Merge branch 'staging-next' into staging

2020-09-24 23:09:00 +02:00 · 2020-09-24 23:09:00 +02:00 · d471c5d1f3
commit d471c5d1f3
parent 17f5821f94 d341a1c614
225 changed files with 2836 additions and 1853 deletions
--- a/doc/builders/images/dockertools.xml
+++ b/doc/builders/images/dockertools.xml
@ -132,11 +132,11 @@ buildImage {
   <para>
    By default <function>buildImage</function> will use a static date of one second past the UNIX Epoch. This allows <function>buildImage</function> to produce binary reproducible images. When listing images with <command>docker images</command>, the newly created images will be listed like this:
   </para>
-<screen><![CDATA[
-$ docker images
+<screen>
+<prompt>$ </prompt>docker images
 REPOSITORY   TAG      IMAGE ID       CREATED        SIZE
 hello        latest   08c791c7846e   48 years ago   25.2MB
-]]></screen>
+</screen>
   <para>
    You can break binary reproducibility but have a sorted, meaningful <literal>CREATED</literal> column by setting <literal>created</literal> to <literal>now</literal>.
   </para>
@ -152,11 +152,11 @@ pkgs.dockerTools.buildImage {
 ]]></programlisting>
   <para>
    and now the Docker CLI will display a reasonable date and sort the images as expected:
-<screen><![CDATA[
-$ docker images
+<screen>
+<prompt>$ </prompt>docker images
 REPOSITORY   TAG      IMAGE ID       CREATED              SIZE
 hello        latest   de2bf4786de6   About a minute ago   25.2MB
-]]></screen>
+</screen>
    however, the produced images will not be binary reproducible.
   </para>
  </example>
--- a/doc/builders/images/ocitools.xml
+++ b/doc/builders/images/ocitools.xml
@ -38,8 +38,7 @@ buildContainer {

  readonly = false; <co xml:id='ex-ociTools-buildContainer-3' />
 }
-
-    </programlisting>
+</programlisting>
   <calloutlist>
    <callout arearefs='ex-ociTools-buildContainer-1'>
     <para>
--- a/doc/builders/packages/citrix.xml
+++ b/doc/builders/packages/citrix.xml
@ -22,10 +22,10 @@
  </para>
  <para>
   In order to set this up, you first have to <link xlink:href="https://its.uiowa.edu/support/article/102186">download the <literal>.cr</literal> file from the Netscaler Gateway</link>. After that you can configure the <command>selfservice</command> like this:
-   <screen>
-    <prompt>$ </prompt>storebrowse -C ~/Downloads/receiverconfig.cr
-    <prompt>$ </prompt>selfservice
-   </screen>
+<screen>
+<prompt>$ </prompt>storebrowse -C ~/Downloads/receiverconfig.cr
+<prompt>$ </prompt>selfservice
+</screen>
  </para>
 </section>

--- a/doc/builders/packages/urxvt.xml
+++ b/doc/builders/packages/urxvt.xml
@ -18,10 +18,13 @@
   includes all available plugins. To make use of this functionality, use an
   overlay or directly install an expression that overrides its configuration,
   such as
-   <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+<programlisting>
+rxvt-unicode.override {
+  configure = { availablePlugins, ... }: {
    plugins = with availablePlugins; [ perls resize-font vtwheel ];
-  }
-}</programlisting>
+  };
+}
+</programlisting>
   If the <literal>configure</literal> function returns an attrset without the
   <literal>plugins</literal> attribute, <literal>availablePlugins</literal>
   will be used automatically.
@ -30,18 +33,22 @@
  <para>
   In order to add plugins but also keep all default plugins installed, it is
   possible to use the following method:
-   <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
-     plugins = (builtins.attrValues availablePlugins) ++ [ custom-plugin ];
-   };
-}</programlisting>
+<programlisting>
+rxvt-unicode.override {
+  configure = { availablePlugins, ... }: {
+    plugins = (builtins.attrValues availablePlugins) ++ [ custom-plugin ];
+  };
+}
+</programlisting>
  </para>

  <para>
   To get a list of all the plugins available, open the Nix REPL and run
-   <programlisting>$ nix repl
+<screen>
+<prompt>$ </prompt>nix repl
 :l &lt;nixpkgs&gt;
 map (p: p.name) pkgs.rxvt-unicode.plugins
-   </programlisting>
+</screen>
   Alternatively, if your shell is bash or zsh and have completion enabled,
   simply type <literal>nixpkgs.rxvt-unicode.plugins.&lt;tab&gt;</literal>.
  </para>
@ -53,18 +60,24 @@ map (p: p.name) pkgs.rxvt-unicode.plugins
    <literal>extraDeps</literal> can be used, for example, to provide
    <literal>xsel</literal> (a clipboard manager) to the clipboard plugin,
    without installing it globally:
-    <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
-     pluginsDeps = [ xsel ];
-   }
-}</programlisting>
+<programlisting>
+rxvt-unicode.override {
+  configure = { availablePlugins, ... }: {
+    pluginsDeps = [ xsel ];
+  };
+}
+</programlisting>

    <literal>perlDeps</literal> is a handy way to provide Perl packages to
    your custom plugins (in <literal>$HOME/.urxvt/ext</literal>). For example,
    if you need <literal>AnyEvent</literal> you can do:
-    <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
-     perlDeps = with perlPackages; [ AnyEvent ];
-   }
-}</programlisting>
+<programlisting>
+rxvt-unicode.override {
+  configure = { availablePlugins, ... }: {
+    perlDeps = with perlPackages; [ AnyEvent ];
+  };
+}
+</programlisting>
  </para>

 </section>
@ -90,7 +103,8 @@ map (p: p.name) pkgs.rxvt-unicode.plugins
  <para>
   If the plugin is itself a perl package that needs to be imported from
   other plugins or scripts, add the following passthrough:
-   <programlisting>passthru.perlPackages = [ "self" ];
+<programlisting>
+passthru.perlPackages = [ "self" ];
 </programlisting>
   This will make the urxvt wrapper pick up the dependency and set up the perl
   path accordingly.
--- a/doc/contributing/submitting-changes.xml
+++ b/doc/contributing/submitting-changes.xml
@ -209,12 +209,12 @@ Additional information.
  </para>

 <programlisting>
-   (fetchpatch {
-     name = "CVE-2019-11068.patch";
-     url = "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch";
-     sha256 = "0pkpb4837km15zgg6h57bncp66d5lwrlvkr73h0lanywq7zrwhj8";
-   })
-  </programlisting>
+(fetchpatch {
+  name = "CVE-2019-11068.patch";
+  url = "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch";
+  sha256 = "0pkpb4837km15zgg6h57bncp66d5lwrlvkr73h0lanywq7zrwhj8";
+})
+</programlisting>

  <para>
   If a security fix applies to both master and a stable release then, similar to regular changes, they are preferably delivered via master first and cherry-picked to the release branch.
--- a/doc/languages-frameworks/beam.xml
+++ b/doc/languages-frameworks/beam.xml
@ -72,9 +72,9 @@
   To install any of those builders into your profile, refer to them by their attribute path <literal>beamPackages.rebar3</literal>:
  </para>

-  <screen>
-  <prompt>$ </prompt>nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA beamPackages.rebar3
-  </screen>
+<screen>
+<prompt>$ </prompt>nix-env -f &quot;&lt;nixpkgs&gt;&quot; -iA beamPackages.rebar3
+</screen>
 </section>

 <section xml:id="packaging-beam-applications">
--- a/doc/languages-frameworks/go.xml
+++ b/doc/languages-frameworks/go.xml
@ -38,11 +38,7 @@ pet = buildGoModule rec {

  vendorSha256 = "1879j77k96684wi554rkjxydrj8g3hpp0kvxz03sd8dmwr3lh83j"; <co xml:id='ex-buildGoModule-1' />

-  subPackages = [ "." ]; <co xml:id='ex-buildGoModule-2' />
-
-  deleteVendor = true; <co xml:id='ex-buildGoModule-3' />
-
-  runVend = true; <co xml:id='ex-buildGoModule-4' />
+  runVend = true; <co xml:id='ex-buildGoModule-2' />

  meta = with lib; {
    description = "Simple command-line snippet manager, written in Go";
@ -64,16 +60,6 @@ pet = buildGoModule rec {
     </para>
    </callout>
    <callout arearefs='ex-buildGoModule-2'>
-     <para>
-      <varname>subPackages</varname> limits the builder from building child packages that have not been listed. If <varname>subPackages</varname> is not specified, all child packages will be built.
-     </para>
-    </callout>
-    <callout arearefs='ex-buildGoModule-3'>
-     <para>
-      <varname>deleteVendor</varname> removes the pre-existing vendor directory and fetches the dependencies. This should only be used if the dependencies included in the vendor folder are broken or incomplete.
-     </para>
-    </callout>
-    <callout arearefs='ex-buildGoModule-4'>
     <para>
      <varname>runVend</varname> runs the vend command to generate the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build.
     </para>
@ -82,12 +68,7 @@ pet = buildGoModule rec {
  </para>

  <para>
-    <varname>vendorSha256</varname> can also take <varname>null</varname> as an input.
-
-    When `null` is used as a value, rather than fetching the dependencies
-    and vendoring them, we use the vendoring included within the source repo.
-    If you'd like to not have to update this field on dependency changes,
-    run `go mod vendor` in your source repo and set 'vendorSha256 = null;'
+   <varname>vendorSha256</varname> can also take <varname>null</varname> as an input. When `null` is used as a value, rather than fetching the dependencies and vendoring them, we use the vendoring included within the source repo. If you'd like to not have to update this field on dependency changes, run `go mod vendor` in your source repo and set 'vendorSha256 = null;'
  </para>
 </section>

@ -106,7 +87,6 @@ deis = buildGoPackage rec {
  version = "1.13.0";

  goPackagePath = "github.com/deis/deis"; <co xml:id='ex-buildGoPackage-1' />
-  subPackages = [ "client" ]; <co xml:id='ex-buildGoPackage-2' />

  src = fetchFromGitHub {
    owner = "deis";
@ -115,11 +95,7 @@ deis = buildGoPackage rec {
    sha256 = "1qv9lxqx7m18029lj8cw3k7jngvxs4iciwrypdy0gd2nnghc68sw";
  };

-  goDeps = ./deps.nix; <co xml:id='ex-buildGoPackage-3' />
-
-  deleteVendor = true; <co xml:id='ex-buildGoPackage-4' />
-
-  buildFlags = [ "--tags" "release" ]; <co xml:id='ex-buildGoPackage-5' />
+  goDeps = ./deps.nix; <co xml:id='ex-buildGoPackage-2' />
 }
 </programlisting>
  </example>
@ -133,28 +109,10 @@ deis = buildGoPackage rec {
     </para>
    </callout>
    <callout arearefs='ex-buildGoPackage-2'>
-     <para>
-      <varname>subPackages</varname> limits the builder from building child packages that have not been listed. If <varname>subPackages</varname> is not specified, all child packages will be built.
-     </para>
-     <para>
-      In this example only <literal>github.com/deis/deis/client</literal> will be built.
-     </para>
-    </callout>
-    <callout arearefs='ex-buildGoPackage-3'>
     <para>
      <varname>goDeps</varname> is where the Go dependencies of a Go program are listed as a list of package source identified by Go import path. It could be imported as a separate <varname>deps.nix</varname> file for readability. The dependency data structure is described below.
     </para>
    </callout>
-    <callout arearefs='ex-buildGoPackage-4'>
-     <para>
-      <varname>deleteVendor</varname> removes the pre-existing vendor directory. This should only be used if the dependencies included in the vendor folder are broken or incomplete.
-     </para>
-    </callout>
-    <callout arearefs='ex-buildGoPackage-5'>
-     <para>
-      <varname>buildFlags</varname> is a list of flags passed to the go build command.
-     </para>
-    </callout>
   </calloutlist>
  </para>

@ -221,4 +179,70 @@ done
 </screen>
  </para>
 </section>
+
+ <section xml:id="ssec-go-common-attributes">
+  <title>Attributes used by the builders</title>
+
+  <para>
+   Both <link xlink:href="#ssec-go-modules"><varname>buildGoModule</varname></link> and <link xlink:href="#ssec-go-modules"><varname>buildGoPackage</varname></link> can be tweaked to behave slightly differently, if the following attributes are used:
+  </para>
+
+  <variablelist>
+   <varlistentry xml:id="var-go-buildFlagsArray">
+    <term>
+     <varname>buildFlagsArray</varname> and <varname>buildFlags</varname>
+    </term>
+    <listitem>
+     <para>
+      These attributes set build flags supported by <varname>go build</varname>. We recommend using <varname>buildFlagsArray</varname>. The most common use case of these attributes is to make the resulting executable aware of its own version. For example:
+     </para>
+     <example xml:id='ex-goBuildFlags-nospaces'>
+      <title>buildFlagsArray</title>
+<programlisting>
+  buildFlagsArray = [
+    "-ldflags=-X main.Version=${version} -X main.Commit=${version}" <co xml:id='ex-goBuildFlags-1' />
+  ];
+</programlisting>
+     </example>
+     <calloutlist>
+      <callout arearefs='ex-goBuildFlags-1'>
+       <para>
+        Note: single quotes are not needed.
+       </para>
+      </callout>
+     </calloutlist>
+     <example xml:id='ex-goBuildFlags-noarray'>
+      <title>buildFlagsArray</title>
+<programlisting>
+  buildFlagsArray = ''
+    -ldflags=
+    -X main.Version=${version}
+    -X main.Commit=${version}
+  '';
+</programlisting>
+     </example>
+    </listitem>
+   </varlistentry>
+   <varlistentry xml:id="var-go-deleteVendor">
+    <term>
+     <varname>deleteVendor</varname>
+    </term>
+    <listitem>
+     <para>
+      Removes the pre-existing vendor directory. This should only be used if the dependencies included in the vendor folder are broken or incomplete.
+     </para>
+    </listitem>
+   </varlistentry>
+   <varlistentry xml:id="var-go-subPackages">
+    <term>
+     <varname>subPackages</varname>
+    </term>
+    <listitem>
+     <para>
+      Limits the builder from building child packages that have not been listed. If <varname>subPackages</varname> is not specified, all child packages will be built.
+     </para>
+    </listitem>
+   </varlistentry>
+  </variablelist>
+ </section>
 </section>
--- a/doc/languages-frameworks/perl.xml
+++ b/doc/languages-frameworks/perl.xml
@ -8,28 +8,28 @@

  <para>
   When executing a Perl script, it is possible you get an error such as <literal>./myscript.pl: bad interpreter: /usr/bin/perl: no such file or directory</literal>. This happens when the script expects Perl to be installed at <filename>/usr/bin/perl</filename>, which is not the case when using Perl from nixpkgs. You can fix the script by changing the first line to:
-  <programlisting>
-  #!/usr/bin/env perl
-  </programlisting>
+<programlisting>
+#!/usr/bin/env perl
+</programlisting>
  to take the Perl installation from the <literal>PATH</literal> environment variable, or invoke Perl directly with:
-  <screen>
-  <prompt>$ </prompt>perl ./myscript.pl
-  </screen>
+<screen>
+<prompt>$ </prompt>perl ./myscript.pl
+</screen>
  </para>

  <para>
   When the script is using a Perl library that is not installed globally, you might get an error such as <literal>Can't locate DB_File.pm in @INC (you may need to install the DB_File module)</literal>. In that case, you can use <command>nix-shell</command> to start an ad-hoc shell with that library installed, for instance:
-  <screen>
-  <prompt>$ </prompt>nix-shell -p perl perlPackages.DBFile --run ./myscript.pl
-  </screen>
+<screen>
+<prompt>$ </prompt>nix-shell -p perl perlPackages.DBFile --run ./myscript.pl
+</screen>
  </para>

  <para>
  If you are always using the script in places where <command>nix-shell</command> is available, you can embed the <command>nix-shell</command> invocation in the shebang like this:
-  <programlisting>
-  #!/usr/bin/env nix-shell
-  #! nix-shell -i perl -p perl perlPackages.DBFile
-  </programlisting>
+<programlisting>
+#!/usr/bin/env nix-shell
+#! nix-shell -i perl -p perl perlPackages.DBFile
+</programlisting>
  </para>
 </section>

