuild = "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
-        in
-        if cfg.allowReboot then ''
+        nixos-rebuild =
+          "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
+      in if cfg.allowReboot then ''
        ${nixos-rebuild} boot ${toString cfg.flags}
        booted="$(readlink /run/booted-system/{initrd,kernel,kernel-modules})"
        built="$(readlink /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
@ -122,7 +161,8 @@ let cfg = config.system.autoUpgrade; in
      startAt = cfg.dates;
    };

-    systemd.timers.nixos-upgrade.timerConfig.RandomizedDelaySec = cfg.randomizedDelaySec;
+    systemd.timers.nixos-upgrade.timerConfig.RandomizedDelaySec =
+      cfg.randomizedDelaySec;

  };

--- a/nixos/modules/virtualisation/railcar.nix
+++ b/nixos/modules/virtualisation/railcar.nix
@ -46,7 +46,7 @@ let
        description = ''
          Mount options of the filesystem to be used.

-          Support optoions are listed in the mount(8) man page. Note that 
+          Support options are listed in the mount(8) man page. Note that
          both filesystem-independent and filesystem-specific options
          are listed.
        '';
--- a/nixos/tests/bittorrent.nix
+++ b/nixos/tests/bittorrent.nix
@ -19,6 +19,7 @@ let
  externalClient2Address = "80.100.100.2";
  externalTrackerAddress = "80.100.100.3";

+  download-dir = "/var/lib/transmission/Downloads";
  transmissionConfig = { ... }: {
    environment.systemPackages = [ pkgs.transmission ];
    services.transmission = {
@ -26,6 +27,7 @@ let
      settings = {
        dht-enabled = false;
        message-level = 3;
+        inherit download-dir;
      };
    };
  };
@ -117,12 +119,12 @@ in
      router.wait_for_unit("miniupnpd")

      # Create the torrent.
-      tracker.succeed("mkdir /tmp/data")
+      tracker.succeed("mkdir ${download-dir}/data")
      tracker.succeed(
-          "cp ${file} /tmp/data/test.tar.bz2"
+          "cp ${file} ${download-dir}/data/test.tar.bz2"
      )
      tracker.succeed(
-          "transmission-create /tmp/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
+          "transmission-create ${download-dir}/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
      )
      tracker.succeed("chmod 644 /tmp/test.torrent")

@ -133,18 +135,16 @@ in

      # Start the initial seeder.
      tracker.succeed(
-          "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir /tmp/data"
+          "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir ${download-dir}/data"
      )

      # Now we should be able to download from the client behind the NAT.
      tracker.wait_for_unit("httpd")
      client1.wait_for_unit("network-online.target")
+      client1.succeed("transmission-remote --add http://${externalTrackerAddress}/test.torrent >&2 &")
+      client1.wait_for_file("${download-dir}/test.tar.bz2")
      client1.succeed(
-          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --download-dir /tmp >&2 &"
-      )
-      client1.wait_for_file("/tmp/test.tar.bz2")
-      client1.succeed(
-          "cmp /tmp/test.tar.bz2 ${file}"
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
      )

      # Bring down the initial seeder.
@ -154,11 +154,11 @@ in
      # the first client created a NAT hole in the router.
      client2.wait_for_unit("network-online.target")
      client2.succeed(
-          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht --download-dir /tmp >&2 &"
+          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht >&2 &"
      )
-      client2.wait_for_file("/tmp/test.tar.bz2")
+      client2.wait_for_file("${download-dir}/test.tar.bz2")
      client2.succeed(
-          "cmp /tmp/test.tar.bz2 ${file}"
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
      )
    '';
 })
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@ -33,7 +33,6 @@ in {

      services.nextcloud = {
        enable = true;
-        nginx.enable = true;
        hostName = "nextcloud";
        config = {
          # Don't inherit adminuser since "root" is supposed to be the default
--- a/nixos/tests/nextcloud/with-mysql-and-memcached.nix
+++ b/nixos/tests/nextcloud/with-mysql-and-memcached.nix
@ -17,7 +17,6 @@ in {
      services.nextcloud = {
        enable = true;
        hostName = "nextcloud";
-        nginx.enable = true;
        https = true;
        caching = {
          apcu = true;
--- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix
+++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix
@ -17,7 +17,6 @@ in {
      services.nextcloud = {
        enable = true;
        hostName = "nextcloud";
-        nginx.enable = true;
        caching = {
          apcu = false;
          redis = true;
--- a/pkgs/applications/audio/a2jmidid/default.nix
+++ b/pkgs/applications/audio/a2jmidid/default.nix
@ -9,7 +9,7 @@ in stdenv.mkDerivation {
  version = "8";

  src = fetchurl {
-    url = "https://repo.or.cz/a2jmidid.git/snapshot/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
+    url = "https://github.com/linuxaudio/a2jmidid/archive/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
    sha256 = "06dgf5655znbvrd7fhrv8msv6zw8vk0hjqglcqkh90960mnnmwz7";
  };

@ -18,13 +18,17 @@ in stdenv.mkDerivation {

  patches = [
    (fetchpatch {
-      url = "https://repo.or.cz/a2jmidid.git/patch/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2";
+      url = "https://github.com/linuxaudio/a2jmidid/commit/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2.diff";
      sha256 = "1nxrvnhxlgqc9wbxnp1gnpw4wjyzxvymwcg1gh2nqzmssgfykfkc";
    })
    (fetchpatch {
-      url = "https://repo.or.cz/a2jmidid.git/patch/7f82da7eb2f540a94db23331be98d42a58ddc269";
+      url = "https://github.com/linuxaudio/a2jmidid/commit/7f82da7eb2f540a94db23331be98d42a58ddc269.diff";
      sha256 = "1nab9zf0agbcj5pvhl90pz0cx1d204d4janqflc5ymjhy8jyrsdv";
    })
+    (fetchpatch {
+      url = "https://github.com/linuxaudio/a2jmidid/commit/c07775d021a71cb91bf64ce1391cf525415cb060.diff";
+      sha256 = "172v9hri03qdqi8a3zsg227k5qxldd8v5bj4jk7fyk5jf50fcxga";
+    })
  ];

  postInstall = ''
@ -35,6 +39,6 @@ in stdenv.mkDerivation {
    description = "Daemon for exposing legacy ALSA sequencer applications in JACK MIDI system";
    license = licenses.gpl2;
    maintainers = [ maintainers.goibhniu ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/audio/adlplug/default.nix
+++ b/pkgs/applications/audio/adlplug/default.nix
@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, libjack2, alsaLib
 , freetype, libX11, libXrandr, libXinerama, libXext, libXcursor
-, fetchpatch
+, fetchpatch, fmt
 , adlplugChip ? "-DADLplug_CHIP=OPL3"
 , pname ? "ADLplug" }:

 stdenv.mkDerivation rec {
  inherit pname;
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "jpcima";
    repo = "ADLplug";
    rev = "v${version}";
-    sha256 = "0n9srdlgl1j528ap5xmllrqs1w6ibc5yf9sphvl1q9kjnizxrs2c";
+    sha256 = "0mqx4bzri8s880v7jwd24nb93m5i3aklqld0b3h0hjnz0lh2qz0f";
    fetchSubmodules = true;
  };

@ -25,13 +25,13 @@ stdenv.mkDerivation rec {
    })
  ];

-  cmakeFlags = [ adlplugChip ];
+  cmakeFlags = [ adlplugChip "-DADLplug_USE_SYSTEM_FMT=ON" ];

  buildInputs = [
    libjack2 alsaLib freetype libX11 libXrandr libXinerama libXext
    libXcursor
  ];
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig fmt ];

  meta = with stdenv.lib; {
    description = "OPL3 and OPN2 FM Chip Synthesizer";
--- a/pkgs/applications/audio/giada/default.nix
+++ b/pkgs/applications/audio/giada/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "giada";
-  version = "0.16.3";
+  version = "0.16.3.1";

  src = fetchFromGitHub {
    owner = "monocasual";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1sysv5d0wq6ib47bqsn3wdzkqzjpzjrgzg15bkllbm67hiz9abhh";
+    sha256 = "0z1jrkggdn630i3j59j30apaa9s242y1wiawqp4g1n9dkg3r9a1j";
  };

  configureFlags = [
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "musikcube";
-  version = "0.92.1";
+  version = "0.93.1";

  src = fetchFromGitHub {
    owner = "clangen";
    repo = pname;
    rev = version;
-    sha256 = "0l4ncxqxvp5m014j7vlglhzxhhrxl0c2m71xn0i0a27hn4nc72mr";
+    sha256 = "05qsxyr7x8l0vlmn4yjg4gglxvcw9raf6vfzvblsl2ngsdsrnizy";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/yasr/10_fix_openpty_forkpty_declarations.patch
+++ b/pkgs/applications/audio/yasr/10_fix_openpty_forkpty_declarations.patch
--- a/pkgs/applications/audio/yasr/20_maxpathlen.patch
+++ b/pkgs/applications/audio/yasr/20_maxpathlen.patch
--- a/pkgs/applications/audio/yasr/30_conf.patch
+++ b/pkgs/applications/audio/yasr/30_conf.patch
--- a/pkgs/applications/audio/yasr/40_dectalk_extended_chars.patch
+++ b/pkgs/applications/audio/yasr/40_dectalk_extended_chars.patch
--- a/pkgs/applications/audio/yasr/default.nix
+++ b/pkgs/applications/audio/yasr/default.nix
@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
  };

  patches = [
-    ./10_fix_openpty_forkpty_declarations
-    ./20_maxpathlen
-    ./30_conf
-    ./40_dectalk_extended_chars
+    ./10_fix_openpty_forkpty_declarations.patch
+    ./20_maxpathlen.patch
+    ./30_conf.patch
+    ./40_dectalk_extended_chars.patch
  ]; # taken from the debian yasr package

  meta = {
--- a/pkgs/applications/blockchains/bitcoin-abc.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc.nix
@ -7,13 +7,13 @@ with stdenv.lib;
 mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.21.10";
+  version = "0.21.12";

  src = fetchFromGitHub {
    owner = "bitcoin-ABC";
    repo = "bitcoin-abc";
    rev = "v${version}";
-    sha256 = "1m210g6db8f09m66v75ia1fdd1dlvs1srgk2jhd3wqbvnmjqa77f";
+    sha256 = "1mad3aqfwrxi06135nf8hv13d67nilmxpx4dw5vjcy1zi3lljj1j";
  };

  patches = [ ./fix-bitcoin-qt-build.patch ];
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -224,7 +224,8 @@ let
        interpreter=$(echo ${stdenv.glibc.out}/lib/ld-linux*.so.2)
        patchelf --set-interpreter "$interpreter" lib/ReSharperHost/linux-x64/mono/bin/mono-sgen
        rm -rf lib/ReSharperHost/linux-x64/dotnet
-        ln -s ${dotnet-sdk_3} lib/ReSharperHost/linux-x64/dotnet
+        mkdir -p lib/ReSharperHost/linux-x64/dotnet/
+        ln -s ${dotnet-sdk_3}/bin/dotnet lib/ReSharperHost/linux-x64/dotnet/dotnet
      '');
    });

