Merge branch 'staging-next' into staging

2019-09-08 18:28:11 +02:00 · 2019-09-08 18:28:11 +02:00 · 7e91247596
commit 7e91247596
parent 02e83699bb ccc8c73ea0
75 changed files with 1845 additions and 797 deletions
--- a/README.md
+++ b/README.md
@ -1,48 +1,113 @@
-[<img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="logo" />](https://nixos.org/nixos)
+<p align="center">
+  <a href="https://nixos.org/nixos"><img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="NixOS logo" /></a>
+</p>

-[![Code Triagers Badge](https://www.codetriage.com/nixos/nixpkgs/badges/users.svg)](https://www.codetriage.com/nixos/nixpkgs)
-[![Open Collective supporters](https://opencollective.com/nixos/tiers/supporter/badge.svg?label=Supporter&color=brightgreen)](https://opencollective.com/nixos)
+<p align="center">
+  <a href="https://www.codetriage.com/nixos/nixpkgs"><img src="https://www.codetriage.com/nixos/nixpkgs/badges/users.svg" alt="Code Triagers badge" /></a>
+  <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=Supporter&color=brightgreen" alt="Open Collective supporters" /></a>
+</p>

-Nixpkgs is a collection of packages for the [Nix](https://nixos.org/nix/) package
-manager. It is periodically built and tested by the [Hydra](https://hydra.nixos.org/)
-build daemon as so-called channels. To get channel information via git, add
-[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels.git) as a remote:
+[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over
+40,000 software packages that can be installed with the
+[Nix](https://nixos.org/nix/) package manager. It also implements
+[NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.

-```
-% git remote add channels https://github.com/NixOS/nixpkgs-channels.git
-```
+# Manuals

-For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-19.03` for the latest
-release and `nixos-unstable` for the latest successful build of master:
+* [NixOS Manual](https://nixos.org/nixos/manual) - how to install, configure, and maintain a purely-functional Linux distribution
+* [Nixpkgs Manual](https://nixos.org/nixpkgs/manual/) - contributing to Nixpkgs and using programming-language-specific Nix expressions
+* [Nix Package Manager Manual](https://nixos.org/nix/manual) - how to write Nix expresssions (programs), and how to use Nix command line tools

-```
-% git remote update channels
-% git rebase channels/nixos-19.03
-```
-
-For pull requests, please rebase onto nixpkgs `master`.
-
-[NixOS](https://nixos.org/nixos/) Linux distribution source code is located inside
-`nixos/` folder.
-
-* [NixOS installation instructions](https://nixos.org/nixos/manual/#ch-installation)
-* [Documentation (Nix Expression Language chapter)](https://nixos.org/nix/manual/#ch-expression-language)
-* [Manual (How to write packages for Nix)](https://nixos.org/nixpkgs/manual/)
-* [Manual (NixOS)](https://nixos.org/nixos/manual/)
-* [Community maintained wiki](https://nixos.wiki/)
-* [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for 19.03 release](https://hydra.nixos.org/jobset/nixos/release-19.03)
-* [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for 19.03 release](https://hydra.nixos.org/job/nixos/release-19.03/tested#tabs-constituents)
-
-Communication:
+# Community

 * [Discourse Forum](https://discourse.nixos.org/)
 * [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)
+* [NixOS Weekly](https://weekly.nixos.org/)
+* [Community-maintained wiki](https://nixos.wiki/)

-Note: MIT license does not apply to the packages built by Nixpkgs, merely to
-the package descriptions (Nix expressions, build scripts, and so on). It also
-might not apply to patches included in Nixpkgs, which may be derivative works
-of the packages to which they apply. The aforementioned artifacts are all
-covered by the licenses of the respective packages.
+# Other Project Repositories
+
+The sources of all offical Nix-related projects are in the [NixOS
+organization on GitHub](https://github.com/NixOS/). Here are some of
+the main ones:
+
+* [Nix](https://github.com/NixOS/nix) - the purely functional package manager
+* [NixOps](https://github.com/NixOS/nixops) - the tool to remotely deploy NixOS machines
+* [Nix RFCs](https://github.com/NixOS/rfcs) - the formal process for making substantial changes to the community
+* [NixOS homepage](https://github.com/NixOS/nixos-homepage) - the [NixOS.org](https://nixos.org) website
+* [hydra](https://github.com/NixOS/hydra) - our continuous integration system
+* [NixOS Artwork](https://github.com/NixOS/nixos-artwork) - NixOS artwork
+
+# Continuous Integration and Distribution
+
+Nixpkgs and NixOS are built and tested by our continuous integration
+system, [Hydra](https://hydra.nixos.org/).
+
+* [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
+* [Continuous package builds for the NixOS 19.03 release](https://hydra.nixos.org/jobset/nixos/release-19.03)
+* [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
+* [Tests for the NixOS 19.03 release](https://hydra.nixos.org/job/nixos/release-19.03/tested#tabs-constituents)
+
+Artifacts successfully built with Hydra are published to cache at
+https://cache.nixos.org/. When successful build and test criteria are
+met, the Nixpkgs expressions are distributed via [Nix
+channels](https://nixos.org/nix/manual/#sec-channels). The channels
+are provided via a read-only mirror of the Nixpkgs repository called
+[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels).
+
+# Contributing
+
+Nixpkgs is among the most active projects on GitHub. While thousands
+of open issues and pull requests might seem a lot at first, it helps
+consider it in the context of the scope of the project. Nixpkgs
+describes how to build over 40,000 pieces of software and implements a
+Linux distribution. The [GitHub Insights](https://github.com/NixOS/nixpkgs/pulse)
+page gives a sense of the project activity.
+
+Community contributions are always welcome through GitHub Issues and
+Pull Requests. When pull requests are made, our tooling automation bot,
+[OfBorg](https://github.com/NixOS/ofborg) will perform various checks
+to help ensure expression quality.
+
+The *Nixpkgs maintainers* are people who have assigned themselves to
+maintain specific individual packages. We encourage people who care
+about a package to assign themselves as a maintainer. When a pull
+request is made against a package, OfBorg will notify the appropriate
+maintainer(s). The *Nixpkgs committers* are people who have been given
+permission to merge.
+
+Most contributions are based on and merged into these branches:
+
+* `master` is the main branch where all small contributions go
+* `staging` is branched from master, changes that have a big impact on
+  Hydra builds go to this branch
+* `staging-next` is branched from staging and only fixes to stabilize
+  and security fixes with a big impact on Hydra builds should be
+  contributed to this branch. This branch is merged into master when
+  deemed of sufficiently high quality
+
+For more information about contributing to the project, please visit
+the [contributing page](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
+
+# Donations
+
+The infrastructure for NixOS and related projects is maintained by a
+nonprofit organization, the [NixOS
+Foundation](https://nixos.org/nixos/foundation.html). To ensure the
+continuity and expansion of the NixOS infrastructure, we are looking
+for donations to our organization.
+
+You can donate to the NixOS foundation by using Open Collective:
+
+<a href="https://opencollective.com/nixos#support"><img src="https://opencollective.com/nixos/tiers/supporter.svg?width=890" /></a>
+
+# License
+
+Nixpkgs is licensed under the [MIT License](COPYING).
+
+Note: MIT license does not apply to the packages built by Nixpkgs,
+merely to the files in this repository (the Nix expressions, build
+scripts, NixOS modules, etc.). It also might not apply to patches
+included in Nixpkgs, which may be derivative works of the packages to
+which they apply. The aforementioned artifacts are all covered by the
+licenses of the respective packages.
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -52,7 +52,9 @@ luasocket,,,,,
 luasql-sqlite3,,,,,vyp
 luassert,,,,,
 luasystem,,,,,
+luautf8,,,,,pstn
 luazip,,,,,
+lua-yajl,,,,,pstn
 luuid,,,,,
 luv,,,,,
 markdown,,,,,
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@ -204,6 +204,11 @@
     accordingly.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     PostgreSQL 9.4 is scheduled EOL during the 19.09 life cycle and has been removed.
+    </para>
+   </listitem>
   <listitem>
    <para>
     The options <option>services.prometheus.alertmanager.user</option> and
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -24,4 +24,116 @@ pkgs: with pkgs.lib;
      throw "${shell} is not a shell package"
    else
      shell;
+
+  /* Recurse into a list or an attrset, searching for attrs named like
+     the value of the "attr" parameter, and return an attrset where the
+     names are the corresponding jq path where the attrs were found and
+     the values are the values of the attrs.
+
+     Example:
+       recursiveGetAttrWithJqPrefix {
+         example = [
+           {
+             irrelevant = "not interesting";
+           }
+           {
+             ignored = "ignored attr";
+             relevant = {
+               secret = {
+                 _secret = "/path/to/secret";
+               };
+             };
+           }
+         ];
+       } "_secret" -> { ".example[1].relevant.secret" = "/path/to/secret"; }
+  */
+  recursiveGetAttrWithJqPrefix = item: attr:
+    let
+      recurse = prefix: item:
+        if item ? ${attr} then
+          nameValuePair prefix item.${attr}
+        else if isAttrs item then
+          map (name: recurse (prefix + "." + name) item.${name}) (attrNames item)
+        else if isList item then
+          imap0 (index: item: recurse (prefix + "[${toString index}]") item) item
+        else
+          [];
+    in listToAttrs (flatten (recurse "" item));
+
+  /* Takes an attrset and a file path and generates a bash snippet that
+     outputs a JSON file at the file path with all instances of
+
+     { _secret = "/path/to/secret" }
+
+     in the attrset replaced with the contents of the file
+     "/path/to/secret" in the output JSON.
+
+     When a configuration option accepts an attrset that is finally
+     converted to JSON, this makes it possible to let the user define
+     arbitrary secret values.
+
+     Example:
+       If the file "/path/to/secret" contains the string
+       "topsecretpassword1234",
+
+       genJqSecretsReplacementSnippet {
+         example = [
+           {
+             irrelevant = "not interesting";
+           }
+           {
+             ignored = "ignored attr";
+             relevant = {
+               secret = {
+                 _secret = "/path/to/secret";
+               };
+             };
+           }
+         ];
+       } "/path/to/output.json"
+
+       would generate a snippet that, when run, outputs the following
+       JSON file at "/path/to/output.json":
+
+       {
+         "example": [
+           {
+             "irrelevant": "not interesting"
+           },
+           {
+             "ignored": "ignored attr",
+             "relevant": {
+               "secret": "topsecretpassword1234"
+             }
+           }
+         ]
+       }
+  */
+  genJqSecretsReplacementSnippet = genJqSecretsReplacementSnippet' "_secret";
+
+  # Like genJqSecretsReplacementSnippet, but allows the name of the
+  # attr which identifies the secret to be changed.
+  genJqSecretsReplacementSnippet' = attr: set: output:
+    let
+      secrets = recursiveGetAttrWithJqPrefix set attr;
+    in ''
+      if [[ -h '${output}' ]]; then
+        rm '${output}'
+      fi
+    ''
+    + concatStringsSep
+        "\n"
+        (imap1 (index: name: "export secret${toString index}=$(<'${secrets.${name}}')")
+               (attrNames secrets))
+    + "\n"
+    + "${pkgs.jq}/bin/jq >'${output}' '"
+    + concatStringsSep
+      " | "
+      (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
+             (attrNames secrets))
+    + ''
+      ' <<'EOF'
+      ${builtins.toJSON set}
+      EOF
+    '';
 }
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -228,7 +228,7 @@ in
      # systems!
      mkDefault (if versionAtLeast config.system.stateVersion "17.09" then pkgs.postgresql_9_6
            else if versionAtLeast config.system.stateVersion "16.03" then pkgs.postgresql_9_5
-            else pkgs.postgresql_9_4);
+            else throw "postgresql_9_4 was removed, please upgrade your postgresql version.");

    services.postgresql.dataDir =
      mkDefault (if versionAtLeast config.system.stateVersion "17.09" then "/var/lib/postgresql/${config.services.postgresql.package.psqlSchema}"
--- a/nixos/modules/services/hardware/upower.nix
+++ b/nixos/modules/services/hardware/upower.nix
@ -5,8 +5,11 @@
 with lib;

 let
+
  cfg = config.services.upower;
+
 in
+
 {

  ###### interface
@ -49,55 +52,7 @@ in

    services.udev.packages = [ cfg.package ];

-    systemd.services.upower =
-      { description = "Power Management Daemon";
-        path = [ pkgs.glib.out ]; # needed for gdbus
-        serviceConfig =
-          { Type = "dbus";
-            BusName = "org.freedesktop.UPower";
-            ExecStart = "@${cfg.package}/libexec/upowerd upowerd";
-            Restart = "on-failure";
-            # Upstream lockdown:
-            # Filesystem lockdown
-            ProtectSystem = "strict";
-            # Needed by keyboard backlight support
-            ProtectKernelTunables = false;
-            ProtectControlGroups = true;
-            ReadWritePaths = "/var/lib/upower";
-            ProtectHome = true;
-            PrivateTmp = true;
-
-            # Network
-            # PrivateNetwork=true would block udev's netlink socket
-            RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
-
-            # Execute Mappings
-            MemoryDenyWriteExecute = true;
-
-            # Modules
-            ProtectKernelModules = true;
-
-            # Real-time
-            RestrictRealtime = true;
-
-            # Privilege escalation
-            NoNewPrivileges = true;
-          };
-      };
-
-    system.activationScripts.upower =
-      ''
-        mkdir -m 0755 -p /var/lib/upower
-      '';
-
-    # The upower daemon seems to get stuck after doing a suspend
-    # (i.e. subsequent suspend requests will say "Sleep has already
-    # been requested and is pending").  So as a workaround, restart
-    # the daemon.
-    powerManagement.resumeCommands =
-      ''
-        ${config.systemd.package}/bin/systemctl try-restart upower
-      '';
+    systemd.packages = [ cfg.package ];

  };

--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:

 # TODO: support non-postgresql

@ -12,14 +12,12 @@ let
  gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
  gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
  pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;
-  pgSuperUser = config.services.postgresql.superUser;

  databaseConfig = {
    production = {
      adapter = "postgresql";
      database = cfg.databaseName;
      host = cfg.databaseHost;
-      password = cfg.databasePassword;
      username = cfg.databaseUsername;
      encoding = "utf8";
      pool = cfg.databasePool;
@ -66,13 +64,6 @@ let

  redisConfig.production.url = "redis://localhost:6379/";

-  secretsConfig.production = {
-    secret_key_base = cfg.secrets.secret;
-    otp_key_base = cfg.secrets.otp;
-    db_key_base = cfg.secrets.db;
-    openid_connect_signing_key = cfg.secrets.jws;
-  };
-
  gitlabConfig = {
    # These are the default settings from config/gitlab.example.yml
    production = flip recursiveUpdate cfg.extraConfig {
@ -180,10 +171,11 @@ let
        address: "${cfg.smtp.address}",
        port: ${toString cfg.smtp.port},
        ${optionalString (cfg.smtp.username != null) ''user_name: "${cfg.smtp.username}",''}
-        ${optionalString (cfg.smtp.password != null) ''password: "${cfg.smtp.password}",''}
+        ${optionalString (cfg.smtp.passwordFile != null) ''password: "@smtpPassword@",''}
        domain: "${cfg.smtp.domain}",
        ${optionalString (cfg.smtp.authentication != null) "authentication: :${cfg.smtp.authentication},"}
        enable_starttls_auto: ${toString cfg.smtp.enableStartTLSAuto},
+        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        openssl_verify_mode: '${cfg.smtp.opensslVerifyMode}'
      }
    end
@ -244,13 +236,33 @@ in {

      databaseHost = mkOption {
        type = types.str;
-        default = "127.0.0.1";
-        description = "Gitlab database hostname.";
+        default = "";
+        description = ''
+          Gitlab database hostname. An empty string means <quote>use
+          local unix socket connection</quote>.
+        '';
      };

-      databasePassword = mkOption {
-        type = types.str;
-        description = "Gitlab database user password.";
+      databasePasswordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          File containing the Gitlab database user password.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
+      databaseCreateLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether a database should be automatically created on the
+          local host. Set this to <literal>false</literal> if you plan
+          on provisioning a local database yourself or use an external
+          one.
+        '';
      };

      databaseName = mkOption {
@ -338,10 +350,15 @@ in {
        '';
      };

-      initialRootPassword = mkOption {
-        type = types.str;
+      initialRootPasswordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
        description = ''
-          Initial password of the root account if this is a new install.
+          File containing the initial password of the root account if
+          this is a new install.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
        '';
      };

@ -365,15 +382,20 @@ in {
        };

        username = mkOption {
-          type = types.nullOr types.str;
+          type = with types; nullOr str;
          default = null;
          description = "Username of the SMTP server for Gitlab.";
        };

-        password = mkOption {
-          type = types.nullOr types.str;
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
          default = null;
-          description = "Password of the SMTP server for Gitlab.";
+          description = ''
+            File containing the password of the SMTP server for Gitlab.
+
+            This should be a string, not a nix path, since nix paths
+            are copied into the world-readable nix store.
+          '';
        };

        domain = mkOption {
@ -383,7 +405,7 @@ in {
        };

        authentication = mkOption {
-          type = types.nullOr types.str;
+          type = with types; nullOr str;
          default = null;
          description = "Authentitcation type to use, see http://api.rubyonrails.org/classes/ActionMailer/Base.html";
        };
@ -401,68 +423,125 @@ in {
        };
      };

-      secrets.secret = mkOption {
-        type = types.str;
+      secrets.secretFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
        description = ''
-          The secret is used to encrypt variables in the DB. If
-          you change or lose this key you will be unable to access variables
-          stored in database.
+          A file containing the secret used to encrypt variables in
+          the DB. If you change or lose this key you will be unable to
+          access variables stored in database.