@ -44,30 +44,30 @@
  <para>
   Perl packages from CPAN are defined in <link
 xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/perl-packages.nix"><filename>pkgs/top-level/perl-packages.nix</filename></link>, rather than <filename>pkgs/all-packages.nix</filename>. Most Perl packages are so straight-forward to build that they are defined here directly, rather than having a separate function for each package called from <filename>perl-packages.nix</filename>. However, more complicated packages should be put in a separate file, typically in <filename>pkgs/development/perl-modules</filename>. Here is an example of the former:
- <programlisting>
- ClassC3 = buildPerlPackage rec {
-   name = "Class-C3-0.21";
-   src = fetchurl {
-     url = "mirror://cpan/authors/id/F/FL/FLORA/${name}.tar.gz";
-     sha256 = "1bl8z095y4js66pwxnm7s853pi9czala4sqc743fdlnk27kq94gz";
-   };
- };
- </programlisting>
+<programlisting>
+ClassC3 = buildPerlPackage rec {
+  name = "Class-C3-0.21";
+  src = fetchurl {
+    url = "mirror://cpan/authors/id/F/FL/FLORA/${name}.tar.gz";
+    sha256 = "1bl8z095y4js66pwxnm7s853pi9czala4sqc743fdlnk27kq94gz";
+  };
+};
+</programlisting>
   Note the use of <literal>mirror://cpan/</literal>, and the <literal>${name}</literal> in the URL definition to ensure that the name attribute is consistent with the source that we’re actually downloading. Perl packages are made available in <filename>all-packages.nix</filename> through the variable <varname>perlPackages</varname>. For instance, if you have a package that needs <varname>ClassC3</varname>, you would typically write
- <programlisting>
- foo = import ../path/to/foo.nix {
-   inherit stdenv fetchurl ...;
-   inherit (perlPackages) ClassC3;
- };
- </programlisting>
+<programlisting>
+foo = import ../path/to/foo.nix {
+  inherit stdenv fetchurl ...;
+  inherit (perlPackages) ClassC3;
+};
+</programlisting>
   in <filename>all-packages.nix</filename>. You can test building a Perl package as follows:
- <screen>
- <prompt>$ </prompt>nix-build -A perlPackages.ClassC3
- </screen>
+<screen>
+<prompt>$ </prompt>nix-build -A perlPackages.ClassC3
+</screen>
   <varname>buildPerlPackage</varname> adds <literal>perl-</literal> to the start of the name attribute, so the package above is actually called <literal>perl-Class-C3-0.21</literal>. So to install it, you can say:
- <screen>
- <prompt>$ </prompt>nix-env -i perl-Class-C3
- </screen>
+<screen>
+<prompt>$ </prompt>nix-env -i perl-Class-C3
+</screen>
   (Of course you can also install using the attribute name: <literal>nix-env -i -A perlPackages.ClassC3</literal>.)
  </para>

@ -94,61 +94,61 @@

  <para>
   <varname>buildPerlPackage</varname> is built on top of <varname>stdenv</varname>, so everything can be customised in the usual way. For instance, the <literal>BerkeleyDB</literal> module has a <varname>preConfigure</varname> hook to generate a configuration file used by <filename>Makefile.PL</filename>:
- <programlisting>
- { buildPerlPackage, fetchurl, db }:
+<programlisting>
+{ buildPerlPackage, fetchurl, db }:

- buildPerlPackage rec {
-   name = "BerkeleyDB-0.36";
+buildPerlPackage rec {
+  name = "BerkeleyDB-0.36";

-   src = fetchurl {
-     url = "mirror://cpan/authors/id/P/PM/PMQS/${name}.tar.gz";
-     sha256 = "07xf50riarb60l1h6m2dqmql8q5dij619712fsgw7ach04d8g3z1";
-   };
+  src = fetchurl {
+    url = "mirror://cpan/authors/id/P/PM/PMQS/${name}.tar.gz";
+    sha256 = "07xf50riarb60l1h6m2dqmql8q5dij619712fsgw7ach04d8g3z1";
+  };

-   preConfigure = ''
-     echo "LIB = ${db.out}/lib" > config.in
-     echo "INCLUDE = ${db.dev}/include" >> config.in
-   '';
- }
- </programlisting>
+  preConfigure = ''
+    echo "LIB = ${db.out}/lib" > config.in
+    echo "INCLUDE = ${db.dev}/include" >> config.in
+  '';
+}
+</programlisting>
  </para>

  <para>
   Dependencies on other Perl packages can be specified in the <varname>buildInputs</varname> and <varname>propagatedBuildInputs</varname> attributes. If something is exclusively a build-time dependency, use <varname>buildInputs</varname>; if it’s (also) a runtime dependency, use <varname>propagatedBuildInputs</varname>. For instance, this builds a Perl module that has runtime dependencies on a bunch of other modules:
- <programlisting>
- ClassC3Componentised = buildPerlPackage rec {
-   name = "Class-C3-Componentised-1.0004";
-   src = fetchurl {
-     url = "mirror://cpan/authors/id/A/AS/ASH/${name}.tar.gz";
-     sha256 = "0xql73jkcdbq4q9m0b0rnca6nrlvf5hyzy8is0crdk65bynvs8q1";
-   };
-   propagatedBuildInputs = [
-     ClassC3 ClassInspector TestException MROCompat
-   ];
- };
- </programlisting>
+<programlisting>
+ClassC3Componentised = buildPerlPackage rec {
+  name = "Class-C3-Componentised-1.0004";
+  src = fetchurl {
+    url = "mirror://cpan/authors/id/A/AS/ASH/${name}.tar.gz";
+    sha256 = "0xql73jkcdbq4q9m0b0rnca6nrlvf5hyzy8is0crdk65bynvs8q1";
+  };
+  propagatedBuildInputs = [
+    ClassC3 ClassInspector TestException MROCompat
+  ];
+};
+</programlisting>
  </para>

  <para>
   On Darwin, if a script has too many <literal>-I<replaceable>dir</replaceable></literal> flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the <literal>shortenPerlShebang</literal> function from the <literal>postInstall</literal> phase:
- <programlisting>
- { stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:
+<programlisting>
+{ stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:

- ImageExifTool = buildPerlPackage {
-   pname = "Image-ExifTool";
-   version = "11.50";
+ImageExifTool = buildPerlPackage {
+  pname = "Image-ExifTool";
+  version = "11.50";

-   src = fetchurl {
-     url = "https://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-11.50.tar.gz";
-     sha256 = "0d8v48y94z8maxkmw1rv7v9m0jg2dc8xbp581njb6yhr7abwqdv3";
-   };
+  src = fetchurl {
+    url = "https://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-11.50.tar.gz";
+    sha256 = "0d8v48y94z8maxkmw1rv7v9m0jg2dc8xbp581njb6yhr7abwqdv3";
+  };

-   buildInputs = stdenv.lib.optional stdenv.isDarwin shortenPerlShebang;
-   postInstall = stdenv.lib.optional stdenv.isDarwin ''
-     shortenPerlShebang $out/bin/exiftool
-   '';
- };
- </programlisting>
+  buildInputs = stdenv.lib.optional stdenv.isDarwin shortenPerlShebang;
+  postInstall = stdenv.lib.optional stdenv.isDarwin ''
+    shortenPerlShebang $out/bin/exiftool
+  '';
+};
+</programlisting>
   This will remove the <literal>-I</literal> flags from the shebang line, rewrite them in the <literal>use lib</literal> form, and put them on the next line instead. This function can be given any number of Perl scripts as arguments; it will modify them in-place.
  </para>

@ -159,27 +159,27 @@
    Nix expressions for Perl packages can be generated (almost) automatically from CPAN. This is done by the program <command>nix-generate-from-cpan</command>, which can be installed as follows:
   </para>

- <screen>
- <prompt>$ </prompt>nix-env -i nix-generate-from-cpan
- </screen>
+<screen>
+<prompt>$ </prompt>nix-env -i nix-generate-from-cpan
+</screen>

   <para>
    This program takes a Perl module name, looks it up on CPAN, fetches and unpacks the corresponding package, and prints a Nix expression on standard output. For example:
- <screen>
- <prompt>$ </prompt>nix-generate-from-cpan XML::Simple
-   XMLSimple = buildPerlPackage rec {
-     name = "XML-Simple-2.22";
-     src = fetchurl {
-       url = "mirror://cpan/authors/id/G/GR/GRANTM/${name}.tar.gz";
-       sha256 = "b9450ef22ea9644ae5d6ada086dc4300fa105be050a2030ebd4efd28c198eb49";
-     };
-     propagatedBuildInputs = [ XMLNamespaceSupport XMLSAX XMLSAXExpat ];
-     meta = {
-       description = "An API for simple XML files";
-       license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
-     };
-   };
- </screen>
+<screen>
+<prompt>$ </prompt>nix-generate-from-cpan XML::Simple
+  XMLSimple = buildPerlPackage rec {
+    name = "XML-Simple-2.22";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/G/GR/GRANTM/${name}.tar.gz";
+      sha256 = "b9450ef22ea9644ae5d6ada086dc4300fa105be050a2030ebd4efd28c198eb49";
+    };
+    propagatedBuildInputs = [ XMLNamespaceSupport XMLSAX XMLSAXExpat ];
+    meta = {
+      description = "An API for simple XML files";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+</screen>
    The output can be pasted into <filename>pkgs/top-level/perl-packages.nix</filename> or wherever else you need it.
   </para>
  </section>
--- a/doc/languages-frameworks/qt.xml
+++ b/doc/languages-frameworks/qt.xml
@ -18,7 +18,7 @@ mkDerivation { <co xml:id='qt-default-nix-co-2' />

  buildInputs = [ qtbase ]; <co xml:id='qt-default-nix-co-3' />
 }
-   </programlisting>
+</programlisting>
 </example>

 <calloutlist>
--- a/doc/languages-frameworks/ruby.xml
+++ b/doc/languages-frameworks/ruby.xml
@ -12,14 +12,14 @@
 </para>

 <screen>
-<![CDATA[$ cd pkgs/servers/monitoring
-$ mkdir sensu
-$ cd sensu
-$ cat > Gemfile
+<prompt>$ </prompt>cd pkgs/servers/monitoring
+<prompt>$ </prompt>mkdir sensu
+<prompt>$ </prompt>cd sensu
+<prompt>$ </prompt>cat > Gemfile
 source 'https://rubygems.org'
 gem 'sensu'
-$ $(nix-build '<nixpkgs>' -A bundix --no-out-link)/bin/bundix --magic
-$ cat > default.nix
+<prompt>$ </prompt>$(nix-build '&lt;nixpkgs>' -A bundix --no-out-link)/bin/bundix --magic
+<prompt>$ </prompt>cat > default.nix
 { lib, bundlerEnv, ruby }:

 bundlerEnv rec {
@ -37,7 +37,7 @@ bundlerEnv rec {
    maintainers = with maintainers; [ theuni ];
    platforms   = platforms.unix;
  };
-}]]>
+}
 </screen>

 <para>
@ -49,17 +49,16 @@ bundlerEnv rec {
 </para>

 <screen>
-<![CDATA[$ cd pkgs/servers/monitoring/sensu
-$ nix-shell -p bundler --run 'bundle lock --update'
-$ nix-shell -p bundix --run 'bundix'
-]]>
+<prompt>$ </prompt>cd pkgs/servers/monitoring/sensu
+<prompt>$ </prompt>nix-shell -p bundler --run 'bundle lock --update'
+<prompt>$ </prompt>nix-shell -p bundix --run 'bundix'
 </screen>

 <para>
  For tools written in Ruby - i.e. where the desire is to install a package and then execute e.g. <command>rake</command> at the command line, there is an alternative builder called <literal>bundlerApp</literal>. Set up the <filename>gemset.nix</filename> the same way, and then, for example:
 </para>

-<screen>
+<programlisting>
 <![CDATA[{ lib, bundlerApp }:

 bundlerApp {
@ -75,7 +74,7 @@ bundlerApp {
    platforms   = platforms.unix;
  };
 }]]>
-</screen>
+</programlisting>

 <para>
  The chief advantage of <literal>bundlerApp</literal> over <literal>bundlerEnv</literal> is the executables introduced in the environment are precisely those selected in the <literal>exes</literal> list, as opposed to <literal>bundlerEnv</literal> which adds all the executables made available by gems in the gemset, which can mean e.g. <command>rspec</command> or <command>rake</command> in unpredictable versions available from various packages.
--- a/doc/languages-frameworks/texlive.xml
+++ b/doc/languages-frameworks/texlive.xml
@ -44,11 +44,11 @@ texlive.combine {
   <listitem>
    <para>
     You can list packages e.g. by <command>nix repl</command>.
-<programlisting><![CDATA[
-$ nix repl
-nix-repl> :l <nixpkgs>
-nix-repl> texlive.collection-<TAB>
-]]></programlisting>
+<programlisting>
+<prompt>$ </prompt>nix repl
+<prompt>nix-repl> </prompt>:l &lt;nixpkgs>
+<prompt>nix-repl> </prompt>texlive.collection-<keycap function="tab" />
+</programlisting>
    </para>
   </listitem>
   <listitem>
--- a/doc/manual.xml
+++ b/doc/manual.xml
@ -1,7 +1,7 @@
 <book xmlns="http://docbook.org/ns/docbook"
      xmlns:xi="http://www.w3.org/2001/XInclude">
 <info>
-  <title>Nixpkgs Users and Contributors Guide</title>
+  <title>Nixpkgs Manual</title>
  <subtitle>Version <xi:include href=".version" parse="text" />
  </subtitle>
 </info>
--- a/doc/stdenv/multiple-output.xml
+++ b/doc/stdenv/multiple-output.xml
@ -67,7 +67,7 @@
    <para>
     <command>nix-env</command> silenty disregards the outputs selected by the user, and instead installs the outputs from <varname>meta.outputsToInstall</varname>. For example,
    </para>
-<programlisting>$ nix-env -iA nixpkgs.coreutils.info</programlisting>
+<screen><prompt>$ </prompt>nix-env -iA nixpkgs.coreutils.info</screen>
    <para>
     installs the <literal>"out"</literal> output (<varname>coreutils.meta.outputsToInstall</varname> is <literal>[ "out" ]</literal>) instead of the requested <literal>"info"</literal>.
    </para>
--- a/doc/using/configuration.xml
+++ b/doc/using/configuration.xml
@ -66,7 +66,7 @@
   <listitem>
    <para>
     For allowing the build of a broken package once, you can use an environment variable for a single invocation of the nix tools:
-<programlisting>$ export NIXPKGS_ALLOW_BROKEN=1</programlisting>
+<screen><prompt>$ </prompt>export NIXPKGS_ALLOW_BROKEN=1</screen>
    </para>
   </listitem>
   <listitem>
@ -92,7 +92,7 @@
   <listitem>
    <para>
     For allowing the build of an unsupported package once, you can use an environment variable for a single invocation of the nix tools:
-<programlisting>$ export NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1</programlisting>
+<screen><prompt>$ </prompt>export NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1</screen>
    </para>
   </listitem>
   <listitem>
@ -122,7 +122,7 @@
   <listitem>
    <para>
     To temporarily allow all unfree packages, you can use an environment variable for a single invocation of the nix tools:
-<programlisting>$ export NIXPKGS_ALLOW_UNFREE=1</programlisting>
+<screen><prompt>$ </prompt>export NIXPKGS_ALLOW_UNFREE=1</screen>
    </para>
   </listitem>
   <listitem>
@ -187,7 +187,7 @@
   <listitem>
    <para>
     To temporarily allow all insecure packages, you can use an environment variable for a single invocation of the nix tools:
-<programlisting>$ export NIXPKGS_ALLOW_INSECURE=1</programlisting>
+<screen><prompt>$ </prompt>export NIXPKGS_ALLOW_INSECURE=1</screen>
    </para>
   </listitem>
   <listitem>
--- a/doc/using/overlays.xml
+++ b/doc/using/overlays.xml
@ -240,7 +240,7 @@ self: super:
    lapackProvider = self.mkl;
  }
 }
-     </programlisting>
+</programlisting>
     <para>
       This overlay uses Intel’s MKL library for both BLAS and LAPACK
       interfaces. Note that the same can be accomplished at runtime
@ -248,9 +248,9 @@ self: super:
       <literal>libblas.so.3</literal> and
       <literal>liblapack.so.3</literal>. For instance:
     </para>
-     <programlisting>
-$ LD_LIBRARY_PATH=$(nix-build -A mkl)/lib:$LD_LIBRARY_PATH nix-shell -p octave --run octave
-     </programlisting>
+<screen>
+<prompt>$ </prompt>LD_LIBRARY_PATH=$(nix-build -A mkl)/lib:$LD_LIBRARY_PATH nix-shell -p octave --run octave
+</screen>
     <para>
       Intel MKL requires an <literal>openmp</literal> implementation
       when running with multiple processors. By default,
@ -288,7 +288,7 @@ assert (!blas.isILP64) &amp;&amp; (!lapack.isILP64);
 stdenv.mkDerivation {
  ...
 }
-     </programlisting>
+</programlisting>
   </section>
 </section>
 </chapter>
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -117,7 +117,7 @@ rec {
        if config._module.check && config._module.freeformType == null && merged.unmatchedDefns != [] then
          let
            firstDef = head merged.unmatchedDefns;
-            baseMsg = "The option `${showOption (prefix ++ firstDef.prefix)}' defined in `${firstDef.file}' does not exist.";
+            baseMsg = "The option `${showOption (prefix ++ firstDef.prefix)}' does not exist. Definition values:${showDefs [ firstDef ]}";
          in
            if attrNames options == [ "_module" ]
              then throw ''
@ -449,7 +449,13 @@ rec {
      # Handle properties, check types, and merge everything together.
      res =
        if opt.readOnly or false && length defs' > 1 then
-          throw "The option `${showOption loc}' is read-only, but it's set multiple times."
+          let
+            # For a better error message, evaluate all readOnly definitions as
+            # if they were the only definition.
+            separateDefs = map (def: def // {
+              value = (mergeDefinitions loc opt.type [ def ]).mergedValue;
+            }) defs';
+          in throw "The option `${showOption loc}' is read-only, but it's set multiple times. Definition values:${showDefs separateDefs}"
        else
          mergeDefinitions loc opt.type defs';

