Merge branch 'staging-next' into staging

2019-12-14 23:09:23 +01:00 · 2019-12-14 23:09:23 +01:00 · aa3cb8b00e
commit aa3cb8b00e
parent 025e4fda6a 429561978b
263 changed files with 5623 additions and 4152 deletions
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@ -1123,6 +1123,16 @@ preBuild = ''

   <variablelist>
    <title>Variables controlling the install phase</title>
+     <varlistentry>
+     <term>
+       <varname>dontInstall</varname>
+     </term>
+     <listitem>
+      <para>
+       Set to true to skip the install phase.
+      </para>
+     </listitem>
+    </varlistentry>
    <varlistentry>
     <term>
      <varname>makeFlags</varname> / <varname>makeFlagsArray</varname> / <varname>makefile</varname>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1110,6 +1110,12 @@
    githubId = 5555066;
    name = "Andrew Cann";
  };
+  cap = {
+    name = "cap";
+    email = "nixos_xasenw9@digitalpostkasten.de";
+    github = "scaredmushroom";
+    githubId = 45340040;
+  };
  carlosdagos = {
    email = "m@cdagostino.io";
    github = "carlosdagos";
@ -2496,6 +2502,12 @@
    githubId = 40521440;
    name = "Haruka Akiyama";
  };
+  fuzen = {
+    email = "me@fuzen.cafe";
+    github = "fuzen-py";
+    githubId = 17859309;
+    name = "Fuzen";
+  };
  fuzzy-id = {
    email = "hacking+nixos@babibo.de";
    name = "Thomas Bach";
@ -2868,6 +2880,12 @@
    githubId = 69209;
    name = "Ian Duncan";
  };
+  ianmjones = {
+    email = "ian@ianmjones.com";
+    github = "ianmjones";
+    githubId = 4710;
+    name = "Ian M. Jones";
+  };
  ianwookim = {
    email = "ianwookim@gmail.com";
    github = "wavewave";
@ -4995,6 +5013,12 @@
    githubId = 2946283;
    name = "Brian Cohen";
  };
+  novoxudonoser = {
+    email = "radnovox@gmail.com";
+    github = "novoxudonoser";
+    githubId = 6052922;
+    name = "Kirill Struokov";
+  };
  np = {
    email = "np.nix@nicolaspouillard.fr";
    github = "np";
@ -6379,6 +6403,12 @@
    githubId = 1437166;
    name = "Xia Bin";
  };
+  softinio = {
+    email = "code@softinio.com";
+    github = "softinio";
+    githubId = 3371635;
+    name = "Salar Rahmanian";
+  };
  solson = {
    email = "scott@solson.me";
    github = "solson";
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -478,7 +478,7 @@ Retype new UNIX password: ***</screen>
     shows what packages are available, and
 <screen>
 <prompt>$ </prompt>nix-env -f '&lt;nixpkgs&gt;' -iA w3m</screen>
-     install the <literal>w3m</literal> browser.
+     installs the <literal>w3m</literal> browser.
    </para>
   </listitem>
  </orderedlist>
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -233,6 +233,16 @@
     The fourStore and fourStoreEndpoint modules have been removed.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     Polkit no longer has the user of uid 0 (root) as an admin identity.
+     We now follow the upstream default of only having every member of the wheel
+     group admin privileged. Before it was root and members of wheel.
+     The positive outcome of this is pkexec GUI popups or terminal prompts
+     will no longer require the user to choose between two essentially equivalent
+     choices (whether to perform the action as themselves with wheel permissions, or as the root user).
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/lib/make-ext4-fs.nix
+++ b/nixos/lib/make-ext4-fs.nix
@ -4,8 +4,11 @@
 # generated image is sized to only fit its contents, with the expectation
 # that a script resizes the filesystem at boot time.
 { pkgs
+, lib
 # List of derivations to be included
 , storePaths
+# Whether or not to compress the resulting image with zstd
+, compressImage ? false, zstd
 # Shell commands to populate the ./files directory.
 # All files in that directory are copied to the root of the FS.
 , populateImageCommands ? ""
@ -20,18 +23,20 @@
 let
  sdClosureInfo = pkgs.buildPackages.closureInfo { rootPaths = storePaths; };
 in
-
 pkgs.stdenv.mkDerivation {
-  name = "ext4-fs.img";
+  name = "ext4-fs.img${lib.optionalString compressImage ".zst"}";

-  nativeBuildInputs = [e2fsprogs.bin libfaketime perl lkl];
+  nativeBuildInputs = [ e2fsprogs.bin libfaketime perl lkl ]
+  ++ lib.optional compressImage zstd;

  buildCommand =
    ''
+      ${if compressImage then "img=temp.img" else "img=$out"}
      (
      mkdir -p ./files
      ${populateImageCommands}
      )
+
      # Add the closures of the top-level store objects.
      storePaths=$(cat ${sdClosureInfo}/store-paths)

@ -42,28 +47,26 @@ pkgs.stdenv.mkDerivation {
      bytes=$((2 * 4096 * $numInodes + 4096 * $numDataBlocks))
      echo "Creating an EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks)"

-      truncate -s $bytes $out
-      faketime -f "1970-01-01 00:00:01" mkfs.ext4 -L ${volumeLabel} -U ${uuid} $out
+      truncate -s $bytes $img
+      faketime -f "1970-01-01 00:00:01" mkfs.ext4 -L ${volumeLabel} -U ${uuid} $img

      # Also include a manifest of the closures in a format suitable for nix-store --load-db.
      cp ${sdClosureInfo}/registration nix-path-registration
-      cptofs -t ext4 -i $out nix-path-registration /
+      cptofs -t ext4 -i $img nix-path-registration /

      # Create nix/store before copying paths
      faketime -f "1970-01-01 00:00:01" mkdir -p nix/store
-      cptofs -t ext4 -i $out nix /
+      cptofs -t ext4 -i $img nix /

      echo "copying store paths to image..."
-      cptofs -t ext4 -i $out $storePaths /nix/store/
+      cptofs -t ext4 -i $img $storePaths /nix/store/

-      (
      echo "copying files to image..."
-      cd ./files
-      cptofs -t ext4 -i $out ./* /
-      )
+      cptofs -t ext4 -i $img ./files/* /
+

      # I have ended up with corrupted images sometimes, I suspect that happens when the build machine's disk gets full during the build.
-      if ! fsck.ext4 -n -f $out; then
+      if ! fsck.ext4 -n -f $img; then
        echo "--- Fsck failed for EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks) ---"
        cat errorlog
        return 1
@ -71,9 +74,9 @@ pkgs.stdenv.mkDerivation {

      (
        # Resizes **snugly** to its actual limits (or closer to)
-        free=$(dumpe2fs $out | grep '^Free blocks:')
-        blocksize=$(dumpe2fs $out | grep '^Block size:')
-        blocks=$(dumpe2fs $out | grep '^Block count:')
+        free=$(dumpe2fs $img | grep '^Free blocks:')
+        blocksize=$(dumpe2fs $img | grep '^Block size:')
+        blocks=$(dumpe2fs $img | grep '^Block count:')
        blocks=$((''${blocks##*:})) # format the number.
        blocksize=$((''${blocksize##*:})) # format the number.
        # System can't boot with 0 blocks free.
@ -82,10 +85,15 @@ pkgs.stdenv.mkDerivation {
        size=$(( blocks - ''${free##*:} + fudge ))

        echo "Resizing from $blocks blocks to $size blocks. (~ $((size*blocksize/1024/1024))MiB)"
-        EXT2FS_NO_MTAB_OK=yes resize2fs $out -f $size
+        EXT2FS_NO_MTAB_OK=yes resize2fs $img -f $size
      )

      # And a final fsck, because of the previous truncating.
-      fsck.ext4 -n -f $out
+      fsck.ext4 -n -f $img
+
+      if [ ${builtins.toString compressImage} ]; then
+        echo "Compressing image"
+        zstd -v --no-progress ./$img -o $out
+      fi
    '';
 }
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -603,9 +603,6 @@ in
        { source = config.system.build.squashfsStore;
          target = "/nix-store.squashfs";
        }
-        { source = config.isoImage.efiSplashImage;
-          target = "/EFI/boot/efi-background.png";
-        }
        { source = config.isoImage.splashImage;
          target = "/isolinux/background.png";
        }
@ -630,8 +627,8 @@ in
        { source = "${efiDir}/EFI";
          target = "/EFI";
        }
-        { source = pkgs.writeText "loopback.cfg" "source /EFI/boot/grub.cfg";
-          target = "/boot/grub/loopback.cfg";
+        { source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/boot/grub.cfg") + "/grub";
+          target = "/boot/grub";
        }
      ] ++ optionals (config.boot.loader.grub.memtest86.enable && canx86BiosBoot) [
        { source = "${pkgs.memtest86plus}/memtest.bin";
@ -641,6 +638,10 @@ in
        { source = config.isoImage.grubTheme;
          target = "/EFI/boot/grub-theme";
        }
+      ] ++ [
+        { source = config.isoImage.efiSplashImage;
+          target = "/EFI/boot/efi-background.png";
+        }
      ];

    boot.loader.timeout = 10;
--- a/nixos/modules/installer/cd-dvd/sd-image.nix
+++ b/nixos/modules/installer/cd-dvd/sd-image.nix
@ -18,6 +18,7 @@ with lib;
 let
  rootfsImage = pkgs.callPackage ../../../lib/make-ext4-fs.nix ({
    inherit (config.sdImage) storePaths;
+    compressImage = true;
    populateImageCommands = config.sdImage.populateRootCommands;
    volumeLabel = "NIXOS_SD";
  } // optionalAttrs (config.sdImage.rootPartitionUUID != null) {
@ -128,10 +129,11 @@ in

    sdImage.storePaths = [ config.system.build.toplevel ];

-    system.build.sdImage = pkgs.callPackage ({ stdenv, dosfstools, e2fsprogs, mtools, libfaketime, utillinux, bzip2 }: stdenv.mkDerivation {
+    system.build.sdImage = pkgs.callPackage ({ stdenv, dosfstools, e2fsprogs,
+    mtools, libfaketime, utillinux, bzip2, zstd }: stdenv.mkDerivation {
      name = config.sdImage.imageName;

-      nativeBuildInputs = [ dosfstools e2fsprogs mtools libfaketime utillinux bzip2 ];
+      nativeBuildInputs = [ dosfstools e2fsprogs mtools libfaketime utillinux bzip2 zstd ];

      inherit (config.sdImage) compressImage;

@ -146,11 +148,14 @@ in
          echo "file sd-image $img" >> $out/nix-support/hydra-build-products
        fi

+        echo "Decompressing rootfs image"
+        zstd -d --no-progress "${rootfsImage}" -o ./root-fs.img
+
        # Gap in front of the first partition, in MiB
        gap=8

        # Create the image file sized to fit /boot/firmware and /, plus slack for the gap.
-        rootSizeBlocks=$(du -B 512 --apparent-size ${rootfsImage} | awk '{ print $1 }')
+        rootSizeBlocks=$(du -B 512 --apparent-size ./root-fs.img | awk '{ print $1 }')
        firmwareSizeBlocks=$((${toString config.sdImage.firmwareSize} * 1024 * 1024 / 512))
        imageSize=$((rootSizeBlocks * 512 + firmwareSizeBlocks * 512 + gap * 1024 * 1024))
        truncate -s $imageSize $img
@ -168,7 +173,7 @@ in

        # Copy the rootfs into the SD image
        eval $(partx $img -o START,SECTORS --nr 2 --pairs)
-        dd conv=notrunc if=${rootfsImage} of=$img seek=$START count=$SECTORS
+        dd conv=notrunc if=./root-fs.img of=$img seek=$START count=$SECTORS

        # Create a FAT32 /boot/firmware partition of suitable size into firmware_part.img
        eval $(partx $img -o START,SECTORS --nr 1 --pairs)
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -866,6 +866,7 @@
  ./services/x11/hardware/digimend.nix
  ./services/x11/hardware/cmt.nix
  ./services/x11/gdk-pixbuf.nix
+  ./services/x11/imwheel.nix
  ./services/x11/redshift.nix
  ./services/x11/urxvtd.nix
  ./services/x11/window-managers/awesome.nix
--- a/nixos/modules/programs/oblogout.nix
+++ b/nixos/modules/programs/oblogout.nix
@ -1,176 +1,11 @@
-# Global configuration for oblogout.
-
 { config, lib, pkgs, ... }:

 with lib;

-let cfg = config.programs.oblogout;
-
-in
 {
-  ###### interface

-  options = {
+  imports = [
+    (mkRemovedOptionModule [ "programs" "oblogout" ] "programs.oblogout has been removed from NixOS. This is because the oblogout repository has been archived upstream.")
+  ];

-    programs.oblogout = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to install OBLogout and create <filename>/etc/oblogout.conf</filename>.
-          See <filename>${pkgs.oblogout}/share/doc/README</filename>.
-        '';
-      };
-
-      opacity = mkOption {
-        type = types.int;
-        default = 70;
-        description = ''
-          Opacity percentage of Cairo rendered backgrounds.
-        '';
-      };
-
-      bgcolor = mkOption {
-        type = types.str;
-        default = "black";
-        description = ''
-          Colour name or hex code (#ffffff) of the background color.
-        '';
-      };
-
-      buttontheme = mkOption {
-        type = types.str;
-        default = "simplistic";
-        description = ''
-          Icon theme for the buttons, must be in the themes folder of
-          the package, or in
-          <filename>~/.themes/&lt;name&gt;/oblogout/</filename>.
-        '';
-      };
-
-      buttons = mkOption {
-        type = types.str;
-        default =  "cancel, logout, restart, shutdown, suspend, hibernate";
-        description = ''
-          List and order of buttons to show.
-        '';
-      };
-
-      cancel = mkOption {
-        type = types.str;
-        default =  "Escape";
-        description = ''
-          Cancel logout/shutdown shortcut.
-        '';
-      };
-
-      shutdown = mkOption {
-        type = types.str;
-        default = "S";
-        description = ''
-          Shutdown shortcut.
-        '';
-      };
-
-      restart = mkOption {
-        type = types.str;
-        default = "R";
-        description = ''
-          Restart shortcut.
-        '';
-      };
-
-      suspend = mkOption {
-        type = types.str;
-        default = "U";
-        description = ''
-          Suspend shortcut.
-        '';
-      };
-
-      logout = mkOption {
-        type = types.str;
-        default = "L";
-        description = ''
-          Logout shortcut.
-        '';
-      };
-
-      lock = mkOption {
-        type = types.str;
-        default = "K";
-        description = ''
-          Lock session shortcut.
-        '';
-      };
-
-      hibernate = mkOption {
-        type = types.str;
-        default =  "H";
-        description = ''
-          Hibernate shortcut.
-        '';
-      };
-
-      clogout = mkOption {
-        type = types.str;
-        default = "openbox --exit";
-        description = ''
-          Command to logout.
-        '';
-      };
-
-      clock = mkOption {
-        type = types.str;
-        default = "";
-        description = ''
-          Command to lock screen.
-        '';
-      };
-
-      cswitchuser = mkOption {
-        type = types.str;
-        default = "";
-        description = ''
-          Command to switch user.
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.oblogout ];
-
-    environment.etc."oblogout.conf".text = ''
-      [settings]
-      usehal = false
-
-      [looks]
-      opacity = ${toString cfg.opacity}
-      bgcolor = ${cfg.bgcolor}
-      buttontheme = ${cfg.buttontheme}
-      buttons = ${cfg.buttons}
-
-      [shortcuts]
-      cancel = ${cfg.cancel}
-      shutdown = ${cfg.shutdown}
-      restart = ${cfg.restart}
-      suspend = ${cfg.suspend}
-      logout = ${cfg.logout}
-      lock = ${cfg.lock}
-      hibernate = ${cfg.hibernate}
-
-      [commands]
-      shutdown = systemctl poweroff
-      restart = systemctl reboot
-      suspend = systemctl suspend
-      hibernate = systemctl hibernate
-      logout = ${cfg.clogout}
-      lock = ${cfg.clock}
-      switchuser = ${cfg.cswitchuser}
-    '';
-  };
 }
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@ -87,6 +87,8 @@ in {
    hardware.opengl.enable = mkDefault true;
    fonts.enableDefaultFonts = mkDefault true;
    programs.dconf.enable = mkDefault true;
+    # To make a Sway session available if a display manager like SDDM is enabled:
+    services.xserver.displayManager.extraSessionFilePackages = [ swayJoined ];
  };

  meta.maintainers = with lib.maintainers; [ gnidorah primeos colemickens ];
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@ -42,15 +42,14 @@ in

    security.polkit.adminIdentities = mkOption {
      type = types.listOf types.str;
-      default = [ "unix-user:0" "unix-group:wheel" ];
+      default = [ "unix-group:wheel" ];
      example = [ "unix-user:alice" "unix-group:admin" ];
      description =
        ''
          Specifies which users are considered “administrators”, for those
          actions that require the user to authenticate as an
          administrator (i.e. have an <literal>auth_admin</literal>
-          value).  By default, this is the <literal>root</literal>
-          user and all users in the <literal>wheel</literal> group.
+          value).  By default, this is all users in the <literal>wheel</literal> group.
        '';
    };

--- a/nixos/modules/services/backup/bacula.nix
+++ b/nixos/modules/services/backup/bacula.nix
@ -45,6 +45,16 @@ let
        ${sd_cfg.extraStorageConfig}
      }

+      ${concatStringsSep "\n" (mapAttrsToList (name: value: ''
+      Autochanger {
+        Name = "${name}";
+        Device = ${concatStringsSep ", " (map (a: "\"${a}\"") value.devices)};
+        Changer Device =  "${value.changerDevice}";
+        Changer Command = "${value.changerCommand}";
+        ${value.extraAutochangerConfig}
+      }
+      '') sd_cfg.autochanger)}
+
      ${concatStringsSep "\n" (mapAttrsToList (name: value: ''
      Device {
        Name = "${name}";
@ -103,7 +113,19 @@ let
      password = mkOption {
        # TODO: required?
        description = ''
-           Specifies the password that must be supplied for a Director to b
+          Specifies the password that must be supplied for the default Bacula
+          Console to be authorized. The same password must appear in the
+          Director resource of the Console configuration file. For added
+          security, the password is never passed across the network but instead
+          a challenge response hash code created with the password. This
+          directive is required. If you have either /dev/random or bc on your
+          machine, Bacula will generate a random password during the
+          configuration process, otherwise it will be left blank and you must
+          manually supply it.
+
+          The password is plain text. It is not generated through any special
+          process but as noted above, it is better to use random text for
+          security reasons. 
        '';
      };
      
@ -111,26 +133,133 @@ let
        default = "no";
        example = "yes";
        description = ''
-           If Monitor is set to no (default), this director will have full 
+          If Monitor is set to <literal>no</literal>, this director will have
+          full access to this Storage daemon. If Monitor is set to
+          <literal>yes</literal>, this director will only be able to fetch the
+          current status of this Storage daemon.
+
+          Please note that if this director is being used by a Monitor, we
+          highly recommend to set this directive to yes to avoid serious
+          security problems. 
        '';
      };
    };
  };