          Make sure the secret is at least 30 characters and all random,
          no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
        '';
      };

-      secrets.db = mkOption {
-        type = types.str;
+      secrets.dbFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
        description = ''
-          The secret is used to encrypt variables in the DB. If
-          you change or lose this key you will be unable to access variables
-          stored in database.
+          A file containing the secret used to encrypt variables in
+          the DB. If you change or lose this key you will be unable to
+          access variables stored in database.

          Make sure the secret is at least 30 characters and all random,
          no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
        '';
      };

-      secrets.otp = mkOption {
-        type = types.str;
+      secrets.otpFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
        description = ''
-          The secret is used to encrypt secrets for OTP tokens. If
-          you change or lose this key, users which have 2FA enabled for login
-          won't be able to login anymore.
+          A file containing the secret used to encrypt secrets for OTP
+          tokens. If you change or lose this key, users which have 2FA
+          enabled for login won't be able to login anymore.

          Make sure the secret is at least 30 characters and all random,
          no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
        '';
      };

-      secrets.jws = mkOption {
-        type = types.str;
+      secrets.jwsFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
        description = ''
-          The secret is used to encrypt session keys. If you change or lose
-          this key, users will be disconnected.
+          A file containing the secret used to encrypt session
+          keys. If you change or lose this key, users will be
+          disconnected.

          Make sure the secret is an RSA private key in PEM format. You can
          generate one with

          openssl genrsa 2048
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
        '';
      };

      extraConfig = mkOption {
        type = types.attrs;
        default = {};
-        example = {
-          gitlab = {
-            default_projects_features = {
-              builds = false;
+        example = literalExample ''
+          {
+            gitlab = {
+              default_projects_features = {
+                builds = false;
+              };
+            };
+            omniauth = {
+              enabled = true;
+              auto_sign_in_with_provider = "openid_connect";
+              allow_single_sign_on = ["openid_connect"];
+              block_auto_created_users = false;
+              providers = [
+                {
+                  name = "openid_connect";
+                  label = "OpenID Connect";
+                  args = {
+                    name = "openid_connect";
+                    scope = ["openid" "profile"];
+                    response_type = "code";
+                    issuer = "https://keycloak.example.com/auth/realms/My%20Realm";
+                    discovery = true;
+                    client_auth_method = "query";
+                    uid_field = "preferred_username";
+                    client_options = {
+                      identifier = "gitlab";
+                      secret = { _secret = "/var/keys/gitlab_oidc_secret"; };
+                      redirect_uri = "https://git.example.com/users/auth/openid_connect/callback";
+                    };
+                  };
+                }
+              ];
            };
          };
-        };
+        '';
        description = ''
-          Extra options to be merged into config/gitlab.yml as nix
-          attribute set.
+          Extra options to be added under
+          <literal>production</literal> in
+          <filename>config/gitlab.yml</filename>, as a nix attribute
+          set.
+
+          Options containing secret data should be set to an attribute
+          set containing the attribute <literal>_secret</literal> - a
+          string pointing to a file containing the value the option
+          should be set to. See the example to get a better picture of
+          this: in the resulting
+          <filename>config/gitlab.yml</filename> file, the
+          <literal>production.omniauth.providers[0].args.client_options.secret</literal>
+          key will be set to the contents of the
+          <filename>/var/keys/gitlab_oidc_secret</filename> file.
        '';
      };
    };
@ -470,12 +549,66 @@ in {

  config = mkIf cfg.enable {

+    assertions = [
+      {
+        assertion = cfg.databaseCreateLocally -> (cfg.user == cfg.databaseUsername);
+        message = "For local automatic database provisioning services.gitlab.user and services.gitlab.databaseUsername should be identical.";
+      }
+      {
+        assertion = (cfg.databaseHost != "") -> (cfg.databasePasswordFile != null);
+        message = "When services.gitlab.databaseHost is customized, services.gitlab.databasePasswordFile must be set!";
+      }
+      {
+        assertion = cfg.initialRootPasswordFile != null;
+        message = "services.gitlab.initialRootPasswordFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.secretFile != null;
+        message = "services.gitlab.secrets.secretFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.dbFile != null;
+        message = "services.gitlab.secrets.dbFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.otpFile != null;
+        message = "services.gitlab.secrets.otpFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.jwsFile != null;
+        message = "services.gitlab.secrets.jwsFile must be set!";
+      }
+    ];
+
    environment.systemPackages = [ pkgs.git gitlab-rake gitlab-rails cfg.packages.gitlab-shell ];

    # Redis is required for the sidekiq queue runner.
    services.redis.enable = mkDefault true;
+
    # We use postgres as the main data store.
-    services.postgresql.enable = mkDefault true;
+    services.postgresql = optionalAttrs cfg.databaseCreateLocally {
+      enable = true;
+      ensureUsers = singleton { name = cfg.databaseUsername; };
+    };
+    # The postgresql module doesn't currently support concepts like
+    # objects owners and extensions; for now we tack on what's needed
+    # here.
+    systemd.services.postgresql.postStart = mkAfter (optionalString cfg.databaseCreateLocally ''
+      $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
+      current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
+      if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
+          $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
+          if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
+              echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
+              exit 1
+          fi
+          touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+          $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
+          rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+      fi
+      $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+    '');
+
    # Use postfix to send out mails.
    services.postfix.enable = mkDefault true;

@ -527,14 +660,9 @@ in {

      "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"

-      "L+ ${cfg.statePath}/config/gitlab.yml - - - - ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)}"
-      "L+ ${cfg.statePath}/config/database.yml - - - - ${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)}"
-      "L+ ${cfg.statePath}/config/secrets.yml - - - - ${pkgs.writeText "secrets.yml" (builtins.toJSON secretsConfig)}"
      "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
-
      "L+ ${cfg.statePath}/config/initializers/extra-gitlab.rb - - - - ${extraGitlabRb}"
-    ] ++ optional cfg.smtp.enable
-      "L+ ${cfg.statePath}/config/initializers/smtp_settings.rb - - - - ${smtpSettings}" ;
+    ];

    systemd.services.gitlab-sidekiq = {
      after = [ "network.target" "redis.service" "gitlab.service" ];
@ -626,46 +754,75 @@ in {
        gnupg
      ];
      preStart = ''
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} rm -rf ${cfg.statePath}/db/*
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
+        cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
+        rm -rf ${cfg.statePath}/db/*
+        cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
+        cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db

-        ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
+        ${cfg.packages.gitlab-shell}/bin/install

-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${cfg.packages.gitlab-shell}/bin/install
+        ${optionalString cfg.smtp.enable ''
+          install -m u=rw ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
+          ${optionalString (cfg.smtp.passwordFile != null) ''
+            smtp_password=$(<'${cfg.smtp.passwordFile}')
+            ${pkgs.replace}/bin/replace-literal -e '@smtpPassword@' "$smtp_password" '${cfg.statePath}/config/initializers/smtp_settings.rb'
+          ''}
+        ''}

-        if ! test -e "${cfg.statePath}/db-created"; then
-          if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
-            ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql postgres -c "CREATE ROLE ${cfg.databaseUsername} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${cfg.databasePassword}'"
-            ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} ${config.services.postgresql.package}/bin/createdb --owner ${cfg.databaseUsername} ${cfg.databaseName}
+        (
+          umask u=rwx,g=,o=

-            # enable required pg_trgm extension for gitlab
-            ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql ${cfg.databaseName} -c "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+          ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
+
+          ${if cfg.databasePasswordFile != null then ''
+              export db_password="$(<'${cfg.databasePasswordFile}')"
+
+              if [[ -z "$db_password" ]]; then
+                >&2 echo "Database password was an empty string!"
+                exit 1
+              fi
+
+              ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+                                '.production.password = $ENV.db_password' \
+                                >'${cfg.statePath}/config/database.yml'
+            ''
+            else ''
+              ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+                                >'${cfg.statePath}/config/database.yml'
+            ''
+          }
+
+          ${utils.genJqSecretsReplacementSnippet
+              gitlabConfig
+              "${cfg.statePath}/config/gitlab.yml"
+          }
+
+          if [[ -h '${cfg.statePath}/config/secrets.yml' ]]; then
+            rm '${cfg.statePath}/config/secrets.yml'
          fi

-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${gitlab-rake}/bin/gitlab-rake db:schema:load
+          export secret="$(<'${cfg.secrets.secretFile}')"
+          export db="$(<'${cfg.secrets.dbFile}')"
+          export otp="$(<'${cfg.secrets.otpFile}')"
+          export jws="$(<'${cfg.secrets.jwsFile}')"
+          ${pkgs.jq}/bin/jq -n '{production: {secret_key_base: $ENV.secret,
+                                              otp_key_base: $ENV.db,
+                                              db_key_base: $ENV.otp,
+                                              openid_connect_signing_key: $ENV.jws}}' \
+                            > '${cfg.statePath}/config/secrets.yml'
+        )

-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} touch "${cfg.statePath}/db-created"
-        fi
-
-        # Always do the db migrations just to be sure the database is up-to-date
-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${gitlab-rake}/bin/gitlab-rake db:migrate
-
-        if ! test -e "${cfg.statePath}/db-seeded"; then
-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${gitlab-rake}/bin/gitlab-rake db:seed_fu \
-            GITLAB_ROOT_PASSWORD='${cfg.initialRootPassword}' GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}'
-          ${pkgs.sudo}/bin/sudo -u ${cfg.user} touch "${cfg.statePath}/db-seeded"
-        fi
+        initial_root_password="$(<'${cfg.initialRootPasswordFile}')"
+        ${gitlab-rake}/bin/gitlab-rake gitlab:db:configure GITLAB_ROOT_PASSWORD="$initial_root_password" \
+                                                           GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}'

        # We remove potentially broken links to old gitlab-shell versions
        rm -Rf ${cfg.statePath}/repositories/**/*.git/hooks

-        ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${pkgs.git}/bin/git config --global core.autocrlf "input"
+        ${pkgs.git}/bin/git config --global core.autocrlf "input"
      '';

      serviceConfig = {
-        PermissionsStartOnly = true; # preStart must be run as root
        Type = "simple";
        User = cfg.user;
        Group = cfg.group;
--- a/nixos/modules/services/misc/gitlab.xml
+++ b/nixos/modules/services/misc/gitlab.xml
@ -54,8 +54,8 @@
 <programlisting>
 services.gitlab = {
  <link linkend="opt-services.gitlab.enable">enable</link> = true;
-  <link linkend="opt-services.gitlab.databasePassword">databasePassword</link> = "eXaMpl3";
-  <link linkend="opt-services.gitlab.initialRootPassword">initialRootPassword</link> = "UseNixOS!";
+  <link linkend="opt-services.gitlab.databasePasswordFile">databasePasswordFile</link> = "/var/keys/gitlab/db_password";
+  <link linkend="opt-services.gitlab.initialRootPasswordFile">initialRootPasswordFile</link> = "/var/keys/gitlab/root_password";
  <link linkend="opt-services.gitlab.https">https</link> = true;
  <link linkend="opt-services.gitlab.host">host</link> = "git.example.com";
  <link linkend="opt-services.gitlab.port">port</link> = 443;
@ -67,38 +67,10 @@ services.gitlab = {
    <link linkend="opt-services.gitlab.smtp.port">port</link> = 25;
  };
  secrets = {
-    <link linkend="opt-services.gitlab.secrets.db">db</link> = "uPgq1gtwwHiatiuE0YHqbGa5lEIXH7fMsvuTNgdzJi8P0Dg12gibTzBQbq5LT7PNzcc3BP9P1snHVnduqtGF43PgrQtU7XL93ts6gqe9CBNhjtaqUwutQUDkygP5NrV6";
-    <link linkend="opt-services.gitlab.secrets.secret">secret</link> = "devzJ0Tz0POiDBlrpWmcsjjrLaltyiAdS8TtgT9YNBOoUcDsfppiY3IXZjMVtKgXrFImIennFGOpPN8IkP8ATXpRgDD5rxVnKuTTwYQaci2NtaV1XxOQGjdIE50VGsR3";
-    <link linkend="opt-services.gitlab.secrets.otp">otp</link> = "e1GATJVuS2sUh7jxiPzZPre4qtzGGaS22FR50Xs1TerRVdgI3CBVUi5XYtQ38W4xFeS4mDqi5cQjExE838iViSzCdcG19XSL6qNsfokQP9JugwiftmhmCadtsnHErBMI";
-    <link linkend="opt-services.gitlab.secrets.jws">jws</link> = ''
-      -----BEGIN RSA PRIVATE KEY-----
-      MIIEpAIBAAKCAQEArrtx4oHKwXoqUbMNqnHgAklnnuDon3XG5LJB35yPsXKv/8GK
-      ke92wkI+s1Xkvsp8tg9BIY/7c6YK4SR07EWL+dB5qwctsWR2Q8z+/BKmTx9D99pm
-      hnsjuNIXTF7BXrx3RX6BxZpH5Vzzh9nCwWKT/JCFqtwH7afNGGL7aMf+hdaiUg/Q
-      SD05yRObioiO4iXDolsJOhrnbZvlzVHl1ZYxFJv0H6/Snc0BBA9Fl/3uj6ANpbjP
-      eXF1SnJCqT87bj46r5NdVauzaRxAsIfqHroHK4UZ98X5LjGQFGvSqTvyjPBS4I1i
-      s7VJU28ObuutHxIxSlH0ibn4HZqWmKWlTS652wIDAQABAoIBAGtPcUTTw2sJlR3x
-      4k2wfAvLexkHNbZhBdKEa5JiO5mWPuLKwUiZEY2CU7Gd6csG3oqNWcm7/IjtC7dz
-      xV8p4yp8T4yq7vQIJ93B80NqTLtBD2QTvG2RCMJEPMzJUObWxkVmyVpLQyZo7KOd
-      KE/OM+aj94OUeEYLjRkSCScz1Gvq/qFG/nAy7KPCmN9JDHuhX26WHo2Rr1OnPNT/
-      7diph0bB9F3b8gjjNTqXDrpdAqVOgR/PsjEBz6DMY+bdyMIn87q2yfmMexxRofN6
-      LulpzSaa6Yup8N8H6PzVO6KAkQuf1aQRj0sMwGk1IZEnj6I0KbuHIZkw21Nc6sf2
-      ESFySDECgYEA1PnCNn5tmLnwe62Ttmrzl20zIS3Me1gUVJ1NTfr6+ai0I9iMYU21
-      5czuAjJPm9JKQF2vY8UAaCj2ZoObtHa/anb3xsCd8NXoM3iJq5JDoXI1ldz3Y+ad
-      U/bZUg1DLRvAniTuXmw9iOTwTwPxlDIGq5k+wG2Xmi1lk7zH8ezr9BMCgYEA0gfk
-      EhgcmPH8Z5cU3YYwOdt6HSJOM0OyN4k/5gnkv+HYVoJTj02gkrJmLr+mi1ugKj46
-      7huYO9TVnrKP21tmbaSv1dp5hS3letVRIxSloEtVGXmmdvJvBRzDWos+G+KcvADi
-      fFCz6w8v9NmO40CB7y/3SxTmSiSxDQeoi9LhDBkCgYEAsPgMWm25sfOnkY2NNUIv
-      wT8bAlHlHQT2d8zx5H9NttBpR3P0ShJhuF8N0sNthSQ7ULrIN5YGHYcUH+DyLAWU
-      TuomP3/kfa+xL7vUYb269tdJEYs4AkoppxBySoz8qenqpz422D0G8M6TpIS5Y5Qi
-      GMrQ6uLl21YnlpiCaFOfSQMCgYEAmZxj1kgEQmhZrnn1LL/D7czz1vMMNrpAUhXz
-      wg9iWmSXkU3oR1sDIceQrIhHCo2M6thwyU0tXjUft93pEQocM/zLDaGoVxtmRxxV
-      J08mg8IVD3jFoyFUyWxsBIDqgAKRl38eJsXvkO+ep3mm49Z+Ma3nM+apN3j2dQ0w
-      3HLzXaECgYBFLMEAboVFwi5+MZjGvqtpg2PVTisfuJy2eYnPwHs+AXUgi/xRNFjI
-      YHEa7UBPb5TEPSzWImQpETi2P5ywcUYL1EbN/nqPWmjFnat8wVmJtV4sUpJhubF4
-      Vqm9LxIWc1uQ1q1HDCejRIxIN3aSH+wgRS3Kcj8kCTIoXd1aERb04g==
-      -----END RSA PRIVATE KEY-----
-    '';
+    <link linkend="opt-services.gitlab.secrets.dbFile">dbFile</link> = "/var/keys/gitlab/db";
+    <link linkend="opt-services.gitlab.secrets.secretFile">secretFile</link> = "/var/keys/gitlab/secret";
+    <link linkend="opt-services.gitlab.secrets.otpFile">otpFile</link> = "/var/keys/gitlab/otp";
+    <link linkend="opt-services.gitlab.secrets.jwsFile">jwsFile</link> = "/var/keys/gitlab/jws";
  };
  <link linkend="opt-services.gitlab.extraConfig">extraConfig</link> = {
    gitlab = {
@ -113,12 +85,16 @@ services.gitlab = {
  </para>