@ -497,8 +503,8 @@ rec {
    mergedValue =
      if isDefined then
        if all (def: type.check def.value) defsFinal then type.merge loc defsFinal
-        else let firstInvalid = findFirst (def: ! type.check def.value) null defsFinal;
-        in throw "The option value `${showOption loc}' in `${firstInvalid.file}' is not of type `${type.description}'."
+        else let allInvalid = filter (def: ! type.check def.value) defsFinal;
+        in throw "A definition for option `${showOption loc}' is not of type `${type.description}'. Definition values:${showDefs allInvalid}"
      else
        # (nixos-option detects this specific error message and gives it special
        # handling.  If changed here, please change it there too.)
--- a/lib/options.nix
+++ b/lib/options.nix
@ -96,12 +96,12 @@ rec {
    else if all isBool list then foldl' lib.or false list
    else if all isString list then lib.concatStrings list
    else if all isInt list && all (x: x == head list) list then head list
-    else throw "Cannot merge definitions of `${showOption loc}' given in ${showFiles (getFiles defs)}.";
+    else throw "Cannot merge definitions of `${showOption loc}'. Definition values:${showDefs defs}";

  mergeOneOption = loc: defs:
    if defs == [] then abort "This case should never happen."
    else if length defs != 1 then
-      throw "The unique option `${showOption loc}' is defined multiple times, in:\n - ${concatStringsSep "\n - " (getFiles defs)}."
+      throw "The unique option `${showOption loc}' is defined multiple times. Definition values:${showDefs defs}"
    else (head defs).value;

  /* "Merge" option definitions by checking that they all have the same value. */
@ -111,11 +111,11 @@ rec {
    # This also makes it work for functions, because the foldl' below would try
    # to compare the first element with itself, which is false for functions
    else if length defs == 1 then (elemAt defs 0).value
-    else foldl' (val: def:
-      if def.value != val then
-        throw "The option `${showOption loc}' has conflicting definitions, in ${showFiles (getFiles defs)}."
+    else (foldl' (first: def:
+      if def.value != first.value then
+        throw "The option `${showOption loc}' has conflicting definition values:${showDefs [ first def ]}"
      else
-        val) (head defs).value defs;
+        first) (head defs) defs).value;

  /* Extracts values of all "value" keys of the given list.

@ -213,6 +213,24 @@ rec {
         else escaped;
    in (concatStringsSep ".") (map escapeOptionPart parts);
  showFiles = files: concatStringsSep " and " (map (f: "`${f}'") files);
+
+  showDefs = defs: concatMapStrings (def:
+    let
+      # Pretty print the value for display, if successful
+      prettyEval = builtins.tryEval (lib.generators.toPretty {} def.value);
+      # Split it into its lines
+      lines = filter (v: ! isList v) (builtins.split "\n" prettyEval.value);
+      # Only display the first 5 lines, and indent them for better visibility
+      value = concatStringsSep "\n    " (take 5 lines ++ optional (length lines > 5) "...");
+      result =
+        # Don't print any value if evaluating the value strictly fails
+        if ! prettyEval.success then ""
+        # Put it on a new line if it consists of multiple
+        else if length lines > 1 then ":\n    " + value
+        else ": " + value;
+    in "\n- In `${def.file}'${result}"
+  ) defs;
+
  unknownModule = "<unknown-file>";

 }
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -49,7 +49,7 @@ checkConfigError() {
        reportFailure "$@"
        return 1
    else
-        if echo "$err" | grep --silent "$errorContains" ; then
+        if echo "$err" | grep -zP --silent "$errorContains" ; then
            pass=$((pass + 1))
            return 0;
        else
@ -62,17 +62,17 @@ checkConfigError() {

 # Check boolean option.
 checkConfigOutput "false" config.enable ./declare-enable.nix
-checkConfigError 'The option .* defined in .* does not exist.' config.enable ./define-enable.nix
+checkConfigError 'The option .* does not exist. Definition values:\n- In .*: true' config.enable ./define-enable.nix

 # Check integer types.
 # unsigned
 checkConfigOutput "42" config.value ./declare-int-unsigned-value.nix ./define-value-int-positive.nix
-checkConfigError 'The option value .* in .* is not of type.*unsigned integer.*' config.value ./declare-int-unsigned-value.nix ./define-value-int-negative.nix
+checkConfigError 'A definition for option .* is not of type.*unsigned integer.*. Definition values:\n- In .*: -23' config.value ./declare-int-unsigned-value.nix ./define-value-int-negative.nix
 # positive
-checkConfigError 'The option value .* in .* is not of type.*positive integer.*' config.value ./declare-int-positive-value.nix ./define-value-int-zero.nix
+checkConfigError 'A definition for option .* is not of type.*positive integer.*. Definition values:\n- In .*: 0' config.value ./declare-int-positive-value.nix ./define-value-int-zero.nix
 # between
 checkConfigOutput "42" config.value ./declare-int-between-value.nix ./define-value-int-positive.nix
-checkConfigError 'The option value .* in .* is not of type.*between.*-21 and 43.*inclusive.*' config.value ./declare-int-between-value.nix ./define-value-int-negative.nix
+checkConfigError 'A definition for option .* is not of type.*between.*-21 and 43.*inclusive.*. Definition values:\n- In .*: -23' config.value ./declare-int-between-value.nix ./define-value-int-negative.nix

 # Check either types
 # types.either
@ -125,7 +125,7 @@ checkConfigOutput 'true' "$@" ./define-enable.nix ./define-attrsOfSub-foo-enable
 set -- config.enable ./define-enable.nix ./declare-enable.nix
 checkConfigOutput "true" "$@"
 checkConfigOutput "false" "$@" ./disable-define-enable.nix
-checkConfigError "The option .*enable.* defined in .* does not exist" "$@" ./disable-declare-enable.nix
+checkConfigError "The option .*enable.* does not exist. Definition values:\n- In .*: true" "$@" ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-define-enable.nix ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-enable-modules.nix

@ -142,17 +142,17 @@ checkConfigError 'infinite recursion encountered' "$@"

 # Check _module.check.
 set -- config.enable ./declare-enable.nix ./define-enable.nix ./define-attrsOfSub-foo.nix
-checkConfigError 'The option .* defined in .* does not exist.' "$@"
+checkConfigError 'The option .* does not exist. Definition values:\n- In .*' "$@"
 checkConfigOutput "true" "$@" ./define-module-check.nix

 # Check coerced value.
 checkConfigOutput "\"42\"" config.value ./declare-coerced-value.nix
 checkConfigOutput "\"24\"" config.value ./declare-coerced-value.nix ./define-value-string.nix
-checkConfigError 'The option value .* in .* is not.*string or signed integer convertible to it' config.value ./declare-coerced-value.nix ./define-value-list.nix
+checkConfigError 'A definition for option .* is not.*string or signed integer convertible to it.*. Definition values:\n- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix

 # Check coerced value with unsound coercion
 checkConfigOutput "12" config.value ./declare-coerced-value-unsound.nix
-checkConfigError 'The option value .* in .* is not.*8 bit signed integer.* or string convertible to it' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
+checkConfigError 'A definition for option .* is not of type .*. Definition values:\n- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
 checkConfigError 'unrecognised JSON value' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix

 # Check mkAliasOptionModule.
@ -183,7 +183,7 @@ checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.ni
 checkConfigOutput "true" config.enable ./disable-recursive/main.nix
 checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-foo.nix}
 checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-bar.nix}
-checkConfigError 'The option .* defined in .* does not exist' config.enable ./disable-recursive/{main.nix,disable-foo.nix,disable-bar.nix}
+checkConfigError 'The option .* does not exist. Definition values:\n- In .*: true' config.enable ./disable-recursive/{main.nix,disable-foo.nix,disable-bar.nix}

 # Check that imports can depend on derivations
 checkConfigOutput "true" config.enable ./import-from-store.nix
@ -207,7 +207,7 @@ checkConfigOutput "empty" config.value.foo ./declare-lazyAttrsOf.nix ./attrsOf-c


 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
-checkConfigError 'The option value .* in .* is not of type .*' \
+checkConfigError 'A definition for option .* is not of type .*' \
  config.value ./declare-int-unsigned-value.nix ./define-value-list.nix ./define-value-int-positive.nix

 ## Freeform modules
@ -216,7 +216,7 @@ checkConfigOutput 24 config.value ./freeform-attrsOf.nix ./define-value-string.n
 # No freeform assigments shouldn't make it error
 checkConfigOutput '{ }' config ./freeform-attrsOf.nix
 # but only if the type matches
-checkConfigError 'The option value .* in .* is not of type .*' config.value ./freeform-attrsOf.nix ./define-value-list.nix
+checkConfigError 'A definition for option .* is not of type .*' config.value ./freeform-attrsOf.nix ./define-value-list.nix
 # and properties should be applied
 checkConfigOutput yes config.value ./freeform-attrsOf.nix ./define-value-string-properties.nix
 # Options should still be declarable, and be able to have a type that doesn't match the freeform type
@ -251,7 +251,7 @@ checkConfigOutput / config.value.path ./types-anything/equal-atoms.nix
 checkConfigOutput null config.value.null ./types-anything/equal-atoms.nix
 checkConfigOutput 0.1 config.value.float ./types-anything/equal-atoms.nix
 # Functions can't be merged together
-checkConfigError "The option .* has conflicting definitions" config.value.multiple-lambdas ./types-anything/functions.nix
+checkConfigError "The option .* has conflicting definition values" config.value.multiple-lambdas ./types-anything/functions.nix
 checkConfigOutput '<LAMBDA>' config.value.single-lambda ./types-anything/functions.nix
 # Check that all mk* modifiers are applied
 checkConfigError 'attribute .* not found' config.value.mkiffalse ./types-anything/mk-mods.nix
--- a/lib/types.nix
+++ b/lib/types.nix
@ -299,16 +299,14 @@ rec {
      check = isList;
      merge = loc: defs:
        map (x: x.value) (filter (x: x ? value) (concatLists (imap1 (n: def:
-          if isList def.value then
-            imap1 (m: def':
-              (mergeDefinitions
-                (loc ++ ["[definition ${toString n}-entry ${toString m}]"])
-                elemType
-                [{ inherit (def) file; value = def'; }]
-              ).optionalValue
-            ) def.value
-          else
-            throw "The option value `${showOption loc}` in `${def.file}` is not a list.") defs)));
+          imap1 (m: def':
+            (mergeDefinitions
+              (loc ++ ["[definition ${toString n}-entry ${toString m}]"])
+              elemType
+              [{ inherit (def) file; value = def'; }]
+            ).optionalValue
+          ) def.value
+        ) defs)));
      emptyValue = { value = {}; };
      getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["*"]);
      getSubModules = elemType.getSubModules;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3149,6 +3149,12 @@
    githubId = 3217744;
    name = "Peter Ferenczy";
  };
+  ghuntley = {
+    email = "ghuntley@ghuntley.com";
+    github = "ghuntley";
+    githubId = 127353;
+    name = "Geoffrey Huntley";
+  };
  gila = {
    email = "jeffry.molanus@gmail.com";
    github = "gila";
@ -3739,6 +3745,12 @@
    githubId = 5283991;
    name = "Jake Waksbaum";
  };
+  jamiemagee = {
+    email = "jamie.magee@gmail.com";
+    github = "JamieMagee";
+    githubId = 1358764;
+    name = "Jamie Magee";
+  };
  jammerful = {
    email = "jammerful@gmail.com";
    github = "jammerful";
--- a/nixos/doc/manual/administration/imperative-containers.xml
+++ b/nixos/doc/manual/administration/imperative-containers.xml
@ -14,18 +14,18 @@
 <para>
  You create a container with identifier <literal>foo</literal> as follows:
 <screen>
-# nixos-container create foo
+<prompt># </prompt>nixos-container create <replaceable>foo</replaceable>
 </screen>
  This creates the container’s root directory in
-  <filename>/var/lib/containers/foo</filename> and a small configuration file
-  in <filename>/etc/containers/foo.conf</filename>. It also builds the
+  <filename>/var/lib/containers/<replaceable>foo</replaceable></filename> and a small configuration file
+  in <filename>/etc/containers/<replaceable>foo</replaceable>.conf</filename>. It also builds the
  container’s initial system configuration and stores it in
-  <filename>/nix/var/nix/profiles/per-container/foo/system</filename>. You can
+  <filename>/nix/var/nix/profiles/per-container/<replaceable>foo</replaceable>/system</filename>. You can
  modify the initial configuration of the container on the command line. For
  instance, to create a container that has <command>sshd</command> running,
  with the given public key for <literal>root</literal>:
 <screen>
-# nixos-container create foo --config '
+<prompt># </prompt>nixos-container create <replaceable>foo</replaceable> --config '
  <xref linkend="opt-services.openssh.enable"/> = true;
  <link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
 '
@ -34,7 +34,7 @@
  as container IP. This behavior can be altered by setting <literal>--host-address</literal> and
  <literal>--local-address</literal>:
 <screen>
-# nixos-container create test --config-file test-container.nix \
+<prompt># </prompt>nixos-container create test --config-file test-container.nix \
    --local-address 10.235.1.2 --host-address 10.235.1.1
 </screen>
 </para>
@ -42,7 +42,7 @@
 <para>
  Creating a container does not start it. To start the container, run:
 <screen>
-# nixos-container start foo
+<prompt># </prompt>nixos-container start <replaceable>foo</replaceable>
 </screen>
  This command will return as soon as the container has booted and has reached
  <literal>multi-user.target</literal>. On the host, the container runs within
@ -51,7 +51,7 @@
  Thus, if something went wrong, you can get status info using
  <command>systemctl</command>:
 <screen>
-# systemctl status container@foo
+<prompt># </prompt>systemctl status container@<replaceable>foo</replaceable>
 </screen>
 </para>

@ -59,22 +59,22 @@
  If the container has started successfully, you can log in as root using the
  <command>root-login</command> operation:
 <screen>
-# nixos-container root-login foo
-[root@foo:~]#
+<prompt># </prompt>nixos-container root-login <replaceable>foo</replaceable>
+<prompt>[root@foo:~]#</prompt>
 </screen>
  Note that only root on the host can do this (since there is no
  authentication). You can also get a regular login prompt using the
  <command>login</command> operation, which is available to all users on the
  host:
 <screen>
-# nixos-container login foo
+<prompt># </prompt>nixos-container login <replaceable>foo</replaceable>
 foo login: alice
 Password: ***
 </screen>
  With <command>nixos-container run</command>, you can execute arbitrary
  commands in the container:
 <screen>
-# nixos-container run foo -- uname -a
+<prompt># </prompt>nixos-container run <replaceable>foo</replaceable> -- uname -a
 Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
 </screen>
 </para>
@ -85,18 +85,18 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
  <literal>/var/lib/container/<replaceable>name</replaceable>/etc/nixos/configuration.nix</literal>,
  and run
 <screen>
-# nixos-container update foo
+<prompt># </prompt>nixos-container update <replaceable>foo</replaceable>
 </screen>
  This will build and activate the new configuration. You can also specify a
  new configuration on the command line:
 <screen>
-# nixos-container update foo --config '
+<prompt># </prompt>nixos-container update <replaceable>foo</replaceable> --config '
  <xref linkend="opt-services.httpd.enable"/> = true;
  <xref linkend="opt-services.httpd.adminAddr"/> = "foo@example.org";
  <xref linkend="opt-networking.firewall.allowedTCPPorts"/> = [ 80 ];
 '