--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@ -4,11 +4,11 @@

 mkDerivation rec {
  pname = "okteta";
-  version = "0.26.3";
+  version = "0.26.4";

  src = fetchurl {
    url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1454844s76skk18gpcf56y9pkmffs7p4z09ggmy37ifzf7yk1p19";
+    sha256 = "00qgzm5mqx0j8f0fznhnw76l9pjyw3lxirvy8ssq59nqqjbb08pg";
  };

  nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];
--- a/pkgs/applications/kde/marble.nix
+++ b/pkgs/applications/kde/marble.nix
@ -1,6 +1,6 @@
 { mkDerivation, lib
 , extra-cmake-modules, kdoctools
-, qtscript, qtsvg, qtquickcontrols, qtwebkit
+, qtscript, qtsvg, qtquickcontrols, qtwebengine
 , krunner, shared-mime-info, kparts, knewstuff
 , gpsd, perl
 }:
@ -11,7 +11,7 @@ mkDerivation {
  outputs = [ "out" "dev" ];
  nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
  propagatedBuildInputs = [
-    qtscript qtsvg qtquickcontrols qtwebkit shared-mime-info krunner kparts
+    qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
    knewstuff gpsd
  ];
  preConfigure = ''
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ArchiSteamFarm";
-  version = "4.2.3.3";
+  version = "4.2.3.6";

  src = fetchurl {
    url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
-    sha256 = "0v69rrs5fr1n5llfx42xkiish52al7kb36fjy3ng0j9qfp3g8pj7";
+    sha256 = "1a8baxrb8czndxxi16md1nyl2snfx215yvrygdpcblgngkp2z2y9";
  };

  nativeBuildInputs = [ unzip makeWrapper jq ];
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
      --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
      --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
      --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
-      --run "[ -d www ] || ln -sf $dist/www ."
+      --run "ln -sf $dist/www ."
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -30,11 +30,11 @@ let
 in
 mkDerivation rec {
  pname = "calibre";
-  version = "4.19.0";
+  version = "4.22.0";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1kpj65spwr9m88vshsljpdrw5jy7bbpqgqcrvqb17abh7fnnrb4x";
+    sha256 = "0d0wmd3ijk8px1d662igal4lfmpyzynfzs6ms1bb9nf42mq2pxai";
  };

  patches = [
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, gettext, intltool
+{ stdenv, fetchFromGitHub, fetchFromGitLab
+, autoconf, automake, gettext, intltool
 , libtool, pkgconfig, wrapGAppsHook, wrapPython, gobject-introspection
 , gtk3, python, pygobject3, pyxdg

@ -18,11 +19,16 @@ let
    stdenv.mkDerivation rec {
      inherit pname version src meta;

-      patches = [
+      patches = stdenv.lib.optionals (pname != "gammastep") [
        # https://github.com/jonls/redshift/pull/575
        ./575.patch
      ];

+      postPatch = stdenv.lib.optionalString (pname == "gammastep") ''
+        substituteInPlace configure.ac \
+          --replace "[gammastep], [2.0]" "[gammastep], [${version}]"
+      '';
+
      nativeBuildInputs = [
        autoconf
        automake
@ -62,10 +68,15 @@ let

      # the geoclue agent may inspect these paths and expect them to be
      # valid without having the correct $PATH set
-      postInstall = ''
+      postInstall = if (pname == "gammastep") then ''
+        substituteInPlace $out/share/applications/gammastep.desktop \
+          --replace 'Exec=gammastep' "Exec=$out/bin/gammastep"
+        substituteInPlace $out/share/applications/gammastep-indicator.desktop \
+          --replace 'Exec=gammastep-indicator' "Exec=$out/bin/gammastep-indicator"
+      '' else ''
        substituteInPlace $out/share/applications/redshift.desktop \
          --replace 'Exec=redshift' "Exec=$out/bin/redshift"
-        substituteInPlace $out/share/applications/redshift.desktop \
+        substituteInPlace $out/share/applications/redshift-gtk.desktop \
          --replace 'Exec=redshift-gtk' "Exec=$out/bin/redshift-gtk"
      '';

@ -118,4 +129,24 @@ rec {
      homepage = "https://github.com/minus7/redshift";
    };
  };
+
+  gammastep = mkRedshift rec {
+    pname = "gammastep";
+    version = "2.0.1";
+
+    src = fetchFromGitLab {
+      owner = "chinstrap";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "1ky4h892sg2mfbwwq5xv0vnjflsl2x3nsy5q456r1kyk1gwkj0rg";
+    };
+
+    meta = redshift.meta // {
+      name = "${pname}-${version}";
+      longDescription = "Gammastep"
+        + stdenv.lib.removePrefix "Redshift" redshift.meta.longDescription;
+      homepage = "https://gitlab.com/chinstrap/gammastep";
+      maintainers = [ stdenv.lib.maintainers.primeos ] ++ redshift.meta.maintainers;
+    };
+  };
 }
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, meson, pkgconfig, ninja, wrapGAppsHook
-, wayland, wlroots, gtkmm3, libinput, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
+, wayland, wlroots, gtkmm3, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
 , howard-hinnant-date, cmake
 , traySupport  ? true,  libdbusmenu-gtk3
 , pulseSupport ? false, libpulseaudio
@ -11,13 +11,13 @@
 }:
  stdenv.mkDerivation rec {
    pname = "waybar";
-    version = "0.9.2";
+    version = "0.9.3";

    src = fetchFromGitHub {
      owner = "Alexays";
      repo = "Waybar";
      rev = version;
-      sha256 = "1gfxyjzwfqznyrpyr3322z3w844i1lh77kly4hcpy9y5gsfmlafy";
+      sha256 = "0ks719khhg2zwpyiwa2079i6962qcxpapm28hmr4ckpsp2n659ck";
    };

    nativeBuildInputs = [
@ -32,7 +32,7 @@
    strictDeps = false;

    buildInputs = with stdenv.lib;
-      [ wayland wlroots gtkmm3 libinput libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
+      [ wayland wlroots gtkmm3 libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
      ++ optional  traySupport  libdbusmenu-gtk3
      ++ optional  pulseSupport libpulseaudio
      ++ optional  nlSupport    libnl
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
  pname = "argo";
-  version = "2.9.4";
+  version = "2.9.5";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "v${version}";
-    sha256 = "156102xqwmsq3g9jammfib0ri22a0nzk96zrv5774gidjvy2xb55";
+    sha256 = "1x44mgvnbn47a33xnhnh9bxxvj1vsr32lvh9bq6w5hpmxb7qbq4f";
  };

  vendorSha256 = "1vqmzz76lcwwnw89n4lyg4jjf7wbdgn9sdzwsgrjwkj8ax7d48cv";
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -11,15 +11,15 @@

 buildGoModule rec {
  pname = "minikube";
-  version = "1.12.1";
+  version = "1.12.2";

-  vendorSha256 = "0v2lnzdv5nmg4jf10hqyvrsyz5yg7brm4p3gil7n88w6n100phfn";
+  vendorSha256 = "0smjj2sq09k1ai79lk74gi056hfls7qy8x08wkq2g24fxi06cr94";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "minikube";
    rev = "v${version}";
-    sha256 = "0ya6mp081vs48c0nh4nys9z04kz79mjfpm4gs0hlmh2kpa5kmc9h";
+    sha256 = "1x28s6d2nibm76qd3kjsa7wkyhqvnwdy9rfwk9xf45hzrx9700sm";
  };

  nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -7,30 +7,30 @@ in {
    pname = "discord";
    binaryName = "Discord";
    desktopName = "Discord";
-    version = "0.0.10";
+    version = "0.0.11";
    src = fetchurl {
      url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-      sha256 = "0kx92i8naqr3algmyy3wyzbh8146z7gigxwf1nbpg1gl16wlplaq";
+      sha256 = "1saqwigi1gjgy4q8rgnwyni57aaszi0w9vqssgyvfgzff8fpcx54";
    };
  };
  ptb = callPackage ./base.nix rec {
    pname = "discord-ptb";
    binaryName = "DiscordPTB";
    desktopName = "Discord PTB";
-    version = "0.0.20";
+    version = "0.0.21";
    src = fetchurl {
      url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-      sha256 = "0wn2qdv0a4n59xl451y7fcq11klp2g63qwx40qkshllvnf5lzzsx";
+      sha256 = "1i164wpi07d45w19i7l5hs47crc29k3plg4y9kc97x75rhh4xym1";
    };
  };
  canary = callPackage ./base.nix rec {
    pname = "discord-canary";
    binaryName = "DiscordCanary";
    desktopName = "Discord Canary";
-    version = "0.0.105";
+    version = "0.0.106";
    src = fetchurl {
      url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-      sha256 = "1jc2zr8q33ras5mkifg19kcxpb84vsqx01rj66w62hsjw1nsbidg";
+      sha256 = "1bqlf7iixdy6c7lhbva4lizvhd6w0xqn69izxcy26wk35xcqgfh8";
    };
  };
 }.${branch}
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.62.0.85";
+  version = "8.63.0.76";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -65,7 +65,7 @@ let
          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "0qlm2hbshxgycczv227bbj2fbiw3b76rp24mh8amhq4xbscazl38";
+        sha256 = "0gmrk1giabr53imiwdflf6ykwpcj2q5zn3bynvrncnhivsbvaavy";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@ -20,13 +20,13 @@ let
  pname = "wire-desktop";