+  autochangerOptions = {...}:
+  {
+    options = {
+      changerDevice = mkOption {
+        description = ''
+          The specified name-string must be the generic SCSI device name of the
+          autochanger that corresponds to the normal read/write Archive Device
+          specified in the Device resource. This generic SCSI device name
+          should be specified if you have an autochanger or if you have a
+          standard tape drive and want to use the Alert Command (see below).
+          For example, on Linux systems, for an Archive Device name of
+          <literal>/dev/nst0</literal>, you would specify
+          <literal>/dev/sg0</literal> for the Changer Device name.  Depending
+          on your exact configuration, and the number of autochangers or the
+          type of autochanger, what you specify here can vary. This directive
+          is optional. See the Using AutochangersAutochangersChapter chapter of
+          this manual for more details of using this and the following
+          autochanger directives.         
+          '';
+      };
+
+      changerCommand = mkOption {
+        description = ''
+          The name-string specifies an external program to be called that will
+          automatically change volumes as required by Bacula. Normally, this
+          directive will be specified only in the AutoChanger resource, which
+          is then used for all devices. However, you may also specify the
+          different Changer Command in each Device resource. Most frequently,
+          you will specify the Bacula supplied mtx-changer script as follows:
+
+          <literal>"/path/mtx-changer %c %o %S %a %d"</literal>
+
+          and you will install the mtx on your system (found in the depkgs
+          release). An example of this command is in the default bacula-sd.conf
+          file. For more details on the substitution characters that may be
+          specified to configure your autochanger please see the
+          AutochangersAutochangersChapter chapter of this manual. For FreeBSD
+          users, you might want to see one of the several chio scripts in
+          examples/autochangers.
+          '';
+        default = "/etc/bacula/mtx-changer %c %o %S %a %d";
+      };
+
+      devices = mkOption {
+        description = ''
+        '';
+      };
+
+      extraAutochangerConfig = mkOption {
+        default = "";
+        description = ''
+          Extra configuration to be passed in Autochanger directive.
+        '';
+        example = ''
+   
+        '';
+      };
+    };
+  };
+
+
  deviceOptions = {...}:
  {
    options = {
      archiveDevice = mkOption {
        # TODO: required?
        description = ''
-          The specified name-string gives the system file name of the storage device managed by this storage daemon. This will usually be the device file name of a removable storage device (tape drive), for example " /dev/nst0" or "/dev/rmt/0mbn". For a DVD-writer, it will be for example /dev/hdc. It may also be a directory name if you are archiving to disk storage.
+          The specified name-string gives the system file name of the storage
+          device managed by this storage daemon. This will usually be the
+          device file name of a removable storage device (tape drive), for
+          example <literal>/dev/nst0</literal> or
+          <literal>/dev/rmt/0mbn</literal>. For a DVD-writer, it will be for
+          example <literal>/dev/hdc</literal>. It may also be a directory name
+          if you are archiving to disk storage. In this case, you must supply
+          the full absolute path to the directory. When specifying a tape
+          device, it is preferable that the "non-rewind" variant of the device
+          file name be given. 
        '';
      };

      mediaType = mkOption {
        # TODO: required?
        description = ''
-          The specified name-string names the type of media supported by this device, for example, "DLT7000". Media type names are arbitrary in that you set them to anything you want, but they must be known to the volume database to keep track of which storage daemons can read which volumes. In general, each different storage type should have a unique Media Type associated with it. The same name-string must appear in the appropriate Storage resource definition in the Director's configuration file.
+          The specified name-string names the type of media supported by this
+          device, for example, <literal>DLT7000</literal>. Media type names are
+          arbitrary in that you set them to anything you want, but they must be
+          known to the volume database to keep track of which storage daemons
+          can read which volumes. In general, each different storage type
+          should have a unique Media Type associated with it. The same
+          name-string must appear in the appropriate Storage resource
+          definition in the Director's configuration file.
+
+          Even though the names you assign are arbitrary (i.e. you choose the
+          name you want), you should take care in specifying them because the
+          Media Type is used to determine which storage device Bacula will
+          select during restore. Thus you should probably use the same Media
+          Type specification for all drives where the Media can be freely
+          interchanged. This is not generally an issue if you have a single
+          Storage daemon, but it is with multiple Storage daemons, especially
+          if they have incompatible media.
+
+          For example, if you specify a Media Type of <literal>DDS-4</literal>
+          then during the restore, Bacula will be able to choose any Storage
+          Daemon that handles <literal>DDS-4</literal>. If you have an
+          autochanger, you might want to name the Media Type in a way that is
+          unique to the autochanger, unless you wish to possibly use the
+          Volumes in other drives. You should also ensure to have unique Media
+          Type names if the Media is not compatible between drives. This
+          specification is required for all devices.
+
+          In addition, if you are using disk storage, each Device resource will
+          generally have a different mount point or directory. In order for
+          Bacula to select the correct Device resource, each one must have a
+          unique Media Type.
        '';
      };

@ -166,8 +295,8 @@ in {
        default = "${config.networking.hostName}-fd";
        description = ''
          The client name that must be used by the Director when connecting.
-          Generally, it is a good idea to use a name related to the machine
-          so that error messages can be easily identified if you have multiple
+          Generally, it is a good idea to use a name related to the machine so
+          that error messages can be easily identified if you have multiple
          Clients. This directive is required.
        '';
      };
@ -232,7 +361,8 @@ in {
        default = 9103;
        type = types.int;
        description = ''
-          Specifies port number on which the Storage daemon listens for Director connections. The default is 9103.
+          Specifies port number on which the Storage daemon listens for
+          Director connections.
        '';
      };

@ -252,6 +382,14 @@ in {
        type = with types; attrsOf (submodule deviceOptions);
      };

+      autochanger = mkOption {
+        default = {};
+        description = ''
+          This option defines Autochanger resources in Bacula Storage Daemon.
+        '';
+        type = with types; attrsOf (submodule autochangerOptions);
+      };
+
      extraStorageConfig = mkOption {
        default = "";
        description = ''
@ -287,7 +425,8 @@ in {
      name = mkOption {
        default = "${config.networking.hostName}-dir";
        description = ''
-          The director name used by the system administrator. This directive is required.
+          The director name used by the system administrator. This directive is
+          required.
        '';
      };
 
@ -295,7 +434,12 @@ in {
        default = 9101;
        type = types.int;
        description = ''
-          Specify the port (a positive integer) on which the Director daemon will listen for Bacula Console connections. This same port number must be specified in the Director resource of the Console configuration file. The default is 9101, so normally this directive need not be specified. This directive should not be used if you specify DirAddresses (N.B plural) directive.
+          Specify the port (a positive integer) on which the Director daemon
+          will listen for Bacula Console connections. This same port number
+          must be specified in the Director resource of the Console
+          configuration file. The default is 9101, so normally this directive
+          need not be specified. This directive should not be used if you
+          specify DirAddresses (N.B plural) directive.
        '';
      };
 
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@ -339,9 +339,9 @@ in
            '') cfg.ensureDatabases}
          '' + ''
            ${concatMapStrings (user: ''
-              $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc "CREATE USER ${user.name}"
+              $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
              ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
-                $PSQL -tAc 'GRANT ${permission} ON ${database} TO ${user.name}'
+                $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"'
              '') user.ensurePermissions)}
            '') cfg.ensureUsers}
          '';
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -671,43 +671,30 @@ in {
        gid = config.ids.gids.matrix-synapse;
      } ];

-    services.postgresql.enable = mkIf usePostgresql (mkDefault true);
+    services.postgresql = mkIf (usePostgresql && cfg.create_local_database) {
+      enable = mkDefault true;
+      ensureDatabases = [ cfg.database_name ];
+      ensureUsers = [{
+        name = cfg.database_user;
+        ensurePermissions = { "DATABASE \"${cfg.database_name}\"" = "ALL PRIVILEGES"; };
+      }];
+    };

    systemd.services.matrix-synapse = {
      description = "Synapse Matrix homeserver";
-      after = [ "network.target" "postgresql.service" ];
+      after = [ "network.target" ] ++ lib.optional config.services.postgresql.enable "postgresql.service" ;
      wantedBy = [ "multi-user.target" ];
      preStart = ''
        ${cfg.package}/bin/homeserver \
          --config-path ${configFile} \
          --keys-directory ${cfg.dataDir} \
          --generate-keys
-      '' + optionalString (usePostgresql && cfg.create_local_database) ''
-        if ! test -e "${cfg.dataDir}/db-created"; then
-          ${pkgs.sudo}/bin/sudo -u ${pg.superUser} \
-            ${pg.package}/bin/createuser \
-            --login \
-            --no-createdb \
-            --no-createrole \
-            --encrypted \
-            ${cfg.database_user}
-          ${pkgs.sudo}/bin/sudo -u ${pg.superUser} \
-            ${pg.package}/bin/createdb \
-            --owner=${cfg.database_user} \
-            --encoding=UTF8 \
-            --lc-collate=C \
-            --lc-ctype=C \
-            --template=template0 \
-            ${cfg.database_name}
-          touch "${cfg.dataDir}/db-created"
-        fi
      '';
      serviceConfig = {
        Type = "notify";
        User = "matrix-synapse";
        Group = "matrix-synapse";
        WorkingDirectory = cfg.dataDir;
-        PermissionsStartOnly = true;
        ExecStart = ''
          ${cfg.package}/bin/homeserver \
            ${ concatMapStringsSep "\n  " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) }
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@ -13,20 +13,24 @@ let
  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

  flushNat = ''
-    iptables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true
-    iptables -w -t nat -F nixos-nat-pre 2>/dev/null || true
-    iptables -w -t nat -X nixos-nat-pre 2>/dev/null || true
-    iptables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
-    iptables -w -t nat -F nixos-nat-post 2>/dev/null || true
-    iptables -w -t nat -X nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true
+    ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true
+    ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true
+    ip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true
+    ip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true
+    ip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true

    ${cfg.extraStopCommands}
  '';

  setupNat = ''
    # Create subchain where we store rules
-    iptables -w -t nat -N nixos-nat-pre
-    iptables -w -t nat -N nixos-nat-post
+    ip46tables -w -t nat -N nixos-nat-pre
+    ip46tables -w -t nat -N nixos-nat-post
+    ip46tables -w -t nat -N nixos-nat-out

    # We can't match on incoming interface in POSTROUTING, so
    # mark packets coming from the internal interfaces.
@ -88,8 +92,9 @@ let
    ${cfg.extraCommands}

    # Append our chains to the nat tables
-    iptables -w -t nat -A PREROUTING -j nixos-nat-pre
-    iptables -w -t nat -A POSTROUTING -j nixos-nat-post
+    ip46tables -w -t nat -A PREROUTING -j nixos-nat-pre
+    ip46tables -w -t nat -A POSTROUTING -j nixos-nat-post
+    ip46tables -w -t nat -A OUTPUT -j nixos-nat-out
  '';

 in
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@ -53,6 +53,13 @@ in

      enable = mkEnableOption "Unbound domain name server";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.unbound;
+        defaultText = "pkgs.unbound";
+        description = "The unbound package to use";
+      };
+
      allowedAccess = mkOption {
        default = [ "127.0.0.0/24" ];
        type = types.listOf types.str;
@ -94,7 +101,7 @@ in

  config = mkIf cfg.enable {

-    environment.systemPackages = [ pkgs.unbound ];
+    environment.systemPackages = [ cfg.package ];

    users.users.unbound = {
      description = "unbound daemon user";
@ -114,7 +121,7 @@ in
        mkdir -m 0755 -p ${stateDir}/dev/
        cp ${confFile} ${stateDir}/unbound.conf
        ${optionalString cfg.enableRootTrustAnchor ''
-          ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
+          ${cfg.package}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
          chown unbound ${stateDir} ${rootTrustAnchorFile}
        ''}
        touch ${stateDir}/dev/random
@ -122,7 +129,7 @@ in
      '';

      serviceConfig = {
-        ExecStart = "${pkgs.unbound}/bin/unbound -d -c ${stateDir}/unbound.conf";
+        ExecStart = "${cfg.package}/bin/unbound -d -c ${stateDir}/unbound.conf";
        ExecStopPost="${pkgs.utillinux}/bin/umount ${stateDir}/dev/random";

        ProtectSystem = true;
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -71,7 +71,7 @@ in
      };

      downloadDirPermissions = mkOption {
-        type = types.string;
+        type = types.str;
        default = "770";
        example = "775";
        description = ''
--- a/nixos/modules/services/web-servers/unit/default.nix
+++ b/nixos/modules/services/web-servers/unit/default.nix
@ -93,23 +93,39 @@ in {
      wantedBy = [ "multi-user.target" ];
      path = with pkgs; [ curl ];
      preStart = ''
-        test -f '/run/unit/control.unit.sock' || rm -f '/run/unit/control.unit.sock'
+        test -f '${cfg.stateDir}/conf.json' || rm -f '${cfg.stateDir}/conf.json'
      '';
      postStart = ''
        curl -X PUT --data-binary '@${configFile}' --unix-socket '/run/unit/control.unit.sock' 'http://localhost/config'
      '';
      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID";
-        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID";
        ExecStart = ''
          ${cfg.package}/bin/unitd --control 'unix:/run/unit/control.unit.sock' --pid '/run/unit/unit.pid' \
                                   --log '${cfg.logDir}/unit.log' --state '${cfg.stateDir}' --no-daemon \
                                   --user ${cfg.user} --group ${cfg.group}
        '';
+        # User and group
+        User = cfg.user;
+        Group = cfg.group;
+        # Capabilities
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SETGID" "CAP_SETUID" ];
+        # Security
+        NoNewPrivileges = true;
+        # Sanboxing
+        ProtectSystem = "full";
+        ProtectHome = true;
        RuntimeDirectory = "unit";
        RuntimeDirectoryMode = "0750";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        PrivateMounts = true;
      };
    };

--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -204,9 +204,12 @@ in
          cat - > /run/gdm/.config/gnome-initial-setup-done <<- EOF
          yes
          EOF
-        '' + optionalString hasDefaultUserSession ''
-          ${setSessionScript}/bin/set-session ${defaultSessionName}
-        '';
+        ''
+        # TODO: Make setSessionScript aware of previously used sessions
+        # + optionalString hasDefaultUserSession ''
+        #   ${setSessionScript}/bin/set-session ${defaultSessionName}
+        # ''
+        ;
      };

    # Because sd_login_monitor_new requires /run/systemd/machines
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
@ -35,6 +35,9 @@ in
      name = "io.elementary.greeter";
    };

+    # Show manual login card.
+    services.xserver.displayManager.lightdm.extraSeatDefaults = "greeter-show-manual-login=true";
+
    environment.etc."lightdm/io.elementary.greeter.conf".source = "${pkgs.pantheon.elementary-greeter}/etc/lightdm/io.elementary.greeter.conf";
    environment.etc."wingpanel.d/io.elementary.greeter.whitelist".source = "${pkgs.pantheon.elementary-default-settings}/etc/wingpanel.d/io.elementary.greeter.whitelist";

--- a/nixos/modules/services/x11/imwheel.nix
+++ b/nixos/modules/services/x11/imwheel.nix
@ -0,0 +1,68 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.xserver.imwheel;
+in
+  {
+    options = {
+      services.xserver.imwheel = {
+        enable = mkEnableOption "IMWheel service";
+
+        extraOptions = mkOption {
+          type = types.listOf types.str;
+          default = [ "--buttons 45" ];
+          example = [ "--debug" ];
+          description = ''
+            Additional command-line arguments to pass to
+            <command>imwheel</command>.
+          '';
+        };
+
+        rules = mkOption {
+          type = types.attrsOf types.str;
+          default = {};
+          example = literalExample ''
+            ".*" = '''
+              None,      Up,   Button4, 8
+              None,      Down, Button5, 8
+              Shift_L,   Up,   Shift_L|Button4, 4
+              Shift_L,   Down, Shift_L|Button5, 4
+              Control_L, Up,   Control_L|Button4
+              Control_L, Down, Control_L|Button5
+            ''';
+          '';
+          description = ''
+            Window class translation rules.
+            /etc/X11/imwheelrc is generated based on this config
+            which means this config is global for all users.
+            See <link xlink:href="http://imwheel.sourceforge.net/imwheel.1.html">offical man pages</link>
+            for more informations.
+          '';
+        };
+      };
+    };
+
+    config = mkIf cfg.enable {
+      environment.systemPackages = [ pkgs.imwheel ];
+
+      environment.etc."X11/imwheel/imwheelrc".source =
+        pkgs.writeText "imwheelrc" (concatStringsSep "\n\n"
+          (mapAttrsToList
+            (rule: conf: "\"${rule}\"\n${conf}") cfg.rules
+          ));
+
+      systemd.user.services.imwheel = {
+        description = "imwheel service";
+        wantedBy = [ "graphical-session.target" ];
+        partOf = [ "graphical-session.target" ];
+        serviceConfig = {
+          ExecStart = "${pkgs.imwheel}/bin/imwheel " + escapeShellArgs ([
+            "--detach"
+            "--kill"
+          ] ++ cfg.extraOptions);
+          ExecStop = "${pkgs.procps}/bin/pkill imwheel";
+          Restart = "on-failure";
+        };
+      };
+    };
+  }
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -35,6 +35,18 @@ in
          with nixos.
        '';
      };
+      recommendedSysctlSettings = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          enables various settings to avoid common pitfalls when
+          running containers requiring many file operations.
+          Fixes errors like "Too many open files" or
+          "neighbour: ndisc_cache: neighbor table overflow!".
+          See https://lxd.readthedocs.io/en/latest/production-setup/
+          for details.
+        '';
+      };
    };
  };

@ -69,8 +81,11 @@ in
        ExecStart = "@${pkgs.lxd.bin}/bin/lxd lxd --group lxd";
        Type = "simple";
        KillMode = "process"; # when stopping, leave the containers alone
+        LimitMEMLOCK = "infinity";
+        LimitNOFILE = "1048576";
+        LimitNPROC = "infinity";
+        TasksMax = "infinity";
      };
-
    };

    users.groups.lxd.gid = config.ids.gids.lxd;
@ -79,5 +94,16 @@ in
      subUidRanges = [ { startUid = 1000000; count = 65536; } ];
      subGidRanges = [ { startGid = 1000000; count = 65536; } ];
    };
+
+    boot.kernel.sysctl = mkIf cfg.recommendedSysctlSettings {
+      "fs.inotify.max_queued_events" = 1048576;
+      "fs.inotify.max_user_instances" = 1048576;
+      "fs.inotify.max_user_watches" = 1048576;
+      "vm.max_map_count" = 262144;
+      "kernel.dmesg_restrict" = 1;
+      "net.ipv4.neigh.default.gc_thresh3" = 8192;
+      "net.ipv6.neigh.default.gc_thresh3" = 8192;
+      "kernel.keys.maxkeys" = 2000;
+    };
  };
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -57,6 +57,7 @@ in
  containers-ip = handleTest ./containers-ip.nix {};
  containers-macvlans = handleTest ./containers-macvlans.nix {};
  containers-physical_interfaces = handleTest ./containers-physical_interfaces.nix {};
+  containers-portforward = handleTest ./containers-portforward.nix {};
  containers-restart_networking = handleTest ./containers-restart_networking.nix {};
  containers-tmpfs = handleTest ./containers-tmpfs.nix {};
  couchdb = handleTest ./couchdb.nix {};
@ -262,6 +263,7 @@ in
  syncthing-init = handleTest ./syncthing-init.nix {};
  syncthing-relay = handleTest ./syncthing-relay.nix {};
  systemd = handleTest ./systemd.nix {};
+  systemd-analyze = handleTest ./systemd-analyze.nix {};
  systemd-confinement = handleTest ./systemd-confinement.nix {};
  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
  systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
--- a/nixos/tests/containers-extra_veth.nix
+++ b/nixos/tests/containers-extra_veth.nix
@ -1,7 +1,7 @@
 # Test for NixOS' container support.