-# curl http://$(nixos-container show-ip foo)/
+<prompt># </prompt>curl http://$(nixos-container show-ip <replaceable>foo</replaceable>)/
 &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">…
 </screen>
  However, note that this will overwrite the container’s
@ -117,7 +117,7 @@ Linux foo 3.4.82 #1-NixOS SMP Thu Mar 20 14:44:05 UTC 2014 x86_64 GNU/Linux
  by using <command>systemctl</command> on the container’s service unit. To
  destroy a container, including its file system, do
 <screen>
-# nixos-container destroy foo
+<prompt># </prompt>nixos-container destroy <replaceable>foo</replaceable>
 </screen>
 </para>
 </section>
--- a/nixos/doc/manual/administration/maintenance-mode.xml
+++ b/nixos/doc/manual/administration/maintenance-mode.xml
@ -8,7 +8,7 @@
 <para>
  You can enter rescue mode by running:
 <screen>
-# systemctl rescue</screen>
+<prompt># </prompt>systemctl rescue</screen>
  This will eventually give you a single-user root shell. Systemd will stop
  (almost) all system services. To get out of maintenance mode, just exit from
  the rescue shell.
--- a/nixos/doc/manual/administration/network-problems.xml
+++ b/nixos/doc/manual/administration/network-problems.xml
@ -16,12 +16,12 @@
  disable the use of the binary cache by adding <option>--option
  use-binary-caches false</option>, e.g.
 <screen>
-# nixos-rebuild switch --option use-binary-caches false
+<prompt># </prompt>nixos-rebuild switch --option use-binary-caches false
 </screen>
  If you have an alternative binary cache at your disposal, you can use it
  instead:
 <screen>
-# nixos-rebuild switch --option binary-caches http://my-cache.example.org/
+<prompt># </prompt>nixos-rebuild switch --option binary-caches <replaceable>http://my-cache.example.org/</replaceable>
 </screen>
 </para>
 </section>
--- a/nixos/doc/manual/administration/rebooting.xml
+++ b/nixos/doc/manual/administration/rebooting.xml
@ -7,20 +7,20 @@
 <para>
  The system can be shut down (and automatically powered off) by doing:
 <screen>
-# shutdown
+<prompt># </prompt>shutdown
 </screen>
  This is equivalent to running <command>systemctl poweroff</command>.
 </para>
 <para>
  To reboot the system, run
 <screen>
-# reboot
+<prompt># </prompt>reboot
 </screen>
  which is equivalent to <command>systemctl reboot</command>. Alternatively,
  you can quickly reboot the system using <literal>kexec</literal>, which
  bypasses the BIOS by directly loading the new kernel into memory:
 <screen>
-# systemctl kexec
+<prompt># </prompt>systemctl kexec
 </screen>
 </para>
 <para>
--- a/nixos/doc/manual/administration/rollback.xml
+++ b/nixos/doc/manual/administration/rollback.xml
@ -20,16 +20,16 @@
  has booted, you can make the selected configuration the default for
  subsequent boots:
 <screen>
-# /run/current-system/bin/switch-to-configuration boot</screen>
+<prompt># </prompt>/run/current-system/bin/switch-to-configuration boot</screen>
 </para>

 <para>
  Second, you can switch to the previous configuration in a running system:
 <screen>
-# nixos-rebuild switch --rollback</screen>
+<prompt># </prompt>nixos-rebuild switch --rollback</screen>
  This is equivalent to running:
 <screen>
-# /nix/var/nix/profiles/system-<replaceable>N</replaceable>-link/bin/switch-to-configuration switch</screen>
+<prompt># </prompt>/nix/var/nix/profiles/system-<replaceable>N</replaceable>-link/bin/switch-to-configuration switch</screen>
  where <replaceable>N</replaceable> is the number of the NixOS system
  configuration. To get a list of the available configurations, do:
 <screen>
--- a/nixos/doc/manual/administration/service-mgmt.xml
+++ b/nixos/doc/manual/administration/service-mgmt.xml
@ -58,9 +58,9 @@ Jan 07 15:55:57 hagbard systemd[1]: Started PostgreSQL Server.
 <para>
  Units can be stopped, started or restarted:
 <screen>
-# systemctl stop postgresql.service
-# systemctl start postgresql.service
-# systemctl restart postgresql.service
+<prompt># </prompt>systemctl stop postgresql.service
+<prompt># </prompt>systemctl start postgresql.service
+<prompt># </prompt>systemctl restart postgresql.service
 </screen>
  These operations are synchronous: they wait until the service has finished
  starting or stopping (or has failed). Starting a unit will cause the
--- a/nixos/doc/manual/administration/user-sessions.xml
+++ b/nixos/doc/manual/administration/user-sessions.xml
@ -39,7 +39,7 @@ c3 - root (0)
  can terminate a session in a way that ensures that all the session’s
  processes are gone:
 <screen>
-# loginctl terminate-session c3
+<prompt># </prompt>loginctl terminate-session c3
 </screen>
 </para>
 </chapter>
--- a/nixos/doc/manual/configuration/adding-custom-packages.xml
+++ b/nixos/doc/manual/configuration/adding-custom-packages.xml
@ -25,7 +25,7 @@ xlink:href="https://nixos.org/nixpkgs/manual">Nixpkgs
  and you run <command>nixos-rebuild</command>, specifying your own Nixpkgs
  tree:
 <screen>
-# nixos-rebuild switch -I nixpkgs=/path/to/my/nixpkgs</screen>
+<prompt># </prompt>nixos-rebuild switch -I nixpkgs=/path/to/my/nixpkgs</screen>
 </para>

 <para>
--- a/nixos/doc/manual/configuration/linux-kernel.xml
+++ b/nixos/doc/manual/configuration/linux-kernel.xml
@ -126,13 +126,13 @@ nixpkgs.config.packageOverrides = pkgs:
   <literal>mellanox</literal> drivers.
  </para>

-<screen><![CDATA[
-$ nix-build '<nixpkgs>' -A linuxPackages.kernel.dev
-$ nix-shell '<nixpkgs>' -A linuxPackages.kernel
-$ unpackPhase
-$ cd linux-*
-$ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
-# insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
-]]></screen>
+<screen>
+<prompt>$ </prompt>nix-build '&lt;nixpkgs>' -A linuxPackages.kernel.dev
+<prompt>$ </prompt>nix-shell '&lt;nixpkgs>' -A linuxPackages.kernel
+<prompt>$ </prompt>unpackPhase
+<prompt>$ </prompt>cd linux-*
+<prompt>$ </prompt>make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
+<prompt># </prompt>insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
+</screen>
 </section>
 </chapter>
--- a/nixos/doc/manual/configuration/luks-file-systems.xml
+++ b/nixos/doc/manual/configuration/luks-file-systems.xml
@ -11,7 +11,7 @@
  you create an encrypted Ext4 file system on the device
  <filename>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</filename>:
 <screen>
-# cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d
+<prompt># </prompt>cryptsetup luksFormat <replaceable>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</replaceable>

 WARNING!
 ========
@ -21,17 +21,17 @@ Are you sure? (Type uppercase yes): YES
 Enter LUKS passphrase: ***
 Verify passphrase: ***

-# cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted
+<prompt># </prompt>cryptsetup luksOpen <replaceable>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</replaceable> <replaceable>crypted</replaceable>
 Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***

-# mkfs.ext4 /dev/mapper/crypted
+<prompt># </prompt>mkfs.ext4 /dev/mapper/<replaceable>crypted</replaceable>
 </screen>
  To ensure that this file system is automatically mounted at boot time as
  <filename>/</filename>, add the following to
  <filename>configuration.nix</filename>:
 <programlisting>
-<link linkend="opt-boot.initrd.luks.devices._name_.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
-<xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/crypted";
+<link linkend="opt-boot.initrd.luks.devices._name_.device">boot.initrd.luks.devices.crypted.device</link> = "<replaceable>/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d</replaceable>";
+<xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/<replaceable>crypted</replaceable>";
 </programlisting>
  Should grub be used as bootloader, and <filename>/boot</filename> is located
  on an encrypted partition, it is necessary to add the following grub option:
@ -45,11 +45,11 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
   and add it as a new key to our existing device <filename>/dev/sda2</filename>:

   <screen>
-# export FIDO2_LABEL="/dev/sda2 @ $HOSTNAME"
-# fido2luks credential "$FIDO2_LABEL"
+<prompt># </prompt>export FIDO2_LABEL="<replaceable>/dev/sda2</replaceable> @ $HOSTNAME"
+<prompt># </prompt>fido2luks credential "$FIDO2_LABEL"
 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7

-# fido2luks -i add-key /dev/sda2 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7
+<prompt># </prompt>fido2luks -i add-key <replaceable>/dev/sda2</replaceable> <replaceable>f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7</replaceable>
 Password:
 Password (again):
 Old password:
@ -60,13 +60,13 @@ Added to key to device /dev/sda2, slot: 2
  To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>:
 <programlisting>
 <link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true;
-<link linkend="opt-boot.initrd.luks.devices._name_.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
+<link linkend="opt-boot.initrd.luks.devices._name_.fido2.credential">boot.initrd.luks.devices."<replaceable>/dev/sda2</replaceable>".fido2.credential</link> = "<replaceable>f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7</replaceable>";
 </programlisting>

  You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>.

 <programlisting>
-<link linkend="opt-boot.initrd.luks.devices._name_.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
+<link linkend="opt-boot.initrd.luks.devices._name_.fido2.passwordLess">boot.initrd.luks.devices."<replaceable>/dev/sda2</replaceable>".fido2.passwordLess</link> = true;
 </programlisting>
  </para>
 </section>
--- a/nixos/doc/manual/configuration/user-mgmt.xml
+++ b/nixos/doc/manual/configuration/user-mgmt.xml
@ -62,24 +62,24 @@ uid = 1000;
  <command>useradd</command>, <command>groupmod</command> and so on. For
  instance, to create a user account named <literal>alice</literal>:
 <screen>
-# useradd -m alice</screen>
+<prompt># </prompt>useradd -m <replaceable>alice</replaceable></screen>
  To make all nix tools available to this new user use `su - USER` which opens
  a login shell (==shell that loads the profile) for given user. This will
  create the ~/.nix-defexpr symlink. So run:
 <screen>
-# su - alice -c "true"</screen>
+<prompt># </prompt>su - <replaceable>alice</replaceable> -c "true"</screen>
  The flag <option>-m</option> causes the creation of a home directory for the
  new user, which is generally what you want. The user does not have an initial
  password and therefore cannot log in. A password can be set using the
  <command>passwd</command> utility:
 <screen>
-# passwd alice
+<prompt># </prompt>passwd <replaceable>alice</replaceable>
 Enter new UNIX password: ***
 Retype new UNIX password: ***
 </screen>
  A user can be deleted using <command>userdel</command>:
 <screen>
-# userdel -r alice</screen>
+<prompt># </prompt>userdel -r <replaceable>alice</replaceable></screen>
  The flag <option>-r</option> deletes the user’s home directory. Accounts
  can be modified using <command>usermod</command>. Unix groups can be managed
  using <command>groupadd</command>, <command>groupmod</command> and
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@ -58,7 +58,7 @@
 </programlisting>
  The X server can then be started manually:
 <screen>
-# systemctl start display-manager.service
+<prompt># </prompt>systemctl start display-manager.service
 </screen>
 </para>
 <para>
--- a/nixos/doc/manual/development/meta-attributes.xml
+++ b/nixos/doc/manual/development/meta-attributes.xml
@ -57,7 +57,7 @@
      linkend="ch-configuration"/>. Changes to a module documentation
    have to be checked to not break building the NixOS manual:
   </para>
-<programlisting>$ nix-build nixos/release.nix -A manual</programlisting>
+<screen><prompt>$ </prompt>nix-build nixos/release.nix -A manual</screen>
  </callout>
 </calloutlist>
 </section>
--- a/nixos/doc/manual/development/writing-documentation.xml
+++ b/nixos/doc/manual/development/writing-documentation.xml
@ -24,8 +24,8 @@
  </para>

 <screen>
-  $ cd /path/to/nixpkgs/nixos/doc/manual
-  $ make
+<prompt>$ </prompt>cd /path/to/nixpkgs/nixos/doc/manual
+<prompt>$ </prompt>make
 </screen>

  <para>
--- a/nixos/doc/manual/installation/installing-behind-a-proxy.xml
+++ b/nixos/doc/manual/installation/installing-behind-a-proxy.xml
@ -27,13 +27,13 @@ networking.proxy.noProxy = &quot;127.0.0.1,localhost,internal.domain&quot;;
    Setup the proxy environment variables in the shell where you are running
    <literal>nixos-install</literal>.
   </para>
-<programlisting>
-# proxy_url=&quot;http://user:password@proxy:port/&quot;
-# export http_proxy=&quot;$proxy_url&quot;
-# export HTTP_PROXY=&quot;$proxy_url&quot;
-# export https_proxy=&quot;$proxy_url&quot;
-# export HTTPS_PROXY=&quot;$proxy_url&quot;
-</programlisting>
+<screen>
+<prompt># </prompt>proxy_url=&quot;http://user:password@proxy:port/&quot;
+<prompt># </prompt>export http_proxy=&quot;$proxy_url&quot;
+<prompt># </prompt>export HTTP_PROXY=&quot;$proxy_url&quot;
+<prompt># </prompt>export https_proxy=&quot;$proxy_url&quot;
+<prompt># </prompt>export HTTPS_PROXY=&quot;$proxy_url&quot;
+</screen>
  </listitem>
 </orderedlist>