  version = {
-    x86_64-darwin = "3.18.3728";
-    x86_64-linux = "3.18.2925";
+    x86_64-darwin = "3.19.3799";
+    x86_64-linux = "3.19.2928";
  }.${system} or throwSystem;

  sha256 = {
-    x86_64-darwin = "0xi3k95yw59xsfavncc1giwxlwjz26z34qm3i604ksjjalvpzy5l";
-    x86_64-linux = "01g39hncj1w0zyfrzv4mgv8npwvx0g0lw99azyai99877b30bm8j";
+    x86_64-darwin = "1sv8n4g1pd4nwpwsg0m61zhrfjlh7sj29rnh46xjw1qg332g6cw9";
+    x86_64-linux = "038h1j59qfj5ckaxk823qpfflxay47v0jrqc0hmrdmnd2y59dpx7";
  }.${system} or throwSystem;

  meta = with stdenv.lib; {
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@ -6,13 +6,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation rec {
  pname = "octopus";
-  version = "9.2";
+  version = "10.0";

  src = fetchFromGitLab {
    owner = "octopus-code";
    repo = "octopus";
    rev = version;
-    sha256 = "083z51sjv70asr04rv53wb9gf4396nblq1zl22qw7jdr28hji4is";
+    sha256 = "1c6q20y0x9aacwa7vp6gj3yvfzain7hnk6skxmvg3wazp02l91kn";
  };

  nativeBuildInputs = [ perl procps autoreconfHook ];
--- a/pkgs/applications/science/electronics/fritzing/default.nix
+++ b/pkgs/applications/science/electronics/fritzing/default.nix
@ -1,8 +1,8 @@
-{ stdenv, fetchpatch, fetchFromGitHub, qmake, pkgconfig
+{ mkDerivation, stdenv, fetchpatch, fetchFromGitHub, qmake, pkgconfig
 , qtbase, qtsvg, qtserialport, boost, libgit2
 }:

-stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "fritzing";
  version = "0.9.3b";

--- a/pkgs/applications/science/electronics/hyp2mat/default.nix
+++ b/pkgs/applications/science/electronics/hyp2mat/default.nix
@ -0,0 +1,53 @@
+{ stdenv
+, fetchFromGitHub
+, bison
+, flex
+, gengetopt
+, help2man
+, groff
+, libharu
+, autoreconfHook
+, pkgconfig
+, libpng
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hyp2mat";
+  version = "0.0.17";
+
+  src = fetchFromGitHub {
+    owner = "koendv";
+    repo = "hyp2mat";
+    rev = "v${version}";
+    sha256 = "04bd2vrn8y1izir7pwl34a60cg2v05baqcrmpfdx5fvf33bbflaj";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    libharu
+    libpng
+    zlib
+    bison
+    flex
+    gengetopt
+    help2man
+    groff
+  ];
+
+  configureFlags = [ "--enable-library" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Import Hyperlynx Boardsim files to openEMS, an open source 3D full-wave electromagnetic field solver";
+    homepage = https://github.com/koendv/hyp2mat;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ matthuszagh ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/ghq/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghq/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "ghq";
-  version = "1.1.2";
+  version = "1.1.5";

  src = fetchFromGitHub {
    owner = "x-motemen";
    repo = "ghq";
    rev = "v${version}";
-    sha256 = "1qzrycmd26f4q36z3rblfxp7jngqgmspb9385vpfwv9laiw3sqrg";
+    sha256 = "098fik155viylq07az7crzbgswcvhpx0hr68xpvyx0rpri792jbq";
  };

-  vendorSha256 = "0x347ljj9q3zi0zf8x13dhvsydv9vg4qc5l1kc2y56v0w8hlb4p7";
+  vendorSha256 = "0gll132g111vn1hdmdjpkha9rbyppz0qj1ld89gwlk2mqd57jxkd";

  buildFlagsArray = ''
    -ldflags=
--- a/pkgs/applications/video/obs-studio/wlrobs.nix
+++ b/pkgs/applications/video/obs-studio/wlrobs.nix
@ -13,12 +13,12 @@ assert dmabufSupport -> libdrm != null && libGL != null;

 stdenv.mkDerivation {
  pname = "obs-wlrobs";
-  version = "20200111";
+  version = "20200622";

  src = fetchhg {
    url = "https://hg.sr.ht/~scoopta/wlrobs";
-    rev = "8345bf985e390896d89e35e2feae1fa37722f4be";
-    sha256 = "0j01wkhwhhla4qx8mwyrq2qj9cfhxksxaq2k8rskmy2qbdkvvdpb";
+    rev = "1d3acaaf64049da3da9721aa8b9b47582fe0081b";
+    sha256 = "0qrcf8024r4ynfjw0zx8vn59ygx9q5rb196s6nyxmy3gkv2lfxlq";
  };

  buildInputs = [ libX11 libGL libdrm meson ninja pkgconfig wayland obs-studio ];
--- a/pkgs/desktops/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/default.nix
@ -1,14 +1,14 @@
 { callPackage, pkgs }:
 {
  #### CORE EFL
-  efl = callPackage ./efl.nix { };
+  efl = callPackage ./efl { };

  #### WINDOW MANAGER
-  enlightenment = callPackage ./enlightenment.nix { };
+  enlightenment = callPackage ./enlightenment { };

  #### APPLICATIONS
-  econnman = callPackage ./econnman.nix { };
-  terminology = callPackage ./terminology.nix { };
-  rage = callPackage ./rage.nix { };
-  ephoto = callPackage ./ephoto.nix { };
+  econnman = callPackage ./econnman { };
+  terminology = callPackage ./terminology { };
+  rage = callPackage ./rage { };
+  ephoto = callPackage ./ephoto { };
 }
--- a/pkgs/desktops/enlightenment/econnman/default.nix
+++ b/pkgs/desktops/enlightenment/econnman/default.nix
--- a/pkgs/desktops/enlightenment/efl/0002-efreet-more-stat-info-changes.patch
+++ b/pkgs/desktops/enlightenment/efl/0002-efreet-more-stat-info-changes.patch
--- a/pkgs/desktops/enlightenment/efl/default.nix
+++ b/pkgs/desktops/enlightenment/efl/default.nix
--- a/pkgs/desktops/enlightenment/efl/efl-elua.patch
+++ b/pkgs/desktops/enlightenment/efl/efl-elua.patch
--- a/pkgs/desktops/enlightenment/enlightenment/0001-wrapped-setuid-executables.patch
+++ b/pkgs/desktops/enlightenment/enlightenment/0001-wrapped-setuid-executables.patch
--- a/pkgs/desktops/enlightenment/enlightenment/0003-setuid-missing-path.patch
+++ b/pkgs/desktops/enlightenment/enlightenment/0003-setuid-missing-path.patch
--- a/pkgs/desktops/enlightenment/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/enlightenment/default.nix
--- a/pkgs/desktops/enlightenment/ephoto/default.nix
+++ b/pkgs/desktops/enlightenment/ephoto/default.nix
--- a/pkgs/desktops/enlightenment/rage/default.nix
+++ b/pkgs/desktops/enlightenment/rage/default.nix
--- a/pkgs/desktops/enlightenment/terminology/default.nix
+++ b/pkgs/desktops/enlightenment/terminology/default.nix
--- a/pkgs/development/compilers/ghc/8.10.1.nix
+++ b/pkgs/development/compilers/ghc/8.10.1.nix
@ -24,7 +24,7 @@
  enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform

  # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64

 , # Whether to build dynamic libs for the standard library (on the target
  # platform). Static libs are always built.
@ -68,7 +68,7 @@ let
    HADDOCK_DOCS = NO
    BUILD_SPHINX_HTML = NO
    BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
    GhcLibWays = "v dyn"
  '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
    GhcLibHcOpts += -fPIC
--- a/pkgs/development/compilers/ghc/8.8.3.nix
+++ b/pkgs/development/compilers/ghc/8.8.3.nix
@ -23,6 +23,9 @@
 , # If enabled, use -fPIC when compiling static libs.
  enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform

+  # aarch64 outputs otherwise exceed 2GB limit
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
+
 , # Whether to build dynamic libs for the standard library (on the target
  # platform). Static libs are always built.
  enableShared ? !stdenv.targetPlatform.isWindows && !stdenv.targetPlatform.useiOSPrebuilt
@ -30,9 +33,6 @@
 , # Whether to build terminfo.
  enableTerminfo ? !stdenv.targetPlatform.isWindows

-  # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
-
 , # What flavour to build. An empty string indicates no
  # specific flavour and falls back to ghc default values.
  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
@ -68,7 +68,7 @@ let
    HADDOCK_DOCS = NO
    BUILD_SPHINX_HTML = NO
    BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
    GhcLibWays = "v dyn"
  '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
    GhcLibHcOpts += -fPIC
--- a/pkgs/development/compilers/ghc/8.8.4.nix
+++ b/pkgs/development/compilers/ghc/8.8.4.nix
@ -24,7 +24,7 @@
  enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform

  # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64

 , # Whether to build dynamic libs for the standard library (on the target
  # platform). Static libs are always built.
@ -68,7 +68,7 @@ let
    HADDOCK_DOCS = NO
    BUILD_SPHINX_HTML = NO
    BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
    GhcLibWays = "v dyn"
  '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
    GhcLibHcOpts += -fPIC
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -20,9 +20,9 @@
  # build-time dependency too.
  buildLlvmPackages, llvmPackages