-import ./make-test.nix ({ pkgs, ...} : {
-  name = "containers-bridge";
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "containers-extra_veth";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ kampfschlaefer ];
  };
@ -52,52 +52,43 @@ import ./make-test.nix ({ pkgs, ...} : {

  testScript =
    ''
-      $machine->waitForUnit("default.target");
-      $machine->succeed("nixos-container list") =~ /webserver/ or die;
+      machine.wait_for_unit("default.target")
+      assert "webserver" in machine.succeed("nixos-container list")

-      # Status of the webserver container.
-      $machine->succeed("nixos-container status webserver") =~ /up/ or die;
+      with subtest("Status of the webserver container is up"):
+          assert "up" in machine.succeed("nixos-container status webserver")

-      # Debug
-      #$machine->succeed("nixos-container run webserver -- ip link >&2");
+      with subtest("Ensure that the veths are inside the container"):
+          assert "state UP" in machine.succeed(
+              "nixos-container run webserver -- ip link show veth1"
+          )
+          assert "state UP" in machine.succeed(
+              "nixos-container run webserver -- ip link show veth2"
+          )

-      # Ensure that the veths are inside the container
-      $machine->succeed("nixos-container run webserver -- ip link show veth1") =~ /state UP/ or die;
-      $machine->succeed("nixos-container run webserver -- ip link show veth2") =~ /state UP/ or die;
+      with subtest("Ensure the presence of the extra veths"):
+          assert "state UP" in machine.succeed("ip link show veth1")
+          assert "state UP" in machine.succeed("ip link show veth2")

-      # Debug
-      #$machine->succeed("ip link >&2");
+      with subtest("Ensure the veth1 is part of br1 on the host"):
+          assert "master br1" in machine.succeed("ip link show veth1")

-      # Ensure the presence of the extra veths
-      $machine->succeed("ip link show veth1") =~ /state UP/ or die;
-      $machine->succeed("ip link show veth2") =~ /state UP/ or die;
+      with subtest("Ping on main veth"):
+          machine.succeed("ping -n -c 1 192.168.0.100")
+          machine.succeed("ping -n -c 1 fc00::2")

-      # Ensure the veth1 is part of br1 on the host
-      $machine->succeed("ip link show veth1") =~ /master br1/ or die;
+      with subtest("Ping on the first extra veth"):
+          machine.succeed("ping -n -c 1 192.168.1.100 >&2")

-      # Debug
-      #$machine->succeed("ip -4 a >&2");
-      #$machine->succeed("ip -4 r >&2");
-      #$machine->succeed("nixos-container run webserver -- ip link >&2");
-      #$machine->succeed("nixos-container run webserver -- ip -4 a >&2");
-      #$machine->succeed("nixos-container run webserver -- ip -4 r >&2");
+      with subtest("Ping on the second extra veth"):
+          machine.succeed("ping -n -c 1 192.168.2.100 >&2")

-      # Ping on main veth
-      $machine->succeed("ping -n -c 1 192.168.0.100");
-      $machine->succeed("ping -n -c 1 fc00::2");
+      with subtest("Container can be stopped"):
+          machine.succeed("nixos-container stop webserver")
+          machine.fail("ping -n -c 1 192.168.1.100 >&2")
+          machine.fail("ping -n -c 1 192.168.2.100 >&2")

-      # Ping on the first extra veth
-      $machine->succeed("ping -n -c 1 192.168.1.100 >&2");
-
-      # Ping on the second extra veth
-      $machine->succeed("ping -n -c 1 192.168.2.100 >&2");
-
-      # Stop the container.
-      $machine->succeed("nixos-container stop webserver");
-      $machine->fail("ping -n -c 1 192.168.1.100 >&2");
-      $machine->fail("ping -n -c 1 192.168.2.100 >&2");
-
-      # Destroying a declarative container should fail.
-      $machine->fail("nixos-container destroy webserver");
+      with subtest("Destroying a declarative container should fail"):
+          machine.fail("nixos-container destroy webserver")
    '';
 })
--- a/nixos/tests/containers-macvlans.nix
+++ b/nixos/tests/containers-macvlans.nix
@ -6,7 +6,7 @@ let
  containerIp2 = "192.168.1.254";
 in

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-macvlans";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ montag451 ];
@ -64,19 +64,23 @@ import ./make-test.nix ({ pkgs, ...} : {
  };

  testScript = ''
-    startAll;
-    $machine1->waitForUnit("default.target");
-    $machine2->waitForUnit("default.target");
+    start_all()
+    machine1.wait_for_unit("default.target")
+    machine2.wait_for_unit("default.target")

-    # Ping between containers to check that macvlans are created in bridge mode
-    $machine1->succeed("nixos-container run test1 -- ping -n -c 1 ${containerIp2}");
+    with subtest(
+        "Ping between containers to check that macvlans are created in bridge mode"
+    ):
+        machine1.succeed("nixos-container run test1 -- ping -n -c 1 ${containerIp2}")

-    # Ping containers from the host (machine1)
-    $machine1->succeed("ping -n -c 1 ${containerIp1}");
-    $machine1->succeed("ping -n -c 1 ${containerIp2}");
+    with subtest("Ping containers from the host (machine1)"):
+        machine1.succeed("ping -n -c 1 ${containerIp1}")
+        machine1.succeed("ping -n -c 1 ${containerIp2}")

-    # Ping containers from the second machine to check that containers are reachable from the outside
-    $machine2->succeed("ping -n -c 1 ${containerIp1}");
-    $machine2->succeed("ping -n -c 1 ${containerIp2}");
+    with subtest(
+        "Ping containers from the second machine to check that containers are reachable from the outside"
+    ):
+        machine2.succeed("ping -n -c 1 ${containerIp1}")
+        machine2.succeed("ping -n -c 1 ${containerIp2}")
  '';
 })
--- a/nixos/tests/containers-physical_interfaces.nix
+++ b/nixos/tests/containers-physical_interfaces.nix
@ -1,5 +1,5 @@

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-physical_interfaces";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ kampfschlaefer ];
@ -86,48 +86,51 @@ import ./make-test.nix ({ pkgs, ...} : {
  };

  testScript = ''
-    startAll;
+    start_all()

-    subtest "prepare server", sub {
-      $server->waitForUnit("default.target");
-      $server->succeed("ip link show dev eth1 >&2");
-    };
+    with subtest("Prepare server"):
+        server.wait_for_unit("default.target")
+        server.succeed("ip link show dev eth1 >&2")

-    subtest "simple physical interface", sub {
-      $server->succeed("nixos-container start server");
-      $server->waitForUnit("container\@server");
-      $server->succeed("systemctl -M server list-dependencies network-addresses-eth1.service >&2");
+    with subtest("Simple physical interface is up"):
+        server.succeed("nixos-container start server")
+        server.wait_for_unit("container@server")
+        server.succeed(
+            "systemctl -M server list-dependencies network-addresses-eth1.service >&2"
+        )

        # The other tests will ping this container on its ip. Here we just check
        # that the device is present in the container.
-      $server->succeed("nixos-container run server -- ip a show dev eth1 >&2");
-    };
+        server.succeed("nixos-container run server -- ip a show dev eth1 >&2")

-    subtest "physical device in bridge in container", sub {
-      $bridged->waitForUnit("default.target");
-      $bridged->succeed("nixos-container start bridged");
-      $bridged->waitForUnit("container\@bridged");
-      $bridged->succeed("systemctl -M bridged list-dependencies network-addresses-br0.service >&2");
-      $bridged->succeed("systemctl -M bridged status -n 30 -l network-addresses-br0.service");
-      $bridged->succeed("nixos-container run bridged -- ping -w 10 -c 1 -n 10.10.0.1");
-    };
+    with subtest("Physical device in bridge in container can ping server"):
+        bridged.wait_for_unit("default.target")
+        bridged.succeed("nixos-container start bridged")
+        bridged.wait_for_unit("container@bridged")
+        bridged.succeed(
+            "systemctl -M bridged list-dependencies network-addresses-br0.service >&2",
+            "systemctl -M bridged status -n 30 -l network-addresses-br0.service",
+            "nixos-container run bridged -- ping -w 10 -c 1 -n 10.10.0.1",
+        )

-    subtest "physical device in bond in container", sub {
-      $bonded->waitForUnit("default.target");
-      $bonded->succeed("nixos-container start bonded");
-      $bonded->waitForUnit("container\@bonded");
-      $bonded->succeed("systemctl -M bonded list-dependencies network-addresses-bond0 >&2");
-      $bonded->succeed("systemctl -M bonded status -n 30 -l network-addresses-bond0 >&2");
-      $bonded->succeed("nixos-container run bonded -- ping -w 10 -c 1 -n 10.10.0.1");
-    };
+    with subtest("Physical device in bond in container can ping server"):
+        bonded.wait_for_unit("default.target")
+        bonded.succeed("nixos-container start bonded")
+        bonded.wait_for_unit("container@bonded")
+        bonded.succeed(
+            "systemctl -M bonded list-dependencies network-addresses-bond0 >&2",
+            "systemctl -M bonded status -n 30 -l network-addresses-bond0 >&2",
+            "nixos-container run bonded -- ping -w 10 -c 1 -n 10.10.0.1",
+        )

-    subtest "physical device in bond in bridge in container", sub {
-      $bridgedbond->waitForUnit("default.target");
-      $bridgedbond->succeed("nixos-container start bridgedbond");
-      $bridgedbond->waitForUnit("container\@bridgedbond");
-      $bridgedbond->succeed("systemctl -M bridgedbond list-dependencies network-addresses-br0.service >&2");
-      $bridgedbond->succeed("systemctl -M bridgedbond status -n 30 -l network-addresses-br0.service");
-      $bridgedbond->succeed("nixos-container run bridgedbond -- ping -w 10 -c 1 -n 10.10.0.1");
-    };
+    with subtest("Physical device in bond in bridge in container can ping server"):
+        bridgedbond.wait_for_unit("default.target")
+        bridgedbond.succeed("nixos-container start bridgedbond")
+        bridgedbond.wait_for_unit("container@bridgedbond")
+        bridgedbond.succeed(
+            "systemctl -M bridgedbond list-dependencies network-addresses-br0.service >&2",
+            "systemctl -M bridgedbond status -n 30 -l network-addresses-br0.service",
+            "nixos-container run bridgedbond -- ping -w 10 -c 1 -n 10.10.0.1",
+        )
  '';
 })
--- a/nixos/tests/containers-portforward.nix
+++ b/nixos/tests/containers-portforward.nix
@ -7,7 +7,7 @@ let
  containerPort = 80;
 in 

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-portforward";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ aristid aszlig eelco kampfschlaefer ianwookim ];
@ -36,27 +36,27 @@ import ./make-test.nix ({ pkgs, ...} : {

  testScript =
    ''
-      $machine->succeed("nixos-container list") =~ /webserver/ or die;
+      container_list = machine.succeed("nixos-container list")
+      assert "webserver" in container_list

      # Start the webserver container.
-      $machine->succeed("nixos-container start webserver");
+      machine.succeed("nixos-container start webserver")

      # wait two seconds for the container to start and the network to be up
-      sleep 2;
+      machine.sleep(2)

      # Since "start" returns after the container has reached
      # multi-user.target, we should now be able to access it.
-      #my $ip = $machine->succeed("nixos-container show-ip webserver");
-      #chomp $ip;
-      $machine->succeed("ping -n -c1 ${hostIp}");
-      $machine->succeed("curl --fail http://${hostIp}:${toString hostPort}/ > /dev/null");
+      # ip = machine.succeed("nixos-container show-ip webserver").strip()
+      machine.succeed("ping -n -c1 ${hostIp}")
+      machine.succeed("curl --fail http://${hostIp}:${toString hostPort}/ > /dev/null")

      # Stop the container.
-      $machine->succeed("nixos-container stop webserver");
-      $machine->fail("curl --fail --connect-timeout 2 http://${hostIp}:${toString hostPort}/ > /dev/null");
+      machine.succeed("nixos-container stop webserver")
+      machine.fail("curl --fail --connect-timeout 2 http://${hostIp}:${toString hostPort}/ > /dev/null")

      # Destroying a declarative container should fail.
-      $machine->fail("nixos-container destroy webserver");
+      machine.fail("nixos-container destroy webserver")
    '';

 })
--- a/nixos/tests/containers-restart_networking.nix
+++ b/nixos/tests/containers-restart_networking.nix
@ -16,7 +16,7 @@ let
      };
    };
  };
-in import ./make-test.nix ({ pkgs, ...} :
+in import ./make-test-python.nix ({ pkgs, ...} :
 {
  name = "containers-restart_networking";
  meta = with pkgs.stdenv.lib.maintainers; {
@ -64,50 +64,52 @@ in import ./make-test.nix ({ pkgs, ...} :
    eth1_bridged = nodes.client_eth1.config.system.build.toplevel;
    eth1_rstp = nodes.client_eth1_rstp.config.system.build.toplevel;
  in ''
-    $client->start();
+    client.start()

-    $client->waitForUnit("default.target");
+    client.wait_for_unit("default.target")

-    subtest "initial state", sub {
-      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2");
+    with subtest("Initial configuration connectivity check"):
+        client.succeed("ping 192.168.1.122 -c 1 -n >&2")
+        client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")

-      $client->fail("ip l show eth1 |grep \"master br0\" >&2");
-      $client->fail("grep eth1 /run/br0.interfaces >&2");
-    };
+        client.fail("ip l show eth1 |grep 'master br0' >&2")
+        client.fail("grep eth1 /run/br0.interfaces >&2")

-    subtest "interfaces without stp", sub {
-      $client->succeed("${eth1_bridged}/bin/switch-to-configuration test >&2");
+    with subtest("Bridged configuration without STP preserves connectivity"):
+        client.succeed(
+            "${eth1_bridged}/bin/switch-to-configuration test >&2"
+        )

-      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2");
+        client.succeed(
+            "ping 192.168.1.122 -c 1 -n >&2",
+            "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
+            "ip l show eth1 |grep 'master br0' >&2",
+            "grep eth1 /run/br0.interfaces >&2",
+        )

-      $client->succeed("ip l show eth1 |grep \"master br0\" >&2");
-      $client->succeed("grep eth1 /run/br0.interfaces >&2");
-    };
-
-    # activating rstp needs another service, therefor the bridge will restart and the container will loose its connectivity
-    #subtest "interfaces with rstp", sub {
-    #  $client->succeed("${eth1_rstp}/bin/switch-to-configuration test >&2");
-    #  $client->execute("ip -4 a >&2");
-    #  $client->execute("ip l >&2");
+    #  activating rstp needs another service, therefore the bridge will restart and the container will lose its connectivity
+    # with subtest("Bridged configuration with STP"):
+    #     client.succeed("${eth1_rstp}/bin/switch-to-configuration test >&2")
+    #     client.execute("ip -4 a >&2")
+    #     client.execute("ip l >&2")
    #
-    #  $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-    #  $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2");
-    #
-    #  $client->succeed("ip l show eth1 |grep \"master br0\" >&2");
-    #  $client->succeed("grep eth1 /run/br0.interfaces >&2");
-    #};
+    #     client.succeed(
+    #         "ping 192.168.1.122 -c 1 -n >&2",
+    #         "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
+    #         "ip l show eth1 |grep 'master br0' >&2",
+    #         "grep eth1 /run/br0.interfaces >&2",
+    #     )

-    subtest "back to no interfaces and no stp", sub {
-      $client->succeed("${originalSystem}/bin/switch-to-configuration test >&2");
+    with subtest("Reverting to initial configuration preserves connectivity"):
+        client.succeed(
+            "${originalSystem}/bin/switch-to-configuration test >&2"
+        )

-      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2");
+        client.succeed("ping 192.168.1.122 -c 1 -n >&2")
+        client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")

-      $client->fail("ip l show eth1 |grep \"master br0\" >&2");
-      $client->fail("grep eth1 /run/br0.interfaces >&2");
-    };
+        client.fail("ip l show eth1 |grep 'master br0' >&2")
+        client.fail("grep eth1 /run/br0.interfaces >&2")
  '';

 })
--- a/nixos/tests/gitea.nix
+++ b/nixos/tests/gitea.nix
@ -6,64 +6,104 @@
 with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;

-{
-  mysql = makeTest {
-    name = "gitea-mysql";
-    meta.maintainers = with maintainers; [ aanderse kolaente ];
+let
+  supportedDbTypes = [ "mysql" "postgres" "sqlite3" ];
+  makeGiteaTest = type: nameValuePair type (makeTest {
+    name = "gitea-${type}";
+    meta.maintainers = with maintainers; [ aanderse kolaente ma27 ];

-    machine =
-      { config, pkgs, ... }:
-      { services.gitea.enable = true;
-        services.gitea.database.type = "mysql";
+    nodes = {
+      server = { config, pkgs, ... }: {
+        services.gitea = {
+          enable = true;
+          database = { inherit type; };
+          disableRegistration = true;
+        };
+        environment.systemPackages = [ pkgs.gitea pkgs.jq ];
+        services.openssh.enable = true;
+      };
+      client1 = { config, pkgs, ... }: {
+        environment.systemPackages = [ pkgs.git ];
+      };
+      client2 = { config, pkgs, ... }: {
+        environment.systemPackages = [ pkgs.git ];
+      };
    };

-    testScript = ''
+    testScript = let
+      inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+    in ''
+      GIT_SSH_COMMAND = "ssh -i $HOME/.ssh/privk -o StrictHostKeyChecking=no"
+      REPO = "gitea@server:test/repo"
+      PRIVK = "${snakeOilPrivateKey}"
+
      start_all()

-      machine.wait_for_unit("gitea.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl --fail http://localhost:3000/")
-    '';
-  };
+      client1.succeed("mkdir /tmp/repo")
+      client1.succeed("mkdir -p $HOME/.ssh")
+      client1.succeed(f"cat {PRIVK} > $HOME/.ssh/privk")
+      client1.succeed("chmod 0400 $HOME/.ssh/privk")
+      client1.succeed("git -C /tmp/repo init")
+      client1.succeed("echo hello world > /tmp/repo/testfile")
+      client1.succeed("git -C /tmp/repo add .")
+      client1.succeed("git config --global user.email test@localhost")
+      client1.succeed("git config --global user.name test")
+      client1.succeed("git -C /tmp/repo commit -m 'Initial import'")
+      client1.succeed(f"git -C /tmp/repo remote add origin {REPO}")

-  postgres = makeTest {
-    name = "gitea-postgres";
-    meta.maintainers = [ maintainers.aanderse ];
+      server.wait_for_unit("gitea.service")
+      server.wait_for_open_port(3000)
+      server.succeed("curl --fail http://localhost:3000/")