--- a/nixos/doc/manual/installation/installing-from-other-distro.xml
+++ b/nixos/doc/manual/installation/installing-from-other-distro.xml
@ -325,14 +325,14 @@ sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot
    to boot on a USB rescue disk and do something along these lines:
   </para>
 <screen>
-# mkdir root
-# mount /dev/sdaX root
-# mkdir root/nixos-root
-# mv -v root/* root/nixos-root/
-# mv -v root/nixos-root/old-root/* root/
-# mv -v root/boot.bak root/boot  # We had renamed this by hand earlier
-# umount root
-# reboot</screen>
+<prompt># </prompt>mkdir root
+<prompt># </prompt>mount /dev/sdaX root
+<prompt># </prompt>mkdir root/nixos-root
+<prompt># </prompt>mv -v root/* root/nixos-root/
+<prompt># </prompt>mv -v root/nixos-root/old-root/* root/
+<prompt># </prompt>mv -v root/boot.bak root/boot  # We had renamed this by hand earlier
+<prompt># </prompt>umount root
+<prompt># </prompt>reboot</screen>
   <para>
    This may work as is or you might also need to reinstall the boot loader
   </para>
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@ -67,32 +67,32 @@
  <literal>nixos-20.03</literal> channel. To see which NixOS channel you’re
  subscribed to, run the following as root:
 <screen>
-# nix-channel --list | grep nixos
+<prompt># </prompt>nix-channel --list | grep nixos
 nixos https://nixos.org/channels/nixos-unstable
 </screen>
  To switch to a different NixOS channel, do
 <screen>
-# nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
 </screen>
  (Be sure to include the <literal>nixos</literal> parameter at the end.) For
  instance, to use the NixOS 20.03 stable channel:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-20.03 nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.03 nixos
 </screen>
  If you have a server, you may want to use the “small” channel instead:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-20.03-small nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.03-small nixos
 </screen>
  And if you want to live on the bleeding edge:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-unstable nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-unstable nixos
 </screen>
 </para>
 <para>
  You can then upgrade NixOS to the latest version in your chosen channel by
  running
 <screen>
-# nixos-rebuild switch --upgrade
+<prompt># </prompt>nixos-rebuild switch --upgrade
 </screen>
  which is equivalent to the more verbose <literal>nix-channel --update nixos;
  nixos-rebuild switch</literal>.
--- a/nixos/doc/manual/man-nixos-enter.xml
+++ b/nixos/doc/manual/man-nixos-enter.xml
@ -136,13 +136,13 @@
   <filename>/mnt</filename>:
  </para>
 <screen>
-# nixos-enter --root /mnt
+<prompt># </prompt>nixos-enter --root /mnt
 </screen>
  <para>
   Run a shell command:
  </para>
 <screen>
-# nixos-enter -c 'ls -l /; cat /proc/mounts'
+<prompt># </prompt>nixos-enter -c 'ls -l /; cat /proc/mounts'
 </screen>
  <para>
   Run a non-shell command:
--- a/nixos/doc/manual/man-nixos-version.xml
+++ b/nixos/doc/manual/man-nixos-version.xml
@ -33,7 +33,7 @@
  <para>
   This command shows the version of the currently active NixOS configuration.
   For example:
-<screen>$ nixos-version
+<screen><prompt>$ </prompt>nixos-version
 16.03.1011.6317da4 (Emu)
 </screen>
   The version consists of the following elements:
@ -111,7 +111,7 @@
     <para>
      Show the full SHA1 hash of the Git commit from which this configuration
      was built, e.g.
-<screen>$ nixos-version --hash
+<screen><prompt>$ </prompt>nixos-version --hash
 6317da40006f6bc2480c6781999c52d88dde2acf
 </screen>
     </para>
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -2,6 +2,11 @@ pkgs: with pkgs.lib;

 rec {

+  # Copy configuration files to avoid having the entire sources in the system closure
+  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
+    cp ${filePath} $out
+  '';
+
  # Check whenever fileSystem is needed for boot.  NOTE: Make sure
  # pathsNeededForBoot is closed under the parent relationship, i.e. if /a/b/c
  # is in the list, put /a and /a/b in as well.
--- a/nixos/modules/hardware/system-76.nix
+++ b/nixos/modules/hardware/system-76.nix
@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkOption mkEnableOption types mkIf mkMerge optional versionOlder;
+  cfg = config.hardware.system76;
+
+  kpkgs = config.boot.kernelPackages;
+  modules = [ "system76" "system76-io" ] ++ (optional (versionOlder kpkgs.kernel.version "5.5") "system76-acpi");
+  modulePackages = map (m: kpkgs.${m}) modules;
+  moduleConfig = mkIf cfg.kernel-modules.enable {
+    boot.extraModulePackages = modulePackages;
+
+    boot.kernelModules = modules;
+
+    services.udev.packages = modulePackages;
+  };
+
+  firmware-pkg = pkgs.system76-firmware;
+  firmwareConfig = mkIf cfg.firmware-daemon.enable {
+    services.dbus.packages = [ firmware-pkg ];
+
+    systemd.services.system76-firmware-daemon = {
+      description = "The System76 Firmware Daemon";
+
+      serviceConfig = {
+        ExecStart = "${firmware-pkg}/bin/system76-firmware-daemon";
+
+        Restart = "on-failure";
+      };
+
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+in {
+  options = {
+    hardware.system76 = {
+      enableAll = mkEnableOption "all recommended configuration for system76 systems";
+
+      firmware-daemon.enable = mkOption {
+        default = cfg.enableAll;
+        example = true;
+        description = "Whether to enable the system76 firmware daemon";
+        type = types.bool;
+      };
+
+      kernel-modules.enable = mkOption {
+        default = cfg.enableAll;
+        example = true;
+        description = "Whether to make the system76 out-of-tree kernel modules available";
+        type = types.bool;
+      };
+    };
+  };
+
+  config = mkMerge [ moduleConfig firmwareConfig ];
+}
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -16,6 +16,8 @@ let
        kernelPackages.nvidia_x11
    else if elem "nvidiaBeta" drivers then
        kernelPackages.nvidia_x11_beta
+    else if elem "nvidiaVulkanBeta" drivers then
+        kernelPackages.nvidia_x11_vulkan_beta
    else if elem "nvidiaLegacy304" drivers then
      kernelPackages.nvidia_x11_legacy304
    else if elem "nvidiaLegacy340" drivers then
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -60,6 +60,7 @@
  ./hardware/printers.nix
  ./hardware/raid/hpsa.nix
  ./hardware/steam-hardware.nix
+  ./hardware/system-76.nix
  ./hardware/tuxedo-keyboard.nix
  ./hardware/usb-wwan.nix
  ./hardware/onlykey.nix
--- a/nixos/modules/services/backup/borgbackup.xml
+++ b/nixos/modules/services/backup/borgbackup.xml
@ -69,10 +69,10 @@
    access this single repository. You need the output of the generate pub file.
  </para>
    <para>
-        <programlisting>
-# sudo ssh-keygen -N '' -t ed25519 -f /run/keys/id_ed25519_my_borg_repo
-# cat /run/keys/id_ed25519_my_borg_repo
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID78zmOyA+5uPG4Ot0hfAy+sLDPU1L4AiIoRYEIVbbQ/ root@nixos</programlisting>
+<screen>
+<prompt># </prompt>sudo ssh-keygen -N '' -t ed25519 -f /run/keys/id_ed25519_my_borg_repo
+<prompt># </prompt>cat /run/keys/id_ed25519_my_borg_repo
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID78zmOyA+5uPG4Ot0hfAy+sLDPU1L4AiIoRYEIVbbQ/ root@nixos</screen>
    </para>
    <para>
      Add the following snippet to your NixOS configuration:
--- a/nixos/modules/services/web-apps/codimd.nix
+++ b/nixos/modules/services/web-apps/codimd.nix
@ -877,6 +877,37 @@ in
        description = "Configure the SAML integration.";
      };
    };
+
+
+    environmentFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = "/var/lib/codimd/codimd.env";
+      description = ''
+        Environment file as defined in <citerefentry>
+        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+        </citerefentry>.
+
+        Secrets may be passed to the service without adding them to the world-readable
+        Nix store, by specifying placeholder variables as the option value in Nix and
+        setting these variables accordingly in the environment file.
+
+        <programlisting>
+          # snippet of CodiMD-related config
+          services.codimd.configuration.dbURL = "postgres://codimd:\''${DB_PASSWORD}@db-host:5432/codimddb";
+          services.codimd.configuration.minio.secretKey = "$MINIO_SECRET_KEY";
+        </programlisting>
+
+        <programlisting>
+          # content of the environment file
+          DB_PASSWORD=verysecretdbpassword
+          MINIO_SECRET_KEY=verysecretminiokey
+        </programlisting>
+
+        Note that this file needs to be available on the host on which
+        <literal>CodiMD</literal> is running.
+      '';
+    };
  };

  config = mkIf cfg.enable {
@ -900,11 +931,17 @@ in
      description = "CodiMD Service";
      wantedBy = [ "multi-user.target" ];
      after = [ "networking.target" ];
+      preStart = ''
+        ${pkgs.envsubst}/bin/envsubst \
+          -o ${cfg.workDir}/config.json \
+          -i ${prettyJSON cfg.configuration}
+      '';
      serviceConfig = {
        WorkingDirectory = cfg.workDir;
        ExecStart = "${pkgs.codimd}/bin/codimd";
+        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
        Environment = [
-          "CMD_CONFIG_FILE=${prettyJSON cfg.configuration}"
+          "CMD_CONFIG_FILE=${cfg.workDir}/config.json"
          "NODE_ENV=production"
        ];
        Restart = "always";
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -159,9 +159,9 @@ in
        To switch to a specialised configuration
        (e.g. <literal>fewJobsManyCores</literal>) at runtime, run:

-        <programlisting>
-        # sudo /run/current-system/specialisation/fewJobsManyCores/bin/switch-to-configuration test
-        </programlisting>
+        <screen>
+        <prompt># </prompt>sudo /run/current-system/specialisation/fewJobsManyCores/bin/switch-to-configuration test
+        </screen>
      '';
      type = types.attrsOf (types.submodule (
        { ... }: {
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -218,6 +218,7 @@ done
 # Create device nodes in /dev.
@preDeviceCommands@
 echo "running udev..."
+ln -sfn /proc/self/fd /dev/fd
 mkdir -p /etc/systemd
 ln -sfn @linkUnits@ /etc/systemd/network
 mkdir -p /etc/udev
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 let
  cfg = config.virtualisation.containers;

@ -13,10 +13,6 @@ let
    json2toml "$valuePath" "$out"
  '';

-  # Copy configuration files to avoid having the entire sources in the system closure
-  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
-    cp ${filePath} $out
-  '';
 in
 {
  meta = {
@ -136,7 +132,7 @@ in

    environment.etc."containers/policy.json".source =
      if cfg.policy != {} then pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
-      else copyFile "${pkgs.skopeo.src}/default-policy.json";
+      else utils.copyFile "${pkgs.skopeo.src}/default-policy.json";
  };

 }
--- a/nixos/modules/virtualisation/cri-o.nix
+++ b/nixos/modules/virtualisation/cri-o.nix
@ -1,16 +1,11 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:

 with lib;
-
 let
  cfg = config.virtualisation.cri-o;

  crioPackage = (pkgs.cri-o.override { inherit (cfg) extraPackages; });

-  # Copy configuration files to avoid having the entire sources in the system closure
-  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
-    cp ${filePath} $out
-  '';
 in
 {
  imports = [
@ -78,12 +73,19 @@ in
        The final CRI-O package (including extra packages).
      '';
    };
+
+    networkDir = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = "Override the network_dir option.";
+      internal = true;
+    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = [ cfg.package pkgs.cri-tools ];

-    environment.etc."crictl.yaml".source = copyFile "${pkgs.cri-o-unwrapped.src}/crictl.yaml";
+    environment.etc."crictl.yaml".source = utils.copyFile "${pkgs.cri-o-unwrapped.src}/crictl.yaml";

    environment.etc."crio/crio.conf.d/00-default.conf".text = ''
      [crio]
@ -95,6 +97,7 @@ in

      [crio.network]
      plugin_dirs = ["${pkgs.cni-plugins}/bin/"]
+      ${optionalString (cfg.networkDir != null) ''network_dir = "${cfg.networkDir}"''}

      [crio.runtime]
      cgroup_manager = "systemd"
@ -109,8 +112,8 @@ in
      ''}
    '';

-    environment.etc."cni/net.d/10-crio-bridge.conf".source = copyFile "${pkgs.cri-o-unwrapped.src}/contrib/cni/10-crio-bridge.conf";
-    environment.etc."cni/net.d/99-loopback.conf".source = copyFile "${pkgs.cri-o-unwrapped.src}/contrib/cni/99-loopback.conf";
+    environment.etc."cni/net.d/10-crio-bridge.conf".source = utils.copyFile "${pkgs.cri-o-unwrapped.src}/contrib/cni/10-crio-bridge.conf";
+    environment.etc."cni/net.d/99-loopback.conf".source = utils.copyFile "${pkgs.cri-o-unwrapped.src}/contrib/cni/99-loopback.conf";

    # Enable common /etc/containers configuration
    virtualisation.containers.enable = true;
--- a/nixos/modules/virtualisation/podman.nix
+++ b/nixos/modules/virtualisation/podman.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 let
  cfg = config.virtualisation.podman;

@ -21,11 +21,6 @@ let
    done
  '';

-  # Copy configuration files to avoid having the entire sources in the system closure
-  copyFile = filePath: pkgs.runCommandNoCC (builtins.unsafeDiscardStringContext (builtins.baseNameOf filePath)) {} ''
-    cp ${filePath} $out
-  '';
-
 in
 {
  imports = [
@ -88,7 +83,7 @@ in
    environment.systemPackages = [ cfg.package ]
      ++ lib.optional cfg.dockerCompat dockerCompat;

-    environment.etc."cni/net.d/87-podman-bridge.conflist".source = copyFile "${pkgs.podman-unwrapped.src}/cni/87-podman-bridge.conflist";
+    environment.etc."cni/net.d/87-podman-bridge.conflist".source = utils.copyFile "${pkgs.podman-unwrapped.src}/cni/87-podman-bridge.conflist";

    # Enable common /etc/containers configuration
    virtualisation.containers.enable = true;
--- a/nixos/tests/codimd.nix
+++ b/nixos/tests/codimd.nix
@ -21,7 +21,15 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
      services = {
        codimd = {
          enable = true;
-          configuration.dbURL = "postgres://codimd:snakeoilpassword@localhost:5432/codimddb";
+          configuration.dbURL = "postgres://codimd:\${DB_PASSWORD}@localhost:5432/codimddb";
+
+          /*
+           * Do not use pkgs.writeText for secrets as
+           * they will end up in the world-readable Nix store.
+           */
+          environmentFile = pkgs.writeText "codimd-env" ''
+            DB_PASSWORD=snakeoilpassword
+          '';
        };
        postgresql = {
          enable = true;
--- a/nixos/tests/magnetico.nix
+++ b/nixos/tests/magnetico.nix
@ -27,12 +27,13 @@ in
      start_all()
      machine.wait_for_unit("magneticod")
      machine.wait_for_unit("magneticow")
+      machine.wait_for_open_port(${toString port})
      machine.succeed(
-          "${pkgs.curl}/bin/curl "
+          "${pkgs.curl}/bin/curl --fail "
          + "-u user:password http://localhost:${toString port}"
      )
-      assert "Unauthorised." in machine.succeed(
-          "${pkgs.curl}/bin/curl "
+      machine.fail(
+          "${pkgs.curl}/bin/curl --fail "
          + "-u user:wrongpwd http://localhost:${toString port}"
      )
      machine.shutdown()
--- a/pkgs/applications/audio/drumkv1/default.nix
+++ b/pkgs/applications/audio/drumkv1/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "drumkv1";
-  version = "0.9.15";
+  version = "0.9.16";

  src = fetchurl {
    url = "mirror://sourceforge/drumkv1/${pname}-${version}.tar.gz";
-    sha256 = "108jk8p1sbm99plipf98ssij6dxaip1lmznibg8y2c4x0v2la6ab";
+    sha256 = "1r55575w9r0ifysw9mgxjvv0fszvx8ykjgim3zczf3mb5s9ngavv";
  };

  buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];
--- a/pkgs/applications/audio/fdkaac/default.nix
+++ b/pkgs/applications/audio/fdkaac/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "fdkaac";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "nu774";
    repo = pname;
-    rev = version;
-    sha256 = "16iwqmwagnb929byz8kj79pmmr0anbyv26drbavhppmxhk7rrpgh";
+    rev = "v${version}";
+    sha256 = "02mzx4bird2q5chzpavfc9pg259hwfvq6px85xarm59vmj9nryb6";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/applications/audio/jamulus/default.nix
+++ b/pkgs/applications/audio/jamulus/default.nix
@ -3,12 +3,12 @@

 mkDerivation rec {
  pname = "jamulus";
-  version = "3.5.9";
+  version = "3.5.10";
  src = fetchFromGitHub {
    owner = "corrados";
    repo = "jamulus";
    rev = "r${stdenv.lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "0h2m1sahi8cg15k6wa9m2d38va2cs3nvi0q8rpr9vak8g8d3p460";
+    sha256 = "0bw2v40csjmlkvkhr3dh0g1a7mfqrs1xkqjsii61yfzy2ckbsi82";
  };