-, # If enabled, GHC will be built with the GPL-free but slower integer-simple
-  # library instead of the faster but GPLed integer-gmp library.
-  enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms)
+, # If enabled, GHC will be built with the GPL-free but slightly slower native
+  # bignum backend instead of the faster but GPLed gmp backend.
+  enableNativeBignum ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms)
 , gmp

 , # If enabled, use -fPIC when compiling static libs.
@ -35,7 +35,7 @@
 , # Whether to build terminfo.
  enableTerminfo ? !stdenv.targetPlatform.isWindows

-, version ? "8.11.20200505"
+, version ? "8.11.20200731"
 , # What flavour to build. An empty string indicates no
  # specific flavour and falls back to ghc default values.
  ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
@ -46,7 +46,7 @@
  disableLargeAddressSpace ? stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64
 }:

-assert !enableIntegerSimple -> gmp != null;
+assert !enableNativeBignum -> gmp != null;

 let
  inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@ -64,7 +64,7 @@ let
    include mk/flavours/\$(BuildFlavour).mk
    endif
    DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
-    INTEGER_LIBRARY = ${if enableIntegerSimple then "integer-simple" else "integer-gmp"}
+    BIGNUM_BACKEND = ${if enableNativeBignum then "native" else "gmp"}
  '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
    Stage1Only = ${if targetPlatform.system == hostPlatform.system then "NO" else "YES"}
    CrossCompilePrefix = ${targetPrefix}
@ -81,7 +81,7 @@ let
  # Splicer will pull out correct variations
  libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
    ++ [libffi]
-    ++ stdenv.lib.optional (!enableIntegerSimple) gmp
+    ++ stdenv.lib.optional (!enableNativeBignum) gmp
    ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv
    ++ stdenv.lib.optional enableDwarf elfutils;

@ -103,8 +103,8 @@ stdenv.mkDerivation (rec {

  src = fetchgit {
    url = "https://gitlab.haskell.org/ghc/ghc.git/";
-    rev = "40c71c2cf38b4e134d81b7184a4d5e02949ae70c";
-    sha256 = "04h9rcyzm9w3an1z00hjs062dp7dl19b8pkyxjsypr7a2i9dmvkb";
+    rev = "380638a33691ba43fdcd2e18bca636750e5f66f1";
+    sha256 = "029cgiyhddvwnx5zx31i0vgj13zsvzb8fna99zr6ifscz6x7rid1";
  };

  enableParallelBuilding = true;
@ -173,7 +173,7 @@ stdenv.mkDerivation (rec {
    "--with-system-libffi"
    "--with-ffi-includes=${targetPackages.libffi.dev}/include"
    "--with-ffi-libraries=${targetPackages.libffi.out}/lib"
-  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableNativeBignum) [
    "--with-gmp-includes=${targetPackages.gmp.dev}/include"
    "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@ -30,11 +30,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.13.14";
+  version = "1.13.15";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "01mbqzn1hj8idbyn2f9gghvirfnw348dcf7pjs3ymschfblk6wqr";
+    sha256 = "0pfgixca3a0svblzivkia11q79l8bzai6yg64m1piy3c0iqk3d2z";
  };

  # perl is used for testing go vet
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "nim";
-  version = "1.2.4";
+  version = "1.2.6";

  src = fetchurl {
    url = "https://nim-lang.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0dnn60slvp3ynlx3zhv3cjkanv8zglljxws0db8g0rdyz8r8zwgf";
+    sha256 = "0zk5qzxayqjw7kq6p92j4008g9bbyilyymhdc5xq9sln5rqym26z";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@ -19,8 +19,8 @@ let
    aarch64-linux = "aarch64";
  }.${stdenv.system} or (throw "Unsupported platform");

-  update = "242";
-  build = "b08";
+  update = "265";
+  build = if stdenv.isAarch64 then "b01" else "ga";
  baseurl = if stdenv.isAarch64 then "https://hg.openjdk.java.net/aarch64-port/jdk8u-shenandoah"
            else "https://hg.openjdk.java.net/jdk8u/jdk8u";
  repover = lib.optionalString stdenv.isAarch64 "aarch64-shenandoah-"
@ -29,50 +29,50 @@ let
  jdk8 = fetchurl {
             name = "jdk8-${repover}.tar.gz";
             url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0qpmr267qcxhmw398zbl1axd161yxn4k4hfz1jlxlmdvg70p7h90"
-                      else "1crs4hmzmgm6fkwfq0d3xz9lph0nd33fngrqv2rz1mkkqcrjx18z";
+             sha256 = if stdenv.isAarch64 then "1a2adw51af064rzlngsdlhs9gl47h3lv6dzvr8swqgl2n93nlbxa"
+                      else "02j1nbf3rxl581fqzc6i3ri6wwxx1dhkmj5klkh5xlp8dkhclr30";
          };
  langtools = fetchurl {
             name = "langtools-${repover}.tar.gz";
             url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "1rhhi4kgmxvnyl3ic5p008p1n7zyji5nw99blm1lr5fw7ry7df24"
-                      else "1aaxd1rl7dlk4kxdivvqvripsbn0d5vny0jvjksycsm97vrfiry4";
+             sha256 = if stdenv.isAarch64 then "0hfrbz7421s2barfrfp0fvmh45iksw2zx1z4ykjg3giv8zbmswfm"
+                      else "1r2adp7sn3y45rb5h059qygz18bgmkqr2g2jc9mpzskl5vwsqiw4";
          };
  hotspot = fetchurl {
             name = "hotspot-${repover}.tar.gz";
             url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0lphrhjqlavd6qlkh7h4sd2bqf5gd0cchkcnvy87703fbd7gy5ii"
-                      else "18i4if16zikgda9k5bgqyx0p2104db23zlnclq512178z0p9yycb";
+             sha256 = if stdenv.isAarch64 then "0g5h74snfl2dj2xwlvb5hgfbqmnbhxax68axadz11mq7r2bhd0lk"
+                      else "10xj8qr499r6nla74bjh4dmq7pkj63iircijk1wyv9xz5v777pcc";
          };
  corba = fetchurl {
             name = "corba-${repover}.tar.gz";
             url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "18h0v566v420d00na6x4jrs41v4aa39byk15fi8k6dcn0dmirhvg"
-                      else "1298k8p2dsj7xc4h2ayk5nl4ssrcgncn06ysyqrmnwrb8gj8s1w4";
+             sha256 = if stdenv.isAarch64 then "0wfqrpr5m4gnavgsl6zcy2l3c7sgn3yl7yhp2crh9icp44ld2cj9"
+                      else "0lk4jimrafgphffsj5yyyhl6pib0y5xxqcr09bgr2w8sjkp4s04s";
          };
  jdk = fetchurl {
             name = "jdk-${repover}.tar.gz";
             url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0xxy7rkj8ah263nnzkd4mg9dai5qix3l9cyilm47dig5hv7g8aq0"
-                      else "0vqlbks3cy3cnmnrnhbjkqinvp8bcy2h96xvx81cvlza4s2hszvz";
+             sha256 = if stdenv.isAarch64 then "0ss49bv2dzb9vkabpv1ag04wli5722p0a8gqkzqmzw4nj67snfqw"
+                      else "0anbp4vq8bzhqsqxlgjd0dx0irf57x4i5ddbpljl36vy2pi9xsm7";
          };
  jaxws = fetchurl {
             name = "jaxws-${repover}.tar.gz";
             url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0ajqm2l9g5w5ag5s4vl4ldpbm99pqa6d342hrzvv7psqn3zf6ar5"
-                      else "1wg9fbiz09arj0llavnzrmbhw8nx0dw8dcjkrzxw78rj1cadflzc";
+             sha256 = if stdenv.isAarch64 then "1nwn6mz38app6pk5f1x3vya1x9qfckyl7z6bi62k6mj2c72ikfh5"
+                      else "113d5nx2mp30m6xy2m2wh0nixk45q8abimlszkiq09w1w1ckzpba";
          };
  jaxp = fetchurl {
             name = "jaxp-${repover}.tar.gz";
             url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "03zjh6xvza05abxz9d9j2w9xndw9n07f8lrn6dymj7f4imals831"
-                      else "1i5xrk8r8pcgnc68zrgp3hd1a1nzcm99swpmdnlb424qlg5nnrcf";
+             sha256 = if stdenv.isAarch64 then "1rhgbwvp7xls7r3f5jm69dw7x521vamchv917dwiz1byvm2bwn7s"
+                      else "0nvqidjssmamcrchq15cg3lfv5v3cnrw05a4h20xmhlpgb9im0vj";
          };
  nashorn = fetchurl {
             name = "nashorn-${repover}.tar.gz";
             url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0n809w264ndxksva9c81x0m1fsyg8c627w571f72xxxl9c1bnrmp"
-                      else "0qlxaz7sriy709vcyzz48s2v4p5h4d31my33whip018c4j5gkfqq";
+             sha256 = if stdenv.isAarch64 then "14gp8q6jw1hq2wlmcalfwn1kgmnq5w9svqnbjww20f25phxkicij"
+                      else "0fm9ldps7ayk7r3wjqiyxp1s6hvi242kl7f92ydkmlxqyfajx60a";
          };
  openjdk8 = stdenv.mkDerivation {
    pname = "openjdk" + lib.optionalString headless "-headless";
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -1336,7 +1336,7 @@ self: super: {
        })).override {
          # we are faster than stack here
          hie-bios = dontCheck self.hie-bios_0_6_1;
-          lsp-test = dontCheck self.lsp-test_0_11_0_3;
+          lsp-test = dontCheck self.lsp-test_0_11_0_4;
        });

  haskell-language-server = (overrideCabal super.haskell-language-server
@ -1356,7 +1356,7 @@ self: super: {
      ghcide = self.hls-ghcide;
      # we are faster than stack here
      hie-bios = dontCheck self.hie-bios_0_6_1;
-      lsp-test = dontCheck self.lsp-test_0_11_0_3;
+      lsp-test = dontCheck self.lsp-test_0_11_0_4;
    };

  # https://github.com/kowainik/policeman/issues/57
--- a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@ -67,9 +67,9 @@ self: super: {
  unliftio-core = doJailbreak super.unliftio-core;

