Merge staging-next into staging

2020-02-11 08:00:27 +01:00 · 2020-02-11 08:00:27 +01:00 · b766624655
commit b766624655
parent 4959c970ee 1a6c3cb06b
225 changed files with 3409 additions and 1511 deletions
--- a/.version
+++ b/.version
@ -1 +1 @@
-20.03
+20.09
--- a/doc/builders/packages/index.xml
+++ b/doc/builders/packages/index.xml
@ -18,6 +18,7 @@
 <xi:include href="opengl.xml" />
 <xi:include href="shell-helpers.xml" />
 <xi:include href="steam.xml" />
+ <xi:include href="urxvt.xml" />
 <xi:include href="weechat.xml" />
 <xi:include href="xorg.xml" />
 </chapter>
--- a/doc/builders/packages/urxvt.xml
+++ b/doc/builders/packages/urxvt.xml
@ -0,0 +1,101 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-urxvt">
+ <title>Urxvt</title>
+
+ <para>
+  Urxvt, also known as rxvt-unicode, is a highly customizable terminal emulator.
+ </para>
+
+ <section xml:id="sec-urxvt-conf">
+
+  <title>Configuring urxvt</title>
+
+  <para>
+   In <literal>nixpkgs</literal>, urxvt is provided by the package
+   <literal>rxvt-unicode</literal>. It can be configured to include your choice
+   of plugins, reducing its closure size from the default configuration which
+   includes all available plugins. To make use of this functionality, use an
+   overlay or directly install an expression that overrides its configuration,
+   such as
+   <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+    plugins = with availablePlugins; [ perls resize-font vtwheel ];
+  }
+}</programlisting>
+   If the <literal>configure</literal> function returns an attrset without the
+   <literal>plugins</literal> attribute, <literal>availablePlugins</literal>
+   will be used automatically.
+  </para>
+
+  <para>
+   In order to add plugins but also keep all default plugins installed, it is
+   possible to use the following method:
+   <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+     plugins = (builtins.attrValues availablePlugins) ++ [ custom-plugin ];
+   };
+}</programlisting>
+  </para>
+
+  <para>
+   To get a list of all the plugins available, open the Nix REPL and run
+   <programlisting>$ nix repl
+:l &lt;nixpkgs&gt;
+map (p: p.name) pkgs.rxvt-unicode.plugins
+   </programlisting>
+   Alternatively, if your shell is bash or zsh and have completion enabled,
+   simply type <literal>nixpkgs.rxvt-unicode.plugins.&lt;tab&gt;</literal>.
+  </para>
+
+  <para>
+    In addition to <literal>plugins</literal> the options
+    <literal>extraDeps</literal> and <literal>perlDeps</literal> can be used
+    to install extra packages.
+    <literal>extraDeps</literal> can be used, for example, to provide 
+    <literal>xsel</literal> (a clipboard manager) to the clipboard plugin,
+    without installing it globally:
+    <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+     pluginsDeps = [ xsel ];
+   }
+}</programlisting>
+
+    <literal>perlDeps</literal> is a handy way to provide Perl packages to
+    your custom plugins (in <literal>$HOME/.urxvt/ext</literal>). For example,
+    if you need <literal>AnyEvent</literal> you can do:
+    <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+     perlDeps = with perlPackages; [ AnyEvent ];
+   }
+}</programlisting>
+  </para>
+
+ </section>
+
+ <section xml:id="sec-urxvt-pkg">
+
+  <title>Packaging urxvt plugins</title>
+
+  <para>
+   Urxvt plugins resides in
+   <literal>pkgs/applications/misc/rxvt-unicode-plugins</literal>.
+   To add a new plugin create an expression in a subdirectory and add the
+   package to the set in
+   <literal>pkgs/applications/misc/rxvt-unicode-plugins/default.nix</literal>.
+  </para>
+
+  <para>
+   A plugin can be any kind of derivation, the only requirement is that it
+   should always install perl scripts in <literal>$out/lib/urxvt/perl</literal>.
+   Look for existing plugins for examples.
+  </para>
+
+  <para>
+   If the plugin is itself a perl package that needs to be imported from
+   other plugins or scripts, add the following passthrough:
+   <programlisting>passthru.perlPackages = [ "self" ];
+</programlisting>
+   This will make the urxvt wrapper pick up the dependency and set up the perl
+   path accordingly.
+  </para>
+
+ </section>
+
+</section>
--- a/doc/contributing/quick-start.xml
+++ b/doc/contributing/quick-start.xml
@ -69,8 +69,7 @@
      <listitem>
       <para>
        JDiskReport, a Java utility: <link
-          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/jdiskreport/default.nix"><filename>pkgs/tools/misc/jdiskreport/default.nix</filename></link> (and the <link
-          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/jdiskreport/builder.sh">builder</link>). Nixpkgs doesn’t have a decent <varname>stdenv</varname> for Java yet so this is pretty ad-hoc.
+          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/jdiskreport/default.nix"><filename>pkgs/tools/misc/jdiskreport/default.nix</filename></link>. Nixpkgs doesn’t have a decent <varname>stdenv</varname> for Java yet so this is pretty ad-hoc.
       </para>
      </listitem>
      <listitem>
--- a/doc/stdenv/cross-compilation.xml
+++ b/doc/stdenv/cross-compilation.xml
@ -256,7 +256,7 @@
     </question>
     <answer>
      <para>
-<programlisting>doCheck = stdenv.hostPlatform != stdenv.buildPlatfrom;</programlisting>
+<programlisting>doCheck = stdenv.hostPlatform == stdenv.buildPlatfrom;</programlisting>
       Add it to your <function>mkDerivation</function> invocation.
      </para>
     </answer>
--- a/flake.nix
+++ b/flake.nix
@ -0,0 +1,50 @@
+# Experimental flake interface to Nixpkgs.
+# See https://github.com/NixOS/rfcs/pull/49 for details.
+{
+  edition = 201909;
+
+  description = "A collection of packages for the Nix package manager";
+
+  outputs = { self }:
+    let
+
+      jobs = import ./pkgs/top-level/release.nix {
+        nixpkgs = self;
+      };
+
+      lib = import ./lib;
+
+      systems = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
+
+      forAllSystems = f: lib.genAttrs systems (system: f system);
+
+    in
+    {
+      lib = lib // {
+        nixosSystem = { modules, ... } @ args:
+          import ./nixos/lib/eval-config.nix (args // {
+            modules = modules ++
+              [ { system.nixos.versionSuffix =
+                    ".${lib.substring 0 8 self.lastModified}.${self.shortRev or "dirty"}";
+                  system.nixos.revision = lib.mkIf (self ? rev) self.rev;
+                }
+              ];
+          });
+      };
+
+      checks.x86_64-linux.tarball = jobs.tarball;
+
+      htmlDocs = {
+        nixpkgsManual = jobs.manual;
+        nixosManual = (import ./nixos/release-small.nix {
+          nixpkgs = self;
+        }).nixos.manual.x86_64-linux;
+      };
+
+      legacyPackages = forAllSystems (system: import ./. { inherit system; });
+
+      nixosModules = {
+        notDetected = import ./nixos/modules/installer/scan/not-detected.nix;
+      };
+    };
+}
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -148,7 +148,7 @@ runTests {
            "${builtins.storeDir}/d945ibfx9x185xf04b890y4f9g3cbb63-python-2.7.11";
      in {
        storePath = isStorePath goodPath;
-        storePathDerivation = isStorePath (import ../.. {}).hello;
+        storePathDerivation = isStorePath (import ../.. { system = "x86_64-linux"; }).hello;
        storePathAppendix = isStorePath
          "${goodPath}/bin/python";
        nonAbsolute = isStorePath (concatStrings (tail (stringToCharacters goodPath)));
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@ -2,7 +2,7 @@

 pkgs.runCommandNoCC "nixpkgs-lib-tests" {
  buildInputs = [ pkgs.nix (import ./check-eval.nix) ];
-  NIX_PATH="nixpkgs=${pkgs.path}";
+  NIX_PATH = "nixpkgs=${toString pkgs.path}";
 } ''
    datadir="${pkgs.nix}/share"
    export TEST_ROOT=$(pwd)/test-tmp
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@ -171,7 +171,7 @@ rec {
     On each release the first letter is bumped and a new animal is chosen
     starting with that new letter.
  */
-  codeName = "Markhor";
+  codeName = "Nightingale";

  /* Returns the current nixpkgs version suffix as string. */
  versionSuffix =
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -357,6 +357,16 @@
    githubId = 5892756;
    name = "Alec Snyder";
  };
+  AluisioASG = {
+    name = "Aluísio Augusto Silva Gonçalves";
+    email = "aluisio@aasg.name";
+    github = "AluisioASG";
+    githubId = 1904165;
+    keys = [{
+      longkeyid = "rsa4096/0x9FAA63E097506D9D";
+      fingerprint = "7FDB 17B3 C29B 5BA6 E5A9  8BB2 9FAA 63E0 9750 6D9D";
+    }];
+  };
  alunduil = {
    email = "alunduil@gmail.com";
    github = "alunduil";
--- a/nixos/doc/manual/man-nixos-rebuild.xml
+++ b/nixos/doc/manual/man-nixos-rebuild.xml
@ -77,7 +77,14 @@
    <option>--builders</option> <replaceable>builder-spec</replaceable>
   </arg>

+   <sbr/>
+
+   <arg>
+    <option>--flake</option> <replaceable>flake-uri</replaceable>
+   </arg>
+
   <sbr />
+
   <arg>
    <group choice='req'>
    <arg choice='plain'>
@ -129,14 +136,17 @@
  <title>Description</title>

  <para>
-   This command updates the system so that it corresponds to the configuration
-   specified in <filename>/etc/nixos/configuration.nix</filename>. Thus, every
-   time you modify <filename>/etc/nixos/configuration.nix</filename> or any
-   NixOS module, you must run <command>nixos-rebuild</command> to make the
-   changes take effect. It builds the new system in
-   <filename>/nix/store</filename>, runs its activation script, and stop and
-   (re)starts any system services if needed. Please note that user services need
-   to be started manually as they aren't detected by the activation script at the moment.
+   This command updates the system so that it corresponds to the
+   configuration specified in
+   <filename>/etc/nixos/configuration.nix</filename> or
+   <filename>/etc/nixos/flake.nix</filename>. Thus, every time you
+   modify the configuration or any other NixOS module, you must run
+   <command>nixos-rebuild</command> to make the changes take
+   effect. It builds the new system in
+   <filename>/nix/store</filename>, runs its activation script, and
+   stop and (re)starts any system services if needed. Please note that
+   user services need to be started manually as they aren't detected
+   by the activation script at the moment.
  </para>

  <para>
@ -508,6 +518,24 @@
     </para>
    </listitem>
   </varlistentry>
+
+   <varlistentry>
+    <term>
+     <option>--flake</option> <replaceable>flake-uri</replaceable>[<replaceable>name</replaceable>]
+    </term>
+    <listitem>
+     <para>
+      Build the NixOS system from the specified flake. It defaults to
+      the directory containing the target of the symlink
+      <filename>/etc/nixos/flake.nix</filename>, if it exists. The
+      flake must contain an output named
+      <literal>nixosConfigurations.<replaceable>name</replaceable></literal>. If
+      <replaceable>name</replaceable> is omitted, it default to the
+      current host name.
+     </para>
+    </listitem>
+   </varlistentry>
+
  </variablelist>

  <para>
@ -554,6 +582,21 @@

  <variablelist>

+   <varlistentry>
+    <term>
+     <filename>/etc/nixos/flake.nix</filename>
+    </term>
+    <listitem>
+     <para>
+      If this file exists, then <command>nixos-rebuild</command> will
+      use it as if the <option>--flake</option> option was given. This
+      file may be a symlink to a <filename>flake.nix</filename> in an
+      actual flake; thus <filename>/etc/nixos</filename> need not be a
+      flake.
+     </para>
+    </listitem>
+   </varlistentry>
+
   <varlistentry>
    <term>
     <filename>/run/current-system</filename>
--- a/nixos/doc/manual/man-nixos-version.xml
+++ b/nixos/doc/manual/man-nixos-version.xml
@ -12,16 +12,22 @@
 </refnamediv>
 <refsynopsisdiv>
  <cmdsynopsis>
-   <command>nixos-version</command> 
+   <command>nixos-version</command>
   <arg>
    <option>--hash</option>
   </arg>
-    
+
   <arg>
    <option>--revision</option>
   </arg>
+
+   <arg>
+    <option>--json</option>
+   </arg>
+
  </cmdsynopsis>
 </refsynopsisdiv>
+
 <refsection>
  <title>Description</title>
  <para>
@ -84,12 +90,16 @@
   </variablelist>
  </para>
 </refsection>
+
 <refsection>
  <title>Options</title>
+
  <para>
   This command accepts the following options:
  </para>
+
  <variablelist>
+
   <varlistentry>
    <term>
     <option>--hash</option>
@ -107,6 +117,21 @@
     </para>
    </listitem>
   </varlistentry>
+
+   <varlistentry>
+    <term>
+     <option>--json</option>
+    </term>
+    <listitem>
+     <para>
+      Print a JSON representation of the versions of NixOS and the
+      top-level configuration flake.
+     </para>
+    </listitem>
+   </varlistentry>
+
  </variablelist>
+
 </refsection>
+
 </refentry>
--- a/nixos/doc/manual/release-notes/release-notes.xml
+++ b/nixos/doc/manual/release-notes/release-notes.xml
@ -8,6 +8,7 @@
  This section lists the release notes for each stable version of NixOS and
  current unstable revision.
 </para>
+ <xi:include href="rl-2009.xml" />
 <xi:include href="rl-2003.xml" />
 <xi:include href="rl-1909.xml" />
 <xi:include href="rl-1903.xml" />
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -440,15 +440,19 @@ users.users.me =
   </listitem>
   <listitem>
    <para>
-      The <link linkend="opt-services.buildkite-agent.enable">Buildkite Agent</link>
-      module and corresponding packages have been updated to 3.x.
-      While doing so, the following options have been changed:
+      The <link linkend="opt-services.buildkite-agents">Buildkite
+      Agent</link> module and corresponding packages have been updated to
+      3.x, and to support multiple instances of the agent running at the
+      same time. This means you will have to rename
+      <literal>services.buildkite-agent</literal> to
+      <literal>services.buildkite-agents.&lt;name&gt;</literal>. Furthermore,
+      the following options have been changed:
    </para>
    <itemizedlist>
      <listitem>
       <para>
         <literal>services.buildkite-agent.meta-data</literal> has been renamed to
-         <link linkend="opt-services.buildkite-agent.tags">services.buildkite-agent.tags</link>,
+         <link linkend="opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.tags</link>,
         to match upstreams naming for 3.x.
         Its type has also changed - it now accepts an attrset of strings.
       </para>
@ -464,13 +468,13 @@ users.users.me =
       <para>
         <literal>services.buildkite-agent.openssh.privateKeyPath</literal>
         has been renamed to
-         <link linkend="opt-services.buildkite-agent.privateSshKeyPath">buildkite-agent.privateSshKeyPath</link>,
+         <link linkend="opt-services.buildkite-agents">buildkite-agents.&lt;name&gt;.privateSshKeyPath</link>,
         as the whole <literal>openssh</literal> now only contained that single option.
       </para>
      </listitem>
      <listitem>
       <para>
-         <link linkend="opt-services.buildkite-agent.shell">services.buildkite-agent.shell</link>
+         <link linkend="opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.shell</link>
         has been introduced, allowing to specify a custom shell to be used.
       </para>
      </listitem>
@ -675,8 +679,9 @@ auth required pam_succeed_if.so uid >= 1000 quiet
     Certificates will be regenerated anew on the next renewal date. The credentials for simp-le are
     preserved and thus it is possible to roll back to previous versions without breaking certificate
     generation.
+    </para>
   </listitem>
-    <listitem>
+   <listitem>
    <para>
    It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token
    via <option>boot.initrd.luks.fido2Support</option>.
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -0,0 +1,80 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09">
+ <title>Release 20.09 (“Nightingale”, 2020.09/??)</title>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-highlights">
+  <title>Highlights</title>
+
+  <para>
+   In addition to numerous new and upgraded packages, this release has the
+   following highlights:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para>
+     Support is planned until the end of October 2020, handing over to 20.09.
+    </para>
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-new-services">
+  <title>New Services</title>
+
+  <para>
+   The following new services were added since the last release:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-incompatibilities">
+  <title>Backward Incompatibilities</title>
+
+  <para>
+   When upgrading from a previous release, please be aware of the following
+   incompatible changes:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-notable-changes">
+  <title>Other Notable Changes</title>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+ </section>
+</section>
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@ -42,6 +42,10 @@ with lib;
    let
      cfg = config.xdg.portal;
      packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
+      joinedPortals = pkgs.symlinkJoin {
+        name = "xdg-portals";
+        paths = cfg.extraPortals;
+      };

