Merge staging-next into staging

2020-03-28 21:15:15 +01:00 · 2020-03-28 21:15:15 +01:00 · a36be028f5
commit a36be028f5
parent 48a137da73 7f4e4b279e
639 changed files with 13721 additions and 10162 deletions
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -369,7 +369,7 @@ automatically select the right version of GHC and other build tools to build,
 test and execute apps in an existing project downloaded from somewhere on the
 Internet. Pass the `--nix` flag to any `stack` command to do so, e.g.
 ```shell
-git clone --recursive https://github.com/yesodweb/wai
+git clone --recurse-submodules https://github.com/yesodweb/wai.git
 cd wai
 stack --nix build
 ```
--- a/lib/generators.nix
+++ b/lib/generators.nix
@ -126,6 +126,59 @@ rec {
      # map input to ini sections
      mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;

+  /* Generate a git-config file from an attrset.
+   *
+   * It has two major differences from the regular INI format:
+   *
+   * 1. values are indented with tabs
+   * 2. sections can have sub-sections
+   *
+   * generators.toGitINI {
+   *   url."ssh://git@github.com/".insteadOf = "https://github.com";
+   *   user.name = "edolstra";
+   * }
+   *
+   *> [url "ssh://git@github.com/"]
+   *>   insteadOf = https://github.com/
+   *>
+   *> [user]
+   *>   name = edolstra
+   */
+  toGitINI = attrs:
+    with builtins;
+    let
+      mkSectionName = name:
+        let
+          containsQuote = libStr.hasInfix ''"'' name;
+          sections = libStr.splitString "." name;
+          section = head sections;
+          subsections = tail sections;
+          subsection = concatStringsSep "." subsections;
+        in if containsQuote || subsections == [ ] then
+          name
+        else
+          ''${section} "${subsection}"'';
+
+      # generation for multiple ini values
+      mkKeyValue = k: v:
+        let mkKeyValue = mkKeyValueDefault { } " = " k;
+        in concatStringsSep "\n" (map (kv: "\t" + mkKeyValue kv) (lib.toList v));
+
+      # converts { a.b.c = 5; } to { "a.b".c = 5; } for toINI
+      gitFlattenAttrs = let
+        recurse = path: value:
+          if isAttrs value then
+            lib.mapAttrsToList (name: value: recurse ([ name ] ++ path) value) value
+          else if length path > 1 then {
+            ${concatStringsSep "." (lib.reverseList (tail path))}.${head path} = value;
+          } else {
+            ${head path} = value;
+          };
+      in attrs: lib.foldl lib.recursiveUpdate { } (lib.flatten (recurse [ ] attrs));
+
+      toINI_ = toINI { inherit mkKeyValue mkSectionName; };
+    in
+      toINI_ (gitFlattenAttrs attrs);

  /* Generates JSON from an arbitrary (non-function) value.
    * For more information see the documentation of the builtin.
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -649,6 +649,13 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
    url = http://metadata.ftp-master.debian.org/changelogs/main/d/debianutils/debianutils_4.8.1_copyright;
  };

+  sspl = {
+    shortName = "SSPL";
+    fullName = "Server Side Public License";
+    url = https://www.mongodb.com/licensing/server-side-public-license;
+    free = false;
+  };
+
  tcltk = spdx {
    spdxId = "TCL";
    fullName = "TCL/TK License";
--- a/lib/sources.nix
+++ b/lib/sources.nix
@ -63,17 +63,14 @@ rec {
  #             https://nixos.org/nix/manual/#builtin-filterSource
  #
  #   name:     Optional name to use as part of the store path.
-  #             This defaults `src.name` or otherwise `baseNameOf src`.
-  #             We recommend setting `name` whenever `src` is syntactically `./.`.
-  #             Otherwise, you depend on `./.`'s name in the parent directory,
-  #             which can cause inconsistent names, defeating caching.
+  #             This defaults to `src.name` or otherwise `"source"`.
  #
  cleanSourceWith = { filter ? _path: _type: true, src, name ? null }:
    let
      isFiltered = src ? _isLibCleanSourceWith;
      origSrc = if isFiltered then src.origSrc else src;
      filter' = if isFiltered then name: type: filter name type && src.filter name type else filter;
-      name' = if name != null then name else if isFiltered then src.name else baseNameOf src;
+      name' = if name != null then name else if isFiltered then src.name else "source";
    in {
      inherit origSrc;
      filter = filter';
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@ -65,6 +65,7 @@ rec {
          freebsd = "FreeBSD";
          openbsd = "OpenBSD";
          wasi = "Wasi";
+          genode = "Genode";
        }.${final.parsed.kernel.name} or null;

         # uname -p
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@ -35,6 +35,8 @@ let
    "vc4-none"

    "js-ghcjs"
+
+    "aarch64-genode" "x86_64-genode"
  ];

  allParsed = map parse.mkSystemFromString all;
@ -68,6 +70,7 @@ in {
  unix    = filterDoubles predicates.isUnix;
  wasi    = filterDoubles predicates.isWasi;
  windows = filterDoubles predicates.isWindows;
+  genode  = filterDoubles predicates.isGenode;

  embedded = filterDoubles predicates.isNone;

--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -47,6 +47,7 @@ rec {
    isMinGW        = { kernel = kernels.windows; abi = abis.gnu; };
    isWasi         = { kernel = kernels.wasi; };
    isGhcjs        = { kernel = kernels.ghcjs; };
+    isGenode       = { kernel = kernels.genode; };
    isNone         = { kernel = kernels.none; };

    isAndroid      = [ { abi = abis.android; } { abi = abis.androideabi; } ];
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@ -279,6 +279,7 @@ rec {
    wasi    = { execFormat = wasm;    families = { }; };
    windows = { execFormat = pe;      families = { }; };
    ghcjs   = { execFormat = unknown; families = { }; };
+    genode  = { execFormat = elf;     families = { }; };
  } // { # aliases
    # 'darwin' is the kernel for all of them. We choose macOS by default.
    darwin = kernels.macos;
@ -395,6 +396,8 @@ rec {
        then { cpu = elemAt l 0; vendor = "unknown"; kernel = elemAt l 1; abi = elemAt l 2; }
      else if (elemAt l 2 == "ghcjs")
        then { cpu = elemAt l 0; vendor = "unknown"; kernel = elemAt l 2; }
+      else if hasPrefix "genode" (elemAt l 2)
+        then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = elemAt l 2; }
      else throw "Target specification with 3 components is ambiguous";
    "4" =    { cpu = elemAt l 0; vendor = elemAt l 1; kernel = elemAt l 2; abi = elemAt l 3; };
  }.${toString (length l)}
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@ -12,16 +12,17 @@ let
    expected = lib.sort lib.lessThan y;
  };
 in with lib.systems.doubles; lib.runTests {
-  testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows ++ embedded ++ js);
+  testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows ++ embedded ++ js ++ genode);

  testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv6l-none" "armv7a-linux" "armv7l-linux" "arm-none" "armv7a-darwin" ];
  testi686 = mseteq i686 [ "i686-linux" "i686-freebsd" "i686-netbsd" "i686-openbsd" "i686-cygwin" "i686-windows" "i686-none" "i686-darwin" ];
  testmips = mseteq mips [ "mipsel-linux" ];
-  testx86_64 = mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" "x86_64-windows" "x86_64-none" ];
+  testx86_64 = mseteq x86_64 [ "x86_64-linux" "x86_64-darwin" "x86_64-freebsd" "x86_64-genode" "x86_64-openbsd" "x86_64-netbsd" "x86_64-cygwin" "x86_64-solaris" "x86_64-windows" "x86_64-none" ];

  testcygwin = mseteq cygwin [ "i686-cygwin" "x86_64-cygwin" ];
  testdarwin = mseteq darwin [ "x86_64-darwin" "i686-darwin" "aarch64-darwin" "armv7a-darwin" ];
  testfreebsd = mseteq freebsd [ "i686-freebsd" "x86_64-freebsd" ];
+  testgenode = mseteq genode [ "aarch64-genode" "x86_64-genode" ];
  testgnu = mseteq gnu (linux /* ++ kfreebsd ++ ... */);
  testillumos = mseteq illumos [ "x86_64-solaris" ];
  testlinux = mseteq linux [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-linux" "mipsel-linux" "riscv32-linux" "riscv64-linux" "x86_64-linux" "powerpc64le-linux" ];
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1257,6 +1257,20 @@
    githubId = 5949913;
    name = "Carlos Fernandez Sanz";
  };
+  cge = {
+    email = "cevans@evanslabs.org";
+    github = "cgevans";
+    githubId = 2054509;
+    name = "Constantine Evans";
+    keys = [
+      { longkeyid = "rsa4096/0xB67DB1D20A93A9F9";
+        fingerprint = "32B1 6EE7 DBA5 16DE 526E  4C5A B67D B1D2 0A93 A9F9";
+      }
+      { longkeyid = "rsa4096/0x1A1D58B86AE2AABD";
+        fingerprint = "669C 1D24 5A87 DB34 6BE4  3216 1A1D 58B8 6AE2 AABD";
+      }
+    ];
+  };
  chaduffy = {
    email = "charles@dyfis.net";
    github = "charles-dyfis-net";
@ -4864,6 +4878,12 @@
    githubId = 19479662;
    name = "Kajetan Champlewski";
  };
+  millerjason = {
+    email = "mailings-github@millerjason.com";
+    github = "millerjason";
+    githubId = 7610974;
+    name = "Jason Miller";
+  };
  miltador = {
    email = "miltador@yandex.ua";
    name = "Vasiliy Solovey";
@ -4877,7 +4897,12 @@
  minijackson = {
    email = "minijackson@riseup.net";
    github = "minijackson";
+    githubId = 1200507;
    name = "Rémi Nicole";
+    keys = [{
+      longkeyid = "rsa2048/0xFEA888C9F5D64F62";
+      fingerprint = "3196 83D3 9A1B 4DE1 3DC2  51FD FEA8 88C9 F5D6 4F62";
+    }];
  };
  mirdhyn = {
    email = "mirdhyn@gmail.com";
@ -5966,6 +5991,12 @@
    githubId = 37715;
    name = "Brian McKenna";
  };
+  puzzlewolf = {
+    email = "nixos@nora.pink";
+    github = "puzzlewolf";
+    githubId = 23097564;
+    name = "Nora Widdecke";
+  };
  pxc = {
    email = "patrick.callahan@latitudeengineering.com";
    name = "Patrick Callahan";
@ -6010,6 +6041,11 @@
      fingerprint = "7573 56D7 79BB B888 773E  415E 736C CDF9 EF51 BD97";
    }];
  };
+  raboof = {
+    email = "arnout@bzzt.net";
+    github = "raboof";
+    name = "Arnout Engelen";
+  };
  rafaelgg = {
    email = "rafael.garcia.gallego@gmail.com";
    github = "rafaelgg";
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -24,8 +24,7 @@
  </para>

  <para>
-   The NixOS manual is available on virtual console 8 (press Alt+F8 to access)
-   or by running <command>nixos-help</command>.
+   The NixOS manual is available by running <command>nixos-help</command>.
  </para>

  <para>
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -648,6 +648,55 @@ auth required pam_succeed_if.so uid >= 1000 quiet
       <xref linkend="opt-environment.systemPackages"/>.
     </para>
   </listitem>
+   <listitem>
+    <para>
+     <package>nextcloud</package> has been updated to <literal>v18.0.2</literal>. This means
+     that users from NixOS 19.09 can't upgrade directly since you can only move one version
+      forward and 19.09 uses <literal>v16.0.8</literal>.
+    </para>
+    <para>
+     To provide a safe upgrade-path and to circumvent similar issues in the future, the following
+     measures were taken:
+     <itemizedlist>
+      <listitem>
+       <para>
+        The <package>pkgs.nextcloud</package>-attribute has been removed and replaced with
+        versioned attributes (currently <package>pkgs.nextcloud17</package> and
+        <package>pkgs.nextcloud18</package>). With this change major-releases can be backported
+        without breaking stuff and to make upgrade-paths easier.
+       </para>
+      </listitem>
+      <listitem>
+       <para>
+        Existing setups will be detected using
+        <link linkend="opt-system.stateVersion">system.stateVersion</link>: by default,
+        <package>nextcloud17</package> will be used, but will raise a warning which notes
+        that after that deploy it's recommended to update to the latest stable version
+        (<package>nextcloud18</package>) by declaring the newly introduced setting
+        <link linkend="opt-services.nextcloud.package">services.nextcloud.package</link>.
+       </para>
+      </listitem>
+      <listitem>
+       <para>
+        Users with an overlay (e.g. to use <package>nextcloud</package> at version
+        <literal>v18</literal> on <literal>19.09</literal>) will get an evaluation error
+        by default. This is done to ensure that our
+        <link linkend="opt-services.nextcloud.package">package</link>-option doesn't select an
+        older version by accident. It's recommended to use <package>pkgs.nextcloud18</package>
+        or to set <link linkend="opt-services.nextcloud.package">package</link> to
+        <package>pkgs.nextcloud</package> explicitly.
+       </para>
+      </listitem>
+     </itemizedlist>
+    </para>
+    <warning>
+     <para>
+      Please note that if you're comming from <literal>19.03</literal> or older, you have
+      to manually upgrade to <literal>19.09</literal> first to upgrade your server
+      to Nextcloud v16.
+     </para>
+    </warning>
+   </listitem>
  </itemizedlist>
 </section>

@ -776,6 +825,11 @@ auth required pam_succeed_if.so uid >= 1000 quiet
    not <command>systemd-networkd</command>.
   </para>
  </listitem>
+  <listitem>
+   <para>
+    <package>mongodb</package> has been updated to version <literal>3.4.24</literal>.
+   </para>
+  </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -111,6 +111,23 @@
      <link linkend="opt-security.duosec.integrationKey">security.duosec.integrationKey</link>.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The initrd SSH support now uses OpenSSH rather than Dropbear to
+     allow the use of Ed25519 keys and other OpenSSH-specific
+     functionality. Host keys must now be in the OpenSSH format, and at
+     least one pre-generated key must be specified.
+    </para>
+    <para>
+     If you used the <option>boot.initrd.network.ssh.host*Key</option>
+     options, you'll get an error explaining how to convert your host
+     keys and migrate to the new
+     <option>boot.initrd.network.ssh.hostKeys</option> option.
+     Otherwise, if you don't have any host keys set, you'll need to
+     generate some; see the <option>hostKeys</option> option
+     documentation for instructions.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@ -133,6 +133,7 @@ in {

  optionsJSON = pkgs.runCommand "options.json"
    { meta.description = "List of NixOS options in JSON format";
+      buildInputs = [ pkgs.brotli ];
    }
    ''
      # Export list of options in different format.
@ -141,8 +142,11 @@ in {

      cp ${builtins.toFile "options.json" (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix))} $dst/options.json

+      brotli -9 < $dst/options.json > $dst/options.json.br
+
      mkdir -p $out/nix-support
      echo "file json $dst/options.json" >> $out/nix-support/hydra-build-products
+      echo "file json-br $dst/options.json.br" >> $out/nix-support/hydra-build-products
    ''; # */

  optionsDocBook = pkgs.runCommand "options-docbook.xml" {} ''
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -6,6 +6,7 @@ from xml.sax.saxutils import XMLGenerator
 import _thread
 import atexit
 import base64
+import codecs
 import os
 import pathlib
 import ptpython.repl
@ -115,6 +116,7 @@ def create_vlan(vlan_nr: str) -> Tuple[str, str, "subprocess.Popen[bytes]", Any]
    fd.write("version\n")
    # TODO: perl version checks if this can be read from
    # an if not, dies. we could hang here forever. Fix it.
+    assert vde_process.stdout is not None
    vde_process.stdout.readline()
    if not os.path.exists(os.path.join(vde_socket, "ctl")):
        raise Exception("cannot start vde_switch")
@ -139,7 +141,7 @@ def retry(fn: Callable) -> None:
 class Logger:
    def __init__(self) -> None:
        self.logfile = os.environ.get("LOGFILE", "/dev/null")
-        self.logfile_handle = open(self.logfile, "wb")
+        self.logfile_handle = codecs.open(self.logfile, "wb")
        self.xml = XMLGenerator(self.logfile_handle, encoding="utf-8")
        self.queue: "Queue[Dict[str, str]]" = Queue(1000)

@ -739,6 +741,7 @@ class Machine:
        self.shell, _ = self.shell_socket.accept()

        def process_serial_output() -> None:
+            assert self.process.stdout is not None
            for _line in self.process.stdout:
                # Ignore undecodable bytes that may occur in boot menus
                line = _line.decode(errors="ignore").replace("\r", "").rstrip()
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -218,9 +218,7 @@ in
           ++ optionals config.services.xserver.enable [ desktopItem pkgs.nixos-icons ]);

      services.mingetty.helpLine = mkIf cfg.doc.enable (
-          "\nRun `nixos-help` "
-        + optionalString config.services.nixosManual.showManual "or press <Alt-F${toString config.services.nixosManual.ttyNumber}> "
-        + "for the NixOS manual."
+          "\nRun 'nixos-help' for the NixOS manual."
      );
    })

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -469,7 +469,6 @@
  ./services/misc/nix-daemon.nix
  ./services/misc/nix-gc.nix
  ./services/misc/nix-optimise.nix
-  ./services/misc/nixos-manual.nix
  ./services/misc/nix-ssh-serve.nix
  ./services/misc/novacomd.nix
  ./services/misc/nzbget.nix
@ -485,7 +484,6 @@
  ./services/misc/redmine.nix
  ./services/misc/rippled.nix
  ./services/misc/ripple-data-api.nix
-  ./services/misc/rogue.nix
  ./services/misc/serviio.nix
  ./services/misc/safeeyes.nix
  ./services/misc/sickbeard.nix
@ -692,6 +690,7 @@
  ./services/networking/prosody.nix
  ./services/networking/quagga.nix
  ./services/networking/quassel.nix
+  ./services/networking/quorum.nix
  ./services/networking/quicktun.nix
  ./services/networking/racoon.nix
  ./services/networking/radicale.nix
@ -823,6 +822,7 @@
  ./services/web-apps/documize.nix
  ./services/web-apps/dokuwiki.nix
  ./services/web-apps/frab.nix
+  ./services/web-apps/gerrit.nix
  ./services/web-apps/gotify-server.nix
  ./services/web-apps/grocy.nix
  ./services/web-apps/icingaweb2/icingaweb2.nix
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@ -26,10 +26,6 @@ with lib;

