Merge branch 'staging-next' into staging

2020-03-04 21:24:05 +01:00 · 2020-03-04 21:24:05 +01:00 · 1a44e325d2
commit 1a44e325d2
parent 62e09735d0 7399c59c41
398 changed files with 11785 additions and 9553 deletions
--- a/doc/Makefile
+++ b/doc/Makefile
@ -87,7 +87,7 @@ functions/library/generated: doc-support/result
 	ln -rfs ./doc-support/result/function-docs functions/library/generated

 %.section.xml: %.section.md
-	pandoc $^ -w docbook+smart \
+	pandoc $^ -w docbook \
 		-f markdown+smart \
 	  | sed -e 's|<ulink url=|<link xlink:href=|' \
 	      -e 's|</ulink>|</link>|' \
@ -98,7 +98,7 @@ functions/library/generated: doc-support/result
 	| cat  > $@

 %.chapter.xml: %.chapter.md
-	pandoc $^ -w docbook+smart \
+	pandoc $^ -w docbook \
 		--top-level-division=chapter \
 		-f markdown+smart \
 	  | sed -e 's|<ulink url=|<link xlink:href=|' \
--- a/doc/functions/library/attrsets.xml
+++ b/doc/functions/library/attrsets.xml
@ -1667,4 +1667,48 @@ recursiveUpdate
 ]]></programlisting>
  </example>
 </section>
+
+ <section xml:id="function-library-lib.attrsets.recurseIntoAttrs">
+  <title><function>lib.attrsets.recurseIntoAttrs</function></title>
+
+  <subtitle><literal>recurseIntoAttrs :: AttrSet -> AttrSet</literal>
+  </subtitle>
+
+  <xi:include href="./locations.xml" xpointer="lib.attrsets.recurseIntoAttrs" />
+
+  <para>
+   Make various Nix tools consider the contents of the resulting
+   attribute set when looking for what to build, find, etc.
+  </para>
+
+  <para>
+   This function only affects a single attribute set; it does not apply itself recursively for nested attribute sets.
+  </para>
+
+  <variablelist>
+   <varlistentry>
+    <term>
+     <varname>attrs</varname>
+    </term>
+    <listitem>
+     <para>
+      An attribute set to scan for derivations.
+     </para>
+    </listitem>
+   </varlistentry>
+  </variablelist>
+
+  <example xml:id="function-library-lib.attrsets.recurseIntoAttrs-example">
+   <title>Making Nix look inside an attribute set</title>
+<programlisting><![CDATA[
+{ pkgs ? import <nixpkgs> {} }:
+{
+  myTools = pkgs.lib.recurseIntoAttrs {
+    inherit (pkgs) hello figlet;
+  };
+}
+]]></programlisting>
+  </example>
+ </section>
+
 </section>
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -473,6 +473,20 @@ rec {
  /* Pick the outputs of packages to place in buildInputs */
  chooseDevOutputs = drvs: builtins.map getDev drvs;

+  /* Make various Nix tools consider the contents of the resulting
+     attribute set when looking for what to build, find, etc.
+
+     This function only affects a single attribute set; it does not
+     apply itself recursively for nested attribute sets.
+   */
+  recurseIntoAttrs =
+    attrs: attrs // { recurseForDerivations = true; };
+
+  /* Undo the effect of recurseIntoAttrs.
+   */
+  dontRecurseIntoAttrs =
+    attrs: attrs // { recurseForDerivations = false; };
+
  /*** deprecated stuff ***/

  zipWithNames = zipAttrsWithNames;
--- a/lib/default.nix
+++ b/lib/default.nix
@ -73,7 +73,8 @@ let
      genAttrs isDerivation toDerivation optionalAttrs
      zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
      recursiveUpdate matchAttrs overrideExisting getOutput getBin
-      getLib getDev chooseDevOutputs zipWithNames zip;
+      getLib getDev chooseDevOutputs zipWithNames zip
+      recurseIntoAttrs dontRecurseIntoAttrs;
    inherit (lists) singleton forEach foldr fold foldl foldl' imap0 imap1
      concatMap flatten remove findSingle findFirst any all count
      optional optionals toList range partition zipListsWith zipLists
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1461,6 +1461,16 @@
    githubId = 5684605;
    name = "Cole Scott";
  };
+  cole-h = {
+    name = "Cole Helbling";
+    email = "cole.e.helbling@outlook.com";
+    github = "cole-h";
+    githubId = 28582702;
+    keys = [{
+      longkeyid = "rsa4096/0xB37E0F2371016A4C";
+      fingerprint = "68B8 0D57 B2E5 4AC3 EC1F  49B0 B37E 0F23 7101 6A4C";
+    }];
+  };
  copumpkin = {
    email = "pumpkingod@gmail.com";
    github = "copumpkin";
@ -4939,6 +4949,12 @@
    githubId = 118035;
    name = "Corbin Simpson";
  };
+  mothsart = {
+    email = "jerem.ferry@gmail.com";
+    github = "mothsart";
+    githubId = 10601196;
+    name = "Jérémie Ferry";
+  };
  mounium = {
    email = "muoniurn@gmail.com";
    github = "mounium";
--- a/nixos/doc/manual/configuration/xfce.xml
+++ b/nixos/doc/manual/configuration/xfce.xml
@ -9,7 +9,6 @@
 <programlisting>
 <xref linkend="opt-services.xserver.desktopManager.xfce.enable" /> = true;
 <xref linkend="opt-services.xserver.displayManager.defaultSession" /> = "xfce";
-};
 </programlisting>
 </para>
 <para>
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -631,6 +631,16 @@ auth required pam_succeed_if.so uid >= 1000 quiet
     </citerefentry>-script now uses the python test-driver.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The <package>riot-web</package> package now accepts configuration overrides as an attribute set instead of a string.
+     A formerly used JSON configuration can be converted to an attribute set with <literal>builtins.fromJSON</literal>.
+    </para>
+    <para>
+     The new default configuration also disables automatic guest account registration and analytics to improve privacy.
+     The previous behavior can be restored by setting <literal>config.riot-web.conf = { disable_guests = false; piwik = true; }</literal>.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

@ -693,6 +703,15 @@ auth required pam_succeed_if.so uid >= 1000 quiet
    via <option>boot.initrd.luks.fido2Support</option>.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     Predicatbly named network-interfaces get renamed in stage-1. This means that it's possible
+     to use the proper interface name for e.g. dropbear-setups.
+    </para>
+    <para>
+     For further reference, please read <link xlink:href="https://github.com/NixOS/nixpkgs/pull/68953">#68953</link> or the corresponding <link xlink:href="https://discourse.nixos.org/t/predictable-network-interface-names-in-initrd/4055">discourse thread</link>.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/modules/hardware/video/amdgpu-pro.nix
+++ b/nixos/modules/hardware/video/amdgpu-pro.nix
@ -30,7 +30,7 @@ in
    nixpkgs.config.xorg.abiCompat = "1.19";

    services.xserver.drivers = singleton
-      { name = "amdgpu"; modules = [ package ]; };
+      { name = "amdgpu"; modules = [ package ]; display = true; };

    hardware.opengl.package = package;
    hardware.opengl.package32 = package32;
--- a/nixos/modules/hardware/video/ati.nix
+++ b/nixos/modules/hardware/video/ati.nix
@ -21,7 +21,7 @@ in
    nixpkgs.config.xorg.abiCompat = "1.17";

    services.xserver.drivers = singleton
-      { name = "fglrx"; modules = [ ati_x11 ]; };
+      { name = "fglrx"; modules = [ ati_x11 ]; display = true; };

    hardware.opengl.package = ati_x11;
    hardware.opengl.package32 = pkgs.pkgsi686Linux.linuxPackages.ati_drivers_x11.override { libsOnly = true; kernel = null; };
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -34,26 +34,57 @@ let
  enabled = nvidia_x11 != null;

  cfg = config.hardware.nvidia;
-  optimusCfg = cfg.optimus_prime;
+  pCfg = cfg.prime;
+  syncCfg = pCfg.sync;
+  offloadCfg = pCfg.offload;
+  primeEnabled = syncCfg.enable || offloadCfg.enable;
 in

 {
+  imports =
+    [
+      (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "enable" ] [ "hardware" "nvidia" "prime" "sync" "enable" ])
+      (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "allowExternalGpu" ] [ "hardware" "nvidia" "prime" "sync" "allowExternalGpu" ])
+      (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "nvidiaBusId" ] [ "hardware" "nvidia" "prime" "nvidiaBusId" ])
+      (mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "intelBusId" ] [ "hardware" "nvidia" "prime" "intelBusId" ])
+    ];
+
  options = {
-    hardware.nvidia.modesetting.enable = lib.mkOption {
-      type = lib.types.bool;
+    hardware.nvidia.modesetting.enable = mkOption {
+      type = types.bool;
      default = false;
      description = ''
        Enable kernel modesetting when using the NVIDIA proprietary driver.

        Enabling this fixes screen tearing when using Optimus via PRIME (see
-        <option>hardware.nvidia.optimus_prime.enable</option>. This is not enabled
+        <option>hardware.nvidia.prime.sync.enable</option>. This is not enabled
        by default because it is not officially supported by NVIDIA and would not
        work with SLI.
      '';
    };

-    hardware.nvidia.optimus_prime.enable = lib.mkOption {
-      type = lib.types.bool;
+    hardware.nvidia.prime.nvidiaBusId = mkOption {
+      type = types.str;
+      default = "";
+      example = "PCI:1:0:0";
+      description = ''
+        Bus ID of the NVIDIA GPU. You can find it using lspci; for example if lspci
+        shows the NVIDIA GPU at "01:00.0", set this option to "PCI:1:0:0".
+      '';
+    };
+
+    hardware.nvidia.prime.intelBusId = mkOption {
+      type = types.str;
+      default = "";
+      example = "PCI:0:2:0";
+      description = ''
+        Bus ID of the Intel GPU. You can find it using lspci; for example if lspci
+        shows the Intel GPU at "00:02.0", set this option to "PCI:0:2:0".
+      '';
+    };
+
+    hardware.nvidia.prime.sync.enable = mkOption {
+      type = types.bool;
      default = false;
      description = ''
        Enable NVIDIA Optimus support using the NVIDIA proprietary driver via PRIME.
@ -66,8 +97,8 @@ in
        be the only driver there.

        If this is enabled, then the bus IDs of the NVIDIA and Intel GPUs have to be
-        specified (<option>hardware.nvidia.optimus_prime.nvidiaBusId</option> and
-        <option>hardware.nvidia.optimus_prime.intelBusId</option>).
+        specified (<option>hardware.nvidia.prime.nvidiaBusId</option> and
+        <option>hardware.nvidia.prime.intelBusId</option>).

        If you enable this, you may want to also enable kernel modesetting for the
        NVIDIA driver (<option>hardware.nvidia.modesetting.enable</option>) in order
@ -79,31 +110,23 @@ in
      '';
    };

-    hardware.nvidia.optimus_prime.allowExternalGpu = lib.mkOption {
-      type = lib.types.bool;
+    hardware.nvidia.prime.sync.allowExternalGpu = mkOption {
+      type = types.bool;
      default = false;
      description = ''
        Configure X to allow external NVIDIA GPUs when using optimus.
      '';
    };

-    hardware.nvidia.optimus_prime.nvidiaBusId = lib.mkOption {
-      type = lib.types.str;
-      default = "";
-      example = "PCI:1:0:0";
+    hardware.nvidia.prime.offload.enable = mkOption {
+      type = types.bool;
+      default = false;
      description = ''
-        Bus ID of the NVIDIA GPU. You can find it using lspci; for example if lspci
-        shows the NVIDIA GPU at "01:00.0", set this option to "PCI:1:0:0".
-      '';
-    };
+        Enable render offload support using the NVIDIA proprietary driver via PRIME.

-    hardware.nvidia.optimus_prime.intelBusId = lib.mkOption {
-      type = lib.types.str;
-      default = "";
-      example = "PCI:0:2:0";
-      description = ''
-        Bus ID of the Intel GPU. You can find it using lspci; for example if lspci
-        shows the Intel GPU at "00:02.0", set this option to "PCI:0:2:0".
+        If this is enabled, then the bus IDs of the NVIDIA and Intel GPUs have to be
+        specified (<option>hardware.nvidia.prime.nvidiaBusId</option> and
+        <option>hardware.nvidia.prime.intelBusId</option>).
      '';
    };
  };
@ -116,12 +139,19 @@ in
      }

      {
-        assertion = !optimusCfg.enable ||
-          (optimusCfg.nvidiaBusId != "" && optimusCfg.intelBusId != "");
+        assertion = primeEnabled -> pCfg.nvidiaBusId != "" && pCfg.intelBusId != "";
        message = ''
-          When NVIDIA Optimus via PRIME is enabled, the GPU bus IDs must configured.
+          When NVIDIA PRIME is enabled, the GPU bus IDs must configured.
        '';
      }
+      {
+        assertion = offloadCfg.enable -> versionAtLeast nvidia_x11.version "435.21";
+        message = "NVIDIA PRIME render offload is currently only supported on versions >= 435.21.";
+      }
+      {
+        assertion = !(syncCfg.enable && offloadCfg.enable);
+        message = "Only one NVIDIA PRIME solution may be used at a time.";
+      }
    ];

    # If Optimus/PRIME is enabled, we:
@ -136,36 +166,38 @@ in
    # - Configure the display manager to run specific `xrandr` commands which will
    #   configure/enable displays connected to the Intel GPU.

-    services.xserver.drivers = singleton {
+    services.xserver.useGlamor = mkDefault offloadCfg.enable;
+
+    services.xserver.drivers = optional primeEnabled {
+      name = "modesetting";
+      display = offloadCfg.enable;
+      deviceSection = ''
+        BusID "${pCfg.intelBusId}"
+        ${optionalString syncCfg.enable ''Option "AccelMethod" "none"''}
+      '';
+    } ++ singleton {
      name = "nvidia";
      modules = [ nvidia_x11.bin ];
-      deviceSection = optionalString optimusCfg.enable
+      display = !offloadCfg.enable;
+      deviceSection = optionalString primeEnabled
        ''
-          BusID "${optimusCfg.nvidiaBusId}"
-          ${optionalString optimusCfg.allowExternalGpu "Option \"AllowExternalGpus\""}
+          BusID "${pCfg.nvidiaBusId}"
+          ${optionalString syncCfg.allowExternalGpu "Option \"AllowExternalGpus\""}
        '';
      screenSection =
        ''
          Option "RandRRotation" "on"
-          ${optionalString optimusCfg.enable "Option \"AllowEmptyInitialConfiguration\""}
+          ${optionalString syncCfg.enable "Option \"AllowEmptyInitialConfiguration\""}
        '';
    };

-    services.xserver.extraConfig = optionalString optimusCfg.enable
-      ''
-        Section "Device"
-          Identifier "nvidia-optimus-intel"
-          Driver "modesetting"
-          BusID  "${optimusCfg.intelBusId}"
-          Option "AccelMethod" "none"
-        EndSection
-      '';
-    services.xserver.serverLayoutSection = optionalString optimusCfg.enable
-      ''
-        Inactive "nvidia-optimus-intel"
-      '';
+    services.xserver.serverLayoutSection = optionalString syncCfg.enable ''
+      Inactive "Device-modesetting[0]"
+    '' + optionalString offloadCfg.enable ''
+      Option "AllowNVIDIAGPUScreens"
+    '';

-    services.xserver.displayManager.setupCommands = optionalString optimusCfg.enable ''
+    services.xserver.displayManager.setupCommands = optionalString syncCfg.enable ''
      # Added by nvidia configuration module for Optimus/PRIME.
      ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource modesetting NVIDIA-0
      ${pkgs.xorg.xrandr}/bin/xrandr --auto
@ -175,11 +207,13 @@ in
      source = "${nvidia_x11.bin}/share/nvidia/nvidia-application-profiles-rc";
    };

-    hardware.opengl.package = nvidia_x11.out;
-    hardware.opengl.package32 = nvidia_libs32;
+    hardware.opengl.package = mkIf (!offloadCfg.enable) nvidia_x11.out;
+    hardware.opengl.package32 = mkIf (!offloadCfg.enable) nvidia_libs32;
+    hardware.opengl.extraPackages = optional offloadCfg.enable nvidia_x11.out;
+    hardware.opengl.extraPackages32 = optional offloadCfg.enable nvidia_libs32;

    environment.systemPackages = [ nvidia_x11.bin nvidia_x11.settings ]
-      ++ lib.filter (p: p != null) [ nvidia_x11.persistenced ];
+      ++ filter (p: p != null) [ nvidia_x11.persistenced ];

    systemd.tmpfiles.rules = optional config.virtualisation.docker.enableNvidia
        "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin"
@ -190,10 +224,10 @@ in

    # nvidia-uvm is required by CUDA applications.
    boot.kernelModules = [ "nvidia-uvm" ] ++
-      lib.optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];
+      optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];

    # If requested enable modesetting via kernel parameter.
-    boot.kernelParams = optional cfg.modesetting.enable "nvidia-drm.modeset=1";
+    boot.kernelParams = optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1";

    # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
    services.udev.extraRules =
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -660,6 +660,7 @@
  ./services/networking/ngircd.nix
  ./services/networking/nghttpx/default.nix
  ./services/networking/nix-serve.nix
+  ./services/networking/nix-store-gcs-proxy.nix
  ./services/networking/nixops-dns.nix
  ./services/networking/nntp-proxy.nix
  ./services/networking/nsd.nix
@ -807,6 +808,7 @@
  ./services/ttys/agetty.nix
  ./services/ttys/gpm.nix
  ./services/ttys/kmscon.nix
+  ./services/wayland/cage.nix
  ./services/web-apps/atlassian/confluence.nix
  ./services/web-apps/atlassian/crowd.nix
  ./services/web-apps/atlassian/jira.nix
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -136,6 +136,27 @@ let
          challenge to ensure the DNS entries required are available.
        '';
      };
+
+      ocspMustStaple = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Turns on the OCSP Must-Staple TLS extension.
+          Make sure you know what you're doing! See:
+          <itemizedlist>
+            <listitem><para><link xlink:href="https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/" /></para></listitem>
+            <listitem><para><link xlink:href="https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html" /></para></listitem>
+          </itemizedlist>
+        '';
+      };
+
+      extraLegoRenewFlags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Additional flags to pass to lego renew.
+        '';
+      };
    };
  };