  # Use the latest version to fix the build.
-  dhall = self.dhall_1_33_1;
+  dhall = self.dhall_1_34_0;
  lens = self.lens_4_19_2;
-  optics-core = self.optics-core_0_3;
+  optics-core = self.optics-core_0_3_0_1;
  repline = self.repline_0_4_0_0;
  singletons = self.singletons_2_7;
  th-desugar = self.th-desugar_1_11;
--- a/pkgs/development/haskell-modules/configuration-ghc-head.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-head.nix
@ -26,6 +26,7 @@ self: super: {
  filepath = null;
  ghc-boot = null;
  ghc-boot-th = null;
+  ghc-bignum = null;
  ghc-compact = null;
  ghc-heap = null;
  ghci = null;
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -72,7 +72,7 @@ default-package-overrides:
  # gi-gdkx11-4.x requires gtk-4.x, which is still under development and
  # not yet available in Nixpkgs
  - gi-gdkx11 < 4
-  # LTS Haskell 16.7
+  # LTS Haskell 16.8
  - abstract-deque ==0.3
  - abstract-par ==0.3.3
  - AC-Angle ==1.0
@ -323,7 +323,7 @@ default-package-overrides:
  - bins ==0.1.2.0
  - bitarray ==0.0.1.1
  - bits ==0.5.2
-  - bitset-word8 ==0.1.1.1
+  - bitset-word8 ==0.1.1.2
  - bits-extra ==0.0.2.0
  - bitvec ==1.0.3.0
  - blake2 ==0.3.0
@ -439,9 +439,9 @@ default-package-overrides:
  - cipher-des ==0.0.6
  - cipher-rc4 ==0.1.4
  - circle-packing ==0.1.0.6
-  - clash-ghc ==1.2.3
-  - clash-lib ==1.2.3
-  - clash-prelude ==1.2.3
+  - clash-ghc ==1.2.4
+  - clash-lib ==1.2.4
+  - clash-prelude ==1.2.4
  - classy-prelude ==1.5.0
  - classy-prelude-conduit ==1.5.0
  - classy-prelude-yesod ==1.5.0
@ -518,9 +518,9 @@ default-package-overrides:
  - control-monad-omega ==0.3.2
  - convertible ==1.1.1.0
  - cookie ==0.4.5
-  - core-data ==0.2.1.5
-  - core-program ==0.2.4.2
-  - core-text ==0.2.3.3
+  - core-data ==0.2.1.7
+  - core-program ==0.2.4.4
+  - core-text ==0.2.3.5
  - countable ==1.0
  - cpio-conduit ==0.7.0
  - cpphs ==1.20.9.1
@ -787,7 +787,7 @@ default-package-overrides:
  - file-path-th ==0.1.0.0
  - filepattern ==0.1.2
  - fileplow ==0.1.0.0
-  - filtrable ==0.1.3.0
+  - filtrable ==0.1.4.0
  - fin ==0.1.1
  - FindBin ==0.0.5
  - fingertree ==0.1.4.2
@ -976,6 +976,7 @@ default-package-overrides:
  - hadoop-streaming ==0.2.0.3
  - hakyll ==4.13.4.0
  - half ==0.3
+  - hall-symbols ==0.1.0.6
  - hamtsolo ==1.0.3
  - HandsomeSoup ==0.4.2
  - hapistrano ==0.4.1.0
@ -1046,7 +1047,7 @@ default-package-overrides:
  - hint ==0.9.0.3
  - hjsmin ==0.2.0.4
  - hkd-default ==1.1.0.0
-  - hkgr ==0.2.6
+  - hkgr ==0.2.6.1
  - hlibcpuid ==0.2.0
  - hlibgit2 ==0.18.0.16
  - hmatrix ==0.20.0.0
@ -1144,7 +1145,7 @@ default-package-overrides:
  - http-link-header ==1.0.3.1
  - http-media ==0.8.0.0
  - http-reverse-proxy ==0.6.0
-  - http-streams ==0.8.7.1
+  - http-streams ==0.8.7.2
  - http-types ==0.12.3
  - human-readable-duration ==0.2.1.4
  - HUnit ==1.6.0.0
@ -1511,7 +1512,7 @@ default-package-overrides:
  - MusicBrainz ==0.4.1
  - mustache ==2.3.1
  - mutable-containers ==0.3.4
-  - mwc-probability ==2.3.0
+  - mwc-probability ==2.3.1
  - mwc-random ==0.14.0.0
  - mx-state-codes ==1.0.0.0
  - mysql ==0.1.7
@ -1732,11 +1733,11 @@ default-package-overrides:
  - pretty-class ==1.0.1.1
  - pretty-hex ==1.1
  - prettyprinter ==1.6.2
-  - prettyprinter-ansi-terminal ==1.1.1.2
+  - prettyprinter-ansi-terminal ==1.1.2
  - prettyprinter-compat-annotated-wl-pprint ==1
  - prettyprinter-compat-ansi-wl-pprint ==1.0.1
  - prettyprinter-compat-wl-pprint ==1.0.0.1
-  - prettyprinter-convert-ansi-wl-pprint ==1.1
+  - prettyprinter-convert-ansi-wl-pprint ==1.1.1
  - pretty-relative-time ==0.2.0.0
  - pretty-show ==1.10
  - pretty-simple ==3.2.3.0
@ -1825,7 +1826,7 @@ default-package-overrides:
  - rawstring-qm ==0.2.3.0
  - raw-strings-qq ==1.1
  - rcu ==0.2.4
-  - rdf ==0.1.0.3
+  - rdf ==0.1.0.4
  - rdtsc ==1.3.0.1
  - re2 ==0.3
  - readable ==0.3.1
@ -1914,7 +1915,7 @@ default-package-overrides:
  - salve ==1.0.10
  - sample-frame ==0.0.3
  - sample-frame-np ==0.0.4.1
-  - sampling ==0.3.4
+  - sampling ==0.3.5
  - say ==0.1.0.1
  - sbp ==2.6.3
  - scalpel ==0.6.2
@ -2137,6 +2138,7 @@ default-package-overrides:
  - syb ==0.7.1
  - symbol ==0.2.4
  - symengine ==0.1.2.0
+  - symmetry-operations-symbols ==0.0.1.4
  - sysinfo ==0.1.1
  - system-argv0 ==0.1.1
  - systemd ==2.3.0
@ -2231,10 +2233,10 @@ default-package-overrides:
  - th-nowq ==0.1.0.5
  - th-orphans ==0.13.10
  - th-printf ==0.7
-  - thread-hierarchy ==0.3.0.1
+  - thread-hierarchy ==0.3.0.2
  - thread-local-storage ==0.2
  - threads ==0.5.1.6
-  - thread-supervisor ==0.1.0.0
+  - thread-supervisor ==0.1.0.1
  - threepenny-gui ==0.9.0.0
  - th-reify-compat ==0.0.1.5
  - th-reify-many ==0.1.9
@ -2426,9 +2428,9 @@ default-package-overrides:
  - wave ==0.2.0
  - wcwidth ==0.0.2
  - webdriver ==0.9.0.1
-  - webex-teams-api ==0.2.0.0
-  - webex-teams-conduit ==0.2.0.0
-  - webex-teams-pipes ==0.2.0.0
+  - webex-teams-api ==0.2.0.1
+  - webex-teams-conduit ==0.2.0.1
+  - webex-teams-pipes ==0.2.0.1
  - webrtc-vad ==0.1.0.3
  - websockets ==0.12.7.1
  - websockets-snap ==0.10.3.1
@ -3745,6 +3747,7 @@ broken-packages:
  - chart-histogram
  - Chart-simple
  - chart-svg
+  - chart-svg-various
  - chart-unit
  - chatter
  - chatty-text
@ -7615,6 +7618,7 @@ broken-packages:
  - mDNSResponder-client
  - mdp
  - mealstrom
+  - mealy
  - MeanShift
  - Measure
  - mecab
@ -8661,6 +8665,8 @@ broken-packages:
  - postgresql-simple-sop
  - postgresql-simple-typed
  - postgresql-syntax
+  - postgresql-tx-query
+  - postgresql-tx-squeal
  - postgresql-typed
  - postgresql-typed-lifted
  - postgrest-ws
@ -9334,6 +9340,7 @@ broken-packages:
  - SCalendar
  - scalendar
  - scalp-webhooks
+  - scalpel-search
  - scan-vector-machine
  - scc
  - scenegraph
@ -10164,6 +10171,7 @@ broken-packages:
  - taskell
  - TaskMonad
  - tasty-auto
+  - tasty-bdd
  - tasty-fail-fast
  - tasty-groundhog-converters
  - tasty-hedgehog-coverage
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/libraries/audio/libmysofa/default.nix
+++ b/pkgs/development/libraries/audio/libmysofa/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake ];
  buildInputs = [ zlib ];