    in mkIf cfg.enable {

@ -56,7 +60,7 @@ with lib;

      environment.variables = {
        GTK_USE_PORTAL = mkIf cfg.gtkUsePortal "1";
-        XDG_DESKTOP_PORTAL_PATH = map (p: "${p}/share/xdg-desktop-portal/portals") cfg.extraPortals;
+        XDG_DESKTOP_PORTAL_DIR = "${joinedPortals}/share/xdg-desktop-portal/portals";
      };
    };
 }
--- a/nixos/modules/installer/tools/nixos-rebuild.sh
+++ b/nixos/modules/installer/tools/nixos-rebuild.sh
@ -3,6 +3,9 @@
 if [ -x "@shell@" ]; then export SHELL="@shell@"; fi;

 set -e
+set -o pipefail
+
+export PATH=@path@:$PATH

 showSyntax() {
    exec man nixos-rebuild
@ -13,6 +16,7 @@ showSyntax() {
 # Parse the command line.
 origArgs=("$@")
 extraBuildFlags=()
+lockFlags=()
 action=
 buildNix=1
 fast=
@ -58,7 +62,7 @@ while [ "$#" -gt 0 ]; do
        j="$1"; shift 1
        extraBuildFlags+=("$i" "$j")
        ;;
-      --show-trace|--keep-failed|-K|--keep-going|-k|--verbose|-v|-vv|-vvv|-vvvv|-vvvvv|--fallback|--repair|--no-build-output|-Q|-j*)
+      --show-trace|--keep-failed|-K|--keep-going|-k|--verbose|-v|-vv|-vvv|-vvvv|-vvvvv|--fallback|--repair|--no-build-output|-Q|-j*|-L|--refresh|--no-net)
        extraBuildFlags+=("$i")
        ;;
      --option)
@ -93,6 +97,22 @@ while [ "$#" -gt 0 ]; do
      --use-remote-sudo)
        maybeSudo=(sudo --)
        ;;
+      --flake)
+        flake="$1"
+        shift 1
+        ;;
+      --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
+        lockFlags+=("$i")
+        ;;
+      --update-input)
+        j="$1"; shift 1
+        lockFlags+=("$i" "$j")
+        ;;
+      --override-input)
+        j="$1"; shift 1
+        k="$1"; shift 1
+        lockFlags+=("$i" "$j" "$k")
+        ;;
      *)
        echo "$0: unknown option \`$i'"
        exit 1
@ -202,7 +222,7 @@ fi


 # If ‘--upgrade’ is given, run ‘nix-channel --update nixos’.
-if [ -n "$upgrade" -a -z "$_NIXOS_REBUILD_REEXEC" ]; then
+if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then
    nix-channel --update nixos

    # If there are other channels that contain a file called
@ -225,8 +245,15 @@ if [ -z "$_NIXOS_REBUILD_REEXEC" ]; then
    export PATH=@nix@/bin:$PATH
 fi

+# Use /etc/nixos/flake.nix if it exists. It can be a symlink to the
+# actual flake.
+if [[ -z $flake && -e /etc/nixos/flake.nix ]]; then
+    flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")"
+fi
+
 # Re-execute nixos-rebuild from the Nixpkgs tree.
-if [ -z "$_NIXOS_REBUILD_REEXEC" -a -n "$canRun" -a -z "$fast" ]; then
+# FIXME: get nixos-rebuild from $flake.
+if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast && -z $flake ]]; then
    if p=$(nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
        export _NIXOS_REBUILD_REEXEC=1
        exec $p/bin/nixos-rebuild "${origArgs[@]}"
@ -234,10 +261,37 @@ if [ -z "$_NIXOS_REBUILD_REEXEC" -a -n "$canRun" -a -z "$fast" ]; then
    fi
 fi

+# For convenience, use the hostname as the default configuration to
+# build from the flake.
+if [[ -n $flake ]]; then
+    if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
+       flake="${BASH_REMATCH[1]}"
+       flakeAttr="${BASH_REMATCH[2]}"
+    fi
+    if [[ -z $flakeAttr ]]; then
+        read -r hostname < /proc/sys/kernel/hostname
+        if [[ -z $hostname ]]; then
+            hostname=default
+        fi
+        flakeAttr="nixosConfigurations.\"$hostname\""
+    else
+        flakeAttr="nixosConfigurations.\"$flakeAttr\""
+    fi
+fi
+
+# Resolve the flake.
+if [[ -n $flake ]]; then
+    flake=$(nix flake info --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
+fi
+
 # Find configuration.nix and open editor instead of building.
 if [ "$action" = edit ]; then
-    NIXOS_CONFIG=${NIXOS_CONFIG:-$(nix-instantiate --find-file nixos-config)}
-    exec "${EDITOR:-nano}" "$NIXOS_CONFIG"
+    if [[ -z $flake ]]; then
+        NIXOS_CONFIG=${NIXOS_CONFIG:-$(nix-instantiate --find-file nixos-config)}
+        exec "${EDITOR:-nano}" "$NIXOS_CONFIG"
+    else
+        exec nix edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
+    fi
    exit 1
 fi

@ -296,7 +350,7 @@ prebuiltNix() {

 remotePATH=

-if [ -n "$buildNix" ]; then
+if [[ -n $buildNix && -z $flake ]]; then
    echo "building Nix..." >&2
    nixDrv=
    if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then
@ -337,7 +391,7 @@ fi

 # Update the version suffix if we're building from Git (so that
 # nixos-version shows something useful).
-if [ -n "$canRun" ]; then
+if [[ -n $canRun && -z $flake ]]; then
    if nixpkgs=$(nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
        suffix=$($SHELL $nixpkgs/nixos/modules/installer/tools/get-version-suffix "${extraBuildFlags[@]}" || true)
        if [ -n "$suffix" ]; then
@ -358,15 +412,37 @@ fi
 if [ -z "$rollback" ]; then
    echo "building the system configuration..." >&2
    if [ "$action" = switch -o "$action" = boot ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
+        else
+            outLink=$tmpDir/result
+            nix build "$flake#$flakeAttr.config.system.build.toplevel" \
+              "${extraBuildFlags[@]}" "${lockFlags[@]}" --out-link $outLink
+            pathToConfig="$(readlink -f $outLink)"
+        fi
        copyToTarget "$pathToConfig"
        targetHostCmd nix-env -p "$profile" --set "$pathToConfig"
    elif [ "$action" = test -o "$action" = build -o "$action" = dry-build -o "$action" = dry-activate ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
+        else
+            nix build "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}"
+            pathToConfig="$(readlink -f ./result)"
+        fi
    elif [ "$action" = build-vm ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
+        else
+            echo "$0: 'build-vm' is not supported with '--flake'" >&2
+            exit 1
+        fi
    elif [ "$action" = build-vm-with-bootloader ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
+        else
+            echo "$0: 'build-vm-with-bootloader' is not supported with '--flake'" >&2
+            exit 1
+        fi
    else
        showSyntax
    fi
--- a/nixos/modules/installer/tools/nixos-version.sh
+++ b/nixos/modules/installer/tools/nixos-version.sh
@ -6,8 +6,17 @@ case "$1" in
    exit 1
    ;;
  --hash|--revision)
+    if ! [[ @revision@ =~ ^[0-9a-f]+$ ]]; then
+      echo "$0: Nixpkgs commit hash is unknown"
+      exit 1
+    fi
    echo "@revision@"
    ;;
+  --json)
+    cat <<EOF
+@json@
+EOF
+    ;;
  *)
    echo "@version@ (@codeName@)"
    ;;
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -31,6 +31,7 @@ let
      nix = config.nix.package.out;
      nix_x86_64_linux = fallback.x86_64-linux;
      nix_i686_linux = fallback.i686-linux;
+      path = makeBinPath [ pkgs.jq ];
    };

  nixos-generate-config = makeProg {
@ -47,6 +48,14 @@ let
    name = "nixos-version";
    src = ./nixos-version.sh;
    inherit (config.system.nixos) version codeName revision;
+    inherit (config.system) configurationRevision;
+    json = builtins.toJSON ({
+      nixosVersion = config.system.nixos.version;
+    } // optionalAttrs (config.system.nixos.revision != null) {
+      nixpkgsRevision = config.system.nixos.revision;
+    } // optionalAttrs (config.system.configurationRevision != null) {
+      configurationRevision = config.system.configurationRevision;
+    });
  };

  nixos-enter = makeProg {
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@ -42,8 +42,8 @@ in

    nixos.revision = mkOption {
      internal = true;
-      type = types.str;
-      default = trivial.revisionWithDefault "master";
+      type = types.nullOr types.str;
+      default = trivial.revisionWithDefault null;
      description = "The Git revision from which this NixOS configuration was built.";
    };

@ -84,6 +84,12 @@ in
      description = "Default NixOS channel to which the root user is subscribed.";
    };

+    configurationRevision = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "The Git revision of the top-level flake from which this configuration was built.";
+    };
+
  };

  config = {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -253,7 +253,7 @@
  ./services/computing/slurm/slurm.nix
  ./services/continuous-integration/buildbot/master.nix
  ./services/continuous-integration/buildbot/worker.nix
-  ./services/continuous-integration/buildkite-agent.nix
+  ./services/continuous-integration/buildkite-agents.nix
  ./services/continuous-integration/hail.nix
  ./services/continuous-integration/hydra/default.nix
  ./services/continuous-integration/gitlab-runner.nix
--- a/nixos/modules/services/continuous-integration/buildkite-agents.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agents.nix
@ -3,7 +3,7 @@
 with lib;

 let
-  cfg = config.services.buildkite-agent;
+  cfg = config.services.buildkite-agents;

  mkHookOption = { name, description, example ? null }: {
    inherit name;
@ -15,7 +15,7 @@ let
  };
  mkHookOptions = hooks: listToAttrs (map mkHookOption hooks);

-  hooksDir = let
+  hooksDir = cfg: let
    mkHookEntry = name: value: ''
      cat > $out/${name} <<'EOF'
      #! ${pkgs.runtimeShell}
@ -29,12 +29,13 @@ let
    ${concatStringsSep "\n" (mapAttrsToList mkHookEntry (filterAttrs (n: v: v != null) cfg.hooks))}
  '';

-in
-
-{
-  options = {
-    services.buildkite-agent = {
-      enable = mkEnableOption "buildkite-agent";
+  buildkiteOptions = { name ? "", config, ... }: {
+    options = {
+      enable = mkOption {
+        default = true;
+        type = types.bool;
+        description = "Whether to enable this buildkite agent";
+      };

      package = mkOption {
        default = pkgs.buildkite-agent;
@ -44,7 +45,7 @@ in
      };

      dataDir = mkOption {
-        default = "/var/lib/buildkite-agent";
+        default = "/var/lib/buildkite-agent-${name}";
        description = "The workdir for the agent";
        type = types.str;
      };
@ -68,9 +69,9 @@ in

      name = mkOption {
        type = types.str;
-        default = "%hostname-%n";
+        default = "%hostname-${name}-%n";
        description = ''
-          The name of the agent.
+          The name of the agent as seen in the buildkite dashboard.
        '';
      };

@ -166,11 +167,11 @@ in

      hooksPath = mkOption {
        type = types.path;
-        default = hooksDir;
-        defaultText = "generated from services.buildkite-agent.hooks";
+        default = hooksDir config;
+        defaultText = "generated from services.buildkite-agents.<name>.hooks";
        description = ''
          Path to the directory storing the hooks.
-          Consider using <option>services.buildkite-agent.hooks.&lt;name&gt;</option>
+          Consider using <option>services.buildkite-agents.&lt;name&gt;.hooks.&lt;name&gt;</option>
          instead.
        '';
      };
@ -184,24 +185,38 @@ in
      };
    };
  };
+  enabledAgents = lib.filterAttrs (n: v: v.enable) cfg;
+  mapAgents = function: lib.mkMerge (lib.mapAttrsToList function enabledAgents);
+in
+{
+  options.services.buildkite-agents = mkOption {
+    type = types.attrsOf (types.submodule buildkiteOptions);
+    default = {};
+    description = ''
+      Attribute set of buildkite agents.
+      The attribute key is combined with the hostname and a unique integer to
+      create the final agent name. This can be overridden by setting the `name`
+      attribute.
+    '';
+  };

-  config = mkIf config.services.buildkite-agent.enable {
-    users.users.buildkite-agent = {
-      name = "buildkite-agent";
+  config.users.users = mapAgents (name: cfg: {
+    "buildkite-agent-${name}" = {
+      name = "buildkite-agent-${name}";
      home = cfg.dataDir;
      createHome = true;
      description = "Buildkite agent user";
      extraGroups = [ "keys" ];
      isSystemUser = true;
    };
+  });

-    environment.systemPackages = [ cfg.package ];
-
-    systemd.services.buildkite-agent =
+  config.systemd.services = mapAgents (name: cfg: {
+    "buildkite-agent-${name}" =
      { description = "Buildkite Agent";
        wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
-        path = cfg.runtimePackages ++ [ pkgs.coreutils ];
+        path = cfg.runtimePackages ++ [ cfg.package pkgs.coreutils ];
        environment = config.networking.proxy.envVars // {
          HOME = cfg.dataDir;
          NIX_REMOTE = "daemon";
@ -230,8 +245,8 @@ in
          '';

        serviceConfig =
-          { ExecStart = "${cfg.package}/bin/buildkite-agent start --config /var/lib/buildkite-agent/buildkite-agent.cfg";
-            User = "buildkite-agent";
+          { ExecStart = "${cfg.package}/bin/buildkite-agent start --config ${cfg.dataDir}/buildkite-agent.cfg";
+            User = "buildkite-agent-${name}";
            RestartSec = 5;
            Restart = "on-failure";
            TimeoutSec = 10;
@ -240,22 +255,18 @@ in
            KillMode = "mixed";
          };
      };
+  });