-    machine =
-      { config, pkgs, ... }:
-      { services.gitea.enable = true;
-        services.gitea.database.type = "postgres";
-      };
-
-    testScript = ''
-      start_all()
-
-      machine.wait_for_unit("gitea.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl --fail http://localhost:3000/")
-    '';
-  };
-
-  sqlite = makeTest {
-    name = "gitea-sqlite";
-    meta.maintainers = [ maintainers.aanderse ];
-
-    machine =
-      { config, pkgs, ... }:
-      { services.gitea.enable = true;
-        services.gitea.disableRegistration = true;
-      };
-
-    testScript = ''
-      start_all()
-
-      machine.wait_for_unit("gitea.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl --fail http://localhost:3000/")
-      machine.succeed(
-          "curl --fail http://localhost:3000/user/sign_up | grep 'Registration is disabled. Please contact your site administrator.'"
+      server.succeed(
+          "curl --fail http://localhost:3000/user/sign_up | grep 'Registration is disabled. "
+          + "Please contact your site administrator.'"
      )
+      server.succeed(
+          "su -l gitea -c 'GITEA_WORK_DIR=/var/lib/gitea gitea admin create-user "
+          + "--username test --password totallysafe --email test@localhost'"
+      )
+
+      api_token = server.succeed(
+          "curl --fail -X POST http://test:totallysafe@localhost:3000/api/v1/users/test/tokens "
+          + "-H 'Accept: application/json' -H 'Content-Type: application/json' -d "
+          + "'{\"name\":\"token\"}' | jq '.sha1' | xargs echo -n"
+      )
+
+      server.succeed(
+          "curl --fail -X POST http://localhost:3000/api/v1/user/repos "
+          + "-H 'Accept: application/json' -H 'Content-Type: application/json' "
+          + f"-H 'Authorization: token {api_token}'"
+          + ' -d \'{"auto_init":false, "description":"string", "license":"mit", "name":"repo", "private":false}\'''
+      )
+
+      server.succeed(
+          "curl --fail -X POST http://localhost:3000/api/v1/user/keys "
+          + "-H 'Accept: application/json' -H 'Content-Type: application/json' "
+          + f"-H 'Authorization: token {api_token}'"
+          + ' -d \'{"key":"${snakeOilPublicKey}","read_only":true,"title":"SSH"}\'''
+      )
+
+      client1.succeed(
+          f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git -C /tmp/repo push origin master"
+      )
+
+      client2.succeed("mkdir -p $HOME/.ssh")
+      client2.succeed(f"cat {PRIVK} > $HOME/.ssh/privk")
+      client2.succeed("chmod 0400 $HOME/.ssh/privk")
+      client2.succeed(f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git clone {REPO}")
+      client2.succeed('test "$(cat repo/testfile | xargs echo -n)" = "hello world"')
+
+      server.succeed(
+          'test "$(curl http://localhost:3000/api/v1/repos/test/repo/commits '
+          + '-H "Accept: application/json" | jq length)" = "1"'
+      )
+
+      client1.shutdown()
+      client2.shutdown()
+      server.shutdown()
    '';
-  };
-}
+  });
+in
+
+listToAttrs (map makeGiteaTest supportedDbTypes)
--- a/nixos/tests/systemd-analyze.nix
+++ b/nixos/tests/systemd-analyze.nix
@ -0,0 +1,46 @@
+import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }:
+
+{
+  name = "systemd-analyze";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ raskin ];
+  };
+
+  machine =
+    { pkgs, lib, ... }:
+    { boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
+      sound.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    # We create a special output directory to copy it as a whole
+    with subtest("Prepare output dir"):
+        machine.succeed("mkdir systemd-analyze")
+
+
+    # Save the output into a file with given name inside the common
+    # output directory
+    def run_systemd_analyze(args, name):
+        tgt_dir = "systemd-analyze"
+        machine.succeed(
+            "systemd-analyze {} > {}/{} 2> {}/{}.err".format(
+                " ".join(args), tgt_dir, name, tgt_dir, name
+            )
+        )
+
+
+    with subtest("Print statistics"):
+        run_systemd_analyze(["blame"], "blame.txt")
+        run_systemd_analyze(["critical-chain"], "critical-chain.txt")
+        run_systemd_analyze(["dot"], "dependencies.dot")
+        run_systemd_analyze(["plot"], "systemd-analyze.svg")
+
+    # We copy the main graph into the $out (toplevel), and we also copy
+    # the entire output directory with additional data
+    with subtest("Copying the resulting data into $out"):
+        machine.copy_from_vm("systemd-analyze/", "")
+        machine.copy_from_vm("systemd-analyze/systemd-analyze.svg", "")
+  '';
+})
--- a/nixos/tests/xmonad.nix
+++ b/nixos/tests/xmonad.nix
@ -27,13 +27,13 @@ import ./make-test-python.nix ({ pkgs, ...} : {
    machine.wait_for_x()
    machine.wait_for_file("${user.home}/.Xauthority")
    machine.succeed("xauth merge ${user.home}/.Xauthority")
-    machine.send_chars("alt-ctrl-x")
+    machine.send_key("alt-ctrl-x")
    machine.wait_for_window("${user.name}.*machine")
    machine.sleep(1)
    machine.screenshot("terminal")
    machine.wait_until_succeeds("xmonad --restart")
    machine.sleep(3)
-    machine.send_chars("alt-shift-ret")
+    machine.send_key("alt-shift-ret")
    machine.wait_for_window("${user.name}.*machine")
    machine.sleep(1)
    machine.screenshot("terminal")
--- a/pkgs/applications/audio/MMA/default.nix
+++ b/pkgs/applications/audio/MMA/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, python3, alsaUtils, timidity }:

  stdenv.mkDerivation rec {
-  version = "16.06";
+  version = "19.08";
  pname = "mma";

  src = fetchurl {
    url = "https://www.mellowood.ca/mma/mma-bin-${version}.tar.gz";
-    sha256 = "1g4gvc0nr0qjc0fyqrnx037zpaasgymgmrm5s7cdxqnld9wqw8ww";
+    sha256 = "02g2q9f1hbrj1v4mbf7zx2571vqpfla5803hcjpkdkvn8g0dwci0";
  };

  buildInputs = [ makeWrapper python3 alsaUtils timidity ];
--- a/pkgs/applications/audio/bshapr/default.nix
+++ b/pkgs/applications/audio/bshapr/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "BShapr";
-  version = "0.4";
+  version = "0.6";

  src = fetchFromGitHub {
    owner = "sjaehn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "02b4wdfhr9y7z2k6ls086gv3vz4sjf7b1k8ryh573bzd8nr4896v";
+    sha256 = "0mi8f0svq1h9cmmxyskcazr5x2q4dls3j9jc6ahi5rlk7i0bpa74";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/renoise/default.nix
+++ b/pkgs/applications/audio/renoise/default.nix
@ -4,8 +4,7 @@
 with stdenv.lib;

 # To use the full release version:
-# 1) Sign into https://backstage.renoise.com and download the appropriate (x86 or x86_64) version
-#    for your machine to some stable location.
+# 1) Sign into https://backstage.renoise.com and download the release version to some stable location.
 # 2) Override the releasePath attribute to point to the location of the newly downloaded bundle.
 # Note: Renoise creates an individual build for each license which screws somewhat with the
 # use of functions like requireFile as the hash will be different for every user.
@ -15,22 +14,17 @@ in

 stdenv.mkDerivation rec {
  pname = "renoise";
-  version = "3.1.0";
+  version = "3.2.0";

  src =
    if stdenv.hostPlatform.system == "x86_64-linux" then
        if releasePath == null then
 		    fetchurl {
-          url = "https://files.renoise.com/demo/Renoise_${urlVersion version}_Demo_x86_64.tar.bz2";
-          sha256 = "0pan68fr22xbj7a930y29527vpry3f07q3i9ya4fp6g7aawffsga";
-        }
-        else
-        releasePath
-    else if stdenv.hostPlatform.system == "i686-linux" then
-        if releasePath == null then
-        fetchurl {
-          url = "http://files.renoise.com/demo/Renoise_${urlVersion version}_Demo_x86.tar.bz2";
-          sha256 = "1lccjj4k8hpqqxxham5v01v2rdwmx3c5kgy1p9lqvzqma88k4769";
+		      urls = [
+		          "https://files.renoise.com/demo/Renoise_${urlVersion version}_Demo_Linux.tar.gz"
+		          "https://web.archive.org/web/https://files.renoise.com/demo/Renoise_${urlVersion version}_Demo_Linux.tar.gz"
+		      ];
+		      sha256 = "0cfczzpk1ddz61nk4d72fydbm5nbgxqp95v81by2n87s1wffjjhi";
 		    }
        else
        	releasePath
@ -69,6 +63,6 @@ stdenv.mkDerivation rec {
    homepage = https://www.renoise.com/;
    license = licenses.unfree;
    maintainers = [];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@ -1,24 +1,26 @@
-{ stdenv, fetchFromGitHub, python2, cdparanoia, cdrdao, flac
-, sox, accuraterip-checksum, utillinux, substituteAll }:
+{ stdenv, fetchFromGitHub, python3, cdparanoia, cdrdao, flac
+, sox, accuraterip-checksum, libsndfile, utillinux, substituteAll }:

-python2.pkgs.buildPythonApplication rec {
-  name = "whipper-${version}";
-  version = "0.7.3";
+python3.pkgs.buildPythonApplication rec {
+  pname = "whipper";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "whipper-team";
    repo = "whipper";
    rev = "v${version}";
-    sha256 = "0ypbgc458i7yvbyvg6wg6agz5yzlwm1v6zw7fmyq9h59xsv27mpr";
+    sha256 = "0x1qsp021i0l5sdcm2kcv9zfwp696k4izhw898v6marf8phll7xc";
  };

-  pythonPath = with python2.pkgs; [
+  pythonPath = with python3.pkgs; [
    pygobject3 musicbrainzngs urllib3 chardet
-    pycdio setuptools mutagen CDDB
+    pycdio setuptools setuptools_scm mutagen
    requests
  ];

-  checkInputs = with python2.pkgs; [
+  buildInputs = [ libsndfile ];
+
+  checkInputs = with python3.pkgs; [
    twisted
  ];

@ -33,6 +35,10 @@ python2.pkgs.buildPythonApplication rec {
    "--prefix" "PATH" ":" (stdenv.lib.makeBinPath [ accuraterip-checksum cdrdao utillinux flac sox ])
  ];

+  preBuild = ''
+    export SETUPTOOLS_SCM_PRETEND_VERSION="v${version}"
+  '';
+
  # some tests require internet access
  # https://github.com/JoeLametta/whipper/issues/291
  doCheck = false;
@ -44,7 +50,7 @@ python2.pkgs.buildPythonApplication rec {
  meta = with stdenv.lib; {
    homepage = https://github.com/whipper-team/whipper;
    description = "A CD ripper aiming for accuracy over speed";
-    maintainers = with maintainers; [ rycee ];
+    maintainers = with maintainers; [ rycee emily ];
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
  };
--- a/pkgs/applications/blockchains/bitcoin.nix
+++ b/pkgs/applications/blockchains/bitcoin.nix
@ -3,9 +3,24 @@
 , withGui }:

 with stdenv.lib;
-stdenv.mkDerivation rec{
-  pname = if withGui then "bitcoin" else "bitcoind";
+
+let
  version = "0.19.0.1";
+  majorMinorVersion = versions.majorMinor version;
+
+  desktop = fetchurl {
+    url = "https://raw.githubusercontent.com/bitcoin-core/packaging/${majorMinorVersion}/debian/bitcoin-qt.desktop";
+    sha256 = "0cpna0nxcd1dw3nnzli36nf9zj28d2g9jf5y0zl9j18lvanvniha";
+  };
+
+  pixmap = fetchurl {
+    url = "https://raw.githubusercontent.com/bitcoin/bitcoin/v${version}/share/pixmaps/bitcoin128.png";
+    sha256 = "08p7j7dg50jlj783kkgdw037klmx0spqjikaprmbkzgcb620r25d";
+  };
+
+in stdenv.mkDerivation rec {
+  pname = if withGui then "bitcoin" else "bitcoind";
+  inherit version;

  src = fetchurl {
    urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
@ -22,6 +37,11 @@ stdenv.mkDerivation rec{
                  ++ optionals stdenv.isLinux [ utillinux ]
                  ++ optionals withGui [ qtbase qttools qrencode ];

+  postInstall = optional withGui ''
+    install -Dm644 ${desktop} $out/share/applications/bitcoin-qt.desktop
+    install -Dm644 ${pixmap} $out/share/pixmaps/bitcoin128.png
+  '';
+
  configureFlags = [ "--with-boost-libdir=${boost.out}/lib"
                     "--disable-bench"
                   ] ++ optionals (!doCheck) [
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -18,9 +18,9 @@ let
    sha256Hash = "0qlrdf7a6f5585mrni1aa2chic4n7b9c8lgrj8br6q929hc2f5d9";
  };
  latestVersion = { # canary & dev
-    version = "4.0.0.5"; # "Android Studio 4.0 Canary 5"
-    build = "193.6039983";
-    sha256Hash = "19pidwl46z7alc0d7awhvi4aq1r87f99wh5yfi94s1zd2azm9f9z";
+    version = "4.0.0.6"; # "Android Studio 4.0 Canary 6"
+    build = "193.6052267";
+    sha256Hash = "1naxyfnrj7milqha7xbwbcvyi81a7fqb7jsm03hhq5xs2sw55m1c";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/edbrowse/default.nix
+++ b/pkgs/applications/editors/edbrowse/default.nix
@ -1,19 +1,11 @@
-{ stdenv, fetchFromGitHub, fetchpatch, duktape, curl, pcre, readline, openssl, perl, html-tidy }:
+{ stdenv, fetchFromGitHub, duktape, curl, pcre, readline, openssl, perl, html-tidy }:

 stdenv.mkDerivation rec {
  pname = "edbrowse";
-  version = "3.7.4";
+  version = "3.7.6";

  buildInputs = [ curl pcre readline openssl duktape perl html-tidy ];

-  patches = [
-    # Fix build against recent libcurl
-    (fetchpatch {
-      url = https://github.com/CMB/edbrowse/commit/5d2b9e21fdf019f461ebe62738d615428d5db963.diff;
-      sha256 = "167q8n0syj3iv6lxrbpv4kvb63j4byj4qxrxayy08bah3pss3gky";
-    })
-  ];
-
  postPatch = ''
    for i in ./tools/*.pl
    do
@ -21,13 +13,16 @@ stdenv.mkDerivation rec {
    done
  '';

-  makeFlags = "-C src prefix=$(out)";
+  makeFlags = [ 
+    "-C src"
+    "prefix=${placeholder "out"}"
+  ];

  src = fetchFromGitHub {
    owner = "CMB";
    repo = "edbrowse";
    rev = "v${version}";
-    sha256 = "0i9ivyfy1dd16c89f392kwx6wxgkkpyq2hl32jhzra0fb0zyl0k6";
+    sha256 = "0yk4djb9q8ll94fs57y706bsqlar4pfx6ysasvkzj146926lrh8a";
  };
  meta = with stdenv.lib; {
    description = "Command Line Editor Browser";
@ -39,8 +34,8 @@ stdenv.mkDerivation rec {
      edbrowse can also tap into databases through odbc. It was primarily written by Karl Dahlke.
      '';
    license = licenses.gpl1Plus;
-    homepage = http://edbrowse.org/;
-    maintainers = [ maintainers.schmitthenner maintainers.vrthra ];
+    homepage = "https://edbrowse.org/";
+    maintainers = with maintainers; [ schmitthenner vrthra equirosa ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@ -4,10 +4,12 @@
 }:

 stdenv.mkDerivation rec {
-  emacsVersion = "26.3";
-  emacsName = "emacs-${emacsVersion}";
+  pname = "emacs";
+  version = "26.3";
+
+  emacsName = "emacs-${version}";
  macportVersion = "7.7";
-  name = "emacs-mac-${emacsVersion}-${macportVersion}";
+  name = "emacs-mac-${version}-${macportVersion}";

  src = fetchurl {
    url = "mirror://gnu/emacs/${emacsName}.tar.xz";
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -38,6 +38,15 @@ in stdenv.mkDerivation rec {
    (stdenv.lib.enableFeature enableTiny "tiny")
  ];

+    patches = [
+      (fetchurl {
+        # fix compilation on macOS, where 'st_mtim' is unknown
+        # upstream patch not in 4.6
+        url = "https://git.savannah.gnu.org/cgit/nano.git/patch/?id=f516cddce749c3bf938271ef3182b9169ac8cbcc";
+        sha256 = "0gqymvr5vxxypr7y3sm252rsi4gjqp597l01x0lkxyvxsn45a4sx";
+      })
+  ];
+
  postInstall = ''
    cp ${nixSyntaxHighlight}/nix.nanorc $out/share/nano/
  '';
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -11,13 +11,13 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1zxj1vav7swjmvvgcn1y61figjhqrczf8d16rk6yayja1pfjgvs5";
-    x86_64-darwin = "0f6ck40rkngzcm5xih1rbwpz905r533n2z08maycgf4iajgwrn43";
+    x86_64-linux = "1ziw2b851kg17jaf713nwhsv5ikbvivq3h01xximhcglv9vzk93l";
+    x86_64-darwin = "0nndasa130551jf06mfrym593c02c3ypgg9f9rdg1fw5qbyjb8hm";
  }.${system};
 in
  callPackage ./generic.nix rec {

-    version = "1.40.1";
+    version = "1.41.0";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -11,8 +11,8 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "01mblkwq3qnj70rwizv408x6sc0jg4wav44p9z3cmzcf9prpm2gs";
-    x86_64-darwin = "1lvh735vddz65l1ahbl66k04rck36lpvp1n3z3hrk0mjn451ga6v";
+    x86_64-linux = "1njxa19mzzydz1jacghwmha3dl4a13m9xzzwsb0rbks5zc9a0v7m";
+    x86_64-darwin = "0cpd87q0q3i172l4s43s79by42wa9k5pyik3v2z5mq8zpms8qcq4";
  }.${system};

  sourceRoot = {
@ -23,7 +23,7 @@ in
  callPackage ./generic.nix rec {
    inherit sourceRoot;