    # Show the manual.
    documentation.nixos.enable = mkForce true;
-    services.nixosManual.showManual = true;
-
-    # Let the user play Rogue on TTY 8 during the installation.
-    #services.rogue.enable = true;

    # Use less privileged nixos user
    users.users.nixos = {
--- a/nixos/modules/services/desktops/gnome3/rygel.nix
+++ b/nixos/modules/services/desktops/gnome3/rygel.nix
@ -26,5 +26,7 @@ with lib;
    services.dbus.packages = [ pkgs.gnome3.rygel ];

    systemd.packages = [ pkgs.gnome3.rygel ];
+
+    environment.etc."rygel.conf".source = "${pkgs.gnome3.rygel}/etc/rygel.conf";
  };
 }
--- a/nixos/modules/services/misc/nixos-manual.nix
+++ b/nixos/modules/services/misc/nixos-manual.nix
@ -1,73 +0,0 @@
-# This module optionally starts a browser that shows the NixOS manual
-# on one of the virtual consoles which is useful for the installation
-# CD.
-
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.nixosManual;
-  cfgd = config.documentation;
-in
-
-{
-
-  options = {
-
-    # TODO(@oxij): rename this to `.enable` eventually.
-    services.nixosManual.showManual = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to show the NixOS manual on one of the virtual
-        consoles.
-      '';
-    };
-
-    services.nixosManual.ttyNumber = mkOption {
-      type = types.int;
-      default = 8;
-      description = ''
-        Virtual console on which to show the manual.
-      '';
-    };
-
-    services.nixosManual.browser = mkOption {
-      type = types.path;
-      default = "${pkgs.w3m-nographics}/bin/w3m";
-      description = ''
-        Browser used to show the manual.
-      '';
-    };
-
-  };
-
-
-  config = mkMerge [
-    (mkIf cfg.showManual {
-      assertions = singleton {
-        assertion = cfgd.enable && cfgd.nixos.enable;
-        message   = "Can't enable `services.nixosManual.showManual` without `documentation.nixos.enable`";
-      };
-    })
-    (mkIf (cfg.showManual && cfgd.enable && cfgd.nixos.enable) {
-      console.extraTTYs = [ "tty${toString cfg.ttyNumber}" ];
-
-      systemd.services.nixos-manual = {
-        description = "NixOS Manual";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          ExecStart = "${cfg.browser} ${config.system.build.manual.manualHTMLIndex}";
-          StandardInput = "tty";
-          StandardOutput = "tty";
-          TTYPath = "/dev/tty${toString cfg.ttyNumber}";
-          TTYReset = true;
-          TTYVTDisallocate = true;
-          Restart = "always";
-        };
-      };
-    })
-  ];
-
-}
--- a/nixos/modules/services/misc/rogue.nix
+++ b/nixos/modules/services/misc/rogue.nix
@ -1,62 +0,0 @@
-# Execute the game `rogue' on tty 9.  Mostly used by the NixOS
-# installation CD.
-
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.rogue;
-
-in
-
-{
-  ###### interface
-
-  options = {
-
-    services.rogue.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to enable the Rogue game on one of the virtual
-        consoles.
-      '';
-    };
-
-    services.rogue.tty = mkOption {
-      type = types.str;
-      default = "tty9";
-      description = ''
-        Virtual console on which to run Rogue.
-      '';
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-
-    console.extraTTYs = [ cfg.tty ];
-
-    systemd.services.rogue =
-      { description = "Rogue dungeon crawling game";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig =
-          { ExecStart = "${pkgs.rogue}/bin/rogue";
-            StandardInput = "tty";
-            StandardOutput = "tty";
-            TTYPath = "/dev/${cfg.tty}";
-            TTYReset = true;
-            TTYVTDisallocate = true;
-            WorkingDirectory = "/tmp";
-            Restart = "always";
-          };
-      };
-
-  };
-
-}
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@ -155,7 +155,7 @@ in {

      systemd.services.alertmanager = {
        wantedBy = [ "multi-user.target" ];
-        after    = [ "network.target" ];
+        after    = [ "network-online.target" ];
        preStart = ''
           ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/tmp/alert-manager-substituted.yaml" \
                                                    -i "${alertmanagerYml}"
--- a/nixos/modules/services/networking/quorum.nix
+++ b/nixos/modules/services/networking/quorum.nix
@ -0,0 +1,229 @@
+{ config, pkgs, lib, ... }:
+let
+
+  inherit (lib) mkEnableOption mkIf mkOption literalExample types optionalString;
+
+  cfg = config.services.quorum;
+  dataDir = "/var/lib/quorum";
+  genesisFile = pkgs.writeText "genesis.json" (builtins.toJSON cfg.genesis);
+  staticNodesFile = pkgs.writeText "static-nodes.json" (builtins.toJSON cfg.staticNodes);
+
+in {
+  options = {
+
+    services.quorum = {
+      enable = mkEnableOption "Quorum blockchain daemon";
+
+      user = mkOption {
+        type = types.str;
+        default = "quorum";
+        description = "The user as which to run quorum.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = cfg.user;
+        description = "The group as which to run quorum.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 21000;
+        description = "Override the default port on which to listen for connections.";
+      };
+
+      nodekeyFile = mkOption {
+        type = types.path;
+        default = "${dataDir}/nodekey";
+        description = "Path to the nodekey.";
+      };
+
+      staticNodes = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "enode://dd333ec28f0a8910c92eb4d336461eea1c20803eed9cf2c056557f986e720f8e693605bba2f4e8f289b1162e5ac7c80c914c7178130711e393ca76abc1d92f57@0.0.0.0:30303?discport=0" ];
+        description = "List of validator nodes.";
+      };
+
+      privateconfig = mkOption {
+        type = types.str;
+        default = "ignore";
+        description = "Configuration of privacy transaction manager.";
+      };
+
+      syncmode = mkOption {
+        type = types.enum [ "fast" "full" "light" ];
+        default = "full";
+        description = "Blockchain sync mode.";
+      };
+
+      blockperiod = mkOption {
+        type = types.int;
+        default = 5;
+        description = "Default minimum difference between two consecutive block's timestamps in seconds.";
+      };
+
+      permissioned = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Allow only a defined list of nodes to connect.";
+      };
+
+      rpc = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Enable RPC interface.";
+        };
+
+        address = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = "Listening address for RPC connections.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 22004;
+          description = "Override the default port on which to listen for RPC connections.";
+        };
+
+        api = mkOption {
+          type = types.str;
+          default = "admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,istanbul";
+          description = "API's offered over the HTTP-RPC interface.";
+        };
+      };
+
+     ws = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Enable WS-RPC interface.";
+        };
+
+        address = mkOption {
+          type = types.str;
+          default = "0.0.0.0";
+          description = "Listening address for WS-RPC connections.";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 8546;
+          description = "Override the default port on which to listen for WS-RPC connections.";
+        };
+
+        api = mkOption {
+          type = types.str;
+          default = "admin,db,eth,debug,miner,net,shh,txpool,personal,web3,quorum,istanbul";
+          description = "API's offered over the WS-RPC interface.";
+        };
+
+       origins = mkOption {
+          type = types.str;
+          default = "*";
+          description = "Origins from which to accept websockets requests";
+       };
+     };
+
+      genesis = mkOption {
+        type = types.nullOr types.attrs;
+        default = null;
+        example = literalExample '' {
+          alloc = {
+            a47385db68718bdcbddc2d2bb7c54018066ec111 = {
+              balance = "1000000000000000000000000000";
+            };
+          };
+          coinbase = "0x0000000000000000000000000000000000000000";
+          config = {
+            byzantiumBlock = 4;
+            chainId = 494702925;
+            eip150Block = 2;
+            eip155Block = 3;
+            eip158Block = 3;
+            homesteadBlock = 1;
+            isQuorum = true;
+            istanbul = {
+              epoch = 30000;
+              policy = 0;
+            };
+          };
+          difficulty = "0x1";
+          extraData = "0x0000000000000000000000000000000000000000000000000000000000000000f85ad59438f0508111273d8e482f49410ca4078afc86a961b8410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0";
+          gasLimit = "0x2FEFD800";
+          mixHash = "0x63746963616c2062797a616e74696e65201111756c7420746f6c6572616e6365";
+          nonce = "0x0";
+          parentHash = "0x0000000000000000000000000000000000000000000000000000000000000000";
+          timestamp = "0x00";
+          }'';
+        description = "Blockchain genesis settings.";
+      };
+     };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.quorum ];
+    systemd.tmpfiles.rules = [
+      "d '${dataDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
+    ];
+    systemd.services.quorum = {
+      description = "Quorum daemon";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        PRIVATE_CONFIG = "${cfg.privateconfig}";
+      };
+      preStart = ''
+        if [ ! -d ${dataDir}/geth ]; then
+          if [ ! -d ${dataDir}/keystore ]; then
+            echo ERROR: You need to create a wallet before initializing your genesis file, run:
+            echo   # su -s /bin/sh - quorum
+            echo   $ geth --datadir ${dataDir} account new
+            echo and configure your genesis file accordingly.
+            exit 1;
+          fi
+          ln -s ${staticNodesFile} ${dataDir}/static-nodes.json
+          ${pkgs.quorum}/bin/geth --datadir ${dataDir} init ${genesisFile}
+        fi
+      '';
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = ''${pkgs.quorum}/bin/geth \
+            --nodiscover \
+            --verbosity 5 \
+            --nodekey ${cfg.nodekeyFile} \
+            --istanbul.blockperiod ${toString cfg.blockperiod} \
+            --syncmode ${cfg.syncmode} \
+            ${optionalString (cfg.permissioned)
+            "--permissioned"} \
+            --mine --minerthreads 1 \
+            ${optionalString (cfg.rpc.enable)
+            "--rpc --rpcaddr ${cfg.rpc.address} --rpcport ${toString cfg.rpc.port} --rpcapi ${cfg.rpc.api}"} \
+            ${optionalString (cfg.ws.enable)
+            "--ws --wsaddr ${cfg.ws.address} --wsport ${toString cfg.ws.port} --wsapi ${cfg.ws.api} --wsorigins ${cfg.ws.origins}"} \
+            --emitcheckpoints \
+            --datadir ${dataDir} \
+            --port ${toString cfg.port}'';
+        Restart = "on-failure";
+
+        # Hardening measures
+        PrivateTmp = "true";
+        ProtectSystem = "full";
+        NoNewPrivileges = "true";
+        PrivateDevices = "true";
+        MemoryDenyWriteExecute = "true";
+      };
+    };
+    users.users.${cfg.user} = {
+      name = cfg.user;
+      group = cfg.group;
+      description = "Quorum daemon user";
+      home = dataDir;
+      isSystemUser = true;
+    };
+    users.groups.${cfg.group} = {};
+  };
+}
--- a/nixos/modules/services/scheduling/atd.nix
+++ b/nixos/modules/services/scheduling/atd.nix
@ -67,8 +67,6 @@ in

    systemd.services.atd = {
      description = "Job Execution Daemon (atd)";
-      after = [ "systemd-udev-settle.service" ];
-      wants = [ "systemd-udev-settle.service" ];
      wantedBy = [ "multi-user.target" ];

      path = [ at ];
--- a/nixos/modules/services/web-apps/gerrit.nix
+++ b/nixos/modules/services/web-apps/gerrit.nix
@ -0,0 +1,218 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.gerrit;
+
+  # NixOS option type for git-like configs
+  gitIniType = with types;
+    let
+      primitiveType = either str (either bool int);
+      multipleType = either primitiveType (listOf primitiveType);
+      sectionType = lazyAttrsOf multipleType;
+      supersectionType = lazyAttrsOf (either multipleType sectionType);
+    in lazyAttrsOf supersectionType;
+
+  gerritConfig = pkgs.writeText "gerrit.conf" (
+    lib.generators.toGitINI cfg.settings
+  );
+
+  # Wrap the gerrit java with all the java options so it can be called
+  # like a normal CLI app
+  gerrit-cli = pkgs.writeShellScriptBin "gerrit" ''
+    set -euo pipefail
+    jvmOpts=(
+      ${lib.escapeShellArgs cfg.jvmOpts}
+      -Xmx${cfg.jvmHeapLimit}
+    )
+    exec ${cfg.jvmPackage}/bin/java \
+      "''${jvmOpts[@]}" \
+      -jar ${cfg.package}/webapps/${cfg.package.name}.war \
+      "$@"
+  '';
+
+  gerrit-plugins = pkgs.runCommand
+    "gerrit-plugins"
+    {
+      buildInputs = [ gerrit-cli ];
+    }
+    ''
+      shopt -s nullglob
+      mkdir $out
+
+      for name in ${toString cfg.builtinPlugins}; do
+        echo "Installing builtin plugin $name.jar"
+        gerrit cat plugins/$name.jar > $out/$name.jar
+      done
+
+      for file in ${toString cfg.plugins}; do
+        name=$(echo "$file" | cut -d - -f 2-)
+        echo "Installing plugin $name"
+        ln -sf "$file" $out/$name
+      done
+    '';
+in
+{
+  options = {
+    services.gerrit = {
+      enable = mkEnableOption "Gerrit service";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.gerrit;
+        description = "Gerrit package to use";
+      };
+
+      jvmPackage = mkOption {
+        type = types.package;
+        default = pkgs.jre_headless;
+        defaultText = "pkgs.jre_headless";
+        description = "Java Runtime Environment package to use";
+      };
+
+      jvmOpts = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "-Dflogger.backend_factory=com.google.common.flogger.backend.log4j.Log4jBackendFactory#getInstance"
+          "-Dflogger.logging_context=com.google.gerrit.server.logging.LoggingContext#getInstance"
+        ];
+        description = "A list of JVM options to start gerrit with.";
+      };
+
+      jvmHeapLimit = mkOption {
+        type = types.str;
+        default = "1024m";
+        description = ''
+          How much memory to allocate to the JVM heap
+        '';
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = "[::]:8080";
+        description = ''
+          <literal>hostname:port</literal> to listen for HTTP traffic.
+
+          This is bound using the systemd socket activation.
+        '';
+      };
+
+      settings = mkOption {
+        type = gitIniType;
+        default = {};
+        description = ''
+          Gerrit configuration. This will be generated to the
+          <literal>etc/gerrit.config</literal> file.
+        '';
+      };
+
+      plugins = mkOption {
+        type = types.listOf types.package;
+        default = [];
+        description = ''
+          List of plugins to add to Gerrit. Each derivation is a jar file
+          itself where the name of the derivation is the name of plugin.
+        '';
+      };
+
+      builtinPlugins = mkOption {
+        type = types.listOf (types.enum cfg.package.passthru.plugins);
+        default = [];
+        description = ''
+          List of builtins plugins to install. Those are shipped in the
+          <literal>gerrit.war</literal> file.
+        '';
+      };
+
+      serverId = mkOption {
+        type = types.str;
+        description = ''
+          Set a UUID that uniquely identifies the server.
+
+          This can be generated with
+          <literal>nix-shell -p utillinux --run uuidgen</literal>.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    services.gerrit.settings = {
+      cache.directory = "/var/cache/gerrit";
+      container.heapLimit = cfg.jvmHeapLimit;
+      gerrit.basePath = lib.mkDefault "git";
+      gerrit.serverId = cfg.serverId;
+      httpd.inheritChannel = "true";
+      httpd.listenUrl = lib.mkDefault "http://${cfg.listenAddress}";
+      index.type = lib.mkDefault "lucene";
+    };
+
+    # Add the gerrit CLI to the system to run `gerrit init` and friends.
+    environment.systemPackages = [ gerrit-cli ];
+
+    systemd.sockets.gerrit = {
+      unitConfig.Description = "Gerrit HTTP socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [ cfg.listenAddress ];
+    };
+
+    systemd.services.gerrit = {
+      description = "Gerrit";
+
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "gerrit.socket" ];
+      after = [ "gerrit.socket" "network.target" ];
+
+      path = [
+        gerrit-cli
+        pkgs.bash
+        pkgs.coreutils
+        pkgs.git
+        pkgs.openssh
+      ];
+
+      environment = {
+        GERRIT_HOME = "%S/gerrit";
+        GERRIT_TMP = "%T";
+        HOME = "%S/gerrit";
+        XDG_CONFIG_HOME = "%S/gerrit/.config";
+      };
+
+      preStart = ''
+        set -euo pipefail
+
+        # bootstrap if nothing exists
+        if [[ ! -d git ]]; then
+          gerrit init --batch --no-auto-start
+        fi
+
+        # install gerrit.war for the plugin manager
+        rm -rf bin
+        mkdir bin
+        ln -sfv ${cfg.package}/webapps/${cfg.package.name}.war bin/gerrit.war
+
+        # copy the config, keep it mutable because Gerrit
+        ln -sfv ${gerritConfig} etc/gerrit.config
+
+        # install the plugins
+        rm -rf plugins
+        ln -sv ${gerrit-plugins} plugins
+      ''
+      ;
+
+      serviceConfig = {
+        CacheDirectory = "gerrit";
+        DynamicUser = true;
+        ExecStart = "${gerrit-cli}/bin/gerrit daemon --console-log";
+        LimitNOFILE = 4096;
+        StandardInput = "socket";
+        StandardOutput = "journal";
+        StateDirectory = "gerrit";
+        WorkingDirectory = "%S/gerrit";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ edef zimbatm ];
+}
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -30,7 +30,7 @@ let

  occ = pkgs.writeScriptBin "nextcloud-occ" ''
    #! ${pkgs.stdenv.shell}
-    cd ${pkgs.nextcloud}
+    cd ${cfg.package}
    sudo=exec
    if [[ "$USER" != nextcloud ]]; then
      sudo='exec /run/wrappers/bin/sudo -u nextcloud --preserve-env=NEXTCLOUD_CONFIG_DIR'
@ -42,6 +42,8 @@ let
      occ $*
  '';