  nativeBuildInputs = [ pkg-config qmake ];
--- a/pkgs/applications/audio/littlegptracker/0001-Remove-coherency-checks.patch
+++ b/pkgs/applications/audio/littlegptracker/0001-Remove-coherency-checks.patch
@ -0,0 +1,52 @@
+From 2e1e9b3ffce9d1069fca0b27b8011f85c7547c3b Mon Sep 17 00:00:00 2001
+From: Francesco Gazzetta <fgaz@fgaz.me>
+Date: Wed, 19 Aug 2020 15:06:19 +0200
+Subject: [PATCH 1/2] Remove coherency checks >:)
+
+As far as I can see, they are just to make sure that the types can fit
+in the word length, but this check was written when 64 bits weren't a
+possibility and didn't take that into account,
+so although the types do fit, the checks fail.
+Indeed, the program seems to work well on 64 bits.
+More info here:
+https://github.com/Mdashdotdashn/LittleGPTracker/issues/4
+---
+ sources/Externals/Soundfont/DATATYPE.H | 22 ----------------------
+ 1 file changed, 22 deletions(-)
+
+diff --git a/sources/Externals/Soundfont/DATATYPE.H b/sources/Externals/Soundfont/DATATYPE.H
+index 762a724..f6b031f 100644
+--- a/sources/Externals/Soundfont/DATATYPE.H
+++ b/sources/Externals/Soundfont/DATATYPE.H
+@@ -123,28 +123,6 @@ typedef short               SHORT;     /* 16 bit signed value was: INT */
+ ********************************************************************/
+ typedef unsigned short        EMUSTAT;
+ 
+-/********************************************************************
+-* Compare <limits.h> values with SoundFont Enabler limits.  Fail compile
+-* if discrepency. If compile fails due to one of these errors, then
+-* the SoundFont enabler will not work with your system or the state of your
+-* development environment.
+-********************************************************************/
+-#if (SCHAR_MAX != CHAR_MAXVAL) || (UCHAR_MAX != BYTE_MAXVAL)
+-  #error <datatype.h>: char is out of range!
+-#endif
+-
+-#if (SHRT_MAX != SHRT_MAXVAL)
+-  #error <datatype.h>: short is out of range!
+-#endif
+-
+-#if (LONG_MAX != LONG_MAXVAL)
+-  #error <datatype.h>: long is out of range!
+-#endif
+-
+-#if (ULONG_MAX != DWORD_MAXVAL)
+-  #error <datatype.h>: unsigned long is out of range!
+-#endif
+-
+ #ifdef __BYTE_COHERENT
+ 
+ /********************************************************************
+-- 
+2.25.4
+
--- a/pkgs/applications/audio/littlegptracker/0002-Set-the-initial-directory-to-the-current-directory.patch
+++ b/pkgs/applications/audio/littlegptracker/0002-Set-the-initial-directory-to-the-current-directory.patch
@ -0,0 +1,27 @@
+From c3865405ca707e3284a81709577d85ce2b3db72c Mon Sep 17 00:00:00 2001
+From: Francesco Gazzetta <fgaz@fgaz.me>
+Date: Wed, 19 Aug 2020 15:06:58 +0200
+Subject: [PATCH 2/2] Set the initial directory to the current directory
+
+otherwise the user has to navigate from the nix store, which makes the program
+crash due to its size
+---
+ sources/Adapters/DEB/System/DEBSystem.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sources/Adapters/DEB/System/DEBSystem.cpp b/sources/Adapters/DEB/System/DEBSystem.cpp
+index 6e86693..65d2cdd 100644
+--- a/sources/Adapters/DEB/System/DEBSystem.cpp
+++ b/sources/Adapters/DEB/System/DEBSystem.cpp
+@@ -54,7 +54,7 @@ void DEBSystem::Boot(int argc,char **argv) {
+ 	}
+ 	Path::SetAlias("bin",dirname(buff)) ;
+ 
+-	Path::SetAlias("root","bin:..") ;
+	Path::SetAlias("root",".") ;
+ 
+ #ifdef _DEBUG
+   Trace::GetInstance()->SetLogger(*(new StdOutLogger()));
+-- 
+2.25.4
+
--- a/pkgs/applications/audio/littlegptracker/default.nix
+++ b/pkgs/applications/audio/littlegptracker/default.nix
@ -0,0 +1,72 @@
+{ stdenv
+, fetchFromGitHub
+, SDL
+, jack2
+, Foundation
+}:
+
+stdenv.mkDerivation rec {
+  pname = "littlegptracker";
+  version = "unstable-2019-04-14";
+
+  src = fetchFromGitHub {
+    owner = "Mdashdotdashn";
+    repo = "littlegptracker";
+    rev = "0ed729b46739e3df5e111c6fa4d548fde2d3b891";
+    sha256 = "1pc6lg2qp6xh7ahs5d5pb63ms4h2dz7ryp3c7mci4g37gbwbsj5b";
+  };
+
+  buildInputs = [
+    SDL
+  ]
+  ++ stdenv.lib.optional stdenv.isDarwin Foundation
+  ++ stdenv.lib.optional stdenv.isLinux jack2;
+
+  patches = [
+    # Remove outdated (pre-64bit) checks that would fail on modern platforms
+    # (see description in patch file)
+    ./0001-Remove-coherency-checks.patch
+    # Set starting directory to cwd, default is in /nix/store and causes a crash
+    # (see description in patch file)
+    ./0002-Set-the-initial-directory-to-the-current-directory.patch
+  ];
+
+  preBuild = "cd projects";
+
+  makeFlags = [ "CXX=${stdenv.cc.targetPrefix}c++" ]
+    ++ stdenv.lib.optionals stdenv.isLinux  [ "PLATFORM=DEB" ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ "PLATFORM=OSX" ];
+
+  NIX_CFLAGS_COMPILE = [ "-fpermissive" ] ++
+    stdenv.lib.optional stdenv.hostPlatform.isAarch64 "-Wno-error=narrowing";
+
+  NIX_LDFLAGS = stdenv.lib.optional stdenv.isDarwin "-framework Foundation";
+
+  installPhase = let extension = if stdenv.isDarwin then "app" else "deb-exe";
+    in "install -Dm555 lgpt.${extension} $out/bin/lgpt";
+
+  meta = with stdenv.lib; {
+    description = "A music tracker similar to lsdj optimised to run on portable game consoles";
+    longDescription = ''
+      LittleGPTracker (a.k.a 'The piggy', 'lgpt') is a music tracker optimised
+      to run on portable game consoles. It is currently running on Game Park's
+      GP2x & Caanoo, PSP, Dingoo, Windows, Mac OSX (intel/ppc) & Linux (Debian).
+
+      It implements the user interface of littlesounddj, a very famous tracker
+      for the Gameboy platform that has been tried and tested by many users over
+      the years, leading to a little complex but yet extremely efficent way of
+      working.
+
+      Piggy currently supports 8 monophonic 16Bit/44.1Khz stereo sample playback
+      channels. Additionally, the program can drive MIDI instruments (with the
+      gp32 and gp2x a custom MIDI interface is required).
+    '';
+    homepage = "http://www.littlegptracker.com/";
+    downloadPage = "http://www.littlegptracker.com/download.php";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    # https://github.com/NixOS/nixpkgs/pull/91766#issuecomment-688751821
+    broken = stdenv.isDarwin;
+  };
+}
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@ -1,5 +1,9 @@
 { stdenv
-, fetchurl, alsaLib
+, fetchurl
+, makeWrapper
+
+, alsaLib
+, perl
 }:

 stdenv.mkDerivation rec {
@ -10,12 +14,30 @@ stdenv.mkDerivation rec {
    sha256 = "0vkcfdx0mqq6lmpczsmpa2jsb0s6dryx3i7gvr32i3w9b9w9ij9h";
  };

-  buildInputs = stdenv.lib.optional (!stdenv.isDarwin) alsaLib;
+  outputs = [ "out" "conplay" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ perl ] ++ stdenv.lib.optional (!stdenv.isDarwin) alsaLib;

  configureFlags = stdenv.lib.optional
    (stdenv.hostPlatform ? mpg123)
    "--with-cpu=${stdenv.hostPlatform.mpg123.cpu}";

+  postInstall = ''
+    mkdir -p $conplay/bin
+    mv scripts/conplay $conplay/bin/
+  '';
+
+  preFixup = ''
+    patchShebangs $conplay/bin/conplay
+  '';
+
+  postFixup = ''
+    wrapProgram $conplay/bin/conplay \
+      --prefix PATH : $out/bin
+  '';
+
  meta = {
    description = "Fast console MPEG Audio Player and decoder library";
    homepage = "http://mpg123.org";
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -12,13 +12,13 @@ let
  ;
 in pythonPackages.buildPythonApplication rec {
  pname = "picard";
-  version = "2.4.2";
+  version = "2.4.4";

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = pname;
    rev = "release-${version}";
-    sha256 = "0sbccsisk9w0gnblvhg7wk1c5ydppldjbvaa0zhl3yrid5a363ah";
+    sha256 = "0iw2v37j70881v0a2rjp2miq97nscq04x1ysk1dqmi1b9hi0y17q";
  };

  nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
--- a/pkgs/applications/blockchains/wasabibackend/deps.nix
+++ b/pkgs/applications/blockchains/wasabibackend/deps.nix
@ -770,13 +770,13 @@ in [
  })
  (fetchNuGet {
    name = "Microsoft.AspNetCore.App.Runtime.linux-x64";
-    version = "3.1.2";
-    sha256 = "19wfh9yg4n2khbl7pvf6ngx95m5p8lw4l9y935pv7nh4xgwk02p9";
+    version = "3.1.8";
+    sha256 = "140zr3nwkmf6xc52gq4iz6ycyh95fxy0jpgn637pkd9z423z8135";
  })
  (fetchNuGet {
    name = "Microsoft.NETCore.App.Runtime.linux-x64";
-    version = "3.1.2";
-    sha256 = "0a332ia5pabnz7mdfc99a5hlc7drnwzlc7cj9b5c3an6dq636p66";
+    version = "3.1.8";
+    sha256 = "1bv9n9wzsqf9g8h6z10p61xkcx8ad4nnip83qv8yyfvhr4kdmbsa";
  })
  (fetchNuGet {
    name = "Microsoft.CSharp";
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -11,8 +11,8 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1i4vq8a81jgshn9iqkj8rp0yqihq2bjim27c8sh4vl9d6a8a6vcr";
-    x86_64-darwin = "090xj8pq3fdn7dcfrzvgvx906k6gs2xm04xkymz8vpm3a4rq1svn";
+    x86_64-linux = "1kgvwcwkdvywsiyg86srfzcq6jcas6hyi9ds4qvndsnd64j0fgkn";
+    x86_64-darwin = "03jci05psxkknpjrrgjpdxsii2xyf5cfpkhrp5nnfafb5acfvs1x";
  }.${system};
 in
  callPackage ./generic.nix rec {
@ -21,7 +21,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.48.2";
+    version = "1.49.1";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "1password";
-  version = "1.1.1";
+  version = "1.7.0";
  src =
    if stdenv.isLinux then fetchzip {
      url = {
@ -10,13 +10,13 @@ stdenv.mkDerivation rec {
        "x86_64-linux" = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
      }.${stdenv.hostPlatform.system};
      sha256 = {
-        "i686-linux" = "1andl3ripkcg4jhwdkd4b39c9aaxqpx9wzq21pysn6rlyy4hfcb0";
-        "x86_64-linux" = "0qj5v8psqyp0sra0pvzkwjpm28kx3bgg36y37wklb6zl2ngpxm5g";
+        "i686-linux" = "0fvi9pfcm6pfy628q2lg62bkikrgsisynrk3kkjisb9ldcyjgabw";
+        "x86_64-linux" = "1iskhls8g8w2zhk79gprz4vzrmm7r7fq87gwgd4xmj5md4nkzran";
      }.${stdenv.hostPlatform.system};
      stripRoot = false;
    } else fetchurl {
      url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.pkg";
-      sha256 = "16inwxkrky4xwlr7vara1l8kapdgjg3kfq1l94i5855782hn4ppm";
+      sha256 = "0x6s26zgjryzmcg9qxmv5s2vml06q96yqbapasjfxqc3l205lnnn";
    };

  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ xar cpio ];
--- a/pkgs/applications/misc/fetchmail/default.nix
+++ b/pkgs/applications/misc/fetchmail/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, openssl }:

 let
-  version = "6.4.8";
+  version = "6.4.12";
 in
 stdenv.mkDerivation {
  pname = "fetchmail";
@ -9,7 +9,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "mirror://sourceforge/fetchmail/fetchmail-${version}.tar.xz";
-    sha256 = "1g893dr3982vrqzxybmflnqfmd1q6yipd9krvxn0avhlrrp97k96";
+    sha256 = "11s83af63gs9nnrjb66yq58xriyvi8hzj4ykxp3kws5z3nby111b";
  };

  buildInputs = [ openssl ];
--- a/pkgs/applications/misc/go-jira/default.nix
+++ b/pkgs/applications/misc/go-jira/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "go-jira";
-  version = "1.0.23";
+  version = "1.0.24";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "go-jira";
    repo = "jira";
-    sha256 = "0qk5ifjxkqisvgv066rw8xj2zszc9mhc0by4338xjd7ng10jkk7b";
+    sha256 = "1qpimh39hsg75mb32hlvxmd7jj5b0cmhdkqz3dizfcnidllr3grd";
  };

  vendorSha256 = "18jwxnkv94lsxfv57ga519knxm077cc8chp5c992ipk58a04nv18";
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@ -2,11 +2,11 @@
 , curl, cdparanoia, libid3tag, ncurses, libtool }:

 stdenv.mkDerivation rec {
-  name = "grip-4.1.1";
+  name = "grip-4.2.0";

  src = fetchurl {
    url = "mirror://sourceforge/grip/${name}.tar.gz";
-    sha256 = "1sbjgawb7qrinixybwi0adk7mpdfb565gkffp5gxxsw8fqd068fs";
+    sha256 = "1si5kidwg0i2jg0brzyvjrzw24v3km2hdgd4kda1adzq81a3p1cs";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/misc/weather/default.nix
+++ b/pkgs/applications/misc/weather/default.nix
@ -1,41 +1,48 @@
-{ stdenv, fetchurl, pythonPackages }:
+{ stdenv, fetchurl, pythonPackages, installShellFiles }:

 stdenv.mkDerivation rec {
-    version = "2.4.1";
-    pname = "weather";
+  version = "2.4.1";
+  pname = "weather";

-    src = fetchurl {
-        url = "http://fungi.yuggoth.org/weather/src/${pname}-${version}.tar.xz";
-        sha256 = "0nf680dl7a2vlgavdhj6ljq8a7lkhvr6zghkpzad53vmilxsndys";
-    };
+  src = fetchurl {
+    url = "http://fungi.yuggoth.org/weather/src/${pname}-${version}.tar.xz";
+    sha256 = "0nf680dl7a2vlgavdhj6ljq8a7lkhvr6zghkpzad53vmilxsndys";
+  };

-    nativeBuildInputs = [ pythonPackages.wrapPython ];
+  nativeBuildInputs = [
+    installShellFiles
+    pythonPackages.wrapPython
+  ];

-    buildInputs = [ pythonPackages.python ];
+  dontConfigure = true;
+  dontBuild = true;

-    phases = [ "unpackPhase" "installPhase" ];
+  # Upstream doesn't provide a setup.py or alike, so we follow:
+  # http://fungi.yuggoth.org/weather/doc/install.rst#id3
+  installPhase = ''
+    site_packages=$out/${pythonPackages.python.sitePackages}
+    install -Dt $out/bin -m 755 weather
+    install -Dt $site_packages weather.py
+    install -Dt $out/share/weather-util \
+      airports overrides.{conf,log} places slist stations \
+      zctas zlist zones
+    install -Dt $out/etc weatherrc

-    installPhase = ''
-        site_packages=$out/${pythonPackages.python.sitePackages}
-        mkdir -p $out/{share/{man,weather-util},bin,etc} $site_packages
-        cp weather $out/bin/
-        cp weather.py $site_packages/
-        chmod +x $out/bin/weather
-        cp airports overrides.{conf,log} places slist stations zctas zlist zones $out/share/weather-util/
-        cp weatherrc $out/etc
-        cp weather.1 weatherrc.5 $out/share/man/
-        sed -i \
-          -e "s|/etc|$out/etc|g" \
-          -e "s|else: default_setpath = \".:~/.weather|&:$out/share/weather-util|" \
-          $site_packages/weather.py
-        wrapPythonPrograms
-    '';
+    sed -i \
+      -e "s|/etc|$out/etc|g" \
+      -e "s|else: default_setpath = \".:~/.weather|&:$out/share/weather-util|" \
+      $site_packages/weather.py