  <para>
-   If you're setting up a new Gitlab instance, generate new secrets. You for
-   instance use <literal>tr -dc A-Za-z0-9 &lt; /dev/urandom | head -c
-   128</literal> to generate a new secret. Gitlab encrypts sensitive data
-   stored in the database. If you're restoring an existing Gitlab instance, you
-   must specify the secrets secret from <literal>config/secrets.yml</literal>
-   located in your Gitlab state folder.
+   If you're setting up a new Gitlab instance, generate new
+   secrets. You for instance use <literal>tr -dc A-Za-z0-9 &lt;
+   /dev/urandom | head -c 128 &gt; /var/keys/gitlab/db</literal> to
+   generate a new db secret. Make sure the files can be read by, and
+   only by, the user specified by <link
+   linkend="opt-services.gitlab.user">services.gitlab.user</link>. Gitlab
+   encrypts sensitive data stored in the database. If you're restoring
+   an existing Gitlab instance, you must specify the secrets secret
+   from <literal>config/secrets.yml</literal> located in your Gitlab
+   state folder.
  </para>

  <para>
--- a/nixos/modules/services/search/kibana.nix
+++ b/nixos/modules/services/search/kibana.nix
@ -9,7 +9,7 @@ let
  lt6_6 = builtins.compareVersions cfg.package.version "6.6" < 0;

  cfgFile = pkgs.writeText "kibana.json" (builtins.toJSON (
-    (filterAttrsRecursive (n: v: v != null) ({
+    (filterAttrsRecursive (n: v: v != null && v != []) ({
      server.host = cfg.listenAddress;
      server.port = cfg.port;
      server.ssl.certificate = cfg.cert;
--- a/nixos/modules/services/torrent/deluge.nix
+++ b/nixos/modules/services/torrent/deluge.nix
@ -178,6 +178,7 @@ in {
      "d '${cfg.dataDir}/.config' 0770 ${cfg.user} ${cfg.group}"
      "d '${cfg.dataDir}/.config/deluge' 0770 ${cfg.user} ${cfg.group}"
    ]
+    ++ optional (cfg.config ? download_location)
      "d '${cfg.config.download_location}' 0770 ${cfg.user} ${cfg.group}"
    ++ optional (cfg.config ? torrentfiles_location)
      "d '${cfg.config.torrentfiles_location}' 0770 ${cfg.user} ${cfg.group}"
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -29,44 +29,14 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {

      services.gitlab = {
        enable = true;
-        databasePassword = "dbPassword";
-        inherit initialRootPassword;
+        databasePasswordFile = pkgs.writeText "dbPassword" "xo0daiF4";
+        initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword;
        smtp.enable = true;
        secrets = {
-          secret = "secret";
-          otp = "otpsecret";
-          db = "dbsecret";
-
-          # nix-shell -p openssl --run "openssl genrsa 2048"
-          jws = ''
-            -----BEGIN RSA PRIVATE KEY-----
-            MIIEpAIBAAKCAQEA13/qEio76OWUtWO0WIz9lWnsTWOU8Esv4sQHDq9PCEFsLt21
-            PAXrlWhLjjWcxGfsrDwnh7YErGHYL62BMSxMdFJolaknlQK/O/V8UETDe45VoHM+
-            Znk270RfUcfYFgiihnXUZXVmL0om9TsQSk646wCcjCY9LxtxUyKNhvT7KjgYw2aX
-            z34aw7M+Js3T2p1TjZPSC82GtmtKkJEKFMi5EjprLTDE7EdcUzr9Xuw+kQ+gRm9k
-            7FE+JQqSoprwE3Q0v2OAn3UhLMgg0gNFRnsc5l6IAshDzV+H22RPqKKlJjVjjfPY
-            0TQSvYLVApigHbDPH0BoCXfjFfQazbbP3OUHrwIDAQABAoIBAQCMU+tkcMQaYIV5
-            qLdjgkwO467QpivyXcOM8wF1eosIYTHFQvIlZ+WEoSmyLQ8shlADyBgls01Pw1c3
-            lNAv6RzQEmmwKzpvOh61OKH+0whIiOMRXHoh2IUBQZCgfHYlwvGyhUAN4WjtGmhM
-            AG4XNTQNM5S9Xpkw97nP3Qwz+YskbbkrfqtCEVy9ro+4nhbjqPsuO3adbnkva4zR
-            cyurRhrHgHU6LPjn5NHnHH4qw2faY2oAsL8pmpkTbO5IqWDvOcbjNfjVPgVoq26O
-            bbaa1qs4nmc80qQgMjRPJef535xyf3eLsSlDvpf6O8sPrJzVR1zaqEqixpQCZDac
-            +kRiSBrhAoGBAOwHiq0PuyJh6VzBu7ybqX6+gF/wA4Jkwzx6mbfaBgurvU1aospp
-            kisIonAkxSbxllZMnjbkShZEdATYKeT9o5NEhnU4YnHfc5bJZbiWOZAzYGLcY7g8
-            vDQ31pBItyY4pFgPbSpNlbUvUsoPVJ45RasRADDTNCzMzdjFQQXst2V9AoGBAOm7
-            sSpzYfFPLEAhieAkuhtbsX58Boo46djiKVfzGftfp6F9aHTOfzGORU5jrZ16mSbS
-            qkkC6BEFrATX2051dzzXC89fWoJYALrsffE5I3KlKXsCAWSnCP1MMxOfH+Ls61Mr
-            7pK/LKfvJt53mUH4jIdbmmFUDwbg18oBEH+x9PmbAoGAS/+JqXu9N67rIxDGUE6W
-            3tacI0f2+U9Uhe67/DTZaXyc8YFTlXU0uWKIWy+bw5RaYeM9tlL/f/f+m2i25KK+
-            vrZ7zNag7CWU5GJovGyykDnauTpZaYM03mN0VPT08/uc/zXIYqyknbhlIeaZynCK
-            fDB3LUF0NVCknz20WCIGU0kCgYEAkxY0ZXx61Dp4pFr2wwEZxQGs7uXpz64FKyEX
-            12r6nMATY4Lh6y/Px0W6w5vis8lk+5Ny6cNUevHQ0LNuJS+yu6ywl+1vrbrnqroM
-            f3LvpcPeGLSoX8jl1VDQi7aFgG6LoKly1xJLbdsH4NPutB9PgBbbTghx9GgmI88L
-            rPA2M6UCgYBOmkYJocNgxg6B1/n4Tb9fN1Q/XuJrFDE6NxVUoke+IIyMPRH7FC3m
-            VMYzu+b7zTVJjaBb1cmJemxl/xajziWDofJYPefhdbOVU7HXtmJFY0IG3pVxU1zW
-            3bmDj5QAtCUDpuuNa6GEIT0YR4+D/V7o3DmlZ0tVIwKJmVJoQ2f5dw==
-            -----END RSA PRIVATE KEY-----
-          '';
+          secretFile = pkgs.writeText "secret" "Aig5zaic";
+          otpFile = pkgs.writeText "otpsecret" "Riew9mue";
+          dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
+          jwsFile = pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
        };
      };
    };
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@ -14,6 +14,7 @@
 , libpthreadstubs
 , libtasn1
 , libXdmcp
+, ninja
 , pcre
 , protobuf
 , sqlite
@ -72,15 +73,20 @@ mkDerivation rec {
    gstreamer
    gst-plugins-base
    gst-plugins-good
+    gst-plugins-ugly
  ])
  ++ lib.optional withVlc vlc;

-  nativeBuildInputs = [ cmake pkgconfig qttools ];
+  nativeBuildInputs = [ cmake ninja pkgconfig qttools ];

  cmakeFlags = [
    "-DUSE_SYSTEM_TAGLIB=ON"
  ];

+  postInstall = ''
+    qtWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
+  '';
+
  meta = with lib; {
    description = "Music player and music collection organizer";
    license = licenses.gpl2;
--- a/pkgs/applications/editors/kdevelop5/kdev-php.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kdev-php";
-  version = "5.4.1";
+  version = "5.4.2";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "07j06k2f5rbwgknwcbj70wwn831a54is4kiwlpfd4la2c05slmy5";
+    sha256 = "1ilazq2y671wifcrh7pa0zf9yqymqxwj1m2kd389ik2p6wm68jx8";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules ];
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kdev-python";
-  version = "5.4.1";
+  version = "5.4.2";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1dazd77bkjs11h318q4ia6ijk0d0s04v0zm8lwqlgcj271sqrfqb";
+    sha256 = "1nnspa1mixdb5z0a8m4nbpsk6c4s81iwrirhrl7091hsw02bsx3f";
  };

  cmakeFlags = [
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -9,11 +9,11 @@

 mkDerivation rec {
  pname = "kdevelop";
-  version = "5.4.1";
+  version = "5.4.2";

  src = fetchurl {
    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "12iqgmhaxm9q085h50dzkswcmsp02jzm4jjgrhkx4jlzmf4w4jb8";
+    sha256 = "1i665m4jd1r5bl77pcfybpn9szxzccrajs4m0prqwhlj93d57qjj";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@ -31,13 +31,13 @@ let

 in buildPythonApplication rec {
  pname = "lutris-original";
-  version = "0.5.2.1";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "lutris";
    repo = "lutris";
    rev = "v${version}";
-    sha256 = "023yqnzmnkfpq21r6ky6jzwbjxjcw1a5zqrrdl6fwwlr78fdhgpv";
+    sha256 = "0n6xa3pnwvsvfipinrkbhxwjzfbw2cjpc9igv97nffcmpydmn5xv";
  };

  buildInputs = [
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -58,7 +58,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "1.27.2";
+  version = "1.27.2"; # Please backport all updates to the stable channel.
+  # All releases have a limited lifetime and "expire" 90 days after the release.
+  # When releases "expire" the application becomes unusable until an update is
+  # applied. The expiration date for the current release can be extracted with:
+  # $ grep -a "^{\"buildExpiration" "${signal-desktop}/libexec/resources/app.asar"
+  # (Alternatively we could try to patch the asar archive, but that requires a
+  # few additional steps and might not be the best idea.)

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@ -27,12 +27,12 @@ let
  in
    assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
    stdenv.mkDerivation rec {
-      version = "2.5";
+      version = "2.6";
      pname = "weechat";

      src = fetchurl {
        url = "https://weechat.org/files/src/weechat-${version}.tar.bz2";
-        sha256 = "14giv8j1phmpg3i9whx45nmskan501lwcq352ps9z52rkja2qxsc";
+        sha256 = "1narazk28m7lmn1vqi7bhyvnr8apjrmaa4w1hbadn64hwr8ya1hb";
      };

      outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;
--- a/pkgs/applications/version-management/git-and-tools/hub/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/hub/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  pname = "hub";
-  version = "2.12.3";
+  version = "2.12.4";

  goPackagePath = "github.com/github/hub";

@ -13,7 +13,7 @@ buildGoPackage rec {
    owner = "github";
    repo = pname;
    rev = "v${version}";
-    sha256 = "13l4nc3k6vl9x1x0153mwi351j3z266wx0fp7xw2851avrgkk9zg";
+    sha256 = "1d4cn4pgx520psrfac92h3m7azxnpj1plrrqmxryar85f3y363bq";
  };

  nativeBuildInputs = [ groff utillinux ];
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -8,13 +8,13 @@ with stdenv.lib;

 buildGoPackage rec {
  pname = "gitea";
-  version = "1.9.2";
+  version = "1.9.3";

  src = fetchFromGitHub {
    owner = "go-gitea";
    repo = "gitea";
    rev = "v${version}";
-    sha256 = "1i7h6scycwzil87fcx1a19w5pl0986g5ax7y030w0wgmrq3zj53a";
+    sha256 = "0g6ch85dq4vazxnr6g78wgqrnfa955395y1zws0a50h0wfxpdjis";
    # Required to generate the same checksum on MacOS due to unicode encoding differences
    # More information: https://github.com/NixOS/nixpkgs/pull/48128
    extraPostFetch = ''
@ -62,7 +62,7 @@ buildGoPackage rec {

  meta = {
    description = "Git with a cup of tea";
-    homepage = https://gitea.io;
+    homepage = "https://gitea.io";
    license = licenses.mit;
    maintainers = with maintainers; [ disassembler kolaente ];
  };
--- a/pkgs/applications/window-managers/i3/status.nix
+++ b/pkgs/applications/window-managers/i3/status.nix
@ -1,21 +1,25 @@
-{ fetchurl, stdenv, libconfuse, yajl, alsaLib, libpulseaudio, libnl, pkgconfig
-  }:
+{ fetchurl, stdenv, libconfuse, yajl, alsaLib, libpulseaudio, libnl, pkgconfig, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl }:

 stdenv.mkDerivation rec {
-  name = "i3status-2.12";
+  name = "i3status-2.13";

  src = fetchurl {
    url = "https://i3wm.org/i3status/${name}.tar.bz2";
-    sha256 = "06krpbijv4yi33nypg6qcn4hilcrdyarsdpd9fmr2cq46qaqiikg";
+    sha256 = "0rhlzb96mw64z2jnhwz9nibc7pxg549626lz5642xxk5hpzwk2ff";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
  buildInputs = [ libconfuse yajl alsaLib libpulseaudio libnl ];

  makeFlags = [ "all" "PREFIX=$(out)" ];

+  # This hack is needed because for unknown reasons configure generates a broken makefile on the 2.13 release under nixos
+  preBuild = ''
+    sed -i -e 's/\$(TEST_LOGS) \$(TEST_LOGS/\$(TEST_LOGS)/g' Makefile
+  '';
+
  meta = {
-    description = "A tiling window manager";
+    description = "Generates a status line for i3bar, dzen2, xmobar or lemonbar";
    homepage = https://i3wm.org;
    maintainers = [ ];
    license = stdenv.lib.licenses.bsd3;
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.16.4/ )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.16.5/ )
--- a/pkgs/desktops/plasma-5/srcs.nix
+++ b/pkgs/desktops/plasma-5/srcs.nix
@ -3,363 +3,363 @@