+  inherit (config.system) stateVersion;
+
 in {
  options.services.nextcloud = {
    enable = mkEnableOption "nextcloud";
@ -64,6 +66,11 @@ in {
      default = false;
      description = "Use https for generated links.";
    };
+    package = mkOption {
+      type = types.package;
+      description = "Which package to use for the Nextcloud instance.";
+      relatedPackages = [ "nextcloud17" "nextcloud18" ];
+    };

    maxUploadSize = mkOption {
      default = "512M";
@ -309,10 +316,31 @@ in {
        }
      ];

-      warnings = optional (cfg.poolConfig != null) ''
+      warnings = []
+        ++ (optional (cfg.poolConfig != null) ''
          Using config.services.nextcloud.poolConfig is deprecated and will become unsupported in a future release.
          Please migrate your configuration to config.services.nextcloud.poolSettings.
-      '';
+        '')
+        ++ (optional (versionOlder cfg.package.version "18") ''
+          You're currently deploying an older version of Nextcloud. This may be needed
+          since Nextcloud doesn't allow major version upgrades across multiple versions (i.e. an
+          upgrade from 16 is possible to 17, but not to 18).
+
+          Please deploy this to your server and wait until the migration is finished. After
+          that you can deploy to the latest Nextcloud version available.
+        '');
+
+      services.nextcloud.package = with pkgs;
+        mkDefault (
+          if pkgs ? nextcloud
+            then throw ''
+              The `pkgs.nextcloud`-attribute has been removed. If it's supposed to be the default
+              nextcloud defined in an overlay, please set `services.nextcloud.package` to
+              `pkgs.nextcloud`.
+            ''
+          else if versionOlder stateVersion "20.03" then nextcloud17
+          else nextcloud18
+        );
    }

    { systemd.timers.nextcloud-cron = {
@ -407,7 +435,7 @@ in {
          path = [ occ ];
          script = ''
            chmod og+x ${cfg.home}
-            ln -sf ${pkgs.nextcloud}/apps ${cfg.home}/
+            ln -sf ${cfg.package}/apps ${cfg.home}/
            mkdir -p ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps
            ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php

@ -429,7 +457,7 @@ in {
          environment.NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config";
          serviceConfig.Type = "oneshot";
          serviceConfig.User = "nextcloud";
-          serviceConfig.ExecStart = "${phpPackage}/bin/php -f ${pkgs.nextcloud}/cron.php";
+          serviceConfig.ExecStart = "${phpPackage}/bin/php -f ${cfg.package}/cron.php";
        };
        nextcloud-update-plugins = mkIf cfg.autoUpdateApps.enable {
          serviceConfig.Type = "oneshot";
@ -471,7 +499,7 @@ in {
        enable = true;
        virtualHosts = {
          ${cfg.hostName} = {
-            root = pkgs.nextcloud;
+            root = cfg.package;
            locations = {
              "= /robots.txt" = {
                priority = 100;
--- a/nixos/modules/services/web-apps/nextcloud.xml
+++ b/nixos/modules/services/web-apps/nextcloud.xml
@ -113,5 +113,53 @@
   maintenance:install</literal>! This command tries to install the application
   and can cause unwanted side-effects!</para>
  </warning>
+
+  <para>
+   Nextcloud doesn't allow to move more than one major-version forward. If you're e.g. on
+   <literal>v16</literal>, you cannot upgrade to <literal>v18</literal>, you need to upgrade to
+   <literal>v17</literal> first. This is ensured automatically as long as the
+   <link linkend="opt-system.stateVersion">stateVersion</link> is declared properly. In that case
+   the oldest version available (one major behind the one from the previous NixOS
+   release) will be selected by default and the module will generate a warning that reminds
+   the user to upgrade to latest Nextcloud <emphasis>after</emphasis> that deploy.
+  </para>
+ </section>
+
+ <section xml:id="module-services-nextcloud-maintainer-info">
+  <title>Maintainer information</title>
+
+  <para>
+   As stated in the previous paragraph, we must provide a clean upgrade-path for Nextcloud
+   since it cannot move more than one major version forward on a single upgrade. This chapter
+   adds some notes how Nextcloud updates should be rolled out in the future.
+  </para>
+
+  <para>
+   While minor and patch-level updates are no problem and can be done directly in the
+   package-expression (and should be backported to supported stable branches after that),
+   major-releases should be added in a new attribute (e.g. Nextcloud <literal>v19.0.0</literal>
+   should be available in <literal>nixpkgs</literal> as <literal>pkgs.nextcloud19</literal>).
+   To provide simple upgrade paths it's generally useful to backport those as well to stable
+   branches. As long as the package-default isn't altered, this won't break existing setups.
+   After that, the versioning-warning in the <literal>nextcloud</literal>-module should be
+   updated to make sure that the
+   <link linkend="opt-services.nextcloud.package">package</link>-option selects the latest version
+   on fresh setups.
+  </para>
+
+  <para>
+   If major-releases will be abandoned by upstream, we should check first if those are needed
+   in NixOS for a safe upgrade-path before removing those. In that case we shold keep those
+   packages, but mark them as insecure in an expression like this (in
+   <literal>&lt;nixpkgs/pkgs/servers/nextcloud/default.nix&gt;</literal>):
+<programlisting>/* ... */
+{
+  nextcloud17 = generic {
+    version = "17.0.x";
+    sha256 = "0000000000000000000000000000000000000000000000000000";
+    insecure = true;
+  };
+}</programlisting>
+  </para>
 </section>
 </chapter>
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -46,6 +46,15 @@ let
    }
  ''));

+  commonHttpConfig = ''
+      # The mime type definitions included with nginx are very incomplete, so
+      # we use a list of mime types from the mailcap package, which is also
+      # used by most other Linux distributions by default.
+      include ${pkgs.mailcap}/etc/nginx/mime.types;
+      include ${cfg.package}/conf/fastcgi.conf;
+      include ${cfg.package}/conf/uwsgi_params;
+  '';
+
  configFile = pkgs.writers.writeNginxConfig "nginx.conf" ''
    pid /run/nginx/nginx.pid;
    error_log ${cfg.logError};
@ -61,12 +70,7 @@ let

    ${optionalString (cfg.httpConfig == "" && cfg.config == "") ''
    http {
-      # The mime type definitions included with nginx are very incomplete, so
-      # we use a list of mime types from the mailcap package, which is also
-      # used by most other Linux distributions by default.
-      include ${pkgs.mailcap}/etc/nginx/mime.types;
-      include ${cfg.package}/conf/fastcgi.conf;
-      include ${cfg.package}/conf/uwsgi_params;
+      ${commonHttpConfig}

      ${optionalString (cfg.resolver.addresses != []) ''
        resolver ${toString cfg.resolver.addresses} ${optionalString (cfg.resolver.valid != "") "valid=${cfg.resolver.valid}"} ${optionalString (!cfg.resolver.ipv6) "ipv6=off"};
@ -79,7 +83,7 @@ let
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
-        types_hash_max_size 2048;
+        types_hash_max_size 4096;
      ''}

      ssl_protocols ${cfg.sslProtocols};
@ -172,9 +176,7 @@ let

    ${optionalString (cfg.httpConfig != "") ''
    http {
-      include ${cfg.package}/conf/mime.types;
-      include ${cfg.package}/conf/fastcgi.conf;
-      include ${cfg.package}/conf/uwsgi_params;
+      ${common.httpConfig}
      ${cfg.httpConfig}
    }''}

--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -651,8 +651,7 @@ in
    systemd.services.display-manager =
      { description = "X11 Server";

-        after = [ "systemd-udev-settle.service" "acpid.service" "systemd-logind.service" ];
-        wants = [ "systemd-udev-settle.service" ];
+        after = [ "acpid.service" "systemd-logind.service" ];

        restartIfChanged = false;

--- a/nixos/modules/system/boot/initrd-ssh.nix
+++ b/nixos/modules/system/boot/initrd-ssh.nix
@ -10,19 +10,21 @@ in

 {

-  options = {
-
-    boot.initrd.network.ssh.enable = mkOption {
+  options.boot.initrd.network.ssh = {
+    enable = mkOption {
      type = types.bool;
      default = false;
      description = ''
        Start SSH service during initrd boot. It can be used to debug failing
        boot on a remote server, enter pasphrase for an encrypted partition etc.
        Service is killed when stage-1 boot is finished.
+
+        The sshd configuration is largely inherited from
+        <option>services.openssh</option>.
      '';
    };

-    boot.initrd.network.ssh.port = mkOption {
+    port = mkOption {
      type = types.int;
      default = 22;
      description = ''
@ -30,7 +32,7 @@ in
      '';
    };

-    boot.initrd.network.ssh.shell = mkOption {
+    shell = mkOption {
      type = types.str;
      default = "/bin/ash";
      description = ''
@ -38,95 +40,163 @@ in
      '';
    };

-    boot.initrd.network.ssh.hostRSAKey = mkOption {
-      type = types.nullOr types.path;
-      default = null;
+    hostKeys = mkOption {
+      type = types.listOf (types.either types.str types.path);
+      default = [];
+      example = [
+        "/etc/secrets/initrd/ssh_host_rsa_key"
+        "/etc/secrets/initrd/ssh_host_ed25519_key"
+      ];
      description = ''
-        RSA SSH private key file in the Dropbear format.
+        Specify SSH host keys to import into the initrd.

-        WARNING: Unless your bootloader supports initrd secrets, this key is
-        contained insecurely in the global Nix store. Do NOT use your regular
-        SSH host private keys for this purpose or you'll expose them to
-        regular users!
+        To generate keys, use
+        <citerefentry><refentrytitle>ssh-keygen</refentrytitle><manvolnum>1</manvolnum></citerefentry>:
+
+        <screen>
+        <prompt># </prompt>ssh-keygen -t rsa -N "" -f /etc/secrets/initrd/ssh_host_rsa_key
+        <prompt># </prompt>ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed_25519_key
+        </screen>
+
+        <warning>
+          <para>
+            Unless your bootloader supports initrd secrets, these keys
+            are stored insecurely in the global Nix store. Do NOT use
+            your regular SSH host private keys for this purpose or
+            you'll expose them to regular users!
+          </para>
+          <para>
+            Additionally, even if your initrd supports secrets, if
+            you're using initrd SSH to unlock an encrypted disk then
+            using your regular host keys exposes the private keys on
+            your unencrypted boot partition.
+          </para>
+        </warning>
      '';
    };

-    boot.initrd.network.ssh.hostDSSKey = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        DSS SSH private key file in the Dropbear format.
-
-        WARNING: Unless your bootloader supports initrd secrets, this key is
-        contained insecurely in the global Nix store. Do NOT use your regular
-        SSH host private keys for this purpose or you'll expose them to
-        regular users!
-      '';
-    };
-
-    boot.initrd.network.ssh.hostECDSAKey = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        ECDSA SSH private key file in the Dropbear format.
-
-        WARNING: Unless your bootloader supports initrd secrets, this key is
-        contained insecurely in the global Nix store. Do NOT use your regular
-        SSH host private keys for this purpose or you'll expose them to
-        regular users!
-      '';
-    };
-
-    boot.initrd.network.ssh.authorizedKeys = mkOption {
+    authorizedKeys = mkOption {
      type = types.listOf types.str;
      default = config.users.users.root.openssh.authorizedKeys.keys;
+      defaultText = "config.users.users.root.openssh.authorizedKeys.keys";
      description = ''
        Authorized keys for the root user on initrd.
-        Note that Dropbear doesn't support OpenSSH's Ed25519 key type.
      '';
    };
-
  };

-  config = mkIf (config.boot.initrd.network.enable && cfg.enable) {
+  imports =
+    map (opt: mkRemovedOptionModule ([ "boot" "initrd" "network" "ssh" ] ++ [ opt ]) ''
+      The initrd SSH functionality now uses OpenSSH rather than Dropbear.
+
+      If you want to keep your existing initrd SSH host keys, convert them with
+        $ dropbearconvert dropbear openssh dropbear_host_$type_key ssh_host_$type_key
+      and then set options.boot.initrd.network.ssh.hostKeys.
+    '') [ "hostRSAKey" "hostDSSKey" "hostECDSAKey" ];
+
+  config = let
+    # Nix complains if you include a store hash in initrd path names, so
+    # as an awful hack we drop the first character of the hash.
+    initrdKeyPath = path: if isString path
+      then path
+      else let name = builtins.baseNameOf path; in
+        builtins.unsafeDiscardStringContext ("/etc/ssh/" +
+          substring 1 (stringLength name) name);
+
+    sshdCfg = config.services.openssh;
+
+    sshdConfig = ''
+      Port ${toString cfg.port}
+
+      PasswordAuthentication no
+      ChallengeResponseAuthentication no
+
+      ${flip concatMapStrings cfg.hostKeys (path: ''
+        HostKey ${initrdKeyPath path}
+      '')}
+
+      KexAlgorithms ${concatStringsSep "," sshdCfg.kexAlgorithms}
+      Ciphers ${concatStringsSep "," sshdCfg.ciphers}
+      MACs ${concatStringsSep "," sshdCfg.macs}
+
+      LogLevel ${sshdCfg.logLevel}
+
+      ${if sshdCfg.useDns then ''
+        UseDNS yes
+      '' else ''
+        UseDNS no
+      ''}
+    '';
+  in mkIf (config.boot.initrd.network.enable && cfg.enable) {
    assertions = [
-      { assertion = cfg.authorizedKeys != [];
+      {
+        assertion = cfg.authorizedKeys != [];
        message = "You should specify at least one authorized key for initrd SSH";
      }
+
+      {
+        assertion = cfg.hostKeys != [];
+        message = ''
+          You must now pre-generate the host keys for initrd SSH.
+          See the boot.inird.network.ssh.hostKeys documentation
+          for instructions.
+        '';
+      }
    ];

    boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs ${pkgs.dropbear}/bin/dropbear
+      copy_bin_and_libs ${pkgs.openssh}/bin/sshd
      cp -pv ${pkgs.glibc.out}/lib/libnss_files.so.* $out/lib
    '';

    boot.initrd.extraUtilsCommandsTest = ''
-      $out/bin/dropbear -V
+      # sshd requires a host key to check config, so we pass in the test's
+      echo -n ${escapeShellArg sshdConfig} |
+        $out/bin/sshd -t -f /dev/stdin \
+        -h ${../../../tests/initrd-network-ssh/ssh_host_ed25519_key}
    '';

    boot.initrd.network.postCommands = ''
      echo '${cfg.shell}' > /etc/shells
      echo 'root:x:0:0:root:/root:${cfg.shell}' > /etc/passwd
+      echo 'sshd:x:1:1:sshd:/var/empty:/bin/nologin' >> /etc/passwd
      echo 'passwd: files' > /etc/nsswitch.conf

-      mkdir -p /var/log
+      mkdir -p /var/log /var/empty
      touch /var/log/lastlog

-      mkdir -p /etc/dropbear
+      mkdir -p /etc/ssh
+      echo -n ${escapeShellArg sshdConfig} > /etc/ssh/sshd_config
+
+      echo "export PATH=$PATH" >> /etc/profile
+      echo "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH" >> /etc/profile

      mkdir -p /root/.ssh
      ${concatStrings (map (key: ''
        echo ${escapeShellArg key} >> /root/.ssh/authorized_keys
      '') cfg.authorizedKeys)}

-      dropbear -s -j -k -E -p ${toString cfg.port} ${optionalString (cfg.hostRSAKey == null && cfg.hostDSSKey == null && cfg.hostECDSAKey == null) "-R"}
+      ${flip concatMapStrings cfg.hostKeys (path: ''
+        # keys from Nix store are world-readable, which sshd doesn't like
+        chmod 0600 "${initrdKeyPath path}"
+      '')}
+
+      /bin/sshd -e
    '';

-    boot.initrd.secrets =
-     (optionalAttrs (cfg.hostRSAKey != null) { "/etc/dropbear/dropbear_rsa_host_key" = cfg.hostRSAKey; }) //
-     (optionalAttrs (cfg.hostDSSKey != null) { "/etc/dropbear/dropbear_dss_host_key" = cfg.hostDSSKey; }) //
-     (optionalAttrs (cfg.hostECDSAKey != null) { "/etc/dropbear/dropbear_ecdsa_host_key" = cfg.hostECDSAKey; });
+    boot.initrd.postMountCommands = ''
+      # Stop sshd cleanly before stage 2.
+      #
+      # If you want to keep it around to debug post-mount SSH issues,
+      # run `touch /.keep_sshd` (either from an SSH session or in
+      # another initrd hook like preDeviceCommands).
+      if ! [ -e /.keep_sshd ]; then
+        pkill -x sshd
+      fi
+    '';

+    boot.initrd.secrets = listToAttrs
+      (map (path: nameValuePair (initrdKeyPath path) path) cfg.hostKeys);
  };