-    meta = with stdenv.lib; {
-        homepage = "http://fungi.yuggoth.org/weather";
-        description = "Quick access to current weather conditions and forecasts";
-        license = licenses.isc;
-        maintainers = [ maintainers.matthiasbeyer ];
-        platforms = platforms.linux ++ platforms.darwin;
-    };
+    wrapPythonPrograms
+
+    installManPage weather.1 weatherrc.5
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "http://fungi.yuggoth.org/weather";
+    description = "Quick access to current weather conditions and forecasts";
+    license = licenses.isc;
+    maintainers = [ maintainers.matthiasbeyer ];
+    platforms = platforms.unix;
+  };
 }
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,17 +1,17 @@
 {
  "stable": {
-    "version": "85.0.4183.102",
-    "sha256": "032yh1mfwins7a62zw8kwwq8xw1n52a0a93lqz7qlyjaf9sd8s4a",
-    "sha256bin64": "1i8xaxxnmg80vsia8hxnq58qi9k5nnbrl80d6d23g9lb7dbc9cpm"
+    "version": "85.0.4183.121",
+    "sha256": "0a1xn39kmvyfpal6pgnylpy30z0322p3v7sx6vxi0r2naiz58670",
+    "sha256bin64": "08vqf1v91703aik47344bl409rsl4myar9bsd2lsvzqncncwsaca"
  },
  "beta": {
-    "version": "86.0.4240.30",
-    "sha256": "1isj0zngb72k1hhn3h0s8mccg1cdmppz1mjmg19f2h306farzmzl",
-    "sha256bin64": "10d8im2adqqnkd6265gngv6xlm5qsz6r13z6cbbchsss0ssr8fxa"
+    "version": "86.0.4240.42",
+    "sha256": "06cfhiym9xmz2q86v6b6xcicrrp2pmr7karavylzz4fqvwd2v6fa",
+    "sha256bin64": "1z5zmdc2i31iimps7p5z43vv4qi83c8ljb7x68zc1rvf8x62p7xj"
  },
  "dev": {
-    "version": "87.0.4252.0",
-    "sha256": "1lxlsdni63zh79hxvpwgmnfn67kgfzhz3yg9bkxghqchqykkz92y",
-    "sha256bin64": "130hf7b35wcxpw05ddbqq89x10c0kays1vb9qg6xhq3zx2mk6ijw"
+    "version": "87.0.4263.3",
+    "sha256": "1ybfrlm4417lpbg5qcwhq5p6nnxrw68wzyy5zvb1sg1ma8s9hhkk",
+    "sha256bin64": "1f7a272kalglmdwmrrzb4iw3crvvpv3mhxca5jh75qpldn4gby6m"
  }
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -138,6 +138,8 @@ stdenv.mkDerivation ({
    "-I${nss.dev}/include/nss"
  ];

+  MACH_USE_SYSTEM_PYTHON = "1";
+
  postPatch = ''
    rm -rf obj-x86_64-pc-linux-gnu

--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    ffversion = "80.0.1";
+    ffversion = "81.0";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "081sf41r7ickjij3kfrdq29a0d6wz7qv8950kx116kakh8qxgjy8ahk2mfwlcp6digrl4mimi8rl7ns1wjngsmrjh4lvqzh1xglx9cp";
+      sha512 = "1dnxn754vb99mccqrj3wr3pg2scjy42rvs5xc6bw022gh6n8kgipx9pbkapwfivkglynxmmbw1k11ak34zhr1g6p31m3550ad6azq19";
    };

    patches = [
@ -36,10 +36,10 @@ rec {

  firefox-esr-78 = common rec {
    pname = "firefox-esr";
-    ffversion = "78.2.0esr";
+    ffversion = "78.3.0esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "1dnvr9nyvnv5dkpnjnadff38lf9r7g37gk401c1i22d661ib5xj0gm2rnz1rjyrkvzrnr6p9f7liy3i41varja00g0x1racccj1my9q";
+      sha512 = "3rg4rjmigir2wsvzdl5dkh74hahjv36yvd04rhq0rszw6xz9wyig64nxhkrpf416z6iy3y1qavk7x9j6j02sc2f545pd6cx8abjgqc9";
    };

    patches = [
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -91,19 +91,19 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "9.5.4";
+  version = "10.0";

  lang = "en-US";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "sha256-XW2B2wTgqMU2w9XhPJNcUjGLrHykQIngMcG/fFTWb04=";
+      sha256 = "1l2rfknffnh6hsi16dzps1wav5s723vyk57fzv9y5vjmbcbf7l2l";
    };

    i686-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "sha256-EyDyAxB5Og1Cn04tuBF9ob8BxqULy2Ur07BuDxZlmqQ=";
+      sha256 = "0x80w02ckb6mznrm1gjdpkxk9yf2rdcl16ljjglivq358a309cl2";
    };
  };
 in
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -18,11 +18,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "3.3.2022.39-1";
+  version = "3.3.2022.47-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "1d49556l067zilndm1381n1y22076qgww4n6nkscwchik2mj79sy";
+    sha256 = "0lraliqb5r8akh8lfmw2sy90s58sbghcpc598nlz2d89f91yq7vz";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@ -11,11 +11,11 @@

 mkDerivation rec {
  pname = "datovka";
-  version = "4.15.1";
+  version = "4.15.2";

  src = fetchurl {
    url = "https://secure.nic.cz/files/datove_schranky/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0ab1s1r6zrqxcfjnij5ar352kzyrl1m92c04nqk6hahpzzma2p3r";
+    sha256 = "0vna3vaivi6w7nlkwpqhwmyly0s1d5y2yg51br2f918pjhp2cp7q";
  };

  buildInputs = [ libisds qmake qtbase qtsvg libxml2 ];
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -1,7 +1,7 @@
 { callPackage, libsForQt5 }:

 let
-  stableVersion = "2.2.13";
+  stableVersion = "2.2.14";
  previewVersion = stableVersion;
  addVersion = args:
    let version = if args.stable then stableVersion else previewVersion;
@ -26,8 +26,8 @@ let
  };
  mkGui = args: libsForQt5.callPackage (import ./gui.nix (addVersion args // extraArgs)) { };
  mkServer = args: callPackage (import ./server.nix (addVersion args // extraArgs)) { };
-  guiSrcHash = "1vhch8hgbzdfmgpxlzgdasv6lxgl7rs96n5v4mn2pcccvfmbqj66";
-  serverSrcHash = "1vlnhlcnjh0kd623zxjjgkvln0rn5zr43zn00vkvbzwc9cgm2jxz";
+  guiSrcHash = "0y0dkyky2vw8ixm8nx4qhsj5b6hk0lv2cayrj4879icmp8zc4dy3";
+  serverSrcHash = "1vpsvvisw0sivlbjwawskkyiavl092qxaqxi13khkimz5fk0d3rc";
 in {
  guiStable = mkGui {
    stable = true;
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -15,11 +15,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "5.2.458699.0906";
+  version = "5.3.465578.0920";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "0cwai5v2m99cvw1dnysl88fi97dwm6rq7xv3y0ydgg3499n8cjpf";
+      sha256 = "0gqpisbzyx2xic0drvyqfbd2x2a5qcizl355qkwwibq3v24mx7kp";
    };
  };

--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@ -2,19 +2,20 @@

 buildGoModule rec {
  pname = "ipfs";
-  version = "0.6.0";
+  version = "0.7.0";
  rev = "v${version}";

  # go-ipfs makes changes to it's source tarball that don't match the git source.
  src = fetchurl {
    url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
-    sha256 = "14bgq2j2bjjy0pspy2lsj5dm3w9rmfha0l8kyq5ig86yhc4nzn80";
+    sha256 = "1fkzwm4qxxpmbjammk6s5qcyjxivfa0ydqz4mpz1w756c4jq0jf3";
  };

  # tarball contains multiple files/directories
  postUnpack = ''
    mkdir ipfs-src
-    mv * ipfs-src || true
+    shopt -s extglob
+    mv !(ipfs-src) ipfs-src || true
    cd ipfs-src
  '';

@ -27,9 +28,9 @@ buildGoModule rec {
  vendorSha256 = null;

  postInstall = ''
-    install -D misc/systemd/ipfs.service $out/etc/systemd/system/ipfs.service
-    install -D misc/systemd/ipfs-api.socket $out/etc/systemd/system/ipfs-api.socket
-    install -D misc/systemd/ipfs-gateway.socket $out/etc/systemd/system/ipfs-gateway.socket
+    install --mode=444 -D misc/systemd/ipfs.service $out/etc/systemd/system/ipfs.service
+    install --mode=444 -D misc/systemd/ipfs-api.socket $out/etc/systemd/system/ipfs-api.socket
+    install --mode=444 -D misc/systemd/ipfs-gateway.socket $out/etc/systemd/system/ipfs-gateway.socket
    substituteInPlace $out/etc/systemd/system/ipfs.service \
      --replace /usr/bin/ipfs $out/bin/ipfs
  '';
--- a/pkgs/applications/networking/sniffers/kismet/default.nix
+++ b/pkgs/applications/networking/sniffers/kismet/default.nix
@ -10,11 +10,11 @@ assert !withPython;

 stdenv.mkDerivation rec {
  pname = "kismet";
-  version = "2020-04-R2";
+  version = "2020-09-R2";

  src = fetchurl {
    url = "https://www.kismetwireless.net/code/${pname}-${version}.tar.xz";
-    sha256 = "0hxmaln0y6bk9m1rshr4swmg0sqy3ic693vfk8haj7f5gnph96cm";
+    sha256 = "1n6y6sgqf50bng8n0mhs2r1w0ak14mv654sqay72a78wh2s7ywzg";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/office/gtg/default.nix
+++ b/pkgs/applications/office/gtg/default.nix
@ -15,13 +15,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "gtg";
-  version = "unstable-2020-08-02";
+  version = "unstable-2020-09-16";

  src = fetchFromGitHub {
    owner = "getting-things-gnome";
    repo = "gtg";
-    rev = "6623731f301c1b9c7b727e009f4a6462ad381c68";
-    sha256 = "14gxgg4nl0ki3dn913041jpyfhxsj90fkd55z6mmpyklhr8mwss1";
+    rev = "1be991c6d7f7b2e4b8ac16f82e8a07f9dce4272f";
+    sha256 = "1f5acpjwnp08c78dds7xm22qjzcfnx2qs121yvm3rswkh27s4n23";
  };


--- a/pkgs/applications/office/homebank/default.nix
+++ b/pkgs/applications/office/homebank/default.nix
@ -2,10 +2,10 @@
 , libsoup, gnome3 }:

 stdenv.mkDerivation rec {
-  name = "homebank-5.4.2";
+  name = "homebank-5.4.3";
  src = fetchurl {
    url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "0bkjvd819kw9cwmr3macggbg8yil3yc8v2za8pjrl6g746s89kn6";
+    sha256 = "02wd569viwy6ncy0144z9nxr3zmpl4shkqhz7zzwyky4gknxf8lj";
  };

  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/science/biology/bwa/default.nix
+++ b/pkgs/applications/science/biology/bwa/default.nix
@ -11,8 +11,15 @@ stdenv.mkDerivation rec {

  buildInputs = [ zlib ];

+  # it's unclear which headers are intended to be part of the public interface
+  # so we may find ourselves having to add more here over time
  installPhase = ''
-    install -vD bwa $out/bin/bwa
+    install -vD -t $out/bin bwa
+    install -vD -t $out/lib libbwa.a
+    install -vD -t $out/include bntseq.h
+    install -vD -t $out/include bwa.h
+    install -vD -t $out/include bwamem.h
+    install -vD -t $out/include bwt.h
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/science/biology/obitools/obitools3.nix
+++ b/pkgs/applications/science/biology/obitools/obitools3.nix
@ -0,0 +1,38 @@
+{ stdenv, fetchurl, python3Packages, cmake, python3 }:
+
+let
+  pythonPackages = python3Packages;
+in
+
+pythonPackages.buildPythonApplication rec {
+  pname = "obitools3";
+  version = "3.0.0-beta14";
+
+  src = fetchurl {
+    url = "https://git.metabarcoding.org/obitools/${pname}/repository/v${version}/archive.tar.gz";
+    sha256 = "17krklxfvxl6baf2m394gm1a88y0lg0bwqx20cf5q39zyw04z442";
+  };
+
+  preBuild = ''
+    substituteInPlace src/CMakeLists.txt --replace \$'{PYTHONLIB}' "$out/lib/${python3.libPrefix}/site-packages";
+    export NIX_CFLAGS_COMPILE="-L $out/lib/${python3.libPrefix}/site-packages $NIX_CFLAGS_COMPILE"
+  '';
+
+  disabled = !pythonPackages.isPy3k;
+
+  nativeBuildInputs = [ pythonPackages.cython cmake ];
+
+  dontConfigure = true;
+
+  doCheck = true;
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib ; {
+    description = "Management of analyses and data in DNA metabarcoding";
+    homepage = "https://git.metabarcoding.org/obitools/obitools3";
+    license = licenses.cecill20;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/science/biology/octopus/default.nix
+++ b/pkgs/applications/science/biology/octopus/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "octopus";
-  version = "0.6.3-beta";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "luntergroup";
    repo = "octopus";
    rev = "v${version}";
-    sha256 = "042fycg8ppld7iajpzq2d8h8wr0nw43zbl57y125sfihryvr373n";
+    sha256 = "0y3g0xc3x3adbcmds6hh60023pfv1qrz6ak7jd88fg9vxi9bdrfb";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/applications/science/biology/truvari/default.nix
+++ b/pkgs/applications/science/biology/truvari/default.nix
@ -5,13 +5,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "truvari";
-  version = "1.3.4";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "spiralgenetics";
    repo = "truvari";
    rev = "v${version}";
-    sha256 = "1bph7v48s7pyfagz8a2fzl5fycjliqzn5lcbv3m2bp2ih1f1gd1v";
+    sha256 = "0lp1wnldjv92k4ncga1h0icb0dpjsrx427vggg40x04a7kp9lwx0";
  };

  propagatedBuildInputs = with python3Packages; [
@ -21,15 +21,16 @@ python3Packages.buildPythonApplication rec {
    pysam
    pyfaidx
    intervaltree
+    pytabix
+    acebinf
+    bwapy
+    joblib
+    pandas
  ];

-  prePatch = ''
-    substituteInPlace ./setup.py \
-      --replace '"progressbar2==3.41.0",' '"progressbar2",' \
-      --replace '"pysam==0.15.2",' '"pysam",' \
-      --replace '"pyfaidx==0.5.5.2",' '"pyfaidx",' \
-      --replace '"intervaltree==3.0.2",' '"intervaltree",'
-  '';
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "truvari" ];

  meta = with lib; {
    description = "Structural variant comparison tool for VCFs";
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -17,14 +17,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "14.31.2";
+  version = "14.31.3";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "0p2cbzxhw1s4l76kbriag3r4dkpsfvrnydryyikgkbdwnq479hm2";
+    sha256 = "067051wp9kgkgcy3mvqwxhim0h1qfcf4jk8vrbzd3y9pwmjismzy";
  };

  patchPhase = ''
--- a/pkgs/applications/science/logic/avy/0001-no-static-boost-libs.patch
+++ b/pkgs/applications/science/logic/avy/0001-no-static-boost-libs.patch
@ -1,12 +0,0 @@
-diff --git a/avy/CMakeLists.txt b/avy/CMakeLists.txt
-index 5913076..b0453b5 100644
--- a/avy/CMakeLists.txt
-+++ b/avy/CMakeLists.txt
-@@ -23,7 +23,6 @@ if (CUSTOM_BOOST_ROOT)
-   set (Boost_NO_SYSTEM_PATHS "ON")
- endif()
- 
-set (Boost_USE_STATIC_LIBS ON)
- find_package (Boost 1.46.1 REQUIRED program_options)
- IF (Boost_FOUND)
-   include_directories (${Boost_INCLUDE_DIRS})
--- a/pkgs/applications/science/logic/avy/default.nix
+++ b/pkgs/applications/science/logic/avy/default.nix
@ -1,13 +1,13 @@
 { stdenv, fetchgit, cmake, zlib, boost }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "avy";
-  version = "2017.10.16";
+  version = "2019.05.01"; # date of cav19 tag

  src = fetchgit {
    url    = "https://bitbucket.org/arieg/extavy";
-    rev    = "c75c83379c38d6ea1046d0caee95aef77283ffe3";
-    sha256 = "0zcycnypg4q5g710bnkjpycaawmibc092vmyhgfbixkgq9fb5lfh";
+    rev    = "cav19";
+    sha256 = "0qdzy9srxp5f38x4dbb3prnr9il6cy0kz80avrvd7fxqzy7wdlwy";
    fetchSubmodules = true;
  };

@ -31,10 +31,6 @@ stdenv.mkDerivation {
    patch -p1 -d glucose -i ${./glucose-fenv.patch}
  '';

-  patches =
-    [ ./0001-no-static-boost-libs.patch
-    ];
-
  installPhase = ''
    mkdir -p $out/bin
    cp avy/src/{avy,avybmc} $out/bin/
--- a/pkgs/applications/science/logic/cvc3/default.nix
+++ b/pkgs/applications/science/logic/cvc3/default.nix
@ -13,16 +13,21 @@ stdenv.mkDerivation rec {

  patches = [ ./cvc3-2.4.1-gccv6-fix.patch ];