-    assertions = [
+  config.assertions = mapAgents (name: cfg: [
      { assertion = cfg.hooksPath == hooksDir || all (v: v == null) (attrValues cfg.hooks);
        message = ''
-          Options `services.buildkite-agent.hooksPath' and
-          `services.buildkite-agent.hooks.<name>' are mutually exclusive.
+          Options `services.buildkite-agents.${name}.hooksPath' and
+          `services.buildkite-agents.${name}.hooks.<name>' are mutually exclusive.
        '';
      }
-    ];
-  };
+  ]);
+
  imports = [
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "token" ]                    [ "services" "buildkite-agent" "tokenPath" ])
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "privateKey" ]     [ "services" "buildkite-agent" "privateSshKeyPath" ])
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "privateKeyPath" ] [ "services" "buildkite-agent" "privateSshKeyPath" ])
-    (mkRemovedOptionModule [ "services" "buildkite-agent" "openssh" "publicKey" ]      "SSH public keys aren't necessary to clone private repos.")
-    (mkRemovedOptionModule [ "services" "buildkite-agent" "openssh" "publicKeyPath" ]  "SSH public keys aren't necessary to clone private repos.")
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "meta-data"]                 [ "services" "buildkite-agent" "tags" ])
+    (mkRemovedOptionModule [ "services" "buildkite-agent"] "services.buildkite-agent has been upgraded from version 2 to version 3 and moved to an attribute set at services.buildkite-agents. Please consult the 20.03 release notes for more information.")
  ];
 }
--- a/nixos/modules/services/monitoring/heapster.nix
+++ b/nixos/modules/services/monitoring/heapster.nix
@ -49,7 +49,7 @@ in {
      };
    };

-    users.users.heapsterrs = {
+    users.users.heapster = {
      uid = config.ids.uids.heapster;
      description = "Heapster user";
    };
--- a/nixos/modules/services/monitoring/statsd.nix
+++ b/nixos/modules/services/monitoring/statsd.nix
@ -125,7 +125,7 @@ in
      message = "Only builtin backends (graphite, console, repeater) or backends enumerated in `pkgs.nodePackages` are allowed!";
    }) cfg.backends;

-    users.use.statsdrs = {
+    users.users.statsd = {
      uid = config.ids.uids.statsd;
      description = "Statsd daemon user";
    };
--- a/nixos/modules/services/networking/supybot.nix
+++ b/nixos/modules/services/networking/supybot.nix
@ -45,7 +45,7 @@ in

    environment.systemPackages = [ pkgs.pythonPackages.limnoria ];

-    users.users.supybotrs = {
+    users.users.supybot = {
      uid = config.ids.uids.supybot;
      group = "supybot";
      description = "Supybot IRC bot user";
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -8,6 +8,125 @@ let
  cfg = xcfg.desktopManager.plasma5;

  inherit (pkgs) kdeApplications plasma5 libsForQt5 qt5;
+  inherit (pkgs) writeText;
+
+  pulseaudio = config.hardware.pulseaudio;
+  pactl = "${getBin pulseaudio.package}/bin/pactl";
+  startplasma-x11 = "${getBin plasma5.plasma-workspace}/bin/startplasma-x11";
+  sed = "${getBin pkgs.gnused}/bin/sed";
+
+  gtkrc2 = writeText "gtkrc-2.0" ''
+    # Default GTK+ 2 config for NixOS Plasma 5
+    include "/run/current-system/sw/share/themes/Breeze/gtk-2.0/gtkrc"
+    style "user-font"
+    {
+      font_name="Sans Serif Regular"
+    }
+    widget_class "*" style "user-font"
+    gtk-font-name="Sans Serif Regular 10"
+    gtk-theme-name="Breeze"
+    gtk-icon-theme-name="breeze"
+    gtk-fallback-icon-theme="hicolor"
+    gtk-cursor-theme-name="breeze_cursors"
+    gtk-toolbar-style=GTK_TOOLBAR_ICONS
+    gtk-menu-images=1
+    gtk-button-images=1
+  '';
+
+  gtk3_settings = writeText "settings.ini" ''
+    [Settings]
+    gtk-font-name=Sans Serif Regular 10
+    gtk-theme-name=Breeze
+    gtk-icon-theme-name=breeze
+    gtk-fallback-icon-theme=hicolor
+    gtk-cursor-theme-name=breeze_cursors
+    gtk-toolbar-style=GTK_TOOLBAR_ICONS
+    gtk-menu-images=1
+    gtk-button-images=1
+  '';
+
+  kcminputrc = writeText "kcminputrc" ''
+    [Mouse]
+    cursorTheme=breeze_cursors
+    cursorSize=0
+  '';
+
+  activationScript = ''
+    # The KDE icon cache is supposed to update itself automatically, but it uses
+    # the timestamp on the icon theme directory as a trigger. This doesn't work
+    # on NixOS because the timestamp never changes. As a workaround, delete the
+    # icon cache at login and session activation.
+    # See also: http://lists-archives.org/kde-devel/26175-what-when-will-icon-cache-refresh.html
+    rm -fv $HOME/.cache/icon-cache.kcache
+
+    # xdg-desktop-settings generates this empty file but
+    # it makes kbuildsyscoca5 fail silently. To fix this
+    # remove that menu if it exists.
+    rm -fv ''${XDG_CONFIG_HOME:?}/menus/applications-merged/xdg-desktop-menu-dummy.menu
+
+    # Qt writes a weird ‘libraryPath’ line to
+    # ~/.config/Trolltech.conf that causes the KDE plugin
+    # paths of previous KDE invocations to be searched.
+    # Obviously using mismatching KDE libraries is potentially
+    # disastrous, so here we nuke references to the Nix store
+    # in Trolltech.conf.  A better solution would be to stop
+    # Qt from doing this wackiness in the first place.
+    trolltech_conf="''${XDG_CONFIG_HOME:?}/Trolltech.conf"
+    if [ -e "$trolltech_conf" ]; then
+        ${sed} -i "$trolltech_conf" -e '/nix\\store\|nix\/store/ d'
+    fi
+
+    # Remove the kbuildsyscoca5 cache. It will be regenerated
+    # immediately after. This is necessary for kbuildsyscoca5 to
+    # recognize that software that has been removed.
+    rm -fv $HOME/.cache/ksycoca*
+
+    ${pkgs.libsForQt5.kservice}/bin/kbuildsycoca5
+  '';
+
+  startplasma =
+    ''
+      export XDG_CONFIG_HOME="''${XDG_CONFIG_HOME:-$HOME/.config}"
+      mkdir -p "''${XDG_CONFIG_HOME:?}"
+
+    ''
+    + optionalString pulseaudio.enable ''
+      # Load PulseAudio module for routing support.
+      # See also: http://colin.guthr.ie/2009/10/so-how-does-the-kde-pulseaudio-support-work-anyway/
+        ${pactl} load-module module-device-manager "do_routing=1"
+
+    ''
+    + ''
+      ${activationScript}
+
+      # Create default configurations if Plasma has never been started.
+      kdeglobals="''${XDG_CONFIG_HOME:?}/kdeglobals"
+      if ! [ -f "$kdeglobals" ]
+      then
+          kcminputrc="''${XDG_CONFIG_HOME:?}/kcminputrc"
+          if ! [ -f "$kcminputrc" ]
+          then
+              cat ${kcminputrc} >"$kcminputrc"
+          fi
+
+          gtkrc2="$HOME/.gtkrc-2.0"
+          if ! [ -f "$gtkrc2" ]
+          then
+              cat ${gtkrc2} >"$gtkrc2"
+          fi
+
+          gtk3_settings="''${XDG_CONFIG_HOME:?}/gtk-3.0/settings.ini"
+          if ! [ -f "$gtk3_settings" ]
+          then
+              mkdir -p "$(dirname "$gtk3_settings")"
+              cat ${gtk3_settings} >"$gtk3_settings"
+          fi
+      fi
+
+    ''
+    + ''
+      exec "${startplasma-x11}"
+    '';

 in

@ -41,27 +160,7 @@ in
      services.xserver.desktopManager.session = singleton {
        name = "plasma5";
        bgSupport = true;
-        start = ''
-          # Load PulseAudio module for routing support.
-          # See http://colin.guthr.ie/2009/10/so-how-does-the-kde-pulseaudio-support-work-anyway/
-          ${optionalString config.hardware.pulseaudio.enable ''
-            ${getBin config.hardware.pulseaudio.package}/bin/pactl load-module module-device-manager "do_routing=1"
-          ''}
-
-          if [ -f "$HOME/.config/kdeglobals" ]
-          then
-              # Remove extraneous font style names.
-              # See also: https://phabricator.kde.org/D9070
-              ${getBin pkgs.gnused}/bin/sed -i "$HOME/.config/kdeglobals" \
-                  -e '/^fixed=/ s/,Regular$//' \
-                  -e '/^font=/ s/,Regular$//' \
-                  -e '/^menuFont=/ s/,Regular$//' \
-                  -e '/^smallestReadableFont=/ s/,Regular$//' \
-                  -e '/^toolBarFont=/ s/,Regular$//'
-          fi
-
-          exec "${getBin plasma5.plasma-workspace}/bin/startplasma-x11"
-        '';
+        start = startplasma;
      };

      security.wrappers = {
@ -227,29 +326,7 @@ in
      xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-kde ];

      # Update the start menu for each user that is currently logged in
-      system.userActivationScripts.plasmaSetup = ''
-        # The KDE icon cache is supposed to update itself
-        # automatically, but it uses the timestamp on the icon
-        # theme directory as a trigger.  Since in Nix the
-        # timestamp is always the same, this doesn't work.  So as
-        # a workaround, nuke the icon cache on login.  This isn't
-        # perfect, since it may require logging out after
-        # installing new applications to update the cache.
-        # See http://lists-archives.org/kde-devel/26175-what-when-will-icon-cache-refresh.html
-        rm -fv $HOME/.cache/icon-cache.kcache
-
-        # xdg-desktop-settings generates this empty file but
-        # it makes kbuildsyscoca5 fail silently. To fix this
-        # remove that menu if it exists.
-        rm -fv $HOME/.config/menus/applications-merged/xdg-desktop-menu-dummy.menu
-
-        # Remove the kbuildsyscoca5 cache. It will be regenerated
-        # immediately after. This is necessary for kbuildsyscoca5 to
-        # recognize that software that has been removed.
-        rm -fv $HOME/.cache/ksycoca*
-
-        ${pkgs.libsForQt5.kservice}/bin/kbuildsycoca5
-      '';
+      system.userActivationScripts.plasmaSetup = activationScript;
    })
  ];

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -32,7 +32,7 @@ in
  bees = handleTest ./bees.nix {};
  bind = handleTest ./bind.nix {};
  bittorrent = handleTest ./bittorrent.nix {};
-  buildkite-agent = handleTest ./buildkite-agent.nix {};
+  buildkite-agents = handleTest ./buildkite-agents.nix {};
  boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
  boot-stage1 = handleTest ./boot-stage1.nix {};
  borgbackup = handleTest ./borgbackup.nix {};
--- a/nixos/tests/buildkite-agents.nix
+++ b/nixos/tests/buildkite-agents.nix
@ -6,18 +6,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
    maintainers = [ flokli ];
  };

-  nodes = {
-    node1 = { pkgs, ... }: {
-      services.buildkite-agent = {
-        enable = true;
+  machine = { pkgs, ... }: {
+    services.buildkite-agents = {
+      one = {
        privateSshKeyPath = (import ./ssh-keys.nix pkgs).snakeOilPrivateKey;
        tokenPath = (pkgs.writeText "my-token" "5678");
      };
-    };
-    # don't configure ssh key, run as a separate user
-    node2 = { pkgs, ...}: {
-      services.buildkite-agent = {
-        enable = true;
+      two = {
        tokenPath = (pkgs.writeText "my-token" "1234");
      };
    };
@ -28,9 +23,9 @@ import ./make-test-python.nix ({ pkgs, ... }:
    # we can't wait on the unit to start up, as we obviously can't connect to buildkite,
    # but we can look whether files are set up correctly

-    node1.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
-    node1.wait_for_file("/var/lib/buildkite-agent/.ssh/id_rsa")
+    machine.wait_for_file("/var/lib/buildkite-agent-one/buildkite-agent.cfg")
+    machine.wait_for_file("/var/lib/buildkite-agent-one/.ssh/id_rsa")

-    node2.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
+    machine.wait_for_file("/var/lib/buildkite-agent-two/buildkite-agent.cfg")
  '';
 })
--- a/nixos/tests/installed-tests/default.nix
+++ b/nixos/tests/installed-tests/default.nix
@ -90,7 +90,9 @@ in
  graphene = callInstalledTest ./graphene.nix {};
  ibus = callInstalledTest ./ibus.nix {};
  libgdata = callInstalledTest ./libgdata.nix {};
+  glib-testing = callInstalledTest ./glib-testing.nix {};
  libxmlb = callInstalledTest ./libxmlb.nix {};
+  malcontent = callInstalledTest ./malcontent.nix {};
  ostree = callInstalledTest ./ostree.nix {};
  xdg-desktop-portal = callInstalledTest ./xdg-desktop-portal.nix {};
 }
--- a/nixos/tests/installed-tests/glib-testing.nix
+++ b/nixos/tests/installed-tests/glib-testing.nix
@ -0,0 +1,5 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.glib-testing;
+}
--- a/nixos/tests/installed-tests/malcontent.nix
+++ b/nixos/tests/installed-tests/malcontent.nix
@ -0,0 +1,5 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.malcontent;
+}
--- a/nixos/tests/installed-tests/xdg-desktop-portal.nix
+++ b/nixos/tests/installed-tests/xdg-desktop-portal.nix
@ -2,4 +2,8 @@

 makeInstalledTest {
  tested = pkgs.xdg-desktop-portal;
+
+  # Ton of breakage.
+  # https://github.com/flatpak/xdg-desktop-portal/pull/428
+  meta.broken = true;
 }
--- a/pkgs/applications/audio/elisa/default.nix
+++ b/pkgs/applications/audio/elisa/default.nix
@ -7,13 +7,13 @@

 mkDerivation rec {
  pname = "elisa";
-  version = "19.12.0";
+  version = "19.12.2";

  src = fetchFromGitHub {
    owner  = "KDE";
    repo   = "elisa";
    rev    = "v${version}";
-    sha256 = "1939xwhy1s502pai63vz56hnnsl3qsb6arhrlg5bw6bwsv88blac";
+    sha256 = "0g6zj4ix97aa529w43v1z3n73b8l5di6gscs40hyx4sl1sb7fdh6";
  };

  buildInputs = [ vlc ];
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@ -3,25 +3,30 @@
 , fetchFromGitHub
 , makeWrapper
 , pkgconfig
+, cmake
 , llvm
 , emscripten
 , openssl
 , libsndfile
 , libmicrohttpd
+, gnutls
+, libtasn1
+, p11-kit
 , vim
+, which
 }:

 with stdenv.lib.strings;

 let

-  version = "2.5.23";
+  version = "2.20.2";

  src = fetchFromGitHub {
    owner = "grame-cncm";
    repo = "faust";
    rev = version;
-    sha256 = "1pci8ac6sqrm3mb3yikmmr3iy35g3nj4iihazif1amqkbdz719rc";
+    sha256 = "08hv8gyj6c83128z3si92r1ka5ckf9sdpn5jdnlhrqyzja4mrxsy";
    fetchSubmodules = true;
  };

@ -40,8 +45,8 @@ let

    inherit src;