 }
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -142,7 +142,10 @@ let
             let source' = if source == null then dest else source; in
               ''
                  mkdir -p $(dirname "$out/secrets/${dest}")
-                  cp -a ${source'} "$out/secrets/${dest}"
+                  # Some programs (e.g. ssh) doesn't like secrets to be
+                  # symlinks, so we use `cp -L` here to match the
+                  # behaviour when secrets are natively supported.
+                  cp -Lr ${source'} "$out/secrets/${dest}"
                ''
          ) config.boot.initrd.secrets))
       }
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -478,6 +478,7 @@ in
        createImportService = pool:
          nameValuePair "zfs-import-${pool}" {
            description = "Import ZFS pool \"${pool}\"";
+            # we need systemd-udev-settle until https://github.com/zfsonlinux/zfs/pull/4943 is merged
            requires = [ "systemd-udev-settle.service" ];
            after = [ "systemd-udev-settle.service" "systemd-modules-load.service" ];
            wantedBy = (getPoolMounts pool) ++ [ "local-fs.target" ];
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@ -28,7 +28,7 @@ let
 in rec {

  nixos = {
-    inherit (nixos') channel manual iso_minimal dummy;
+    inherit (nixos') channel manual options iso_minimal dummy;
    tests = {
      inherit (nixos'.tests)
        containers-imperative
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -97,6 +97,7 @@ in
  fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix {};
  freeswitch = handleTest ./freeswitch.nix {};
  fsck = handleTest ./fsck.nix {};
+  gerrit = handleTest ./gerrit.nix {};
  gotify-server = handleTest ./gotify-server.nix {};
  grocy = handleTest ./grocy.nix {};
  gitdaemon = handleTest ./gitdaemon.nix {};
@ -210,6 +211,7 @@ in
  nghttpx = handleTest ./nghttpx.nix {};
  nginx = handleTest ./nginx.nix {};
  nginx-etag = handleTest ./nginx-etag.nix {};
+  nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
  nginx-sso = handleTest ./nginx-sso.nix {};
  nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
  nixos-generate-config = handleTest ./nixos-generate-config.nix {};
@ -250,6 +252,7 @@ in
  prosodyMysql = handleTest ./xmpp/prosody-mysql.nix {};
  proxy = handleTest ./proxy.nix {};
  quagga = handleTest ./quagga.nix {};
+  quorum = handleTest ./quorum.nix {};
  rabbitmq = handleTest ./rabbitmq.nix {};
  radarr = handleTest ./radarr.nix {};
  radicale = handleTest ./radicale.nix {};
@ -306,6 +309,7 @@ in
  vault = handleTest ./vault.nix {};
  victoriametrics = handleTest ./victoriametrics.nix {};
  virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
+  wg-quick = handleTest ./wireguard/wg-quick.nix {};
  wireguard = handleTest ./wireguard {};
  wireguard-generated = handleTest ./wireguard/generated.nix {};
  wireguard-namespaces = handleTest ./wireguard/namespaces.nix {};
--- a/nixos/tests/gerrit.nix
+++ b/nixos/tests/gerrit.nix
@ -0,0 +1,56 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  lfs = pkgs.fetchurl {
+    url = "https://gerrit-ci.gerritforge.com/job/plugin-lfs-bazel-master/90/artifact/bazel-bin/plugins/lfs/lfs.jar";
+    sha256 = "023b0kd8djm3cn1lf1xl67yv3j12yl8bxccn42lkfmwxjwjfqw6h";
+  };
+
+in {
+  name = "gerrit";
+
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ flokli zimbatm ];
+  };
+
+  nodes = {
+    server =
+      { config, pkgs, ... }: {
+        networking.firewall.allowedTCPPorts = [ 80 2222 ];
+
+        virtualisation.memorySize = 1024;
+
+        services.gerrit = {
+          enable = true;
+          serverId = "aa76c84b-50b0-4711-a0a0-1ee30e45bbd0";
+          listenAddress = "[::]:80";
+          jvmPackage = pkgs.jdk12_headless;
+          jvmHeapLimit = "1g";
+
+          plugins = [ lfs ];
+          builtinPlugins = [ "hooks" "webhooks" ];
+          settings = {
+            gerrit.canonicalWebUrl = "http://server";
+            lfs.plugin = "lfs";
+            plugins.allowRemoteAdmin = true;
+            sshd.listenAddress = "[::]:2222";
+            sshd.advertisedAddress = "[::]:2222";
+          };
+        };
+      };
+
+    client =
+      { ... }: {
+      };
+  };
+
+  testScript = ''
+    start_all()
+    server.wait_for_unit("gerrit.service")
+    server.wait_for_open_port(80)
+    client.succeed("curl http://server")
+
+    server.wait_for_open_port(2222)
+    client.succeed("nc -z server 2222")
+  '';
+})
--- a/nixos/tests/initrd-network-ssh/default.nix
+++ b/nixos/tests/initrd-network-ssh/default.nix
@ -3,7 +3,7 @@ import ../make-test-python.nix ({ lib, ... }:
 {
  name = "initrd-network-ssh";
  meta = with lib.maintainers; {
-    maintainers = [ willibutz ];
+    maintainers = [ willibutz emily ];
  };

  nodes = with lib; {
@ -17,9 +17,9 @@ import ../make-test-python.nix ({ lib, ... }:
          enable = true;
          ssh = {
            enable = true;
-            authorizedKeys = [ "${readFile ./openssh.pub}" ];
+            authorizedKeys = [ (readFile ./id_ed25519.pub) ];
            port = 22;
-            hostRSAKey = ./dropbear.priv;
+            hostKeys = [ ./ssh_host_ed25519_key ];
          };
        };
        boot.initrd.preLVMCommands = ''
@ -42,11 +42,11 @@ import ../make-test-python.nix ({ lib, ... }:
              "${toString (head (splitString " " (
                toString (elemAt (splitString "\n" config.networking.extraHosts) 2)
              )))} "
-              "${readFile ./dropbear.pub}"
+              "${readFile ./ssh_host_ed25519_key.pub}"
            ];
          };
          sshKey = {
-            source = ./openssh.priv; # dont use this anywhere else
+            source = ./id_ed25519;
            mode = "0600";
          };
        };
@ -56,7 +56,17 @@ import ../make-test-python.nix ({ lib, ... }:
  testScript = ''
    start_all()
    client.wait_for_unit("network.target")
-    client.wait_until_succeeds("ping -c 1 server")
+
+
+    def ssh_is_up(_) -> bool:
+        status, _ = client.execute("nc -z server 22")
+        return status == 0
+
+
+    with client.nested("waiting for SSH server to come up"):
+        retry(ssh_is_up)
+
+
    client.succeed(
        "ssh -i /etc/sshKey -o UserKnownHostsFile=/etc/knownHosts server 'touch /fnord'"
    )
--- a/nixos/tests/initrd-network-ssh/dropbear.priv
+++ b/nixos/tests/initrd-network-ssh/dropbear.priv
--- a/nixos/tests/initrd-network-ssh/dropbear.pub
+++ b/nixos/tests/initrd-network-ssh/dropbear.pub
@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzJ0OniLB91MpPC86I1m3wwJeAc+Gme7bAuaLIU/cSfPwxT5NO7MfCp0Pu94gYDKtDXMs/wXg0bTAVDeAFFkdIj6kBBumEmQLCTL48q2UxDIXVLT/E/AAgj6q7WwgCg7fwm4Vjn4z7aUyBx8EfRy+5/SQyeYla3D/lFYgMi5x4D6J+yeR+JPAptDE/IR5IizNV7mY0ZcoXYyHrrehI1tTYEEqjX13ZqS4OCBFWwHe1QHhRNM+jHhcATbgikjAj8FyFPtLvc+dSVtkuhQktQl36Bi8zMUQcV6+mM7Ln6DBcDlM9urHKLYPTWmUAyhxM955iglOn5z0RaAIcyNMT6hz0rHaNf0BIlmbXoTC0XGjHh/OnoOEC/zg0JqgQTnPiU45K4TnRSSXp2GfiDfiQAK0+HaXACkjuFR68u7WCZpB1Bse1OgKNClFqtRhIr5DilUb2/e5DCCmFkddMUcjmYqzZdbXNt7fo8CFULe+mbiCp8+tMg4aRTaDZ/Hk93nCvGE5TP2ypEMbfL6nRVKvXOjhdvSQQgKwx+O003FDEHCSG0Bpageh7yVpna+SPrbGklce7MjTpbx3iIwmvKpQ6asnK1L3KkahpY1S3NhQ+/S3Gs8KWQ5LAU+d3xiPX3jfIVHsCIIyxHDbwcJvxM4MFBFQpqRMD6E+LoM9RHjl4C9k2iQ== tmtynkky@duuni
--- a/nixos/tests/initrd-network-ssh/generate-keys.nix
+++ b/nixos/tests/initrd-network-ssh/generate-keys.nix
@ -1,12 +1,10 @@
 with import ../../.. {};

 runCommand "gen-keys" {
-    buildInputs = [ dropbear openssh ];
+    buildInputs = [ openssh ];
  }
  ''
    mkdir $out
-    dropbearkey -t rsa -f $out/dropbear.priv -s 4096 | sed -n 2p > $out/dropbear.pub
-    ssh-keygen -q -t rsa -b 4096 -N "" -f client
-    mv client $out/openssh.priv
-    mv client.pub $out/openssh.pub
+    ssh-keygen -q -t ed25519 -N "" -f $out/ssh_host_ed25519_key
+    ssh-keygen -q -t ed25519 -N "" -f $out/id_ed25519
  ''
--- a/nixos/tests/initrd-network-ssh/id_ed25519
+++ b/nixos/tests/initrd-network-ssh/id_ed25519
@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAVcX+32Yqig25RxRA8bel/f604wV0p/63um+Oku/3vfwAAAJi/AJZMvwCW
+TAAAAAtzc2gtZWQyNTUxOQAAACAVcX+32Yqig25RxRA8bel/f604wV0p/63um+Oku/3vfw
+AAAEAPLjQusjrB90Lk3996G3AbtTeK+XweNgxaegYnml/A/RVxf7fZiqKDblHFEDxt6X9/
+rTjBXSn/re6b46S7/e9/AAAAEG5peGJsZEBsb2NhbGhvc3QBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
--- a/nixos/tests/initrd-network-ssh/id_ed25519.pub
+++ b/nixos/tests/initrd-network-ssh/id_ed25519.pub
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxf7fZiqKDblHFEDxt6X9/rTjBXSn/re6b46S7/e9/ nixbld@localhost
--- a/nixos/tests/initrd-network-ssh/openssh.priv
+++ b/nixos/tests/initrd-network-ssh/openssh.priv
@ -1,51 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEA7+9A2PCPOTAlFmrablrUWA+VZdAuLfM6JXeHsOF7ZbC2F6lv
-WmvDM925DQqhiAjcgWnt5WHWS5Y+b7lGnuzT7fyKegXd80nCRmqlpSG3srX0/lxR
-aQAJLzfoDjcsF+ceswQo6GSsYnCHVxMNs007gbbVY3f7o+sWZtLdxJPD2iHvl5Zr
-LK0d1RLMmU6cfIhIABlL0S8EWiv29RROepsCQnS0dnK2b+von1SCYoggvAMe2ToA
-IAJ8+uqaYfGAyn9q8fjZiRHxLmKDq90tKoCUL5r/2dmEIE+t8T/3PfHoq1QzZts9
-W9idhBdT21dEXBtGyoMtckp5njk5m82LQDYiOXkuSoIUhSOteh5g7fBv1BtVSERx
-Jg3UeJjPeGKFwdnzapmAKC2w/6V8xcIINNA+fhZA7B9fD1RAi2TECZ+gyMYDc4T+
-USlMSm9cfvSOrf2+5ngtFb84nHjqvClxCMLu+bCWK8HamqUzhE/a5LbR+48E7PyG
-s3KV+sWFN9KOnakTjj/6iQhXZRhgeAK39F2XTk5Ms5Y+BRSStnMoMZA2grIV+jHi
-1zbWokVqXPI5YRo5isR/PgtKAV6FfNWumcYoFJ9F40pMHQ6hJVEmtrCBx7EApSl3
-mSGbQJUmilLC51qNhwQRbD//ZtpIrN82HTMKzZ6kj7kDCdsff+wsnkIXmmMCAwEA
-AQKCAgA4tMINw6UF7hQF3VEsnbjr6xrzCiWv5HlMm5htPI1OdlpC81+G7ksfOfrf
-UzDkFrwOtftsqBfem268Nvyy2OQprfMIbdSMCFWrEM9/XJ2u1gRGDYmMGF8TUtI8
-cduw9oWx53zHl+uKBHBoKu+k/c7flFeQf63wisIroRCawhWau0SF/h3sXCndzuie
-Hw8q+4aQx2m80bDkotlmCNuXbIU3MZ/pEql9gDLlXTLHmMaryM0EqAmZhx0ErGe6
-WDqJIV4kPB0loSDwRoY6GzbugZ8ENUzcruTkQhCpIOYNNNw5idfwKkaxK1vm+SBv
-iYt1fVjYyfH2vhVKSNoNsaGEloa1u4Dymt/FpFztEpRzHXcw93N8BdLxJ4OUhzm2
-iAbpiyjniTIeAVVi7BUwLXh5WAx8nT0eeb1zKoZg1p1ciK5cYl1Uel7j8xRycsSW
-3YgmtuPqY4Agbc9v3eXbQZNDk48JFMEqpIxk97FAkRYpzfxg5Qq14WJCp60CkdRt
-T60hXy8lT/BcI8OWLfGJuBbsVLNRiC7PpwqRKQAinXSv134FpP7jrhpkMybs2oIS
-5obRG7J5OfOTp925erG5mrpwqa3BPkgqx347Wj9z8quOZyuhi+XaPvqmPtvs5JOl
-4RCqjt6RQlHm7xos9ZZGI4jDAIFaFWgyVZrYplOgwxWma4DTgQKCAQEA9+tizQRU
-lF0lxNcEPvsFnYJo80Y+MQK9VdtlhR19YuSfwP1NCaMG1MhQ+PVBVmepOwJMRJR7
-9PLfOouNMfixKBGP12dtStMuh7jowq/BxhRI6JWp3RhTZ1yJ9ouzHze7IDrEBa6w
-p0hUu9H0Sbt51LXbC3JmTyhbdhfry559DfyGW1Ma/bv/pihL9B5Y7sNf1thNp1gi
-GbQ9B+o2Yyw8ZD8zY+sl+aYDSWyCtcBV/KXEF74Bkfs/a5ExJ00X0jYj/TAp2ray
-T4PY0FR8wN/O10bFLP9j+Xa/ywbcPhoj8nvVRIg9VfWT/QaEd+KR0EZVxdjCCqne
-enbSQksTpAZNwQKCAQEA98E+BMmS+yHUVUhNZABtQ5avwuV4+DoSN8KTp3xwQ0CH
-m9fWxSDs12FdyMhDxrJPeywvHtZ18/7cl3dr8wnFVE0s4ongnRDXsNk5xN6J3AaO
-KqW4HF9cbwZqzLILy8TrO+EK/EQV9FypbrxqvxAlP1kezIA2CJNzVRAgimSuV/H7
-05HTnp5W06fjtEf8U1CUrdNetoSROUo1j/IMGPYGlsBFYAGrj5y/BlKd+3T3kjRp
-Xje7HpiykjrZHn0WDp04Ln+u9nveEewXmHKch313emt7HpW0xspp8JM8OZtEKozk
-D5PfYdBfMJJOUlqovCCzTTJ6kNOahknKXFeO/qs5IwKCAQEAjF0/zhWikXF/fcfD
-Bql2z2vTYdEmSvdjHSYff1Nn90K71DdVk5wytOxJM/sfp/z+yoMNjVKIL/IGQw5Z
-va4xFx+CUhGjxlZ0pLEjT37U9gHsGYsK5jvslLvG/MixfH5AOwoqi5ERQVTpbIF9
-jvVPEAh6YSu/ExglWGJIxTsRUIblxvTxdjEnl/p+rlM0RNJnA6vpo1J51BXA7CdF
-7bZQ5u0Feo/bK1I70ClYg/DGfkmYEV0pZG5cxNkqfDbgwsqWa7YGLGd94xkh+ymq
-jETqxeWyozxhbQ83nYpfzeVc7t//qlJ8b5uf0wUKoRmtNr9rtp13lzP/21REzPXW
-w+oxwQKCAQAoAf2Y2lAw25KlPuq4ZlU+n9u8FkBFnWMJvBMJ7c9XHNmJMf6NkLaO
-RTvWy3geYvbwxf7J9QnRH+vRTciR05cY+Olxn6A03N5nwXxRrToH3MsiWeZ0NnX/
-u8KNUYcUHbV60ulqOThuYHQ/3I9EUUAijaqqjV2sXts19ke68W0x6HKpBJhuudT9
-ktPzbdhyP8Xyl/pocNnerXwexZBsi3Ye6+eIDFz+8OnsBHVcgNPluS72tvsxgqj7
-ciNTiBGCxKKo55eCWBhRPpXE2WUrf/hGPYsBMl2h6FfZMH1+M/N7B4tgdJmS+woU
-Ftws8lTjJEiwA6HFN1ZxrwLNjJobx9yPAoIBAE0igsBuWWn6rXeOPylYg4264XOq
-8gb94pte2n9amDgCzyCn8m6AL3snLC/AoCD19DK+gyK0ukoesXPa3iX6w2xv69ZC
-urDx36Jhd4zrJb4QsFPoeKfDP+UvNVZaS41vipRRzY/y11em15prUZ4U8FA/UT1Y
-FzkBo9r6iUZRnyBLppMuEfWASDtuRNmeIHynoT1AcQOH3l9vR210iEpmAuJr0CYA
-bvTuz3UzzGGEAuIUvuaiRtkfKY52jBmiEr7SSPCr1HvLj3Ccz8bgjgR2kiXmcU50
-1zLnaPAD44LZ/0Fjqj+PimQGT6K7CNXPllmYh7MvoU52g3SVPf6rHlIR0Nc=
-----END RSA PRIVATE KEY-----
--- a/nixos/tests/initrd-network-ssh/openssh.pub
+++ b/nixos/tests/initrd-network-ssh/openssh.pub
@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDv70DY8I85MCUWatpuWtRYD5Vl0C4t8zold4ew4XtlsLYXqW9aa8Mz3bkNCqGICNyBae3lYdZLlj5vuUae7NPt/Ip6Bd3zScJGaqWlIbeytfT+XFFpAAkvN+gONywX5x6zBCjoZKxicIdXEw2zTTuBttVjd/uj6xZm0t3Ek8PaIe+XlmssrR3VEsyZTpx8iEgAGUvRLwRaK/b1FE56mwJCdLR2crZv6+ifVIJiiCC8Ax7ZOgAgAnz66pph8YDKf2rx+NmJEfEuYoOr3S0qgJQvmv/Z2YQgT63xP/c98eirVDNm2z1b2J2EF1PbV0RcG0bKgy1ySnmeOTmbzYtANiI5eS5KghSFI616HmDt8G/UG1VIRHEmDdR4mM94YoXB2fNqmYAoLbD/pXzFwgg00D5+FkDsH18PVECLZMQJn6DIxgNzhP5RKUxKb1x+9I6t/b7meC0VvziceOq8KXEIwu75sJYrwdqapTOET9rkttH7jwTs/IazcpX6xYU30o6dqROOP/qJCFdlGGB4Arf0XZdOTkyzlj4FFJK2cygxkDaCshX6MeLXNtaiRWpc8jlhGjmKxH8+C0oBXoV81a6ZxigUn0XjSkwdDqElUSa2sIHHsQClKXeZIZtAlSaKUsLnWo2HBBFsP/9m2kis3zYdMwrNnqSPuQMJ2x9/7CyeQheaYw== tmtynkky@duuni
--- a/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key
+++ b/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key
@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDP9Mz6qlxdQqA4omrgbOlVsxSGONCJstjW9zqquajlIAAAAJg0WGFGNFhh
+RgAAAAtzc2gtZWQyNTUxOQAAACDP9Mz6qlxdQqA4omrgbOlVsxSGONCJstjW9zqquajlIA
+AAAEA0Hjs7LfFPdTf3ThGx6GNKvX0ItgzgXs91Z3oGIaF6S8/0zPqqXF1CoDiiauBs6VWz
+FIY40Imy2Nb3Oqq5qOUgAAAAEG5peGJsZEBsb2NhbGhvc3QBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
--- a/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key.pub
+++ b/nixos/tests/initrd-network-ssh/ssh_host_ed25519_key.pub
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0zPqqXF1CoDiiauBs6VWzFIY40Imy2Nb3Oqq5qOUg nixbld@localhost
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -104,7 +104,6 @@ let

      with subtest("Assert readiness of login prompt"):
          machine.succeed("echo hello")
-          machine.wait_for_unit("nixos-manual")

      with subtest("Wait for hard disks to appear in /dev"):
          machine.succeed("udevadm settle")
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@ -1,10 +1,29 @@
 # This test start mongodb, runs a query using mongo shell