 {
  bluedevil = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/bluedevil-5.16.4.tar.xz";
-      sha256 = "36eaff3da49104fb4ca8de32c2cd42657af7cde94f54c95bacf5abd6c1d39521";
-      name = "bluedevil-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/bluedevil-5.16.5.tar.xz";
+      sha256 = "60ac3471d30cb113b1959eacdaa1f4898f04f779f94a35dbca00993cda4ea464";
+      name = "bluedevil-5.16.5.tar.xz";
    };
  };
  breeze = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-5.16.4.tar.xz";
-      sha256 = "84fea0c31a41521983698ad2aed603b5e2c6e4f6e8723e2c64c66c37eb2a5395";
-      name = "breeze-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-5.16.5.tar.xz";
+      sha256 = "09225021a2cf396e74cabe692b0a5dcf9a12f0b47f02fb14df6ccc9db01f2e6b";
+      name = "breeze-5.16.5.tar.xz";
    };
  };
  breeze-grub = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-grub-5.16.4.tar.xz";
-      sha256 = "c36b2183fff7d559ae944881443e0caa03c63bcc81af9f6b21b722109d2e34db";
-      name = "breeze-grub-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-grub-5.16.5.tar.xz";
+      sha256 = "ce73297350e7b79b04aa8ba44594e8eca2d37c0342eb331bd5d31679f3887878";
+      name = "breeze-grub-5.16.5.tar.xz";
    };
  };
  breeze-gtk = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-gtk-5.16.4.tar.xz";
-      sha256 = "8c954a8754bc75b2d8edff70a7b322c559da6e23dc75e1ed616ac926fbe186eb";
-      name = "breeze-gtk-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-gtk-5.16.5.tar.xz";
+      sha256 = "d9849ecf6c2fc85fde76912410ab36c46ca65b96d80b4e51819ca35015a88098";
+      name = "breeze-gtk-5.16.5.tar.xz";
    };
  };
  breeze-plymouth = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/breeze-plymouth-5.16.4.tar.xz";
-      sha256 = "7556c8f6bff771f3439036f843309b45594c5e903fc11a3275cc2c38346dec9f";
-      name = "breeze-plymouth-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/breeze-plymouth-5.16.5.tar.xz";
+      sha256 = "bb10d2f0185181e6f2fe8e3b85415dfcce6069595e0074b182688c6f567dd0b0";
+      name = "breeze-plymouth-5.16.5.tar.xz";
    };
  };
  discover = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/discover-5.16.4.tar.xz";
-      sha256 = "0e07a49d3ee93434452d69330b11653546a2104601ec08518be111ba7967f1b0";
-      name = "discover-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/discover-5.16.5.tar.xz";
+      sha256 = "26c47a5c0f59a31f37da85e894a926c76805b66f91dde8ba6d2de8015842d5c1";
+      name = "discover-5.16.5.tar.xz";
    };
  };
  drkonqi = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/drkonqi-5.16.4.tar.xz";
-      sha256 = "9d030a59a6d1d732241f8c54a54291ac60584d542ea0b891ca4b2bcb958bd51f";
-      name = "drkonqi-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/drkonqi-5.16.5.tar.xz";
+      sha256 = "b4ae1518108c2d3ccbc533708801b52b83b7e9efd6eed9f1ee9d67936b9e78ff";
+      name = "drkonqi-5.16.5.tar.xz";
    };
  };
  kactivitymanagerd = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kactivitymanagerd-5.16.4.tar.xz";
-      sha256 = "a287fc9624390c8493a35a5440e2161d1bb67252b6986231acb6268440bb4770";
-      name = "kactivitymanagerd-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kactivitymanagerd-5.16.5.tar.xz";
+      sha256 = "e35dbf7aae8a7b7f21b2304935cad96881af558a7c9d947f0114093038b1c4bc";
+      name = "kactivitymanagerd-5.16.5.tar.xz";
    };
  };
  kde-cli-tools = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kde-cli-tools-5.16.4.tar.xz";
-      sha256 = "56c7c2566217704a9d613757767c3b8ee8d1bc4601b9414a44acb50aaaaedc0d";
-      name = "kde-cli-tools-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kde-cli-tools-5.16.5.tar.xz";
+      sha256 = "bc82b159d3c9a23f0ecb47a8314b645041b01692887a3be0ef0582d54f926de2";
+      name = "kde-cli-tools-5.16.5.tar.xz";
    };
  };
  kdecoration = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kdecoration-5.16.4.tar.xz";
-      sha256 = "aa77507dcf357243cca9002764f8c8d1c8404d7e5b7249ad0d0f900f0a47ace4";
-      name = "kdecoration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kdecoration-5.16.5.tar.xz";
+      sha256 = "2b8c7b7cf114d0eff4ec842009cda264d8cf1254ec4bf65868b6d26f263829bb";
+      name = "kdecoration-5.16.5.tar.xz";
    };
  };
  kde-gtk-config = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kde-gtk-config-5.16.4.tar.xz";
-      sha256 = "c271b1caebac0837483af7ae11d2e4786a7770ff85753f1a3da4c8d28681111c";
-      name = "kde-gtk-config-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kde-gtk-config-5.16.5.tar.xz";
+      sha256 = "f78abf129aaa7afac2c7a71105b36b9553a975bbcb89ec65a0166099d1cca8c1";
+      name = "kde-gtk-config-5.16.5.tar.xz";
    };
  };
  kdeplasma-addons = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kdeplasma-addons-5.16.4.tar.xz";
-      sha256 = "4c0884dcb8413fa836d7e390b1c12fc71127c0e5e6fa278a338c253d1539f4a1";
-      name = "kdeplasma-addons-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kdeplasma-addons-5.16.5.tar.xz";
+      sha256 = "a4737a54b75143053a9f8a5bc28c608f843c524872c665d4e5a65bd2853e1e00";
+      name = "kdeplasma-addons-5.16.5.tar.xz";
    };
  };
  kgamma5 = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kgamma5-5.16.4.tar.xz";
-      sha256 = "18c01c6a9d73f2450da24ac7a52c00b9d355a1ba41bd346eb71fbe271de85f46";
-      name = "kgamma5-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kgamma5-5.16.5.tar.xz";
+      sha256 = "838fabf4312f022ee3df5bba940c0c73e26260cfee39235c1ba8da8a2e61bfa0";
+      name = "kgamma5-5.16.5.tar.xz";
    };
  };
  khotkeys = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/khotkeys-5.16.4.tar.xz";
-      sha256 = "a8646ab20cd067a515d4a9318c814760be0030f27856f155edf11920caeddd0d";
-      name = "khotkeys-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/khotkeys-5.16.5.tar.xz";
+      sha256 = "e7b866b5249ff7c5860a5a222dca79691ca1f09af176f786021fbbadbd718c8c";
+      name = "khotkeys-5.16.5.tar.xz";
    };
  };
  kinfocenter = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kinfocenter-5.16.4.tar.xz";
-      sha256 = "30e4df2d641c4faa385a718c772d893900eca99591ffee5787d6563fe5130426";
-      name = "kinfocenter-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kinfocenter-5.16.5.tar.xz";
+      sha256 = "e3bbc5e2baedf35dc8750c99e18c115b651f2665218a105c08177bc5250eb9b1";
+      name = "kinfocenter-5.16.5.tar.xz";
    };
  };
  kmenuedit = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kmenuedit-5.16.4.tar.xz";
-      sha256 = "f749ca062d9c7bfd2033c4016e8a3dcc9f849f83f941dd9a60fd5b0232d023a2";
-      name = "kmenuedit-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kmenuedit-5.16.5.tar.xz";
+      sha256 = "8e95b81b910e5e78689fc7d4427c813ba7d39426df24cf8606adb850913a19a4";
+      name = "kmenuedit-5.16.5.tar.xz";
    };
  };
  kscreen = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kscreen-5.16.4.tar.xz";
-      sha256 = "40c29ad2236459a267eed3cad4a6fc64b5e3f12df8567fcf8869ba770c2e2328";
-      name = "kscreen-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kscreen-5.16.5.tar.xz";
+      sha256 = "ce35f554014cee819767180f0c9381d539e497edfb9c290b279fa78e9dea4bb0";
+      name = "kscreen-5.16.5.tar.xz";
    };
  };
  kscreenlocker = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kscreenlocker-5.16.4.tar.xz";
-      sha256 = "92a858f1f4bd6f209f328ca6456dfadc6b542e2a1e3d04ecdcc70f70c1cc2f6f";
-      name = "kscreenlocker-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kscreenlocker-5.16.5.tar.xz";
+      sha256 = "5ed6fdeac9aaba014edf67c5f782fc210d58310d083afaa589d0ff1bb3e8e02d";
+      name = "kscreenlocker-5.16.5.tar.xz";
    };
  };
  ksshaskpass = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/ksshaskpass-5.16.4.tar.xz";
-      sha256 = "e3ff91e5c160b8e83b48215fca5d70f4baeef95b6c3b32e8cfc749183b0ec97c";
-      name = "ksshaskpass-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/ksshaskpass-5.16.5.tar.xz";
+      sha256 = "78eaa38ebbf888a8905e9385173e7161335041d6d07720283ce6f3fa06426a33";
+      name = "ksshaskpass-5.16.5.tar.xz";
    };
  };
  ksysguard = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/ksysguard-5.16.4.tar.xz";
-      sha256 = "10abf3bfa676275b6fded5e49979466a011e0552b9357c1b8923f01184c029d5";
-      name = "ksysguard-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/ksysguard-5.16.5.tar.xz";
+      sha256 = "5558977389cb1fac4a5ce52c9430b27d9d1ee92705ae1995d92bed5340477282";
+      name = "ksysguard-5.16.5.tar.xz";
    };
  };
  kwallet-pam = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwallet-pam-5.16.4.tar.xz";
-      sha256 = "7332dd9729c55f4b24260b3ec1266f72284f834eed66ce76badd4ac5af3dd429";
-      name = "kwallet-pam-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwallet-pam-5.16.5.tar.xz";
+      sha256 = "4a12a8ed51973f9ea318a39a699523bcc99ae4e1cac932fccd19dedd45e758a8";
+      name = "kwallet-pam-5.16.5.tar.xz";
    };
  };
  kwayland-integration = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwayland-integration-5.16.4.tar.xz";
-      sha256 = "f15ae33af1d9ff999ec45d00752f202242f71fc022ae72b9522e5bf3a20edace";
-      name = "kwayland-integration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwayland-integration-5.16.5.tar.xz";
+      sha256 = "63724ecfb6db053ee949273979b393192309dbeed45b59bc193a605f90232282";
+      name = "kwayland-integration-5.16.5.tar.xz";
    };
  };
  kwin = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwin-5.16.4.tar.xz";
-      sha256 = "71b96f1efef0b3f4974900373285a08d425a63628404fe9e89c27f61119383e6";
-      name = "kwin-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwin-5.16.5.tar.xz";
+      sha256 = "7ff0e114e323ff7e10d78a157f8242b1d3cfa03967898d9e3fd3c039b7c9918b";
+      name = "kwin-5.16.5.tar.xz";
    };
  };
  kwrited = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/kwrited-5.16.4.tar.xz";
-      sha256 = "c3011ee1c7a431b25797e12fa0b16e6d92277c8fe5dc1e656121a135ad156c0f";
-      name = "kwrited-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/kwrited-5.16.5.tar.xz";
+      sha256 = "4b122099b0a362fc409b50b7523689ba8a112508dad26f58753c6b648e7c5313";
+      name = "kwrited-5.16.5.tar.xz";
    };
  };
  libkscreen = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/libkscreen-5.16.4.tar.xz";
-      sha256 = "f20f33a2f32b3db39e94ca9d10e240591650357d03c1a2f8eb6c5faa4d1bf723";
-      name = "libkscreen-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/libkscreen-5.16.5.tar.xz";
+      sha256 = "fd2d1e849315ac745ecfe757d6b2c5cc6486e0be5397f686dae3916c0252c938";
+      name = "libkscreen-5.16.5.tar.xz";
    };
  };
  libksysguard = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/libksysguard-5.16.4.tar.xz";
-      sha256 = "b9a8166bf808a54dd80eb8f760047c63989f1f10a9a7f649c8298c9a5031368f";
-      name = "libksysguard-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/libksysguard-5.16.5.tar.xz";
+      sha256 = "f09b99737a937df890ecdd2a33720b6cba3c79fc8bc17ef1470572748a6e1976";
+      name = "libksysguard-5.16.5.tar.xz";
    };
  };
  milou = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/milou-5.16.4.tar.xz";
-      sha256 = "de9addbc504135839b1735742938d340cb191827606aa390f4b6ce1625c1ed89";
-      name = "milou-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/milou-5.16.5.tar.xz";
+      sha256 = "bfcdba29262dda9f386ee99132053ad5751194b2df8219899fcbb0b3699afcd5";
+      name = "milou-5.16.5.tar.xz";
    };
  };
  oxygen = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/oxygen-5.16.4.tar.xz";
-      sha256 = "7ba8a18a0b44d2bf48c96679328f698a9bfd4d041724b960095fed67f228f2e1";
-      name = "oxygen-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/oxygen-5.16.5.tar.xz";
+      sha256 = "0e85dcd874d2e69aaa2d4eefc379289c7dd572437f53e42f1d6d260d97c2f8a2";
+      name = "oxygen-5.16.5.tar.xz";
    };
  };
  plasma-browser-integration = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-browser-integration-5.16.4.tar.xz";
-      sha256 = "a097b90dd47cdd01f6b7207cb9439c7f6e0ce68555272172f8b3b8e2086199ef";
-      name = "plasma-browser-integration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-browser-integration-5.16.5.tar.xz";
+      sha256 = "99269c7e27fddb0c075bff28a5afba41298dc8d28297d69f35f6bc30f3af1d35";
+      name = "plasma-browser-integration-5.16.5.tar.xz";
    };
  };
  plasma-desktop = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-desktop-5.16.4.tar.xz";
-      sha256 = "990e93eed2753053ac732ce5d1d45e7c9a52daa660b41b0d48955428e4834344";
-      name = "plasma-desktop-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-desktop-5.16.5.tar.xz";
+      sha256 = "49dc4c9eff5742eb52fc0d12c139c194eda837945389cd09f498a0c4c352a20f";
+      name = "plasma-desktop-5.16.5.tar.xz";
    };
  };
  plasma-integration = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-integration-5.16.4.tar.xz";
-      sha256 = "d4c5022ea91f9727cfebab821cb6b8e7b52671a6508cd7450e05bf51e248452d";
-      name = "plasma-integration-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-integration-5.16.5.tar.xz";
+      sha256 = "635f109e7b59bb440c6be0c7a4baae70d2f44e659ab0522e170693b664e6d709";
+      name = "plasma-integration-5.16.5.tar.xz";
    };
  };
  plasma-nm = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-nm-5.16.4.tar.xz";
-      sha256 = "2da834873d4fa471ad87ee8ce18a871dfb2acdf0bdc0b764789e8e26ebc2ca09";
-      name = "plasma-nm-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-nm-5.16.5.tar.xz";
+      sha256 = "b519429bd784ff2ede0bf10e1e943822ef08ea5cf85e901363fda36d32907460";
+      name = "plasma-nm-5.16.5.tar.xz";
    };
  };
  plasma-pa = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-pa-5.16.4.tar.xz";
-      sha256 = "9b166e11f7115576181c17f0ced51b9a7ec689334d4b15ebb55d4e6e7ff6cbd4";
-      name = "plasma-pa-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-pa-5.16.5.tar.xz";
+      sha256 = "e029563d50cc6266a4a3e22574c33fef4670e1aaab18630eb30769e2167acc96";
+      name = "plasma-pa-5.16.5.tar.xz";
    };
  };
  plasma-sdk = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-sdk-5.16.4.tar.xz";
-      sha256 = "ce8152ad6044e2cf430834bf97bb4542e69e168a4b7350e313d148a9bd3b9403";
-      name = "plasma-sdk-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-sdk-5.16.5.tar.xz";
+      sha256 = "1b05f0501309099f241ebae857c24b31bc4e61fde8bfc33e854d3a1dd3d37385";
+      name = "plasma-sdk-5.16.5.tar.xz";
    };
  };
  plasma-tests = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-tests-5.16.4.tar.xz";
-      sha256 = "9e0f8fcef080fc1b0ffae01f6b3caa17eccac27445e312243221fcace56d1097";
-      name = "plasma-tests-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-tests-5.16.5.tar.xz";
+      sha256 = "236a83c2caa99801b6db1debce53a6c7390087115899410a8139ad3b7268b7f7";
+      name = "plasma-tests-5.16.5.tar.xz";
    };
  };
  plasma-vault = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-vault-5.16.4.tar.xz";
-      sha256 = "8d01b80079477fd7ea48a4cc3ff59728ae7dac3a5f6e552092dd5e67d72148f6";
-      name = "plasma-vault-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-vault-5.16.5.tar.xz";
+      sha256 = "2bb40a80c35f3eaedc729013a8b6b76641cc74eca4fd171f1cda99237f83198c";
+      name = "plasma-vault-5.16.5.tar.xz";
    };
  };
  plasma-workspace = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-workspace-5.16.4.tar.xz";
-      sha256 = "5cd9366ef3d0b68159d9dee2f14886d1f81d1ccf7aedceed1ae5cf8e32d243f1";
-      name = "plasma-workspace-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-workspace-5.16.5.tar.xz";
+      sha256 = "43364fe4e7ea10ad7b5b1d7af4f1baa1d8796b60692f2dfc0d58693f63e458ff";
+      name = "plasma-workspace-5.16.5.tar.xz";
    };
  };
  plasma-workspace-wallpapers = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plasma-workspace-wallpapers-5.16.4.tar.xz";
-      sha256 = "052f6d978b1230706821f67574a7d053fadfb25de65227ffc8389a8570ac6003";
-      name = "plasma-workspace-wallpapers-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plasma-workspace-wallpapers-5.16.5.tar.xz";
+      sha256 = "ff6e0eac42c540c72556439e6477fb78be2dab456386218813cce021f82d42d9";
+      name = "plasma-workspace-wallpapers-5.16.5.tar.xz";
    };
  };
  plymouth-kcm = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/plymouth-kcm-5.16.4.tar.xz";
-      sha256 = "cf9d3e6f14d012617cc8a5c3381295449e68b1b13209436b561417232d21863f";
-      name = "plymouth-kcm-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/plymouth-kcm-5.16.5.tar.xz";
+      sha256 = "db839c5fe9f6df882b95f436983c129cd553dd50e6cf1065c4410a91b20f1dcc";
+      name = "plymouth-kcm-5.16.5.tar.xz";
    };
  };
  polkit-kde-agent = {
-    version = "1-5.16.4";
+    version = "1-5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/polkit-kde-agent-1-5.16.4.tar.xz";
-      sha256 = "917b31f194fcf5d56d465bd4a3a1cc8d0a30e302be63b9048b1b85b6746b46a0";
-      name = "polkit-kde-agent-1-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/polkit-kde-agent-1-5.16.5.tar.xz";
+      sha256 = "6f7a17990d72bb25c93acae919b764f95ac226754209b2e177075fbe9251f95f";
+      name = "polkit-kde-agent-1-5.16.5.tar.xz";
    };
  };
  powerdevil = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/powerdevil-5.16.4.tar.xz";
-      sha256 = "40885869890366f7ea92946ed0f8d251546fb14228eddd2ad128e3be8f88d2ed";
-      name = "powerdevil-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/powerdevil-5.16.5.tar.xz";
+      sha256 = "ac868f31df8c6bcc6b1c850efa0640695ba698caabefcb21fc0b0c3405712139";
+      name = "powerdevil-5.16.5.tar.xz";
    };
  };
  sddm-kcm = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/sddm-kcm-5.16.4.tar.xz";
-      sha256 = "340034c5475d751c19c96a75445fa50877fad1c4de3422bc02f4b95e8f14bd68";
-      name = "sddm-kcm-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/sddm-kcm-5.16.5.tar.xz";
+      sha256 = "4220d18f1a04c767649bffee1aed6c2b2c12c60cd7d6ca6fabc3dbec1ec3f127";
+      name = "sddm-kcm-5.16.5.tar.xz";
    };
  };
  systemsettings = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/systemsettings-5.16.4.tar.xz";
-      sha256 = "73b78c3c5177aa3ba0ffe970a83cb8bea1ba8ac54420a6c8379d6e86cabda31e";
-      name = "systemsettings-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/systemsettings-5.16.5.tar.xz";
+      sha256 = "57944cf3f566cf5e25d5859f5716b2ad5dbd87de259f8d77efdfdd50a16fe1ec";
+      name = "systemsettings-5.16.5.tar.xz";
    };
  };
  user-manager = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/user-manager-5.16.4.tar.xz";
-      sha256 = "3dd29a6abf8c15014ed87a448b13190516e16d8dc3a67d56f05f62d1f2e1b745";
-      name = "user-manager-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/user-manager-5.16.5.tar.xz";
+      sha256 = "e9df3ec2718de68b0b46d0b86f993fe450b236e13dda6219f350121f08f4c468";
+      name = "user-manager-5.16.5.tar.xz";
    };
  };
  xdg-desktop-portal-kde = {
-    version = "5.16.4";
+    version = "5.16.5";
    src = fetchurl {
-      url = "${mirror}/stable/plasma/5.16.4/xdg-desktop-portal-kde-5.16.4.tar.xz";
-      sha256 = "3b8aa78451cfc97ef316f1632f6a255ccebbe383ec8389ffc74d44540fc05052";
-      name = "xdg-desktop-portal-kde-5.16.4.tar.xz";
+      url = "${mirror}/stable/plasma/5.16.5/xdg-desktop-portal-kde-5.16.5.tar.xz";
+      sha256 = "4884652b642fb6e8db791a04e9d42b5fec53f28cc0f0d26f49eb2bdaaa1709df";
+      name = "xdg-desktop-portal-kde-5.16.5.tar.xz";
    };
  };
 }
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -77,13 +77,6 @@ self: super: {
    hinotify = if pkgs.stdenv.isLinux then self.hinotify else self.fsnotify;
  };