@ -174,7 +195,7 @@ in

      renewInterval = mkOption {
        type = types.str;
-        default = "weekly";
+        default = "daily";
        description = ''
          Systemd calendar expression when to check for renewal. See
          <citerefentry><refentrytitle>systemd.time</refentrytitle>
@ -288,12 +309,16 @@ in
                          ++ concatLists (mapAttrsToList (name: root: [ "-d" name ]) data.extraDomains)
                          ++ (if data.dnsProvider != null then [ "--dns" data.dnsProvider ] else [ "--http" "--http.webroot" data.webroot ])
                          ++ optionals (cfg.server != null || data.server != null) ["--server" (if data.server == null then cfg.server else data.server)];
-                runOpts = escapeShellArgs (globalOpts ++ [ "run" ]);
-                renewOpts = escapeShellArgs (globalOpts ++ [ "renew" "--days" (toString cfg.validMinDays) ]);
+                certOpts = optionals data.ocspMustStaple [ "--must-staple" ];
+                runOpts = escapeShellArgs (globalOpts ++ [ "run" ] ++ certOpts);
+                renewOpts = escapeShellArgs (globalOpts ++
+                  [ "renew" "--days" (toString cfg.validMinDays) ] ++
+                  certOpts ++ data.extraLegoRenewFlags);
                acmeService = {
                  description = "Renew ACME Certificate for ${cert}";
                  after = [ "network.target" "network-online.target" ];
                  wants = [ "network-online.target" ];
+                  wantedBy = [ "multi-user.target" ];
                  serviceConfig = {
                    Type = "oneshot";
                    # With RemainAfterExit the service is considered active even
@ -327,7 +352,7 @@ in
                            cp -p ${spath}/certificates/${keyName}.key key.pem
                            cp -p ${spath}/certificates/${keyName}.crt fullchain.pem
                            cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
-                            ln -s fullchain.pem cert.pem
+                            ln -sf fullchain.pem cert.pem
                            cat key.pem fullchain.pem > full.pem
                            chmod ${rights} *.pem
                            chown '${data.user}:${data.group}' *.pem
@ -399,7 +424,17 @@ in
      systemd.tmpfiles.rules =
        map (data: "d ${data.webroot}/.well-known/acme-challenge - ${data.user} ${data.group}") (filter (data: data.webroot != null) (attrValues cfg.certs));

-      systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair
+      systemd.timers = let
+        # Allow systemd to pick a convenient time within the day
+        # to run the check.
+        # This allows the coalescing of multiple timer jobs.
+        # We divide by the number of certificates so that if you
+        # have many certificates, the renewals are distributed over
+        # the course of the day to avoid rate limits.
+        numCerts = length (attrNames cfg.certs);
+        _24hSecs = 60 * 60 * 24;
+        AccuracySec = "${toString (_24hSecs / numCerts)}s";
+      in flip mapAttrs' cfg.certs (cert: data: nameValuePair
        ("acme-${cert}")
        ({
          description = "Renew ACME Certificate for ${cert}";
@ -408,8 +443,9 @@ in
            OnCalendar = cfg.renewInterval;
            Unit = "acme-${cert}.service";
            Persistent = "yes";
-            AccuracySec = "5m";
-            RandomizedDelaySec = "1h";
+            inherit AccuracySec;
+            # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.
+            RandomizedDelaySec = "24h";
          };
        })
      );
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@ -37,6 +37,13 @@ in

      after = [ "dev-random.device" ];

+      # Clean shutdown without DefaultDependencies
+      conflicts = [ "shutdown.target" ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+      ];
+
      description = "Hardware RNG Entropy Gatherer Daemon";

      # rngd may have to start early to avoid entropy starvation during boot with encrypted swap
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@ -265,6 +265,11 @@ in {
      '';
      serviceConfig = {
        Type = "oneshot";
+        # RemainAfterExit makes restartIfChanged work for this service, so
+        # downstream services will get updated automatically when things like
+        # services.mailman.hyperkitty.baseUrl change.  Otherwise users have to
+        # restart things manually, which is confusing.
+        RemainAfterExit = "yes";
      };
    };

@ -282,6 +287,9 @@ in {
      serviceConfig = {
        User = cfg.webUser;
        Type = "oneshot";
+        # Similar to mailman-settings.service, this makes restartTriggers work
+        # properly for this service.
+        RemainAfterExit = "yes";
        WorkingDirectory = "/var/lib/mailman-web";
      };
    };
--- a/nixos/modules/services/misc/home-assistant.nix
+++ b/nixos/modules/services/misc/home-assistant.nix
@ -96,7 +96,20 @@ in {

    config = mkOption {
      default = null;
-      type = with types; nullOr attrs;
+      # Migrate to new option types later: https://github.com/NixOS/nixpkgs/pull/75584
+      type =  with lib.types; let
+          valueType = nullOr (oneOf [
+            bool
+            int
+            float
+            str
+            (lazyAttrsOf valueType)
+            (listOf valueType)
+          ]) // {
+            description = "Yaml value";
+            emptyValue.value = {};
+          };
+        in valueType;
      example = literalExample ''
        {
          homeassistant = {
--- a/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix
@ -30,7 +30,17 @@ in
        Whether to perform certificate verification for https.
      '';
    };
-
+    constLabels = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      example = [
+        "label1=value1"
+        "label2=value2"
+      ];
+      description = ''
+        A list of constant labels that will be used in every metric.
+      '';
+    };
  };
  serviceOpts = {
    serviceConfig = {
@ -40,6 +50,7 @@ in
          --nginx.ssl-verify ${toString cfg.sslVerify} \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
          --web.telemetry-path ${cfg.telemetryPath} \
+          --prometheus.const-labels ${concatStringsSep "," cfg.constLabels} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
    };
--- a/nixos/modules/services/networking/git-daemon.nix
+++ b/nixos/modules/services/networking/git-daemon.nix
@ -104,14 +104,14 @@ in

  config = mkIf cfg.enable {

-    users.users = optionalAttrs (cfg.user != "git") {
+    users.users = optionalAttrs (cfg.user == "git") {
      git = {
        uid = config.ids.uids.git;
        description = "Git daemon user";
      };
    };

-    users.groups = optionalAttrs (cfg.group != "git") {
+    users.groups = optionalAttrs (cfg.group == "git") {
      git.gid = config.ids.gids.git;
    };

--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@ -65,7 +65,7 @@ let
        let
          m                = builtins.match "([0-9.]+):([0-9-]+)" fwd.destination;
          destinationIP    = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;
-          destinationPorts = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else elemAt m 1;
+          destinationPorts = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1);
        in ''
          # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself
          iptables -w -t nat -A nixos-nat-out \
--- a/nixos/modules/services/networking/nix-store-gcs-proxy.nix
+++ b/nixos/modules/services/networking/nix-store-gcs-proxy.nix
@ -0,0 +1,75 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  opts = { name, config, ... }: {
+    options = {
+      enable = mkOption {
+        default = true;
+        type = types.bool;
+        example = true;
+        description = "Whether to enable proxy for this bucket";
+      };
+      bucketName = mkOption {
+        type = types.str;
+        default = name;
+        example = "my-bucket-name";
+        description = "Name of Google storage bucket";
+      };
+      address = mkOption {
+        type = types.str;
+        example = "localhost:3000";
+        description = "The address of the proxy.";
+      };
+    };
+  };
+  enabledProxies = lib.filterAttrs (n: v: v.enable) config.services.nix-store-gcs-proxy;
+  mapProxies = function: lib.mkMerge (lib.mapAttrsToList function enabledProxies);
+in
+{
+  options.services.nix-store-gcs-proxy = mkOption {
+    type = types.attrsOf (types.submodule opts);
+    default = {};
+    description = ''
+      An attribute set describing an HTTP to GCS proxy that allows us to use GCS
+      bucket via HTTP protocol.
+    '';
+  };
+
+  config.systemd.services = mapProxies (name: cfg: {
+    "nix-store-gcs-proxy-${name}" = {
+      description = "A HTTP nix store that proxies requests to Google Storage";
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        RestartSec = 5;
+        StartLimitInterval = 10;
+        ExecStart = ''
+          ${pkgs.nix-store-gcs-proxy}/bin/nix-store-gcs-proxy \
+            --bucket-name ${cfg.bucketName} \
+            --addr ${cfg.address}
+        '';
+
+        DynamicUser = true;
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+
+        NoNewPrivileges = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+      };
+    };
+  });
+
+  meta.maintainers = [ maintainers.mrkkrp ];
+}
--- a/nixos/modules/services/networking/sslh.nix
+++ b/nixos/modules/services/networking/sslh.nix
@ -77,19 +77,14 @@ in

  config = mkMerge [
    (mkIf cfg.enable {
-      users.users.${user} = {
-        description = "sslh daemon user";
-        isSystemUser = true;
-      };
-
      systemd.services.sslh = {
        description = "Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port)";
        after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];

        serviceConfig = {
-          User                 = user;
-          Group                = "nogroup";
+          DynamicUser          = true;
+          User                 = "sslh";
          PermissionsStartOnly = true;
          Restart              = "always";
          RestartSec           = "1s";
--- a/nixos/modules/services/networking/zerotierone.nix
+++ b/nixos/modules/services/networking/zerotierone.nix
@ -67,5 +67,15 @@ in
    networking.firewall.allowedUDPPorts = [ cfg.port ];

    environment.systemPackages = [ cfg.package ];
+
+    # Prevent systemd from potentially changing the MAC address
+    environment.etc."systemd/network/50-zerotier.link".text = ''
+      [Match]
+      OriginalName=zt*
+
+      [Link]
+      AutoNegotiation=false
+      MACAddressPolicy=none
+    '';
  };
 }
--- a/nixos/modules/services/wayland/cage.nix
+++ b/nixos/modules/services/wayland/cage.nix
@ -0,0 +1,99 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.cage;
+in {
+  options.services.cage.enable = mkEnableOption "cage kiosk service";
+
+  options.services.cage.user = mkOption {
+    type = types.str;
+    default = "demo";
+    description = ''
+      User to log-in as.
+    '';
+  };
+
+  options.services.cage.extraArguments = mkOption {
+    type = types.listOf types.str;
+    default = [];
+    defaultText = "[]";
+    description = "Additional command line arguments to pass to Cage.";
+    example = ["-d"];
+  };
+
+  options.services.cage.program = mkOption {
+    type = types.path;
+    default = "${pkgs.xterm}/bin/xterm";
+    description = ''
+      Program to run in cage.
+    '';
+  };
+
+  config = mkIf cfg.enable {
+
+    # The service is partially based off of the one provided in the
+    # cage wiki at
+    # https://github.com/Hjdskes/cage/wiki/Starting-Cage-on-boot-with-systemd.
+    systemd.services."cage-tty1" = {
+      enable = true;
+      after = [
+        "systemd-user-sessions.service"
+        "plymouth-start.service"
+        "plymouth-quit.service"
+        "systemd-logind.service"
+        "getty@tty1.service"
+      ];
+      before = [ "graphical.target" ];
+      wants = [ "dbus.socket" "systemd-logind.service" "plymouth-quit.service"];
+      wantedBy = [ "graphical.target" ];
+      conflicts = [ "getty@tty1.service" ];
+
+      restartIfChanged = false;
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.cage}/bin/cage \
+            ${escapeShellArgs cfg.extraArguments} \
+            -- ${cfg.program}
+        '';
+        User = cfg.user;
+
+        ConditionPathExists = "/dev/tty1";
+        IgnoreSIGPIPE = "no";
+
+        # Log this user with utmp, letting it show up with commands 'w' and
+        # 'who'. This is needed since we replace (a)getty.
+        UtmpIdentifier = "%n";
+        UtmpMode = "user";
+        # A virtual terminal is needed.
+        TTYPath = "/dev/tty1";
+        TTYReset = "yes";
+        TTYVHangup = "yes";
+        TTYVTDisallocate = "yes";
+        # Fail to start if not controlling the virtual terminal.
+        StandardInput = "tty-fail";
+        StandardOutput = "syslog";
+        StandardError = "syslog";
+        # Set up a full (custom) user session for the user, required by Cage.
+        PAMName = "cage";
+      };
+    };
+
+    security.pam.services.cage.text = ''
+      auth    required pam_unix.so nullok
+      account required pam_unix.so
+      session required pam_unix.so
+      session required ${pkgs.systemd}/lib/security/pam_systemd.so
+    '';
+
+    hardware.opengl.enable = mkDefault true;
+
+    systemd.targets.graphical.wants = [ "cage-tty1.service" ];
+
+    systemd.defaultUnit = "graphical.target";
+  };
+
+  meta.maintainers = with lib.maintainers; [ matthewbauer flokli ];
+
+}
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -16,7 +16,10 @@ in

 {

-  meta.maintainers = pkgs.pantheon.maintainers;
+  meta = {
+    doc = ./pantheon.xml;
+    maintainers = pkgs.pantheon.maintainers;
+  };

  options = {

--- a/nixos/modules/services/x11/desktop-managers/pantheon.xml
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.xml
@ -0,0 +1,130 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-pantheon">
+ <title>Pantheon Destkop</title>
+ <para>
+  Pantheon is the desktop environment created for the elementary OS distribution. It is written from scratch in Vala, utilizing GNOME technologies with GTK 3 and Granite.
+ </para>
+ <section xml:id="sec-pantheon-enable">
+  <title>Enabling Pantheon</title>
+
+  <para>
+   All of Pantheon is working in NixOS and the applications should be available, aside from a few <link xlink:href="https://github.com/NixOS/nixpkgs/issues/58161">exceptions</link>. To enable Pantheon, set
+<programlisting>
+<xref linkend="opt-services.xserver.desktopManager.pantheon.enable"/> = true;
+</programlisting>
+   This automatically enables LightDM and Pantheon's LightDM greeter. If you'd like to disable this, set
+<programlisting>
+<xref linkend="opt-services.xserver.displayManager.lightdm.greeters.pantheon.enable"/> = false;
+<xref linkend="opt-services.xserver.displayManager.lightdm.enable"/> = false;
+</programlisting>
+   but please be aware using Pantheon without LightDM as a display manager will break screenlocking from the UI. The NixOS module for Pantheon installs all of Pantheon's default applications. If you'd like to not install Pantheon's apps, set
+<programlisting>
+<xref linkend="opt-services.pantheon.apps.enable"/> = false;
+</programlisting>
+   You can also use <xref linkend="opt-environment.pantheon.excludePackages"/> to remove any other app (like <package>geary</package>).
+  </para>
+ </section>
+ <section xml:id="sec-pantheon-wingpanel-switchboard">
+  <title>Wingpanel and Switchboard plugins</title>
+
+  <para>
+   Wingpanel and Switchboard work differently than they do in other distributions, as far as using plugins. You cannot install a plugin globally (like with <option>environment.systemPackages</option>) to start using it. You should instead be using the following options:
+   <itemizedlist>
+    <listitem>
+     <para>
+      <xref linkend="opt-services.xserver.desktopManager.pantheon.extraWingpanelIndicators"/>
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      <xref linkend="opt-services.xserver.desktopManager.pantheon.extraSwitchboardPlugs"/>
+     </para>
+    </listitem>
+   </itemizedlist>
+   to configure the programs with plugs or indicators.
+  </para>
+
+  <para>
+   The difference in NixOS is both these programs are patched to load plugins from a directory that is the value of an environment variable. All of which is controlled in Nix. If you need to configure the particular packages manually you can override the packages like:
+<programlisting>
+wingpanel-with-indicators.override {
+  indicators = [
+    pkgs.some-special-indicator
+  ];
+};
+
+switchboard-with-plugs.override {
+  plugs = [
+    pkgs.some-special-plug
+  ];
+};
+</programlisting>
+   please note that, like how the NixOS options describe these as extra plugins, this would only add to the default plugins included with the programs. If for some reason you'd like to configure which plugins to use exactly, both packages have an argument for this:
+<programlisting>
+wingpanel-with-indicators.override {
+  useDefaultIndicators = false;
+  indicators = specialListOfIndicators;
+};
+
+switchboard-with-plugs.override {
+  useDefaultPlugs = false;
+  plugs = specialListOfPlugs;
+};
+</programlisting>
+   this could be most useful for testing a particular plug-in in isolation.
+  </para>
+ </section>
+ <section xml:id="sec-pantheon-faq">
+  <title>FAQ</title>
+
+  <variablelist>
+   <varlistentry xml:id="sec-pantheon-faq-messed-up-theme">
+    <term>
+     I have switched from a different desktop and Pantheon’s theming looks messed up.
+    </term>
+    <listitem>
+     <para>
+      Open Switchboard and go to: <guilabel>Administration</guilabel> → <guilabel>About</guilabel> → <guilabel>Restore Default Settings</guilabel> → <guibutton>Restore Settings</guibutton>. This will reset any dconf settings to their Pantheon defaults. Note this could reset certain GNOME specific preferences if that desktop was used prior.
+     </para>
+    </listitem>
+   </varlistentry>
+   <varlistentry xml:id="sec-pantheon-faq-slow-shutdown">
+    <term>
+     Using Pantheon sometimes makes my shutdown take a long time.
+    </term>
+    <listitem>
+     <para>
+      We have not yet determined what processes fight with systemd during shutdown, there are many reports. In elementary OS the default system timeout is lowered to lessen the impact of the issue. If you'd like to do this in NixOS, set
+<programlisting>
+ <xref linkend="opt-systemd.extraConfig"/> = ''
+  DefaultTimeoutStopSec=10s
+  DefaultTimeoutStartSec=10s
+'';
+</programlisting>
+     </para>
+    </listitem>
+   </varlistentry>
+   <varlistentry xml:id="sec-pantheon-faq-gnome3-and-pantheon">
+    <term>
+     I cannot enable both GNOME 3 and Pantheon.
+    </term>
+    <listitem>
+     <para>
+      This is a known <link xlink:href="https://github.com/NixOS/nixpkgs/issues/64611">issue</link> and there is no known workaround.
+     </para>
+    </listitem>
+   </varlistentry>
+   <varlistentry xml:id="sec-pantheon-faq-appcenter">
+    <term>
+     Does AppCenter work, or is it available?
+    </term>
+    <listitem>
+     <para>
+      AppCenter has been available since 20.03, but it is of little use. This is because there is no functioning PackageKit backend for Nix 2.0. In the near future you will be able to install Flatpak applications from AppCenter on NixOS. See this <link xlink:href="https://github.com/NixOS/nixpkgs/issues/70214">issue</link>.
+     </para>
+    </listitem>
+   </varlistentry>
+  </variablelist>
+ </section>
+</chapter>
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -573,7 +573,7 @@ in
           then { modules = [xorg.${"xf86video" + name}]; }
           else null)
          knownVideoDrivers;
-      in optional (driver != null) ({ inherit name; modules = []; driverName = name; } // driver));
+      in optional (driver != null) ({ inherit name; modules = []; driverName = name; display = true; } // driver));

    assertions = [
      { assertion = config.security.polkit.enable;
@ -740,7 +740,7 @@ in
          ${cfg.serverLayoutSection}
          # Reference the Screen sections for each driver.  This will
          # cause the X server to try each in turn.
-          ${flip concatMapStrings cfg.drivers (d: ''
+          ${flip concatMapStrings (filter (d: d.display) cfg.drivers) (d: ''
            Screen "Screen-${d.name}[0]"
          '')}
        EndSection
@ -764,42 +764,44 @@ in
            ${driver.deviceSection or ""}
            ${xrandrDeviceSection}
          EndSection
+          ${optionalString driver.display ''