-import ./make-test-python.nix ({ pkgs, ...} : let
+import ./make-test-python.nix ({ pkgs, ... }:
+  let
    testQuery = pkgs.writeScript "nixtest.js" ''
      db.greetings.insert({ "greeting": "hello" });
      print(db.greetings.findOne().greeting);
    '';
+
+    runMongoDBTest = pkg: ''
+      node.execute("(rm -rf data || true) && mkdir data")
+      node.execute(
+          "${pkg}/bin/mongod --fork --logpath logs --dbpath data"
+      )
+      node.wait_for_open_port(27017)
+
+      assert "hello" in node.succeed(
+          "mongo ${testQuery}"
+      )
+
+      node.execute(
+          "${pkg}/bin/mongod --shutdown --dbpath data"
+      )
+      node.wait_for_closed_port(27017)
+    '';
+
  in {
    name = "mongodb";
    meta = with pkgs.stdenv.lib.maintainers; {
@ -12,31 +31,22 @@ in {
    };

    nodes = {
-    one =
-      { ... }:
-        {
-          services = {
-           mongodb.enable = true;
-           mongodb.enableAuth = true;
-           mongodb.initialRootPassword = "root";
-           mongodb.initialScript = pkgs.writeText "mongodb_initial.js" ''
-             db = db.getSiblingDB("nixtest");
-             db.createUser({user:"nixtest",pwd:"nixtest",roles:[{role:"readWrite",db:"nixtest"}]});
-           '';
-           mongodb.extraConfig = ''
-             # Allow starting engine with only a small virtual disk
-             storage.journal.enabled: false
-             storage.mmapv1.smallFiles: true
-           '';
-          };
+      node = {...}: {
+        environment.systemPackages = with pkgs; [
+#          mongodb-3_4
+          mongodb-3_6
+          mongodb-4_0
+        ];
      };
    };

    testScript = ''
-    start_all()
-    one.wait_for_unit("mongodb.service")
-    one.succeed(
-        "mongo -u nixtest -p nixtest nixtest ${testQuery} | grep -q hello"
-    )
+      node.start()
+    ''
+#      + runMongoDBTest pkgs.mongodb-3_4
+      + runMongoDBTest pkgs.mongodb-3_6 
+      + runMongoDBTest pkgs.mongodb-4_0
+      + ''
+        node.shutdown()
      '';
  })
--- a/nixos/tests/nginx-pubhtml.nix
+++ b/nixos/tests/nginx-pubhtml.nix
@ -0,0 +1,20 @@
+import ./make-test-python.nix {
+  name = "nginx-pubhtml";
+
+  machine = { pkgs, ... }: {
+    services.nginx.enable = true;
+    services.nginx.virtualHosts.localhost = {
+      locations."~ ^/\\~([a-z0-9_]+)(/.*)?$".alias = "/home/$1/public_html$2";
+    };
+    users.users.foo.isNormalUser = true;
+  };
+
+  testScript = ''
+    machine.wait_for_unit("nginx")
+    machine.wait_for_open_port(80)
+    machine.succeed("chmod 0711 /home/foo")
+    machine.succeed("su -c 'mkdir -p /home/foo/public_html' foo")
+    machine.succeed("su -c 'echo bar > /home/foo/public_html/bar.txt' foo")
+    machine.succeed('test "$(curl -fvvv http://localhost/~foo/bar.txt)" = bar')
+  '';
+}
--- a/nixos/tests/quorum.nix
+++ b/nixos/tests/quorum.nix
@ -0,0 +1,79 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "quorum";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
+
+  nodes = {
+    machine = { ... }: {
+      services.quorum = {
+        enable = true;
+        permissioned = false;
+        staticNodes = [ "enode://dd333ec28f0a8910c92eb4d336461eea1c20803eed9cf2c056557f986e720f8e693605bba2f4e8f289b1162e5ac7c80c914c7178130711e393ca76abc1d92f57@0.0.0.0:30303?discport=0" ];
+        genesis = {
+          alloc = {
+            "189d23d201b03ae1cf9113672df29a5d672aefa3" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            "44b07d2c28b8ed8f02b45bd84ac7d9051b3349e6" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            "4c1ccd426833b9782729a212c857f2f03b7b4c0d" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            "7ae555d0f6faad7930434abdaac2274fd86ab516" = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+            c1056df7c02b6f1a353052eaf0533cc7cb743b52 = {
+              balance = "0x446c3b15f9926687d2c40534fdb564000000000000";
+            };
+          };
+          coinbase = "0x0000000000000000000000000000000000000000";
+          config = {
+            byzantiumBlock = 1;
+            chainId = 10;
+            eip150Block = 1;
+            eip150Hash =
+              "0x0000000000000000000000000000000000000000000000000000000000000000";
+            eip155Block = 1;
+            eip158Block = 1;
+            isQuorum = true;
+            istanbul = {
+              epoch = 30000;
+              policy = 0;
+            };
+          };
+        difficulty = "0x1";
+        extraData =
+          "0x0000000000000000000000000000000000000000000000000000000000000000f8aff869944c1ccd426833b9782729a212c857f2f03b7b4c0d94189d23d201b03ae1cf9113672df29a5d672aefa39444b07d2c28b8ed8f02b45bd84ac7d9051b3349e694c1056df7c02b6f1a353052eaf0533cc7cb743b52947ae555d0f6faad7930434abdaac2274fd86ab516b8410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0";
+        gasLimit = "0xe0000000";
+        gasUsed = "0x0";
+        mixHash =
+          "0x63746963616c2062797a616e74696e65206661756c7420746f6c6572616e6365";
+        nonce = "0x0";
+        number = "0x0";
+        parentHash =
+          "0x0000000000000000000000000000000000000000000000000000000000000000";
+        timestamp = "0x5cffc201";
+		  };
+     };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_until_succeeds("mkdir -p /var/lib/quorum/keystore")
+    machine.wait_until_succeeds(
+        'echo \{\\"address\\":\\"9377bc3936de934c497e22917b81aa8774ac3bb0\\",\\"crypto\\":\{\\"cipher\\":\\"aes-128-ctr\\",\\"ciphertext\\":\\"ad8341d8ef225650403fd366c955f41095e438dd966a3c84b3d406818c1e366c\\",\\"cipherparams\\":\{\\"iv\\":\\"2a09f7a72fd6dff7c43150ff437e6ac2\\"\},\\"kdf\\":\\"scrypt\\",\\"kdfparams\\":\{\\"dklen\\":32,\\"n\\":262144,\\"p\\":1,\\"r\\":8,\\"salt\\":\\"d1a153845bb80cd6274c87c5bac8ac09fdfac5ff131a6f41b5ed319667f12027\\"\},\\"mac\\":\\"a9621ad88fa1d042acca6fc2fcd711f7e05bfbadea3f30f379235570c8e270d3\\"\},\\"id\\":\\"89e847a3-1527-42f6-a321-77de0a14ce02\\",\\"version\\":3\}\\" > /var/lib/quorum/keystore/UTC--2020-03-23T11-08-34.144812212Z--9377bc3936de934c497e22917b81aa8774ac3bb0'
+    )
+    machine.wait_until_succeeds(
+        "echo fe2725c4e8f7617764b845e8d939a65c664e7956eb47ed7d934573f16488efc1 > /var/lib/quorum/nodekey"
+    )
+    machine.wait_until_succeeds("systemctl restart quorum")
+    machine.wait_for_unit("quorum.service")
+    machine.sleep(15)
+    machine.wait_until_succeeds(
+        'geth attach /var/lib/quorum/geth.ipc --exec "eth.accounts" | grep 0x9377bc3936de934c497e22917b81aa8774ac3bb0'
+    )
+  '';
+})
--- a/nixos/tests/wireguard/default.nix
+++ b/nixos/tests/wireguard/default.nix
@ -1,33 +1,19 @@
+import ../make-test-python.nix ({ pkgs, lib, ...} :
  let
    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = (import ./make-peer.nix) { inherit lib; };
  in
-
-import ../make-test-python.nix ({ pkgs, ...} : {
+  {
    name = "wireguard";
    meta = with pkgs.stdenv.lib.maintainers; {
      maintainers = [ ma27 ];
    };

    nodes = {
-    peer0 = { lib, ... }: {
-      boot.kernel.sysctl = {
-        "net.ipv6.conf.all.forwarding" = "1";
-        "net.ipv6.conf.default.forwarding" = "1";
-        "net.ipv4.ip_forward" = "1";
-      };
-
-      networking.useDHCP = false;
-      networking.interfaces.eth1 = {
-        ipv4.addresses = lib.singleton {
-          address = "192.168.0.1";
-          prefixLength = 24;
-        };
-        ipv6.addresses = lib.singleton {
-          address = "fd00::1";
-          prefixLength = 64;
-        };
-      };
-
+      peer0 = peer {
+        ip4 = "192.168.0.1";
+        ip6 = "fd00::1";
+        extraConfig = {
          networking.firewall.allowedUDPPorts = [ 23542 ];
          networking.wireguard.interfaces.wg0 = {
            ips = [ "10.23.42.1/32" "fc00::1/128" ];
@ -42,26 +28,12 @@ import ../make-test-python.nix ({ pkgs, ...} : {
            };
          };
        };
-
-    peer1 = { pkgs, lib, ... }: {
-      boot.kernel.sysctl = {
-        "net.ipv6.conf.all.forwarding" = "1";
-        "net.ipv6.conf.default.forwarding" = "1";
-        "net.ipv4.ip_forward" = "1";
-      };
-
-      networking.useDHCP = false;
-      networking.interfaces.eth1 = {
-        ipv4.addresses = lib.singleton {
-          address = "192.168.0.2";
-          prefixLength = 24;
-        };
-        ipv6.addresses = lib.singleton {
-          address = "fd00::2";
-          prefixLength = 64;
-        };
      };

+      peer1 = peer {
+        ip4 = "192.168.0.2";
+        ip6 = "fd00::2";
+        extraConfig = {
          networking.wireguard.interfaces.wg0 = {
            ips = [ "10.23.42.2/32" "fc00::2/128" ];
            listenPort = 23542;
@ -84,6 +56,7 @@ import ../make-test-python.nix ({ pkgs, ...} : {
          };
        };
      };
+    };

    testScript = ''
      start_all()
@ -94,4 +67,5 @@ import ../make-test-python.nix ({ pkgs, ...} : {
      peer1.succeed("ping -c5 fc00::1")
      peer1.succeed("ping -c5 10.23.42.1")
    '';
-})
+  }
+)
--- a/nixos/tests/wireguard/make-peer.nix
+++ b/nixos/tests/wireguard/make-peer.nix
@ -0,0 +1,23 @@
+{ lib, ... }: { ip4, ip6, extraConfig }:
+lib.mkMerge [
+  {
+    boot.kernel.sysctl = {
+      "net.ipv6.conf.all.forwarding" = "1";
+      "net.ipv6.conf.default.forwarding" = "1";
+      "net.ipv4.ip_forward" = "1";
+    };
+
+    networking.useDHCP = false;
+    networking.interfaces.eth1 = {
+      ipv4.addresses = [{
+        address = ip4;
+        prefixLength = 24;
+      }];
+      ipv6.addresses = [{
+        address = ip6;
+        prefixLength = 64;
+      }];
+    };
+  }
+  extraConfig
+]
--- a/nixos/tests/wireguard/wg-quick.nix
+++ b/nixos/tests/wireguard/wg-quick.nix
@ -0,0 +1,63 @@
+import ../make-test-python.nix ({ pkgs, lib, ... }:
+  let
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = (import ./make-peer.nix) { inherit lib; };
+  in
+  {
+    name = "wg-quick";
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ xwvvvvwx ];
+    };
+
+    nodes = {
+      peer0 = peer {
+        ip4 = "192.168.0.1";
+        ip6 = "fd00::1";
+        extraConfig = {
+          networking.firewall.allowedUDPPorts = [ 23542 ];
+          networking.wg-quick.interfaces.wg0 = {
+            address = [ "10.23.42.1/32" "fc00::1/128" ];
+            listenPort = 23542;
+
+            inherit (wg-snakeoil-keys.peer0) privateKey;
+
+            peers = lib.singleton {
+              allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];
+
+              inherit (wg-snakeoil-keys.peer1) publicKey;
+            };
+          };
+        };
+      };
+
+      peer1 = peer {
+        ip4 = "192.168.0.2";
+        ip6 = "fd00::2";
+        extraConfig = {
+          networking.wg-quick.interfaces.wg0 = {
+            address = [ "10.23.42.2/32" "fc00::2/128" ];
+            inherit (wg-snakeoil-keys.peer1) privateKey;
+
+            peers = lib.singleton {
+              allowedIPs = [ "0.0.0.0/0" "::/0" ];
+              endpoint = "192.168.0.1:23542";
+              persistentKeepalive = 25;
+
+              inherit (wg-snakeoil-keys.peer0) publicKey;
+            };
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer0.wait_for_unit("wg-quick-wg0.service")
+      peer1.wait_for_unit("wg-quick-wg0.service")
+
+      peer1.succeed("ping -c5 fc00::1")
+      peer1.succeed("ping -c5 10.23.42.1")
+    '';
+  }
+)
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@ -4,7 +4,7 @@
 , librdf_raptor, librdf_rasqal, libsamplerate, libsigcxx, libsndfile
 , libusb, libuuid, libxml2, libxslt, lilv, lrdf, lv2, makeWrapper
 , perl, pkgconfig, python2, rubberband, serd, sord, sratom
-, taglib, vampSDK, dbus, fftw, pango, suil, libarchive
+, taglib, vamp-plugin-sdk, dbus, fftw, pango, suil, libarchive
 , wafHook }:

 let
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
      libmad libogg librdf_raptor librdf_rasqal libsamplerate
      libsigcxx libsndfile libusb libuuid libxml2 libxslt lilv lrdf lv2
      makeWrapper pango perl pkgconfig python2 rubberband serd sord
-      sratom suil taglib vampSDK libarchive
+      sratom suil taglib vamp-plugin-sdk libarchive
    ];