-    nativeBuildInputs = [ makeWrapper pkgconfig vim ];
-    buildInputs = [ llvm emscripten openssl libsndfile libmicrohttpd ];
+    nativeBuildInputs = [ makeWrapper pkgconfig cmake vim which ];
+    buildInputs = [ llvm emscripten openssl libsndfile libmicrohttpd gnutls libtasn1 p11-kit ];


    passthru = {
@ -50,39 +55,13 @@ let


    preConfigure = ''
-      makeFlags="$makeFlags prefix=$out LLVM_CONFIG='${llvm}/bin/llvm-config' world"
-
-      # The faust makefiles use 'system ?= $(shell uname -s)' but nix
-      # defines 'system' env var, so undefine that so faust detects the
-      # correct system.
-      unset system
-      # sed -e "232s/LLVM_STATIC_LIBS/LLVMLIBS/" -i compiler/Makefile.unix
-
-      # The makefile sets LLVM_<version> depending on the current llvm
-      # version, but the detection code is quite brittle.
-      #
-      # Failing to properly detect the llvm version means that the macro
-      # LLVM_VERSION ends up being the raw output of `llvm-config --version`, while
-      # the code assumes that it's set to a symbol like `LLVM_35`.  Two problems result:
-      # * <command-line>:0:1: error: macro names must be identifiers.; and
-      # * a bunch of undefined reference errors due to conditional definitions relying on
-      #   LLVM_XY being defined.
-      #
-      # For now, fix this by 1) pinning the llvm version; 2) manually setting LLVM_VERSION
-      # to something the makefile will recognize.
-      sed '52iLLVM_VERSION=${stdenv.lib.getVersion llvm}' -i compiler/Makefile.unix
+      cd build
    '';

-    postPatch = ''
-      # fix build with llvm 5.0.2 by adding it to the list of known versions
-      # TODO: check if still needed on next update
-      substituteInPlace compiler/Makefile.unix \
-        --replace "5.0.0 5.0.1" "5.0.0 5.0.1 5.0.2"
+    cmakeFlags = ''
+      -C ../backends/all.cmake -C  ../targets/all.cmake ..
    '';

-    # Remove most faust2appl scripts since they won't run properly
-    # without additional paths setup. See faust.wrap,
-    # faust.wrapWithBuildEnv.
    postInstall = ''
      # syntax error when eval'd directly
      pattern="faust2!(*@(atomsnippets|graph|graphviewer|md|plot|sig|sigviewer|svg))"
@ -90,10 +69,6 @@ let
    '';

    postFixup = ''
-      # Set faustpath explicitly.
-      substituteInPlace "$out"/bin/faustpath \
-        --replace "/usr/local /usr /opt /opt/local" "$out"
-
      # The 'faustoptflags' is 'source'd into other faust scripts and
      # not used as an executable, so patch 'uname' usage directly
      # rather than use makeWrapper.
@ -160,8 +135,6 @@ let
        # 'faustoptflags' to absolute paths.
        for script in "$out"/bin/*; do
          substituteInPlace "$script" \
-            --replace ". faustpath" ". '${faust}/bin/faustpath'" \
-            --replace ". faustoptflags" ". '${faust}/bin/faustoptflags'" \
            --replace " error " "echo"
        done
      '';
@ -200,19 +173,22 @@ let

      propagatedBuildInputs = [ faust ] ++ propagatedBuildInputs;

+      libPath = stdenv.lib.makeLibraryPath propagatedBuildInputs;

      postFixup = ''

        # export parts of the build environment
        for script in "$out"/bin/*; do
          wrapProgram "$script" \
+            --set FAUSTLDDIR "${faust}/lib" \
            --set FAUSTLIB "${faust}/share/faust" \
-            --set FAUST_LIB_PATH "${faust}/share/faust" \
            --set FAUSTINC "${faust}/include/faust" \
+            --set FAUSTARCH "${faust}/share/faust" \
            --prefix PATH : "$PATH" \
            --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
            --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
-            --set NIX_LDFLAGS "$NIX_LDFLAGS"
+            --set NIX_LDFLAGS "$NIX_LDFLAGS -lpthread" \
+            --prefix LIBRARY_PATH $libPath
        done
      '';
    });
--- a/pkgs/applications/audio/faust/faust2jack.nix
+++ b/pkgs/applications/audio/faust/faust2jack.nix
@ -1,6 +1,7 @@
 { faust
 , gtk2
 , jack2Full
+, alsaLib
 , opencv
 , libsndfile
 }:
@ -18,6 +19,7 @@ faust.wrapWithBuildEnv {
  propagatedBuildInputs = [
    gtk2
    jack2Full
+    alsaLib
    opencv
    libsndfile
  ];
--- a/pkgs/applications/audio/faust/faust2jackrust.nix
+++ b/pkgs/applications/audio/faust/faust2jackrust.nix
@ -0,0 +1,18 @@
+{ stdenv
+, faust
+, libjack2
+, cargo
+, binutils
+, gcc
+, gnumake
+, openssl
+, pkgconfig
+
+}:
+
+faust.wrapWithBuildEnv {
+
+  baseName = "faust2jackrust";
+
+  propagatedBuildInputs = [ libjack2 cargo binutils gcc gnumake openssl pkgconfig ];
+}
--- a/pkgs/applications/audio/google-play-music-desktop-player/default.nix
+++ b/pkgs/applications/audio/google-play-music-desktop-player/default.nix
@ -1,14 +1,15 @@
-{ stdenv, alsaLib, atk, cairo, cups, dbus, dpkg, expat, fontconfig, freetype
+{ stdenv, alsaLib, atk, at-spi2-atk, cairo, cups, dbus, dpkg, expat, fontconfig, freetype
 , fetchurl, GConf, gdk-pixbuf, glib, gtk2, gtk3, libpulseaudio, makeWrapper, nspr
 , nss, pango, udev, xorg
 }:

 let
-  version = "4.6.1";
+  version = "4.7.1";

  deps = [
    alsaLib
    atk
+    at-spi2-atk
    cairo
    cups
    dbus
@ -48,7 +49,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://github.com/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/releases/download/v${version}/google-play-music-desktop-player_${version}_amd64.deb";
-    sha256 = "0dyn2fxhcri9d9nmcprszs6yg79gsr09bjfzzb1p10yjmi77cj2g";
+    sha256 = "1ljm9c5sv6wa7pa483yq03wq9j1h1jdh8363z5m2imz407yzgm5r";
  };

  dontBuild = true;
--- a/pkgs/applications/audio/r128gain/default.nix
+++ b/pkgs/applications/audio/r128gain/default.nix
@ -0,0 +1,25 @@
+{ lib, python3Packages, ffmpeg }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "r128gain";
+  version = "0.9.3";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "0dx2grryp0lj58bawx1zcq9a6b4ijz9r5qrg8h6nvm92kqlya26i";
+  };
+
+  propagatedBuildInputs = [ ffmpeg ]
+    ++ (with python3Packages; [ crcmod mutagen tqdm ])
+    ;
+
+  doCheck = false; # downloads media files for testing
+
+  meta = with lib; {
+    description = "Fast audio loudness scanner & tagger (ReplayGain v2 / R128)";
+    homepage = "https://github.com/desbma/r128gain";
+    license = licenses.lgpl2Plus;
+    maintainers = [ maintainers.AluisioASG ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/redoflacs/default.nix
+++ b/pkgs/applications/audio/redoflacs/default.nix
@ -1,39 +1,49 @@
-{ stdenv, fetchFromGitHub, makeWrapper
-, flac, sox }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, makeWrapper
+, installShellFiles
+, flac
+, sox
+, withAucdtect ? false
+, aucdtect ? null
+}:

 stdenv.mkDerivation rec {
  pname = "redoflacs";
-  version = "0.30.20150202";
+  version = "0.30.20190903";

  src = fetchFromGitHub {
-    owner  = "sirjaren";
-    repo   = "redoflacs";
-    rev    = "86c6f5becca0909dcb2a0cb9ed747a575d7a4735";
-    sha256 = "1gzlmh4vnf2fl0x8ig2n1f76082ngldsv85i27dv15y2m1kffw2j";
+    owner = "sirjaren";
+    repo = "redoflacs";
+    rev = "4ca544cbc075d0865884906208cb2b8bc318cf9e";
+    sha256 = "19lcl09d4ngz2zzwd8dnnxx41ddvznhar6ggrlf1xvkr5gd7lafp";
  };

  dontBuild = true;

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ];

  installPhase = ''
    runHook preInstall

    install -Dm755 -t $out/bin redoflacs
    install -Dm644 -t $out/share/doc/redoflacs LICENSE *.md
+    installManPage redoflacs.1

    runHook postInstall
  '';

  postFixup = ''
    wrapProgram $out/bin/redoflacs \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ flac sox ]}
+      --prefix PATH : ${stdenv.lib.makeBinPath ([ flac sox ] ++ lib.optional withAucdtect aucdtect)}
  '';

-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Parallel BASH commandline FLAC compressor, verifier, organizer, analyzer, and retagger";
-    homepage    = src.meta.homepage;
-    license     = licenses.gpl2;
-    platforms   = platforms.all;
+    homepage = src.meta.homepage;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.all;
  };
 }
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@ -4,11 +4,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "snd-19.9";
+  name = "snd-20.0";

  src = fetchurl {
    url = "mirror://sourceforge/snd/${name}.tar.gz";
-    sha256 = "13s8fahpsjygjdrcwmprcrz23ny3klaj2rh2xzdv3bfs69gxvhys";
+    sha256 = "195j0mkxvkb0znwhc0pjp4r0r8j4i12i27nxbkq27wg9rck6likc";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@ -1,29 +1,30 @@
 { stdenv, lib, fetchurl, unzip, glib, systemd, nss, nspr, gtk3-x11, gnome2,
 atk, cairo, gdk-pixbuf, xorg, xorg_sys_opengl, utillinux, alsaLib, dbus, at-spi2-atk,
-cups, vivaldi-ffmpeg-codecs, libpulseaudio }:
+cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core }:

 stdenv.mkDerivation rec {
  pname = "exodus";
-  version = "19.5.24";
+  version = "20.1.30";

  src = fetchurl {
-    url = "https://exodusbin.azureedge.net/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "1yx296i525qmpqh8f2vax7igffg826nr8cyq1l0if35374bdsqdw";
+    url = "https://downloads.exodus.io/releases/${pname}-linux-x64-${version}.zip";
+    sha256 = "0jns5zqjm0gqn18ypghbgk6gb713mh7p44ax1r8y4vcwijlp5nql";
  };

  sourceRoot = ".";
  unpackCmd = ''
-			${unzip}/bin/unzip "$src" -x "Exodus*/lib*so"
+      ${unzip}/bin/unzip "$src" -x "Exodus*/lib*so"
  '';

  installPhase = ''
-		mkdir -p $out/bin $out/share/applications
-		cd Exodus-linux-x64
-		cp -r . $out
-		ln -s $out/Exodus $out/bin/Exodus
-		ln -s $out/exodus.desktop $out/share/applications
-		substituteInPlace $out/share/applications/exodus.desktop \
-				  --replace 'Exec=bash -c "cd `dirname %k` && ./Exodus"' "Exec=Exodus"
+    mkdir -p $out/bin $out/share/applications
+    cd Exodus-linux-x64
+    cp -r . $out
+    ln -s $out/Exodus $out/bin/Exodus
+    ln -s $out/bin/Exodus $out/bin/exodus
+    ln -s $out/exodus.desktop $out/share/applications
+    substituteInPlace $out/share/applications/exodus.desktop \
+          --replace 'Exec=bash -c "cd `dirname %k` && ./Exodus"' "Exec=Exodus"
  '';

  dontPatchELF = true;
@ -31,35 +32,36 @@ stdenv.mkDerivation rec {

  preFixup = let
    libPath = lib.makeLibraryPath [
-			glib
-			nss
-			nspr
-			gtk3-x11
-			gnome2.pango
-			atk
-			cairo
-			gdk-pixbuf
-			xorg.libX11
-			xorg.libxcb
-			xorg.libXcomposite
-			xorg.libXcursor
-			xorg.libXdamage
-			xorg.libXext
-			xorg.libXfixes
-			xorg.libXi
-			xorg.libXrender
-			xorg.libXtst
-			xorg_sys_opengl
-			utillinux
-			xorg.libXrandr
-			xorg.libXScrnSaver
-			alsaLib
-			dbus.lib
-			at-spi2-atk
-			cups.lib
-			libpulseaudio
-			systemd
-			vivaldi-ffmpeg-codecs
+      glib
+      nss
+      nspr
+      gtk3-x11
+      gnome2.pango
+      atk
+      cairo
+      gdk-pixbuf
+      xorg.libX11
+      xorg.libxcb
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrender
+      xorg.libXtst
+      xorg_sys_opengl
+      utillinux
+      xorg.libXrandr
+      xorg.libXScrnSaver
+      alsaLib
+      dbus.lib
+      at-spi2-atk
+      at-spi2-core
+      cups.lib
+      libpulseaudio
+      systemd
+      vivaldi-ffmpeg-codecs
    ];
  in ''
    patchelf \
--- a/pkgs/applications/editors/manuskript/default.nix
+++ b/pkgs/applications/editors/manuskript/default.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "manuskript";
-  version = "0.10.0";
+  version = "0.11.0";

  format = "other";

@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
    repo = pname;
    owner = "olivierkes";
    rev = version;
-    sha256 = "0q413vym7hzjpyg3krj5y63hwpncdifjkyswqmr76zg5yqnklnh3";
+    sha256 = "1l6l9k6k69yv8xqpll0zv9cwdqqg4zvxy90l6sx5nv2yywh5crla";
  };

  nativeBuildInputs = [ wrapQtAppsHook ];
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -11,8 +11,8 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0n4wcg072a0b76jjv08cig2kygkmakvwav5vvl0h6ww9sbdcwl1x";
-    x86_64-darwin = "0xvyh9qypsyzw02vpmnfa0hdszj8ylvf78yjbmg86m4xml0sbj9r";
+    x86_64-linux = "0f6ic24w6s9wfirzk5rvysn96gj1naj6b81al9743mllaf32ad5q";
+    x86_64-darwin = "0fgyhb2wxkvrc90zzw5w2k3ggwbinmax286gbff3sjlrzbs5sj64";
  }.${system};

  sourceRoot = {
@ -25,7 +25,7 @@ in
    # The update script doesn't correctly change the hash for darwin, so please:
    # nixpkgs-update: no auto update

-    version = "1.41.1";
+    version = "1.42.0";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@ -4,7 +4,7 @@

 stdenv.mkDerivation {
  pname = "saga";
-  version = "7.3.0";
+  version = "7.5.0";

  # See https://groups.google.com/forum/#!topic/nix-devel/h_vSzEJAPXs
  # for why the have additional buildInputs on darwin
@ -18,8 +18,8 @@ stdenv.mkDerivation {
  CXXFLAGS = stdenv.lib.optionalString stdenv.cc.isClang "-std=c++11 -Wno-narrowing";

  src = fetchurl {
-    url = "https://sourceforge.net/projects/saga-gis/files/SAGA%20-%207/SAGA%20-%207.3.0/saga-7.3.0.tar.gz";
-    sha256 = "1g7v6vx7b8mfhbbg03pdk4kyks20maqbcdbasnxazhs8pl2zih7k";
+    url = "https://sourceforge.net/projects/saga-gis/files/SAGA%20-%207/SAGA%20-%207.5.0/saga-7.5.0.tar.gz";
+    sha256 = "0s5195802xwlkb2w4i4vd9ys95d7fnzn5cnnixh1csaqc2x1qp6r";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/graphics/c3d/default.nix
+++ b/pkgs/applications/graphics/c3d/default.nix
@ -1,17 +1,17 @@
-{ stdenv, fetchgit, cmake, itk, Cocoa }:
+{ stdenv, fetchgit, cmake, itk4, Cocoa }:

 stdenv.mkDerivation {
  pname   = "c3d";
-  version = "2018-10-04";
+  version = "unstable-2019-10-22";

  src = fetchgit {
-    url = "https://git.code.sf.net/p/c3d/git";
-    rev = "351929a582b2ef68fb9902df0b11d38f44a0ccd0";
-    sha256 = "0mpv4yl6hdnxgvnwrmd182h64n3ppp30ldzm0jz6jglk0nvpzq9w";
+    url    = "https://github.com/pyushkevich/c3d";
+    rev    = "c04e2b84568654665c64d8843378c8bbd58ba9b0";
+    sha256 = "0lzldxvshl9q362mg76byc7s5zc9qx7mxf2wgyij5vysx8mihx3q";
  };