-          Section "Screen"
-            Identifier "Screen-${driver.name}[0]"
-            Device "Device-${driver.name}[0]"
-            ${optionalString (cfg.monitorSection != "") ''
-              Monitor "Monitor[0]"
-            ''}
+            Section "Screen"
+              Identifier "Screen-${driver.name}[0]"
+              Device "Device-${driver.name}[0]"
+              ${optionalString (cfg.monitorSection != "") ''
+                Monitor "Monitor[0]"
+              ''}

-            ${cfg.screenSection}
-            ${driver.screenSection or ""}
+              ${cfg.screenSection}
+              ${driver.screenSection or ""}

-            ${optionalString (cfg.defaultDepth != 0) ''
-              DefaultDepth ${toString cfg.defaultDepth}
-            ''}
+              ${optionalString (cfg.defaultDepth != 0) ''
+                DefaultDepth ${toString cfg.defaultDepth}
+              ''}

-            ${optionalString
-                (driver.name != "virtualbox" &&
-                 (cfg.resolutions != [] ||
-                  cfg.extraDisplaySettings != "" ||
-                  cfg.virtualScreen != null))
-              (let
-                f = depth:
-                  ''
-                    SubSection "Display"
-                      Depth ${toString depth}
-                      ${optionalString (cfg.resolutions != [])
-                        "Modes ${concatMapStrings (res: ''"${toString res.x}x${toString res.y}"'') cfg.resolutions}"}
-                      ${cfg.extraDisplaySettings}
-                      ${optionalString (cfg.virtualScreen != null)
-                        "Virtual ${toString cfg.virtualScreen.x} ${toString cfg.virtualScreen.y}"}
-                    EndSubSection
-                  '';
-              in concatMapStrings f [8 16 24]
-            )}
+              ${optionalString
+                  (driver.name != "virtualbox" &&
+                  (cfg.resolutions != [] ||
+                    cfg.extraDisplaySettings != "" ||
+                    cfg.virtualScreen != null))
+                (let
+                  f = depth:
+                    ''
+                      SubSection "Display"
+                        Depth ${toString depth}
+                        ${optionalString (cfg.resolutions != [])
+                          "Modes ${concatMapStrings (res: ''"${toString res.x}x${toString res.y}"'') cfg.resolutions}"}
+                        ${cfg.extraDisplaySettings}
+                        ${optionalString (cfg.virtualScreen != null)
+                          "Virtual ${toString cfg.virtualScreen.x} ${toString cfg.virtualScreen.y}"}
+                      EndSubSection
+                    '';
+                in concatMapStrings f [8 16 24]
+              )}

-          EndSection
+            EndSection
+          ''}
        '')}

        ${xrandrMonitorSections}
--- a/nixos/modules/system/boot/initrd-network.nix
+++ b/nixos/modules/system/boot/initrd-network.nix
@ -6,7 +6,11 @@ let

  cfg = config.boot.initrd.network;

-  dhcpinterfaces = lib.attrNames (lib.filterAttrs (iface: v: v.useDHCP == true) (config.networking.interfaces or {}));
+  dhcpInterfaces = lib.attrNames (lib.filterAttrs (iface: v: v.useDHCP == true) (config.networking.interfaces or {}));
+  doDhcp = config.networking.useDHCP || dhcpInterfaces != [];
+  dhcpIfShellExpr = if config.networking.useDHCP
+                      then "$(ls /sys/class/net/ | grep -v ^lo$)"
+                      else lib.concatMapStringsSep " " lib.escapeShellArg dhcpInterfaces;

  udhcpcScript = pkgs.writeScript "udhcp-script"
    ''
@ -62,6 +66,16 @@ in
      '';
    };

+    boot.initrd.network.flushBeforeStage2 = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to clear the configuration of the interfaces that were set up in
+        the initrd right before stage 2 takes over. Stage 2 will do the regular network
+        configuration based on the NixOS networking options.
+      '';
+    };
+
    boot.initrd.network.udhcpc.extraArgs = mkOption {
      default = [];
      type = types.listOf types.str;
@ -89,49 +103,45 @@ in
    boot.initrd.kernelModules = [ "af_packet" ];

    boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs ${pkgs.mkinitcpio-nfs-utils}/bin/ipconfig
+      copy_bin_and_libs ${pkgs.klibc}/lib/klibc/bin.static/ipconfig
    '';

    boot.initrd.preLVMCommands = mkBefore (
      # Search for interface definitions in command line.
      ''
+        ifaces=""
        for o in $(cat /proc/cmdline); do
          case $o in
            ip=*)
-              ipconfig $o && hasNetwork=1
+              ipconfig $o && ifaces="$ifaces $(echo $o | cut -d: -f6)"
              ;;
          esac
        done
      ''

      # Otherwise, use DHCP.
-      + optionalString (config.networking.useDHCP || dhcpinterfaces != []) ''
-        if [ -z "$hasNetwork" ]; then
+      + optionalString doDhcp ''
+        # Bring up all interfaces.
+        for iface in ${dhcpIfShellExpr}; do
+          echo "bringing up network interface $iface..."
+          ip link set "$iface" up && ifaces="$ifaces $iface"
+        done

-          # Bring up all interfaces.
-          for iface in $(ls /sys/class/net/); do
-            echo "bringing up network interface $iface..."
-            ip link set "$iface" up
-          done
-
-          # Acquire DHCP leases.
-          for iface in ${ if config.networking.useDHCP then
-                            "$(ls /sys/class/net/ | grep -v ^lo$)"
-                          else
-                            lib.concatMapStringsSep " " lib.escapeShellArg dhcpinterfaces
-                        }; do
-            echo "acquiring IP address via DHCP on $iface..."
-            udhcpc --quit --now -i $iface -O staticroutes --script ${udhcpcScript} ${udhcpcArgs} && hasNetwork=1
-          done
-        fi
+        # Acquire DHCP leases.
+        for iface in ${dhcpIfShellExpr}; do
+          echo "acquiring IP address via DHCP on $iface..."
+          udhcpc --quit --now -i $iface -O staticroutes --script ${udhcpcScript} ${udhcpcArgs}
+        done
      ''

-      + ''
-        if [ -n "$hasNetwork" ]; then
-          echo "networking is up!"
-          ${cfg.postCommands}
-        fi
-      '');
+      + cfg.postCommands);
+
+    boot.initrd.postMountCommands = mkIf cfg.flushBeforeStage2 ''
+      for iface in $ifaces; do
+        ip address flush "$iface"
+        ip link down "$iface"
+      done
+    '';

  };

--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -67,7 +67,12 @@ let
    (assertOnlyFields [
      "PrivateKeyFile" "ListenPort" "FwMark"
    ])
-    (assertRange "FwMark" 1 4294967295)
+    # The following check won't work on nix <= 2.2
+    # see https://github.com/NixOS/nix/pull/2378
+    #
+    # Add this again when we'll have drop the
+    # nix < 2.2 support.
+    # (assertRange "FwMark" 1 4294967295)
  ];

  # NOTE The PresharedKey directive is missing on purpose here, please
@ -181,7 +186,12 @@ let
    (assertOnlyFields [
      "InterfaceId" "Independent"
    ])
-    (assertRange "InterfaceId" 1 4294967295)
+    # The following check won't work on nix <= 2.2
+    # see https://github.com/NixOS/nix/pull/2378
+    #
+    # Add this again when we'll have drop the
+    # nix < 2.2 support.
+    # (assertRange "InterfaceId" 1 4294967295)
    (assertValueOneOf "Independent" boolValues)
  ];

@ -235,6 +245,26 @@ let
    (assertValueOneOf "AutoJoin" boolValues)
  ];

+  checkRoutingPolicyRule = checkUnitConfig "RoutingPolicyRule" [
+    (assertOnlyFields [
+      "TypeOfService" "From" "To" "FirewallMark" "Table" "Priority"
+      "IncomingInterface" "OutgoingInterface" "SourcePort" "DestinationPort"
+      "IPProtocol" "InvertRule" "Family"
+    ])
+    (assertRange "TypeOfService" 0 255)
+    # The following check won't work on nix <= 2.2
+    # see https://github.com/NixOS/nix/pull/2378
+    #
+    # Add this again when we'll have drop the
+    # nix < 2.2 support.
+    #  (assertRange "FirewallMark" 1 4294967295)
+    (assertInt "Priority")
+    (assertPort "SourcePort")
+    (assertPort "DestinationPort")
+    (assertValueOneOf "InvertRule" boolValues)
+    (assertValueOneOf "Family" ["ipv4" "ipv6" "both"])
+  ];
+
  checkRoute = checkUnitConfig "Route" [
    (assertOnlyFields [
      "Gateway" "GatewayOnLink" "Destination" "Source" "Metric"
@ -535,6 +565,22 @@ let
    };
  };

+  routingPolicyRulesOptions = {
+    options = {
+      routingPolicyRuleConfig = mkOption {
+        default = { };
+        example = { routingPolicyRuleConfig = { Table = 10; IncomingInterface = "eth1"; Family = "both"; } ;};
+        type = types.addCheck (types.attrsOf unitOption) checkRoutingPolicyRule;
+        description = ''
+          Each attribute in this set specifies an option in the
+          <literal>[RoutingPolicyRule]</literal> section of the unit.  See
+          <citerefentry><refentrytitle>systemd.network</refentrytitle>
+          <manvolnum>5</manvolnum></citerefentry> for details.
+        '';
+      };
+    };
+  };
+
  routeOptions = {
    options = {
      routeConfig = mkOption {
@ -772,6 +818,16 @@ let
      '';
    };

+    routingPolicyRules = mkOption {
+      default = [ ];
+      type = with types; listOf (submodule routingPolicyRulesOptions);
+      description = ''
+        A list of routing policy rules sections to be added to the unit.  See
+        <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
    routes = mkOption {
      default = [ ];
      type = with types; listOf (submodule routeOptions);
@ -928,6 +984,11 @@ let
            [Route]
            ${attrsToSection x.routeConfig}

+          '')}
+          ${flip concatMapStrings def.routingPolicyRules (x: ''
+            [RoutingPolicyRule]
+            ${attrsToSection x.routingPolicyRuleConfig}
+
          '')}
          ${def.extraConfig}
        '';
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -210,6 +210,8 @@ done
 # Create device nodes in /dev.
@preDeviceCommands@
 echo "running udev..."
+mkdir -p /etc/systemd
+ln -sfn @linkUnits@ /etc/systemd/network
 mkdir -p /etc/udev
 ln -sfn @udevRules@ /etc/udev/rules.d
 mkdir -p /dev/.mdadm
@ -266,7 +268,7 @@ checkFS() {
        return 0
    fi

-    # Device might be already mounted manually 
+    # Device might be already mounted manually
    # e.g. NBD-device or the host filesystem of the file which contains encrypted root fs
    if mount | grep -q "^$device on "; then
        echo "skip checking already mounted $device"
@ -351,7 +353,7 @@ mountFS() {
            elif [ "$fsType" = f2fs ]; then
                echo "resizing $device..."
                fsck.f2fs -fp "$device"
-                resize.f2fs "$device" 
+                resize.f2fs "$device"
            fi
            ;;
    esac
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -120,6 +120,7 @@ let

      # Copy udev.
      copy_bin_and_libs ${udev}/lib/systemd/systemd-udevd
+      copy_bin_and_libs ${udev}/lib/systemd/systemd-sysctl
      copy_bin_and_libs ${udev}/bin/udevadm
      for BIN in ${udev}/lib/udev/*_id; do
        copy_bin_and_libs $BIN
@ -198,6 +199,14 @@ let
    ''; # */


+  linkUnits = pkgs.runCommand "link-units" {
+      allowedReferences = [ extraUtils ];
+      preferLocalBuild = true;
+    } ''
+      mkdir -p $out
+      cp -v ${udev}/lib/systemd/network/*.link $out/
+    '';
+
  udevRules = pkgs.runCommand "udev-rules" {
      allowedReferences = [ extraUtils ];
      preferLocalBuild = true;
@ -208,7 +217,9 @@ let

      cp -v ${udev}/lib/udev/rules.d/60-cdrom_id.rules $out/
      cp -v ${udev}/lib/udev/rules.d/60-persistent-storage.rules $out/
+      cp -v ${udev}/lib/udev/rules.d/75-net-description.rules $out/
      cp -v ${udev}/lib/udev/rules.d/80-drivers.rules $out/
+      cp -v ${udev}/lib/udev/rules.d/80-net-setup-link.rules $out/
      cp -v ${pkgs.lvm2}/lib/udev/rules.d/*.rules $out/
      ${config.boot.initrd.extraUdevRulesCommands}

@ -222,7 +233,7 @@ let
            --replace ${pkgs.lvm2}/sbin ${extraUtils}/bin \
            --replace ${pkgs.mdadm}/sbin ${extraUtils}/sbin \
            --replace ${pkgs.bash}/bin/sh ${extraUtils}/bin/sh \
-            --replace ${udev}/bin/udevadm ${extraUtils}/bin/udevadm
+            --replace ${udev} ${extraUtils}
      done

      # Work around a bug in QEMU, which doesn't implement the "READ
@ -257,7 +268,7 @@ let
      ${pkgs.buildPackages.busybox}/bin/ash -n $target
    '';

-    inherit udevRules extraUtils modulesClosure;
+    inherit linkUnits udevRules extraUtils modulesClosure;

    inherit (config.boot) resumeDevice;

--- a/nixos/modules/system/boot/systemd-lib.nix
+++ b/nixos/modules/system/boot/systemd-lib.nix
@ -59,6 +59,11 @@ in rec {
    optional (attr ? ${name} && ! isMacAddress attr.${name})
      "Systemd ${group} field `${name}' must be a valid mac address.";

+  isPort = i: i >= 0 && i <= 65535;
+
+  assertPort = name: group: attr:
+    optional (attr ? ${name} && ! isPort attr.${name})
+      "Error on the systemd ${group} field `${name}': ${attr.name} is not a valid port number.";

  assertValueOneOf = name: values: group: attr:
    optional (attr ? ${name} && !elem attr.${name} values)
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -623,7 +623,11 @@ in
        after = [ "zfs-import.target" ];
        path = [ packages.zfsUser ];
        startAt = cfgTrim.interval;
-        serviceConfig.ExecStart = "${pkgs.runtimeShell} -c 'zpool list -H -o name | xargs --no-run-if-empty -n1 zpool trim'";
+        # By default we ignore errors returned by the trim command, in case:
+        # - HDDs are mixed with SSDs
+        # - There is a SSDs in a pool that is currently trimmed.
+        # - There are only HDDs and we would set the system in a degraded state
+        serviceConfig.ExecStart = ''${pkgs.runtimeShell} -c 'for pool in $(zpool list -H -o name); do zpool trim $pool;  done || true' '';
      };
    })
  ];
--- a/nixos/modules/testing/service-runner.nix
+++ b/nixos/modules/testing/service-runner.nix
@ -12,7 +12,10 @@ let

      sub run {
          my ($cmd) = @_;
-          my @args = split " ", $cmd;
+          my @args = ();
+          while ($cmd =~ /([^ \t\n']+)|(\'([^'])\')\s*/g) {
+            push @args, $1;
+          }
          my $prog;
          if (substr($args[0], 0, 1) eq "@") {
              $prog = substr($args[0], 1);
@ -48,15 +51,20 @@ let
      '') service.environment)}

      # Run the ExecStartPre program.  FIXME: this could be a list.
-      my $preStart = '${service.serviceConfig.ExecStartPre or ""}';
-      if ($preStart ne "") {
+      my $preStart = <<END_CMD;
+      ${service.serviceConfig.ExecStartPre or ""}
+      END_CMD
+      if (defined $preStart && $preStart ne "\n") {
          print STDERR "running ExecStartPre: $preStart\n";
          my $res = run_wait $preStart;
          die "$0: ExecStartPre failed with status $res\n" if $res;
      };

      # Run the ExecStart program.
-      my $cmd = '${service.serviceConfig.ExecStart}';
+      my $cmd = <<END_CMD;
+      ${service.serviceConfig.ExecStart}
+      END_CMD
+
      print STDERR "running ExecStart: $cmd\n";
      my $mainPid = run $cmd;
      $ENV{'MAINPID'} = $mainPid;
@ -70,8 +78,10 @@ let
      $SIG{'QUIT'} = \&intHandler;

      # Run the ExecStartPost program.
-      my $postStart = '${service.serviceConfig.ExecStartPost or ""}';
-      if ($postStart ne "") {
+      my $postStart = <<END_CMD;
+      ${service.serviceConfig.ExecStartPost or ""}
+      END_CMD
+      if (defined $postStart && $postStart ne "\n") {
          print STDERR "running ExecStartPost: $postStart\n";
          my $res = run_wait $postStart;
          die "$0: ExecStartPost failed with status $res\n" if $res;
@ -82,8 +92,10 @@ let
      my $mainRes = $?;