  # ardour's wscript has a "tarball" target but that required the git revision
--- a/pkgs/applications/audio/cheesecutter/0001-fix-impure-build-date-display.patch
+++ b/pkgs/applications/audio/cheesecutter/0001-fix-impure-build-date-display.patch
@ -0,0 +1,26 @@
+diff --git a/src/ct2util.d b/src/ct2util.d
+index 523cadc..e462b09 100644
+--- a/src/ct2util.d
+++ b/src/ct2util.d
+@@ -105,7 +105,7 @@ int main(string[] args) {
+ 	speeds.length = 32;
+ 	masks.length = 32;
+ 	void printheader() {
+-		enum hdr = "CheeseCutter 2 utilities" ~ com.util.versionInfo;
+		enum hdr = "CheeseCutter 2 utilities";
+ 		writefln(hdr);
+ 		writefln("\nUsage: \t%s <command> <options> <infile> <-o outfile>",args[0]);
+ 		writefln("\t%s import <infile> <infile2> <-o outfile>",args[0]);
+diff --git a/src/ui/ui.d b/src/ui/ui.d
+index e418dda..21af408 100644
+--- a/src/ui/ui.d
+++ b/src/ui/ui.d
+@@ -231,7 +231,7 @@ class Infobar : Window {
+ 	  
+ 		screen.clrtoeol(0, headerColor);
+ 
+-		enum hdr = "CheeseCutter 2.9" ~ com.util.versionInfo;
+		enum hdr = "CheeseCutter 2.9";
+ 		screen.cprint(4, 0, 1, headerColor, hdr);
+ 		screen.cprint(screen.width - 14, 0, 1, headerColor, "F12 = Help");
+ 		int c1 = audio.player.isPlaying ? 13 : 12;
--- a/pkgs/applications/audio/cheesecutter/default.nix
+++ b/pkgs/applications/audio/cheesecutter/default.nix
@ -0,0 +1,48 @@
+{ stdenv, lib, fetchFromGitHub, fetchpatch
+, acme, ldc, patchelf
+, SDL
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cheesecutter";
+  version = "unstable-2019-12-06";
+
+  src = fetchFromGitHub {
+    owner = "theyamo";
+    repo = "CheeseCutter";
+    rev = "6b433c5512d693262742a93c8bfdfb353d4be853";
+    sha256 = "1szlcg456b208w1237581sg21x69mqlh8cr6v8yvbhxdz9swxnwy";
+  };
+
+  nativeBuildInputs = [ acme ldc patchelf ];
+
+  buildInputs = [ SDL ];
+
+  patches = [
+    ./0001-fix-impure-build-date-display.patch
+  ];
+
+  makefile = "Makefile.ldc";
+
+  installPhase = ''
+    for exe in {ccutter,ct2util}; do
+      install -D $exe $out/bin/$exe
+    done
+
+    mkdir -p $out/share/cheesecutter/example_tunes
+    cp -r tunes/* $out/share/cheesecutter/example_tunes
+  '';
+
+  postFixup = ''
+    rpath=$(patchelf --print-rpath $out/bin/ccutter)
+    patchelf --set-rpath "$rpath:${lib.makeLibraryPath buildInputs}" $out/bin/ccutter
+  '';
+
+  meta = with lib; {
+    description = "A tracker program for composing music for the SID chip.";
+    homepage = "https://github.com/theyamo/CheeseCutter/";
+    license = licenses.gpl2;
+    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
+    maintainers = with maintainers; [ OPNA2608 ];
+  };
+}
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "drumkv1";
-  version = "0.9.12";
+  version = "0.9.13";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/${pname}-${version}.tar.gz";
-    sha256 = "0hmnmk9vvi43wl6say0dg7j088h7mmwmfdwjhsq89c7i7cpg78da";
+    sha256 = "1h88sakxs0b20k8v2sh14y05fin1zqmhnid6h9mk9c37ixxg58ia";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
@ -15,7 +15,7 @@ mkDerivation rec {

  meta = with lib; {
    description = "An old-school drum-kit sampler synthesizer with stereo fx";
-    homepage = http://drumkv1.sourceforge.net/;
+    homepage = "http://drumkv1.sourceforge.net/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
    maintainers = [ maintainers.goibhniu ];
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@ -20,13 +20,13 @@ with stdenv.lib.strings;

 let

-  version = "2.20.2";
+  version = "unstable-2020-03-20";

  src = fetchFromGitHub {
    owner = "grame-cncm";
    repo = "faust";
-    rev = version;
-    sha256 = "08hv8gyj6c83128z3si92r1ka5ckf9sdpn5jdnlhrqyzja4mrxsy";
+    rev = "2782088d4485f1c572755f41e7a072b41cb7148a";
+    sha256 = "1l7bi2mq10s5wm8g4cdipg8gndd478x897qv0h7nqi1s2q9nq99p";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/faust/faust2jaqt.nix
+++ b/pkgs/applications/audio/faust/faust2jaqt.nix
@ -3,6 +3,7 @@
 , opencv
 , qt4
 , libsndfile
+, which
 }:

 faust.wrapWithBuildEnv {
@ -19,6 +20,7 @@ faust.wrapWithBuildEnv {
    opencv
    qt4
    libsndfile
+    which
  ];

 }
--- a/pkgs/applications/audio/faust/faust2lv2.nix
+++ b/pkgs/applications/audio/faust/faust2lv2.nix
@ -2,6 +2,7 @@
 , faust
 , lv2
 , qt4
+, which

 }:

@ -9,6 +10,6 @@ faust.wrapWithBuildEnv {

  baseName = "faust2lv2";

-  propagatedBuildInputs = [ boost lv2 qt4 ];
+  propagatedBuildInputs = [ boost lv2 qt4 which ];

 }
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@ -0,0 +1,32 @@
+{ lib, stdenv, fetchsvn, cmake, pkg-config, gcc, pkgconfig, fftwFloat, alsaLib
+, zlib, wavpack, wxGTK31, udev, jackaudioSupport ? false, libjack2
+, includeDemo ? true }:
+
+stdenv.mkDerivation rec {
+  pname = "grandorgue";
+  rev = "2333";
+  version = "0.3.1-r${rev}";
+  src = fetchsvn {
+    url = "https://svn.code.sf.net/p/ourorgan/svn/trunk";
+    inherit rev;
+    sha256 = "0xzjdc2g4gja2lpmn21xhdskv43qpbpzkbb05jfqv6ma2zwffzz1";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  buildInputs = [ pkgconfig fftwFloat alsaLib zlib wavpack wxGTK31 udev ]
+    ++ lib.optional jackaudioSupport libjack2;
+
+  cmakeFlags = lib.optional (!jackaudioSupport) [
+    "-DRTAUDIO_USE_JACK=OFF"
+    "-DRTMIDI_USE_JACK=OFF"
+  ] ++ lib.optional (!includeDemo) "-DINSTALL_DEMO=OFF";
+
+  meta = {
+    description = "Virtual Pipe Organ Software";
+    homepage = "https://sourceforge.net/projects/ourorgan";
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.puzzlewolf ];
+  };
+}
--- a/pkgs/applications/audio/magnetophonDSP/faustCompressors/default.nix
+++ b/pkgs/applications/audio/magnetophonDSP/faustCompressors/default.nix
@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
  buildInputs = [ faust2jaqt faust2lv2 ];

  buildPhase = ''
+    echo "hack out autoComp.dsp due to https://github.com/grame-cncm/faust/407/issues "
+    rm autoComp.dsp
    for f in *.dsp;
    do
      echo "compiling standalone from" $f
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -3,7 +3,7 @@
 , libid3tag, libmad, libopus, libshout, libsndfile, libusb1, libvorbis
 , libGLU, libxcb, lilv, lv2, opusfile
 , pkgconfig, portaudio, portmidi, protobuf, qtbase, qtscript, qtsvg
-, qtx11extras, rubberband, scons, sqlite, taglib, upower, vampSDK
+, qtx11extras, rubberband, scons, sqlite, taglib, upower, vamp-plugin-sdk
 }:

 mkDerivation rec {
@ -21,7 +21,7 @@ mkDerivation rec {
  buildInputs = [
    chromaprint fftw flac faad2 glibcLocales mp4v2 libid3tag libmad libopus libshout libsndfile
    libusb1 libvorbis libxcb libGLU lilv lv2 opusfile pkgconfig portaudio portmidi protobuf qtbase qtscript qtsvg
-    qtx11extras rubberband sqlite taglib upower vampSDK
+    qtx11extras rubberband sqlite taglib upower vamp-plugin-sdk
  ];

  enableParallelBuilding = true;
--- a/pkgs/applications/audio/muse/fix-parallel-building.patch
+++ b/pkgs/applications/audio/muse/fix-parallel-building.patch
@ -36,6 +36,13 @@ In file included from ../muse/mixer/rack.cpp:49:
 ui_plugindialogbase.h: No such file or directory


+ninja muse/midiedit/CMakeFiles/midiedit.dir/drumedit.o
+
+In file included from /build/source/muse3/muse/midiedit/drumedit.cpp:64:
+/build/source/muse3/muse/components/filedialog.h:29:10: fatal error:
+ui_fdialogbuttons.h: No such file or directory
+
+
 --- a/muse/components/CMakeLists.txt
 +++ b/muse/components/CMakeLists.txt
@@ -343,4 +343,5 @@ set_target_properties( components
@ -76,3 +83,11 @@ ui_plugindialogbase.h: No such file or directory
 +      components
       widgets
       )
+--- a/muse/midiedit/CMakeLists.txt
+++ b/muse/midiedit/CMakeLists.txt
+@@ -93,4 +93,5 @@ set_target_properties( midiedit
+ target_link_libraries ( midiedit
+       ${QT_LIBRARIES}
+      components
+       al
+       ctrl
--- a/pkgs/applications/audio/nootka/default.nix
+++ b/pkgs/applications/audio/nootka/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchurl, cmake
+, alsaLib, fftwSinglePrec, libjack2, libpulseaudio, libvorbis, soundtouch, qtbase
+}:
+
+stdenv.mkDerivation rec {
+  name = "nootka-1.4.7";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/nootka/${name}-source.tar.bz2";
+    sha256 = "1y9wlwri74v2z9dwbcfjs7xri54yra24vpwq19xi2lfv1nbs518x";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    alsaLib fftwSinglePrec libjack2 libpulseaudio libvorbis soundtouch qtbase
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_INCLUDE_PATH=${libjack2}/include/jack;${libpulseaudio.dev}/include/pulse"
+    "-DENABLE_JACK=ON"
+    "-DENABLE_PULSEAUDIO=ON"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Application for practicing playing musical scores and ear training";
+    homepage = https://nootka.sourceforge.io/;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/nootka/unstable.nix
+++ b/pkgs/applications/audio/nootka/unstable.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchurl, cmake
+, alsaLib, fftwSinglePrec, libjack2, libpulseaudio, libvorbis, soundtouch
+, qtbase, qtdeclarative, qtquickcontrols2
+}:
+
+stdenv.mkDerivation rec {
+  name = "nootka-1.7.0-beta1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/nootka/${name}-source.tar.bz2";
+    sha256 = "13b50vnpr1zx2mrgkc8fmhsyfa19rqq1rksvn31145dy6fk1f3gc";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    alsaLib fftwSinglePrec libjack2 libpulseaudio libvorbis soundtouch
+    qtbase qtdeclarative qtquickcontrols2
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_INCLUDE_PATH=${libjack2}/include/jack;${libpulseaudio.dev}/include/pulse"
+    "-DENABLE_JACK=ON"
+    "-DENABLE_PULSEAUDIO=ON"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Application for practicing playing musical scores and ear training";
+    homepage = https://nootka.sourceforge.io/;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/padthv1/default.nix
+++ b/pkgs/applications/audio/padthv1/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "padthv1";
-  version = "0.9.12";
+  version = "0.9.13";

  src = fetchurl {
    url = "mirror://sourceforge/padthv1/${pname}-${version}.tar.gz";
-    sha256 = "1zz3rz990k819q0rlzllqdwvag0x9k63443lb0mp8lwlczxnza6l";
+    sha256 = "1c1zllph86qswcxddz4vpsj6r9w21hbv4gkba0pyd3q7pbfqr7nz";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools fftw ];
@ -15,7 +15,7 @@ mkDerivation rec {

  meta = with stdenv.lib; {
    description = "polyphonic additive synthesizer";
-    homepage = http://padthv1.sourceforge.net/;
+    homepage = "http://padthv1.sourceforge.net/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
    maintainers = [ maintainers.magnetophon ];
--- a/pkgs/applications/audio/pianobooster/default.nix
+++ b/pkgs/applications/audio/pianobooster/default.nix
@ -1,35 +1,31 @@
-{ stdenv, fetchurl, alsaLib, cmake, libGLU, libGL, makeWrapper, qt4 }:
+{ stdenv, fetchFromGitHub, cmake, pkg-config, qttools
+, alsaLib, ftgl, libGLU, libjack2, qtbase, rtmidi
+}:

-stdenv.mkDerivation  {
+stdenv.mkDerivation rec {
  pname = "pianobooster";
-  version = "0.6.4b";
+  version = "0.7.2b";

-  src = fetchurl {
-    url = "mirror://sourceforge/pianobooster/pianobooster-src-0.6.4b.tar.gz";
-    sha256 = "1xwyap0288xcl0ihjv52vv4ijsjl0yq67scc509aia4plmlm6l35";
+  src = fetchFromGitHub {
+    owner = "captnfab";
+    repo = "PianoBooster";
+    rev = "v${version}";
+    sha256 = "03xcdnlpsij22ca3i6xj19yqzn3q2ch0d32r73v0c96nm04gvhjj";
  };

-  patches = [
-    ./pianobooster-0.6.4b-cmake.patch
-    ./pianobooster-0.6.4b-cmake-gcc4.7.patch
+  nativeBuildInputs = [ cmake pkg-config qttools ];
+
+  buildInputs = [ alsaLib ftgl libGLU libjack2 qtbase rtmidi ];
+
+  cmakeFlags = [
+    "-DOpenGL_GL_PREFERENCE=GLVND"
  ];

-  preConfigure = "cd src";
-
-  buildInputs = [ alsaLib cmake makeWrapper libGLU libGL qt4 ];
-  NIX_LDFLAGS = "-lGL -lpthread";
-
-  postInstall = ''
-    wrapProgram $out/bin/pianobooster \
-      --prefix LD_LIBRARY_PATH : ${libGL}/lib \
-      --prefix LD_LIBRARY_PATH : ${libGLU}/lib
-  '';
-
  meta = with stdenv.lib; {
    description = "A MIDI file player that teaches you how to play the piano";
-    homepage = http://pianobooster.sourceforge.net;
-    license = licenses.gpl3;
+    homepage = https://github.com/captnfab/PianoBooster;
+    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.goibhniu ];
+    maintainers = with maintainers; [ goibhniu orivej ];
  };
 }
--- a/pkgs/applications/audio/pianobooster/pianobooster-0.6.4b-cmake-gcc4.7.patch
+++ b/pkgs/applications/audio/pianobooster/pianobooster-0.6.4b-cmake-gcc4.7.patch
@ -1,11 +0,0 @@
--- pianobooster-src-0.6.4b/src/CMakeLists.txt.orig	2013-04-06 10:48:02.469532914 -0700
-+++ pianobooster-src-0.6.4b/src/CMakeLists.txt	2013-04-06 10:48:12.989532445 -0700
-@@ -203,8 +203,6 @@
-         ${PIANOBOOSTER_UI_HDRS} )
- ENDIF(WIN32)
- 
-SET_TARGET_PROPERTIES(pianobooster PROPERTIES LINK_FLAGS "-mwindows")
-
- IF (USE_PCH)
- ADD_PRECOMPILED_HEADER( pianobooster ${CMAKE_CURRENT_SOURCE_DIR}/precompile/precompile.h )
- ENDIF (USE_PCH)
--- a/pkgs/applications/audio/pianobooster/pianobooster-0.6.4b-cmake.patch
+++ b/pkgs/applications/audio/pianobooster/pianobooster-0.6.4b-cmake.patch
@ -1,44 +0,0 @@
--- pianobooster-src-0.6.4b/src/CMakeLists.txt.orig
-+++ pianobooster-src-0.6.4b/src/CMakeLists.txt
-@@ -2,12 +2,6 @@
- # for the debug build type cmake -DCMAKE_BUILD_TYPE=Debug
- SET(CMAKE_BUILD_TYPE Release)
- SET(CMAKE_VERBOSE_MAKEFILE OFF)
-SET(USE_FLUIDSYNTH OFF)
-
-# The inplace directory is mainly for windows builds
-# SET(FLUIDSYNTH_INPLACE_DIR C:/download/misc/ljb/fluidsynth-1.0.9)
-SET(FLUIDSYNTH_INPLACE_DIR /home/louis/build/fluidsynth-1.0.9)
-
- 
- # Testing precompiled headers  it does not work -- leave as OFF.
- SET(USE_PCH OFF)
-@@ -78,18 +72,7 @@
-     ADD_DEFINITIONS(-DPB_USE_FLUIDSYNTH)
-     MESSAGE("Building using fluidsynth")
-     SET( PB_BASE_SRCS MidiDeviceFluidSynth.cpp )
-
-    IF(FLUIDSYNTH_INPLACE_DIR)
-        INCLUDE_DIRECTORIES(${FLUIDSYNTH_INPLACE_DIR}/include/)
-        IF(WIN32)
-            LINK_LIBRARIES( ${FLUIDSYNTH_INPLACE_DIR}/src/.libs/libfluidsynth.dll.a)
-        ENDIF(WIN32)
-        IF(UNIX)
-            LINK_LIBRARIES(${FLUIDSYNTH_INPLACE_DIR}/src/.libs/libfluidsynth.so)
-        ENDIF(UNIX)
-    ELSEIF(FLUIDSYNTH_INPLACE_DIR)
-        LINK_LIBRARIES( fluidsynth)
-    ENDIF(FLUIDSYNTH_INPLACE_DIR)
-+	LINK_LIBRARIES(fluidsynth)
- ENDIF(USE_FLUIDSYNTH)
- 
- 
-@@ -214,8 +197,6 @@
- INSTALL(TARGETS pianobooster RUNTIME DESTINATION bin)
- #INSTALL( index.docbook INSTALL_DESTINATION ${HTML_INSTALL_DIR}/en  SUBDIR kmidimon )
- 
-INSTALL( FILES ../README.txt  DESTINATION share/doc/pianobooster )
-
- INSTALL ( FILES images/pianobooster.png DESTINATION share/pixmaps )
- 
- 
--- a/pkgs/applications/audio/qmidiarp/default.nix
+++ b/pkgs/applications/audio/qmidiarp/default.nix
@ -0,0 +1,49 @@
+{ stdenv
+, fetchgit
+, automake
+, autoreconfHook
+, lv2
+, pkg-config
+, qt5
+, alsaLib
+, libjack2
+}:
+
+stdenv.mkDerivation rec {
+  name = "qmidiarp";
+  version = "0.6.5";
+
+  src = fetchgit {
+    url = "https://git.code.sf.net/p/qmidiarp/code";
+    sha256 = "1g2143gzfbihqr2zi3k2v1yn1x3mwfbb2khmcd4m4cq3hcwhhlx9";
+    rev = "qmidiarp-0.6.5";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    alsaLib
+    lv2
+    libjack2
+  ] ++ (with qt5; [
+    qttools
+  ]);
+
+  meta = with stdenv.lib; {
+    description = "An advanced MIDI arpeggiator";
+    longDescription = ''
+      An advanced MIDI arpeggiator, programmable step sequencer and LFO for Linux.
+      It can hold any number of arpeggiator, sequencer, or LFO modules running in
+      parallel.
+    '';
+
+    homepage = "http://qmidiarp.sourceforge.net";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ sjfloat ];
+  };
+}
--- a/pkgs/applications/audio/qtractor/default.nix
+++ b/pkgs/applications/audio/qtractor/default.nix
@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
      suil
    ];