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ itk ]
+  buildInputs = [ itk4 ]
    ++ stdenv.lib.optional stdenv.isDarwin Cocoa;

  meta = with stdenv.lib; {
@ -20,6 +20,5 @@ stdenv.mkDerivation {
    maintainers = with maintainers; [ bcdarwin ];
    platforms = platforms.unix;
    license = licenses.gpl2;
-    broken = true;
  };
 }
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@ -60,11 +60,11 @@ let

 in mkDerivation rec {
  pname = "drawpile";
-  version = "2.1.15";
+  version = "2.1.16";

  src = fetchurl {
    url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "0w6bdg1rnnjzjg8xzqv3a9qhw41q41sjvp6f8m0sqxjfax05lqin";
+    sha256 = "1mz64c1a5x906j2jqq7i16l1q1d97wgm2y0ybmmcyqzg09x9wyaw";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/sane/config.nix
+++ b/pkgs/applications/graphics/sane/config.nix
@ -6,7 +6,7 @@ with stdenv.lib;
 let installSanePath = path: ''
      if [ -e "${path}/lib/sane" ]; then
        find "${path}/lib/sane" -maxdepth 1 -not -type d | while read backend; do
-          ln -s "$backend" "$out/lib/sane/$(basename "$backend")"
+          symlink "$backend" "$out/lib/sane/$(basename "$backend")"
        done
      fi

@ -16,14 +16,14 @@ let installSanePath = path: ''
          if [ "$name" = "dll.conf" ] || [ "$name" = "saned.conf" ] || [ "$name" = "net.conf" ]; then
            cat "$conf" >> "$out/etc/sane.d/$name"
          else
-            ln -s "$conf" "$out/etc/sane.d/$name"
+            symlink "$conf" "$out/etc/sane.d/$name"
          fi
        done
      fi

      if [ -e "${path}/etc/sane.d/dll.d" ]; then
        find "${path}/etc/sane.d/dll.d" -maxdepth 1 -not -type d | while read conf; do
-          ln -s "$conf" "$out/etc/sane.d/dll.d/$(basename $conf)"
+          symlink "$conf" "$out/etc/sane.d/dll.d/$(basename $conf)"
        done
      fi
    '';
@ -33,6 +33,14 @@ stdenv.mkDerivation {
  phases = "installPhase";

  installPhase = ''
+    function symlink () {
+      local target=$1 linkname=$2
+      if [ -e "$linkname" ]; then
+        echo "warning: conflict for $linkname. Overriding $(readlink $linkname) with $target."
+      fi
+      ln -sfn "$target" "$linkname"
+    }
+
    mkdir -p $out/etc/sane.d $out/etc/sane.d/dll.d $out/lib/sane
  '' + concatMapStrings installSanePath paths;
 }
--- a/pkgs/applications/misc/far2l/default.nix
+++ b/pkgs/applications/misc/far2l/default.nix
@ -1,10 +1,17 @@
 { stdenv, fetchFromGitHub, fetchpatch, makeWrapper, cmake, pkgconfig, wxGTK30, glib, pcre, m4, bash,
  xdg_utils, gvfs, zip, unzip, gzip, bzip2, gnutar, p7zip, xz, imagemagick, darwin }:

-with stdenv.lib;
+let
+  newer-colorer-schemes = fetchFromGitHub {
+    owner = "colorer";
+    repo = "Colorer-schemes";
+    rev = "7c831f5e94a90530ace8b2bb9916210e3a2fcda6"; # 2019-11-28 (far2l has older Colorer-schemes)
+    sha256 = "18vaahdz5i7xdf00c9h9kjjswm4jszywm8zkhva4c4ivr4qqnv2c";
+  };
+in
 stdenv.mkDerivation rec {
-  build = "unstable-2018-07-19.git${builtins.substring 0 7 src.rev}";
-  name = "far2l-2.1.${build}";
+  pname = "far2l";
+  version = "2019-12-14.git${builtins.substring 0 7 src.rev}";

  src = fetchFromGitHub {
    owner = "elfmz";
@ -16,16 +23,16 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake pkgconfig m4 makeWrapper imagemagick ];

  buildInputs = [ wxGTK30 glib pcre ]
-    ++ optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa;
+    ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa;

-  postPatch = optionalString stdenv.isLinux ''
+  postPatch = stdenv.lib.optionalString stdenv.isLinux ''
    substituteInPlace far2l/bootstrap/trash.sh \
      --replace 'gvfs-trash'  '${gvfs}/bin/gvfs-trash'
-  '' + optionalString stdenv.isDarwin ''
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
    substituteInPlace far2l/CMakeLists.txt \
      --replace "-framework System" -lSystem
  '' + ''
-    echo 'echo ${build}' > far2l/bootstrap/scripts/vbuild.sh
+    echo 'echo ${version}' > far2l/bootstrap/scripts/vbuild.sh
    substituteInPlace far2l/bootstrap/open.sh              \
      --replace 'xdg-open'    '${xdg_utils}/bin/xdg-open'
    substituteInPlace far2l/vtcompletor.cpp                \
@ -42,14 +49,9 @@ stdenv.mkDerivation rec {
      --replace '"bzip2 '     '"${bzip2}/bin/bzip2 '       \
      --replace '"tar '       '"${gnutar}/bin/tar '

-    ( cd colorer/configs/base
-      patch -p2 <  ${ fetchpatch {
-                        name   = "nix-language-highlighting.patch";
-                        url    = https://github.com/colorer/Colorer-schemes/commit/64bd06de0a63224b431cd8fc42cd9fa84b8ba7c0.patch;
-                        sha256 = "1mrj1wyxmk7sll9j1jzw6miwi0sfavf654klms24wngnh6hadsch";
-                      }
-                    }
-    )
+    cp ${newer-colorer-schemes}/hrc/hrc/base/nix.hrc     colorer/configs/base/hrc/base/
+    cp ${newer-colorer-schemes}/hrc/hrc/base/cpp.hrc     colorer/configs/base/hrc/base/
+    cp ${newer-colorer-schemes}/hrc/hrc/inet/jscript.hrc colorer/configs/base/hrc/base/
  '';

  installPhase = ''
@ -59,7 +61,8 @@ stdenv.mkDerivation rec {
    ln -s -r --force $out/bin/far2l $out/share/far2l/far2l_askpass
    ln -s -r --force $out/bin/far2l $out/share/far2l/far2l_sudoapp

-    sed "s,/usr/bin/,$out/bin/," ../far2l/DE/far2l.desktop > $out/share/applications/far2l.desktop
+    cp ../far2l/DE/far2l.desktop $out/share/applications/far2l.desktop
+    substituteInPlace $out/share/applications/far2l.desktop --replace \''${CMAKE_INSTALL_PREFIX} "$out"

    cp ../far2l/DE/icons/hicolor/1024x1024/apps/far2l.svg $out/share/icons/hicolor/scalable/apps/
    convert -size 128x128 ../far2l/DE/icons/far2l.svg $out/share/icons/far2l.png
@ -75,7 +78,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = {
+  meta = with stdenv.lib; {
    description = "An orthodox file manager";
    homepage = https://github.com/elfmz/far2l;
    license = licenses.gpl2;
--- a/pkgs/applications/misc/jgmenu/default.nix
+++ b/pkgs/applications/misc/jgmenu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "jgmenu";
-  version = "4.0";
+  version = "4.0.2";

  src = fetchFromGitHub {
    owner = "johanmalm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1s9291y38k4adc2wqj7plfhj431nf36zs262jm6mmb2fs910ncgv";
+    sha256 = "086p91l1igx5mv2i6fwbgx5p72war9aavc7v3m7sd0c0xvb334br";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "kanboard";
-  version = "1.2.12";
+  version = "1.2.13";

  src = fetchFromGitHub {
    owner = "kanboard";
    repo = "kanboard";
    rev = "v${version}";
-    sha256 = "1m1drgbyk1m6mf69xqlz9gqcj650n9m4y2fdj7d2yv20q8r31489";
+    sha256 = "0mm5sx323v1rwykd1dhvk4d3ipgvgvi3wvhrlavbja3lgay3mdwk";
  };

  dontBuild = true;
@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
    description = "Kanban project management software";
    homepage = https://kanboard.net;
    license = licenses.mit;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz lheckemann ];
  };
 }
--- a/pkgs/applications/misc/lsd2dsl/default.nix
+++ b/pkgs/applications/misc/lsd2dsl/default.nix
@ -1,26 +1,29 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake
-, boost, libvorbis, libsndfile, minizip, gtest }:
+{ stdenv, mkDerivation, lib, fetchFromGitHub, cmake
+, boost, libvorbis, libsndfile, minizip, gtest, qtwebkit }:

 mkDerivation rec {
  pname = "lsd2dsl";
-  version = "0.4.1";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "nongeneric";
    repo = pname;
    rev = "v${version}";
-    sha256 = "15xjp5xxvl0qc4zp553n7djrbvdp63sfjw406idgxqinfmkqkqdr";
+    sha256 = "100qd9i0x6r0nkw1ic2p0xjr16jlhinxkn1x7i98s4xmw4wyb8n8";
  };

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ boost libvorbis libsndfile minizip gtest ];
+  buildInputs = [ boost libvorbis libsndfile minizip gtest qtwebkit ];

-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";

  installPhase = ''
-    install -Dm755 lsd2dsl $out/bin/lsd2dsl
-    install -m755 qtgui/lsd2dsl-qtgui $out/bin/lsd2dsl-qtgui
+    install -Dm755 console/lsd2dsl $out/bin/lsd2dsl
+    install -m755 gui/lsd2dsl-qtgui $out/bin/lsd2dsl-qtgui
+  '' + lib.optionalString stdenv.isDarwin ''
+    wrapQtApp $out/bin/lsd2dsl
+    wrapQtApp $out/bin/lsd2dsl-qtgui
  '';

  meta = with lib; {
@ -31,6 +34,6 @@ mkDerivation rec {
    '';
    license = licenses.mit;
    maintainers = with maintainers; [ sikmir ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/misc/rxvt-unicode-plugins/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/default.nix
@ -0,0 +1,22 @@
+{ callPackage }:
+
+{
+  autocomplete-all-the-things = callPackage ./urxvt-autocomplete-all-the-things { };
+
+  bidi = callPackage ./urxvt-bidi { };
+
+  font-size = callPackage ./urxvt-font-size { };
+
+  perl = callPackage ./urxvt-perl { };
+
+  perls = callPackage ./urxvt-perls { };
+
+  resize-font = callPackage ./urxvt-resize-font { };
+
+  tabbedex = callPackage ./urxvt-tabbedex { };
+
+  theme-switch = callPackage ./urxvt-theme-switch { };
+
+  vtwheel = callPackage ./urxvt-vtwheel { };
+
+}
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-autocomplete-all-the-things/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-autocomplete-all-the-things/default.nix
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-bidi/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-bidi/default.nix
@ -16,6 +16,8 @@ perlPackages.buildPerlPackage rec {
    install -Dm555 misc/bidi "$out/lib/urxvt/perl/bidi"
  '';