      # Run the ExecStopPost program.
-      my $postStop = '${service.serviceConfig.ExecStopPost or ""}';
-      if ($postStop ne "") {
+      my $postStop = <<END_CMD;
+      ${service.serviceConfig.ExecStopPost or ""}
+      END_CMD
+      if (defined $postStop && $postStop ne "\n") {
          print STDERR "running ExecStopPost: $postStop\n";
          my $res = run_wait $postStop;
          die "$0: ExecStopPost failed with status $res\n" if $res;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -39,6 +39,7 @@ in
  buildbot = handleTest ./buildbot.nix {};
  caddy = handleTest ./caddy.nix {};
  cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
+  cage = handleTest ./cage.nix {};
  cassandra = handleTest ./cassandra.nix {};
  ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
  ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};
@ -98,6 +99,7 @@ in
  fsck = handleTest ./fsck.nix {};
  gotify-server = handleTest ./gotify-server.nix {};
  grocy = handleTest ./grocy.nix {};
+  gitdaemon = handleTest ./gitdaemon.nix {};
  gitea = handleTest ./gitea.nix {};
  gitlab = handleTest ./gitlab.nix {};
  gitolite = handleTest ./gitolite.nix {};
@ -262,6 +264,7 @@ in
  samba = handleTest ./samba.nix {};
  sanoid = handleTest ./sanoid.nix {};
  sddm = handleTest ./sddm.nix {};
+  service-runner = handleTest ./service-runner.nix {};
  shiori = handleTest ./shiori.nix {};
  signal-desktop = handleTest ./signal-desktop.nix {};
  simple = handleTest ./simple.nix {};
@ -282,7 +285,7 @@ in
  systemd-confinement = handleTest ./systemd-confinement.nix {};
  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
-  systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
+  systemd-networkd = handleTest ./systemd-networkd.nix {};
  systemd-nspawn = handleTest ./systemd-nspawn.nix {};
  pdns-recursor = handleTest ./pdns-recursor.nix {};
  taskserver = handleTest ./taskserver.nix {};
--- a/nixos/tests/buildbot.nix
+++ b/nixos/tests/buildbot.nix
@ -41,7 +41,7 @@ import ./make-test-python.nix {
      systemd.services.git-daemon = {
        description   = "Git daemon for the test";
        wantedBy      = [ "multi-user.target" ];
-        after         = [ "network.target" ];
+        after         = [ "network.target" "sshd.service" ];

        serviceConfig.Restart = "always";
        path = with pkgs; [ coreutils git openssh ];
--- a/nixos/tests/cage.nix
+++ b/nixos/tests/cage.nix
@ -0,0 +1,43 @@
+import ./make-test-python.nix ({ pkgs, ...} :
+
+{
+  name = "cage";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ matthewbauer flokli ];
+  };
+
+  machine = { ... }:
+
+  {
+    imports = [ ./common/user-account.nix ];
+    services.cage = {
+      enable = true;
+      user = "alice";
+      program = "${pkgs.xterm}/bin/xterm -cm -pc"; # disable color and bold to make OCR easier
+    };
+
+    # this needs a fairly recent kernel, otherwise:
+    #   [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
+    #   [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
+    #   [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
+    #   [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
+    #   [backend/drm/drm.c:618] Failed to initialize renderer on connector 'Virtual-1': initial page-flip failed
+    #   [backend/drm/drm.c:701] Failed to initialize renderer for plane
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+
+    virtualisation.memorySize = 1024;
+  };
+
+  enableOCR = true;
+
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.users.alice;
+  in ''
+    with subtest("Wait for cage to boot up"):
+        start_all()
+        machine.wait_for_file("/run/user/${toString user.uid}/wayland-0.lock")
+        machine.wait_until_succeeds("pgrep xterm")
+        machine.wait_for_text("alice@machine")
+        machine.screenshot("screen")
+  '';
+})
--- a/nixos/tests/gitdaemon.nix
+++ b/nixos/tests/gitdaemon.nix
@ -0,0 +1,64 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  hashes = pkgs.writeText "hashes" ''
+    b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c  /project/bar
+  '';
+in {
+  name = "gitdaemon";
+
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ tilpner ];
+  };
+
+  nodes = {
+    server =
+      { config, ... }: {
+        networking.firewall.allowedTCPPorts = [ config.services.gitDaemon.port ];
+
+        environment.systemPackages = [ pkgs.git ];
+
+        services.gitDaemon = {
+          enable = true;
+          basePath = "/git";
+        };
+      };
+
+    client =
+      { pkgs, ... }: {
+        environment.systemPackages = [ pkgs.git ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("create project.git"):
+        server.succeed(
+            "mkdir /git",
+            "git init --bare /git/project.git",
+            "touch /git/project.git/git-daemon-export-ok",
+        )
+
+    with subtest("add file to project.git"):
+        server.succeed(
+            "git clone /git/project.git /project",
+            "echo foo > /project/bar",
+            "git config --global user.email 'you@example.com'",
+            "git config --global user.name 'Your Name'",
+            "git -C /project add bar",
+            "git -C /project commit -m 'quux'",
+            "git -C /project push",
+            "rm -r /project",
+        )
+
+    with subtest("git daemon starts"):
+        server.wait_for_unit("git-daemon.service")
+
+    with subtest("client can clone project.git"):
+        client.succeed(
+            "git clone git://server/project.git /project",
+            "sha256sum -c ${hashes}",
+        )
+  '';
+})
--- a/nixos/tests/initrd-network.nix
+++ b/nixos/tests/initrd-network.nix
@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, lib, ...} : {
  name = "initrd-network";

  meta.maintainers = [ pkgs.stdenv.lib.maintainers.eelco ];
@ -8,15 +8,26 @@ import ./make-test-python.nix ({ pkgs, ...} : {
    boot.initrd.network.enable = true;
    boot.initrd.network.postCommands =
      ''
+        ip addr show
+        ip route show
        ip addr | grep 10.0.2.15 || exit 1
        ping -c1 10.0.2.2 || exit 1
      '';
+    # Check if cleanup was done correctly
+    boot.initrd.postMountCommands = lib.mkAfter
+      ''
+        ip addr show
+        ip route show
+        ip addr | grep 10.0.2.15 && exit 1
+        ping -c1 10.0.2.2 && exit 1
+      '';
  };

  testScript =
    ''
      start_all()
      machine.wait_for_unit("multi-user.target")
-      machine.succeed("ip link >&2")
+      machine.succeed("ip addr show >&2")
+      machine.succeed("ip route show >&2")
    '';
 })
--- a/nixos/tests/opensmtpd.nix
+++ b/nixos/tests/opensmtpd.nix
@ -121,5 +121,5 @@ import ./make-test-python.nix {
    client.succeed("check-mail-landed >&2")
  '';

-  meta.timeout = 30;
+  meta.timeout = 1800;
 }
--- a/nixos/tests/predictable-interface-names.nix
+++ b/nixos/tests/predictable-interface-names.nix
@ -17,6 +17,12 @@ in pkgs.lib.listToAttrs (pkgs.lib.crossLists (predictable: withNetworkd: {
      networking.useNetworkd = withNetworkd;
      networking.dhcpcd.enable = !withNetworkd;
      networking.useDHCP = !withNetworkd;
+
+      # Check if predictable interface names are working in stage-1
+      boot.initrd.postDeviceCommands = ''
+        ip link
+        ip link show eth0 ${if predictable then "&&" else "||"} exit 1
+      '';
    };

    testScript = ''
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -287,7 +287,7 @@ let
        services.nginx = {
          enable = true;
          statusPage = true;
-          virtualHosts."/".extraConfig = "return 204;";
+          virtualHosts."test".extraConfig = "return 204;";
        };
      };
      exporterTest = ''
--- a/nixos/tests/rsyslogd.nix
+++ b/nixos/tests/rsyslogd.nix
@ -3,40 +3,38 @@
  pkgs ? import ../.. { inherit system config; }
 }:

-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;

 {
  test1 = makeTest {
    name = "rsyslogd-test1";
-    meta.maintainers = [ maintainers.aanderse ];
+    meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ];

-    machine =
-      { config, pkgs, ... }:
-      { services.rsyslogd.enable = true;
-        services.journald.forwardToSyslog = false;
-      };
+    machine = { config, pkgs, ... }: {
+      services.rsyslogd.enable = true;
+      services.journald.forwardToSyslog = false;
+    };

    # ensure rsyslogd isn't receiving messages from journald if explicitly disabled
    testScript = ''
-      $machine->waitForUnit("default.target");
-      $machine->fail("test -f /var/log/messages");
+      machine.wait_for_unit("default.target")
+      machine.fail("test -f /var/log/messages")
    '';
  };

  test2 = makeTest {
    name = "rsyslogd-test2";
-    meta.maintainers = [ maintainers.aanderse ];
+    meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ];

-    machine =
-      { config, pkgs, ... }:
-      { services.rsyslogd.enable = true;
-      };
+    machine = { config, pkgs, ... }: {
+      services.rsyslogd.enable = true;
+    };

    # ensure rsyslogd is receiving messages from journald
    testScript = ''
-      $machine->waitForUnit("default.target");
-      $machine->succeed("test -f /var/log/messages");
+      machine.wait_for_unit("default.target")
+      machine.succeed("test -f /var/log/messages")
    '';
  };
 }
--- a/nixos/tests/service-runner.nix
+++ b/nixos/tests/service-runner.nix
@ -0,0 +1,36 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "service-runner";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ roberth ];
+  };
+
+  nodes = {
+    machine = { pkgs, lib, ... }: {
+      services.nginx.enable = true;
+      services.nginx.virtualHosts.machine.root = pkgs.runCommand "webroot" {} ''
+        mkdir $out
+        echo 'yay' >$out/index.html
+      '';
+      systemd.services.nginx.enable = false;
+    };
+
+  };
+
+  testScript = { nodes, ... }: ''
+    url = "http://localhost/index.html"
+
+    with subtest("check systemd.services.nginx.runner"):
+        machine.fail(f"curl {url}")
+        machine.succeed(
+            """
+            mkdir -p /run/nginx /var/spool/nginx/logs
+            ${nodes.machine.config.systemd.services.nginx.runner} &
+            echo $!>my-nginx.pid
+            """
+        )
+        machine.wait_for_open_port(80)
+        machine.succeed(f"curl {url}")
+        machine.succeed("kill -INT $(cat my-nginx.pid)")
+        machine.wait_for_closed_port(80)
+  '';
+})
--- a/nixos/tests/systemd-networkd-wireguard.nix
+++ b/nixos/tests/systemd-networkd-wireguard.nix
@ -41,15 +41,25 @@ let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: {
              { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; }
            ];
          };
-          "90-eth1" = {
+          "30-eth1" = {
            matchConfig = { Name = "eth1"; };
-            address = [ "192.168.1.${nodeId}/24" ];
+            address = [
+              "192.168.1.${nodeId}/24"
+              "fe80::${nodeId}/64"
+            ];
+            routingPolicyRules = [
+              { routingPolicyRuleConfig = { Table = 10; IncomingInterface = "eth1"; Family = "both"; };}
+              { routingPolicyRuleConfig = { Table = 20; OutgoingInterface = "eth1"; };}
+              { routingPolicyRuleConfig = { Table = 30; From = "192.168.1.1"; To = "192.168.1.2"; SourcePort = 666 ; DestinationPort = 667; };}
+              { routingPolicyRuleConfig = { Table = 40; IPProtocol = "tcp"; InvertRule = true; };}
+              { routingPolicyRuleConfig = { Table = 50; IncomingInterface = "eth1"; Family = "ipv4"; };}
+            ];
          };
        };
      };
    };
 in import ./make-test-python.nix ({pkgs, ... }: {
-  name = "networkd-wireguard";
+  name = "networkd";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ ninjatrappeur ];
  };
@ -76,9 +86,28 @@ testScript = ''
    start_all()
    node1.wait_for_unit("systemd-networkd-wait-online.service")
    node2.wait_for_unit("systemd-networkd-wait-online.service")
+
+    # ================================
+    # Wireguard
+    # ================================
    node1.succeed("ping -c 5 10.0.0.2")
    node2.succeed("ping -c 5 10.0.0.1")
    # Is the fwmark set?
    node2.succeed("wg | grep -q 42")
+
+    # ================================
+    # Routing Policies
+    # ================================
+    # Testing all the routingPolicyRuleConfig members:
+    # Table + IncomingInterface
+    node1.succeed("sudo ip rule | grep 'from all iif eth1 lookup 10'")
+    # OutgoingInterface
+    node1.succeed("sudo ip rule | grep 'from all oif eth1 lookup 20'")
+    # From + To + SourcePort + DestinationPort
+    node1.succeed(
+        "sudo ip rule | grep 'from 192.168.1.1 to 192.168.1.2 sport 666 dport 667 lookup 30'"
+    )
+    # IPProtocol + InvertRule
+    node1.succeed("sudo ip rule | grep 'not from all ipproto tcp lookup 40'")
 '';
 })
--- a/pkgs/applications/accessibility/contrast/default.nix
+++ b/pkgs/applications/accessibility/contrast/default.nix
@ -30,10 +30,7 @@ rustPlatform.buildRustPackage rec {
    sha256 = "0rm705zrk9rfv31pwbqxrswi5v6vhnghxa8dgxjmcrh00l8dm6j9";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "06vgc89d93fhjcyy9d1v6lf8kr34pl5bbpwbv2jpfahpj9y84bgj";
+  cargoSha256 = "0qj0vmxa1d6war1vb3zgkf1drvk7awm970fw6692hd9msa9c1kkf";

  nativeBuildInputs = [
    desktop-file-utils
--- a/pkgs/applications/audio/deadbeef/default.nix
+++ b/pkgs/applications/audio/deadbeef/default.nix
@ -59,22 +59,15 @@ assert remoteSupport -> curl != null;

 stdenv.mkDerivation rec {
  pname = "deadbeef";
-  version = "1.8.0";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "DeaDBeeF-Player";
    repo = "deadbeef";
    rev = version;
-    sha256 = "126i5qlkpv7pvi1mmc9y0jhqs6jjspsj7j615n2ddvsb2jsps81c";
+    sha256 = "016wwnh5jqdcfxn1ff6in5dz73c3gdhh3fva8inq7sc3vzdz5khj";
  };

-  patches = [
-    # Fix broken symbol name
-    # https://github.com/NixOS/nixpkgs/pull/59187#issuecomment-480977993
-    # will be fixed in deadbeef 1.8.1
-    ./fix-wildmidi.patch
-  ];
-
  buildInputs = with stdenv.lib; [ jansson ]
    ++ optional gtk2Support gtk2
    ++ optionals gtk3Support [ gtk3 gsettings-desktop-schemas ]
--- a/pkgs/applications/audio/dragonfly-reverb/default.nix
+++ b/pkgs/applications/audio/dragonfly-reverb/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "dragonfly-reverb";
-  version = "2.0.0";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "michaelwillis";
    repo = "dragonfly-reverb";
    rev = version;
-    sha256 = "1qrbv4kk5v6ynx424h1i54qj0w8v6vpw81b759jawxvzzprpgq72";
+    sha256 = "1z2x33lzpd26dv1p29ca7vy8mjfzkfpin35iq46spwd9k3sqn1ja";
    fetchSubmodules = true;
  };

@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    mkdir -p $out/lib/lv2/
    mkdir -p $out/lib/vst/
    cd bin
-    for bin in DragonflyHallReverb DragonflyRoomReverb; do
+    for bin in DragonflyEarlyReflections DragonflyPlateReverb DragonflyHallReverb DragonflyRoomReverb; do
      cp -a $bin        $out/bin/
      cp -a $bin-vst.so $out/lib/vst/
      cp -a $bin.lv2/   $out/lib/lv2/ ;
--- a/pkgs/applications/audio/lmms/default.nix
+++ b/pkgs/applications/audio/lmms/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "lmms";
-  version = "1.2.0-rc7";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "LMMS";
    repo = "lmms";
    rev = "v${version}";
-    sha256 = "1hshzf2sbdfw37y9rz1ksgvn81kp2n23dp74lsaasc2n7wzjwdis";
+    sha256 = "08k2nfj0rw9mahr7pr90n79wviqmjmflrgcljc6y3x30v84wbp26";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@ -12,6 +12,10 @@
 , desktop-file-utils
 , totem-pl-parser
 , gobject-introspection
+, glib-networking
+, gdk-pixbuf
+, glib
+, pango
 , wrapGAppsHook
 , lastFMSupport ? true
 , youtubeSupport ? true
@ -19,7 +23,7 @@

 python3.pkgs.buildPythonApplication rec  {
  pname = "lollypop";
-  version = "1.2.16";
+  version = "1.2.23";

  format = "other";
  doCheck = false;
@ -28,7 +32,7 @@ python3.pkgs.buildPythonApplication rec  {
    url = "https://gitlab.gnome.org/World/lollypop";
    rev = "refs/tags/${version}";
    fetchSubmodules = true;
-    sha256 = "0rl4a5npjh5sm3kih11cs2j7ik894nlygllbw4j5pn9n9v66x51w";
+    sha256 = "059z7ri5qwkmfh2kvv8rq5wp80mz75423wc5hnm33wb9sgdd5x47";
  };

  nativeBuildInputs = [
@ -42,6 +46,9 @@ python3.pkgs.buildPythonApplication rec  {
  ];

  buildInputs = with gst_all_1; [
+    gdk-pixbuf
+    glib
+    glib-networking
    gst-libav
    gst-plugins-bad
    gst-plugins-base
@ -50,6 +57,7 @@ python3.pkgs.buildPythonApplication rec  {
    gstreamer
    gtk3
    libsoup
+    pango
    totem-pl-parser
  ] ++ lib.optional lastFMSupport libsecret;