+  enableParallelBuilding = true;
+
  meta = with stdenv.lib; {
    description = "Audio/MIDI multi-track sequencer";
    homepage = http://qtractor.sourceforge.net;
--- a/pkgs/applications/audio/sfxr-qt/default.nix
+++ b/pkgs/applications/audio/sfxr-qt/default.nix
@ -10,12 +10,12 @@

 mkDerivation rec {
  pname = "sfxr-qt";
-  version = "1.2.0";
+  version = "1.3.0";
  src = fetchFromGitHub {
    owner = "agateau";
    repo = "sfxr-qt";
    rev = version;
-    sha256 = "1ndw1dcmzvkrc6gnb0y057zb4lqlhwrv18jlbx26w3s4xrbxqr41";
+    sha256 = "15yjgjl1c5k816mnpc09104zq0ack2a3mjsxmhcik7cmjkfiipr5";
    fetchSubmodules = true;
  };
  nativeBuildInputs = [
@ -27,10 +27,9 @@ mkDerivation rec {
    qtquickcontrols2
    SDL
  ];
-  configurePhase = "cmake . -DCMAKE_INSTALL_PREFIX=$out";

  meta = with lib; {
-    homepage = https://github.com/agateau/sfxr-qt;
+    homepage = "https://github.com/agateau/sfxr-qt";
    description = "A sound effect generator, QtQuick port of sfxr";
    license = licenses.gpl2;
    maintainers = with maintainers; [ fgaz ];
--- a/pkgs/applications/audio/sonic-lineup/default.nix
+++ b/pkgs/applications/audio/sonic-lineup/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, alsaLib, boost, bzip2, fftw, fftwFloat, libfishsound
 , libid3tag, liblo, libmad, liboggz, libpulseaudio, libsamplerate
-, libsndfile, lrdf, opusfile, portaudio, rubberband, serd, sord, vampSDK, capnproto
+, libsndfile, lrdf, opusfile, portaudio, rubberband, serd, sord, capnproto
 , wrapQtAppsHook, pkgconfig
 }:

--- a/pkgs/applications/audio/sonic-visualiser/default.nix
+++ b/pkgs/applications/audio/sonic-visualiser/default.nix
@ -3,7 +3,7 @@
 { stdenv, fetchurl, alsaLib, bzip2, fftw, libjack2, libX11, liblo
 , libmad, libogg, lrdf, librdf_raptor, librdf_rasqal, libsamplerate
 , libsndfile, pkgconfig, libpulseaudio, qtbase, qtsvg, redland
-, rubberband, serd, sord, vampSDK, fftwFloat
+, rubberband, serd, sord, vamp-plugin-sdk, fftwFloat
 , capnproto, liboggz, libfishsound, libid3tag, opusfile
 , wrapQtAppsHook
 }:
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  buildInputs =
    [ libsndfile qtbase qtsvg fftw fftwFloat bzip2 lrdf rubberband
-      libsamplerate vampSDK alsaLib librdf_raptor librdf_rasqal redland
+      libsamplerate vamp-plugin-sdk alsaLib librdf_raptor librdf_rasqal redland
      serd
      sord
      # optional
--- a/pkgs/applications/audio/tony/default.nix
+++ b/pkgs/applications/audio/tony/default.nix
@ -0,0 +1,37 @@
+{ stdenv, fetchurl, pkgconfig, wrapQtAppsHook
+, alsaLib, boost, bzip2, fftw, fftwFloat, libX11, libfishsound, libid3tag
+, libjack2, liblo, libmad, libogg, liboggz, libpulseaudio, libsamplerate
+, libsndfile, lrdf, opusfile, qtbase, qtsvg, rubberband, serd, sord
+}:
+
+stdenv.mkDerivation rec {
+  name = "tony-2.1.1";
+
+  src = fetchurl {
+    url = "https://code.soundsoftware.ac.uk/attachments/download/2616/${name}.tar.gz";
+    sha256 = "03g2bmlj08lmgvh54dyd635xccjn730g4wwlhpvsw04bffz8b7fp";
+  };
+
+  nativeBuildInputs = [ pkgconfig wrapQtAppsHook ];
+
+  buildInputs = [
+    alsaLib boost bzip2 fftw fftwFloat libX11 libfishsound libid3tag
+    libjack2 liblo libmad libogg liboggz libpulseaudio libsamplerate
+    libsndfile lrdf opusfile qtbase qtsvg rubberband serd sord
+  ];
+
+  # comment out the tests
+  preConfigure = ''
+    sed -i 's/sub_test_svcore_/#sub_test_svcore_/' tony.pro
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Pitch and note annotation of unaccompanied melody";
+    homepage = https://www.sonicvisualiser.org/tony/;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/x42-avldrums/default.nix
+++ b/pkgs/applications/audio/x42-avldrums/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, pkgconfig, cairo, glib, libGLU, lv2, pango }:
+
+stdenv.mkDerivation rec {
+  pname = "x42-avldrums";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "x42";
+    repo = "avldrums.lv2";
+    rev = "v${version}";
+    sha256 = "1vwdp3d8qzd493qa99ddya7iql67bbfxmbcl8hk96lxif2lhmyws";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ cairo glib libGLU lv2 pango ];
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Drum sample player LV2 plugin dedicated to Glen MacArthur's AVLdrums";
+    homepage = https://x42-plugins.com/x42/x42-avldrums;
+    maintainers = with maintainers; [ orivej ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/x42-gmsynth/default.nix
+++ b/pkgs/applications/audio/x42-gmsynth/default.nix
@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, pkgconfig, glib, lv2 }:
+
+stdenv.mkDerivation rec {
+  pname = "x42-gmsynth";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "x42";
+    repo = "gmsynth.lv2";
+    rev = "v${version}";
+    sha256 = "08dvdj8r17sfl6l18g2b8abgls2irkbrq5vhrfai01hp2m0rlm34";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib lv2 ];
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Chris Colins' General User soundfont player LV2 plugin";
+    homepage = https://x42-plugins.com/x42/x42-gmsynth;
+    maintainers = with maintainers; [ orivej ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/zita-ajbridge/default.nix
+++ b/pkgs/applications/audio/zita-ajbridge/default.nix
@ -0,0 +1,31 @@
+{ stdenv, fetchurl, alsaLib, libjack2, zita-alsa-pcmi, zita-resampler }:
+
+stdenv.mkDerivation rec {
+  name = "zita-ajbridge-0.8.2";
+
+  src = fetchurl {
+    url = "https://kokkinizita.linuxaudio.org/linuxaudio/downloads/${name}.tar.bz2";
+    sha256 = "1gvk6g6w9rsiib89l0i9myl2cxxfzmcpbg9wdypq6b27l9s5k64j";
+  };
+
+  buildInputs = [ alsaLib libjack2 zita-alsa-pcmi zita-resampler ];
+
+  preConfigure = ''
+    cd ./source/
+  '';
+
+  makeFlags = [
+    "PREFIX=$(out)"
+    "MANDIR=$(out)/share/man/man1"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Connect additional ALSA devices to JACK";
+    homepage = http://kokkinizita.linuxaudio.org/linuxaudio/index.html;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/zita-at1/default.nix
+++ b/pkgs/applications/audio/zita-at1/default.nix
@ -0,0 +1,36 @@
+{ stdenv, fetchurl
+, cairo, fftwSinglePrec, libX11, libXft, libclthreads, libclxclient, libjack2
+, xorgproto, zita-resampler
+}:
+
+stdenv.mkDerivation rec {
+  name = "zita-at1-0.6.2";
+
+  src = fetchurl {
+    url = "https://kokkinizita.linuxaudio.org/linuxaudio/downloads/${name}.tar.bz2";
+    sha256 = "0mxfn61zvhlq3r1mqipyqzjbanrfdkk8x4nxbz8nlbdk0bf3vfqr";
+  };
+
+  buildInputs = [
+    cairo fftwSinglePrec libX11 libXft libclthreads libclxclient libjack2
+    xorgproto zita-resampler
+  ];
+
+  preConfigure = ''
+    cd ./source/
+  '';
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Autotuner Jack application to correct the pitch of vocal tracks";
+    homepage = https://kokkinizita.linuxaudio.org/linuxaudio/index.html;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/blockchains/go-ethereum.nix
+++ b/pkgs/applications/blockchains/go-ethereum.nix
@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, libobjc, IOKit, CoreServices }:
+{ stdenv, buildGoModule, fetchFromGitHub, libobjc, IOKit }:

 buildGoModule rec {
  pname = "go-ethereum";
@ -30,8 +30,6 @@ buildGoModule rec {
    "cmd/wnode"
  ];

-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
-
  # Fix for usb-related segmentation faults on darwin
  propagatedBuildInputs =
    stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ];
--- a/pkgs/applications/blockchains/lnd.nix
+++ b/pkgs/applications/blockchains/lnd.nix
@ -1,4 +1,4 @@
-{ buildGoModule, fetchFromGitHub, stdenv, Security }:
+{ buildGoModule, fetchFromGitHub, lib }:

 buildGoModule rec {
  pname = "lnd";
@ -13,12 +13,10 @@ buildGoModule rec {

  modSha256 = "1pvcvpiz6ck8xkgpypchrq9kgkik0jxd7f3jhihbgldsh4zaqiaq";

-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Lightning Network Daemon";
    homepage = "https://github.com/lightningnetwork/lnd";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    maintainers = with maintainers; [ cypherpunk2140 ];
  };
 }
--- a/pkgs/applications/blockchains/namecoin.nix
+++ b/pkgs/applications/blockchains/namecoin.nix
@ -3,14 +3,14 @@

 with stdenv.lib;
 stdenv.mkDerivation rec {
-  version = "nc0.15.99-name-tab-beta2";
+  version = "nc0.19.1";
  name = "namecoin" + toString (optional (!withGui) "d") + "-" + version;

  src = fetchFromGitHub {
    owner = "namecoin";
    repo = "namecoin-core";
    rev = version;
-    sha256 = "1r0v0yvlazmidxp6xhapbdawqb8fhzrdp11d4an5vgxa208s6wdf";
+    sha256 = "13rdvngrl2w0gk7km3sd9fy8yxzgxlkcwn50ajsbrhgzl8kx4q7m";
  };

  nativeBuildInputs = [
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Decentralized open source information registration and transfer system based on the Bitcoin cryptocurrency";
-    homepage = https://namecoin.org;
+    homepage = "https://namecoin.org";
    license = licenses.mit;
    maintainers = with maintainers; [ doublec AndersonTorres infinisil ];
    platforms = platforms.linux;
--- a/pkgs/applications/blockchains/tessera.nix
+++ b/pkgs/applications/blockchains/tessera.nix
@ -0,0 +1,26 @@
+{ stdenv, fetchurl, makeWrapper, jre }:
+
+stdenv.mkDerivation rec {
+  pname = "tessera";
+  version = "0.10.2";
+
+  src = fetchurl {
+    url = "https://oss.sonatype.org/service/local/repositories/releases/content/com/jpmorgan/quorum/${pname}-app/${version}/${pname}-app-${version}-app.jar";
+    sha256 = "1zn8w7q0q5man0407kb82lw4mlvyiy9whq2f6izf2b5415f9s0m4";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    makeWrapper ${jre}/bin/java $out/bin/tessera --add-flags "-jar $src"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Enterprise Implementation of Quorum's transaction manager";
+    homepage = "https://github.com/jpmorganchase/tessera";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mmahut ];
+  };
+}
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -18,9 +18,9 @@ let
    sha256Hash = "072rvh20xkn7izh6f2r2bspy06jrvcibj2hc12hz76m8cwzf4v0m";
  };
  latestVersion = { # canary & dev
-    version = "4.1.0.3"; # "Android Studio 4.1 Canary 3"
-    build = "193.6297379";
-    sha256Hash = "0sb8ll9bkkdglq18wvy5hikimhjbpfadjdygx9cd8q545h8dy137";
+    version = "4.1.0.4"; # "Android Studio 4.1 Canary 4"
+    build = "193.6325121";
+    sha256Hash = "19b4a03qfljdisn7cw44qzab85hib000m9mgswzssjh6ylkd9arw";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ lib, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
  pname = "glow";
@ -13,11 +13,9 @@ buildGoModule rec {

  modSha256 = "0r0yq7kgz7i1wf4gxxihdrn1c8mi4wcyhadncxbln24s9c5apxsf";

-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
  buildFlagsArray = [ "-ldflags=" "-X=main.Version=${version}" ];

-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Render markdown on the CLI";
    homepage = "https://github.com/charmbracelet/glow";
    license = licenses.mit;
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -20,11 +20,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "nano";
-  version = "4.7";
+  version = "4.9";

  src = fetchurl {
    url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "1x9nqy2kgaz6087p63i71gdjsqbdc9jjpx1ymlyclfakvsby3h2q";
+    sha256 = "19ik88b3g0d9xwav4hkai2h1acmjy5fdnh21gdc1mjq5s4lrff8f";
  };

  nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@ -1,25 +1,58 @@
-{ buildFHSUserEnv, makeDesktopItem, stdenv, lib, requireFile, unstick, cycloneVSupport ? true }:
+{ buildFHSUserEnv, makeDesktopItem, writeScript, stdenv, lib, requireFile, unstick,
+  supportedDevices ? [ "Arria II" "Cyclone V" "Cyclone IV" "Cyclone 10 LP" "MAX II/V" "MAX 10 FPGA" ] }:

 let
+  deviceIds = {
+    "Arria II" = "arria_lite";
+    "Cyclone V" = "cyclonev";
+    "Cyclone IV" = "cyclone";
+    "Cyclone 10 LP" = "cyclone10lp";
+    "MAX II/V" = "max";
+    "MAX 10 FPGA" = "max10";
+  };
+
+  supportedDeviceIds =
+    assert lib.assertMsg (lib.all (name: lib.hasAttr name deviceIds) supportedDevices)
+      "Supported devices are: ${lib.concatStringsSep ", " (lib.attrNames deviceIds)}";
+    lib.listToAttrs (map (name: {
+      inherit name;
+      value = deviceIds.${name};
+    }) supportedDevices);
+
+  unsupportedDeviceIds = lib.filterAttrs (name: value:
+    !(lib.hasAttr name supportedDeviceIds)
+  ) deviceIds;
+
  quartus = stdenv.mkDerivation rec {
    version = "19.1.0.670";
-    pname = "quartus-prime-lite";
+    pname = "quartus-prime-lite-unwrapped";

    src = let
      require = {name, sha256}: requireFile {
        inherit name sha256;
        url = "${meta.homepage}/${lib.versions.majorMinor version}/?edition=lite&platform=linux";
      };
+
+      hashes = {
+        "arria_lite" = "1flj9w0vb2p9f9zll136izr6qvmxn0lg72bvaqxs3sxc9vj06wm1";
+        "cyclonev" = "0bqxpvjgph0y6slk0jq75mcqzglmqkm0jsx10y9xz5llm6zxzqab";
+        "cyclone" = "0pzs8y4s3snxg4g6lrb21qi88abm48g279xzd98qv17qxb2z82rr";
+        "cyclone10lp" = "1ccxq8n20y40y47zddkijcv41w3cddvydddr3m4844q31in3nxha";
+        "max" = "1cxzbqscxvlcy74dpqmvlnxjyyxfwcx3spygpvpwi6dfj3ipgm2z";
+        "max10" = "14k83javivbk65mpb17wdwsyb8xk7x9gzj9x0wnd24mmijrvdy9s";
+      };
+
+      devicePackages = map (id: {
+        name = "${id}-${version}.qdz";
+        sha256 = lib.getAttr id hashes;
+      }) (lib.attrValues supportedDeviceIds);
    in map require ([{
      name = "QuartusLiteSetup-${version}-linux.run";
      sha256 = "15vxvqxqdk29ahlw3lkm1nzxyhzy4626wb9s5f2h6sjgq64r8m7f";
    } {
      name = "ModelSimSetup-${version}-linux.run";
      sha256 = "0j1vfr91jclv88nam2plx68arxmz4g50sqb840i60wqd5b0l3y6r";
-    }] ++ lib.optional cycloneVSupport {
-      name = "cyclonev-${version}.qdz";
-      sha256 = "0bqxpvjgph0y6slk0jq75mcqzglmqkm0jsx10y9xz5llm6zxzqab";
-    });
+    }] ++ devicePackages);

    nativeBuildInputs = [ unstick ];

@ -37,14 +70,9 @@ let
      disabledComponents = [
        "quartus_help"
        "quartus_update"
+        # not modelsim_ase
        "modelsim_ae"
-        # Devices
-        "arria_lite"
-        "cyclone"
-        "cyclone10lp"
-        "max"
-        "max10"
-      ] ++ lib.optional (!cycloneVSupport) "cyclonev";
+      ] ++ (lib.attrValues unsupportedDeviceIds);
    in ''
      ${lib.concatMapStringsSep "\n" copyInstaller installers}
      ${lib.concatMapStringsSep "\n" copyComponent components}
@ -69,17 +97,17 @@ let
  };

  desktopItem = makeDesktopItem {
-    name = quartus.name;
+    name = "quartus-prime-lite";
    exec = "quartus";
    icon = "quartus";
    desktopName = "Quartus";
-    genericName = "Quartus FPGA IDE";
+    genericName = "Quartus Prime";
    categories = "Development;";
  };