-  cmakeFlags = [ "-DBUILD_TESTS=OFF" ];
+  cmakeFlags = [ "-DBUILD_TESTS=OFF" "-DCODE_COVERAGE=OFF" ];

  meta = with stdenv.lib; {
    description = "Reader for AES SOFA files to get better HRTFs";
--- a/pkgs/development/libraries/ayatana-ido/default.nix
+++ b/pkgs/development/libraries/ayatana-ido/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub
+, pkgconfig, autoreconfHook
+, gtk3, gobject-introspection, gtk-doc, vala
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ayatana-ido";
+  version = "0.4.90";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = pname;
+    rev = version;
+    sha256 = "02vqjryni96zzrpkq5d7kvgw7nf252d2fm2xq8fklvvb2vz3fa0w";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook gtk-doc vala ];
+
+  buildInputs = [ gtk3 gobject-introspection ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Display Indicator Objects";
+    homepage = "https://github.com/AyatanaIndicators/ayatana-ido";
+    changelog = "https://github.com/AyatanaIndicators/ayatana-ido/blob/${version}/ChangeLog";
+    license = [ licenses.gpl3 licenses.lgpl21 ];
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "faudio";
-  version = "20.07";
+  version = "20.08";

  src = fetchFromGitHub {
    owner = "FNA-XNA";
    repo = "FAudio";
    rev = version;
-    sha256 = "14fi0jwax9qzn2k89qazdkhxvklk5zcwhbi6pxi1l5i9zk4ly2h7";
+    sha256 = "1fs0h5wl0ndix61mz7h59c15kpqikrk7nn1rc7m2a44jiw8mzdnx";
  };

 	nativeBuildInputs = [cmake];
--- a/pkgs/development/libraries/gl2ps/default.nix
+++ b/pkgs/development/libraries/gl2ps/default.nix
@ -1,17 +1,27 @@
-{ stdenv, fetchurl, cmake
-, zlib, libGL, libGLU, libpng, freeglut }:
+{ stdenv
+, fetchurl
+, cmake
+, zlib
+, libGL
+, libGLU
+, libpng
+, freeglut
+}:

 stdenv.mkDerivation rec {
-  version = "1.4.2";
  pname = "gl2ps";
+  version = "1.4.2";

  src = fetchurl {
    url = "http://geuz.org/gl2ps/src/${pname}-${version}.tgz";
    sha256 = "1sgzv547h7hrskb9qd0x5yp45kmhvibjwj2mfswv95lg070h074d";
  };

-  buildInputs = [
+  nativeBuildInputs = [
    cmake
+  ];
+
+  buildInputs = [
    zlib
    libGL
    libGLU
--- a/pkgs/development/libraries/grpc/default.nix
+++ b/pkgs/development/libraries/grpc/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, fetchpatch, cmake, zlib, c-ares, pkgconfig, openssl, protobuf, gflags, abseil-cpp }:

 stdenv.mkDerivation rec {
-  version = "1.29.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
+  version = "1.31.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
  pname = "grpc";
  src = fetchFromGitHub {
    owner = "grpc";
    repo = "grpc";
    rev = "v${version}";
-    sha256 = "1n604grkf2amzrmwcz6am0rpbp3yfb062lpgmhv943hj8wk7xw27";
+    sha256 = "1h7gmhkjijfkpqhz8vswhkz2gkphs638g10dlkayic8xg9xdl4gj";
    fetchSubmodules = true;
  };
  patches = [
--- a/pkgs/development/libraries/kmsxx/default.nix
+++ b/pkgs/development/libraries/kmsxx/default.nix
@ -3,14 +3,14 @@

 stdenv.mkDerivation {
  pname = "kmsxx";
-  version = "2020-02-14";
+  version = "2020-08-04";

  src = fetchFromGitHub {
    owner = "tomba";
    repo = "kmsxx";
    fetchSubmodules = true;
-    rev = "7c5e645112a899ad018219365c3898b0e896353f";
-    sha256 = "1hj4gk4gwlvpjprjbrmrbrzqjhdgszsndrb1i4f9z7mjvdv8gij2";
+    rev = "38bee3092f2d477f1baebfcae464f888d3d04bbe";
+    sha256 = "0xz4m9bk0naawxwpx5cy1j3cm6c8c9m5y551csk88y88x1g0z0xh";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "ldb";
-  version = "2.1.4";
+  version = "2.2.0";

  src = fetchurl {
    url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    sha256 = "0kmzs2s7fvar9ksaxyiqlh8q8mbwc7bxrq9w1y91zlyb23p142wy";
+    sha256 = "0pxxb3sn9lignkf80kndd84shxqk9m2qwimz62gzb6khd4bvajqk";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libayatana-appindicator/default.nix
+++ b/pkgs/development/libraries/libayatana-appindicator/default.nix
@ -0,0 +1,49 @@
+{ stdenv, fetchFromGitHub, lib
+, pkgconfig, autoreconfHook , gtk-doc
+, gtkVersion ? "3"
+, gtk2, libayatana-indicator-gtk2, libdbusmenu-gtk2
+, gtk3, libayatana-indicator-gtk3, libdbusmenu-gtk3
+, dbus-glib, python2, python2Packages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libayatana-appindicator-gtk${gtkVersion}";
+  version = "0.5.4";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = "libayatana-appindicator";
+    rev = version;
+    sha256 = "0bqjqb7gabdk7mifk8azi630qw39z978f973fx2ylgdgr4a66j1v";
+  };
+
+  patchPhase = ''
+    substituteInPlace configure.ac \
+      --replace "codegendir pygtk-2.0" "codegendir pygobject-2.0"
+  '';
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook gtk-doc ];
+
+  buildInputs = [ dbus-glib python2 python2Packages.pygtk ]
+    ++ lib.lists.optional (gtkVersion == "2") libayatana-indicator-gtk2
+    ++ lib.lists.optional (gtkVersion == "3") libayatana-indicator-gtk3;
+
+  propagatedBuildInputs =
+    lib.lists.optionals (gtkVersion == "2") [ gtk2 libdbusmenu-gtk2 ]
+    ++ lib.lists.optionals (gtkVersion == "3") [ gtk3 libdbusmenu-gtk3 ];
+
+  preAutoreconf = ''
+    gtkdocize
+  '';
+
+  configureFlags = [ "--with-gtk=${gtkVersion}" ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Application Indicators Shared Library";
+    homepage = "https://github.com/AyatanaIndicators/libayatana-appindicator";
+    changelog = "https://github.com/AyatanaIndicators/libayatana-appindicator/blob/${version}/ChangeLog";
+    license = [ licenses.gpl3 licenses.lgpl21 ];
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}
--- a/pkgs/development/libraries/libayatana-indicator/default.nix
+++ b/pkgs/development/libraries/libayatana-indicator/default.nix
@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, lib
+, pkgconfig, autoreconfHook
+, gtkVersion ? "3"
+, gtk2
+, gtk3
+, ayatana-ido
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libayatana-indicator-gtk${gtkVersion}";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = "libayatana-indicator";
+    rev = version;
+    sha256 = "1q9wmaw6pckwyrv0s7wkqzm1yrk031pbz4xbr8cwn75ixqyfcb28";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+
+  buildInputs = [ ayatana-ido ]
+    ++ lib.lists.optionals (gtkVersion == "2") [ gtk2 ]
+    ++ lib.lists.optionals (gtkVersion == "3") [ gtk3 ];
+
+  configureFlags = [ "--with-gtk=${gtkVersion}" ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Indicators Shared Library";
+    homepage = "https://github.com/AyatanaIndicators/libayatana-indicator";
+    changelog = "https://github.com/AyatanaIndicators/libayatana-indicator/blob/${version}/ChangeLog";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, fetchpatch
-, zlib, xz, python, gettext, ncurses, findXMLCatalogs
+, zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt"
@ -46,6 +46,8 @@ stdenv.mkDerivation rec {
  buildInputs = lib.optional pythonSupport python
    ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
    ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses
+    ++ lib.optional (stdenv.isDarwin &&
+                     pythonSupport && python?isPy2 && python.isPy2) libintl
    # Libxml2 has an optional dependency on liblzma.  However, on impure
    # platforms, it may end up using that from /usr/lib, and thus lack a
    # RUNPATH for that, leading to undefined references for its users.
--- a/pkgs/development/libraries/oneDNN/default.nix
+++ b/pkgs/development/libraries/oneDNN/default.nix
@ -5,13 +5,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
  pname = "oneDNN";
-  version = "1.5.1";
+  version = "1.6";

  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "oneDNN";
    rev = "v${version}";
-    sha256 = "1l66gkidldjpznp8pb01wdgrmm0rmrbndv8lzidz8fp9hf473zgl";
+    sha256 = "0w2rgr3zgk7a3cql12dpddyhz2isyqqaks4vm8p45y426pd5m64b";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/openmpi/default.nix
+++ b/pkgs/development/libraries/openmpi/default.nix
@ -13,7 +13,6 @@

 # Enable libfabric support (necessary for Omnipath networks) on x86_64 linux
 , fabricSupport ? stdenv.isLinux && stdenv.isx86_64
-
 }:

 assert !cudaSupport || cudatoolkit != null;
@ -59,6 +58,7 @@ in stdenv.mkDerivation rec {
      "--with-libnl=${libnl.dev}"
      "--with-pmix=${pmix}"
      "--with-pmix-libdir=${pmix}/lib"
+      "--enable-mpi-cxx"
    ] ++ lib.optional enableSGE "--with-sge"
    ++ lib.optional enablePrefix "--enable-mpirun-prefix-by-default"
    # TODO: add UCX support, which is recommended to use with cuda for the most robust OpenMPI build
--- a/pkgs/development/libraries/rocclr/default.nix
+++ b/pkgs/development/libraries/rocclr/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake rocm-cmake ];

-  buildInputs = [ clang rocm-comgr rocm-runtime rocm-thunk clang ];
+  buildInputs = [ clang rocm-comgr rocm-runtime rocm-thunk ];

  propagatedBuildInputs = [ libelf libglvnd libX11 ];

@ -34,7 +34,8 @@ stdenv.mkDerivation rec {
      --replace 'set(ROCCLR_EXPORTS_FILE "''${CMAKE_CURRENT_BINARY_DIR}/amdrocclr_staticTargets.cmake")' \
        'set(ROCCLR_EXPORTS_FILE "''${CMAKE_INSTALL_LIBDIR}/cmake/amdrocclr_staticTargets.cmake")' \
      --replace 'set (CMAKE_LIBRARY_OUTPUT_DIRECTORY ''${CMAKE_CURRENT_BINARY_DIR}/lib)' \
-        'set (CMAKE_LIBRARY_OUTPUT_DIRECTORY ''${CMAKE_INSTALL_LIBDIR})'
+        'set (CMAKE_LIBRARY_OUTPUT_DIRECTORY ''${CMAKE_INSTALL_LIBDIR})' \
+      --replace 'find_library( OpenCL REQUIRED' 'find_library( OpenCL'
    substituteInPlace device/comgrctx.cpp \
      --replace "libamd_comgr.so" "${rocm-comgr}/lib/libamd_comgr.so"
  '';
--- a/pkgs/development/ocaml-modules/gmetadom/default.nix
+++ b/pkgs/development/ocaml-modules/gmetadom/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
    sha256 = "0skmlv0pnqvg99wzzzi1h4zhwzd82xg7xpkj1kwpfy7bzinjh7ig";
  };