--- a/pkgs/applications/audio/sunvox/default.nix
+++ b/pkgs/applications/audio/sunvox/default.nix
@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "SunVox";
-  version = "1.9.5";
+  version = "1.9.5c";

  src = fetchurl {
    url = "http://www.warmplace.ru/soft/sunvox/sunvox-${version}.zip";
-    sha256 = "011cyagbqqkvnrxxq196zsvcyn3gksjfsaas02xl8ncjwfj084di";
+    sha256 = "19ilif221nw8lvw0fgpjqzawibyvxk16aaylizwygf7c4j40wayi";
  };

  buildInputs = [ unzip ];
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -39,10 +39,10 @@
      elpaBuild {
        pname = "ada-mode";
        ename = "ada-mode";
-        version = "6.2.1";
+        version = "7.0.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ada-mode-6.2.1.tar";
-          sha256 = "0lg2y28qs8ls70d43ikhy5zcwadh5ddfw4k59p7sqb79w0y3lbnq";
+          url = "https://elpa.gnu.org/packages/ada-mode-7.0.1.tar";
+          sha256 = "0iqninv4wf4ap8axk9m0gi39j3kq4jpbpdc8hczd34xrp83ml46a";
        };
        packageRequires = [ emacs uniquify-files wisi ];
        meta = {
@ -343,10 +343,10 @@
      elpaBuild {
        pname = "bnf-mode";
        ename = "bnf-mode";
-        version = "0.4.2";
+        version = "0.4.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/bnf-mode-0.4.2.tar";
-          sha256 = "04wl563hxgjbhz6hhwvysdfvdni9fm7kahy5wxkyqxi1sy64gn7d";
+          url = "https://elpa.gnu.org/packages/bnf-mode-0.4.3.tar";
+          sha256 = "1hdhk6kw50vsixprrri0jb5i1c2y94ihifipqgq6kil7y4blr614";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -557,10 +557,10 @@
      elpaBuild {
        pname = "company";
        ename = "company";
-        version = "0.9.11";
+        version = "0.9.12";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/company-0.9.11.tar";
-          sha256 = "05fmkvsn5byaakl8i26nvnmiiz0766r17pni6x7bfrqby39ls233";
+          url = "https://elpa.gnu.org/packages/company-0.9.12.tar";
+          sha256 = "1vcgfccdc06alba3jl6dg7ms20wdzdhaqikh7id5lbawb00hc10j";
        };
        packageRequires = [ emacs ];
        meta = {
@ -655,10 +655,10 @@
      elpaBuild {
        pname = "csv-mode";
        ename = "csv-mode";
-        version = "1.10";
+        version = "1.12";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/csv-mode-1.10.el";
-          sha256 = "0q7j2cmj7vs6hz8cnf7j7lmlcjmig3jn2p6az345z96agl8a5xsq";
+          url = "https://elpa.gnu.org/packages/csv-mode-1.12.tar";
+          sha256 = "0bya12smlrzwv4cbcmch4kg1fazp4k0ndrh1z17ix9p8c14d0v1j";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -730,10 +730,10 @@
      elpaBuild {
        pname = "debbugs";
        ename = "debbugs";
-        version = "0.21";
+        version = "0.22";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/debbugs-0.21.tar";
-          sha256 = "1xx1wjfpsnwx2fpydqhwy9k1b5kjk8dqbkzf8lqaj9c4rvjbn50a";
+          url = "https://elpa.gnu.org/packages/debbugs-0.22.tar";
+          sha256 = "05ik9qv539b5c1nzxkk3lk23bqj4vqgmfmd8x367abhb7c9gix2z";
        };
        packageRequires = [ emacs soap-client ];
        meta = {
@ -925,10 +925,10 @@
      elpaBuild {
        pname = "ebdb";
        ename = "ebdb";
-        version = "0.6.12";
+        version = "0.6.13";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ebdb-0.6.12.tar";
-          sha256 = "1nmg2xxhfv53h13kb19xd4x5a7q9ln2rwzxc5v8zkf0g3vaxmhxw";
+          url = "https://elpa.gnu.org/packages/ebdb-0.6.13.tar";
+          sha256 = "1nxbp7w4xxij07q8manc15b896sl10yh2h1cg88prdqbw1wk62qr";
        };
        packageRequires = [ cl-lib emacs seq ];
        meta = {
@ -985,10 +985,10 @@
      elpaBuild {
        pname = "eev";
        ename = "eev";
-        version = "20191105";
+        version = "20200224";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eev-20191105.tar";
-          sha256 = "0w53wq8nhl4c5czda5imcv7y97pgbpfmvcvpi6kdwl3jbn9cx396";
+          url = "https://elpa.gnu.org/packages/eev-20200224.tar";
+          sha256 = "1r1wh001ikg34axihffrhzl0n8r0w42s2hac2jys8sil1hqvx306";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1070,10 +1070,10 @@
      elpaBuild {
        pname = "elisp-benchmarks";
        ename = "elisp-benchmarks";
-        version = "1.1";
+        version = "1.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/elisp-benchmarks-1.1.tar";
-          sha256 = "1blx3wsnz94va67437rmqa4i90gm9ig69bbmg9lp6jqyxrm9d7gc";
+          url = "https://elpa.gnu.org/packages/elisp-benchmarks-1.2.tar";
+          sha256 = "0grm4qw3aaf3hzrfg0vdgb5q67haappbc77qjgsy4jip85z7njmj";
        };
        packageRequires = [];
        meta = {
@ -1153,6 +1153,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    expand-region = callPackage ({ elpaBuild, fetchurl, lib }:
+      elpaBuild {
+        pname = "expand-region";
+        ename = "expand-region";
+        version = "0.11.0";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/expand-region-0.11.0.tar";
+          sha256 = "1q6xaqkv40z4c6rgdkxqqkvxgsaj8yjqjrxi40kz5y0ck3bjrk0i";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/expand-region.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    exwm = callPackage ({ elpaBuild, fetchurl, lib, xelb }:
      elpaBuild {
        pname = "exwm";
@ -1352,10 +1367,10 @@
      elpaBuild {
        pname = "gnorb";
        ename = "gnorb";
-        version = "1.6.4";
+        version = "1.6.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gnorb-1.6.4.tar";
-          sha256 = "1zm4c48x9vjqyn1h60lphhnzzg005wcad5mzn0majk0h59qcr0ff";
+          url = "https://elpa.gnu.org/packages/gnorb-1.6.5.tar";
+          sha256 = "1har3j8gb65mawrwn93939jg157wbap138qa1z1myznrrish6vzc";
        };
        packageRequires = [ cl-lib ];
        meta = {
@ -1846,10 +1861,10 @@
      elpaBuild {
        pname = "map";
        ename = "map";
-        version = "2.0";
+        version = "2.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/map-2.0.el";
-          sha256 = "1djygpvk1qgldg9my0lh8n2z1n6acz3y5ws7sv2w08hvxdlxz857";
+          url = "https://elpa.gnu.org/packages/map-2.1.el";
+          sha256 = "0ydz5w1n4vwhhzxxj003s7jv8n1wjijwfryk5z93bwhnr0cak0i0";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2095,10 +2110,10 @@
      elpaBuild {
        pname = "nhexl-mode";
        ename = "nhexl-mode";
-        version = "1.4";
+        version = "1.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/nhexl-mode-1.4.el";
-          sha256 = "1c2q4w6hkvc7z4026hiqdcsm2scd6q35x7b0dk80h8qicsbi14c8";
+          url = "https://elpa.gnu.org/packages/nhexl-mode-1.5.el";
+          sha256 = "0qvxfg7sv4iqyjxzaim6b4v9k5hav36qd4vkf9jwzw6p5fri8w8d";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -2245,10 +2260,10 @@
      elpaBuild {
        pname = "org";
        ename = "org";
-        version = "9.3.1";
+        version = "9.3.6";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-9.3.1.tar";
-          sha256 = "1n79h6ihhsaxxbnl9hw511aav0215m3pa51sa5fh3ddknjfplian";
+          url = "https://elpa.gnu.org/packages/org-9.3.6.tar";
+          sha256 = "0jwpgfzjvf1hd3mx582pw86hysdryaqzp69hk6azi9kmq4bzk87d";
        };
        packageRequires = [];
        meta = {
@ -2260,10 +2275,10 @@
      elpaBuild {
        pname = "org-edna";
        ename = "org-edna";
-        version = "1.0.2";
+        version = "1.1.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-edna-1.0.2.tar";
-          sha256 = "005pmnqr41s2w72gahq9bf4l5kw601i19ypiqfnb8aq0f4acjr3d";
+          url = "https://elpa.gnu.org/packages/org-edna-1.1.1.tar";
+          sha256 = "1hfkdjbjnhbwb27vgs43ywl4kn2lqc037f4xppp2v0s97850za8r";
        };
        packageRequires = [ emacs org seq ];
        meta = {
@ -2410,10 +2425,10 @@
      elpaBuild {
        pname = "phps-mode";
        ename = "phps-mode";
-        version = "0.3.27";
+        version = "0.3.38";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/phps-mode-0.3.27.tar";
-          sha256 = "1p6s5dq0d1ysm993qax8mi2sv4956ggainfbhsn65gc2718kjd0h";
+          url = "https://elpa.gnu.org/packages/phps-mode-0.3.38.tar";
+          sha256 = "1m8f1z259c66k0hf0cfjqidfd0cra2c2mb7k5lj71v1kfckwj6bh";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2455,10 +2470,10 @@
      elpaBuild {
        pname = "posframe";
        ename = "posframe";
-        version = "0.5.0";
+        version = "0.6.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/posframe-0.5.0.el";
-          sha256 = "1fjnpwg1fj9j54nymh802vd4viggrg3qnqwh52281n7zv6xfv0qb";
+          url = "https://elpa.gnu.org/packages/posframe-0.6.0.el";
+          sha256 = "14x2jgjn8di03rrad4x4mn8fhcqibk1j5c0ya0vmv8648fki6i9d";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2746,16 +2761,16 @@
          license = lib.licenses.free;
        };
      }) {};
-    relint = callPackage ({ elpaBuild, fetchurl, lib, xr }:
+    relint = callPackage ({ elpaBuild, emacs, fetchurl, lib, xr }:
      elpaBuild {
        pname = "relint";
        ename = "relint";
-        version = "1.11";
+        version = "1.14";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/relint-1.11.tar";
-          sha256 = "0c7d35kp5k11fnyjrq9cg8i2r005gs57pmb3rvpf8ilwv0scn1m7";
+          url = "https://elpa.gnu.org/packages/relint-1.14.tar";
+          sha256 = "0hjzhxcygb2r2s3g2pk3z9x3appy1y8gkw8gpg9cpkl6lpwcsh2f";
        };
-        packageRequires = [ xr ];
+        packageRequires = [ emacs xr ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/relint.html";
          license = lib.licenses.free;
@ -2936,10 +2951,10 @@
      elpaBuild {
        pname = "sml-mode";
        ename = "sml-mode";
-        version = "6.9";
+        version = "6.10";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/sml-mode-6.9.el";
-          sha256 = "1bdg9ywpvj85hxqah9w1raxlcrhkyx67nw22jwd1bd5j0fhmgqij";
+          url = "https://elpa.gnu.org/packages/sml-mode-6.10.el";
+          sha256 = "01yf0s474r9xhj6nbs14ljn9ccxb5yy758i17c8nmgmqvm8fx7sb";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -3041,10 +3056,10 @@
      elpaBuild {
        pname = "stream";
        ename = "stream";
-        version = "2.2.4";
+        version = "2.2.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/stream-2.2.4.tar";
-          sha256 = "1fdjjxfnpzfv5jsy0wmmnrsk821bg8d3magsng609fb2pkwvk1ij";
+          url = "https://elpa.gnu.org/packages/stream-2.2.5.tar";
+          sha256 = "00c3n4gyxzv7vczqms0d62kl8zsmjfyxa92mwxn2snyx857a9jfw";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3176,10 +3191,10 @@
      elpaBuild {
        pname = "tramp";
        ename = "tramp";
-        version = "2.4.3";
+        version = "2.4.3.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-2.4.3.tar";
-          sha256 = "0m1w4myvd2z293xcdyj7yc75b108f67f98i0jrizhdaj9nlw8j5f";
+          url = "https://elpa.gnu.org/packages/tramp-2.4.3.2.tar";
+          sha256 = "17kay6rpkgz79jggzj53awkbqfsp5sq93wpssw5vlwnigd4mrkzx";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3236,10 +3251,10 @@
      elpaBuild {
        pname = "undo-tree";
        ename = "undo-tree";
-        version = "0.7.2";
+        version = "0.7.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/undo-tree-0.7.2.el";
-          sha256 = "0gdqh5rkgwlancbjx5whgl5gqkdipdkspkl2bqmrq70sgg5ahrcc";
+          url = "https://elpa.gnu.org/packages/undo-tree-0.7.4.el";
+          sha256 = "018ixl802f076sfyf4gkacpgrdpybin88jd8vq9zgyvc6x2dalfa";
        };
        packageRequires = [];
        meta = {
@ -3352,10 +3367,10 @@
      elpaBuild {
        pname = "verilog-mode";
        ename = "verilog-mode";
-        version = "2019.12.17.268053413";
+        version = "2020.2.23.232634261";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/verilog-mode-2019.12.17.268053413.el";
-          sha256 = "0g42sd5s5xrck077qx0p2sldnr2f9qm8dsr9d0fiaks294sk8li8";
+          url = "https://elpa.gnu.org/packages/verilog-mode-2020.2.23.232634261.el";
+          sha256 = "07r2nzyfwmpv1299q1v768ai14rdgq7y4bvz5xsnp4qj3g06p0f6";
        };
        packageRequires = [];
        meta = {
@ -3565,10 +3580,10 @@
      elpaBuild {
        pname = "wisi";
        ename = "wisi";
-        version = "2.2.1";
+        version = "3.0.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/wisi-2.2.1.tar";
-          sha256 = "1qvhx8bpms7gri7y6wniwqd6nmqxj4lip5l3sphbq2kjf4zq4qd4";
+          url = "https://elpa.gnu.org/packages/wisi-3.0.1.tar";
+          sha256 = "01961apbirdi4y8qx2wb01f04knkw3hyin3ndrkjlkfslqbsnzzv";
        };
        packageRequires = [ emacs seq ];
        meta = {
@ -3615,10 +3630,10 @@
      elpaBuild {
        pname = "xclip";
        ename = "xclip";
-        version = "1.9";
+        version = "1.10";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xclip-1.9.el";
-          sha256 = "0xbs6fw0dfm5iynhdx62cwixzizjkrwrib6n0fjnsj31kajbkf3y";
+          url = "https://elpa.gnu.org/packages/xclip-1.10.el";
+          sha256 = "0i3i9kwfg8qmhcmqhhnrb1kljgwkccv63s9q1mjwqfjldyfh8j8i";
        };
        packageRequires = [];
        meta = {
@ -3656,16 +3671,16 @@
          license = lib.licenses.free;
        };
      }) {};
-    xr = callPackage ({ elpaBuild, fetchurl, lib }:
+    xr = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "xr";
        ename = "xr";
-        version = "1.13";
+        version = "1.16";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xr-1.13.tar";
-          sha256 = "1km4x92pii8c4bcimks4xzhmwpypdf183z0zh7raj062jz4jb74r";
+          url = "https://elpa.gnu.org/packages/xr-1.16.tar";
+          sha256 = "1s6pkbr7gkan0r9gfmix75m587d8cg6l11722v70zzgf2z9w2xg9";
        };
-        packageRequires = [];
+        packageRequires = [ emacs ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/xr.html";
          license = lib.licenses.free;
@ -3734,4 +3749,4 @@
          license = lib.licenses.free;
        };
      }) {};
-  }
+  }
--- a/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
--- a/pkgs/applications/editors/ne/default.nix
+++ b/pkgs/applications/editors/ne/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "ne";
-  version = "3.2.1";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "vigna";
    repo = pname;
    rev = version;
-    sha256 = "0h6d08cnwrk96ss83i9bragwwanph6x54sm3ak1z81146dsqsiif";
+    sha256 = "01aglnsfljlvx0wvyvpjfn4y88jf450a06qnj9a8lgdqv1hdkq1a";
  };

  postPatch = ''
--- a/pkgs/applications/editors/texmacs/darwin.nix
+++ b/pkgs/applications/editors/texmacs/darwin.nix
@ -49,7 +49,7 @@ stdenv.mkDerivation {
    "${ghostscript}/bin:" +
    (if aspell == null then "" else "${aspell}/bin:") +
    (if tex == null then "" else "${tex}/bin:") +
-    (if netpbm == null then "" else "${netpbm}/bin:") +
+    (if netpbm == null then "" else "${stdenv.lib.getBin netpbm}/bin:") +
    (if imagemagick == null then "" else "${imagemagick}/bin:");

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "tiled";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "bjorn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1jfr9ngsbkn9j3yvy3mnx0llfwmk39dj8kfiy9fawkhw0v4bzjbd";
+    sha256 = "0v8imw6zdygs9ymsgk41jclsfr1jwbracjc5balydh15r57rvwjd";
  };

  nativeBuildInputs = [ pkgconfig qmake ];
@ -19,7 +19,7 @@ mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Free, easy to use and flexible tile map editor";
-    homepage = https://www.mapeditor.org/;
+    homepage = "https://www.mapeditor.org/";
    license = with licenses; [
      bsd2	# libtiled and tmxviewer
      gpl2Plus	# all the rest
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -62,6 +62,8 @@ in
      else [ gtk2 at-spi2-atk wrapGAppsHook ] ++ atomEnv.packages)
        ++ [ libsecret libXScrnSaver ];

+    runtimeDependencies = [ systemd.lib fontconfig.lib ];
+
    nativeBuildInputs = lib.optional (!stdenv.isDarwin) autoPatchelfHook;

    dontBuild = true;
@ -94,9 +96,5 @@ in
        grep -q "VSCODE_PATH='$out/lib/vscode'" $out/bin/${executableName} # check if sed succeeded
      '';