 # I think modelsim_ase/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
-in buildFHSUserEnv {
-  name = "quartus-prime-lite";
+in buildFHSUserEnv rec {
+  name = "quartus-prime-lite"; # wrapped

  targetPkgs = pkgs: with pkgs; [
    # quartus requirements
@ -110,10 +138,43 @@ in buildFHSUserEnv {
    xorg.libXrender
  ];

-  extraInstallCommands = ''
-    mkdir -p $out/share/applications
-    cp ${desktopItem}/share/applications/* $out/share/applications
+  passthru = {
+    unwrapped = quartus;
+  };
+
+  extraInstallCommands = let
+    quartusExecutables = (map (c: "quartus/bin/quartus_${c}") [
+      "asm" "cdb" "cpf" "drc" "eda" "fit" "jbcc" "jli" "map" "pgm" "pow"
+      "sh" "si" "sim" "sta" "stp" "tan"
+    ]) ++ [ "quartus/bin/quartus" ];
+
+    qsysExecutables = map (c: "quartus/sopc_builder/bin/qsys-${c}") [
+      "generate" "edit" "script"
+    ];
+    # Should we install all executables ?
+    modelsimExecutables = map (c: "modelsim_ase/bin/${c}") [
+      "vsim" "vlog" "vlib"
+    ];
+  in ''
+    mkdir -p $out/share/applications $out/share/icons/128x128
+    ln -s ${desktopItem}/share/applications/* $out/share/applications
+    ln -s ${quartus}/licenses/images/dc_quartus_panel_logo.png $out/share/icons/128x128/quartus.png
+
+    mkdir -p $out/quartus/bin $out/quartus/sopc_builder/bin $out/modelsim_ase/bin
+    WRAPPER=$out/bin/${name}
+    EXECUTABLES="${lib.concatStringsSep " " (quartusExecutables ++ qsysExecutables ++ modelsimExecutables)}"
+    for executable in $EXECUTABLES; do
+        echo "#!${stdenv.shell}" >> $out/$executable
+        echo "$WRAPPER ${quartus}/$executable \$@" >> $out/$executable
+    done
+
+    cd $out
+    chmod +x $EXECUTABLES
+    # link into $out/bin so executables become available on $PATH
+    ln --symbolic --relative --target-directory ./bin $EXECUTABLES
  '';

-  runScript = "${quartus}/quartus/bin/quartus";
+  runScript = writeScript "${name}-wrapper" ''
+    exec $@
+  '';
 }
--- a/pkgs/applications/editors/vim/configurable.nix
+++ b/pkgs/applications/editors/vim/configurable.nix
@ -14,7 +14,7 @@

 , features          ? "huge" # One of tiny, small, normal, big or huge
 , wrapPythonDrv     ? false
-, guiSupport        ? config.vim.gui or "gtk3"
+, guiSupport        ? config.vim.gui or (if stdenv.isDarwin then "gtk2" else "gtk3")
 , luaSupport        ? config.vim.lua or true
 , perlSupport       ? config.vim.perl or false      # Perl interpreter
 , pythonSupport     ? config.vim.python or true     # Python interpreter
--- a/pkgs/applications/editors/vim/vimacs.nix
+++ b/pkgs/applications/editors/vim/vimacs.nix
@ -0,0 +1,34 @@
+{ stdenv, config, vim_configurable, macvim, vimPlugins
+, useMacvim ? stdenv.isDarwin && (config.vimacs.macvim or true)
+, vimacsExtraArgs ? "" }:
+
+stdenv.mkDerivation rec {
+  pname = "vimacs";
+  version = vimPackage.version;
+  vimPackage = if useMacvim then macvim else vim_configurable;
+
+  buildInputs = [ vimPackage vimPlugins.vimacs ];
+
+  buildCommand = ''
+    mkdir -p "$out"/bin
+    cp "${vimPlugins.vimacs}"/share/vim-plugins/vimacs/bin/vim $out/bin/vimacs
+    substituteInPlace "$out"/bin/vimacs \
+      --replace '-vim}' '-@bin@/bin/vim}' \
+      --replace '-gvim}' '-@bin@/bin/vim -g}' \
+      --replace '--cmd "let g:VM_Enabled = 1"' \
+                '--cmd "let g:VM_Enabled = 1" --cmd "set rtp^=@rtp@" ${vimacsExtraArgs}' \
+      --replace @rtp@ ${vimPlugins.vimacs.rtp} \
+      --replace @bin@ ${vimPackage}
+    for prog in vm gvm gvimacs vmdiff vimacsdiff
+    do
+      ln -s "$out"/bin/vimacs $out/bin/$prog
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Vim-Improved eMACS: Emacs emulation for Vim";
+    homepage = "http://algorithm.com.au/code/vimacs";
+    license = licenses.gpl2Plus;
+    maintainers = with stdenv.lib.maintainers; [ millerjason ];
+  };
+}
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -10,7 +10,7 @@ let
    [ qscintilla-qt5 gdal jinja2 numpy psycopg2
      chardet dateutil pyyaml pytz requests urllib3 pygments pyqt5 sip owslib six ];
 in mkDerivation rec {
-  version = "3.10.1";
+  version = "3.10.4";
  pname = "qgis";
  name = "${pname}-unwrapped-${version}";

@ -18,7 +18,7 @@ in mkDerivation rec {
    owner = "qgis";
    repo = "QGIS";
    rev = "final-${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0xq0nnp7zdqaihqvh5rsi1129g23vnk5ijkpxfzaggafgmhf5hgz";
+    sha256 = "0d1rsgjgnnq6jgms5bgppz8lkh4518nf90fk0qvxajdfi9j4jn12";
  };

  passthru = {
--- a/pkgs/applications/graphics/antimony/default.nix
+++ b/pkgs/applications/graphics/antimony/default.nix
@ -4,19 +4,19 @@
 }:

 let
-  gitRev    = "6dfe6822e0279a4cc2f1c60e85b42212627285fe";
+  gitRev    = "8fb4b0929ce84cf375bfb83a9d522ccd80681eaf";
  gitBranch = "develop";
  gitTag    = "0.9.3";
 in
  stdenv.mkDerivation {
    pname = "antimony";
-    version = "2019-10-30";
+    version = "2020-03-28";

    src = fetchFromGitHub {
      owner  = "mkeeter";
      repo   = "antimony";
      rev    = gitRev;
-      sha256 = "07zlkwlk79czq8dy85b6n3ds3g36l8qy4ix849ady6ia3gm8981j";
+      sha256 = "1s0zmq5jmhmb1wcsyaxfmii448g6x8b41mzvb1awlljj85qj0k2s";
    };

    patches = [ ./paths-fix.patch ];
@ -29,11 +29,10 @@ in

    buildInputs = [
      libpng python3 python3.pkgs.boost
-      libGLU libGL qtbase wrapQtAppsHook
-      ncurses
+      libGLU libGL qtbase ncurses
    ];

-    nativeBuildInputs = [ cmake flex lemon ];
+    nativeBuildInputs = [ cmake flex lemon wrapQtAppsHook ];

    cmakeFlags= [
      "-DGITREV=${gitRev}"
--- a/pkgs/applications/graphics/gscan2pdf/default.nix
+++ b/pkgs/applications/graphics/gscan2pdf/default.nix
@ -10,11 +10,11 @@ with stdenv.lib;

 perlPackages.buildPerlPackage rec {
  pname = "gscan2pdf";
-  version = "2.6.3";
+  version = "2.6.5";

  src = fetchurl {
    url = "mirror://sourceforge/gscan2pdf/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1chmk51xwylnjrgc6hw23x7g7cpwzgwmjc49fcah7pkd3dk1cvvr";
+    sha256 = "0x8931i5zs4zl3iqjhlp7h8y6ssklxiqsddz5kh84nl3p0izbg0y";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
--- a/pkgs/applications/misc/archiver/default.nix
+++ b/pkgs/applications/misc/archiver/default.nix
@ -1,7 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
-, stdenv
-, Security
+, lib
 }:

 buildGoModule rec {
@ -17,9 +16,7 @@ buildGoModule rec {

  modSha256 = "1mrfqhd0zb78rlqlj2ncb0srwjfl7rzhy2p9mwa82pgysvlp08gv";

-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Easily create & extract archives, and compress & decompress files of various formats";
    homepage = "https://github.com/mholt/archiver";
    license = licenses.mit;
--- a/pkgs/applications/misc/cheat/default.nix
+++ b/pkgs/applications/misc/cheat/default.nix
@ -2,23 +2,23 @@

 buildGoModule rec {
  pname = "cheat";
-  version = "3.0.7";
+  version = "3.8.0";

  src = fetchFromGitHub {
-    owner = "chrisallenlane";
+    owner = "cheat";
    repo = "cheat";
    rev = version;
-    sha256 = "0i5j85ciimk14kndb81qxny1ksr57sr9xdvjn7x1ibc7h6pikjn5";
+    sha256 = "062dlc54x9qwb3hsxp20h94dpwsa1nzpjln9cqmvwjhvp434l97r";
  };

  subPackages = [ "cmd/cheat" ];

-  modSha256 = "1v9hvxygwvqma2j5yz7r95g34xpwb0n29hm39i89vgmvl3hy67s0";
+  modSha256 = "1is19qca5wgzya332rmpk862nnivxzgxchkllv629f5fwwdvdgmg";

  meta = with stdenv.lib; {
    description = "Create and view interactive cheatsheets on the command-line";
    maintainers = with maintainers; [ mic92 ];
    license = with licenses; [ gpl3 mit ];
-    homepage = "https://github.com/chrisallenlane/cheat";
+    inherit (src.meta) homepage;
  };
 }
--- a/pkgs/applications/misc/clipmenu/default.nix
+++ b/pkgs/applications/misc/clipmenu/default.nix
@ -4,13 +4,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "clipmenu";
-  version = "5.6.0";
+  version = "6.0.1";

  src = fetchFromGitHub {
    owner  = "cdown";
    repo   = "clipmenu";
    rev    = version;
-    sha256 = "13hyarzazh6j33d808h3s5yk320wqzivc0ni9xm8kalvn4k3a0bq";
+    sha256 = "0053j4i14lz5m2bzc5sch5id5ilr1bl196mp8fp0q8x74w3vavs9";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/applications/misc/cura/lulzbot/curaengine.nix
+++ b/pkgs/applications/misc/cura/lulzbot/curaengine.nix
@ -1,6 +1,6 @@
-{ stdenv, callPackage, fetchgit, fetchpatch, cmake, libarcusLulzbot, stb, protobuf }:
+{ gcc8Stdenv, callPackage, fetchgit, fetchpatch, cmake, libarcusLulzbot, stb, protobuf }:

-stdenv.mkDerivation rec {
+gcc8Stdenv.mkDerivation rec {
  pname = "curaengine-lulzBot";
  version = "3.6.21";

@ -15,7 +15,7 @@ stdenv.mkDerivation rec {

  cmakeFlags = [ "-DCURA_ENGINE_VERSION=${version}" ];

-  meta = with stdenv.lib; {
+  meta = with gcc8Stdenv.lib; {
    description = "A powerful, fast and robust engine for processing 3D models into 3D printing instruction";
    homepage = https://code.alephobjects.com/source/curaengine-lulzbot/;
    license = licenses.agpl3;
@ -23,4 +23,3 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ chaduffy ];
  };
 }
-
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -1,14 +1,14 @@
-{ lib, fetchFromGitHub, python3Packages, qtbase, wrapQtAppsHook }:
+{ lib, fetchFromGitHub, python3Packages, qtbase, wrapQtAppsHook, secp256k1 }:

 python3Packages.buildPythonApplication rec {
  pname = "electron-cash";
-  version = "4.0.11";
+  version = "4.0.14";

  src = fetchFromGitHub {
    owner = "Electron-Cash";
    repo = "Electron-Cash";
    rev = version;
-    sha256 = "1k4zbaj0g8bgk1l5vrb835a8bqfay2707bcb4ql2vx4igcwpb680";
+    sha256 = "1dp7cj1185h6xfz6jzh0iq58zvg3wq9hl96bkgxkf5h4ygni2vm6";
  };

  propagatedBuildInputs = with python3Packages; [
@ -25,6 +25,7 @@ python3Packages.buildPythonApplication rec {
    requests
    tlslite-ng
    qdarkstyle
+    stem

    # plugins
    keepkey
@ -56,8 +57,14 @@ python3Packages.buildPythonApplication rec {
      --replace "Exec=electron-cash" "Exec=$out/bin/electron-cash"
  '';

+  # If secp256k1 wasn't added to the library path, the following warning is given:
+  #
+  #   Electron Cash was unable to find the secp256k1 library on this system.
+  #   Elliptic curve cryptography operations will be performed in slow
+  #   Python-only mode.
  postFixup = ''
-    wrapQtApp $out/bin/electron-cash
+    wrapQtApp $out/bin/electron-cash \
+      --prefix LD_LIBRARY_PATH : ${secp256k1}/lib
  '';

  doInstallCheck = true;
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
  pname = "exercism";
@ -13,8 +13,6 @@ buildGoModule rec {

  modSha256 = "0pg0hxrr6jjd03wbjn5y65x02md3h352mnm1gr6vyiv7hn4ws14m";

-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
  subPackages = [ "./exercism" ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@ -1,4 +1,4 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
  pname = "geoipupdate";
@ -13,8 +13,6 @@ buildGoModule rec {

  modSha256 = "1bypanvrkcqp8rk84cv2569671irgaf3cy27lcrknyina4pdvir5";

-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
  meta = with stdenv.lib; {
    description = "Automatic GeoIP database updater";
    homepage = "https://github.com/maxmind/geoipupdate";
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -1,20 +1,20 @@
-{ stdenv, buildGoModule, fetchFromGitHub, Security }:
+{ stdenv, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
  pname = "hugo";
-  version = "0.68.1";
+  version = "0.68.3";
+
+  goPackagePath = "github.com/gohugoio/hugo";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1h7zymvxk71jq51az4qnldk54jl9sd4zwkn5r5323xzjffwzny82";
+    sha256 = "138sv4q6f1szpkrrxnzhvxr6rrznhq1d7in0zba1pifsw3yimqq4";
  };

  modSha256 = "04vzm65kbj9905z4cf5yh6yc6g3b0pd5vc00lrxw84pwgqgc0ykb";

-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];
-
  buildFlags = [ "-tags" "extended" ];

  subPackages = [ "." ];
--- a/Show More
+++ b/Show More
				`@ -1 +0,0 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzJ0OniLB91MpPC86I1m3wwJeAc+Gme7bAuaLIU/cSfPwxT5NO7MfCp0Pu94gYDKtDXMs/wXg0bTAVDeAFFkdIj6kBBumEmQLCTL48q2UxDIXVLT/E/AAgj6q7WwgCg7fwm4Vjn4z7aUyBx8EfRy+5/SQyeYla3D/lFYgMi5x4D6J+yeR+JPAptDE/IR5IizNV7mY0ZcoXYyHrrehI1tTYEEqjX13ZqS4OCBFWwHe1QHhRNM+jHhcATbgikjAj8FyFPtLvc+dSVtkuhQktQl36Bi8zMUQcV6+mM7Ln6DBcDlM9urHKLYPTWmUAyhxM955iglOn5z0RaAIcyNMT6hz0rHaNf0BIlmbXoTC0XGjHh/OnoOEC/zg0JqgQTnPiU45K4TnRSSXp2GfiDfiQAK0+HaXACkjuFR68u7WCZpB1Bse1OgKNClFqtRhIr5DilUb2/e5DCCmFkddMUcjmYqzZdbXNt7fo8CFULe+mbiCp8+tMg4aRTaDZ/Hk93nCvGE5TP2ypEMbfL6nRVKvXOjhdvSQQgKwx+O003FDEHCSG0Bpageh7yVpna+SPrbGklce7MjTpbx3iIwmvKpQ6asnK1L3KkahpY1S3NhQ+/S3Gs8KWQ5LAU+d3xiPX3jfIVHsCIIyxHDbwcJvxM4MFBFQpqRMD6E+LoM9RHjl4C9k2iQ== tmtynkky@duuni
				`@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxf7fZiqKDblHFEDxt6X9/rTjBXSn/re6b46S7/e9/ nixbld@localhost`
				`@ -1 +0,0 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDv70DY8I85MCUWatpuWtRYD5Vl0C4t8zold4ew4XtlsLYXqW9aa8Mz3bkNCqGICNyBae3lYdZLlj5vuUae7NPt/Ip6Bd3zScJGaqWlIbeytfT+XFFpAAkvN+gONywX5x6zBCjoZKxicIdXEw2zTTuBttVjd/uj6xZm0t3Ek8PaIe+XlmssrR3VEsyZTpx8iEgAGUvRLwRaK/b1FE56mwJCdLR2crZv6+ifVIJiiCC8Ax7ZOgAgAnz66pph8YDKf2rx+NmJEfEuYoOr3S0qgJQvmv/Z2YQgT63xP/c98eirVDNm2z1b2J2EF1PbV0RcG0bKgy1ySnmeOTmbzYtANiI5eS5KghSFI616HmDt8G/UG1VIRHEmDdR4mM94YoXB2fNqmYAoLbD/pXzFwgg00D5+FkDsH18PVECLZMQJn6DIxgNzhP5RKUxKb1x+9I6t/b7meC0VvziceOq8KXEIwu75sJYrwdqapTOET9rkttH7jwTs/IazcpX6xYU30o6dqROOP/qJCFdlGGB4Arf0XZdOTkyzlj4FFJK2cygxkDaCshX6MeLXNtaiRWpc8jlhGjmKxH8+C0oBXoV81a6ZxigUn0XjSkwdDqElUSa2sIHHsQClKXeZIZtAlSaKUsLnWo2HBBFsP/9m2kis3zYdMwrNnqSPuQMJ2x9/7CyeQheaYw== tmtynkky@duuni
				`@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0zPqqXF1CoDiiauBs6VWzFIY40Imy2Nb3Oqq5qOUg nixbld@localhost`