-    version = "1.40.1";
+    version = "1.41.0";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/cinepaint/default.nix
+++ b/pkgs/applications/graphics/cinepaint/default.nix
@ -1,38 +0,0 @@
-{ stdenv, fetchurl, cmake, pkgconfig, gtk2, freetype, fontconfig, lcms,
-  flex, libtiff, libjpeg, libpng, libexif, zlib, perlPackages, libX11,
-  pythonPackages, gettext, intltool, babl, gegl,
-  glib, makedepend, xorgproto, libXmu, openexr,
-  libGLU, libGL, libXext, libXpm, libXau, libXxf86vm, pixman, libpthreadstubs, fltk } :
-
-let
-  inherit (pythonPackages) python pygtk;
-in stdenv.mkDerivation rec {
-  name = "cinepaint-1.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/cinepaint/${name}.tgz";
-    sha256 = "0b5g4bkq62yiz1cnb2vfij0a8fw5w5z202v5dm4dh89k7cj0yq4w";
-  };
-
-  buildInputs = [ libpng gtk2 freetype fontconfig lcms flex libtiff libjpeg
-    libexif zlib libX11 python pygtk gettext intltool babl
-    gegl glib makedepend xorgproto libXmu openexr libGLU libGL
-    libXext libXpm libXau libXxf86vm pixman libpthreadstubs fltk
-  ] ++ (with perlPackages; [ perl XMLParser ]);
-
-  hardeningDisable = [ "format" ];
-
-  patches = [ ./install.patch ];
-
-  nativeBuildInputs = [ cmake pkgconfig ];
-
-  NIX_LDFLAGS = "-lm -llcms -ljpeg -lpng -lX11";
-
-  meta = {
-    homepage = http://www.cinepaint.org/;
-    license = stdenv.lib.licenses.free;
-    description = "Image editor which supports images over 8bpp and ICC profiles";
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/graphics/cinepaint/install.patch
+++ b/pkgs/applications/graphics/cinepaint/install.patch
@ -1,24 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index dfb182f..5adaaa5 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -138,7 +138,7 @@ STRING(REPLACE "/" "\\/" ESCAPEDPREFIX ${PREFIX})
- # Note that for MacOS this needs to be revised 
- # for the @OSX_ICC...@ variables
- ADD_CUSTOM_COMMAND(
-   OUTPUT ${CMAKE_CURRENT_SOURCE_DIR}/gimprc
-+   OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/gimprc
-    COMMAND  sed -e s/\@platform\@//g
- 		-e s/\@prefix\@/${ESCAPEDPREFIX}/g 
- 	        -e s/\@exec_prefix\@/\${prefix}/g
-@@ -155,8 +155,8 @@ ADD_CUSTOM_COMMAND(
- 
- ADD_CUSTOM_TARGET(RCFile ALL echo
-       ""
-      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/user_install 
-              ${CMAKE_CURRENT_SOURCE_DIR}/gimprc
-+      DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/user_install 
-+              ${CMAKE_CURRENT_BINARY_DIR}/gimprc
-    )
- 
- 
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@ -60,11 +60,11 @@ let

 in mkDerivation rec {
  pname = "drawpile";
-  version = "2.1.14";
+  version = "2.1.15";

  src = fetchurl {
    url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "0vpsq8swvli6xiykjqjmdcz33jd44nvhq1n350dm9qap9s9wdr47";
+    sha256 = "0w6bdg1rnnjzjg8xzqv3a9qhw41q41sjvp6f8m0sqxjfax05lqin";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/mcomix/default.nix
+++ b/pkgs/applications/graphics/mcomix/default.nix
@ -1,34 +0,0 @@
-{ stdenv, fetchurl, python27Packages }:
-
-python27Packages.buildPythonApplication rec {
-    name = "mcomix-${version}";
-    version = "1.2.1";
-
-    src = fetchurl {
-      url = "mirror://sourceforge/mcomix/${name}.tar.bz2";
-      sha256 = "0fzsf9pklhfs1rzwzj64c0v30b74nk94p93h371rpg45qnfiahvy";
-    };
-
-    propagatedBuildInputs = with python27Packages; [ pygtk pillow setuptools ];
-
-    doCheck = false;
-
-    meta = {
-      description = "Image viewer designed to handle comic books";
-      longDescription = ''
-        MComix is an user-friendly, customizable image viewer. It is specifically
-        designed to handle comic books, but also serves as a generic viewer.
-        It reads images in ZIP, RAR, 7Zip or tar archives as well as plain image
-        files. It is written in Python and uses GTK through the PyGTK bindings,
-        and runs on both Linux and Windows.
-
-        MComix is a fork of the Comix project, and aims to add bug fixes and
-        stability improvements after Comix development came to a halt in late 2009.
-      '';
-      homepage = http://mcomix.sourceforge.net/;
-      license = stdenv.lib.licenses.gpl2;
-      maintainers = with stdenv.lib.maintainers; [ AndersonTorres ];
-    };
-}
-# TODO:
-# - error in check phase
--- a/pkgs/applications/graphics/mirage/default.nix
+++ b/pkgs/applications/graphics/mirage/default.nix
@ -1,31 +0,0 @@
-{ stdenv, fetchurl, pythonPackages, libX11, gettext }:
-
-pythonPackages.buildPythonApplication rec {
-    pname = "mirage";
-    version = "0.9.5.2";
-
-    src = fetchurl {
-      url = "mirror://sourceforge/mirageiv/${pname}-${version}.tar.bz2";
-      sha256 = "d214a1b6d99d1d1e83da5848a2cef181f6781e0990e93f7ebff5880b0c43f43c";
-    };
-
-    doCheck = false;
-
-    nativeBuildInputs = [ gettext ];
-
-    buildInputs = [ stdenv libX11 gettext ];
-
-    patchPhase = ''
-      sed -i "s@/usr/local/share/locale@$out/share/locale@" mirage.py
-    '';
-
-    propagatedBuildInputs = with pythonPackages; [ pygtk pillow ];
-
-    meta = {
-      description = "Simple image viewer written in PyGTK";
-
-      homepage = http://mirageiv.sourceforge.net/;
-
-      license = stdenv.lib.licenses.gpl2;
-    };
-}
--- a/pkgs/applications/misc/batti/default.nix
+++ b/pkgs/applications/misc/batti/default.nix
@ -1,51 +0,0 @@
-{ stdenv, fetchurl
-, pkgconfig, gettext, pythonPackages
-, gtk2, gdk-pixbuf, upower
-, makeWrapper }:
-
-let
-  inherit (pythonPackages) dbus-python pygtk python;
-in stdenv.mkDerivation rec {
-
-  pname = "batti";
-  version = "0.3.8";
-
-  src = fetchurl {
-    url = "https://batti-gtk.googlecode.com/files/${pname}-${version}.tar.gz";
-    sha256 = "072d92gpsiiin631589nj77i2w1425p6db0qxyml7myscfy9jgx6";
-  };
-
-  buildInputs = with stdenv.lib;
-  [ pkgconfig gettext python gtk2 pygtk dbus-python gdk-pixbuf upower makeWrapper ];
-
-  dontConfigure = true;
-
-  buildPhase = ''
-    python setup.py build
-  '';
-
-  installPhase = ''
-    python setup.py install --prefix $out
-    wrapProgram "$out/bin/batti" \
-      --set PYTHONPATH "$PYTHONPATH:$(toPythonPath $out)" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-
-  meta = with stdenv.lib; {
-    description = "An {UPower,GTK}-based battery monitor for the system tray";
-    longDescription = ''
-      Batti is a simple battery monitor for the system tray. Batti
-      uses UPower, and if that is missing DeviceKit.Power, for it's
-      power information.
-    '';
-    homepage = http://batti-gtk.googlecode.com/;
-    license = licenses.lgpl2Plus;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
-    broken = true;  # see https://github.com/NixOS/nixpkgs/pull/4031#issuecomment-56283520
-  };
-}
-
-# TODO: fix the "icon not found" problems...
--- a/pkgs/applications/misc/bleachbit/default.nix
+++ b/pkgs/applications/misc/bleachbit/default.nix
@ -1,4 +1,14 @@
-{ stdenv, pythonPackages, fetchurl, gettext }:
+{ stdenv
+, pythonPackages
+, fetchurl
+, gettext
+, gobject-introspection
+, wrapGAppsHook
+, glib
+, gtk3
+, libnotify
+}:
+
 pythonPackages.buildPythonApplication rec {
  pname = "bleachbit";
  version = "3.0";
@ -10,7 +20,24 @@ pythonPackages.buildPythonApplication rec {
    sha256 = "18ns9hms671b4l0189m1m2agprkydnpvyky9q2f5hxf35i9cn67d";
  };

-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [
+    gettext
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libnotify
+  ];
+
+  propagatedBuildInputs = with pythonPackages; [
+    chardet
+    pygobject3
+    requests
+    scandir
+  ];

  # Patch the many hardcoded uses of /usr/share/ and /usr/bin
  postPatch = ''
@ -20,15 +47,17 @@ pythonPackages.buildPythonApplication rec {

  dontBuild = true;

-  installFlags = [ "prefix=${placeholder "out"}" ];
+  installFlags = [
+    "prefix=${placeholder "out"}"
+  ];

-  propagatedBuildInputs = with pythonPackages; [ pygtk ];
+  strictDeps = false;

-  meta = {
+  meta = with stdenv.lib; {
    homepage = http://bleachbit.sourceforge.net;
    description = "A program to clean your computer";
    longDescription = "BleachBit helps you easily clean your computer to free space and maintain privacy.";
-    license = stdenv.lib.licenses.gpl3;
-    maintainers = with stdenv.lib.maintainers; [ leonardoce ];
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ leonardoce ];
  };
 }
--- a/pkgs/applications/misc/dupeguru/default.nix
+++ b/pkgs/applications/misc/dupeguru/default.nix
@ -0,0 +1,62 @@
+{stdenv, python3Packages, gettext, qt5, fetchFromGitHub}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "dupeguru";
+  version = "4.0.4";
+
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "arsenetar";
+    repo = "dupeguru";
+    rev = "${version}";
+    sha256 = "0ma4f1c6vmpz8gi4sdy43x1ik7wh42wayvk1iq520d3i714kfcpy";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    gettext
+    python3Packages.pyqt5
+    qt5.wrapQtAppsHook
+  ];
+
+  pythonPath = with python3Packages; [
+    pyqt5
+    send2trash
+    sphinx
+    polib
+    hsaudiotag3k
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder ''out''}"
+    "NO_VENV=1"
+  ];
+
+  # TODO: package pytest-monkeyplus for running tests
+  # https://github.com/NixOS/nixpkgs/pull/75054/files#r357690123
+  doCheck = false;
+
+  # Avoid double wrapping Python programs.
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    # TODO: A bug in python wrapper
+    # see https://github.com/NixOS/nixpkgs/pull/75054#discussion_r357656916
+    makeWrapperArgs="''${qtWrapperArgs[@]}"
+  '';
+
+  postFixup = ''
+    # Executable in $out/bin is a symlink to $out/share/dupeguru/run.py
+    # so wrapPythonPrograms hook does not handle it automatically.
+    wrapPythonProgramsIn "$out/share/dupeguru" "$out $pythonPath"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "GUI tool to find duplicate files in a system";
+    homepage = "https://github.com/arsenetar/dupeguru";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.novoxudonoser ];
+  };
+}
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -74,6 +74,7 @@ python3Packages.buildPythonApplication {
    tlslite-ng

    # plugins
+    ckcc-protocol
    keepkey
    trezor
    btchip
--- a/pkgs/applications/misc/gnome15/default.nix
+++ b/pkgs/applications/misc/gnome15/default.nix
@ -1,39 +0,0 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, python2, gnome_python, gnome_python_desktop }:
-
-stdenv.mkDerivation {
-  name = "gnome15-2016-06-10";
-
-  src = fetchFromGitHub {
-    owner = "achilleas-k";
-    repo = "gnome15";
-    rev = "1077c890d9ba8ef7a5e448e70a792de5c7443c84";
-    sha256 = "0z5k2rgvv5zyi3lbbk6svncypidj44qzfchivb4vlr7clmh16m95";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkgconfig python2.pkgs.wrapPython ];
-  buildInputs = [ python2 ];
-  propagatedBuildInputs = with python2.pkgs; [
-    pygtk keyring virtkey pillow dbus-python pyinotify lxml pyxdg pyusb gnome_python gnome_python_desktop
-    python-uinput xlib pyudev pyinputevent
-  ];
-
-  postPatch = ''
-    touch README
-    export UDEV_RULES_PATH="$out/lib/udev/rules.d"
-  '';
-
-  postFixup = ''
-    wrapPythonPrograms
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A set of tools for configuring the Logitech G15 keyboard";
-    # Doesn't work with new `keyring` library which is Python 3-only now.
-    # https://github.com/Gnome15/gnome15/issues/29
-    broken = true;
-    license = licenses.gpl3;
-    homepage = https://gnome15.org/;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ abbradar ];
-  };
-}
--- a/pkgs/applications/misc/hamster-time-tracker/default.nix
+++ b/pkgs/applications/misc/hamster-time-tracker/default.nix
@ -1,42 +0,0 @@
-{ stdenv, fetchzip, pythonPackages, docbook2x, libxslt, gnome-doc-utils
-, intltool, dbus-glib, gnome_python
-, hicolor-icon-theme
-, wafHook
-}:
-
-# TODO: Add optional dependency 'wnck', for "workspace tracking" support. Fixes
-# this message:
-#
-#   WARNING:root:Could not import wnck - workspace tracking will be disabled
-
-pythonPackages.buildPythonApplication rec {
-  name = "hamster-time-tracker-1.04";
-
-  src = fetchzip {
-    name = "${name}-src";
-    url = "https://github.com/projecthamster/hamster/archive/${name}.tar.gz";
-    sha256 = "1a85rcg561792kdyv744cgzw7mmpmgv6d6li1sijfdpqa1ninf8g";
-  };
-
-  nativeBuildInputs = [ wafHook intltool ];
-  buildInputs = [
-    docbook2x libxslt gnome-doc-utils dbus-glib hicolor-icon-theme
-  ];
-
-  propagatedBuildInputs = with pythonPackages; [ pygobject2 pygtk pyxdg gnome_python dbus-python ];
-
-  postFixup = ''
-    wrapPythonProgramsIn $out/lib/hamster-time-tracker "$out $pythonPath"
-  '';
-
-  # error: invalid command 'test'
-  doCheck = false;
-
-  meta = with stdenv.lib; {
-    description = "Time tracking application";
-    homepage = https://projecthamster.wordpress.com/;
-    license = licenses.gpl3;
-    platforms = platforms.all;
-    maintainers = [ maintainers.bjornfor ];
-  };
-}
--- a/pkgs/applications/misc/hivemind/default.nix
+++ b/pkgs/applications/misc/hivemind/default.nix
@ -2,14 +2,14 @@

 buildGoPackage rec {
  pname = "hivemind";
-  version = "1.0.4";
+  version = "1.0.6";
  goPackagePath = "github.com/DarthSim/hivemind";

  src = fetchFromGitHub {
    owner = "DarthSim";
    repo = "hivemind";
    rev = "v${version}";
-    sha256 = "1z2izvyf0j3gi0cas5v22kkmkls03sg67182k8v3p6kwhzn0jw67";
+    sha256 = "0afcnd03wsdphbbpha65rv5pnv0x6ldnnm6rnv1m6xkkywgnzx95";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.60.1";
+  version = "0.61.0";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0l8n87y5zrs09s693rqvqwz0233wlr4jwib7r36ilss1qgm7x6n5";
+    sha256 = "1ad70g4gb44dk48pbgk48jzs44b6l7ksxb739ahp7vs1nyvvgffr";
  };

-  modSha256 = "1an4plbx06fzz2iqzgs08r6vsjpkl5lbqck5jqmv6fv7b7psf7iw";
+  modSha256 = "1jb1iqlp1005aj8smcgznmwnqaysi5g5wcsj8nvvm70hhc9j8wns";

  buildFlags = "-tags extended";

--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@ -3,11 +3,11 @@

 mkDerivation rec {
  pname = "latte-dock";
-  version = "0.8.9";
+  version = "0.9.5";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1kkpxa39crjpqgamrcpgp1mrcdg0aq9850yb6cf7lw7d3x2fdrxj";
+    sha256 = "1g8a2lmg9agcs2kwbwh6sj9hkrbzad7bkxk39nx5536svnifbg1c";
    name = "${pname}-${version}.tar.xz";
  };

--- a/pkgs/applications/misc/pmenu/default.nix
+++ b/pkgs/applications/misc/pmenu/default.nix
@ -1,36 +0,0 @@
-{ stdenv, fetchFromGitLab, python2Packages, gnome-menus }:
-
-stdenv.mkDerivation {
-  pname = "pmenu";
-  version = "2018-01-01";
-
-  src = fetchFromGitLab {
-    owner = "o9000";
-    repo = "pmenu";
-    rev = "f98a5bdf20deb0b7f0543e5ce6a8f5574f695e07";
-    sha256 = "131nqafbmbfpgsgss27pz4cyb9fb29m5h1ai1fyvcn286rr9dnp2";
-  };
-
-  nativeBuildInputs = [ python2Packages.wrapPython ];
-
-  buildInputs = [ python2Packages.pygtk gnome-menus ];
-
-  pythonPath = [ python2Packages.pygtk ];
-    
-  installPhase = ''
-    mkdir -p $out/bin $out/share/applications
-    ./install.sh $out
-  '';
-
-  postFixup = ''
-    wrapPythonPrograms
-  '';
-
-  meta = {
-    homepage = https://gitlab.com/o9000/pmenu;
-    description = "Start menu for Linux/BSD";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
-  };
-}
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -9,7 +9,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "prusa-slicer";
-  version = "2.1.0";
+  version = "2.1.1";

  enableParallelBuilding = true;

@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "PrusaSlicer";
-    sha256 = "172nz01iiqfjzkpcbl78j6almq6av70l71jgrzrcdw6ham1wqnpr";
+    sha256 = "0i393nbc2salb4j5l2hvy03ng7hmf90d2xj653pw9bsikhj0r3jd";
    rev = "version_${version}";
  };

--- a/pkgs/applications/misc/vym/default.nix
+++ b/pkgs/applications/misc/vym/default.nix
@ -1,18 +1,45 @@
-{ stdenv, fetchurl, pkgconfig, qmake, qtsvg }:
+{ stdenv, mkDerivation, fetchurl, pkgconfig, qmake, qtscript, qtsvg }:

-stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "vym";
-  version = "2.6.11";
+  version = "2.7.0";

  src = fetchurl {
-    url = "mirror://sourceforge/project/vym/2.6.0/${pname}-${version}.tar.bz2";
-    sha256 = "1yznlb47jahd662a2blgh1ccwpl5dp5rjz9chsxjzhj3vbkzx3nl";
+    url = "mirror://sourceforge/project/vym/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "1rnrfqlff7wv6yni8bvff8n90pmn82k82zd4sn1jsx9r1n3qsfkh";
  };

+  # Hardcoded paths scattered about all have form share/vym
+  # which is encouraging, although we'll need to patch them (below).
+  qmakeFlags = [
+    "DATADIR=${placeholder "out"}/share"
+    "DOCDIR=${placeholder "out"}/share/doc/vym"
+  ];
+
+  postPatch = ''
+    for x in \
+      exportoofiledialog.cpp \
+      main.cpp \
+      mainwindow.cpp \
+      tex/*.{tex,lyx}; \
+    do
+      substituteInPlace $x \
+        --replace /usr/share/vym $out/share/vym \
+        --replace /usr/local/share/vym $out/share/vym \
+        --replace /usr/share/doc $out/share/doc/vym
+    done
+  '';
+
  hardeningDisable = [ "format" ];

  nativeBuildInputs = [ pkgconfig qmake ];
-  buildInputs = [ qtsvg ];
+  buildInputs = [ qtscript qtsvg ];
+
+  postInstall = ''
+    install -Dm755 -t $out/share/man/man1 doc/*.1.gz
+  '';
+
+  dontGzipMan = true;

  meta = with stdenv.lib; {
    description = "A mind-mapping software";
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "wtf";
-  version = "0.24.0";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "wtfutil";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0jz7hjcm0hfxcih2zplp47wx6lyvhhzj9ka4ljqrx0i4l7cm9ahs";
+    sha256 = "1g76hzlyi8s8dayd36cs4bhnwgrrr731ybflw3xk5pgkgcbs14sd";
   };