-    preFixup = lib.optionalString (system == "i686-linux" || system == "x86_64-linux") ''
-      gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ systemd fontconfig ]})
-    '';
-
    inherit meta;
  }
--- a/pkgs/applications/graphics/drawing/default.nix
+++ b/pkgs/applications/graphics/drawing/default.nix
@ -0,0 +1,69 @@
+{ lib
+, fetchFromGitHub
+, meson
+, ninja
+, pkgconfig
+, python3
+, gtk3
+, appstream-glib
+, desktop-file-utils
+, gobject-introspection
+, wrapGAppsHook
+, glib
+, gdk-pixbuf
+, pango
+, gettext
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "drawing";
+  version = "0.4.11";
+
+  format = "other";
+  
+  src = fetchFromGitHub {
+    owner = "maoschanz";
+    repo = pname;
+    rev = version;
+    sha256 = "00c1h6jns11rmsg35gy40fb6ahvik80wpbm2133bjcqxfwwnlal6";
+  };
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    gobject-introspection
+    meson
+    ninja
+    pkgconfig
+    wrapGAppsHook
+    glib
+    gettext
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    gdk-pixbuf
+    pango
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pycairo
+    pygobject3
+  ];
+
+  postPatch = ''
+    chmod +x build-aux/meson/postinstall.py # patchShebangs requires executable file
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  strictDeps = false;
+
+  meta = with lib; {
+    description = "A free basic image editor, similar to Microsoft Paint, but aiming at the GNOME desktop";
+    homepage = "https://maoschanz.github.io/drawing/";
+    maintainers = with maintainers; [ mothsart ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@ -60,11 +60,11 @@ let

 in mkDerivation rec {
  pname = "drawpile";
-  version = "2.1.16";
+  version = "2.1.17";

  src = fetchurl {
    url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "1mz64c1a5x906j2jqq7i16l1q1d97wgm2y0ybmmcyqzg09x9wyaw";
+    sha256 = "11lhn1mymhqk9g5sh384xhj3qw8h9lv88pr768y9q6kg3sl7nzzf";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/ideogram/default.nix
+++ b/pkgs/applications/graphics/ideogram/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "ideogram";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "cassidyjames";
    repo = pname;
    rev = version;
-    sha256 = "08nl11gj3234nrqyigqkq3yiyrqf2hha24x5jkl78ypj2xhcnhw8";
+    sha256 = "1zkr7x022khn5g3sq2dkxzy1hiiz66vl81s3i5sb9qr88znh79p1";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/mandelbulber/default.nix
+++ b/pkgs/applications/graphics/mandelbulber/default.nix
@ -19,13 +19,13 @@ assert withOpenCL -> ocl-icd != null;

 mkDerivation rec {
  pname = "mandelbulber";
-  version = "2.20";
+  version = "2.21";

  src = fetchFromGitHub {
    owner = "buddhi1980";
    repo = "mandelbulber2";
    rev = version;
-    sha256 = "043dks9fimhradyhdzqdc6lb9z0x9lkj3szj10751g424lppp207";
+    sha256 = "1bmk71vbxc1n8cnizlmzfqlvgxjb95cydbzxlvq1s5givxr2jwli";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/qimgv/default.nix
+++ b/pkgs/applications/graphics/qimgv/default.nix
@ -0,0 +1,49 @@
+{ mkDerivation, fetchFromGitHub, lib
+, pkgconfig, cmake
+, exiv2, qtbase, qtimageformats, qtsvg
+}:
+
+mkDerivation rec {
+  pname = "qimgv";
+  version = "0.8.9";
+
+  src = fetchFromGitHub {
+    owner = "easymodo";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0cmya06j466v0pirhxbzbj1vbz0346y7rbc1gbv4n9xcp6c6bln6";
+  };
+
+  cmakeFlags = [
+    # Video support appears to be broken; the following gets printed upon
+    # attempting to view an mp4, webm, or mkv (and probably all video formats):
+    #
+    #   [VideoPlayerInitProxy] Error - could not load player library
+    #   "qimgv_player_mpv"
+    #
+    # GIFs are unaffected. If this ever gets addressed, all that is necessary is
+    # to add `mpv` to the arguments list and to `buildInputs`, and to remove
+    # `cmakeFlags`.
+    "-DVIDEO_SUPPORT=OFF"
+  ];
+
+  nativeBuildInputs = [
+    pkgconfig
+    cmake
+  ];
+
+  buildInputs = [
+    exiv2
+    qtbase
+    qtimageformats
+    qtsvg
+  ];
+
+  meta = with lib; {
+    description = "Qt5 image viewer with optional video support";
+    homepage = "https://github.com/easymodo/qimgv";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ cole-h ];
+  };
+}
--- a/pkgs/applications/graphics/rx/default.nix
+++ b/pkgs/applications/graphics/rx/default.nix
@ -16,10 +16,7 @@ rustPlatform.buildRustPackage rec {
    sha256 = "1n5s7v2z13550gkqz7w6dw62jdy60wdi8w1lfa23609b4yhg4w94";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "173jfjvdag97f6jvfg366hjk9v3cz301cbzpcahy51rbf1cip1w1";
+  cargoSha256 = "077cs9bf7f3h5aschcv7pbbnpaq1rg79j7f6pnyrzkmn7gxzicg3";

  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];

--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -7,7 +7,7 @@
 , jackaudioSupport ? false, libjack2
 , cudaSupport ? config.cudaSupport or false, cudatoolkit
 , colladaSupport ? true, opencollada
-, enableNumpy ? false, makeWrapper
+, makeWrapper
 , pugixml, SDL, Cocoa, CoreGraphics, ForceFeedback, OpenAL, OpenGL
 }:

@ -117,11 +117,13 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  postInstall = optionalString enableNumpy
-    ''
-      wrapProgram $out/bin/blender \
-        --prefix PYTHONPATH : ${python3Packages.numpy}/${python.sitePackages}
-    '';
+  blenderExecutable =
+    placeholder "out" + (if stdenv.isDarwin then "/Blender.app/Contents/MacOS/Blender" else "/bin/blender");
+  # --python-expr is used to workaround https://developer.blender.org/T74304
+  postInstall = ''
+    wrapProgram $blenderExecutable \
+      --add-flags '--python-expr "import sys; sys.path.append(\"${python3Packages.numpy}/${python.sitePackages}\")"'
+  '';

  # Set RUNPATH so that libcuda and libnvrtc in /run/opengl-driver(-32)/lib can be
  # found. See the explanation in libglvnd.
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "dbeaver-ce";
-  version = "6.3.5";
+  version = "7.0.0";

  desktopItem = makeDesktopItem {
    name = "dbeaver";
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1ssxgnd23cy6br7sbfszvx283c5vz9hgfhx0vqyvm13wyr67hk45";
+    sha256 = "0ggay9igpqwq016yzfz2dw3cjhlzadaml0hi06iqzhxljr86qm44";
  };

  installPhase = ''
--- a/pkgs/applications/misc/dmenu/wayland.nix
+++ b/pkgs/applications/misc/dmenu/wayland.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, meson, ninja, cairo, pango, pkg-config, wayland-protocols
+, glib, wayland, libxkbcommon, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dmenu-wayland-unstable";
+  version = "2020-02-28";
+
+  src = fetchFromGitHub {
+    owner = "nyyManni";
+    repo = "dmenu-wayland";
+    rev = "68e08e8bcde10a10ac3290431f173c6c7fce4238";
+    sha256 = "10b1v2brgpgb6wkzn62haj56zmkf3aq6fs3p9rp6bxiw8bs2nvlm";
+  };
+
+  outputs = [ "out" "man" ];
+
+  nativeBuildInputs = [ meson ninja pkg-config makeWrapper ];
+  buildInputs = [ cairo pango wayland-protocols glib wayland libxkbcommon ];
+
+  postInstall = ''
+    wrapProgram $out/bin/dmenu-wl_run \
+      --prefix PATH : $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    license = licenses.mit;
+    platforms = platforms.linux;
+    description = "dmenu for wayland-compositors";
+    homepage = "https://github.com/nyyManni/dmenu-wayland";
+    maintainers = with maintainers; [ ma27 ];
+  };
+}
--- a/pkgs/applications/misc/fetchmail/default.nix
+++ b/pkgs/applications/misc/fetchmail/default.nix
@ -1,15 +1,15 @@
 { stdenv, fetchurl, openssl }:

 let
-  version = "6.3.26";
+  version = "6.4.2";
 in
 stdenv.mkDerivation {
  pname = "fetchmail";
  inherit version;

  src = fetchurl {
-    url = "mirror://sourceforge/fetchmail.berlios/fetchmail-${version}.tar.bz2";
-    sha256 = "08rafrs1dlr11myr0p99kg4k80qyy0fa63gg3ac88zn49174lwhw";
+    url = "mirror://sourceforge/fetchmail/fetchmail-${version}.tar.xz";
+    sha256 = "0c563if3kribnj771l14aj06irmrlhm61dc68w6dp7zj4qrnn7z2";
  };

  buildInputs = [ openssl ];
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.65.3";
+  version = "0.66.0";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,7 +10,7 @@ buildGoModule rec {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1m0xhzm1w6y778x3fplzr9dif7lcqlkfvk4b7plywrisv3ic8yqs";
+    sha256 = "177vqxzmldpkpaj7giqlbl39091fa2ga2pnshdj6gc393rw52f0a";
  };

  modSha256 = "1f320zbqnv2ybsp3qmlgn3rsjgp2zdb24qjd3gcys30mw48cx3na";
--- a/pkgs/applications/misc/iterm2/default.nix
+++ b/pkgs/applications/misc/iterm2/default.nix
@ -1,31 +1,48 @@
 { stdenv, fetchFromGitHub }:

+ /*
+ This derivation is impure: it relies on an Xcode toolchain being installed
+ and available in the expected place. The values of sandboxProfile
+ are copied pretty directly from the MacVim derivation, which
+ is also impure. In order to build you at least need the `sandbox`
+ option set to `relaxed` or `false`.
+ */
+
 stdenv.mkDerivation rec {
  pname = "iterm2";
-  version = "3.0.14";
+  version = "3.3.9";

  src = fetchFromGitHub {
    owner = "gnachman";
    repo = "iTerm2";
    rev = "v${version}";
-    sha256 = "03m0ja11w9910z96yi8fzq3436y8xl14q031rdb2w3sapjd54qrj";
+    sha256 = "06mq3gfjgy8jw2f3fzdsi3pbfkdijfzzlhlw6ixa5bfb4hbcgn5j";
  };

  patches = [ ./disable_updates.patch ];
  postPatch = ''
    sed -i -e 's/CODE_SIGN_IDENTITY = "Developer ID Application"/CODE_SIGN_IDENTITY = ""/g' ./iTerm2.xcodeproj/project.pbxproj
  '';
+
  preConfigure = "LD=$CC";
-  makeFlagsArray = ["Deployment"];
+  makeFlagsArray = ["Nix"];
  installPhase = ''
-    mkdir -p "$out/Applications"
-    mv "build/Deployment/iTerm2.app" "$out/Applications/iTerm.app"
+    mkdir -p $out/Applications
+    mv Build/Products/Deployment/iTerm2.app $out/Applications/iTerm.app
  '';

-  meta = {
+  sandboxProfile = ''
+     (allow file-read* file-write* process-exec mach-lookup)
+     ; block homebrew dependencies
+     (deny file-read* file-write* process-exec mach-lookup (subpath "/usr/local") (with no-log))
+  '';
+
+  meta = with stdenv.lib; {
    description = "A replacement for Terminal and the successor to iTerm";
    homepage = https://www.iterm2.com/;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.darwin;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ tricktron ];
+    platforms = platforms.darwin;
+    hydraPlatforms = [];
  };
 }
--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@ -3,11 +3,11 @@

 mkDerivation rec {
  pname = "latte-dock";
-  version = "0.9.8.1";
+  version = "0.9.9";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "10x5aplkjyi2w0793whjjzi777ffh3m4d0sp06qzkpx8jqd46him";
+    sha256 = "01b2zr2x5hnadkvj687lwi3l6dwq3kdn5y9k4qf1bv0sa4vw6hn9";
    name = "${pname}-${version}.tar.xz";
  };

@ -20,7 +20,7 @@ mkDerivation rec {

  meta = with lib; {
    description = "Dock-style app launcher based on Plasma frameworks";
-    homepage = https://github.com/psifidotos/Latte-Dock;
+    homepage = "https://github.com/psifidotos/Latte-Dock";
    license = licenses.gpl2;
    platforms = platforms.unix;
    maintainers = [ maintainers.benley maintainers.ysndr ];
--- a/pkgs/applications/misc/pastel/default.nix
+++ b/pkgs/applications/misc/pastel/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pastel";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "sharkdp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1fh0l64bvpbgm1725qmyq3042pglr8wz3w1azjv6lml9ivrm4b0k";
+    sha256 = "1xrg25w175m2iz7q9v7c05a0p0v5rr71vd4m3v6p0lqvij3sih4s";
  };

-  cargoSha256 = "0q7p66r6hwqaalwm9fd2bshadlynhjf3pzd6rnamr07mknyfzh5s";
+  cargoSha256 = "17rw9wp9mfv38h0azdjwl60bxdknb5q84ia0a2r1vi91gz6275cs";

  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;

--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@ -13,10 +13,7 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [ installShellFiles ];

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "1y33n0dmrssv35l0apfq1mchyh92cfbzjarh0m8zb2nxwhvk7paw";
+  cargoSha256 = "08zqhj3b0v4fxj8vi323zrxg4xvbp9gndm2khzs6daacglbwbvhk";

  postInstall = ''
    installShellCompletion utils/completions/pueue.{bash,fish} --zsh utils/completions/_pueue
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "A command-line time tracker";
-    homepage = https://taskwarrior.org/docs/timewarrior;
+    homepage = "https://timewarrior.net";
    license = licenses.mit;
    maintainers = with maintainers; [ matthiasbeyer mrVanDalo ];
    platforms = platforms.linux ++ platforms.darwin;
--- a/pkgs/applications/misc/wofi/default.nix
+++ b/pkgs/applications/misc/wofi/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "wofi";
-  version = "1.0";
+  version = "1.1";

  src = fetchhg {
    url = "https://hg.sr.ht/~scoopta/wofi";
    rev = "v${version}";
-    sha256 = "147yarm26nl0zc0a2rs7qi4jd7bz48vvyaygsif1qsv8fx0xiqqf";
+    sha256 = "0rq6c8fv0h7xj3jw1i01r39dz0f31k7jgf7hpgl6mlsyn0ddc80z";
  };

  nativeBuildInputs = [ pkg-config meson ninja ];
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "wtf";
-  version = "0.25.0";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "wtfutil";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1g76hzlyi8s8dayd36cs4bhnwgrrr731ybflw3xk5pgkgcbs14sd";
+    sha256 = "0j184s82bnnhrpm7vdsqg7i3xfm2wqz8jmwqxjkfw87ifgvaha5d";
   };

-  modSha256 = "186m7s20r59dyh5lpby4sd4vw3rvnkfzslylwin0c3r6150yrx8h";
+  modSha256 = "14qbjv8rnidfqxzqhli7jyj4573s0swwypdj11mpykcrzk9by8xk";

  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];

--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -7,7 +7,7 @@
 , xdg_utils, yasm, minizip, libwebp
 , libusb1, pciutils, nss, re2, zlib

-, python2Packages, perl, pkgconfig
+, python2Packages, perl, pkgconfig, clang-tools
 , nspr, systemd, kerberos
 , utillinux, alsaLib
 , bison, gperf
@ -104,6 +104,8 @@ let
            result
       else result;

+  llvm-clang-tools = clang-tools.override { inherit llvmPackages; };
+
  base = rec {
    name = "${packageName}-unwrapped-${version}";
    inherit (upstream-info) channel version;
@ -214,6 +216,8 @@ let
      ln -s ${stdenv.cc}/bin/clang              third_party/llvm-build/Release+Asserts/bin/clang
      ln -s ${stdenv.cc}/bin/clang++            third_party/llvm-build/Release+Asserts/bin/clang++
      ln -s ${llvmPackages.llvm}/bin/llvm-ar    third_party/llvm-build/Release+Asserts/bin/llvm-ar
+    '' + optionalString (stdenv.lib.versionAtLeast version "82") ''
+      ln -s ${llvm-clang-tools}/bin/clang-format buildtools/linux64/clang-format
    '';

    gnFlags = mkGnFlags ({
--- a/pkgs/applications/networking/browsers/ephemeral/default.nix
+++ b/pkgs/applications/networking/browsers/ephemeral/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "ephemeral";
-  version = "6.2.1";
+  version = "6.3.0";

  src = fetchFromGitHub {
    owner = "cassidyjames";
    repo = "ephemeral";
    rev = version;
-    sha256 = "182kzk68l6rr878aaaqx31c6npb65x77qzhbc5rbqlrrdrb69zsg";
+    sha256 = "0h159szljvphs2hvagxwv6nncx46q0mvr4ylhl2nimap9jvss91n";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -1,20 +1,44 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, buildGoPackage, fetchFromGitHub }:

-buildGoPackage rec {
+let
+  # Argo can package a static server in the CLI using the `staticfiles` go module.
+  # We build the CLI without the static server for simplicity, but the tool is still required for
+  # compilation to succeed.
+  # See: https://github.com/argoproj/argo/blob/d7690e32faf2ac5842468831daf1443283703c25/Makefile#L117
+  staticfiles = buildGoPackage rec {
+    name = "staticfiles";
+    src = fetchFromGitHub {
+      owner = "bouk";
+      repo = "staticfiles";
+      rev = "827d7f6389cd410d0aa3f3d472a4838557bf53dd";
+      sha256 = "0xarhmsqypl8036w96ssdzjv3k098p2d4mkmw5f6hkp1m3j67j61";
+    };
+
+    goPackagePath = "bou.ke/staticfiles";
+  };
+in
+buildGoModule rec {
  pname = "argo";
-  version = "2.4.3";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "v${version}";
-    sha256 = "15726n5rrbzszq5dpmrxbw9cn7ahihn28jqk274270140gz5aak1";
+    sha256 = "0hlvsi706jwlf43mdwic6j7iriii4daxjr82qgi80ac4h4x0z3h2";
  };

-  goDeps = ./deps.nix;
-  goPackagePath = "github.com/argoproj/argo";
+  modSha256 = "1394bav1k1xv9n1rvji0j9a09mibk97xpha24640jkgmy9bnmg45";
+
  subPackages = [ "cmd/argo" ];