-  patches = [ ./gcc-4.3.dpatch ];
+  patches = [ ./gcc-4.3.patch ];

  dontDisableStatic = true;

--- a/pkgs/development/ocaml-modules/gmetadom/gcc-4.3.dpatch
+++ b/pkgs/development/ocaml-modules/gmetadom/gcc-4.3.dpatch
--- a/pkgs/development/python-modules/azure-mgmt-monitor/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-monitor/default.nix
@ -11,12 +11,12 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-monitor";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "0r3l55mhd00zx8sw13d7i9l7r214946s1y3wxcswxad7q5660zfm";
+    sha256 = "c6e1fe83dd2ddffa7f6d90c7aa63b3128042396a3893c14dc4816ad28cb15016";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@ -9,6 +9,8 @@
 , gnutar
 , p7zip
 , cabextract
+, cramfsprogs
+, cramfsswap
 , lzma
 , nose
 , pycrypto
@ -29,7 +31,7 @@ buildPythonPackage {
    sha256 = "1bxgj569fzwv6jhcbl864nmlsi9x1k1r20aywjxc8b9b1zgqrlvc";
  };

-  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar p7zip cabextract lzma pycrypto ]
+  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar p7zip cabextract cramfsswap cramfsprogs lzma pycrypto ]
  ++ stdenv.lib.optional visualizationSupport pyqtgraph;

  # setup.py only installs version.py during install, not test
--- a/pkgs/development/python-modules/braintree/default.nix
+++ b/pkgs/development/python-modules/braintree/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "braintree";
-  version = "4.2.0";
+  version = "4.3.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0aw5n1hqrg5pb5xmcr1b8y9i7v8zj23q9k2p4b6bwnq2c2fqi8wr";
+    sha256 = "d2b5ead45dbfe98b6099d387c7f12b7d2994ae0efb60679e6bb0929a06027e16";
  };

  propagatedBuildInputs = [ requests ];
--- a/pkgs/development/python-modules/cfgv/default.nix
+++ b/pkgs/development/python-modules/cfgv/default.nix
@ -2,12 +2,12 @@

 buildPythonPackage rec {
  pname = "cfgv";
-  version = "3.1.0";
+  version = "3.2.0";
  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "c8e8f552ffcc6194f4e18dd4f68d9aef0c0d58ae7e7be8c82bee3c5e9edfa513";
+    sha256 = "cf22deb93d4bcf92f345a5c3cd39d3d41d6340adc60c78bbbd6588c384fda6a1";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/python-modules/cli-helpers/default.nix
+++ b/pkgs/development/python-modules/cli-helpers/default.nix
@ -10,11 +10,11 @@

 buildPythonPackage rec {
  pname = "cli_helpers";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "18f7d8c5a22d85fc685d56a9f301d8b9f7f0d7d4e9033a27563b066c2ab41833";
+    sha256 = "dd6f164310f7d86fa3da1f82043a9c784e44a02ad49be932a80624261e56979b";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cot/default.nix
+++ b/pkgs/development/python-modules/cot/default.nix
@ -0,0 +1,56 @@
+{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, isPy3k
+, argcomplete, colorlog, pyvmomi, requests, verboselogs
+, psutil, pyopenssl, setuptools
+, mock, pytest, pytest-mock, pytestCheckHook, qemu
+}:
+
+buildPythonPackage rec {
+  pname = "cot";
+  version = "2.2.1";
+
+  disabled = !isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "f4b3553415f90daac656f89d3e82e79b3d751793239bb173a683b4cc0ceb2635";
+  };
+
+  propagatedBuildInputs = [ colorlog pyvmomi requests verboselogs pyopenssl setuptools ]
+  ++ stdenv.lib.optional (pythonOlder "3.3") psutil;
+
+  checkInputs = [ mock pytestCheckHook pytest-mock qemu ];
+
+  # Many tests require network access and/or ovftool (https://code.vmware.com/web/tool/ovf)
+  # try enabling these tests with ovftool once/if it is added to nixpkgs
+  disabledTests = [
+    "HelperGenericTest"
+    "TestCOTAddDisk"
+    "TestCOTAddFile"
+    "TestCOTEditHardware"
+    "TestCOTEditProduct"
+    "TestCOTEditProperties"
+    "TestCOTInjectConfig"
+    "TestISO"
+    "TestOVFAPI"
+    "TestQCOW2"
+    "TestRAW"
+    "TestVMDKConversion"
+  ];
+
+
+  # argparse is part of the standardlib
+  prePatch = ''
+    substituteInPlace setup.py --replace "'argparse'," ""
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Common OVF Tool";
+    longDescription = ''
+      COT (the Common OVF Tool) is a tool for editing Open Virtualization Format (.ovf, .ova) virtual appliances,
+      with a focus on virtualized network appliances such as the Cisco CSR 1000V and Cisco IOS XRv platforms.
+    '';
+    homepage = "https://github.com/glennmatthews/cot";
+    license = licenses.mit;
+    maintainers = with maintainers; [ evanjs ];
+  };
+}
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "grpcio-tools";
-  version = "1.29.0";
+  version = "1.31.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0f681c1ebd5472b804baa391b16dc59d92b065903999566f4776bfbd010bcec9";
+    sha256 = "3b08cbd3f4d5b60e3bff8f859e6e03db739967a684268164abc940415e23ca51";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/python-modules/itemloaders/default.nix
+++ b/pkgs/development/python-modules/itemloaders/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy27
+, w3lib
+, parsel
+, jmespath
+, itemadapter
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "itemloaders";
+  version = "1.0.1";
+
+  disabled = isPy27;
+
+  # Tests not included in PyPI tarball
+  src = fetchFromGitHub {
+    owner = "scrapy";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0frs0s876ddha844vhnhhiggyk3qbhhngrwkvgg3c0mrnn282f6k";
+  };
+
+  propagatedBuildInputs = [ w3lib parsel jmespath itemadapter ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Base library for scrapy's ItemLoader";
+    homepage = "https://github.com/scrapy/itemloaders";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.marsam ];
+  };
+}
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@ -24,10 +24,11 @@
 , pytest-twisted
 , botocore
 , itemadapter
+, itemloaders
 }:

 buildPythonPackage rec {
-  version = "2.2.1";
+  version = "2.3.0";
  pname = "Scrapy";

  disabled = isPy27;
@ -57,22 +58,24 @@ buildPythonPackage rec {
    zope_interface
    protego
    itemadapter
+    itemloaders
  ];

  LC_ALL = "en_US.UTF-8";

  # Disable doctest plugin—enabled in the shipped pytest.ini—because it causes pytest to hang
  # Ignore proxy tests because requires mitmproxy
+  # Ignore utils_display tests because it requires pygments
  # Ignore test_retry_dns_error because tries to resolve an invalid dns and weirdly fails with "Reactor was unclean"
  # Ignore xml encoding test on darwin because lxml can't find encodings https://bugs.launchpad.net/lxml/+bug/707396
  checkPhase = ''
    substituteInPlace pytest.ini --replace "--doctest-modules" ""
-    pytest --ignore=tests/test_linkextractors_deprecated.py --ignore=tests/test_proxy_connect.py --deselect tests/test_crawl.py::CrawlTestCase::test_retry_dns_error ${lib.optionalString stdenv.isDarwin "--deselect tests/test_utils_iterators.py::LxmlXmliterTestCase::test_xmliter_encoding"}
+    pytest --ignore=tests/test_linkextractors_deprecated.py --ignore=tests/test_proxy_connect.py --ignore=tests/test_utils_display.py --deselect tests/test_crawl.py::CrawlTestCase::test_retry_dns_error ${lib.optionalString stdenv.isDarwin "--deselect tests/test_utils_iterators.py::LxmlXmliterTestCase::test_xmliter_encoding"}
  '';

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6a09beb5190bfdee2d72cf261822eae5d92fe8a86ac9ee1f55fc44b4864ca583";
+    sha256 = "b4d08cdacb615563c291d053ef1ba2dc08d9d4b6d81578684eaa1cf7b832f90c";
  };

  postInstall = ''
--- a/pkgs/development/python-modules/vega/default.nix
+++ b/pkgs/development/python-modules/vega/default.nix
@ -1,5 +1,5 @@
 { stdenv, buildPythonPackage , fetchPypi, pythonOlder
-, pytest, jupyter_core, pandas, ipywidgets }:
+, pytest, jupyter_core, pandas, ipywidgets, jupyter, altair }:

 buildPythonPackage rec {
  pname = "vega";
@ -12,7 +12,11 @@ buildPythonPackage rec {
  };

  buildInputs = [ pytest ];
-  propagatedBuildInputs = [ jupyter_core pandas ipywidgets ];
+  propagatedBuildInputs = [ jupyter jupyter_core pandas ipywidgets ];
+
+  # currently, recommonmark is broken on python3
+  doCheck = false;
+  checkInputs = [ altair ];

  meta = with stdenv.lib; {
    description = "An IPython/Jupyter widget for Vega and Vega-Lite";
--- a/pkgs/development/python-modules/wxPython/4.0.nix
+++ b/pkgs/development/python-modules/wxPython/4.0.nix
@ -1,29 +1,18 @@
 { lib
 , stdenv
-, openglSupport ? true
-, libX11
-, pyopengl
 , buildPythonPackage
 , fetchPypi
 , pkgconfig
-, libjpeg
-, libtiff
-, SDL
-, gst-plugins-base
-, libnotify
-, freeglut
-, xorg
 , which
 , cairo
-, requests
 , pango
-, pathlib2
 , python
 , doxygen
 , ncurses
-, libpng
-, gstreamer
 , wxGTK
+, numpy
+, pillow
+, six
 }:

 buildPythonPackage rec {
@ -38,16 +27,7 @@ buildPythonPackage rec {
  doCheck = false;

  nativeBuildInputs = [ pkgconfig which doxygen wxGTK ];
-
-  buildInputs = [ libjpeg libtiff SDL
-      gst-plugins-base libnotify freeglut xorg.libSM ncurses
-      requests libpng gstreamer libX11
-      pathlib2
-      (wxGTK.gtk)
-  ]
-    ++ lib.optional openglSupport pyopengl;
-
-  hardeningDisable = [ "format" ];
+  buildInputs = [ ncurses wxGTK.gtk ];