-  # compatibility with servant-0.16.2. Remove with the next release
-  cachix = appendPatch super.cachix (pkgs.fetchpatch {
-    url = "https://github.com/cachix/cachix/commit/051679a99cd56e2497c0f05310035b6649129a13.patch";
-    sha256 = "198n5byp9mfiymgzpvyd42l6vqy6hfy9kdi7svfx7mcwsy7sg7kp";
-    stripLen = 1;
-  });
-
  # Fix test trying to access /home directory
  shell-conduit = overrideCabal super.shell-conduit (drv: {
    postPatch = "sed -i s/home/tmp/ test/Spec.hs";
@ -1226,4 +1219,13 @@ self: super: {
  # https://github.com/elliottt/hsopenid/issues/15
  openid = markBroken super.openid;

+  # The test suite needs the packages's executables in $PATH to succeed.
+  arbtt = overrideCabal super.arbtt (drv: {
+    preCheck = ''
+      for i in $PWD/dist/build/*; do
+        export PATH="$i:$PATH"
+      done
+    '';
+  });
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -3097,7 +3097,6 @@ broken-packages:
  - arbor-monad-metric
  - arbor-monad-metric-datadog
  - arbor-postgres
-  - arbtt
  - archiver
  - archlinux
  - archlinux-web
@ -3598,7 +3597,6 @@ broken-packages:
  - cabin
  - cabocha
  - cached
-  - cachix
  - cacophony
  - caffegraph
  - cairo-core
@ -5935,8 +5933,6 @@ broken-packages:
  - hmt-diagrams
  - hmumps
  - hnetcdf
-  - hnix
-  - hnix-store-remote
  - HNM
  - hnormalise
  - ho-rewriting
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -254,8 +254,8 @@ let

 in {
  php72 = generic {
-    version = "7.2.21";
-    sha256 = "1vqldc2namfblwyv87fgpfffkjpzawfpcp48f40nfdl3pshq6c9l";
+    version = "7.2.22";
+    sha256 = "12phn0rrd5r1j6xlz83h7v6gszmj4lb5gwj927psbbc6nn1rh2n1";

    # https://bugs.php.net/bug.php?id=76826
    extraPatches = optional stdenv.isDarwin ./php72-darwin-isfinite.patch;
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -1,5 +1,5 @@
 { stdenv, buildPackages, lib
-, fetchurl, fetchFromSavannah, fetchFromGitHub
+, fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
 , zlib, openssl, gdbm, ncurses, readline, groff, libyaml, libffi, autoreconfHook, bison
 , autoconf, libiconv, libobjc, libunwind, Foundation
 , buildEnv, bundler, bundix
@ -34,7 +34,7 @@ let
    };
    self = lib.makeOverridable (
      { stdenv, buildPackages, lib
-      , fetchurl, fetchFromSavannah, fetchFromGitHub
+      , fetchurl, fetchpatch, fetchFromSavannah, fetchFromGitHub
      , useRailsExpress ? true
      , rubygemsSupport ? true
      , zlib, zlibSupport ? true
@ -90,7 +90,7 @@ let

        patches =
          (import ./patchsets.nix {
-            inherit patchSet useRailsExpress ops;
+            inherit patchSet useRailsExpress ops fetchpatch;
            patchLevel = ver.patchLevel;
          }).${ver.majMinTiny};

@ -211,14 +211,6 @@ let
    ) args; in self;

 in {
-  ruby_2_3 = generic {
-    version = rubyVersion "2" "3" "8" "";
-    sha256 = {
-      src = "1gwsqmrhpx1wanrfvrsj3j76rv888zh7jag2si2r14qf8ihns0dm";
-      git = "0158fg1sx6l6applbq0831kl8kzx5jacfl9lfg0shfzicmjlys3f";
-    };
-  };
-
  ruby_2_4 = generic {
    version = rubyVersion "2" "4" "7" "";
    sha256 = {
--- a/pkgs/development/interpreters/ruby/patchsets.nix
+++ b/pkgs/development/interpreters/ruby/patchsets.nix
@ -1,4 +1,4 @@
-{ patchSet, useRailsExpress, ops, patchLevel }:
+{ patchSet, useRailsExpress, ops, patchLevel, fetchpatch }:

 {
  "2.3.8" = ops useRailsExpress [
@ -16,7 +16,12 @@
    "${patchSet}/patches/ruby/2.5/head/railsexpress/02-improve-gc-stats.patch"
    "${patchSet}/patches/ruby/2.5/head/railsexpress/03-more-detailed-stacktrace.patch"
  ];
-  "2.6.4" = ops useRailsExpress [
+  "2.6.4" = [
+    (fetchpatch {
+      url = "https://git.ruby-lang.org/ruby.git/patch/?id=ade1283ca276f7d589ffd3539fbc7b9817f682d5";
+      sha256 = "1vgrckmzz0ykyxgzyp8fcifa93xz2hvyfil79bw1gc3xx94wnnxd";
+    })
+  ] ++ ops useRailsExpress [
    "${patchSet}/patches/ruby/2.6/head/railsexpress/01-fix-broken-tests-caused-by-ad.patch"
    "${patchSet}/patches/ruby/2.6/head/railsexpress/02-improve-gc-stats.patch"
    "${patchSet}/patches/ruby/2.6/head/railsexpress/03-more-detailed-stacktrace.patch"
--- a/pkgs/development/libraries/libgap/default.nix
+++ b/pkgs/development/libraries/libgap/default.nix
@ -1,25 +0,0 @@
-{ stdenv
-, fetchurl
-, gmp
-}:
-# will probably be obsolte (or at leat built from the upstream gap sources) soon (gap 4.9?). See
-# - https://github.com/gap-system/gap/projects/5#card-6239828
-# - https://github.com/markuspf/gap/issues/2
-# - https://trac.sagemath.org/ticket/22626
-stdenv.mkDerivation rec {
-  pname = "libgap";
-  # Has to be the same version as "gap"
-  version = "4.8.6";
-  src = fetchurl {
-    url = "mirror://sageupstream/libgap/libgap-${version}.tar.gz";
-    sha256 = "1h5fx5a55857w583ql7ly2jl49qyx9mvs7j5abys00ra9gzrpn5v";
-  };
-  buildInputs = [gmp];
-  meta = {
-    inherit version;
-    description = ''A library-packaged fork of the GAP kernel'';
-    license = stdenv.lib.licenses.gpl3Plus;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@ -91,6 +91,12 @@ stdenv.mkDerivation rec {
      #})
      ./qt4-gcc6.patch
      ./qt4-openssl-1.1.patch
+      (fetchpatch {
+        name = "qt4-gcc8.diff";
+        url = "https://aur.archlinux.org/cgit/aur.git/plain/qt4-gcc8.patch?h=qt4&id=3ac369b8";
+        sha256 = "0zcdrlmanczr9cbrnc6f3nz6ldmj7rw5irlvndk89fl6fvj8zkwy";
+        extraPrefix = "./";
+      })
    ]
    ++ lib.optional gtkStyle (substituteAll ({
        src = ./dlopen-gtkstyle.diff;
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -1106,6 +1106,26 @@ luasystem = buildLuarocksPackage {
    };
  };
 };
+luautf8 = buildLuarocksPackage {
+  pname = "luautf8";
+  version = "0.1.1-1";
+
+  src = fetchurl {
+    url    = https://luarocks.org/luautf8-0.1.1-1.src.rock;
+    sha256 = "1832ilrlddh4h7ayx4l9j7z1p8c2hk5yr96cpxjjrmirkld23aji";
+  };
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://github.com/starwing/luautf8";
+    description = "A UTF-8 support module for Lua";
+    maintainers = with maintainers; [ pstn ];
+    license = {
+      fullName = "MIT";
+    };
+  };
+};
 luazip = buildLuarocksPackage {
  pname = "luazip";
  version = "1.2.7-1";
@ -1125,6 +1145,26 @@ luazip = buildLuarocksPackage {
    };
  };
 };
+lua-yajl = buildLuarocksPackage {
+  pname = "lua-yajl";
+  version = "2.0-1";
+
+  src = fetchurl {
+    url    = https://luarocks.org/lua-yajl-2.0-1.src.rock;
+    sha256 = "0bsm519vs53rchcdf8g96ygzdx2bz6pa4vffqlvc7ap49bg5np4f";
+  };
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://github.com/brimworks/lua-yajl";
+    description = "Integrate the yajl JSON library with Lua.";
+    maintainers = with maintainers; [ pstn ];
+    license = {
+      fullName = "MIT/X11";
+    };
+  };
+};
 luuid = buildLuarocksPackage {
  pname = "luuid";
  version = "20120509-2";
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -235,6 +235,12 @@ with super;
    ];
  });

+  lua-yajl = super.lua-yajl.override({
+    buildInputs = [
+      pkgs.yajl
+    ];
+  });
+
  luuid = super.luuid.override(old: {
    externalDeps = [
      { name = "LIBUUID"; dep = pkgs.libuuid; }
--- a/pkgs/development/perl-modules/mhonarc.patch
+++ b/pkgs/development/perl-modules/mhonarc.patch
@ -0,0 +1,26 @@
+diff --git a/lib/mhamain.pl b/lib/mhamain.pl
+index 80980a2..c1259ce 100644
+--- a/lib/mhamain.pl
+++ b/lib/mhamain.pl
+@@ -1562,7 +1562,7 @@ sub signal_catch {
+ ##
+ sub defineIndex2MsgId {
+     no warnings qw(deprecated);
+-    if (!defined(%Index2MsgId)) {
+    unless (%Index2MsgId) {
+ 	foreach (keys %MsgId) {
+ 	    $Index2MsgId{$MsgId{$_}} = $_;
+ 	}
+diff --git a/lib/mhopt.pl b/lib/mhopt.pl
+index 02fb05e..939109b 100644
+--- a/lib/mhopt.pl
+++ b/lib/mhopt.pl
+@@ -865,7 +865,7 @@ sub update_data_1_to_2 {
+ sub update_data_2_1_to_later {
+     no warnings qw(deprecated);
+     # we can preserve filter arguments
+-    if (defined(%main::MIMEFiltersArgs)) {
+    if (%main::MIMEFiltersArgs) {
+ 	warn qq/         preserving MIMEARGS...\n/;
+ 	%readmail::MIMEFiltersArgs = %main::MIMEFiltersArgs;
+ 	$IsDefault{'MIMEARGS'} = 0;
--- a/pkgs/development/python-modules/colorcet/default.nix
+++ b/pkgs/development/python-modules/colorcet/default.nix
@ -34,9 +34,9 @@ buildPythonPackage rec {
    export HOME=$(mktemp -d)
    mkdir -p $HOME/.config/matplotlib
    echo "backend: ps" > $HOME/.config/matplotlib/matplotlibrc
+    ln -s $HOME/.config/matplotlib $HOME/.matplotlib

-    # disable matplotlib tests on darwin, because it requires a framework build of Python
-    pytest ${stdenv.lib.optionalString stdenv.isDarwin "--ignore=colorcet/tests/test_matplotlib.py"} colorcet
+    pytest colorcet
  '';

  meta = with stdenv.lib; {
--- a/pkgs/development/python-modules/django/1_11.nix
+++ b/pkgs/development/python-modules/django/1_11.nix
@ -5,11 +5,11 @@

 buildPythonPackage rec {
  pname = "Django";
-  version = "1.11.23";
+  version = "1.11.24";

  src = fetchurl {
    url = "https://www.djangoproject.com/m/releases/1.11/${pname}-${version}.tar.gz";
-    sha256 = "1qb9npkpvyafd1f4yjqyzhj78wp1ifg3awj41bd04v83idznv9jj";
+    sha256 = "1qw97zcsnbnn9dqad1kps48vfaifdkvqb8c3vld6nnvp7x2jfp11";
  };

  patches = stdenv.lib.optionals withGdal [
--- a/pkgs/development/python-modules/elasticsearch-curator/default.nix
+++ b/pkgs/development/python-modules/elasticsearch-curator/default.nix
@ -45,6 +45,10 @@ buildPythonPackage rec {
    funcsigs
  ];

+  postPatch = ''
+    sed -i s/pyyaml==3.12/pyyaml==${pyyaml.version}/ setup.cfg setup.py
+  '';
+
  meta = with stdenv.lib; {
    homepage = https://github.com/elastic/curator;
    description = "Curate, or manage, your Elasticsearch indices and snapshots";
--- a/pkgs/development/python-modules/httpretty/default.nix
+++ b/pkgs/development/python-modules/httpretty/default.nix
@ -36,6 +36,7 @@ buildPythonPackage rec {
  NOSE_EXCLUDE = stdenv.lib.concatStringsSep "," [
    "tests.functional.test_httplib2.test_callback_response"
    "tests.functional.test_requests.test_streaming_responses"
+    "tests.functional.test_httplib2.test_callback_response"
  ];

  meta = with stdenv.lib; {
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@ -33,6 +33,8 @@ buildPythonPackage rec {
    })
  ];