+  passthru.perlPackages = [ "self" ];
+
  meta = with lib; {
    description = "Text::Bidi Perl package using fribidi, providing a urxvt plugin";
    homepage = "https://github.com/mkamensky/Text-Bidi";
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-font-size/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-font-size/default.nix
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-perl/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-perl/default.nix
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-perls/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-perls/default.nix
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-resize-font/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-resize-font/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "urxvt-resize-font";
+  version = "2019-10-05";
+  dontPatchShebangs = true;
+
+  src = fetchFromGitHub {
+    owner = "simmel";
+    repo = "urxvt-resize-font";
+    rev = "e966a5d77264e9263bfc8a51e160fad24055776b";
+    sha256 = "18ab3bsfdkzzh1n9fpi2al5bksvv2b7fjmvxpx6fzqcy4bc64vkh";
+  };
+
+  installPhase = ''
+    mkdir -p $out/lib/urxvt/perl
+    cp resize-font $out/lib/urxvt/perl
+  '';
+
+  meta = with stdenv.lib; {
+    description = "URxvt Perl extension for resizing the font";
+    homepage = "https://github.com/simmel/urxvt-resize-font";
+    license = licenses.mit;
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-tabbedex/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-tabbedex/default.nix
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-theme-switch/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-theme-switch/default.nix
--- a/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-vtwheel/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode-plugins/urxvt-vtwheel/default.nix
--- a/pkgs/applications/misc/rxvt-unicode/default.nix
+++ b/pkgs/applications/misc/rxvt-unicode/default.nix
@ -0,0 +1,88 @@
+{ stdenv, fetchurl, makeDesktopItem
+, libX11, libXt, libXft, libXrender
+, ncurses, fontconfig, freetype
+, pkgconfig, gdk-pixbuf, perl
+, perlSupport      ? true
+, gdkPixbufSupport ? true
+, unicode3Support  ? true
+}:
+
+let
+  pname = "rxvt-unicode";
+  version = "9.22";
+  description = "A clone of the well-known terminal emulator rxvt";
+
+  desktopItem = makeDesktopItem {
+    name = pname;
+    exec = "urxvt";
+    icon = "utilities-terminal";
+    comment = description;
+    desktopName = "URxvt";
+    genericName = pname;
+    categories = "System;TerminalEmulator;";
+  };
+in
+
+with stdenv.lib;
+
+stdenv.mkDerivation {
+  name = "${pname}-unwrapped-${version}";
+  inherit pname version;
+
+  src = fetchurl {
+    url = "http://dist.schmorp.de/rxvt-unicode/Attic/rxvt-unicode-${version}.tar.bz2";
+    sha256 = "1pddjn5ynblwfrdmskylrsxb9vfnk3w4jdnq2l8xn2pspkljhip9";
+  };
+
+  buildInputs =
+    [ libX11 libXt libXft ncurses  # required to build the terminfo file
+      fontconfig freetype pkgconfig libXrender
+    ] ++ optional perlSupport perl
+      ++ optional gdkPixbufSupport gdk-pixbuf;
+
+  outputs = [ "out" "terminfo" ];
+
+  patches = [
+    ./patches/9.06-font-width.patch
+    ./patches/256-color-resources.patch
+  ] ++ optional stdenv.isDarwin ./patches/makefile-phony.patch;
+
+
+  configureFlags = [
+    "--with-terminfo=$terminfo/share/terminfo"
+    "--enable-256-color"
+    (enableFeature perlSupport "perl")
+    (enableFeature unicode3Support "unicode3")
+  ];
+
+  LDFLAGS = [ "-lfontconfig" "-lXrender" "-lpthread" ];
+  CFLAGS = [ "-I${freetype.dev}/include/freetype2" ];
+
+  preConfigure =
+    ''
+      # without this the terminfo won't be compiled by tic, see man tic
+      mkdir -p $terminfo/share/terminfo
+      export TERMINFO=$terminfo/share/terminfo
+    ''
+    + stdenv.lib.optionalString perlSupport ''
+      # make urxvt find its perl file lib/perl5/site_perl
+      # is added to PERL5LIB automatically
+      mkdir -p $out/$(dirname ${perl.libPrefix})
+      ln -s $out/lib/urxvt $out/${perl.libPrefix}
+    '';
+
+  postInstall = ''
+    mkdir -p $out/nix-support
+    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
+    cp -r ${desktopItem}/share/applications/ $out/share/
+  '';
+
+  meta = {
+    inherit description;
+    homepage = "http://software.schmorp.de/pkg/rxvt-unicode.html";
+    downloadPage = "http://dist.schmorp.de/rxvt-unicode/Attic/";
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms = platforms.unix;
+    license = licenses.gpl3;
+  };
+}
--- a/pkgs/applications/misc/rxvt_unicode/rxvt-unicode-256-color-resources.patch
+++ b/pkgs/applications/misc/rxvt_unicode/rxvt-unicode-256-color-resources.patch
--- a/pkgs/applications/misc/rxvt_unicode/rxvt-unicode-9.06-font-width.patch
+++ b/pkgs/applications/misc/rxvt_unicode/rxvt-unicode-9.06-font-width.patch
--- a/pkgs/applications/misc/rxvt_unicode/rxvt-unicode-makefile-phony.patch
+++ b/pkgs/applications/misc/rxvt_unicode/rxvt-unicode-makefile-phony.patch
--- a/pkgs/applications/misc/rxvt-unicode/wrapper.nix
+++ b/pkgs/applications/misc/rxvt-unicode/wrapper.nix
@ -0,0 +1,58 @@
+{ callPackage
+, symlinkJoin
+, makeWrapper
+, lib
+, rxvt-unicode-unwrapped
+, rxvt-unicode-plugins
+, perlPackages
+, configure ? { availablePlugins, ... }:
+  { plugins = builtins.attrValues availablePlugins;
+    extraDeps = [ ];
+    perlDeps = [ ];
+  }
+}:
+
+let
+  availablePlugins = rxvt-unicode-plugins;
+
+  # Transform the string "self" to the plugin itself.
+  # It's needed for plugins like bidi who depends on the perl
+  # package they provide themself.
+  mkPerlDeps = p:
+    let deps = p.perlPackages or [ ];
+    in map (x: if x == "self" then p else x) deps;
+
+  # The wrapper is called with a `configure` function
+  # that takes the urxvt plugins as input and produce
+  # the configuration of the wrapper: list of plugins,
+  # extra dependencies and perl dependencies.
+  # This provides simple way to customize urxvt using
+  # the `.override` mechanism.
+  wrapper = { configure, ... }:
+    let 
+      config = configure { inherit availablePlugins; };
+      plugins = config.plugins or (builtins.attrValues availablePlugins);
+      extraDeps = config.extraDeps or [ ];
+      perlDeps = (config.perlDeps or [ ]) ++ lib.concatMap mkPerlDeps plugins;
+    in
+      symlinkJoin {
+        name = "rxvt-unicode-${rxvt-unicode-unwrapped.version}";
+
+        paths = [ rxvt-unicode-unwrapped ] ++ plugins ++ extraDeps;
+
+        buildInputs = [ makeWrapper ];
+
+        postBuild = ''
+          wrapProgram $out/bin/urxvt \
+            --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
+            --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
+          wrapProgram $out/bin/urxvtd \
+            --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
+            --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
+        '';
+
+        passthru.plugins = plugins;
+      };
+
+in
+  lib.makeOverridable wrapper { inherit configure; }
--- a/pkgs/applications/misc/rxvt_unicode/default.nix
+++ b/pkgs/applications/misc/rxvt_unicode/default.nix
@ -1,72 +0,0 @@
-{ stdenv, fetchurl, makeDesktopItem, perlSupport ? true, libX11, libXt, libXft,
-  ncurses, perl, fontconfig, freetype, pkgconfig, libXrender,
-  gdkPixbufSupport ? true, gdk-pixbuf, unicode3Support ? true }:
-
-let
-  pname = "rxvt-unicode";
-  version = "9.22";
-  description = "A clone of the well-known terminal emulator rxvt";
-
-  desktopItem = makeDesktopItem {
-    name = pname;
-    exec = "urxvt";
-    icon = "utilities-terminal";
-    comment = description;
-    desktopName = "URxvt";
-    genericName = pname;
-    categories = "System;TerminalEmulator;";
-  };
-in
-
-stdenv.mkDerivation ({
-
-  name = "${pname}${if perlSupport then "-with-perl" else ""}${if unicode3Support then "-with-unicode3" else ""}-${version}";
-
-  src = fetchurl {
-    url = "http://dist.schmorp.de/rxvt-unicode/Attic/rxvt-unicode-${version}.tar.bz2";
-    sha256 = "1pddjn5ynblwfrdmskylrsxb9vfnk3w4jdnq2l8xn2pspkljhip9";
-  };
-
-  buildInputs =
-    [ libX11 libXt libXft ncurses /* required to build the terminfo file */
-      fontconfig freetype pkgconfig libXrender ]
-    ++ stdenv.lib.optional perlSupport perl
-    ++ stdenv.lib.optional gdkPixbufSupport gdk-pixbuf;
-
-  outputs = [ "out" "terminfo" ];
-
-  patches = [
-    ./rxvt-unicode-9.06-font-width.patch
-    ./rxvt-unicode-256-color-resources.patch
-  ]
-  ++ stdenv.lib.optional stdenv.isDarwin ./rxvt-unicode-makefile-phony.patch;
-
-  preConfigure =
-    ''
-      mkdir -p $terminfo/share/terminfo
-      configureFlags="--with-terminfo=$terminfo/share/terminfo --enable-256-color ${if perlSupport then "--enable-perl" else "--disable-perl"} ${if unicode3Support then "--enable-unicode3" else "--disable-unicode3"}";
-      export TERMINFO=$terminfo/share/terminfo # without this the terminfo won't be compiled by tic, see man tic
-      NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${freetype.dev}/include/freetype2"
-      NIX_LDFLAGS="$NIX_LDFLAGS -lfontconfig -lXrender -lpthread "
-    ''
-    # make urxvt find its perl file lib/perl5/site_perl is added to PERL5LIB automatically
-    + stdenv.lib.optionalString perlSupport ''
-      mkdir -p $out/$(dirname ${perl.libPrefix})
-      ln -s $out/lib/urxvt $out/${perl.libPrefix}
-    '';
-
-  postInstall = ''
-    mkdir -p $out/nix-support
-    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
-    cp -r ${desktopItem}/share/applications/ $out/share/
-  '';
-
-  meta = with stdenv.lib; {
-    inherit description;
-    homepage = http://software.schmorp.de/pkg/rxvt-unicode.html;
-    downloadPage = "http://dist.schmorp.de/rxvt-unicode/Attic/";
-    maintainers = with maintainers; [ rnhmjoj ];
-    platforms = platforms.unix;
-    license = licenses.gpl3;
-  };
-})
--- a/pkgs/applications/misc/rxvt_unicode/wrapper.nix
+++ b/pkgs/applications/misc/rxvt_unicode/wrapper.nix
@ -1,23 +0,0 @@
-{ symlinkJoin, rxvt_unicode, makeWrapper, plugins, perlPackages, perlDeps ? []}:
-
-let
-  rxvt_name = builtins.parseDrvName rxvt_unicode.name;
-
-in symlinkJoin {
-  name = "${rxvt_name.name}-with-plugins-${rxvt_name.version}";
-
-  paths = [ rxvt_unicode ] ++ plugins;
-
-  buildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/urxvt \
-      --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
-      --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
-    wrapProgram $out/bin/urxvtd \
-      --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
-      --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
-  '';
-
-  passthru.plugins = plugins;
-}
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "tippecanoe";
-  version = "1.34.3";
+  version = "1.35.0";

  src = fetchFromGitHub {
    owner = "mapbox";
    repo = pname;
    rev = version;
-    sha256 = "08pkxzwp4w5phrk9b0vszxnx8yymp50v0bcw96pz8qwk48z4xm0i";
+    sha256 = "0v5ycc3gsqnl9pps3m45yrnb1gvw5pk6jdyr0q6516b4ac6x67m5";
  };

  buildInputs = [ sqlite zlib ];
@ -21,9 +21,9 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Build vector tilesets from large collections of GeoJSON features";
-    homepage = https://github.com/mapbox/tippecanoe;
+    homepage = "https://github.com/mapbox/tippecanoe";
    license = licenses.bsd2;
    maintainers = with maintainers; [ sikmir ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2019.12.0";
+  version = "2020.2.0";

  src = fetchFromGitHub {
    owner  = "cloudflare";
    repo   = "cloudflared";
    rev    = version;
-    sha256 = "0cc78bysp7z76h4ddiwbsrygz4m4r71f8xylg99pc5qyg8p3my4p";
+    sha256 = "1fzndqkmfpx15fllxqxbh7n4m13ydlp50dvkdh8n384j09ndmx4r";
  };

  modSha256 = "1y5vh8g967rrm9b9hjlr70bs2rm09cpik673brgk3nzqxka10w7p";
@ -17,7 +17,7 @@ buildGoModule rec {

  meta = with stdenv.lib; {
    description = "CloudFlare Argo Tunnel daemon (and DNS-over-HTTPS client)";
-    homepage    = https://www.cloudflare.com/products/argo-tunnel;
+    homepage    = "https://www.cloudflare.com/products/argo-tunnel";
    license     = licenses.unfree;
    platforms   = platforms.unix;
    maintainers = [ maintainers.thoughtpolice maintainers.enorris ];
--- a/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
+++ b/pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh
@ -4,7 +4,7 @@ header "fetching Apache Mesos maven repo"
 function fetchArtifact {
  repoPath="$1"
  echo "Fetching $repoPath"
-  url="http://repo.maven.apache.org/maven2/$repoPath"
+  url="https://repo.maven.apache.org/maven2/$repoPath"
  mkdir -p $(dirname $out/$repoPath)
  curl --fail --location --insecure --retry 3 --max-redirs 20 "$url" --output "$out/$repoPath"
 }
--- a/pkgs/applications/networking/hpmyroom/default.nix
+++ b/pkgs/applications/networking/hpmyroom/default.nix
@ -4,11 +4,11 @@
 }:
 mkDerivation rec {
  pname = "hpmyroom";
-  version = "11.1.0.0508";
+  version = "12.0.0.0220";

  src = fetchurl {
    url = "https://www.myroom.hpe.com/downloadfiles/${pname}-${version}.x86_64.rpm";
-    sha256 = "1j7mzvf349yxb42m8syh73gpvil01hy1a2wrr0rdzb2ijfnkxyaa";
+    sha256 = "0gajj2s6l7jj8520agrv2dyisg7hhacbwzqlsp9a0xdxr0v71jhr";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -2,7 +2,7 @@
 , vala, cmake, ninja, wrapGAppsHook, pkgconfig, gettext
 , gobject-introspection, gnome3, glib, gdk-pixbuf, gtk3, glib-networking
 , xorg, libXdmcp, libxkbcommon
-, libnotify, libsoup, libgee, utillinux, libselinux, libsepol, libpsl, brotli
+, libnotify, libsoup, libgee
 , librsvg, libsignal-protocol-c
 , libgcrypt
 , epoxy
@ -52,18 +52,12 @@ stdenv.mkDerivation rec {
    pcre
    xorg.libxcb
    xorg.libpthreadstubs
-    xorg.libXtst
    libXdmcp
    libxkbcommon
    epoxy
    at-spi2-core
    dbus
    icu
-    utillinux
-    libselinux
-    libsepol
-    libpsl
-    brotli
    libsignal-protocol-c
    librsvg
  ];
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -23,7 +23,7 @@ let
      else "");
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "1.30.1"; # Please backport all updates to the stable channel.
+  version = "1.31.0"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "08l51f1fq9jlnqb4j38lxdfwfbqfzb85zrim57wlgcj8azp2ash6";
+    sha256 = "19vsv7jv30xvfgq1nr3091b6x4agymy9afpy9r9mxzgn0xfb0ap9";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/twinkle/default.nix
+++ b/pkgs/applications/networking/instant-messengers/twinkle/default.nix
@ -47,10 +47,16 @@ mkDerivation rec {
  ];

  patches = [
-    (fetchurl { # https://github.com/LubosD/twinkle/pull/152 patch for bcg729 1.0.2+
+    # patch for bcg729 1.0.2+
+    (fetchurl { # https://github.com/LubosD/twinkle/pull/152
      url = "https://github.com/LubosD/twinkle/compare/05082ae12051821b1d969e6672d9e4e5afe1bc07...7a6c533cda387652b5b4cb2a867be1a18585890c.patch";
      sha256 = "39fc6cef3e88cfca8db44612b2d082fb618027b0f99509138d3c0d2777a494c2";
    })
+    # patch manual link to not link to old url, which now points to NSFW page
+    (fetchurl { # https://github.com/LubosD/twinkle/commit/05082ae12051821b1d969e6672d9e4e5afe1bc07
+      url = "https://github.com/LubosD/twinkle/commit/05082ae12051821b1d969e6672d9e4e5afe1bc07.diff";
+      sha256 = "1iamragr9wp2vczsnp6n261fpr1ai2nc2abp0228jlar9zafksw0";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix
@ -1,20 +1,34 @@
-{ buildPythonPackage, stdenv, python, fetchFromGitHub,
-  pyopenssl, webcolors, future, atomicwrites,
-  attrs, Logbook, pygments, cachetools, matrix-nio }:
+{ buildPythonPackage
+, stdenv
+, python
+, fetchFromGitHub
+, pyopenssl
+, webcolors
+, future
+, atomicwrites
+, attrs
+, Logbook
+, pygments
+, matrix-nio
+, aiohttp
+, requests
+}:

 let
-  matrixUploadPython = python.withPackages (ps: with ps; [
-    magic
+  scriptPython = python.withPackages (ps: with ps; [
+    aiohttp
+    requests
+    python_magic
  ]);
 in buildPythonPackage {
  pname = "weechat-matrix";
-  version = "unstable-2019-11-10";
+  version = "unstable-2020-01-21";

  src = fetchFromGitHub {
    owner = "poljar";
    repo = "weechat-matrix";
-    rev = "69ad2a9c03d516c212d3d0700dbb2bfe654f6365";
-    sha256 = "1mfbkag5np2lgv6f31nyfnvavyh67jrrx6gxhzb8m99dd43lgs8c";
+    rev = "46640df3e0bfb058e97d8abe723bb88fdf4e5177";
+    sha256 = "1j3l43j741csfxsp1nsc74y6wj2wm86c45iraf167g6p0sdzcq8z";
  };

  propagatedBuildInputs = [
@ -25,8 +39,9 @@ in buildPythonPackage {
    attrs
    Logbook
    pygments
-    cachetools
    matrix-nio
+    aiohttp
+    requests
  ];

  passthru.scripts = [ "matrix.py" ];
@ -38,10 +53,18 @@ in buildPythonPackage {
    mkdir -p $out/share $out/bin
    cp $src/main.py $out/share/matrix.py