  DOXYGEN = "${doxygen}/bin/doxygen";

@ -68,10 +48,9 @@ buildPythonPackage rec {

  installPhase = ''
    ${python.interpreter} setup.py install --skip-build --prefix=$out
-    wrapPythonPrograms
  '';

-  passthru = { inherit wxGTK openglSupport; };
+  passthru = { inherit wxGTK; };


  meta = {
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:

 let
-  version = "13.2.0";
+  version = "13.2.2";
  # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
  docker_x86_64 = fetchurl {
    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "0cvcil96gww68abdj5ni7w69ss5ncz3ixh00k1a9nlqggf0ifaav";
+    sha256 = "1m45jipn0lmlc4ynmm7g4nd1ryr5bzz1wvr8spd6gxvq5577i4pk";
  };

  docker_arm = fetchurl {
    url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "1j2z1wk4qs089mvx7y14al28pzhhnzs17n1ijpahsln2jn7b2s5m";
+    sha256 = "10nx0gjhbl4gz2n3yl8m7w60pmgdywgzins6y2pa7wvj5dkm04ax";
  };
 in
 buildGoPackage rec {
@ -30,7 +30,7 @@ buildGoPackage rec {
    owner = "gitlab-org";
    repo = "gitlab-runner";
    rev = "v${version}";
-    sha256 = "0bgrh1yckc879qq155dvdqsr7673g1r1hbwf489ngabj8f8l3l23";
+    sha256 = "1jii9rm11kcdh7hg9rif27b7rlj2cip6q9viknvs3ha1rf9fw96q";
  };

  patches = [ ./fix-shell-path.patch ];
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "dbmate";
-  version = "1.9.0";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "amacneil";
    repo = "dbmate";
    rev = "v${version}";
-    sha256 = "0v00k658b4ca9bpn2yiiy3gq5gr6hms8mlk31wf8svwsjyzjibzr";
+    sha256 = "0s7ymw1r1k1s8kwyg6nxpgak6kh9z3649a0axdfpjnm62v283shd";
  };

  vendorSha256 = "00vp925vf9clk5bkw5fvj34id4v548rlssizh52z9psvdizj8q5p";
--- a/pkgs/development/tools/gopls/default.nix
+++ b/pkgs/development/tools/gopls/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gopls";
-  version = "0.4.3";
+  version = "0.4.4";

  src = fetchgit {
    rev = "gopls/v${version}";
    url = "https://go.googlesource.com/tools";
-    sha256 = "1r670c7p63l0fhx671r3mb1jgvvfv1382079fv59z07j5j5hizbc";
+    sha256 = "1h4ica6rwrdp5wg4ybpzvyvszj4m5l6w9hpvd9r2qcd9qdnqlykf";
  };

  modRoot = "gopls";
-  vendorSha256 = "1xdvkdkvk7a32jspzjcgxkfdn78d2zm53wxmc9c4sqysxsgy6lbw";
+  vendorSha256 = "175051d858lsdir2hj5qcimp6hakbi9grpws1ssvk3r2jna27x1z";

  meta = with stdenv.lib; {
    description = "Official language server for the Go language";
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@ -2,8 +2,8 @@

 buildGoModule rec {
  pname = "kustomize";
-  version = "3.8.0";
-  # rev is the 3.8.0 commit, mainly for kustomize version command output
+  version = "3.8.1";
+  # rev is the 3.8.1 commit, mainly for kustomize version command output
  rev = "6a50372dd5686df22750b0c729adaf369fbf193c";

  buildFlagsArray = let t = "sigs.k8s.io/kustomize/api/provenance"; in
@ -17,14 +17,14 @@ buildGoModule rec {
    owner = "kubernetes-sigs";
    repo = pname;
    rev = "kustomize/v${version}";
-    sha256 = "1v86gqn16xh28gi2fa6jgbbk0clrcng3sbr1az42iy4mm4nmsriy";
+    sha256 = "07zdp6xv8viwnaz1qacwhg82dlzcrgb8dls6yz9qk4qcnsk6badx";
  };

  # avoid finding test and development commands
  sourceRoot = "source/kustomize";

  deleteVendor = true;
-  vendorSha256 = "03z40gi9nrj120cd57pa3fmi8grldyxa65a1lkvlc2r3z9g29vdw";
+  vendorSha256 = "01ff3w4hwp4ynqhg8cplv0i2ixs811d2x2j6xbh1lslyyh3z3wc5";

  meta = with lib; {
    description = "Customization of kubernetes YAML configurations";
--- a/pkgs/development/tools/misc/arcanist/default.nix
+++ b/pkgs/development/tools/misc/arcanist/default.nix
@ -1,53 +1,54 @@
-{ stdenv, fetchFromGitHub, php, flex, makeWrapper }:
+{ stdenv, fetchFromGitHub, php, flex }:
+
+# Make a custom wrapper. If `wrapProgram` is used, arcanist thinks .arc-wrapped is being
+# invoked and complains about it being an unknown toolset. We could use `makeWrapper`, but
+# then we’d need to still craft a script that does the `php libexec/arcanist/bin/...` dance
+# anyway... So just do everything at once.
+let makeArcWrapper = toolset: ''
+    cat << WRAPPER > $out/bin/${toolset}
+    #!$shell -e
+    export PATH='${php}/bin/'\''${PATH:+':'}\$PATH
+    exec ${php}/bin/php $out/libexec/arcanist/bin/${toolset} "\$@"
+    WRAPPER
+    chmod +x $out/bin/${toolset}
+'';

-let
-  libphutil = fetchFromGitHub {
-    owner = "phacility";
-    repo = "libphutil";
-    rev = "cc2a3dbf590389400da55563cb6993f321ec6d73";
-    sha256 = "1k7sr3racwz845i7r5kdwvgqrz8gldz07pxj3yw77s58rqbix3ad";
-  };
-  arcanist = fetchFromGitHub {
-    owner = "phacility";
-    repo = "arcanist";
-    rev = "21a1828ea06cf031e93082db8664d73efc88290a";
-    sha256 = "05rq9l9z7446ks270viay57r5ibx702b5bnlf4ck529zc4abympx";
-  };
 in
+
 stdenv.mkDerivation {
  pname = "arcanist";
-  version = "20200127";
+  version = "20200711";

-  src = [ arcanist libphutil ];
-  buildInputs = [ php makeWrapper flex ];
-
-  unpackPhase = ''
-    cp -aR ${libphutil} libphutil
-    cp -aR ${arcanist} arcanist
-    chmod +w -R libphutil arcanist
-  '';
+  src = fetchFromGitHub {
+    owner = "phacility";
+    repo = "arcanist";
+    rev = "2565cc7b4d1dbce6bc7a5b3c4e72ae94be4712fe";
+    sha256 = "0jiv4aj4m5750dqw9r8hizjkwiyxk4cg4grkr63sllsa2dpiibxw";
+  };
+  buildInputs = [ php flex ];

  postPatch = stdenv.lib.optionalString stdenv.isAarch64 ''
-    substituteInPlace libphutil/support/xhpast/Makefile \
+    substituteInPlace support/xhpast/Makefile \
      --replace "-minline-all-stringops" ""
  '';

  buildPhase = ''
-    (
-      cd libphutil/support/xhpast
-      make clean all install
-    )
+    make xhpast -C support/xhpast
  '';
+
  installPhase = ''
    mkdir -p $out/bin $out/libexec
-    cp -R libphutil $out/libexec/libphutil
-    cp -R arcanist  $out/libexec/arcanist
-    ${if stdenv.isDarwin then ''
-        echo "#! $shell -e" > $out/bin/arc
-        echo "exec ${php}/bin/php $out/libexec/arcanist/scripts/arcanist.php "'"$@"' >> $out/bin/arc
-        chmod +x $out/bin/arc''
-      else ''
-        ln -s $out/libexec/arcanist/scripts/arcanist.php $out/bin/arc''}
+    make install -C support/xhpast
+    cp -R $src $out/libexec/arcanist
+
+    ${makeArcWrapper "arc"}
+    ${makeArcWrapper "phage"}
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/arc help diff -- > /dev/null
+    $out/bin/phage help alias -- > /dev/null
  '';

  meta = {
--- a/pkgs/development/tools/misc/cproto/cproto.patch
+++ b/pkgs/development/tools/misc/cproto/cproto.patch
--- a/pkgs/development/tools/misc/cproto/default.nix
+++ b/pkgs/development/tools/misc/cproto/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  };

  # patch made by Joe Khoobyar copied from gentoo bugs
-  patches = ./cproto_patch;
+  patches = [ ./cproto.patch ];

  nativeBuildInputs = [ flex bison ];

--- a/pkgs/development/tools/misc/pahole/default.nix
+++ b/pkgs/development/tools/misc/pahole/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "pahole";
-  version = "1.16";
+  version = "1.17";
  src = fetchgit {
    url = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git";
    rev = "v${version}";
-    sha256 = "1gfc9v4dgs811v1zjk0d9hsgmizllw2hibc83ykmakzysimaxsy3";
+    sha256 = "13dxsmhpf9n2wqggf4gd6f12rm0vhv0q96jd50gkvaxzzvgpzzbc";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "strace";
-  version = "5.7";
+  version = "5.8";

  src = fetchurl {
    url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1n6cfz3i2krkyvxpdp3kmxhf7sy5xp0danzaiirbk5fdkfgvb15j";
+    sha256 = "1abs3svkg9985f4jrxx34sj1dcpsf95vv1a0g01c777zgygncjnz";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/Show More
+++ b/Show More