+  dontUseCmakeConfigure = true;
+
  checkInputs = [ pytest cmake ]
    ++ (lib.optional (numpy != null) numpy)
    ++ (lib.optional (eigen != null) eigen)
--- a/pkgs/development/python-modules/pytest-mpl/default.nix
+++ b/pkgs/development/python-modules/pytest-mpl/default.nix
@ -26,13 +26,11 @@ buildPythonPackage rec {
    pytest
  ];

-  # disable tests on darwin, because it requires a framework build of Python
-  doCheck = !stdenv.isDarwin;
-
  checkPhase = ''
    export HOME=$(mktemp -d)
    mkdir -p $HOME/.config/matplotlib
    echo "backend: ps" > $HOME/.config/matplotlib/matplotlibrc
+    ln -s $HOME/.config/matplotlib $HOME/.matplotlib

    pytest
  '';
--- a/pkgs/development/python-modules/rfc6555/default.nix
+++ b/pkgs/development/python-modules/rfc6555/default.nix
@ -0,0 +1,28 @@
+{ stdenv, buildPythonPackage, fetchPypi, pythonPackages }:
+
+buildPythonPackage rec {
+  pname = "rfc6555";
+  version = "0.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "05sjrd6jc0sdvx0z7d3llk82rx366jlmc7ijam0nalsv66hbn70r";
+  };
+
+  propagatedBuildInputs = with pythonPackages; [ selectors2 ];
+
+  checkInputs = with pythonPackages; [ mock pytest ];
+  # disabling tests that require a functional DNS IPv{4,6} stack to pass.
+  patches = [ ./disable_network_tests.patch ];
+  # default doCheck = true; is not enough, apparently
+  postCheck = ''
+    py.test tests/
+  '';
+
+  meta = {
+    description = "Python implementation of the Happy Eyeballs Algorithm";
+    homepage = "https://pypi.org/project/rfc6555";
+    license = stdenv.lib.licenses.asl20;
+    maintainers = with stdenv.lib.maintainers; [ endocrimes ];
+  };
+}
--- a/pkgs/development/python-modules/rfc6555/disable_network_tests.patch
+++ b/pkgs/development/python-modules/rfc6555/disable_network_tests.patch
@ -0,0 +1,31 @@
+diff --git a/tests/test_create_connection.py b/tests/test_create_connection.py
+index fe38026..cdb26b4 100644
+--- a/tests/test_create_connection.py
+++ b/tests/test_create_connection.py
+@@ -6,10 +6,12 @@ from .test_utils import requires_network
+ 
+ 
+ class _BasicCreateConnectionTests(object):
+
+     @requires_network
+     def test_create_connection_google(self):
+         sock = rfc6555.create_connection(('www.google.com', 80))
+ 
+    @requires_network
+     @pytest.mark.parametrize('timeout', [None, 5.0])
+     def test_create_connection_has_proper_timeout(self, timeout):
+         sock = rfc6555.create_connection(('www.google.com', 80), timeout=timeout)
+diff --git a/tests/test_ipv6.py b/tests/test_ipv6.py
+index 3ee8564..f0db28e 100644
+--- a/tests/test_ipv6.py
+++ b/tests/test_ipv6.py
+@@ -2,7 +2,9 @@ import socket
+ import mock
+ import rfc6555
+ 
+from .test_utils import requires_network
+ 
+@requires_network
+ def test_ipv6_available():
+     assert rfc6555._detect_ipv6()
+ 
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@ -22,6 +22,7 @@
 , requests
 , sphinxcontrib-websupport
 , typing
+, setuptools
 }:

 buildPythonPackage rec {
@ -46,6 +47,7 @@ buildPythonPackage rec {
    pygments
    alabaster
    Babel
+    setuptools
    snowballstemmer
    six
    sqlalchemy
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "tflint";
-  version = "0.10.3";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "wata727";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1p4w1ddgb4nqibbrvix0p0gdlj6ann5lkyvlcsbkn25z8ha3qa39";
+    sha256 = "0aff7ckl245cyjs2rbgczkqlp2x6g4g458p4li0k1agk3m9bbq35";
  };

-  modSha256 = "1snanz4cpqkfgxp8k52w3x4i49k6d5jffcffrcx8xya8yvx2wxy3";
+  modSha256 = "1facqppgpmmz2j7j77fa3mnjv2nzjxz4ya6xvyvyy92ma0ybclgh";

  subPackages = [ "." ];

--- a/pkgs/development/tools/misc/kibana/6.x.nix
+++ b/pkgs/development/tools/misc/kibana/6.x.nix
@ -18,12 +18,12 @@ let
  shas =
    if enableUnfree
    then {
-      x86_64-linux  = "1i3zmzxihplwd8n994lfxhhgygdg3qxjqgrj1difa8w3vss0zbfn";
-      x86_64-darwin = "09a96ms9id77infxd9xxfs6r7j01mn0rz5yw3g9sl92j9ri7r52c";
+      "x86_64-linux"  = "1xwklhqxk5rmdrgy2simwvijzq29kyq5w2w3hy53xh2i1zlnyvq3";
+      "x86_64-darwin" = "1qpdn28mrpggd55khzqqld6r89l0hb870rigxcw2i8p2yx3jv106";
    }
    else {
-      x86_64-linux  = "166rhxr0qlv1yarj2mg1c3b8mxvhl70jhz53azq7ic6laj55q7fk";
-      x86_64-darwin = "0ngngkbl036p2mzwhp8qafi3aqzk398a218w12srfqny5n630vdk";
+      "x86_64-linux"  = "1wpnwal2rq5v2bsp5qil9j6dplif7ql5394sy4ia5ghp2fzifxmf";
+      "x86_64-darwin" = "12z8i0wbw10c097glbpdy350p0h3957433f51qfx2p0ghgkzkhzv";
    };

 in stdenv.mkDerivation rec {
--- a/pkgs/development/tools/misc/kibana/7.x.nix
+++ b/pkgs/development/tools/misc/kibana/7.x.nix
@ -18,12 +18,12 @@ let
  shas =
    if enableUnfree
    then {
-      x86_64-linux  = "1mzycd0ljnkslz9p9jhq279bkpk35r7svhngxjnmsh11ampsvxb8";
-      x86_64-darwin = "1bz409njdpmsagh5dg062114wpa96w7pmxwfjsizwksqyyjdwdv7";
+      "x86_64-linux"  = "0sc5709k3z7lb8qcjpj49s6vfv69ds2wc8319ag9x776nyz1pqxi";
+      "x86_64-darwin" = "0zh4q46vfdwaihs838ck8fap92i3b4x10wbpmx8mcwyfk5v0fkch";
    }
    else {
-      x86_64-linux  = "1x3gjc9xa03m4jfnl5vjxigzcnb8ysnhxgd8618v85x4l0010v38";
-      x86_64-darwin = "1nsbmrswv2jv2z7686i2sf6rrmxysbqi5ih6jjrbrqnk64xi18j2";
+      "x86_64-linux"  = "1pq17fasryharvw4byybvmcf5172hcmy6cp0m8bxhkxagwilprba";
+      "x86_64-darwin" = "11crpx2qs2nzkzv6fvs1gqn9v4zalxkzsc5br0fy1y02lzm26zbm";
    };

 in stdenv.mkDerivation rec {
@ -32,14 +32,14 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://artifacts.elastic.co/downloads/kibana/${name}-${plat}-${arch}.tar.gz";
-    sha256 = shas.${stdenv.hostPlatform.system} or (throw "Unknown architecture");
+    sha256 = shas."${stdenv.hostPlatform.system}" or (throw "Unknown architecture");
  };

  patches = [
    # Kibana specifies it specifically needs nodejs 10.15.2 but nodejs in nixpkgs is at 10.15.3.
    # The <nixpkgs/nixos/tests/elk.nix> test succeeds with this newer version so lets just
    # disable the version check.
-    ./disable-nodejs-version-check.patch
+    ./disable-nodejs-version-check-7.patch
  ];

  buildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch
+++ b/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch
@ -0,0 +1,19 @@
+diff --git a/src/setup_node_env/node_version_validator.js b/src/setup_node_env/node_version_validator.js
+index 3f611e5a..f5c60c85 100644
+--- a/src/setup_node_env/node_version_validator.js
+++ b/src/setup_node_env/node_version_validator.js
+@@ -25,11 +25,11 @@ var pkg = require('../../package.json'); // Note: This is written in ES5 so we c
+ var currentVersion = process && process.version || null;
+ var rawRequiredVersion = pkg && pkg.engines && pkg.engines.node || null;
+ var requiredVersion = rawRequiredVersion ? 'v' + rawRequiredVersion : rawRequiredVersion;
+-var isVersionValid = !!currentVersion && !!requiredVersion && currentVersion === requiredVersion; // Validates current the NodeJS version compatibility when Kibana starts.
+var isVersionValid = !!currentVersion && !!requiredVersion; // Validates current the NodeJS version compatibility when Kibana starts.
+ 
+ if (!isVersionValid) {
+   var errorMessage = 'Kibana does not support the current Node.js version ' + currentVersion + '. Please use Node.js ' + requiredVersion + '.'; // Actions to apply when validation fails: error report + exit.
+ 
+   console.error(errorMessage);
+   process.exit(1);
+-}
+\ No newline at end of file
+}
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@ -1,4 +1,4 @@
-{stdenv, fetchurl
+{stdenv, fetchFromGitHub
 , curl, makeWrapper, which, unzip
 , lua
 # for 'luarocks pack'
@ -9,11 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "luarocks";
-  version = "3.1.3";
+  version = "3.2.1";

-  src = fetchurl {
-    url="http://luarocks.org/releases/luarocks-${version}.tar.gz";
-    sha256="04q5k6drypsnbp1wspr9ns72k8kjf62a787a6jg1bb2s95gl6wy5";
+  src = fetchFromGitHub {
+    owner = "luarocks";
+    repo = "luarocks";
+    rev = "v${version}";
+    sha256 = "0viiafmb8binksda79ah828q1dfnb6jsqlk7vyndl2xvx9yfn4y2";
  };

  patches = [ ./darwin-3.1.3.patch ];
--- a/pkgs/development/tools/repository-managers/nexus/default.nix
+++ b/pkgs/development/tools/repository-managers/nexus/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "nexus";
-  version = "3.16.1-02";
+  version = "3.18.1-01";

  src = fetchurl {
    url = "https://sonatype-download.global.ssl.fastly.net/nexus/3/nexus-${version}-unix.tar.gz";
-    sha256 = "0nfcpsb7byykiwrdz01c99a6hr5ww2d4471spzpgs9i64kbjj7ln";
+    sha256 = "0z3hb1ha0yvi09hrndrzzh95g3m42pfsi0gzw7hfx9r0n8r2qgkd";
  };

  sourceRoot = "${pname}-${version}";
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/games/mudlet/default.nix
@ -1,46 +1,62 @@
-{ fetchurl, unzip, stdenv, makeWrapper, qtbase, yajl, libzip, hunspell
-, boost, lua5_1, luafilesystem, luazip, lrexlib-pcre, luasql-sqlite3, qmake }:
+{ fetchFromGitHub, fetchpatch, stdenv, wrapQtAppsHook, pcre, pugixml, qtbase, qtmultimedia, qttools, yajl, libzip, hunspell
+, boost, libGLU, lua, cmake,  which, }:

+let
+  luaEnv = lua.withPackages(ps: with ps; [ luazip luafilesystem lrexlib-pcre luasql-sqlite3 lua-yajl luautf8 ]);
+in
 stdenv.mkDerivation rec {
  pname = "mudlet";
-  version = "3.0.0-delta";
+  version = "4.0.3";

-  src = fetchurl {
-    url = "https://github.com/Mudlet/Mudlet/archive/Mudlet-${version}.tar.gz";
-    sha256 = "08fhqd323kgz5s17ac5z9dhkjxcmwvcmvhzy0x1vw4rayhijfrd7";
+  src = fetchFromGitHub {
+    owner = "Mudlet";
+    repo = "Mudlet";
+    rev = "Mudlet-${version}";
+    fetchSubmodules = true;
+    sha256 = "18bl4k0qgh47d9k5ipfvypfj1il678c0ws64a8adn8k21jajzkik";
  };

-  nativeBuildInputs = [ makeWrapper qmake ];
-  buildInputs = [
-    unzip qtbase lua5_1 hunspell libzip yajl boost
-    luafilesystem luazip lrexlib-pcre luasql-sqlite3
+  patches = [
+    ( fetchpatch {
+      url = "https://github.com/Mudlet/Mudlet/commit/3c8f12b6d757894d92ec2e2c9b12b91f69e8a3b6.patch";
+      name = "hunspell-1.7";
+      sha256 = "09qggls4pzpd8h9h10fbpfd7x3kr7fjp9axdwz98igpwy714n98j";
+    })
  ];

-  preConfigure = "cd src";
+  nativeBuildInputs = [ cmake wrapQtAppsHook qttools which ];
+  buildInputs = [
+    pcre pugixml qtbase qtmultimedia luaEnv libzip libGLU yajl boost hunspell
+  ];

-  installPhase = let
-    luaZipPath = "${luazip}/lib/lua/5.1/?.so";
-    luaFileSystemPath = "${luafilesystem}/lib/lua/5.1/?.so";
-    lrexlibPath = "${lrexlib-pcre}/lib/lua/5.1/?.so";
-    luasqlitePath = "${luasql-sqlite3}/lib/lua/5.1/?.so";
-  in ''
+  WITH_FONTS = "NO";
+  WITH_UPDATER = "NO";
+
+  enableParallelBuilding = true;
+
+  installPhase =  ''
    mkdir -pv $out/bin
-    cp mudlet $out
-    cp -r mudlet-lua $out
+    cp src/mudlet $out
+    mkdir -pv $out/share/mudlet
+    cp -r ../src/mudlet-lua/lua $out/share/mudlet/

-    makeWrapper $out/mudlet $out/bin/mudlet \
-      --set LUA_CPATH "${luaFileSystemPath};${luaZipPath};${lrexlibPath};${luasqlitePath}" \
+    mkdir -pv $out/share/applications
+    cp ../mudlet.desktop $out/share/applications/
+
+    mkdir -pv $out/share/pixmaps
+    cp -r ../mudlet.png $out/share/pixmaps/
+
+    makeQtWrapper $out/mudlet $out/bin/mudlet \
+      --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
+      --prefix LUA_PATH : "$NIX_LUA_PATH" \
      --run "cd $out";
  '';

-  patches = [ ./libs.patch ];
-
-  meta = {
+  meta = with stdenv.lib; {
    description = "Crossplatform mud client";
    homepage = http://mudlet.org/;
-    maintainers = [ stdenv.lib.maintainers.wyvie ];
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2;
-    broken = true;
+    maintainers = [ maintainers.wyvie maintainers.pstn ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
  };
 }
--- a/pkgs/games/mudlet/libs.patch
+++ b/pkgs/games/mudlet/libs.patch
@ -1,13 +0,0 @@
--- a/src/src.pro	2014-09-05 12:51:09.000000000 +0400
-+++ b/src/src.pro	2014-09-15 16:54:34.812560065 +0400
-@@ -85,8 +85,8 @@
- # Again according to FHS /usr/local/share/games is the corresponding place for locally built games documentation:
-     isEmpty( DOCDIR ) DOCDIR = $${DATAROOTDIR}/doc/mudlet
-     LIBS += -lpcre \
-        -llua5.1 \
-        -lhunspell \
-+        -llua \
-+        -lhunspell-1.6 \
-         -L/usr/local/lib/ \
-         -lyajl \
-         -lGLU \
--- a/pkgs/misc/logging/beats/6.x.nix
+++ b/pkgs/misc/logging/beats/6.x.nix
@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
        owner = "elastic";
        repo = "beats";
        rev = "v${version}";
-        sha256 = "0if08dxibdnqpsxs8f6hvw147j0j8bavhcm11scn28j9id65absq";
+        sha256 = "0jkiz5dfdi9zsji04ipcmcj7pml9294v455y7s2c22k24gyzbaw8";
      };

      goPackagePath = "github.com/elastic/beats";
--- a/pkgs/misc/logging/beats/7.x.nix
+++ b/pkgs/misc/logging/beats/7.x.nix
@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
        owner = "elastic";
        repo = "beats";
        rev = "v${version}";
-        sha256 = "1ca6a4zm062jpqwhmd8ivvzha1cvrw7mg5342vnmn99xdlr1pk9j";
+        sha256 = "0715fgqw6mqms4zld8wyf6appvvpfb1hglcmcn852c66a8zwr2r2";
      };

      goPackagePath = "github.com/elastic/beats";
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@ -1,18 +1,68 @@
-{ stdenv, fetchurl, substituteAll, gtk-doc, pkgconfig, gobject-introspection, intltool
-, libgudev, polkit, libxmlb, gusb, sqlite, libarchive, glib-networking
-, libsoup, help2man, gpgme, libxslt, elfutils, libsmbios, efivar, gnu-efi
-, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
-, ninja, gcab, gnutls, python3, wrapGAppsHook, json-glib, bash-completion
-, shared-mime-info, umockdev, vala, makeFontsConf, freefont_ttf
-, cairo, freetype, fontconfig, pango
-, bubblewrap, efibootmgr, flashrom, tpm2-tools
-}:
-
 # Updating? Keep $out/etc synchronized with passthru.filesInstalledToEtc