-    cp $src/contrib/matrix_upload $out/bin/
+    cp \
+      $src/contrib/matrix_upload \
+      $src/contrib/matrix_decrypt \
+      $src/contrib/matrix_sso_helper \
+      $out/bin/
    substituteInPlace $out/bin/matrix_upload \
-      --replace '/usr/bin/env -S python3 -u' '${matrixUploadPython}/bin/python -u' 
-  
+      --replace '/usr/bin/env -S python3' '${scriptPython}/bin/python'
+    substituteInPlace $out/bin/matrix_sso_helper \
+      --replace '/usr/bin/env -S python3' '${scriptPython}/bin/python'
+    substituteInPlace $out/bin/matrix_decrypt \
+      --replace '/usr/bin/env python3' '${scriptPython}/bin/python'
+   
    mkdir -p $out/${python.sitePackages}
    cp -r $src/matrix $out/${python.sitePackages}/matrix
  '';
@ -53,6 +76,6 @@ in buildPythonPackage {
    homepage = "https://github.com/poljar/weechat-matrix";
    license = licenses.isc;
    platforms = platforms.linux;
-    maintainers = [ maintainers.tilpner ];
+    maintainers = with maintainers; [ tilpner emily ];
  };
 }
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@ -19,7 +19,7 @@ let
    maintainers = with maintainers; [ emmanuelrosa dtzWill kampka ];
  };

-  version = "0.38.2";
+  version = "0.39.4";

 in {
  
@ -30,7 +30,7 @@ in {

    src = fetchurl {
      url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-      sha256 = "10f5zfqcfcjynw04d5xzrfmkbqpk85i4mq7njhkibx2f1m0br2qa";
+      sha256 = "18wrnm13k0gg6aljpf6k7c5zia81zzkqc0sa1pgz0yzczydsfaa9";
    };
  
    # Fetch from source repo, no longer included in release.
@ -78,7 +78,7 @@ in {

    src = fetchurl {
      url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-      sha256 = "1df0cx9gpzk0086lgha0qm1g03l8f4rz7y2xzgpzng5rrxjkgz61";
+      sha256 = "06svdp25031p665pvlxdz10malvhxpczzrg90hpr1zymm6v8van3";
    };

    nativeBuildInputs = [
--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "last";
-  version = "1045";
+  version = "1047";

  src = fetchurl {
    url = "http://last.cbrc.jp/last-${version}.zip";
-    sha256 = "0x2wrm52ca935n3yc486m8yy59ap34w1x9h3csjca3jab5agnjkc";
+    sha256 = "06fj4qfw3dd35y3pky3dnr40v1alf43wjx373rbx1vr3hbgzvgf8";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/science/biology/minc-tools/default.nix
+++ b/pkgs/applications/science/biology/minc-tools/default.nix
@ -1,21 +1,28 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perlPackages, libminc, libjpeg, zlib }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perl, TextFormat,
+  libminc, libjpeg, nifticlib, zlib }:

 stdenv.mkDerivation rec {
-  pname = "minc-tools";
-  name  = "${pname}-2017-09-11";
+  pname   = "minc-tools";
+  version = "unstable-2019-12-04";

  src = fetchFromGitHub {
    owner  = "BIC-MNI";
    repo   = pname;
-    rev    = "5b7c40425cd4f67a018055cb85c0157ee50a3056";
-    sha256 = "0zkcs05svp1gj5h0cdgc0k20c7lrk8m7wg3ks3xc5mkaiannj8g7";
+    rev    = "d4dddfdb4e4fa0cea389b8fdce51cfc076565d94";
+    sha256 = "1wwdss59qq4hz1jp35qylfswzzv0d37if23al0srnxkkgc5f8zng";
  };

+  patches = [ ./fix-netcdf-header.patch ];
+
  nativeBuildInputs = [ cmake flex bison makeWrapper ];
  buildInputs = [ libminc libjpeg zlib ];
-  propagatedBuildInputs = with perlPackages; [ perl TextFormat ];
+  propagatedBuildInputs = [ perl TextFormat ];

-  cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" ];
+  cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/"
+                 "-DZNZ_INCLUDE_DIR=${nifticlib}/include/"
+                 "-DZNZ_LIBRARY=${nifticlib}/lib/libznz.a"
+                 "-DNIFTI_INCLUDE_DIR=${nifticlib}/include/nifti/"
+                 "-DNIFTI_LIBRARY=${nifticlib}/lib/libniftiio.a" ];

  postFixup = ''
    for prog in minccomplete minchistory mincpik; do
--- a/pkgs/applications/science/biology/minc-tools/fix-netcdf-header.patch
+++ b/pkgs/applications/science/biology/minc-tools/fix-netcdf-header.patch
@ -0,0 +1,12 @@
+diff --git a/progs/mincdump/mincdump.h b/progs/mincdump/mincdump.h
+index 14c95cd..117ab26 100644
+--- a/progs/mincdump/mincdump.h
+++ b/progs/mincdump/mincdump.h
+@@ -3,6 +3,7 @@
+  *   See netcdf/COPYRIGHT file for copying and redistribution conditions.
+  *   $Header: /private-cvsroot/minc/progs/mincdump/mincdump.h,v 1.1 2004-04-27 15:35:15 bert Exp $
+  *********************************************************************/
+#include <netcdf_meta.h>
+ 
+ 
+ /* error checking macro */
--- a/pkgs/applications/science/chemistry/marvin/default.nix
+++ b/pkgs/applications/science/chemistry/marvin/default.nix
@ -4,12 +4,12 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "marvin";
-  version = "20.3.0";
+  version = "20.4.0";

  src = fetchurl {
    name = "marvin-${version}.deb";
    url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "1y2vh1n80mrrbxqbhxfag8h4lisarbw8h3labmh3ajrfan7bmhql";
+    sha256 = "12kygxq24in7hbp7shkx1baqig8rwmzvv0d3kc3ld9sj9hb0a2n1";
  };

  nativeBuildInputs = [ dpkg makeWrapper ];
@ -45,4 +45,4 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    platforms = platforms.linux;
  };
-}
+}
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@ -35,8 +35,8 @@ let
  python = python3;
  wxPython = python3Packages.wxPython_4_0;

-  kicad-libraries = callPackages ./libraries.nix versionConfig.libVersion;
-  kicad-base = callPackage ./base.nix {
+  libraries = callPackages ./libraries.nix versionConfig.libVersion;
+  base = callPackage ./base.nix {
    pname = baseName;
    inherit versions stable baseName;
    inherit wxGTK python wxPython;
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
  inherit pname;
  version = versions.${baseName}.kicadVersion.version;

-  src = kicad-base;
+  src = base;
  dontUnpack = true;
  dontConfigure = true;
  dontBuild = true;
@ -61,10 +61,10 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = optionals (scriptingSupport)
    [ pythonPackages.wrapPython ];

-  # wrapGAppsHook added the equivalent to ${kicad-base}/share
+  # wrapGAppsHook added the equivalent to ${base}/share
  # though i noticed no difference without it
  makeWrapperArgs = [
-    "--prefix XDG_DATA_DIRS : ${kicad-base}/share"
+    "--prefix XDG_DATA_DIRS : ${base}/share"
    "--prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share"
    "--prefix XDG_DATA_DIRS : ${gnome3.defaultIconTheme}/share"
    "--prefix XDG_DATA_DIRS : ${wxGTK.gtk}/share/gsettings-schemas/${wxGTK.gtk.name}"
@ -73,13 +73,13 @@ stdenv.mkDerivation rec {
    "--prefix XDG_DATA_DIRS : ${cups}/share"
    "--prefix GIO_EXTRA_MODULES : ${gnome3.dconf}/lib/gio/modules"

-    "--set KISYSMOD ${kicad-libraries.footprints}/share/kicad/modules"
-    "--set KICAD_SYMBOL_DIR ${kicad-libraries.symbols}/share/kicad/library"
-    "--set KICAD_TEMPLATE_DIR ${kicad-libraries.templates}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${kicad-libraries.symbols}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${kicad-libraries.footprints}/share/kicad/template"
+    "--set KISYSMOD ${libraries.footprints}/share/kicad/modules"
+    "--set KICAD_SYMBOL_DIR ${libraries.symbols}/share/kicad/library"
+    "--set KICAD_TEMPLATE_DIR ${libraries.templates}/share/kicad/template"
+    "--prefix KICAD_TEMPLATE_DIR : ${libraries.symbols}/share/kicad/template"
+    "--prefix KICAD_TEMPLATE_DIR : ${libraries.footprints}/share/kicad/template"
  ]
-  ++ optionals (with3d) [ "--set KISYS3DMOD ${kicad-libraries.packages3d}/share/kicad/modules/packages3d" ]
+  ++ optionals (with3d) [ "--set KISYS3DMOD ${libraries.packages3d}/share/kicad/modules/packages3d" ]
  ++ optionals (ngspiceSupport) [ "--prefix LD_LIBRARY_PATH : ${libngspice}/lib" ]

  # infinisil's workaround for #39493
@ -88,30 +88,30 @@ stdenv.mkDerivation rec {

  # dunno why i have to add $makeWrapperArgs manually...
  # $out and $program_PYTHONPATH don't exist when makeWrapperArgs gets set?
-  # not sure if anything has to be done with the other stuff in kicad-base/bin
+  # not sure if anything has to be done with the other stuff in base/bin
  # dxf2idf, idf2vrml, idfcyl, idfrect, kicad2step, kicad-ogltest
  installPhase =
-    optionalString (scriptingSupport) '' buildPythonPath "${kicad-base} $pythonPath"
+    optionalString (scriptingSupport) '' buildPythonPath "${base} $pythonPath"
    '' +
-    '' makeWrapper ${kicad-base}/bin/kicad $out/bin/kicad $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/kicad $out/bin/kicad $makeWrapperArgs ''
    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
    '' +
-    '' makeWrapper ${kicad-base}/bin/pcbnew $out/bin/pcbnew $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/pcbnew $out/bin/pcbnew $makeWrapperArgs ''
    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
    '' +
-    '' makeWrapper ${kicad-base}/bin/eeschema $out/bin/eeschema $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/eeschema $out/bin/eeschema $makeWrapperArgs ''
    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
    '' +
-    '' makeWrapper ${kicad-base}/bin/gerbview $out/bin/gerbview $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/gerbview $out/bin/gerbview $makeWrapperArgs ''
    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
    '' +
-    '' makeWrapper ${kicad-base}/bin/pcb_calculator $out/bin/pcb_calculator $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/pcb_calculator $out/bin/pcb_calculator $makeWrapperArgs ''
    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
    '' +
-    '' makeWrapper ${kicad-base}/bin/pl_editor $out/bin/pl_editor $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/pl_editor $out/bin/pl_editor $makeWrapperArgs ''
    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
    '' +
-    '' makeWrapper ${kicad-base}/bin/bitmap2component $out/bin/bitmap2component $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/bitmap2component $out/bin/bitmap2component $makeWrapperArgs ''
    + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
    ''
  ;
--- a/pkgs/applications/science/electronics/kicad/update.sh
+++ b/pkgs/applications/science/electronics/kicad/update.sh
@ -5,13 +5,12 @@
 # this should contain the versions' revs and hashes
 # the stable revs are stored only for ease of skipping

-# if you get something like "tar: no space left on device"
-# you may need a bigger tmpfs, this can be set as such
-# services.logind.extraConfig = "RuntimeDirectorySize=8G";
-# this is most likely only needed for the packages3d
-# this can be checked without that config by manual TOFU
-# copy the generated items from ,versions.nix to versions.nix
-# then nix-build and see what it actually gets
+# by default nix-prefetch-url uses XDG_RUNTIME_DIR as tmp
+# which is /run/user/1000, which defaults to 10% of your RAM
+# unless you have over 64GB of ram that'll be insufficient
+# resulting in "tar: no space left on device" for packages3d
+# hence:
+export TMPDIR=/tmp

 # if something goes unrepairably wrong, run 'update.sh all clean'

@ -19,7 +18,8 @@
 # support parallel instances for each pname
 #   currently risks reusing old data
 # no getting around manually checking if the build product works...
-# if there is, default to commiting
+# if there is, default to commiting?
+#   won't work when running in parallel?
 # remove items left in /nix/store?

 # get the latest tag that isn't an RC or *.99
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@ -27,25 +27,25 @@
  };
  "kicad-unstable" = {
    kicadVersion = {
-      version =			"2020-01-08";
+      version =			"2020-02-10";
      src = {
-        rev =			"ca34ade00c554157f106fde97af5f08a202808ef";
-        sha256 =		"0xx5qkc5pi3qdrdikgq3902ws8zilv2476fb4bbgh95d9wpgr35v";
+        rev =			"1190e60dd426d246661e478db3287f266ec6cda2";
+        sha256 =		"0cgfad07j69cks97llj4hf3kga0d5qf728s89xwxrzcwm06k62bi";
      };
    };
    libVersion = {
-      version =			"2020-01-08";
+      version =			"2020-02-10";
      libSources = {
-        i18n.rev =		"e7439fd76f27cfc26e269c4e6c4d56245345c28b";
-        i18n.sha256 =		"1nqm1kx5b4f7s0f9q8bg4rdhqnp0128yp6bgnrkia1kwmfnf5gmy";
-        symbols.rev =		"ad58768b88d564fd188c6667841adec436da53f2";
-        symbols.sha256 =	"1rdplf04bff0hmgjwr81fbcr9nkqi21n0n88nzs5fdp73mqiywcy";
+        i18n.rev =		"26786c4ca804bad7eb072f1ef381f00b5a2ff3ee";
+        i18n.sha256 =		"0iqr1xfw4s677afjy9bn5y41z4isp327f9y90wypkxiwwq3dfkfl";
+        symbols.rev =		"35b7da2d211d7cc036b37ad7f5e40ef03faa1bc7";
+        symbols.sha256 =	"0wbfw1swbfvfp47cn48pxpqlygjs3xh568ydrrs51v3w102x8y64";
        templates.rev =		"0c0490897f803ab8b7c3dad438b7eb1f80e0417c";
        templates.sha256 =	"0cs3bm3zb5ngw5ldn0lzw5bvqm4kvcidyrn76438alffwiz2b15g";
-        footprints.rev =	"973867de7f33f202e9fd1b3455bd1f7e7fe4a074";
-        footprints.sha256 =	"0yvidpnqbfxjdwaiscl5bdchsg0l4d769vp456dc8h0f3802mibi";
-        packages3d.rev =	"c2b92a411adc93ddeeed74b36b542e1057f81a2a";
-        packages3d.sha256 =	"05znc6y2lc31iafspg308cxdda94zg6c7mwslmys76npih1pb8qc";
+        footprints.rev =	"9357b6f09312966c57fec9f66a516941d79c3038";
+        footprints.sha256 =	"0cgah1q0h012ffwfl220k7qb6hgbs0i91spq2j4v3lgpfr4g638d";
+        packages3d.rev =	"de368eb739abe41dfc3163e0e370477e857f9cc1";
+        packages3d.sha256 =	"0b3p5v8g24h6l7q3sbqz7ns0gnrf9l89glj86m5ybhizvls9vrrs";
      };
    };
  };
--- a/pkgs/applications/science/math/clp/default.nix
+++ b/pkgs/applications/science/math/clp/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, zlib }:

 stdenv.mkDerivation rec {
-  version = "1.17.3";
+  version = "1.17.5";
  pname = "clp";
  src = fetchurl {
    url = "https://www.coin-or.org/download/source/Clp/Clp-${version}.tgz";
-    sha256 = "0ws515f73vq2p4nzyq0fbnm4zp9a7mjg54szdzvkql5dj51gafx1";
+    sha256 = "0y5wg4lfffy5vh8gc20v68pmmv241ndi2jgm9pgvk39b00bzkaa9";
  };