+  preBuild = ''
+    mkdir -p ui/dist/app
+    echo "Built without static files" > ui/dist/app/index.html
+
+    ${staticfiles}/bin/staticfiles -o server/static/files.go ui/dist/app
+  '';
+
  meta = with lib; {
    description = "Container native workflow engine for Kubernetes";
    homepage = https://github.com/argoproj/argo;
--- a/pkgs/applications/networking/cluster/argo/deps.nix
+++ b/pkgs/applications/networking/cluster/argo/deps.nix
@ -1,903 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "cloud.google.com/go";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/gocloud";
-      rev =  "ceeb313ad77b789a7fa5287b36a1d127b69b7093";
-      sha256 = "0z5z3qag9g4fc7g6di7ijxzz0s3c7al1rx0sxxkbqbpwlgk4iwf2";
-    };
-  }
-  {
-    goPackagePath  = "contrib.go.opencensus.io/exporter/ocagent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-ecosystem/opencensus-go-exporter-ocagent";
-      rev =  "f9129169651c35ecbdc1186c3ba4aa876ee62e1e";
-      sha256 = "09n7w31668f6f55qw6qkw85mp6mhkmxs2x5hk4vr0p5qiqap576h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/Azure/go-autorest";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/go-autorest";
-      rev =  "880eb0e2aca291c40538ddef66e5914fb1cc1d7f";
-      sha256 = "0v6d6la29n3kkgn7r3b63pf96cpj5kf88rddkm2x2vqb9x2gmi0p";
-    };
-  }
-  {
-    goPackagePath  = "github.com/Knetic/govaluate";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Knetic/govaluate";
-      rev =  "9aa49832a739dcd78a5542ff189fb82c3e423116";
-      sha256 = "12klijhq4fckzbhv0cwygbazj6lvhmdqksha9y6jgfmwzv51kwv5";
-    };
-  }
-  {
-    goPackagePath  = "github.com/PuerkitoBio/purell";
-    fetch = {
-      type = "git";
-      url = "https://github.com/PuerkitoBio/purell";
-      rev =  "44968752391892e1b0d0b821ee79e9a85fa13049";
-      sha256 = "0c525frsxmalrn55hzzsxy17ng8avkd40ga0wxfw9haxsdjgqdqy";
-    };
-  }
-  {
-    goPackagePath  = "github.com/PuerkitoBio/urlesc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/PuerkitoBio/urlesc";
-      rev =  "de5bf2ad457846296e2031421a34e2568e304e35";
-      sha256 = "0n0srpqwbaan1wrhh2b7ysz543pjs1xw2rghvqyffg9l0g8kzgcw";
-    };
-  }
-  {
-    goPackagePath  = "github.com/argoproj/pkg";
-    fetch = {
-      type = "git";
-      url = "https://github.com/argoproj/pkg";
-      rev =  "5616f48963eebf7cca912632230032b263bb62bc";
-      sha256 = "1m50mpmgdv4hjdpl994xdkdbjfwv7dagn6mhix17cb5mf61ixs6z";
-    };
-  }
-  {
-    goPackagePath  = "github.com/aws/aws-sdk-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aws/aws-sdk-go";
-      rev =  "d57c8d96f72d9475194ccf18d2ba70ac294b0cb3";
-      sha256 = "09bv2ay7vnv15vj83ysqs98v0hcjg0nziwnp7qjdr0iasrhl4r21";
-    };
-  }
-  {
-    goPackagePath  = "github.com/beorn7/perks";
-    fetch = {
-      type = "git";
-      url = "https://github.com/beorn7/perks";
-      rev =  "37c8de3658fcb183f997c4e13e8337516ab753e6";
-      sha256 = "17n4yygjxa6p499dj3yaqzfww2g7528165cl13haj97hlx94dgl7";
-    };
-  }
-  {
-    goPackagePath  = "github.com/census-instrumentation/opencensus-proto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-proto";
-      rev =  "d89fa54de508111353cb0b06403c00569be780d8";
-      sha256 = "19fcx3sc99i5dsklny6r073z5j20vlwn2xqm6di1q3b1xwchzqfj";
-    };
-  }
-  {
-    goPackagePath  = "github.com/colinmarc/hdfs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/colinmarc/hdfs";
-      rev =  "9746310a4d311e21ce43b2a645c5a1e64c5e8efa";
-      sha256 = "0r5dyadjck22i7fyci67r00ajbcqgx52z13rhriy0sw68j510r1r";
-    };
-  }
-  {
-    goPackagePath  = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev =  "8991bc29aa16c548c550c7ff78260e27b9ab7c73";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dgrijalva/jwt-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dgrijalva/jwt-go";
-      rev =  "06ea1031745cb8b3dab3f6a236daf2b0aa468b7e";
-      sha256 = "08m27vlms74pfy5z79w67f9lk9zkx6a9jd68k3c4msxy75ry36mp";
-    };
-  }
-  {
-    goPackagePath  = "github.com/docker/spdystream";
-    fetch = {
-      type = "git";
-      url = "https://github.com/docker/spdystream";
-      rev =  "6480d4af844c189cf5dd913db24ddd339d3a4f85";
-      sha256 = "19glzj20vvy19igsl5bji9xrxi9m0ixhk4zs98dg15mh8ah36zak";
-    };
-  }
-  {
-    goPackagePath  = "github.com/dustin/go-humanize";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dustin/go-humanize";
-      rev =  "9f541cc9db5d55bce703bd99987c9d5cb8eea45e";
-      sha256 = "1kqf1kavdyvjk7f8kx62pnm7fbypn9z1vbf8v2qdh3y7z7a0cbl3";
-    };
-  }
-  {
-    goPackagePath  = "github.com/emicklei/go-restful";
-    fetch = {
-      type = "git";
-      url = "https://github.com/emicklei/go-restful";
-      rev =  "6ac3b8eb89d325e5c750d77f344a6870464d03c3";
-      sha256 = "0dgjld5240xhz45rj929ffm452n931qfw3fx8x99vhlnii9qrwz2";
-    };
-  }
-  {
-    goPackagePath  = "github.com/emirpasic/gods";
-    fetch = {
-      type = "git";
-      url = "https://github.com/emirpasic/gods";
-      rev =  "1615341f118ae12f353cc8a983f35b584342c9b3";
-      sha256 = "0i5qqq7ajvw3mikr95zl9rsnfsjanzwpqqs6kzzplsfgsifybar1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/evanphx/json-patch";
-    fetch = {
-      type = "git";
-      url = "https://github.com/evanphx/json-patch";
-      rev =  "026c730a0dcc5d11f93f1cf1cc65b01247ea7b6f";
-      sha256 = "144mk2v9q37l1qjf8498nff4hhz96mlkl7ls7ihixbmrji4lmch4";
-    };
-  }
-  {
-    goPackagePath  = "github.com/ghodss/yaml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ghodss/yaml";
-      rev =  "0ca9ea5df5451ffdf184b4428c902747c2c11cd7";
-      sha256 = "0skwmimpy7hlh7pva2slpcplnm912rp3igs98xnqmn859kwa5v8g";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-openapi/jsonpointer";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/jsonpointer";
-      rev =  "a105a905c5e6ad147f08504784917f3e178e0ba5";
-      sha256 = "1s3cqf4svrbygvvpvi7hf122szsgihas52vqh0bba3avf4w03g9n";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-openapi/jsonreference";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/jsonreference";
-      rev =  "2903bfd4bfbaf188694f1edf731f2725a8fa344f";
-      sha256 = "0v933yvcwyzzlpdxwb9204ki7lls2rwfd96ww2i901ndvz37kdf8";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-openapi/spec";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/spec";
-      rev =  "bdfd7e07daecc404d77868a88b2364d0aed0ee5a";
-      sha256 = "1r2my46qc85fp1j4lbddmd6c1n0am9bq1wyqsnw7x8raiznqxp5l";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-openapi/swag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-openapi/swag";
-      rev =  "c3d0f7896d589f3babb99eea24bbc7de98108e72";
-      sha256 = "1z34vqc5yz6rzvarrvlhkimxx33p74iaxb28l1mv716njvlsmjhg";
-    };
-  }
-  {
-    goPackagePath  = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev =  "72cd26f257d44c1114970e19afddcd812016007e";
-      sha256 = "1fvsvwc1v2i0gqn01mynvi1shp5xm0xaym6xng09fcbqb56lbjx1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gogo/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gogo/protobuf";
-      rev =  "0ca988a254f991240804bf9821f3450d87ccbb1b";
-      sha256 = "0slfyrmbpdcppf0z3waar90bpszdhi2gv705ys1b0zx5x6ax8f1a";
-    };
-  }
-  {
-    goPackagePath  = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev =  "6c65a5562fc06764971b7c5d05c76c75e84bdbf7";
-      sha256 = "1k1wb4zr0qbwgpvz9q5ws9zhlal8hq7dmq62pwxxriksayl6hzym";
-    };
-  }
-  {
-    goPackagePath  = "github.com/google/gofuzz";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/gofuzz";
-      rev =  "f140a6486e521aad38f5917de355cbf147cc0496";
-      sha256 = "0qz439qvccm91w0mmjz4fqgx48clxdwagkvvx89cr43q1d4iry36";
-    };
-  }
-  {
-    goPackagePath  = "github.com/googleapis/gnostic";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/gnostic";
-      rev =  "ab0dd09aa10e2952b28e12ecd35681b20463ebab";
-      sha256 = "1f4bs71hrqkwg8fdhsxh25s12xnkxly13cnmp6m4qj6vc6k6zr2n";
-    };
-  }
-  {
-    goPackagePath  = "github.com/gorilla/websocket";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/websocket";
-      rev =  "c3e18be99d19e6b3e8f1559eea2c161a665c4b6b";
-      sha256 = "03n1n0nwz3k9qshmriycqznnnvd3dkzsfwpnfjzzvafjxk9kyapv";
-    };
-  }
-  {
-    goPackagePath  = "github.com/grpc-ecosystem/grpc-gateway";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc-ecosystem/grpc-gateway";
-      rev =  "471f45a5a99a578de7a8638dc7ed29e245bde097";
-      sha256 = "1jbr14p1dh6jpq3q6b4nq97ryh56h17ali0nckicpxhdrvxgi81c";
-    };
-  }
-  {
-    goPackagePath  = "github.com/hashicorp/go-uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-uuid";
-      rev =  "4f571afc59f3043a65f8fe6bf46d887b10a01d43";
-      sha256 = "0jvb88m0rq41bwgirsadgw7mnayl27av3gd2vqa3xvxp3fy0hp5k";
-    };
-  }
-  {
-    goPackagePath  = "github.com/hashicorp/golang-lru";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/golang-lru";
-      rev =  "7f827b33c0f158ec5dfbba01bb0b14a4541fd81d";
-      sha256 = "1p2igd58xkm8yaj2c2wxiplkf2hj6kxwrg6ss7mx61s5rd71v5xb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/imdario/mergo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/imdario/mergo";
-      rev =  "7c29201646fa3de8506f701213473dd407f19646";
-      sha256 = "05ir0jj74w0yfi1lrhjd97v759in1dpsma64cgmbiqvyp6hfmmf8";
-    };
-  }
-  {
-    goPackagePath  = "github.com/inconshreveable/mousetrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/inconshreveable/mousetrap";
-      rev =  "76626ae9c91c4f2a10f34cad8ce83ea42c93bb75";
-      sha256 = "1mn0kg48xkd74brf48qf5hzp0bc6g8cf5a77w895rl3qnlpfw152";
-    };
-  }
-  {
-    goPackagePath  = "github.com/jbenet/go-context";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jbenet/go-context";
-      rev =  "d14ea06fba99483203c19d92cfcd13ebe73135f4";
-      sha256 = "0q91f5549n81w3z5927n4a1mdh220bdmgl42zi3h992dcc4ls0sl";
-    };
-  }
-  {
-    goPackagePath  = "github.com/jcmturner/gofork";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jcmturner/gofork";
-      rev =  "dc7c13fece037a4a36e2b3c69db4991498d30692";
-      sha256 = "0xzsnjqv3d59w9pgqzf6550wdwaqnac7zcdgqfd25w65yhcffzhr";
-    };
-  }
-  {
-    goPackagePath  = "github.com/jmespath/go-jmespath";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jmespath/go-jmespath";
-      rev =  "c2b33e84";
-      sha256 = "1r6w7ydx8ydryxk3sfhzsk8m6f1nsik9jg3i1zhi69v4kfl4d5cz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/json-iterator/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/json-iterator/go";
-      rev =  "27518f6661eba504be5a7a9a9f6d9460d892ade3";
-      sha256 = "0n79p4s67zl5zprxv7diayw3vavnmmfqkmd6snz0i9bxp825dsyz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/kevinburke/ssh_config";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kevinburke/ssh_config";
-      rev =  "6cfae18c12b8934b1afba3ce8159476fdef666ba";
-      sha256 = "05jvz5r58a057zxvic9dyr9v2wilha8l6366npwkqgxmnmk9sh5f";
-    };
-  }
-  {
-    goPackagePath  = "github.com/konsorten/go-windows-terminal-sequences";
-    fetch = {
-      type = "git";
-      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev =  "f55edac94c9bbba5d6182a4be46d86a2c9b5b50e";
-      sha256 = "09mn209ika7ciy87xf2x31dq5fnqw39jidgaljvmqxwk7ff1hnx7";
-    };
-  }
-  {
-    goPackagePath  = "github.com/lib/pq";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lib/pq";
-      rev =  "3427c32cb71afc948325f299f040e53c1dd78979";
-      sha256 = "08j1smm6rassdssdks4yh9aspa1dv1g5nvwimmknspvhx8a7waqz";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mailru/easyjson";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mailru/easyjson";
-      rev =  "b2ccc519800e761ac8000b95e5d57c80a897ff9e";
-      sha256 = "0q85h383mhbkcjm2vqm72bi8n2252fv3c56q3lclzb8n2crnjcdk";
-    };
-  }
-  {
-    goPackagePath  = "github.com/matttproud/golang_protobuf_extensions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matttproud/golang_protobuf_extensions";
-      rev =  "c12348ce28de40eed0136aa2b644d0ee0650e56c";
-      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
-    };
-  }
-  {
-    goPackagePath  = "github.com/minio/minio-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/minio/minio-go";
-      rev =  "c6c2912aa5522e5f5a505e6cba30e95f0d8456fa";
-      sha256 = "0f5av1da4xbcy34j6dfy7c90na4a1capmsyac9qswq4xzq2zky10";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mitchellh/go-homedir";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-homedir";
-      rev =  "af06845cf3004701891bf4fdb884bfe4920b3727";
-      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mitchellh/go-ps";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-ps";
-      rev =  "621e5597135b1d14a7d9c2bfc7bc312e7c58463c";
-      sha256 = "0sjkz24kqz5nzgncnvdlzhlyba4jwmf6cxj8c4p8mb44679gkphh";
-    };
-  }
-  {
-    goPackagePath  = "github.com/modern-go/concurrent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/modern-go/concurrent";
-      rev =  "bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94";
-      sha256 = "0s0fxccsyb8icjmiym5k7prcqx36hvgdwl588y0491gi18k5i4zs";
-    };
-  }
-  {
-    goPackagePath  = "github.com/modern-go/reflect2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/modern-go/reflect2";
-      rev =  "4b7aa43c6742a2c18fdef89dd197aaae7dac7ccd";
-      sha256 = "1721y3yr3dpx5dx5ashf063qczk2awy5zjir1jvp1h5hn7qz4i49";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev =  "ba968bfe8b2f7e042a574c888954fccecfa385b4";
-      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev =  "792786c7400a136282c1664665ae0a8db921c6c2";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/client_golang";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_golang";
-      rev =  "c5b7fccd204277076155f10851dad72b76a49317";
-      sha256 = "1xqny3147g12n4j03kxm8s9mvdbs3ln6i56c655mybrn9jjy48kd";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev =  "14fe0d1b01d4d5fc031dd4bec1823bd3ebbe8016";
-      sha256 = "0zdmk6rbbx39cvfz0r59v2jg5sg9yd02b4pds5n5llgvivi99550";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/common";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/common";
-      rev =  "31bed53e4047fd6c510e43a941f90cb31be0972a";
-      sha256 = "1q16br348117ffycxdwsldb0i39p34miclfa8z93k6vjwnrqbh2l";
-    };
-  }
-  {
-    goPackagePath  = "github.com/prometheus/procfs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/procfs";
-      rev =  "00ec24a6a2d86e7074629c8384715dbb05adccd8";
-      sha256 = "1z5jq5rjala0a0di4nwk1rai0z9f73qwqj6mgcbpjbg2qknlb544";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sergi/go-diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sergi/go-diff";
-      rev =  "1744e2970ca51c86172c8190fadad617561ed6e7";
-      sha256 = "0swiazj8wphs2zmk1qgq75xza6m19snif94h2m6fi8dqkwqdl7c7";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev =  "839c75faf7f98a33d445d181f3018b5c3409a45e";
-      sha256 = "087k2lxrr9p9dh68yw71d05h5g9p5v26zbwd6j7lghinjfaw334x";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/cobra";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cobra";
-      rev =  "fe5e611709b0c57fa4a89136deaa8e1d4004d053";
-      sha256 = "1pn7g9jmhqc9yg6x02dgp4phiggnnxz8a11pv5y4vxhrvkjm6h71";
-    };
-  }
-  {
-    goPackagePath  = "github.com/spf13/pflag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/pflag";
-      rev =  "298182f68c66c05229eb03ac171abe6e309ee79a";
-      sha256 = "1cj3cjm7d3zk0mf1xdybh0jywkbbw7a6yr3y22x9sis31scprswd";
-    };
-  }
-  {
-    goPackagePath  = "github.com/src-d/gcfg";
-    fetch = {
-      type = "git";
-      url = "https://github.com/src-d/gcfg";
-      rev =  "1ac3a1ac202429a54835fe8408a92880156b489d";
-      sha256 = "044j95skmyrwjw5fwjk6ka32rjgsg0ar0mfp9np19sh1acwv4x4r";
-    };
-  }
-  {
-    goPackagePath  = "github.com/stretchr/objx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/objx";
-      rev =  "477a77ecc69700c7cdeb1fa9e129548e1c1c393c";
-      sha256 = "0iph0qmpyqg4kwv8jsx6a56a7hhqq8swrazv40ycxk9rzr0s8yls";
-    };
-  }
-  {
-    goPackagePath  = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev =  "221dbe5ed46703ee255b1da0dec05086f5035f62";
-      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
-    };
-  }
-  {
-    goPackagePath  = "github.com/tidwall/gjson";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tidwall/gjson";
-      rev =  "c5e72cdf74dff23857243dd662c465b810891c21";
-      sha256 = "0cg23va26ga6d0gckp5i3ramc98cbz6ij9gn9dqqyc8igvcx9cb3";
-    };
-  }
-  {
-    goPackagePath  = "github.com/tidwall/match";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tidwall/match";
-      rev =  "33827db735fff6510490d69a8622612558a557ed";
-      sha256 = "1ip5nkjvmzzzsypyzdd9nsnzbhwssprlx8qs5llqh16fl7kcvi3n";
-    };
-  }
-  {
-    goPackagePath  = "github.com/tidwall/pretty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tidwall/pretty";
-      rev =  "1166b9ac2b65e46a43d8618d30d1554f4652d49b";
-      sha256 = "1jwpj5903lh8hsj9apm2gwd70809zq0gjgmivkxaq4iq29wnv0n9";
-    };
-  }
-  {
-    goPackagePath  = "github.com/valyala/bytebufferpool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/valyala/bytebufferpool";
-      rev =  "e746df99fe4a3986f4d4f79e13c1e0117ce9c2f7";
-      sha256 = "01lqzjddq6kz9v41nkky7wbgk7f1cw036sa7ldz10d82g5klzl93";
-    };
-  }
-  {
-    goPackagePath  = "github.com/valyala/fasttemplate";
-    fetch = {
-      type = "git";
-      url = "https://github.com/valyala/fasttemplate";
-      rev =  "8b5e4e491ab636663841c42ea3c5a9adebabaf36";
-      sha256 = "0l131znbv8v67y20s4q361mwiww2c33zdc68mwvxchzk1gpy5ywq";
-    };
-  }
-  {
-    goPackagePath  = "github.com/xanzy/ssh-agent";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xanzy/ssh-agent";
-      rev =  "6a3e2ff9e7c564f36873c2e36413f634534f1c44";
-      sha256 = "1chjlnv5d6svpymxgsr62d992m2xi6jb5lybjc5zn1h3hv1m01av";
-    };
-  }
-  {
-    goPackagePath  = "go.opencensus.io";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-go";
-      rev =  "aab39bd6a98b853ab66c8a564f5d6cfcad59ce8a";
-      sha256 = "1x1ysvpyak1hcmfgvy0mk30g1ammbsmw19c9s0brz5h9wn7m4vva";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "9756ffdc24725223350eb3266ffb92590d28f278";
-      sha256 = "0q7hxaaq6lp0v8qqzifvysl47z5rfdlrxkh3d29vsl3wyby3dxl8";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "ba9fcec4b297b415637633c5a6e8fa592e4a16c3";
-      sha256 = "1hbqvy6r0s5h0dpdqw8fynl3cq0acin3iyqki9xvl5r8h33yb9bx";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/oauth2";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/oauth2";
-      rev =  "0f29369cfe4552d0e4bcddc57cc75f4d7e672a33";
-      sha256 = "06jwpvx0x2gjn2y959drbcir5kd7vg87k0r1216abk6rrdzzrzi2";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev =  "112230192c580c3556b8cee6403af37a4fc5f28c";
-      sha256 = "05i2k43j2d0llq768hg5pf3hb2yhfzp9la1w5wp0rsnnzblr0lfn";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "9109b7679e13aa34a54834cfb4949cac4b96e576";
-      sha256 = "169sg6fyjkykiylrgxr0pynv2zc3frkgssbsk5w2lqyl8mb319hl";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev =  "342b2e1fbaa52c93f31447ad2c6abc048c63e475";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/time";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/time";
-      rev =  "9d24e82272b4f38b78bc8cff74fa936d31ccd8ef";
-      sha256 = "1f5nkr4vys2vbd8wrwyiq2f5wcaahhpxmia85d1gshcbqjqf8dkb";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev =  "be0da057c5e3c2df569a2c25cd280149b7d7e7d0";
-      sha256 = "19i9sjvbk79sgzyzjzrnmf575rnwj2bjsj4r1fmp7827dq97kqks";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/api";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/google-api-go-client";
-      rev =  "feb0267beb8644f5088a03be4d5ec3f8c7020152";
-      sha256 = "1lzdzkd2i41v6amxs9jah1q44qbvf1yvm8906jpfjiq6c3ffhqss";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev =  "5f2a59506353b8d5ba8cbbcd9f3c1f41f1eaf079";
-      sha256 = "1gwcwh8w5b1l15pjm8pqs3bbymvjcak3wva37zi5z9ilzr8c5wnx";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/genproto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-genproto";
-      rev =  "24fa4b261c55da65468f2abfdae2b024eef27dfb";
-      sha256 = "109zhaqlfd8zkbr1hk6zqbs6vcxfrk64scjwh2nswph05gr0m84d";
-    };
-  }
-  {
-    goPackagePath  = "google.golang.org/grpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc/grpc-go";
-      rev =  "6eaf6f47437a6b4e2153a190160ef39a92c7eceb";
-      sha256 = "1cn33r2gclmq2v1ndpf1n5bmhf2qs8mms7ii5cnl6f9ch4r2c4k3";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/inf.v0";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-inf/inf";
-      rev =  "d2d2541c53f18d2a059457998ce2876cc8e67cbf";
-      sha256 = "00k5iqjcp371fllqxncv7jkf80hn1zww92zm78cclbcn4ybigkng";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/ini.v1";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-ini/ini";
-      rev =  "d4cae42d398bc0095297fc3315669590d29166ea";
-      sha256 = "1z7531wz62305hwg9y2f04d819am8x3ys96ssy6qndlzmw60yjsr";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/jcmturner/aescts.v1";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jcmturner/aescts";
-      rev =  "f6abebb3171c4c1b1fea279cb7c7325020a26290";
-      sha256 = "0rbq4zf3db48xa2gqdp2swws7wizmbwagigqkr1zxzd1ramps6rv";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/jcmturner/dnsutils.v1";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jcmturner/dnsutils";
-      rev =  "13eeb8d49ffb74d7a75784c35e4d900607a3943c";
-      sha256 = "0l543c64pyzbnrc00jspg21672l3a0kjjw9pbdxwna93w8d8m927";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/jcmturner/gokrb5.v5";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jcmturner/gokrb5";
-      rev =  "32ba44ca5b42f17a4a9f33ff4305e70665a1bc0f";
-      sha256 = "0jynpkncifdd2ib2pc9qhh0r8q7ab7yw0ygzpzgisdzv8ars1diq";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/jcmturner/rpc.v0";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jcmturner/rpc";
-      rev =  "4480c480c9cd343b54b0acb5b62261cbd33d7adf";
-      sha256 = "0hivgq52gwxsqs5x1my2047k7nqh7wx3yi0llsj3lc3h2mjy4yhd";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/src-d/go-billy.v4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/src-d/go-billy";
-      rev =  "780403cfc1bc95ff4d07e7b26db40a6186c5326e";
-      sha256 = "0jcyi4ink2njgflp3f2mbl5b86p2w0rh945k5xplcl158i5wkrc6";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/src-d/go-git.v4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/src-d/go-git";
-      rev =  "0d1a009cbb604db18be960db5f1525b99a55d727";
-      sha256 = "0n4x7r69qrmpss51b3wd3vj4b9jmip4archz3fbqk6q1yyd1pxjb";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/warnings.v0";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-warnings/warnings";
-      rev =  "ec4a0fea49c7b46c2aeb0b51aac55779c607e52b";
-      sha256 = "1kzj50jn708cingn7a13c2wdlzs6qv89dr2h4zj8d09647vlnd81";
-    };
-  }
-  {
-    goPackagePath  = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-yaml/yaml";
-      rev =  "51d6538a90f86fe93ac480b35f37b2be17fef232";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/api";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/api";
-      rev =  "e3a6b8045b0b303430f6d0c261fd9e35be50800e";
-      sha256 = "1c1nrcy0j7aj93l2xgdw0asyvxa4h8pzz004drf7pvh9pvsg0vqq";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/apimachinery";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/apimachinery";
-      rev =  "8f6ac2502e5143406f4eaedc4ca4262854d877ce";
-      sha256 = "0v8cb63nvry4b0ls1h185hb3llp6rk0b4n92f76jcjsv1b7sspbi";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/client-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/client-go";
-      rev =  "6d55c1b1f1ca8ad83d572bbc3ca55ba5526d9d71";
-      sha256 = "1j8m0pqn9c6lwr7h5aq7zrpdd73bwbwnhy4mbc0654ylmc3lnq8q";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/code-generator";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/code-generator";
-      rev =  "6c2a4329ac290d921e8616cad41635c87dbb1518";
-      sha256 = "18kx2wcqb5cvivbl61q7vyic5rp0fica9n6xgrjfsxczjbihlq70";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/gengo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/gengo";
-      rev =  "a874a240740c2ae854082ec73d46c5efcedd2149";
-      sha256 = "0z8gay4bj6l8cv7gzi55l2c3jx94caq28sk0x6p3s6wxqxmnqp92";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/klog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/klog";
-      rev =  "3ca30a56d8a775276f9cdae009ba326fdc05af7f";
-      sha256 = "0a7kn145q4cbsd2cfpv7sz09prjrxl6aaqzdcgq7p7jxc23a7zps";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/kube-openapi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/kube-openapi";
-      rev =  "5e22f3d471e6f24ca20becfdffdc6206c7cecac8";
-      sha256 = "08drikf269fhlnrhc29v7rhxl1950d94rl5x8l11n0qf2v2ffwib";
-    };
-  }
-  {
-    goPackagePath  = "k8s.io/utils";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes/utils";
-      rev =  "3a4a5477acf81b48e20870a3b9dc743f63c66730";
-      sha256 = "1f01ck7nvm9rmw1fkylbnr1cdd9byiagl9ni40j9p9gfy5v5nxk8";
-    };
-  }
-  {
-    goPackagePath  = "sigs.k8s.io/yaml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kubernetes-sigs/yaml";
-      rev =  "fd68e9863619f6ec2fdd8625fe1f02e7c877e480";
-      sha256 = "1p7hvjdr5jsyk7nys1g1pmgnf3ys6n320i6hds85afppk81k01kb";
-    };
-  }
-  {
-    goPackagePath  = "upper.io/db.v3";
-    fetch = {
-      type = "git";
-      url = "https://upper.io/db.v3";
-      rev =  "fad80cdab4f761cb26416675df120f5d8c3f0db7";
-      sha256 = "1bddpi278bzp39470llrgnsnnfyqqmzym5hmd8dxmczmzhhkirfv";
-    };
-  }
-]
--- a/pkgs/applications/networking/cluster/click/default.nix
+++ b/pkgs/applications/networking/cluster/click/default.nix
@ -13,10 +13,7 @@ buildRustPackage rec {
    sha256 = "18mpzvvww2g6y2d3m8wcfajzdshagihn59k03xvcknd5d8zxagl3";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "0298x7wkr4j1l5flmv5vhl1ay8icvh4dlhsh4xi8fd3p8jl9jpqv";
+  cargoSha256 = "1f9yn4pvp58laylngdrfdkwygisnzkhkm7pndf6l33k3aqxhz5mm";