+{ stdenv
+, fetchurl
+, substituteAll
+, gtk-doc
+, pkgconfig
+, gobject-introspection
+, intltool
+, libgudev
+, polkit
+, libxmlb
+, gusb
+, sqlite
+, libarchive
+, glib-networking
+, libsoup
+, help2man
+, gpgme
+, libxslt
+, elfutils
+, libsmbios
+, efivar
+, gnu-efi
+, libyaml
+, valgrind
+, meson
+, libuuid
+, colord
+, docbook_xml_dtd_43
+, docbook_xsl
+, ninja
+, gcab
+, gnutls
+, python3
+, wrapGAppsHook
+, json-glib
+, bash-completion
+, shared-mime-info
+, umockdev
+, vala
+, makeFontsConf
+, freefont_ttf
+, cairo
+, freetype
+, fontconfig
+, pango
+, bubblewrap
+, efibootmgr
+, flashrom
+, tpm2-tools
+, nixosTests
+}:
+
 let
-  python = python3.withPackages (p: with p; [ pygobject3 pycairo pillow ]);
-  installedTestsPython = python3.withPackages (p: with p; [ pygobject3 requests ]);
+  python = python3.withPackages (p: with p; [
+    pygobject3
+    pycairo
+    pillow
+  ]);
+
+  installedTestsPython = python3.withPackages (p: with p; [
+    pygobject3
+    requests
+  ]);

  fontsConf = makeFontsConf {
    fontDirectories = [ freefont_ttf ];
@ -26,30 +76,70 @@ let
  # only redfish for x86_64
  haveRedfish = stdenv.isx86_64;

-  # Currently broken on Aarch64
-  haveFlashrom = isx86;
+  # # Currently broken on Aarch64
+  # haveFlashrom = isx86;
+  # Experimental in 1.2.10
+  haveFlashrom = false;

-in stdenv.mkDerivation rec {
+in
+
+stdenv.mkDerivation rec {
  pname = "fwupd";
-  version = "1.2.8";
+  version = "1.2.10";

  src = fetchurl {
    url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "0qbvq52c0scn1h99i1rf2la6rrhckin6gb02k7l0v3g07mxs20wc";
+    sha256 = "0inngs7i48akm9c7fmdsf9zjif595rkaba69rl76jfwfv8r21vjb";
  };

  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];

  nativeBuildInputs = [
-    meson ninja gtk-doc pkgconfig gobject-introspection intltool shared-mime-info
-    valgrind gcab docbook_xml_dtd_43 docbook_xsl help2man libxslt python wrapGAppsHook vala
+    meson
+    ninja
+    gtk-doc
+    pkgconfig
+    gobject-introspection
+    intltool
+    shared-mime-info
+    valgrind
+    gcab
+    docbook_xml_dtd_43
+    docbook_xsl
+    help2man
+    libxslt
+    python
+    wrapGAppsHook
+    vala
  ];

  buildInputs = [
-    polkit libxmlb gusb sqlite libarchive libsoup elfutils gnu-efi libyaml
-    libgudev colord gpgme libuuid gnutls glib-networking json-glib umockdev
-    bash-completion cairo freetype fontconfig pango efivar
-  ] ++ stdenv.lib.optionals haveDell [ libsmbios ];
+    polkit
+    libxmlb
+    gusb
+    sqlite
+    libarchive
+    libsoup
+    elfutils
+    gnu-efi
+    libyaml
+    libgudev
+    colord
+    gpgme
+    libuuid
+    gnutls
+    glib-networking
+    json-glib
+    umockdev
+    bash-completion
+    cairo
+    freetype
+    fontconfig
+    pango
+    efivar
+  ] ++ stdenv.lib.optionals haveDell [
+    libsmbios
+  ];

  patches = [
    ./fix-paths.patch
@ -65,7 +155,12 @@ in stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    patchShebangs .
+    patchShebangs \
+      libfwupd/generate-version-script.py \
+      meson_post_install.sh \
+      po/make-images \
+      po/make-images.sh \
+      po/test-deps

    # we cannot use placeholder in substituteAll
    # https://github.com/NixOS/nix/issues/1846
@ -85,9 +180,12 @@ in stdenv.mkDerivation rec {
  # doCheck = true;

  preFixup = let
-    binPath = [ efibootmgr bubblewrap tpm2-tools ] ++ stdenv.lib.optional haveFlashrom flashrom;
-  in
-  ''
+    binPath = [
+      efibootmgr
+      bubblewrap
+      tpm2-tools
+    ] ++ stdenv.lib.optional haveFlashrom flashrom;
+  in ''
    gappsWrapperArgs+=(
      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
      # See programs reached with fu_common_find_program_in_path in source
@ -128,6 +226,10 @@ in stdenv.mkDerivation rec {

  FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file

+  # error: “PolicyKit files are missing”
+  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+
  # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
  dontWrapGApps = true;
  # so we need to wrap the executables manually
@ -157,11 +259,15 @@ in stdenv.mkDerivation rec {
      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
      "pki/fwupd-metadata/LVFS-CA.pem"
    ];
+
+    tests = {
+      installedTests = nixosTests.fwupd;
+    };
  };

  meta = with stdenv.lib; {
    homepage = https://fwupd.org/;
-    maintainers = with maintainers; [];
+    maintainers = with maintainers; [ jtojnar ];
    license = [ licenses.gpl2 ];
    platforms = platforms.linux;
  };
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@ -1,53 +1,58 @@
 { stdenv
 , fetchurl
 , pkgconfig
-, dbus-glib
-, intltool
 , libxslt
 , docbook_xsl
 , udev
 , libgudev
 , libusb1
+, glib
 , gobject-introspection
-, useSystemd ? true, systemd
+, gettext
+, systemd
+, useIMobileDevice ? true
+, libimobiledevice
 }:

 stdenv.mkDerivation {
  pname = "upower";
-  version = "0.99.10";
+  version = "0.99.11";
+
+  outputs = [ "out" "dev" ];

  src = fetchurl {
-    url = https://gitlab.freedesktop.org/upower/upower/uploads/c438511024b9bc5a904f8775cfc8e4c4/upower-0.99.10.tar.xz;
-    sha256 = "17d2bclv5fgma2y3g8bsn9pdvspn1zrzismzdnzfivc0f2wm28k4";
+    url = https://gitlab.freedesktop.org/upower/upower/uploads/93cfe7c8d66ed486001c4f3f55399b7a/upower-0.99.11.tar.xz;
+    sha256 = "1vxxvmz2cxb1qy6ibszaz5bskqdy9nd9fxspj9fv3gfmrjzzzdb4";
  };

  nativeBuildInputs = [
+    docbook_xsl
+    gettext
+    gobject-introspection
+    libxslt
    pkgconfig
  ];

  buildInputs = [
-    dbus-glib
-    intltool
-    libxslt
-    docbook_xsl
-    udev
    libgudev
    libusb1
-    gobject-introspection
+    udev
+    systemd
  ]
-  ++ stdenv.lib.optional useSystemd systemd
+  ++ stdenv.lib.optional useIMobileDevice libimobiledevice
  ;

+  propagatedBuildInputs = [
+    glib
+  ];
+
  configureFlags = [
-    "--with-backend=linux"
    "--localstatedir=/var"
-  ]
-  ++ stdenv.lib.optional useSystemd [
+    "--with-backend=linux"
    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
    "--with-systemdutildir=${placeholder "out"}/lib/systemd"
    "--with-udevrulesdir=${placeholder "out"}/lib/udev/rules.d"
-  ]
-  ;
+  ];

  doCheck = false; # fails with "env: './linux/integration-test': No such file or directory"

--- a/pkgs/servers/dns/powerdns/default.nix
+++ b/pkgs/servers/dns/powerdns/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig
-, boost, libyamlcpp, libsodium, sqlite, protobuf, botan2, libressl
+, boost, libyamlcpp, libsodium, sqlite, protobuf, botan2, openssl
 , mysql57, postgresql, lua, openldap, geoip, curl, opendbx, unixODBC
 }:

@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
    boost mysql57.connector-c postgresql lua openldap sqlite protobuf geoip
-    libyamlcpp libsodium curl opendbx unixODBC botan2 libressl
+    libyamlcpp libsodium curl opendbx unixODBC botan2 openssl
  ];

  # nix destroy with-modules arguments, when using configureFlags
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
      "--with-modules=bind gmysql geoip godbc gpgsql gsqlite3 ldap lua mydns opendbx pipe random remote"
      --with-sqlite3
      --with-socketdir=/var/lib/powerdns
-      --with-libcrypto=${libressl.dev}
+      --with-libcrypto=${openssl.dev}
      --enable-libsodium
      --enable-botan
      --enable-tools
--- a/pkgs/servers/http/unit/default.nix
+++ b/pkgs/servers/http/unit/default.nix
@ -4,7 +4,6 @@
 , withPHP73 ? false, php73
 , withPerl ? true, perl
 , withPerldevel ? false, perldevel
-, withRuby_2_3 ? false, ruby_2_3
 , withRuby_2_4 ? false, ruby_2_4
 , withRuby ? true, ruby
 , withSSL ? true, openssl ? null
@ -33,7 +32,6 @@ stdenv.mkDerivation rec {
    ++ optional withPHP73 php73
    ++ optional withPerl perl
    ++ optional withPerldevel perldevel
-    ++ optional withRuby_2_3 ruby_2_3
    ++ optional withRuby_2_4 ruby_2_4
    ++ optional withRuby ruby
    ++ optional withSSL openssl;
@ -53,7 +51,6 @@ stdenv.mkDerivation rec {
    ${optionalString withPHP73      "./configure php     --module=php73     --config=${php73.dev}/bin/php-config  --lib-path=${php73}/lib"}
    ${optionalString withPerl       "./configure perl    --module=perl      --perl=${perl}/bin/perl"}
    ${optionalString withPerldevel  "./configure perl    --module=perl529   --perl=${perldevel}/bin/perl"}
-    ${optionalString withRuby_2_3   "./configure ruby    --module=ruby23    --ruby=${ruby_2_3}/bin/ruby"}
    ${optionalString withRuby_2_4   "./configure ruby    --module=ruby24    --ruby=${ruby_2_4}/bin/ruby"}
    ${optionalString withRuby       "./configure ruby    --module=ruby      --ruby=${ruby}/bin/ruby"}
  '';
--- a/pkgs/servers/search/elasticsearch/6.x.nix
+++ b/pkgs/servers/search/elasticsearch/6.x.nix
@ -19,8 +19,8 @@ stdenv.mkDerivation (rec {
    url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}.tar.gz";
    sha256 =
      if enableUnfree
-      then "1a88yyl0x4bsx92m3wjsz1fgm76gbfdzcd4bzp2x652rha667vfh"
-      else "04fa0fk25d5yxcjdj0bwqvdrswgwj31fwjvbq4gpg66c6bqwzcn6";
+      then "09dy3iyzk460vra6na6vk7d3mzpbv4cl0pl7kjmybxy947j7hh42"
+      else "0s04xz3j4psyhawvy503sp2nl5s0gswmpd9wfvwnavgcrr23wk39";
  };

  patches = [ ./es-home-6.x.patch ];
--- a/pkgs/servers/search/elasticsearch/7.x.nix
+++ b/pkgs/servers/search/elasticsearch/7.x.nix
@ -17,12 +17,12 @@ let
  shas =
    if enableUnfree
    then {
-      x86_64-linux  = "1jkfllafcjqhfydsy90jx2ghpv5cmm6gabv206niwg9qc6y6r1ik";
-      x86_64-darwin = "1lgyxq3yahdww0wpqmpc1mz57kmk5hy2drb1dha69k9l0ibmjf18";
+      "x86_64-linux"  = "0x1ws6iqflvzphg2srvdrn4xrr5wd5fnykkc9h006mj9rb5lp1k9";
+      "x86_64-darwin" = "0yjzgsbsgwa6gbp270fqfm1klm6f8n4s2xmay62gdgvnsj543cxz";
    }
    else {
-      x86_64-linux  = "0pg22wi2xcjla44azfvn9c58r4xq3x9jiwh7qb0d8f3nv30vfd10";
-      x86_64-darwin = "0d9xg3bf06mr7mw2bd16gb2xrfjncrhj19846rrj4j5gb2qjz0x2";
+      "x86_64-linux"  = "1nl6yic1j422l2c7mf8wv0ylfx6marrwm7d181z9nzdswq509kpg";
+      "x86_64-darwin" = "1sy4an9d1faifr3n2y45kalrd22yb68dnpjhi9h8q73c21gp8pzf";
    };
 in
 stdenv.mkDerivation (rec {
@ -31,7 +31,7 @@ stdenv.mkDerivation (rec {

  src = fetchurl {
    url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}-${plat}-${arch}.tar.gz";
-    sha256 = shas.${stdenv.hostPlatform.system} or (throw "Unknown architecture");
+    sha256 = shas."${stdenv.hostPlatform.system}" or (throw "Unknown architecture");
  };

  patches = [ ./es-home-6.x.patch ];
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@ -168,14 +168,6 @@ let

 in self: {

-  postgresql_9_4 = self.callPackage generic {
-    version = "9.4.24";
-    psqlSchema = "9.4";
-    sha256 = "0acl1wmah3r1a0qjjmpc256glccrjnzq4pkwklx4d9s6vmkks9aj";
-    this = self.postgresql_9_4;
-    inherit self;
-  };
-
  postgresql_9_5 = self.callPackage generic {
    version = "9.5.19";
    psqlSchema = "9.5";
--- a/pkgs/servers/web-apps/cryptpad/generate.sh
+++ b/pkgs/servers/web-apps/cryptpad/generate.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p nodePackages.node2nix nodePackages.bower2nix
+#! nix-shell -i bash  -I nixpkgs=../../../.. -p nodePackages.node2nix nodePackages.bower2nix
 set -euo pipefail