-  modSha256 = "04d8hvd90f7v853p23xcx38qz3ryv7kz7zjk9b131cjnd4mcv0sm";
+  modSha256 = "186m7s20r59dyh5lpby4sd4vw3rvnkfzslylwin0c3r6150yrx8h";

  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];

--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -93,19 +93,19 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "9.0.1";
+  version = "9.0.2";

  lang = "en-US";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "09iasj13wn3d1dygpxn4www4rx8wnxxlm9h6df9lzf4wll15px55";
+      sha256 = "1xdnqphsj7wzwyv927jwd3fi36srx0minydwl5jg5yyd3m3if9hb";
    };

    i686-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "1vz3pvqi114c9lkyhqy754ngi90708c187xwiyr9786ff89sjw5i";
+      sha256 = "1qk9fg5dvyyvbngsqla00by8a974mpvq9pnm2djif54lr2nfivwf";
    };
  };
 in
@ -397,7 +397,7 @@ stdenv.mkDerivation rec {
    longDescription = tor-browser-bundle.meta.longDescription;
    homepage = "https://www.torproject.org/";
    platforms = attrNames srcs;
-    maintainers = with maintainers; [ offline matejc doublec thoughtpolice joachifm hax404 ];
+    maintainers = with maintainers; [ offline matejc doublec thoughtpolice joachifm hax404 cap ];
    hydraPlatforms = [];
    # MPL2.0+, GPL+, &c.  While it's not entirely clear whether
    # the compound is "libre" in a strict sense (some components place certain
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "argo";
-  version = "2.4.1";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "v${version}";
-    sha256 = "1f9l9d4r0qfhpr2fn17faczcwmwmdz8f56f27cmmnhxz4r7qcm48";
+    sha256 = "15726n5rrbzszq5dpmrxbw9cn7ahihn28jqk274270140gz5aak1";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "0k59n40rmxjdn0xi8gr08zlxk0irfc7crra9x8qdljvivqshma3z";
+    sha256 = "09ds5qn13l6l8kl2i01hgy6pqr30z1rm447ax32lf79zp8hca3r3";
  };

  modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -112,8 +112,8 @@ in rec {
  terraform_0_11-full = terraform_0_11.full;

  terraform_0_12 = pluggable (generic {
-    version = "0.12.17";
-    sha256 = "1pmvjbmzws5qjzz34dw0fcb6p36vafqs0h8i87g7lmhckb9bqihv";
+    version = "0.12.18";
+    sha256 = "1p2rvs9dw2rzzggf3q2lifwbd82b7xb3jpb4yz5nmggn5g22qlc1";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "zeek";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchurl {
    url = "https://www.zeek.org/downloads/zeek-${version}.tar.gz";
-    sha256 = "16pz5fh0z1hmvhn8pxqmdm5a9d8mqrp4gxpxkaywnaqk2h598lmm";
+    sha256 = "1lhik212wrbi092qizc08f3i0b9pj318sxwm0abc5jc3v3pz7x3r";
  };

  nativeBuildInputs = [ cmake flex bison file ];
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -17,9 +17,13 @@ stdenv.mkDerivation rec {
      then writeText "riot-config.json" conf
      else "$out/config.sample.json";
  in ''
+    runHook preInstall
+
    mkdir -p $out/
    cp -R . $out/
    ln -s ${configFile} $out/config.json
+
+    runHook postInstall
  '';

  meta = {
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -6,7 +6,7 @@ at-spi2-atk, at-spi2-core, libuuid, nodePackages, libpulseaudio

 let

-  version = "4.1.2";
+  version = "4.2.0";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -53,7 +53,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://downloads.slack-edge.com/linux_releases/slack-desktop-${version}-amd64.deb";
-        sha256 = "0a1b2k81hm1lfrdb47gmd07jqb7hva9sxsiph7b3iwzpzw8pjrkh";
+        sha256 = "01b2klhky04fijdqcpfafgdqx2c5nh2fpnzvzgvz10hv7h16cinv";
      }
    else
      throw "Slack is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, wrapGAppsHook
+, dpkg
+, atomEnv
+, libuuid
+, pulseaudio
+, at-spi2-atk
+, coreutils
+, gawk
+, xdg_utils
+, systemd }:
+
+stdenv.mkDerivation rec {
+  pname = "teams";
+  version = "1.2.00.32451";
+
+  src = fetchurl {
+    url = "https://packages.microsoft.com/repos/ms-teams/pool/main/t/teams/teams_${version}_amd64.deb";
+    sha256 = "1p053kg5qksr78v2h7cxia5mb9kzgfwm6n99x579vfx48kka1n18";
+  };
+
+  nativeBuildInputs = [ dpkg autoPatchelfHook wrapGAppsHook ];
+
+  unpackCmd = "dpkg -x $curSrc .";
+
+  buildInputs = atomEnv.packages ++ [
+    libuuid
+    at-spi2-atk
+  ];
+
+  runtimeDependencies = [
+    systemd.lib
+    pulseaudio
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PATH : "${coreutils}/bin:${gawk}/bin:${xdg_utils}/bin")
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{opt,bin}
+
+    mv share/teams $out/opt/
+    mv share $out/share
+
+    substituteInPlace $out/share/applications/teams.desktop \
+      --replace /usr/bin/ $out/bin/
+
+    ln -s $out/opt/teams/teams $out/bin/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Microsoft Teams";
+    homepage = "https://teams.microsoft.com";
+    downloadPage = "https://teams.microsoft.com/downloads";
+    license = licenses.unfree;
+    maintainers = [ maintainers.liff ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, fetchpatch, pkgconfig, gtk2, lua, perl, python3
 , pciutils, dbus-glib, libcanberra-gtk2, libproxy
-, libsexy, enchant2, libnotify, openssl, isocodes
+, enchant2, libnotify, openssl, isocodes
 , desktop-file-utils
 , meson, ninja
 }:
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    gtk2 lua perl python3 pciutils dbus-glib libcanberra-gtk2 libproxy
-    libsexy libnotify openssl desktop-file-utils
+    libnotify openssl desktop-file-utils
    isocodes
  ];

--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@ -1,213 +1,339 @@
-{ lib, stdenv, fetchurl, pkgconfig, gtk2, pango, perl, python2, python3, nodejs
-, libIDL, libjpeg, zlib, dbus, dbus-glib, bzip2, xorg
-, freetype, fontconfig, file, nspr, nss, libnotify
-, yasm, libGLU, libGL, sqlite, zip, unzip
-, libevent, libstartup_notification
-, icu, libpng, jemalloc
-, autoconf213, which, m4, fetchpatch
-, writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl
-, runtimeShell
-, cargo, rustc, rust-cbindgen, llvmPackages, nasm
-, enableGTK3 ? false, gtk3, gnome3, wrapGAppsHook, makeWrapper
-, enableCalendar ? true
-, debugBuild ? false
-, # If you want the resulting program to call itself "Thunderbird" instead
-  # of "Earlybird" or whatever, enable this option.  However, those
-  # binaries may not be distributed without permission from the
-  # Mozilla Foundation, see
-  # http://www.mozilla.org/foundation/trademarks/.
-  enableOfficialBranding ? false
+{ autoconf213
+, bzip2
+, cargo
+, common-updater-scripts
+, coreutils
+, curl
+, dbus
+, dbus-glib
+, fetchurl
+, file
+, fontconfig
+, freetype
+, glib
+, gnugrep
+, gnused
+, icu
+, jemalloc
+, lib
+, libGL
+, libGLU
+, libIDL
+, libevent
+, libjpeg
+, libnotify
+, libpng
+, libstartup_notification
+, libvpx
+, libwebp
+, llvmPackages
+, m4
 , makeDesktopItem
+, nasm
+, nodejs
+, nspr
+, nss
+, pango
+, perl
+, pkgconfig
+, python2
+, python3
+, runtimeShell
+, rust-cbindgen
+, rustc
+, sqlite
+, stdenv
+, unzip
+, which
+, writeScript
+, xidel
+, xorg
+, yasm
+, zip
+, zlib
+
+, debugBuild ? false
+
+, alsaSupport ? stdenv.isLinux, alsaLib
+, pulseaudioSupport ? stdenv.isLinux, libpulseaudio
+, gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
+, waylandSupport ? true
+, libxkbcommon, calendarSupport ? true
+
+, # If you want the resulting program to call itself "Thunderbird" instead
+# of "Earlybird" or whatever, enable this option.  However, those
+# binaries may not be distributed without permission from the
+# Mozilla Foundation, see
+# http://www.mozilla.org/foundation/trademarks/.
+enableOfficialBranding ? false
 }:

-let
-  wrapperTool = if enableGTK3 then wrapGAppsHook else makeWrapper;
-  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
-in stdenv.mkDerivation rec {
+assert waylandSupport -> gtk3Support == true;
+
+stdenv.mkDerivation rec {
  pname = "thunderbird";
-  version = "68.2.2";
+  version = "68.3.0";

  src = fetchurl {
-    url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "3mvanjfc35f14lsfa4zjlhsvwij1n9dz9xmisd5s376r5wp9y33sva5ly914b2hmdl85ypdwv90zyi6whj7jb2f2xmqk480havxgjcn";
+    url =
+      "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
+    sha512 =
+      "3aqr3dj5laws516k6jf8f35a1964p0s75sp682yy87xnzgd8m1iha55z79dcavis2ma9hiyacjnznjz04qhqd4q8swjgfg7lj8lyiwl";
  };

-  # from firefox, but without sound libraries
-  buildInputs =
-    [ gtk2 zip libIDL libjpeg zlib bzip2
-      dbus dbus-glib pango freetype fontconfig xorg.libXi
-      xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
-      nspr nss libnotify xorg.pixman yasm libGLU libGL
-      xorg.libXScrnSaver xorg.xorgproto
-      xorg.libXext sqlite unzip
-      libevent libstartup_notification /* cairo */
-      icu libpng jemalloc nasm
-    ]
-    ++ lib.optionals enableGTK3 [ gtk3 gnome3.adwaita-icon-theme ];
+  nativeBuildInputs = [
+    autoconf213
+    cargo
+    gnused
+    llvmPackages.llvm
+    m4
+    nasm
+    nodejs
+    perl
+    pkgconfig
+    python2
+    python3
+    rust-cbindgen
+    rustc
+    which
+    yasm
+  ] ++ lib.optional gtk3Support wrapGAppsHook;

-  # from firefox + m4 + wrapperTool
-  # llvm is for llvm-objdump
-  nativeBuildInputs = [ m4 autoconf213 which gnused pkgconfig perl python2 python3 nodejs wrapperTool cargo rustc rust-cbindgen llvmPackages.llvm ];
+  buildInputs = [
+    bzip2
+    dbus
+    dbus-glib
+    file
+    fontconfig
+    freetype
+    glib
+    gtk2
+    icu
+    jemalloc
+    libGL
+    libGLU
+    libIDL
+    libevent
+    libjpeg
+    libnotify
+    libpng
+    libstartup_notification
+    libvpx
+    libwebp
+    nspr
+    nss
+    pango
+    perl
+    sqlite
+    unzip
+    xorg.libX11
+    xorg.libXScrnSaver
+    xorg.libXcursor
+    xorg.libXext
+    xorg.libXft
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXt
+    xorg.pixman
+    xorg.xorgproto
+    zip
+    zlib
+  ] ++ lib.optional alsaSupport alsaLib
+    ++ lib.optional gtk3Support gtk3
+    ++ lib.optional pulseaudioSupport libpulseaudio
+    ++ lib.optional waylandSupport libxkbcommon;
+
+  NIX_CFLAGS_COMPILE =[
+    "-I${glib.dev}/include/gio-unix-2.0"
+    "-I${nss.dev}/include/nss"
+  ];

  patches = [
-    # Remove buildconfig.html to prevent a dependency on clang etc.
    ./no-buildconfig.patch
-  ]
-  ++ lib.optional (lib.versionOlder version "69")
-    (fetchpatch { # https://bugzilla.mozilla.org/show_bug.cgi?id=1500436#c29
-      name = "write_error-parallel_make.diff";
-      url = "https://hg.mozilla.org/mozilla-central/raw-diff/562655fe/python/mozbuild/mozbuild/action/node.py";
-      sha256 = "11d7rgzinb4mwl7yzhidjkajynmxgmffr4l9isgskfapyax9p88y";
-    });
+  ];

-  configureFlags =
-    [ # from firefox, but without sound libraries (alsa, libvpx, pulseaudio)
+  postPatch = ''
+    rm -rf obj-x86_64-pc-linux-gnu
+  '';
+
+  preConfigure = ''
+    # remove distributed configuration files
+    rm -f configure
+    rm -f js/src/configure
+    rm -f .mozconfig*
+
+    configureScript="$(realpath ./mach) configure"
+    # AS=as in the environment causes build failure https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
+    unset AS
+
+    export MOZCONFIG=$(pwd)/mozconfig
+
+    # Set C flags for Rust's bindgen program. Unlike ordinary C
+    # compilation, bindgen does not invoke $CC directly. Instead it
+    # uses LLVM's libclang. To make sure all necessary flags are
+    # included we need to look in a few places.
+    # TODO: generalize this process for other use-cases.
+
+    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
+      $(< ${stdenv.cc}/nix-support/cc-cflags) \
+      ${stdenv.cc.default_cxx_stdlib_compile} \
+      ${
+        lib.optionalString stdenv.cc.isClang
+        "-idirafter ${stdenv.cc.cc}/lib/clang/${
+          lib.getVersion stdenv.cc.cc
+        }/include"
+      } \
+      ${
+        lib.optionalString stdenv.cc.isGNU
+        "-isystem ${stdenv.cc.cc}/include/c++/${
+          lib.getVersion stdenv.cc.cc
+        } -isystem ${stdenv.cc.cc}/include/c++/${
+          lib.getVersion stdenv.cc.cc
+        }/$(cc -dumpmachine)"
+      } \
+      $NIX_CFLAGS_COMPILE"
+
+    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
+  '';
+
+  configureFlags = let
+    toolkitSlug = if gtk3Support then
+      "3${lib.optionalString waylandSupport "-wayland"}"
+    else
+      "2";
+    toolkitValue = "cairo-gtk${toolkitSlug}";
+  in [
    "--enable-application=comm/mail"
-      "--disable-alsa"
-      "--disable-pulseaudio"

-      "--with-system-jpeg"
-      "--with-system-zlib"
    "--with-system-bz2"
+    "--with-system-icu"
+    "--with-system-jpeg"
+    "--with-system-libevent"
    "--with-system-nspr"
    "--with-system-nss"
-      "--with-system-libevent"
    "--with-system-png" # needs APNG support
    "--with-system-icu"
-      #"--enable-rust-simd" # not supported since rustc 1.32.0 -> 1.33.0; TODO: probably OK since 68.0.0
+    "--with-system-zlib"
+    "--with-system-webp"
+    "--with-system-libvpx"
+
+    "--enable-rust-simd"
+    "--enable-crashreporter"
+    "--enable-default-toolkit=${toolkitValue}"
+    "--enable-js-shell"
+    "--enable-necko-wifi"
+    "--enable-startup-notification"
    "--enable-system-ffi"
    "--enable-system-pixman"
    "--enable-system-sqlite"
-      #"--enable-system-cairo"
-      "--enable-startup-notification"
-      "--disable-crashreporter"
+
+    "--disable-gconf"
    "--disable-tests"
-      "--disable-necko-wifi" # maybe we want to enable this at some point
    "--disable-updater"
    "--enable-jemalloc"
-      "--disable-gconf"
-      "--enable-default-toolkit=cairo-gtk${if enableGTK3 then "3" else "2"}"
-      "--enable-js-shell"
-    ]
-      ++ lib.optional enableCalendar "--enable-calendar"
-      ++ (if debugBuild then [ "--enable-debug" "--enable-profiling"]
-                        else [ "--disable-debug" "--enable-release"
+  ] ++ (if debugBuild then [
+    "--enable-debug"
+    "--enable-profiling"
+  ] else [
+    "--disable-debug"
+    "--enable-release"
    "--disable-debug-symbols"
-                               "--enable-optimize" "--enable-strip" ])
-      ++ lib.optional enableOfficialBranding "--enable-official-branding"
-      ++ lib.optionals (lib.versionAtLeast version "56" && !stdenv.hostPlatform.isi686) [
+    "--enable-optimize"
+    "--enable-strip"
+  ]) ++ lib.optionals (!stdenv.hostPlatform.isi686) [
    # on i686-linux: --with-libclang-path is not available in this configuration
    "--with-libclang-path=${llvmPackages.libclang}/lib"
    "--with-clang-path=${llvmPackages.clang}/bin/clang"
-      ];
+  ] ++ lib.optional alsaSupport "--enable-alsa"
+  ++ lib.optional calendarSupport "--enable-calendar"
+  ++ lib.optional enableOfficialBranding "--enable-official-branding"
+  ++ lib.optional pulseaudioSupport "--enable-pulseaudio";

  enableParallelBuilding = true;

-  preConfigure =
-    ''
-      cxxLib=$( echo -n ${gcc}/include/c++/* )
-      archLib=$cxxLib/$( ${gcc}/bin/gcc -dumpmachine )
-
-      test -f layout/style/ServoBindings.toml && sed -i -e '/"-DRUST_BINDGEN"/ a , "-cxx-isystem", "'$cxxLib'", "-isystem", "'$archLib'"' layout/style/ServoBindings.toml
-
-      configureScript="$(realpath ./configure)"
-      mkdir ../objdir
-      cd ../objdir
-
-      # AS=as in the environment causes build failure https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
-      unset AS
+  postConfigure = ''
+    cd obj-*
  '';

-  dontWrapGApps = true; # we do it ourselves
-  postInstall =
-    ''
-      # TODO: Move to a dev output?
-      rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
+  makeFlags = lib.optionals enableOfficialBranding [
+    "MOZILLA_OFFICIAL=1"
+    "BUILD_OFFICIAL=1"
+  ];

-      # $binary is a symlink to $target.
-      # We wrap $target by replacing the $binary symlink.
-      local target="$out/lib/thunderbird/thunderbird"
-      local binary="$out/bin/thunderbird"
+  doCheck = false;