-  preConfigure = ''
+  postPatch = ''
    sed -e "s@ /bin/bash@bash@g" -i Makefile.std
    find . -exec sed -e "s@/usr/bin/perl@${perl}/bin/perl@g" -i '{}' ';'
+
+    # bison 3.7 workaround
+    for f in parsePL parseLisp parsesmtlib parsesmtlib2 ; do
+      ln -s ../parser/''${f}_defs.h src/include/''${f}.hpp
+    done
  '';

  meta = with stdenv.lib; {
    description = "A prover for satisfiability modulo theory (SMT)";
    maintainers = with maintainers;
      [ raskin ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    license = licenses.free;
    homepage = "http://www.cs.nyu.edu/acsys/cvc3/index.html";
  };
--- a/pkgs/applications/science/logic/why3/default.nix
+++ b/pkgs/applications/science/logic/why3/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation {
  pname = "why3";
-  version = "1.3.1";
+  version = "1.3.3";

  src = fetchurl {
-    url = "https://gforge.inria.fr/frs/download.php/file/38291/why3-1.3.1.tar.gz";
-    sha256 = "16zcrc60zz2j3gd3ww93z2z9x2jkxb3kr57y8i5rcgmacy7mw3bv";
+    url = "https://gforge.inria.fr/frs/download.php/file/38367/why3-1.3.3.tar.gz";
+    sha256 = "1n0a2nn1gnk0zg339lh698g4wpk7m8m1vyi2yvifd5adqvk4milw";
  };

  buildInputs = with ocamlPackages; [
--- a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
@ -1,23 +1,73 @@
-{ callPackage, stdenv, fetchFromGitHub, ...}:
+{ callPackage, stdenv, fetchFromGitHub, git, zsh, ...}:

 stdenv.mkDerivation rec {
  pname = "gitstatus";
-  version = "1.2.2";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "romkatv";
    repo = "gitstatus";
    rev = "v${version}";
-    sha256 = "1kspz2fhryyjhn6gqf029rv0386a1ga08sf6g0l6smivw628k71l";
+    sha256 = "0zan1sa8c24hpqwj66y9srd4n15f4nk64fc5jrd4smgfgn22wph8";
  };

  buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];
  patchPhase = ''
-    sed -i "1i GITSTATUS_DAEMON=$out/bin/gitstatusd" gitstatus.plugin.zsh
+    sed -i '1i GITSTATUS_AUTO_INSTALL=''${GITSTATUS_AUTO_INSTALL-0}' gitstatus.plugin.zsh
+    sed -i "1a GITSTATUS_DAEMON=$out/bin/gitstatusd" install
  '';
  installPhase = ''
    install -Dm755 usrbin/gitstatusd $out/bin/gitstatusd
    install -Dm444 gitstatus.plugin.zsh $out
+    install -Dm555 install $out
+    install -Dm444 build.info $out
+  '';
+  # Don't install the "install" and "build.info" files, which the end user
+  # should not need to worry about.
+  pathsToLink = [
+    "/bin/gitstatusd"
+    "/gitstatus.plugin.zsh"
+  ];
+
+  # The install check sets up an empty Git repository and a minimal zshrc that
+  # invokes gitstatus.plugin.zsh. It runs zsh against this zshrc and verifies
+  # that the script was sourced successfully and that the "gitstatus_query"
+  # command ran successfully. This tests the binary itself and the zsh
+  # integration.
+  installCheckInputs = [ git zsh ];
+  doInstallCheck = true;
+  installCheckPhase = ''
+    TEMP=$(mktemp -d)
+    cd "$TEMP"
+
+    git init
+
+    echo '
+      GITSTATUS_LOG_LEVEL=DEBUG
+      . $out/gitstatus.plugin.zsh || exit 1
+
+      gitstatus_stop NIX_TEST && gitstatus_start NIX_TEST
+      gitstatus_query NIX_TEST
+      if [[ $? -ne 0 ]]; then
+          print -- "Something went wrong with gitstatus"
+          exit 1
+      elif [[ $VCS_STATUS_RESULT != "ok-sync" ]]; then
+          print -- "Not in a Git repo"
+          exit 1
+      else
+          print -- "OK"
+          exit 0
+      fi
+    ' > .zshrc
+
+    # If we try to run zsh like "zsh -i -c true" or "zsh -i > output" then job
+    # control will be disabled in the shell and the gitstatus plugin script
+    # will fail when it tries to set the MONITOR option. As a workaround, we
+    # run zsh as a full-fledged independent process and then wait for it to
+    # exit. (The "exit" statements in the zshrc ensure that zsh will exit
+    # almost immediately after starting.)
+    ZDOTDIR=. zsh -i &
+    wait $!
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/video/obs-studio/v4l2sink.nix
+++ b/pkgs/applications/video/obs-studio/v4l2sink.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-v4l2sink";
-  version = "0.1.0";
+  version = "0.1.0-12-g1ec3c8a";

  src = fetchFromGitHub {
    owner = "CatxFish";
    repo = "obs-v4l2sink";
    rev = version;
-    sha256 = "0l4lavaywih5lzwgxcbnvdrxhpvkrmh56li06s3aryikngxwsk3z";
+    sha256 = "03ah91cm1qz26k90mfx51l0d598i9bcmw39lkikjs1msm4c9dfxx";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/video/vcs/default.nix
+++ b/pkgs/applications/video/vcs/default.nix
@ -0,0 +1,39 @@
+{ stdenv, fetchurl, makeWrapper
+, coreutils, ffmpeg, gawk, gnugrep, gnused, imagemagick, mplayer, utillinux
+, dejavu_fonts
+}:
+with stdenv.lib;
+let
+  version = "1.13.4";
+  runtimeDeps = [ coreutils ffmpeg gawk gnugrep gnused imagemagick mplayer utillinux ];
+in
+stdenv.mkDerivation {
+  pname = "vcs";
+  inherit version;
+  src = fetchurl {
+    url = "http://p.outlyer.net/files/vcs/vcs-${version}.bash";
+    sha256 = "0nhwcpffp3skz24kdfg4445i6j37ks6a0qsbpfd3dbi4vnpa60a0";
+  };
+
+  unpackCmd = "mkdir src; cp $curSrc src/vcs";
+  patches = [ ./fonts.patch ];
+  nativeBuildInputs = [ makeWrapper ];
+  doBuild = false;
+
+  inherit dejavu_fonts;
+  installPhase = ''
+    mkdir -p $out/bin
+    mv vcs $out/bin/vcs
+    substituteAllInPlace $out/bin/vcs
+    chmod +x $out/bin/vcs
+    wrapProgram $out/bin/vcs --argv0 vcs --set PATH "${makeBinPath runtimeDeps}"
+  '';
+
+  meta = {
+    description = "Generates contact sheets from video files";
+    homepage = "http://p.outlyer.net/vcs";
+    license = licenses.cc-by-nc-sa-30;
+    maintainers = with maintainers; [ elitak ];
+    platforms = with platforms; unix;
+  };
+}
--- a/pkgs/applications/video/vcs/fonts.patch
+++ b/pkgs/applications/video/vcs/fonts.patch
@ -0,0 +1,23 @@
+--- a/vcs	2020-04-04 14:37:53.531095977 -0700
+++ b/vcs	2020-04-04 14:40:46.459407878 -0700
+@@ -3669,18 +3669,8 @@
+ 	[[ ( -z $USR_FONT_TITLE ) && ( $FONT_TITLE != 'DejaVu-Sans-Book' ) ]] && return
+ 	[[ ( -z $USR_FONT_TSTAMPS ) && ( $FONT_TSTAMPS != 'DejaVu-Sans-Book' ) ]] && return
+ 	[[ ( -z $USR_FONT_SIGN ) && ( $FONT_SIGN != 'DejaVu-Sans-Book' ) ]] && return
+-	# Try to locate DejaVu Sans
+-	local dvs=''
+-	if [[ -d /usr/local/share/fonts ]]; then
+-		dvs=$(find /usr/local/share/fonts/ -type f -iname 'dejavusans.ttf')
+-	fi
+-	if [[ ( -z $dvs ) && ( -d /usr/share/fonts ) ]]; then
+-		dvs=$(find /usr/share/fonts/ -type f -iname 'dejavusans.ttf')
+-	fi
+-	if [[ -z $dvs ]]; then
+-		warn "Unable to locate DejaVu Sans font. Falling back to helvetica."
+-		dvs=helvetica
+-	fi
+	# Use DejaVu Sans, by default
+	local dvs='@dejavu_fonts@/share/fonts/truetype/DejaVuSans.ttf'
+ 	[[ -z $USR_FONT_HEADING ]] && FONT_HEADING="$dvs"
+ 	[[ -z $USR_FONT_TITLE ]] && FONT_TITLE="$dvs"
+ 	[[ -z $USR_FONT_TSTAMPS ]] && FONT_TSTAMPS="$dvs"
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@ -25,6 +25,7 @@ let
    "test_pid.py"
    "test_pid_file.py"
    "test_preserve_fds.py"
+    "test_resources"
    "test_start.py"
    "test_uid_gid.py"
    "test_update.py"
@ -34,13 +35,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "crun";
-  version = "0.14.1";
+  version = "0.15";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = version;
-    sha256 = "0r77ksdrpxskf79m898a7ai8wxw9fmmsf2lg8fw3ychnk74l8jvh";
+    sha256 = "0cqzk2lm1w0g2v6qhiliq565cf4p7hzh839jb01p3i5cr9kx11kc";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -16,13 +16,13 @@

 buildGoModule rec {
  pname = "podman";
-  version = "2.0.6";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    sha256 = "1kl8cfsqwfbjl14mbp58wrxfm90y2w58x6138zq0sn4jzwwpy1a4";
+    sha256 = "033pdkrmdsk33n1mglpcpl3g9i62raw47wpab752qhbmpy1c49lr";
  };

  vendorSha256 = null;
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@ -29,7 +29,7 @@
 , target ? null
 , cargoVendorDir ? null
 , checkType ? buildType
-
+, depsExtraArgs ? {}
 # Needed to `pushd`/`popd` into a subdir of a tarball if this subdir
 # contains a Cargo.toml, but isn't part of a workspace (which is e.g. the
 # case for `rustfmt`/etc from the `rust-sources).
@ -43,11 +43,11 @@ assert buildType == "release" || buildType == "debug";
 let

  cargoDeps = if cargoVendorDir == null
-    then fetchCargoTarball {
+    then fetchCargoTarball ({
        inherit name src srcs sourceRoot unpackPhase cargoUpdateHook;
        patches = cargoPatches;
        sha256 = cargoSha256;
-      }
+      } // depsExtraArgs)
    else null;

  # If we have a cargoSha256 fixed-output derivation, validate it at build time
@ -83,7 +83,7 @@ let

 in

-stdenv.mkDerivation (args // {
+stdenv.mkDerivation ((removeAttrs args ["depsExtraArgs"]) // {
  inherit cargoDeps;

  patchRegistryDeps = ./patch-registry-deps;
--- a/pkgs/data/fonts/comic-neue/default.nix
+++ b/pkgs/data/fonts/comic-neue/default.nix
@ -1,32 +1,44 @@
-{ lib, fetchzip }:
+{ stdenv, fetchzip }:

-let
-  version = "2.3";
-in fetchzip rec {
-  name = "comic-neue-${version}";
+stdenv.mkDerivation rec {
+  pname = "comic-neue";
+  version = "2.5";

-  url = "http://comicneue.com/${name}.zip";
+  src = fetchzip {
+    url = "http://comicneue.com/${pname}-${version}.zip";
+    sha256 = "1kc0yyha6cc584vcl9z1cq1z6prgkxk93g75mr8gapfdrj25dp3q";
+    stripRoot = false; # because it comes with a __MACOSX directory
+  };

-  postFetch = ''
-    mkdir -vp $out/share/{doc,fonts}
-    unzip -j $downloadedFile OTF/\*.otf   -d $out/share/fonts/opentype
-    unzip -j $downloadedFile Web/\*.ttf   -d $out/share/fonts/truetype
-    unzip -j $downloadedFile Web/\*.eot   -d $out/share/fonts/EOT
-    unzip -j $downloadedFile Web/\*.woff  -d $out/share/fonts/WOFF
-    unzip -j $downloadedFile Web/\*.woff2 -d $out/share/fonts/WOFF2
-    unzip -j $downloadedFile \*.pdf FONTLOG.txt OFL-FAQ.txt SIL-License.txt -d $out/share/doc/${name}
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,EOT,WOFF,WOFF2}}
+    cp -v ${pname}-${version}/{FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
+    cp -v ${pname}-${version}/OTF/ComicNeue-Angular/*.otf $out/share/fonts/opentype
+    cp -v ${pname}-${version}/OTF/ComicNeue/*.otf $out/share/fonts/opentype
+    cp -v ${pname}-${version}/TTF/ComicNeue-Angular/*.ttf $out/share/fonts/truetype
+    cp -v ${pname}-${version}/TTF/ComicNeue/*.ttf $out/share/fonts/truetype
+    cp -v ${pname}-${version}/WebFonts/eot/ComicNeue-Angular/*.eot $out/share/fonts/EOT
+    cp -v ${pname}-${version}/WebFonts/eot/ComicNeue/*.eot $out/share/fonts/EOT
+    cp -v ${pname}-${version}/WebFonts/woff/ComicNeue-Angular/*.woff $out/share/fonts/WOFF
+    cp -v ${pname}-${version}/WebFonts/woff/ComicNeue/*.woff $out/share/fonts/WOFF
+    cp -v ${pname}-${version}/WebFonts/woff2/ComicNeue/*.woff2 $out/share/fonts/WOFF2
+
+    # Quick fix for conflicting names in upstream
+    for i in ${pname}-${version}/WebFonts/woff2/ComicNeue-Angular/*.woff2; do
+      cp -v $i $out/share/fonts/WOFF2/`basename $i|sed -e 's|ComicNeue|ComicNeue-Angular|'`
+    done
  '';

-  sha256 = "1gs4vhys0m3qsw06qaxzyi81f06w5v66kbyl64yw3pq2rb656779";
-
-  meta = with lib; {
+  meta = with stdenv.lib; {
    homepage = "http://comicneue.com/";
    description = "A casual type face: Make your lemonade stand look like a fortune 500 company";
    longDescription = ''
-      It is inspired by Comic Sans but more regular.  The font was
-      designed by Craig Rozynski.  It is available in two variants:
-      Comic Neue and Comic Neue Angular.  The former having round and
-      the latter angular terminals.  Both variants come in Light,
+      ComicNeue is inspired by Comic Sans but more regular. It was
+      designed by Craig Rozynski. It is available in two variants:
+      Comic Neue and Comic Neue Angular. The former having round and
+      the latter angular terminals. Both variants come in Light,
      Regular, and Bold weights with Oblique variants.
    '';
    license = licenses.ofl;
--- a/pkgs/development/chez-modules/chez-mit/default.nix
+++ b/pkgs/development/chez-modules/chez-mit/default.nix
@ -13,7 +13,6 @@ stdenv.mkDerivation {
  buildInputs = [ chez chez-srfi ];

  buildPhase = ''
-    export CHEZSCHEMELIBDIRS=${chez-srfi}/lib/csv-site
    make PREFIX=$out CHEZ=${chez}/bin/scheme
  '';

--- a/pkgs/development/chez-modules/chez-scmutils/default.nix
+++ b/pkgs/development/chez-modules/chez-scmutils/default.nix
@ -13,7 +13,6 @@ stdenv.mkDerivation {
  buildInputs = [ chez chez-srfi chez-mit ];

  buildPhase = ''
-    export CHEZSCHEMELIBDIRS=${chez-srfi}/lib/csv-site:${chez-mit}/lib/csv-site
    make PREFIX=$out CHEZ=${chez}/bin/scheme
  '';

--- a/pkgs/development/compilers/chez/default.nix
+++ b/pkgs/development/compilers/chez/default.nix
@ -65,6 +65,8 @@ stdenv.mkDerivation rec {
    rm -rf $out/lib/csv${version}/examples
  '';

+  setupHook = ./setup-hook.sh;
+
  meta = {
    description  = "A powerful and incredibly fast R6RS Scheme compiler";
    homepage     = "https://cisco.github.io/ChezScheme/";
--- a/Show More
+++ b/Show More