 node2nix -6 \
--- a/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
+++ b/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
@ -49,13 +49,13 @@ let
        sha1 = "d32815404d689699f85a4ea4fa8755dd13a96048";
      };
    };
-    "chainpad-server-3.0.3" = {
+    "chainpad-server-3.0.5" = {
      name = "chainpad-server";
      packageName = "chainpad-server";
-      version = "3.0.3";
+      version = "3.0.5";
      src = fetchurl {
-        url = "https://registry.npmjs.org/chainpad-server/-/chainpad-server-3.0.3.tgz";
-        sha512 = "NRfV7FFBEYy4ZVX7h0P5znu55X8v5K4iGWeMGihkfWZLKu70GmCPUTwpBCP79dUvnCToKEa4/e8aoSPcvZC8pA==";
+        url = "https://registry.npmjs.org/chainpad-server/-/chainpad-server-3.0.5.tgz";
+        sha512 = "USKOMSHsNjnme81Qy3nQ+ji9eCkBPokYH4T82LVHAI0aayTSCXcTPUDLVGDBCRqe8NsXU4io1WPXn1KiZwB8fA==";
      };
    };
    "content-disposition-0.5.2" = {
@ -619,14 +619,14 @@ let
  };
 in
 {
-  "cryptpad-git+https://github.com/xwiki-labs/cryptpad.git#3.0.0" = nodeEnv.buildNodePackage {
+  "cryptpad-git+https://github.com/xwiki-labs/cryptpad.git#3.0.1" = nodeEnv.buildNodePackage {
    name = "cryptpad";
    packageName = "cryptpad";
-    version = "3.0.0";
+    version = "3.0.1";
    src = fetchgit {
      url = "https://github.com/xwiki-labs/cryptpad.git";
-      rev = "166ab65cd47a64e020528089244ed5be34f6e3c8";
-      sha256 = "35a3b733b5c128b7c7e1c0e7473f4a6a446d663f4c787745b36b1071205c1fd7";
+      rev = "4e5f6edac4f9a3a7a4756eb543d29dc9d1eef32a";
+      sha256 = "f32a93316b717246d1563baec70f9e1e7e5ec1be4f325a473cc37e656afa13cd";
    };
    dependencies = [
      sources."accepts-1.3.7"
@ -634,7 +634,7 @@ in
      sources."async-limiter-1.0.1"
      sources."body-parser-1.18.3"
      sources."bytes-3.0.0"
-      sources."chainpad-server-3.0.3"
+      sources."chainpad-server-3.0.5"
      sources."content-disposition-0.5.2"
      sources."content-type-1.0.4"
      sources."cookie-0.3.1"
--- a/pkgs/servers/web-apps/cryptpad/node-packages.json
+++ b/pkgs/servers/web-apps/cryptpad/node-packages.json
@ -1,3 +1,3 @@
 [
-  { "cryptpad": "git+https://github.com/xwiki-labs/cryptpad.git#3.0.0" }
+  { "cryptpad": "git+https://github.com/xwiki-labs/cryptpad.git#3.0.1" }
 ]
--- a/pkgs/tools/misc/html-proofer/Gemfile.lock
+++ b/pkgs/tools/misc/html-proofer/Gemfile.lock
@ -6,13 +6,12 @@ GEM
    ethon (0.12.0)
      ffi (>= 1.3.0)
    ffi (1.11.1)
-    html-proofer (3.12.0)
+    html-proofer (3.12.2)
      addressable (~> 2.3)
      mercenary (~> 0.3)
      nokogiri (~> 1.10)
      parallel (~> 1.3)
      rainbow (~> 3.0)
-      timerizer (~> 0.3)
      typhoeus (~> 1.3)
      yell (~> 2.0)
    mercenary (0.3.6)
@ -22,7 +21,6 @@ GEM
    parallel (1.17.0)
    public_suffix (4.0.1)
    rainbow (3.0.0)
-    timerizer (0.3.2)
    typhoeus (1.3.1)
      ethon (>= 0.9.0)
    yell (2.2.0)
--- a/pkgs/tools/misc/html-proofer/gemset.nix
+++ b/pkgs/tools/misc/html-proofer/gemset.nix
@ -32,15 +32,15 @@
    version = "1.11.1";
  };
  html-proofer = {
-    dependencies = ["addressable" "mercenary" "nokogiri" "parallel" "rainbow" "timerizer" "typhoeus" "yell"];
+    dependencies = ["addressable" "mercenary" "nokogiri" "parallel" "rainbow" "typhoeus" "yell"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1a5h5ijrngfd4ri36g7bs5lcg4001i5xx7nlk35rsg34xpy8mp04";
+      sha256 = "0xkcchgvlqkk3xgn11vw8n42bhavj6nn6vqsbycbx1rqxgiljlhy";
      type = "gem";
    };
-    version = "3.12.0";
+    version = "3.12.2";
  };
  mercenary = {
    groups = ["default"];
@ -103,16 +103,6 @@
    };
    version = "3.0.0";
  };
-  timerizer = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06zk04kprgj0abws15wqrk4q29f3wcx7z2jj3v25nnb2517lk66c";
-      type = "gem";
-    };
-    version = "0.3.2";
-  };
  typhoeus = {
    dependencies = ["ethon"];
    groups = ["default"];
--- a/pkgs/tools/misc/logstash/6.x.nix
+++ b/pkgs/tools/misc/logstash/6.x.nix
@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
    url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
    sha256 =
      if enableUnfree
-      then "178shgxwc9kw9w9vwsvwxp8m8r6lssaw1i32vvmx9na01b4w5m4p"
-      else "0gyq97qsg7fys9cc5yj4kpcf3xxvdd5qgzal368yg9swps37g5yj";
+      then "00pwi7clgdflzzg15bh3y30gzikvvy7p5fl88fww7xhhy47q8053"
+      else "0spxgqsyh72n0l0xh6rljp0lbqz46xmr02sqz25ybycr4qkxdhgk";
  };

  dontBuild         = true;
--- a/pkgs/tools/misc/logstash/7.x.nix
+++ b/pkgs/tools/misc/logstash/7.x.nix
@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
    url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
    sha256 =
      if enableUnfree
-      then "0ls7ia4ldyb7kslmjqhszb30bkammdm5nydc5y7r41zl1zjlhfgc"
-      else "1mpmfnc57vpjk8x3vibamz8lgq163msf20m1bail4hbwhwsmms9i";
+      then "1mw053bx2zh5320p545ax8fnydzqj28r239l7a4m1d2shi89w6s8"
+      else "0d57ahak4chxmd0pmgkbmig2wacprv120pwmjlx63sxf5vw72yap";
  };

  dontBuild         = true;
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@ -2,19 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "starship";
-  version = "0.13.1";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "starship";
    repo = "starship";
    rev = "v${version}";
-    sha256 = "0y6ixl3i1brak226hh02da1zzlcv41f0kb648dqii6dzyhrwhrld";
+    sha256 = "164qxbzlzg53xicp2n5kg9qbmvlckc6rk78n69s82d2d09mbq1ks";
  };

  buildInputs = [ openssl ] ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
  nativeBuildInputs = [ pkgconfig ];

-  cargoSha256 = "1xk4ngxhgww921fk40d4ziprnzgp927lhdwwzcifcb0hdyl0854p";
+  cargoSha256 = "192lq0wf8c2p3s4n6c0xr02hwyswypxypimbghi4m8f3fgj2l3ig";
  checkPhase = "cargo test -- --skip directory::home_directory --skip directory::directory_in_root";

  meta = with stdenv.lib; {
--- a/pkgs/tools/nix/nixpkgs-fmt/default.nix
+++ b/pkgs/tools/nix/nixpkgs-fmt/default.nix
@ -1,16 +1,16 @@
 { lib, rustPlatform, fetchFromGitHub }:
 rustPlatform.buildRustPackage rec {
  pname = "nixpkgs-fmt";
-  version = "0.3.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0nz4njmrwacizz9z89ligxr2gyggk65vq9cmd6s4hn133gajf2n1";
+    sha256 = "07hnyx616dk03md00pmgpb5c2sp9w0n5l94s82arair0kpi0ncy0";
  };

-  cargoSha256 = "0p3qa1asdvw2npav4281lzndjczrzac6fr8z4y61m7rbn363s8sa";
+  cargoSha256 = "0wfx7shsdqrwbnzr2a0fnly1kd93mxbm96zjq5pzrq94lphkhqhz";

  meta = with lib; {
    description = "Nix code formatter for nixpkgs";
--- a/pkgs/tools/security/gnome-keysign/default.nix
+++ b/pkgs/tools/security/gnome-keysign/default.nix
@ -0,0 +1,73 @@
+{ stdenv
+, fetchFromGitLab
+, python3
+, wrapGAppsHook
+, gobject-introspection
+, gtk3
+, glib
+, gnome3
+, gst_all_1
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "gnome-keysign";
+  version = "1.0.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = pname;
+    rev = version;
+    sha256 = "0iy70dskd7wly37lpb2ypd9phhyml5j3c7rzajii4f2s7zgb3abg";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    gobject-introspection
+  ] ++ (with python3.pkgs; [
+    Babel
+    lxml
+  ]);
+
+  buildInputs = [
+    # TODO: add avahi support
+    gtk3
+    glib
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    (gst_all_1.gst-plugins-good.override { gtkSupport = true; })
+    gst_all_1.gst-plugins-bad # for zbar plug-in
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    dbus-python
+    future
+    gpgme
+    magic-wormhole
+    pygobject3
+    pybluez
+    qrcode
+    requests
+    twisted
+  ];
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
+  # https://github.com/NixOS/nixpkgs/issues/56943
+  strictDeps = false;
+
+  # bunch of linting
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "GTK/GNOME application to use GnuPG for signing other peoples’ keys";
+    homepage = https://wiki.gnome.org/Apps/Keysign;
+    license = licenses.gpl3Plus;
+    maintainers = gnome3.maintainers;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@ -9,16 +9,16 @@ assert pythonSupport -> pythonPackages != null;

 rustPlatform.buildRustPackage rec {
  pname = "sequoia";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitLab {
    owner = "sequoia-pgp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "13dzwdzz33dy2lgnznsv8wqnw2501f2ggrkfwpqy5x6d1kgms8rj";
+    sha256 = "0gvczghyik56jlnb8cz7jg2l3nbm519gf19g7l5blxci3009v23d";
  };

-  cargoSha256 = "1zcnkpzcar3a2fk2rn3i3nb70b59ds9fpfa44f15r3aaxajsdhdi";
+  cargoSha256 = "0dk9sjcbmygbdpwqnah5krli1p9j5hahgiqrca9c0kfpfiwgx62q";

  nativeBuildInputs = [
    pkgconfig
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -265,7 +265,6 @@ mapAliases ({
  plexpy = tautulli; # plexpy got renamed to tautulli, added 2019-02-22
  pmtools = acpica-tools; # added 2018-11-01
  poppler_qt5 = libsForQt5.poppler;  # added 2015-12-19
-  postgresql94 = postgresql_9_4;
  postgresql95 = postgresql_9_5;
  postgresql96 = postgresql_9_6;
  postgresql100 = throw "deprecated 2018-10-21: use postgresql_10 instead";
@ -303,8 +302,9 @@ mapAliases ({
  rssglx = rss-glx; #added 2015-03-25
  ruby_2_0_0 = throw "deprecated 2018-0213: use a newer version of ruby";
  ruby_2_1_0 = throw "deprecated 2018-0213: use a newer version of ruby";
-  ruby_2_2_9 = throw "deprecated 2018-0213: use ruby_2_2 instead";
-  ruby_2_3_6 = throw "deprecated 2018-0213: use ruby_2_3 instead";
+  ruby_2_2_9 = throw "deprecated 2018-0213: use a newer version of ruby";
+  ruby_2_3_6 = throw "deprecated 2018-0213: use a newer version of ruby";
+  ruby_2_3 = throw "deprecated 2019-09-06: use a newer version of ruby";
  ruby_2_4_3 = throw "deprecated 2018-0213: use ruby_2_4 instead";
  ruby_2_5_0 = throw "deprecated 2018-0213: use ruby_2_5 instead";
  rubygems = throw "deprecated 2016-03-02: rubygems is now bundled with ruby";
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1066,22 +1066,14 @@ in

  bchunk = callPackage ../tools/cd-dvd/bchunk { };

-  inherit (callPackages ../misc/logging/beats/6.x.nix {
-    # XXX: this is failing with Go 1.12. Error is related to cgo, an
-    # update to this package might fix it.
-    buildGoPackage = buildGo111Package;
-  })
+  inherit (callPackages ../misc/logging/beats/6.x.nix { })
    filebeat6
    heartbeat6
    metricbeat6
    packetbeat6
    journalbeat6;

-  inherit (callPackages ../misc/logging/beats/7.x.nix {
-    # XXX: this is failing with Go 1.12. Error is related to cgo, an
-    # update to this package might fix it.
-    buildGoPackage = buildGo111Package;
-  })
+  inherit (callPackages ../misc/logging/beats/7.x.nix { })
    filebeat7
    heartbeat7
    metricbeat7
@ -2873,8 +2865,8 @@ in
  evemu = callPackage ../tools/system/evemu { };

  # The latest version used by elasticsearch, logstash, kibana and the the beats from elastic.
-  elk6Version = "6.7.2";
-  elk7Version = "7.0.1";
+  elk6Version = "6.8.3";
+  elk7Version = "7.3.1";

  elasticsearch6 = callPackage ../servers/search/elasticsearch/6.x.nix {
    utillinux = utillinuxMinimal;
@ -2914,13 +2906,7 @@ in
          sha256 = "f15516df478d5a56180fbf80e68f206010e6d160fc39fa508b65e035fd75130b";
        };
      });
-      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
-        version = "3.12";
-        src = oldAttrs.src.override {
-          inherit version;
-          sha256 = "1aqjl8dk9amd4zr99n8v2qxzgmr2hdvqfma4zh7a41rj6336c9sr";
-        };
-      });
+      pyyaml = super.pyyaml_3;
    };
  }).pkgs; toPythonApplication elasticsearch-curator;

@ -3443,6 +3429,8 @@ in

  gnome-builder = callPackage ../applications/editors/gnome-builder { };

+  gnome-keysign = callPackage ../tools/security/gnome-keysign { };
+
  gnome-podcasts = callPackage ../applications/audio/gnome-podcasts { };

  gnome-photos = callPackage ../applications/graphics/gnome-photos {
@ -4342,6 +4330,8 @@ in

  memtester = callPackage ../tools/system/memtester { };

+  mhonarc = perlPackages.MHonArc;
+
  minergate = callPackage ../applications/misc/minergate { };

  minergate-cli = callPackage ../applications/misc/minergate-cli { };
@ -8950,14 +8940,12 @@ in
    inherit (darwin) libiconv libobjc libunwind;
    inherit (darwin.apple_sdk.frameworks) Foundation;
  })
-    ruby_2_3
    ruby_2_4
    ruby_2_5
    ruby_2_6;

  ruby = ruby_2_6;

-  rubyPackages_2_3 = recurseIntoAttrs ruby_2_3.gems;
  rubyPackages_2_4 = recurseIntoAttrs ruby_2_4.gems;
  rubyPackages_2_5 = recurseIntoAttrs ruby_2_5.gems;
  rubyPackages_2_6 = recurseIntoAttrs ruby_2_6.gems;
@ -14999,8 +14987,6 @@ in

  pgbouncer = callPackage ../servers/sql/pgbouncer { };

-  pgpool94 = pgpool.override { postgresql = postgresql_9_4; };
-
  pgpool = callPackage ../servers/sql/pgpool {
    pam = if stdenv.isLinux then pam else null;
    libmemcached = null; # Detection is broken upstream
@ -15011,7 +14997,6 @@ in
  timescaledb-tune = callPackage ../development/tools/database/timescaledb-tune { };

  inherit (import ../servers/sql/postgresql pkgs)
-    postgresql_9_4
    postgresql_9_5
    postgresql_9_6
    postgresql_10
@ -16279,7 +16264,7 @@ in

  semodule-utils = callPackage ../os-specific/linux/semodule-utils { };

-  powerdns = callPackage ../servers/dns/powerdns { libressl = libressl_2_8; };
+  powerdns = callPackage ../servers/dns/powerdns { };

  dnsdist = callPackage ../servers/dns/dnsdist { };

@ -20438,9 +20423,7 @@ in

  wavebox = callPackage ../applications/networking/instant-messengers/wavebox { };

-  sonic-pi = callPackage ../applications/audio/sonic-pi {
-    ruby = ruby_2_3;
-  };
+  sonic-pi = callPackage ../applications/audio/sonic-pi { };

  st = callPackage ../applications/misc/st {
    conf = config.st.conf or null;
@ -22144,7 +22127,7 @@ in
  mrrescue = callPackage ../games/mrrescue { };

  mudlet = libsForQt5.callPackage ../games/mudlet {
-    inherit (lua51Packages) luafilesystem lrexlib-pcre luazip luasql-sqlite3;
+    lua = lua5_1;
  };

  n2048 = callPackage ../games/n2048 {};
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -10661,23 +10661,26 @@ let
    };
  };

-  MHonArc = buildPerlPackage {
+  MHonArc = buildPerlPackage rec {
    pname = "MHonArc";
-    version = "2.6.18";
+    version = "2.6.19";

    src = fetchurl {
-      url    = "http://dcssrv1.oit.uci.edu/indiv/ehood/release/MHonArc/tar/MHonArc-2.6.18.tar.gz";
-      sha256 = "1xmf26dfwr8achprc3n1pxgl0mkiyr6pf25wq3dqgzqkghrrsxa2";
+      url = "https://www.mhonarc.org/release/MHonArc/tar/MHonArc-${version}.tar.gz";
+      sha256 = "0ll3v93yji334zqp6xfzfxc0127pmjcznmai1l5q6dzawrs2igzq";
    };
+
+    patches = [ ../development/perl-modules/mhonarc.patch ];
+
    outputs = [ "out" "dev" ]; # no "devdoc"

    installTargets = "install";

    meta = with stdenv.lib; {
-      homepage    = http://dcssrv1.oit.uci.edu/indiv/ehood/mhonarch.html;
+      homepage = "https://www.mhonarc.org/";
      description = "A mail-to-HTML converter";
      maintainers = with maintainers; [ lovek323 ];
-      license     = licenses.gpl2;
+      license = licenses.gpl2;
    };
  };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -4661,6 +4661,8 @@ in {
    inherit (pkgs) pkgconfig; # use normal pkgconfig, not the python package
  };

+  rfc6555 = callPackage ../development/python-modules/rfc6555 { };
+
  qdarkstyle = callPackage ../development/python-modules/qdarkstyle { };

  quamash = callPackage ../development/python-modules/quamash { };