-      # Wrap correctly, this is needed to
-      # 1) find Mozilla runtime, because argv0 must be the real thing,
-      #    or a symlink thereto. It cannot be the wrapper itself
-      # 2) detect itself as the default mailreader across builds
-      gappsWrapperArgs+=(
-        --argv0 "$target"
-        --set MOZ_APP_LAUNCHER thunderbird
-        # See commit 87e261843c4236c541ee0113988286f77d2fa1ee
-        --set MOZ_LEGACY_PROFILES 1
-        --set MOZ_ALLOW_DOWNGRADE 1
-        # https://github.com/NixOS/nixpkgs/pull/61980
-        --set SNAP_NAME "thunderbird"
-      )
-      ${
-        # We wrap manually because wrapGAppsHook does not detect the symlink
-        # To mimic wrapGAppsHook, we run it with dontWrapGApps, so
-        # gappsWrapperArgs gets defined correctly
-        lib.optionalString enableGTK3 "wrapGAppsHook"
-      }
-
-      # "$binary" is a symlink, replace it by the wrapper
-      rm "$binary"
-      makeWrapper "$target" "$binary" "''${gappsWrapperArgs[@]}"
-
-      ${ let desktopItem = makeDesktopItem {
+  postInstall = let
+    desktopItem = makeDesktopItem {
+      categories = lib.concatStringsSep ";" [ "Application" "Network" ];
+      desktopName = "Thunderbird";
+      genericName = "Mail Reader";
      name = "thunderbird";
      exec = "thunderbird %U";
-          desktopName = "Thunderbird";
      icon = "$out/lib/thunderbird/chrome/icons/default/default256.png";
-          genericName = "Mail Reader";
-          categories = "Application;Network";
-          mimeType = stdenv.lib.concatStringsSep ";" [
+      mimeType = lib.concatStringsSep ";" [
        # Email
        "x-scheme-handler/mailto"
        "message/rfc822"
-            # Newsgroup
-            "x-scheme-handler/news"
-            "x-scheme-handler/snews"
-            "x-scheme-handler/nntp"
-            # Feed
+        # Feeds
        "x-scheme-handler/feed"
        "application/rss+xml"
        "application/x-extension-rss"
+        # Newsgroups
+        "x-scheme-handler/news"
+        "x-scheme-handler/snews"
+        "x-scheme-handler/nntp"
      ];
-        }; in desktopItem.buildCommand
-      }
+    };
+  in ''
+    # TODO: Move to a dev output?
+    rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
+
+    ${desktopItem.buildCommand}
  '';

-  postFixup =
-    # Fix notifications. LibXUL uses dlopen for this, unfortunately; see #18712.
-    ''
-      patchelf --set-rpath "${lib.getLib libnotify
-        }/lib:$(patchelf --print-rpath "$out"/lib/thunderbird*/libxul.so)" \
-          "$out"/lib/thunderbird*/libxul.so
+  preFixup = ''
+    # Needed to find Mozilla runtime
+    gappsWrapperArgs+=(
+      --argv0 "$out/bin/thunderbird"
+      --set MOZ_APP_LAUNCHER thunderbird
+      # https://github.com/NixOS/nixpkgs/pull/61980
+      --set SNAP_NAME "thunderbird"
+      --set MOZ_LEGACY_PROFILES 1
+      --set MOZ_ALLOW_DOWNGRADE 1
+    )
+  '';
+
+  # FIXME: This can probably be removed as soon as we package a
+  # Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
+  postFixup = ''
+    local xul="$out/lib/thunderbird/libxul.so"
+    patchelf --set-rpath "${libnotify}/lib:$(patchelf --print-rpath $xul)" $xul
  '';

  doInstallCheck = true;
-  installCheckPhase =
-    ''
-      # Some basic testing
+  installCheckPhase = ''
    "$out/bin/thunderbird" --version
  '';

-  disallowedRequisites = [ stdenv.cc ];
-
-  meta = with stdenv.lib; {
-    description = "A full-featured e-mail client";
-    homepage = http://www.mozilla.org/thunderbird/;
-    license =
-      # Official branding implies thunderbird name and logo cannot be reuse,
-      # see http://www.mozilla.org/foundation/licensing.html
-      if enableOfficialBranding then licenses.proprietary else licenses.mpl11;
-    maintainers = [ maintainers.pierron maintainers.eelco ];
-    platforms = platforms.linux;
-  };
+  disallowedRequisites = [
+    stdenv.cc
+  ];

  passthru.updateScript = import ./../../browsers/firefox/update.nix {
    attrPath = "thunderbird";
    baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
-    inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl runtimeShell;
+    inherit writeScript lib common-updater-scripts xidel coreutils gnused
+      gnugrep curl runtimeShell;
+  };
+
+  meta = with stdenv.lib; {
+    description = "A full-featured e-mail client";
+    homepage = "https://www.thunderbird.net";
+    maintainers = with maintainers; [
+      eelco
+      lovesegfault
+      pierron
+    ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -16,7 +16,8 @@ assert iceSupport -> zeroc-ice != null;
 with stdenv.lib;
 let
  generic = overrides: source: qt5.mkDerivation (source // overrides // {
-    name = "${overrides.type}-${source.version}";
+    pname = overrides.type;
+    version = source.version;

    patches = (source.patches or []) ++ optional jackSupport ./mumble-jack-support.patch;

@ -63,9 +64,9 @@ let

    meta = {
      description = "Low-latency, high quality voice chat software";
-      homepage = https://mumble.info;
+      homepage = "https://mumble.info";
      license = licenses.bsd3;
-      maintainers = with maintainers; [ ];
+      maintainers = with maintainers; [ petabyteboy ];
      platforms = platforms.linux;
    };
  });
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -12,7 +12,6 @@
 , qtkeychain
 , qttools
 , qtwebengine
-, qtwebkit
 , sqlite
 }:

@ -45,7 +44,6 @@ mkDerivation rec {
    qtkeychain
    qttools
    qtwebengine
-    qtwebkit
    sqlite
  ];

@ -55,6 +53,7 @@ mkDerivation rec {

  cmakeFlags = [
    "-DCMAKE_INSTALL_LIBDIR=lib" # expected to be prefix-relative by build code setting RPATH
+    "-DNO_SHIBBOLETH=1" # allows to compile without qtwebkit
  ];

  meta = with lib; {
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "gnunet";
-  version = "0.11.6";
+  version = "0.11.8";

  src = fetchurl {
    url = "mirror://gnu/gnunet/${pname}-${version}.tar.gz";
-    sha256 = "1gspr1lh885sb9r2anh7bi4zan3zjqx33lpyhq9hm2g0n5ip187q";
+    sha256 = "1zkmcq75sfr3iyg8rgxp9dbl7fwsvc1a71rc0vgisghcbrx1n7yj";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -10,13 +10,13 @@ with lib;

 mkDerivation rec {
  pname = "qbittorrent";
-  version = "4.1.9.1";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qbittorrent";
    rev = "release-${version}";
-    sha256 = "19zgqlby7i1kr20wa4zd99qzd062a879xxxbmlf40rnqiqy4bhyi";
+    sha256 = "17vm6aa2k8k1q14z9r2r06c794bcr4m0l0fdsn08wid6mj1zjsbx";
  };

  # NOTE: 2018-05-31: CMake is working but it is not officially supported
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@ -31,7 +31,10 @@ in stdenv.mkDerivation rec {
  version = "5.5.1";

  src = fetchurl {
-    url = "https://download.anydesk.com/linux/${pname}-${version}-${arch}.tar.gz";
+    urls = [
+      "https://download.anydesk.com/linux/${pname}-${version}-${arch}.tar.gz"
+      "https://download.anydesk.com/linux/generic-linux/${pname}-${version}-${arch}.tar.gz"
+    ];
    inherit sha256;
  };

--- a/pkgs/applications/networking/remote/citrix-workspace/default.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/default.nix
@ -24,7 +24,7 @@
 , gtk_engines
 , alsaLib
 , zlib
-, version ? "19.10.0"
+, version ? "19.12.0"
 }:

 let
@ -71,7 +71,18 @@ let
        x86hash   = "000zjik8wf8b6fadnsai0p77b4n2l95544zx503iyrb9pv53bj3y";
        x64suffix = "15";
        x86suffix = "15";
-        homepage  = https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest1.html;
+        homepage  = https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-1910.html;
+      };
+
+      "19.12.0" = {
+        major     = "19";
+        minor     = "12";
+        patch     = "0";
+        x64hash   = "1si5mkxbgb8m99bkvgc3l80idjfdp0kby6pv47s07nn43dbr1j7a";
+        x86hash   = "07rfp90ksnvr8zv7ix7f0z6a59n48s7bd4kqbzilfwxgs4ddqmcy";
+        x64suffix = "19";
+        x86suffix = "19";
+        homepage  = https://www.citrix.com/de-de/downloads/workspace-app/linux/workspace-app-for-linux-latest.html;
      };
    };

--- a/pkgs/applications/office/flexibee/default.nix
+++ b/pkgs/applications/office/flexibee/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, makeWrapper, jre }:

 let
-  version = "2019.3.0.7";
+  version = "2019.3.1.1";
  majorVersion = builtins.substring 0 6 version;
 in

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://download.flexibee.eu/download/${majorVersion}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "01n2pkh17s2iab7n9xgq9vqcf1fnzmb382zmmd1lwyw3x57f5rq2";
+    sha256 = "0zlxbdwcb0xb0bx4nvj6dn0vpw21czgf196bjlkk1547j6146p1p";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/applications/office/skrooge/default.nix
@ -7,21 +7,13 @@

 mkDerivation rec {
  pname = "skrooge";
-  version = "2.20.0";
+  version = "2.21.0";

  src = fetchurl {
    url = "http://download.kde.org/stable/skrooge/${pname}-${version}.tar.xz";
-    sha256 = "0rakfngp7j2x7h1isg6lbc5kva6k1kg99dz0zl43dc28s15can1w";
+    sha256 = "1aqn0367q7mdg728r5085aqzc4mgfz1bgqqlhgdjjp7r192yq7r2";
  };

-  patches = [
-    (fetchpatch {
-      name = "skrooge-2.20.0-missing-header.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-office/skrooge/files/skrooge-2.20.0-missing-header.patch?id=cb8c91474b0ae2f9e889f89afe2d9114dbd1784f";
-      sha256 = "154zsidx45h6qrcqjh6czjxrcwrcmbyv3yh2k1s40v8pzvjwzrld";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake extra-cmake-modules kdoctools shared-mime-info
  ];
--- a/pkgs/applications/office/tryton/default.nix
+++ b/pkgs/applications/office/tryton/default.nix
@ -1,5 +1,5 @@
 { stdenv
-, python2Packages
+, python3Packages
 , pkgconfig
 , librsvg
 , gobject-introspection
@ -7,40 +7,59 @@
 , gtk3
 , gtkspell3
 , gnome3
+, glib
 , goocanvas2
+, gdk-pixbuf
+, pango
+, fontconfig
+, freetype
+, wrapGAppsHook
 }:

 with stdenv.lib;

-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "tryton";
-  version = "4.8.5";
-  src = python2Packages.fetchPypi {
+  version = "5.4.0";
+
+  disabled = !python3Packages.isPy3k;
+
+  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "43759d22b061a7a392a534d19a045fafd442ce98a0e390ee830127367dcaf4b4";
+    sha256 = "0wbq8y8z0n6c5b3h5ynlawn3z79a3hkb1fkmblz4pwnj0jfnbswd";
  };
-  nativeBuildInputs = [ pkgconfig gobject-introspection ];
-  propagatedBuildInputs = with python2Packages; [
-    chardet
+
+  nativeBuildInputs = [
+    pkgconfig
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
    dateutil
-    pygtk
-    librsvg
    pygobject3
    goocalendar
-    cdecimal
+    pycairo
  ];
+
  buildInputs = [
    atk
-    gtk3
+    gdk-pixbuf
+    glib
    gnome3.adwaita-icon-theme
-    gtkspell3
    goocanvas2
+    fontconfig
+    freetype
+    gtk3
+    gtkspell3
+    librsvg
+    pango
  ];
-  makeWrapperArgs = [
-    ''--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"''
-    ''--set GI_TYPELIB_PATH "$GI_TYPELIB_PATH"''
-    ''--suffix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"''
-  ];
+
+  strictDeps = false;
+
+  doCheck = false;
+
  meta = {
    description = "The client of the Tryton application platform";
    longDescription = ''
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -35,11 +35,11 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "5.0.77";
+  version = "5.0.80";

  src = fetchurl {
    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "1dgxzprpb8f5wpmvlvkxix0xxckfgjsi3wfcy9mb221a17cv0029";
+    sha256 = "0a5xjliml6rwxvi450l42iw6m9mk3aahnp90sr22jyijz9qii2al";
  };

  buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme dconf ];
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@ -1,31 +1,20 @@
-{ stdenv, fetchurl, libxml2Python, libxslt, makeWrapper
-, pyserial, pygtk }:
-
-stdenv.mkDerivation rec {
+{ stdenv
+, fetchurl
+, python2
+}:
+python2.pkgs.buildPythonApplication rec {
  pname = "chirp-daily";
-  version = "20190925";
+  version = "20191123";

  src = fetchurl {
    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0immgss7nj7395r3csiypksnbn1r2f3j45c5v8qpybz65lpbplps";
+    sha256 = "11wzk0c9fa3gp185gyd47g3sh7gfallw7qapr6qp913q2zfmif8v";
  };

-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [
-    pyserial pygtk libxml2Python libxslt
+  propagatedBuildInputs = with python2.pkgs; [
+    pygtk pyserial libxml2
  ];

-  installPhase = ''
-    mkdir -p $out/bin $out/share/chirp
-    cp -r . $out/share/chirp/
-    ln -s $out/share/chirp/chirpw $out/bin/chirpw
-
-    for file in "$out"/bin/*; do
-      wrapProgram "$file" \
-        --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath "$out")
-    done
-  '';
-
  meta = with stdenv.lib; {
    description = "A free, open-source tool for programming your amateur radio";
    homepage = https://chirp.danplanet.com/;
--- a/pkgs/applications/radio/wsjtx/default.nix
+++ b/pkgs/applications/radio/wsjtx/default.nix
@ -4,12 +4,12 @@

 stdenv.mkDerivation rec {
  pname = "wsjtx";
-  version = "2.1.0";
+  version = "2.1.2";

  # This is a "superbuild" tarball containing both wsjtx and a hamlib fork
  src = fetchurl {
    url = "http://physics.princeton.edu/pulsar/k1jt/wsjtx-${version}.tgz";
-    sha256 = "04flhyfw0djnnbrzh3f5lx06bnn92khchz3bmswk8if8n8j58v4y";
+    sha256 = "0aj3wg5xjjqwjvw6lra171ag5wq86w0hf1ra4k8mnaf0mc1qgbyl";
  };

  # Hamlib builds with autotools, wsjtx builds with cmake
--- a/pkgs/applications/science/biology/bedtools/default.nix
+++ b/pkgs/applications/science/biology/bedtools/default.nix
@ -2,19 +2,20 @@

 stdenv.mkDerivation rec {
  pname = "bedtools";
-  version = "2.29.0";
+  version = "2.29.1";

  src = fetchFromGitHub {
    owner = "arq5x";
    repo = "bedtools2";
    rev = "v${version}";
-    sha256 = "0d6i985qqxp92ddq4n6558m70qi5rqhl724wrfys0hm0p6a9h56x";
+    sha256 = "1vbpjvzl4ppzkan9qgm84bkn9kl3h3m5xz92y18wn1sksxcdq50x";
  };

  buildInputs = [ zlib python bzip2 lzma ];
-  cc = if stdenv.cc.isClang then "clang++" else "g++";
-  buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cc} -j $NIX_BUILD_CORES";
-  installPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cc} install";
+  cxx = if stdenv.cc.isClang then "clang++" else "g++";
+  cc = if stdenv.cc.isClang then "clang" else "gcc";
+  buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} -j $NIX_BUILD_CORES";
+  installPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} install";

  meta = with stdenv.lib; {
    description = "A powerful toolset for genome arithmetic.";
--- a/pkgs/applications/science/logic/boolector/default.nix
+++ b/pkgs/applications/science/logic/boolector/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, fetchpatch
 , cmake, lingeling, btor2tools
 }:

@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
    sha256 = "15i3ni5klss423m57wcy1gx0m5wfrjmglapwg85pm7fb3jj1y7sz";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-7560.patch";
+      url = "https://github.com/Boolector/boolector/commit/8d979d02e0482c7137c9f3a34e6d430dbfd1f5c5.patch";
+      sha256 = "1a1g02mk8b0azzjcigdn5zpshn0dn05fciwi8sd5q38yxvnvpbbi";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];
  buildInputs = [ lingeling btor2tools ];

--- a/pkgs/applications/science/logic/btor2tools/default.nix
+++ b/pkgs/applications/science/logic/btor2tools/default.nix
@ -24,8 +24,8 @@ stdenv.mkDerivation {
  outputs = [ "out" "dev" "lib" ];

  meta = with stdenv.lib; {
-    description = "Fast SAT solver";
-    homepage    = http://fmv.jku.at/lingeling/;
+    description = "A generic parser and tool package for the BTOR2 format";
+    homepage    = "https://github.com/Boolector/btor2tools";
    license     = licenses.mit;
    platforms   = platforms.linux;
    maintainers = with maintainers; [ thoughtpolice ];
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -32,6 +32,7 @@ let
   "8.10.0" = "138jw94wp4mg5dgjc2asn8ng09ayz1mxdznq342n0m469j803gzg";
   "8.10.1" = "072v2zkjzf7gj48137wpr3c9j0hg9pdhlr5l8jrgrwynld8fp7i4";
   "8.10.2" = "0znxmpy71bfw0p6x47i82jf5k7v41zbz9bdpn901ysn3ir8l3wrz";
+   "8.11+beta1" = "06dlxj6v7gd51dh6ir121z7lgqdagkq717xxxrc8bdqhz7d2z7qj";
  }.${version};
  coq-version = stdenv.lib.versions.majorMinor version;
  versionAtLeast = stdenv.lib.versionAtLeast coq-version;
--- a/pkgs/applications/science/math/sage/pybrial.nix
+++ b/pkgs/applications/science/math/sage/pybrial.nix
@ -1,6 +1,7 @@
 { stdenv
 , fetchFromGitHub
 , buildPythonPackage
+, brial
 }:
 # This has a cyclic dependency with sage. I don't include sage in the
 # buildInputs and let python figure it out at runtime. Because of this,
@ -9,15 +10,10 @@
 # it).
 buildPythonPackage rec {
    pname = "pyBRiAl";
-    version = "1.2.3";
+    version = brial.version;

    # included with BRiAl source
-    src = fetchFromGitHub {
-      owner = "BRiAl";
-      repo = "BRiAl";
-      rev = version;
-      sha256 = "0qy4cwy7qrk4zg151cmws5cglaa866z461cnj9wdnalabs7v7qbg";
-    };
+    src = brial.src;

    sourceRoot = "source/sage-brial";

--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@ -1,27 +1,32 @@
-{ stdenv, fetchurl, cmake, pcre, pkgconfig, python2
-, libX11, libXpm, libXft, libXext, libGLU, libGL, zlib, libxml2, lz4, lzma, gsl, xxHash
+{ stdenv, fetchurl, cmake, gl2ps, gsl, libX11, libXpm, libXft, libXext
+, libGLU, libGL, libxml2, lz4, lzma, pcre, pkgconfig, python, xxHash, zlib
 , Cocoa, OpenGL, noSplash ? false }:

 stdenv.mkDerivation rec {
  pname = "root";
-  version = "6.12.06";
+  version = "6.18.04";

  src = fetchurl {
    url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "1557b9sdragsx9i15qh6lq7fn056bgi87d31kxdl4vl0awigvp5f";
+    sha256 = "196ghma6g5a7sqz52wyjkgvmh4hj4vqwppm0zwdypy33hgy8anii";
  };