  propagatedBuildInputs = [ zlib ];
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "git-repo";
-  version = "1.13.9.4";
+  version = "2.0";

  src = fetchFromGitHub {
    owner = "android";
    repo = "tools_repo";
    rev = "v${version}";
-    sha256 = "0kkb3s472zvmz5xign25rgv7amdzhjb1wvchqxaf80g4913rw583";
+    sha256 = "077fsg2mh47c7qvqwpivkw474rpnw5xs36j23rxj2k5m700bz3hq";
  };

  patches = [ ./import-ssl-module.patch ];
--- a/pkgs/applications/video/catt/default.nix
+++ b/pkgs/applications/video/catt/default.nix
@ -8,11 +8,11 @@

 buildPythonApplication rec {
  pname = "catt";
-  version = "0.10.2";
+  version = "0.10.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0n6aa2vvbq0z3vcg4cylhpqxch783cxvxk234647knklgg9vdf1r";
+    sha256 = "08rjimcy9n7nvh4dz9693gjmkq6kaq5pq1nmjjsdrb7vb89yl53i";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@ -1,9 +1,9 @@
 { flavor ? ""
-, ldflags ? ""
 , stdenv
 , btrfs-progs
 , buildGoPackage
 , fetchFromGitHub
+, git
 , glibc
 , gpgme
 , libapparmor
@ -13,13 +13,14 @@
 , libselinux
 , lvm2
 , pkgconfig
+, which
 }:

 let
  buildTags = "apparmor seccomp selinux containers_image_ostree_stub";
 in buildGoPackage rec {
  project = "cri-o";
-  version = "1.16.1";
+  version = "1.17.0";
  name = "${project}-${version}${flavor}";

  goPackagePath = "github.com/${project}/${project}";
@ -28,11 +29,11 @@ in buildGoPackage rec {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    sha256 = "0w690zhc55gdqzc31jc34nrzwd253pfb3rq23z51q22nqwmlsh9p";
+    sha256 = "0xjmylf0ww23qqcg7kw008px6608r4qq6q57pfqis0661kp6f24j";
  };

  outputs = [ "bin" "out" ];
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ git pkgconfig which ];
  buildInputs = [ btrfs-progs gpgme libapparmor libassuan libgpgerror
                 libseccomp libselinux lvm2 ]
                ++ stdenv.lib.optionals (glibc != null) [ glibc glibc.static ];
@ -40,27 +41,15 @@ in buildGoPackage rec {
  buildPhase = ''
    pushd go/src/${goPackagePath}

-    # Build pause
-    make -C pause
-
-    # Build the crio binaries
-    function build() {
-      go build \
-        -tags "${buildTags}" \
-        -o bin/"$1" \
-        -buildmode=pie \
-        -ldflags '-s -w ${ldflags}' \
-        ${goPackagePath}/cmd/"$1"
-    }
-    build crio
-    build crio-status
+    make BUILDTAGS='${buildTags}' \
+      bin/crio \
+      bin/crio-status \
+      bin/pinns
  '';
  installPhase = ''
    install -Dm755 bin/crio $bin/bin/crio${flavor}
    install -Dm755 bin/crio-status $bin/bin/crio-status${flavor}
-
-    mkdir -p $bin/libexec/crio
-    install -Dm755 bin/pause $bin/libexec/crio/pause${flavor}
+    install -Dm755 bin/pinns $bin/bin/pinns${flavor}
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -84,6 +84,37 @@ stdenv.mkDerivation rec {
      stripLen = 1;
      extraPrefix = "slirp/";
    })
+    # patches listed at: https://nvd.nist.gov/vuln/detail/CVE-2020-7039
+    (fetchpatch {
+      name = "CVE-2020-7039-1.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=2655fffed7a9e765bcb4701dd876e9dab975f289";
+      sha256 = "1jh0k3lg3553c2x1kq1kl3967jabhba5gm584wjpmr5mjqk3lnz1";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+      excludes = ["slirp/CHANGELOG.md"];
+    })
+    (fetchpatch {
+      name = "CVE-2020-7039-2.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=82ebe9c370a0e2970fb5695aa19aa5214a6a1c80";
+      sha256 = "08ccxcmrhzknnzd1a1q2brszv3a7h02n26r73kpli10b0hn12r2l";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+    })
+    (fetchpatch {
+      name = "CVE-2020-7039-3.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9";
+      sha256 = "18ypj9an2jmsmdn58853rbz42r10587h7cz5fdws2x4635778ibd";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+    })
+    # patches listed at: https://nvd.nist.gov/vuln/detail/CVE-2020-7211
+    (fetchpatch {
+      name = "CVE-2020-7211.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=14ec36e107a8c9af7d0a80c3571fe39b291ff1d4";
+      sha256 = "1lc8zabqs580iqrsr5k7zwgkx6qjmja7apwfbc36lkvnrxwfzmrc";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+    })
  ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
    ++ optionals stdenv.hostPlatform.isMusl [
    (fetchpatch {
--- a/pkgs/data/fonts/recursive/default.nix
+++ b/pkgs/data/fonts/recursive/default.nix
@ -2,25 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "recursive";
-  version = "1.022";
+  version = "1.030";

-  srcs = [
-    (fetchzip {
-      name = "${pname}";
-      url = "https://github.com/arrowtype/recursive/releases/download/v${version}/recursive-beta_1_022.zip";
-      sha256 = "09nr1fli7ksv8z4yb25c4xidwsqq50av18qrybsy4kqy5c22957v";
-      stripRoot = false;
-    })
-
-    (fetchzip {
-      name = "${pname}-static";
-      url = "https://github.com/arrowtype/recursive/releases/download/v${version}/recursive-static_fonts-b020.zip";
-      sha256 = "1wlj113gjm26ra9y2r2b3syis2wx0mjq2m8i8xpwscp1kflma1r6";
-      stripRoot = false;
-    })
-  ];
-
-  sourceRoot = ".";
+  src = fetchzip {
+    url = "https://github.com/arrowtype/recursive/releases/download/${version}/recursive-beta_1_030--statics.zip";
+    sha256 = "1clds4ljiqdf0zc3b7nlna1w7kc23pc9gxdd5vwbgmz9xfvkam0f";
+    stripRoot = false;
+  };

  installPhase = ''
    mkdir -p $out/share/fonts/{opentype,truetype,woff2}
--- a/pkgs/data/icons/flat-remix-icon-theme/default.nix
+++ b/pkgs/data/icons/flat-remix-icon-theme/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec  {
  pname = "flat-remix-icon-theme";
-  version = "20191018";
+  version = "20191122";

  src = fetchFromGitHub  {
    owner = "daniruiz";
    repo = "flat-remix";
    rev = version;
-    sha256 = "13ibxvrvri04lb5phm49b6d553jh0aigm57z5i0nsins405gixn9";
+    sha256 = "1rv35r52l7xxjpajwli0md07k3xl7xplbw919vjmsb1hhrzavzzg";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "cinnamon-desktop";
-  version = "4.4.0";
+  version = "4.4.1";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "17hb8gkb9pfj56ckva5g4x83yvmdv7hvpidxjsdf79dw6pabr5rg";
+    sha256 = "10db5rai8cbbzphvcwarr3hm1bd9rxchlc0hcghg7qnmvv52fq03";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@ -66,8 +66,9 @@ let
        # Remove old versions of elixir, when the supports fades out:
        # https://hexdocs.pm/elixir/compatibility-and-deprecations.html

-        lfe = lfe_1_2;
+        lfe = lfe_1_3;
        lfe_1_2 = lib.callLFE ../interpreters/lfe/1.2.nix { inherit erlang buildRebar3 buildHex; };
+        lfe_1_3 = lib.callLFE ../interpreters/lfe/1.3.nix { inherit erlang buildRebar3 buildHex; };

        # Non hex packages. Examples how to build Rebar/Mix packages with and
        # without helper functions buildRebar3 and buildMix.
--- a/pkgs/development/compilers/bs-platform/build-bs-platform.nix
+++ b/pkgs/development/compilers/bs-platform/build-bs-platform.nix
@ -30,9 +30,8 @@ stdenv.mkDerivation {
    cp ${custom-ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
  '';

-  configurePhase = ''
-    node scripts/ninja.js config
-  '';
+  # avoid building the development version, will break aarch64 build
+  dontConfigure = true;

  buildPhase = ''
    # This is an unfortunate name, but it's actually how to build a release
--- a/pkgs/development/compilers/bs-platform/default.nix
+++ b/pkgs/development/compilers/bs-platform/default.nix
@ -21,8 +21,5 @@ in
    license = licenses.lgpl3;
    maintainers = with maintainers; [ turbomack gamb anmonteiro ];
    platforms = platforms.all;
-    # Currently there is an issue with aarch build in hydra
-    # https://github.com/BuckleScript/bucklescript/issues/4091
-    badPlatforms = platforms.aarch64;
  };
 })
--- a/pkgs/development/compilers/ispc/default.nix
+++ b/pkgs/development/compilers/ispc/default.nix
@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, which, m4, python, bison, flex, llvmPackages,
+{stdenv, fetchFromGitHub, cmake, which, m4, python, bison, flex, llvmPackages,
 testedTargets ? ["sse2"] # the default test target is sse4, but that is not supported by all Hydra agents
 }:

@ -17,11 +17,9 @@ stdenv.mkDerivation rec {
    sha256 = "1x07n2gaff3v32yvddrb659mx5gg12bnbsqbyfimp396wn04w60b";
  };

-  # there are missing dependencies in the Makefile, causing sporadic build failures
-  enableParallelBuilding = false;
-
  doCheck = stdenv.isLinux;

+  nativeBuildInputs = [ cmake ];
  buildInputs = with llvmPackages; [
    which
    m4
@ -32,7 +30,7 @@ stdenv.mkDerivation rec {
    llvmPackages.clang-unwrapped # we need to link against libclang, so we need the unwrapped
  ];

-  postPatch = "sed -i -e 's,/bin/,,g' -e 's/-lcurses/-lncurses/g' Makefile";
+  postPatch = "sed -i -e 's/curses/ncurses/g' CMakeLists.txt";

  # TODO: this correctly catches errors early, but also some things that are just weird and don't seem to be real
  # errors
@ -40,27 +38,23 @@ stdenv.mkDerivation rec {
  #  makeFlagsArray=( SHELL="${bash}/bin/bash -o pipefail" )
  #'';

-  installPhase = ''
-    mkdir -p $out/bin
-    cp ispc $out/bin
-  '';
-
  checkPhase = ''
-    export ISPC_HOME=$PWD
+    export ISPC_HOME=$PWD/bin
    for target in $testedTargets
    do
      echo "Testing target $target"
      echo "================================"
      echo
-      PATH=${llvmPackages.clang}/bin:$PATH python run_tests.py -t $target --non-interactive --verbose --file=test_output.log
-      fgrep -q "No new fails"  test_output.log || exit 1
+      (cd ../
+       PATH=${llvmPackages.clang}/bin:$PATH python run_tests.py -t $target --non-interactive --verbose --file=test_output.log
+       fgrep -q "No new fails"  test_output.log || exit 1)
    done
  '';

-  makeFlags = [
-    "CXX=${stdenv.cc}/bin/clang++"
-    "CLANG=${stdenv.cc}/bin/clang"
-    "CLANG_INCLUDE=${llvmPackages.clang-unwrapped}/include"
+  cmakeFlags = [
+    "-DCLANG_EXECUTABLE=${llvmPackages.clang}/bin/clang"
+    "-DISPC_INCLUDE_EXAMPLES=OFF"
+    "-DISPC_INCLUDE_UTILS=OFF"
    ];

  meta = with stdenv.lib; {
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@ -1,24 +1,23 @@
 { stdenv, makeWrapper, fetchFromGitHub, ocaml, findlib, dune
-, menhir, merlin-extend, ppx_tools_versioned, utop, cppo
-, ocaml_lwt
+, fix, menhir, merlin-extend, ppx_tools_versioned, utop, cppo
 }:

 stdenv.mkDerivation rec {
  name = "ocaml${ocaml.version}-reason-${version}";
-  version = "3.5.1";
+  version = "3.5.4";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "reason";
-    rev = "aea245a43eb44034d2fccac7028b640a437af239";
-    sha256 = "0ff7rjxbsg9zkq6sxlm9bkx7yk8x2cvras7z8436msczgd1wmmyf";
+    rev = "e3287476e5c3f0cbcd9dc7ab18d290f81f4afa0c";
+    sha256 = "02p5d1x6lr7jp9mvgvsas3nnq3a97chxp5q6rl07n5qm61d5b4dl";
  };

  nativeBuildInputs = [ makeWrapper ];

  propagatedBuildInputs = [ menhir merlin-extend ppx_tools_versioned ];

-  buildInputs = [ ocaml findlib dune cppo utop menhir ];
+  buildInputs = [ ocaml findlib dune cppo fix utop menhir ];

  buildFlags = [ "build" ]; # do not "make tests" before reason lib is installed

@ -27,8 +26,8 @@ stdenv.mkDerivation rec {
  postInstall = ''
    wrapProgram $out/bin/rtop \
      --prefix PATH : "${utop}/bin" \
-      --prefix CAML_LD_LIBRARY_PATH : "${ocaml_lwt}/lib/ocaml/${ocaml.version}/site-lib" \
-      --prefix OCAMLPATH : "$out/lib/ocaml/${ocaml.version}/site-lib"
+      --prefix CAML_LD_LIBRARY_PATH : "$CAML_LD_LIBRARY_PATH" \
+      --prefix OCAMLPATH : "$OCAMLPATH:$OCAMLFIND_DESTDIR"
  '';

  meta = with stdenv.lib; {
--- a/pkgs/development/compilers/sdcc/default.nix
+++ b/pkgs/development/compilers/sdcc/default.nix
@ -10,11 +10,11 @@ in

 stdenv.mkDerivation rec {
  pname = "sdcc";
-  version = "3.9.0";
+  version = "4.0.0";

  src = fetchurl {
    url = "mirror://sourceforge/sdcc/sdcc-src-${version}.tar.bz2";
-    sha256 = "0dn0cy6whcrvbfh9x467jdi8dmzjrvixz2bz63pgxwzpz9rsxv4l";
+    sha256 = "042fxw5mnsfhpc0z9lxfsw88kdkm32pwrxacp88kj2n2dy0814a8";
  };

  buildInputs = [ autoconf bison boost flex gputils texinfo zlib ];
--- a/pkgs/development/interpreters/elixir/1.10.nix
+++ b/pkgs/development/interpreters/elixir/1.10.nix
@ -3,7 +3,7 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/elixir-lang/elixir/archive/v${version}.tar.gz
 mkDerivation {
-  version = "1.10.0";
-  sha256 = "1fz22c2jqqm2jvzxar11bh1djg3kqdn5rbxdddlz0cv6mfz7hvgv";
+  version = "1.10.1";
+  sha256 = "07iccn90yp11ms58mwkwd9ixd9vma0025l9zm6l7y0jjzrj3vycy";
  minimumOTPVersion = "21";
 }
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@ -73,6 +73,6 @@ in

      license = licenses.epl10;
      platforms = platforms.unix;
-      maintainers = with maintainers; [ the-kenny havvy couchemar ankhers ];
+      maintainers = with maintainers; [ the-kenny havvy couchemar ankhers filalex77 ];
    };
  })
--- a/Show More
+++ b/Show More
 @ -1 +1 @@
 .03
 .09