-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake pcre python2 zlib libxml2 lz4 lzma gsl xxHash ]
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ gl2ps pcre python zlib libxml2 lz4 lzma gsl xxHash ]
    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU libGL ]
    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
    ;
+  propagatedBuildInputs = [ python.pkgs.numpy ];

  patches = [
    ./sw_vers.patch
  ];

  preConfigure = ''
+    rm -rf builtins/*
+    substituteInPlace cmake/modules/SearchInstalledSoftware.cmake \
+      --replace 'set(lcgpackages ' '#set(lcgpackages '
+
    patchShebangs build/unix/
  '' + stdenv.lib.optionalString noSplash ''
    substituteInPlace rootx/src/rootx.cxx --replace "gNoLogo = false" "gNoLogo = true"
@ -35,8 +40,10 @@ stdenv.mkDerivation rec {
    "-Dbonjour=OFF"
    "-Dcastor=OFF"
    "-Dchirp=OFF"
+    "-Dclad=OFF"
    "-Ddavix=OFF"
    "-Ddcache=OFF"
+    "-Dfail-on-missing=ON"
    "-Dfftw3=OFF"
    "-Dfitsio=OFF"
    "-Dfortran=OFF"
@ -57,6 +64,7 @@ stdenv.mkDerivation rec {
    "-Drfio=OFF"
    "-Dsqlite=OFF"
    "-Dssl=OFF"
+    "-Dvdt=OFF"
    "-Dxml=ON"
    "-Dxrootd=OFF"
  ]
--- a/pkgs/applications/science/misc/root/sw_vers.patch
+++ b/pkgs/applications/science/misc/root/sw_vers.patch
@ -1,54 +1,46 @@
-diff --git a/build/unix/compiledata.sh b/build/unix/compiledata.sh
+diff a/build/unix/compiledata.sh b/build/unix/compiledata.sh
 --- a/build/unix/compiledata.sh
 +++ b/build/unix/compiledata.sh
-@@ -49,7 +49,7 @@ fi
+@@ -47,7 +47,7 @@ fi
 
 if [ "$ARCH" = "macosx" ] || [ "$ARCH" = "macosx64" ] || \
    [ "$ARCH" = "macosxicc" ]; then
 -   macosx_minor=`sw_vers | sed -n 's/ProductVersion://p' | cut -d . -f 2`
-+   macosx_minor=7
+   macosx_minor=12
    SOEXT="so"
    if [ $macosx_minor -ge 5 ]; then
       if [ "x`echo $SOFLAGS | grep -- '-install_name'`" != "x" ]; then
-diff --git a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
+diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
 --- a/cmake/modules/SetUpMacOS.cmake
 +++ b/cmake/modules/SetUpMacOS.cmake
-@@ -12,25 +12,11 @@ set(CMAKE_PREFIX_PATH ${CMAKE_PREFIX_PATH} /usr/X11R6)
- #---------------------------------------------------------------------------------------------------------
+@@ -2,17 +2,8 @@ set(ROOT_ARCHITECTURE macosx)
+ set(ROOT_PLATFORM macosx)
 
 if (CMAKE_SYSTEM_NAME MATCHES Darwin)
 -  EXECUTE_PROCESS(COMMAND sw_vers "-productVersion"
 -                  COMMAND cut -d . -f 1-2
 -                  OUTPUT_VARIABLE MACOSX_VERSION OUTPUT_STRIP_TRAILING_WHITESPACE)
+-
 -  MESSAGE(STATUS "Found a Mac OS X System ${MACOSX_VERSION}")
-  EXECUTE_PROCESS(COMMAND sw_vers "-productVersion"
-                  COMMAND cut -d . -f 2
-                  OUTPUT_VARIABLE MACOSX_MINOR OUTPUT_STRIP_TRAILING_WHITESPACE)
 -
 -  if(MACOSX_VERSION VERSION_GREATER 10.7 AND ${CMAKE_CXX_COMPILER_ID} MATCHES Clang)
     set(libcxx ON CACHE BOOL "Build using libc++" FORCE)
 -  endif()
 
-  if(${MACOSX_MINOR} GREATER 4)
+-  if(MACOSX_VERSION VERSION_GREATER 10.4)
     #TODO: check haveconfig and rpath -> set rpath true
     #TODO: check Thread, define link command
     #TODO: more stuff check configure script
-    execute_process(COMMAND /usr/sbin/sysctl machdep.cpu.extfeatures OUTPUT_VARIABLE SYSCTL_OUTPUT)
-    if(${SYSCTL_OUTPUT} MATCHES 64)
-       MESSAGE(STATUS "Found a 64bit system")
-        set(ROOT_ARCHITECTURE macosx64)
-        SET(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS}")
-        SET(CMAKE_SHARED_LIBRARY_CREATE_C_FLAGS "${CMAKE_SHARED_LIBRARY_CREATE_C_FLAGS} -m64")
-@@ -38,27 +24,6 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
+@@ -25,23 +16,7 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
        SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m64")
        SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m64")
        SET(CMAKE_Fortran_FLAGS "${CMAKE_Fortran_FLAGS} -m64")
-    else(${SYSCTL_OUTPUT} MATCHES 64)
+-    else()
 -       MESSAGE(STATUS "Found a 32bit system")
 -       SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m32")
 -       SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m32")
 -       SET(CMAKE_Fortran_FLAGS "${CMAKE_Fortran_FLAGS} -m32")
-    endif(${SYSCTL_OUTPUT} MATCHES 64)
+-    endif()
 -  endif()
 -
 -  if(MACOSX_VERSION VERSION_GREATER 10.6)
@ -59,32 +51,51 @@ diff --git a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
 -  endif()
 -  if(MACOSX_VERSION VERSION_GREATER 10.8)
 -    set(MACOSX_GLU_DEPRECATED ON)
-    set(MACOSX_KRB5_DEPRECATED ON)
-  endif()
-  if(MACOSX_VERSION VERSION_GREATER 10.9)
-    set(MACOSX_LDAP_DEPRECATED ON)
 -  endif()
+     endif()
 
   if (CMAKE_COMPILER_IS_GNUCXX)
      message(STATUS "Found GNU compiler collection")
-@@ -135,7 +100,7 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
+@@ -104,7 +79,6 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
   endif()
 
   #---Set Linker flags----------------------------------------------------------------------
-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS}  -mmacosx-version-min=${MACOSX_VERSION} -Wl,-rpath,@loader_path/../lib")
-+  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-rpath,@loader_path/../lib")
- 
- 
+-  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -mmacosx-version-min=${MACOSX_VERSION}")
 else (CMAKE_SYSTEM_NAME MATCHES Darwin)
-diff --git a/config/root-config.in b/config/root-config.in
+   MESSAGE(FATAL_ERROR "There is no setup for this this Apple system up to now. Don't know waht to do. Stop cmake at this point.")
+ endif (CMAKE_SYSTEM_NAME MATCHES Darwin)
+diff a/config/root-config.in b/config/root-config.in
 --- a/config/root-config.in
 +++ b/config/root-config.in
-@@ -304,7 +304,7 @@ macosxicc)
+@@ -306,12 +306,6 @@ macosxicc)
+    auxlibs="-lm -ldl"
    ;;
 macosx64)
-    # MacOS X with gcc (GNU cc v4.x) in 64 bit mode
+-   # MacOS X with gcc (GNU cc v4.x) in 64 bit mode
 -   macosx_minor=`sw_vers | sed -n 's/ProductVersion://p' | cut -d . -f 2`
-+   macosx_minor=7
-    # cannot find the one linked to libGraf if relocated after built
-    if [ $macosx_minor -le 4 ]; then
-       rootlibs="$rootlibs -lfreetype"
+-   # cannot find the one linked to libGraf if relocated after built
+-   if [ $macosx_minor -le 4 ]; then
+-      rootlibs="$rootlibs -lfreetype"
+-   fi
+    auxcflags="${cxxversionflag} -m64"
+    auxldflags="-m64"
+    auxlibs="-lm -ldl"
+@@ -375,18 +369,11 @@ freebsd* | openbsd* | linux*)
+ macosx*)
+    for f in $features ; do
+       if test "x$f" = "xthread" ; then
+-         if [ $macosx_minor -ge 5 ]; then
+             auxcflags="-pthread $auxcflags"
+             auxlibs="-lpthread $auxlibs"
+-         else
+-            auxcflags="-D_REENTRANT $auxcflags"
+-            auxlibs="-lpthread $auxlibs"
+-         fi
+       fi
+       if test "x$f" = "xrpath" ; then
+-         if [ $macosx_minor -ge 5 ]; then
+             auxlibs="-Wl,-rpath,$libdir $auxlibs"
+-         fi
+       fi
+       if test "x$f" = "xlibcxx" ; then
+          auxcflags="-stdlib=libc++ $auxcflags"
--- a/pkgs/applications/science/robotics/mavproxy/default.nix
+++ b/pkgs/applications/science/robotics/mavproxy/default.nix
@ -0,0 +1,31 @@
+{ lib, buildPythonApplication, fetchPypi, matplotlib, numpy, pymavlink, pyserial
+, setuptools, wxPython_4_0 }:
+
+buildPythonApplication rec {
+  pname = "MAVProxy";
+  version = "1.8.17";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "193hjilsmbljbgj7v6icy3b4hzm14l0z6v05v7ycx6larij5xj2r";
+  };
+
+  propagatedBuildInputs = [
+    matplotlib
+    numpy
+    pymavlink
+    pyserial
+    setuptools
+    wxPython_4_0
+  ];
+
+  # No tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "MAVLink proxy and command line ground station";
+    homepage = "https://github.com/ArduPilot/MAVProxy";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ lopsided98 ];
+  };
+}
--- a/pkgs/applications/version-management/diffuse/default.nix
+++ b/pkgs/applications/version-management/diffuse/default.nix
@ -1,33 +0,0 @@
-{ stdenv, fetchurl, python27Packages, makeWrapper }:
-
-let
-  inherit (python27Packages) pygtk python;
-in stdenv.mkDerivation rec {
-  version = "0.4.8";
-  pname = "diffuse";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/diffuse/diffuse/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0ayz8bywmk1z3zicb0a7hbxliqpc7xym60s0mawzqllkpadvgly1";
-  };
-
-  buildInputs = [ python pygtk makeWrapper ];
-
-  buildPhase = ''
-    python ./install.py --prefix="$out" --sysconfdir="$out/etc" --pythonbin="${python}/bin/python"
-    wrapProgram "$out/bin/diffuse" --prefix PYTHONPATH : $PYTHONPATH:${pygtk}/lib/${python.libPrefix}/site-packages/gtk-2.0
-  '';
-
-  # no-op, everything is done in buildPhase
-  installPhase = "true";
-
-  # NOTE: diffuse installs a .desktop file itself
-
-  meta = with stdenv.lib; {
-    description = "Graphical diff and merge tool";
-    homepage = http://diffuse.sourceforge.net/;
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
-  };
-}
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.24.0";
+  version = "2.24.1";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -33,7 +33,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "06rpakbwzck85ncfsgv4xmq3iwab9d4f5y6dqhl8nvb2fccxcwcz";
+    sha256 = "0ql5z31vgl7b785gwrf00m129mg7zi9pa65n12ij3mpxx3f28gvj";
  };

  outputs = [ "out" ];
@ -230,6 +230,7 @@ stdenv.mkDerivation {
                -e "s|exec wish|exec '${tk}/bin/wish'|g" \
                "$out/$prog"
       done
+       ln -s $out/share/git/contrib/completion/git-completion.bash $out/share/bash-completion/completions/gitk
     '' else ''
       # Don't wrap Tcl/Tk, replace them by notification scripts
       for prog in bin/gitk libexec/git-core/git-gui; do
--- a/pkgs/applications/version-management/git-and-tools/lab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@ -2,18 +2,20 @@

 buildGoModule rec {
  pname = "lab";
-  version = "0.16.0";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = "zaquestion";
    repo = "lab";
    rev = "v${version}";
-    sha256 = "0f1gi4mlcxjvz2sgh0hzzsqxg5gfvq2ay7xjd0y1kz3pp8kxja7i";
+    sha256 = "1z83v1dl9c5f99jvvc23ijkwrfrv489la05rlsrc3r4zzza1hx1f";
  };

  subPackages = [ "." ];

-  modSha256 = "0bw47dd1b46ywsian2b957a4ipm77ncidipzri9ra39paqlv7abb";
+  modSha256 = "03fqa7s6729g0a6ffiyc61dkldpi7vg8pvvpqak4c0mqi1dycivd";
+
+  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];

  postInstall = ''
    mkdir -p "$out/share/bash-completion/completions" "$out/share/zsh/site-functions"
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,9 +1,9 @@
 {
-  "version": "12.5.3",
-  "repo_hash": "1q76yhg4ygs9w5hb8hbv1908d5pfqzr8idmjp06pa4dw5qqqkv97",
+  "version": "12.5.4",
+  "repo_hash": "08jngv83pvxjyw3iaqzv484v4mwgwnzg9am3iqfidl9ihbm7i4h2",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v12.5.3-ee",
+  "rev": "v12.5.4-ee",
  "passthru": {
    "GITALY_SERVER_VERSION": "1.72.1",
    "GITLAB_PAGES_VERSION": "1.12.0",
--- a/pkgs/applications/video/key-mon/default.nix
+++ b/pkgs/applications/video/key-mon/default.nix
@ -1,28 +0,0 @@
-{ stdenv, fetchurl, gnome2, librsvg, pythonPackages }:
-
-pythonPackages.buildPythonApplication rec {
-  pname = "key-mon";
-  version = "1.17";
-  namePrefix = "";
-
-  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/key-mon/${pname}-${version}.tar.gz";
-    sha256 = "1liz0dxcqmchbnl1xhlxkqm3gh76wz9jxdxn9pa7dy77fnrjkl5q";
-  };
-
-  propagatedBuildInputs =
-    [ gnome2.python_rsvg librsvg pythonPackages.pygtk pythonPackages.xlib ];
-
-  doCheck = false;
-
-  preFixup = ''
-      export makeWrapperArgs="--set GDK_PIXBUF_MODULE_FILE $GDK_PIXBUF_MODULE_FILE"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://code.google.com/archive/p/key-mon;
-    description = "Utility to show live keyboard and mouse status for teaching and screencasts";
-    license = licenses.asl20;
-    maintainers = [ maintainers.goibhniu ];
-  };
-}
--- a/pkgs/applications/video/recordmydesktop/default.nix
+++ b/pkgs/applications/video/recordmydesktop/default.nix
@ -1,29 +0,0 @@
-{ stdenv, fetchsvn, autoreconfHook, zlib, popt, alsaLib, libvorbis, libtheora
-, libICE, libSM, libX11, libXext, libXfixes, libXdamage }:
-
-stdenv.mkDerivation rec {
-  pname = "recordmydesktop";
-  version = "0.3.8.1-svn${rev}";
-  rev = "602";
-
-  src = fetchsvn {
-    url = https://recordmydesktop.svn.sourceforge.net/svnroot/recordmydesktop/trunk/recordmydesktop;
-    inherit rev;
-    sha256 = "1avirkc4ymrd575m616pi6wpgq1i0r5sb3qahps1g18sjpxks0lf";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-
-  buildInputs = [
-    zlib popt alsaLib libICE libSM libX11 libXext
-    libXfixes libXdamage libvorbis libtheora
-  ];
-
-  meta = with stdenv.lib; {
-    description = "Desktop session recorder";
-    homepage = http://recordmydesktop.sourceforge.net/;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/applications/video/recordmydesktop/gtk.nix
+++ b/pkgs/applications/video/recordmydesktop/gtk.nix
@ -1,37 +0,0 @@
-{ stdenv, lib, fetchsvn, recordmydesktop, autoreconfHook, pkgconfig
-, pythonPackages, jack2, xwininfo }:
-
-let
-  binPath = lib.makeBinPath [ recordmydesktop jack2 xwininfo ];
-
-in stdenv.mkDerivation {
-  pname = "gtk-recordmydesktop";
-  version = "0.3.8-svn${recordmydesktop.rev}";
-
-  src = fetchsvn {
-    url = https://recordmydesktop.svn.sourceforge.net/svnroot/recordmydesktop/trunk/gtk-recordmydesktop;
-    inherit (recordmydesktop) rev;
-    sha256 = "010aykgjfxhyiixq9a9fg3p1a1ixz59m1vkn16hpy0lybgf4dsby";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-
-  buildInputs = with pythonPackages; [
-    python pygtk wrapPython
-  ];
-
-  pythonPath = with pythonPackages; [ pygtk ];
-
-  postInstall = ''
-    makeWrapperArgs="--prefix PATH : ${binPath}"
-    wrapPythonPrograms
-  '';
-
-  meta = with stdenv.lib; {
-    description = "GTK frontend for recordmydesktop";
-    homepage = http://recordmydesktop.sourceforge.net/;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/applications/video/recordmydesktop/qt.nix
+++ b/pkgs/applications/video/recordmydesktop/qt.nix
@ -1,37 +0,0 @@
-{ stdenv, lib, fetchsvn, recordmydesktop, autoreconfHook, pkgconfig
-, glib, pythonPackages, qt4, jack2, xwininfo }:
-
-let
-  binPath = lib.makeBinPath [ recordmydesktop jack2 xwininfo ];
-
-in stdenv.mkDerivation {
-  pname = "qt-recordmydesktop";
-  version = "0.3.8-svn${recordmydesktop.rev}";
-
-  src = fetchsvn {
-    url = https://recordmydesktop.svn.sourceforge.net/svnroot/recordmydesktop/trunk/qt-recordmydesktop;
-    inherit (recordmydesktop) rev;
-    sha256 = "0vz7amrmz317sbx2cv2186d0r57as4l26xa9rpim5gbvzk20caqc";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-
-  buildInputs = [ glib qt4 ] ++ (with pythonPackages; [
-    python wrapPython pyqt4
-  ]);
-
-  pythonPath = with pythonPackages; [ pyqt4 ];
-
-  postInstall = ''
-    makeWrapperArgs="--prefix PATH : ${binPath}"
-    wrapPythonPrograms
-  '';
-
-  meta = with stdenv.lib; {
-    description = "GTK frontend for recordmydesktop";
-    homepage = http://recordmydesktop.sourceforge.net/;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@ -9,13 +9,13 @@
 stdenv.mkDerivation rec {
  project = "conmon";
  name = "${project}-${version}";
-  version = "2.0.4";
+  version = "2.0.7";

  src = fetchFromGitHub {
    owner = "containers";
    repo = project;
    rev = "v${version}";
-    sha256 = "1qma778h5fdvyf53ck8qr606aaf4f8msddb7pv5pgn1bywpcxs38";
+    sha256 = "1sfh94a1if907kky0wlqz188v6kfdl6v1i34pikpxjllngxzyfr9";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "crun";
-  version = "0.8";
+  version = "0.10.6";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = version;
-    sha256 = "1anvlgw373031w0pp0b28l10yrnyhbj192n60bbbjahw487dk2fi";
+    sha256 = "0v1hrlpnln0c976fb0k2ig4jv11qbyzf95z0wy92fd8r8in16rc1";
    fetchSubmodules = true;
  };

--- a/Show More
+++ b/Show More