  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];

--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -2,8 +2,8 @@

 buildGoModule rec {
  pname = "kube3d";
-  version = "1.3.1";
-  k3sVersion = "0.9.1";
+  version = "1.6.0";
+  k3sVersion = "1.17.3+k3s1";

  goPackagePath = "github.com/rancher/k3d";

@ -11,7 +11,7 @@ buildGoModule rec {
    owner  = "rancher";
    repo   = "k3d";
    rev    = "v${version}";
-    sha256 = "0bdpjnzyxd6mdc1qv0ml89qds6305kn3wmyci2kv6g2y7r7wxvm2";
+    sha256 = "0qjwqqynvgzainq66fpzczgynwk3hv7wzgfy5271fc6mj2k0zz5x";
  };

  buildFlagsArray = ''
@ -21,13 +21,13 @@ buildGoModule rec {
      -X github.com/rancher/k3d/version.K3sVersion=v${k3sVersion}
  '';

-  modSha256 = "1qadf3gc2626l4jpad4lzi649nh8if9m6fgs2cf46r1nish16h95";
+  modSha256 = "0c8bfl0hz5cfhi6jzhhylz051jiix6s7s20fn23w7wri4xaqrjn8";

  meta = with stdenv.lib; {
    homepage = "https://github.com/rancher/k3d";
    description = "A helper to run k3s (Lightweight Kubernetes. 5 less than k8s) in a docker container";
    license = licenses.mit;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ kuznero jlesquembre ];
+    maintainers = with maintainers; [ kuznero jlesquembre ngerstle ];
  };
 }
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.9.8";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "1d3m13pl30w8d7pxjdhspxprk2jm8cm25rc5s867z4a37c5igv7y";
+    sha256 = "14ahb02p1gqcqbjz6mn3axw436b6bi4ygq5ckm85jzs28s4wrfsv";
  };

  modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";
--- a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
@ -19,7 +19,7 @@

 buildGoPackage rec {
  pname = "terraform-provider-libvirt";
-  version = "0.5.1";
+  version = "0.6.1";

  goPackagePath = "github.com/dmacvicar/terraform-provider-libvirt";

@ -27,7 +27,7 @@ buildGoPackage rec {
    owner = "dmacvicar";
    repo = "terraform-provider-libvirt";
    rev = "v${version}";
-    sha256 = "0shnj5byqj3qzyqniiy1dcygd8xw1h2bx9z6mgcydw8k64fkm4bw";
+    sha256 = "1l2n97nj6g44n7bhnbjwmv36xi6754p4iq2qnpkdh39x4384a0zz";
  };

  buildInputs = [ libvirt pkgconfig makeWrapper ];
--- a/pkgs/applications/networking/errbot/default.nix
+++ b/pkgs/applications/networking/errbot/default.nix
@ -1,9 +1,9 @@
 { lib, fetchFromGitHub, python, glibcLocales }:

 let
-  # errbot requires markdown<3, and is not compatible with it either.
  py = python.override {
    packageOverrides = self: super: {
+      # errbot requires markdown<3, and is not compatible with it either.
      markdown = super.markdown.overridePythonAttrs (oldAttrs: rec {
        version = "2.6.11";
        src = super.fetchPypi {
@ -12,6 +12,28 @@ let
          sha256 = "108g80ryzykh8bj0i7jfp71510wrcixdi771lf2asyghgyf8cmm8";
        };
      });
+
+      # errbot requires slackclient 1.x, see https://github.com/errbotio/errbot/pull/1367
+      # latest 1.x release would be 1.3.2, but it requires an older websocket_client than the one in nixpkgs
+      # so let's just vendor the known-working version until they've migrated to 2.x.
+      slackclient = super.slackclient.overridePythonAttrs (oldAttrs: rec {
+        version = "1.2.1";
+        pname = "slackclient";
+        src = fetchFromGitHub {
+          owner  = "slackapi";
+          repo   = "python-slackclient";
+          rev    = version;
+          sha256 = "073fwf6fm2sqdp5ms3vm1v3ljh0pldi69k048404rp6iy3cfwkp0";
+        };
+
+        propagatedBuildInputs = with self; [ websocket_client requests six ];
+
+        checkInputs = with self; [ pytest codecov coverage mock pytestcov pytest-mock responses flake8 ];
+        # test_server.py fails because it needs connection (I think);
+        checkPhase = ''
+          py.test --cov-report= --cov=slackclient tests --ignore=tests/test_server.py
+        '';
+      });
    };
  };

@ -48,6 +70,7 @@ py.pkgs.buildPythonApplication rec {
    homepage = http://errbot.io/;
    maintainers = with maintainers; [ fpletz globin ];
    license = licenses.gpl3;
-    platforms = platforms.unix;
+    platforms = platforms.linux;
+    # flaky on darwin, "RuntimeError: can't start new thread"
  };
 }
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@ -12,10 +12,7 @@ rustPlatform.buildRustPackage rec {
    sha256 = "1bg2qjkzdawn4fnn0w7jhw1dk6191w8axnqra43z21pinfyim6da";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "0q0iqd8y9rph8pwild5i2kv00h217a166c88hxpmbrigq9w960lp";
+  cargoSha256 = "0q7bira2adfmx0ghb1c5nqz200iajaxap9bq8j5wvvk9l2wywslp";

  postPatch = ''
    substituteInPlace Makefile --replace "|| true" ""
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "FlexGet";
-  version = "3.1.26";
+  version = "3.1.30";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "0bd8ccc9ae8e9fd9d5aa4f61a1a5d8b62ff30257fc0f5b2ec61b2f4b26275eee";
+    sha256 = "453992c6bf8a7b0f83abeddd0e8f989dc10fd59e407e3803b886072cff2576a7";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@ -2,7 +2,7 @@
  "name": "riot-web",
  "productName": "Riot",
  "main": "src/electron-main.js",
-  "version": "1.5.9",
+  "version": "1.5.10",
  "description": "A feature-rich client for Matrix.org",
  "author": "New Vector Ltd.",
  "dependencies": {
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@ -6,12 +6,12 @@

 let
  executableName = "riot-desktop";
-  version = "1.5.9";
+  version = "1.5.10";
  riot-web-src = fetchFromGitHub {
    owner = "vector-im";
    repo = "riot-web";
    rev = "v${version}";
-    sha256 = "13bskp8nj1h44y7x4dibnfa8sdnzl744x4xckcw5lxnlkccfr69m";
+    sha256 = "0yr5f3i24qh9b8hjfalpqxwr0qhs7hax450g83vf06skap1l5i5j";
  };

 in mkYarnPackage rec {
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -2,8 +2,9 @@
 , fetchFromGitHub
 # Dynamic libraries
 , dbus, glib, libGL, libX11, libXfixes, libuuid, libxcb, qtbase, qtdeclarative
-, qtimageformats, qtlocation, qtquickcontrols, qtquickcontrols2, qtscript, qtsvg
-, qttools, qtwayland, qtwebchannel, qtwebengine
+, qtgraphicaleffects, qtimageformats, qtlocation, qtquickcontrols
+, qtquickcontrols2, qtscript, qtsvg , qttools, qtwayland, qtwebchannel
+, qtwebengine
 # Runtime
 , coreutils, libjpeg_turbo, pciutils, procps, utillinux
 , pulseaudioSupport ? true, libpulseaudio ? null
@ -14,11 +15,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "3.5.359539.0224";
+  version = "3.5.361976.0301";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "1n6rcsl86150y2dzkcgy5rzdij0d6ib3nvg4dz4a4dkyhq5hbla2";
+      sha256 = "12pqs4pk73d7y9b49vq6f4fryph27k45zm1rjrpijnbi6ln2w993";
    };
  };

@ -39,9 +40,9 @@ in mkDerivation {
  nativeBuildInputs = [ autoPatchelfHook ];

  buildInputs = [
-    dbus glib libGL libX11 libXfixes libuuid libxcb libjpeg_turbo
-    qtbase qtdeclarative qtlocation qtquickcontrols qtquickcontrols2 qtscript
-    qtwebchannel qtwebengine qtimageformats qtsvg qttools qtwayland
+    dbus glib libGL libX11 libXfixes libuuid libxcb libjpeg_turbo qtbase
+    qtdeclarative qtgraphicaleffects qtlocation qtquickcontrols qtquickcontrols2
+    qtscript qtwebchannel qtwebengine qtimageformats qtsvg qttools qtwayland
  ];

  runtimeDependencies = optional pulseaudioSupport libpulseaudio;
--- a/pkgs/applications/networking/irc/tiny/default.nix
+++ b/pkgs/applications/networking/irc/tiny/default.nix
@ -19,10 +19,7 @@ rustPlatform.buildRustPackage rec {
    sha256 = "1m57xsrc7lzkrm8k1wh3yx3in5bhd0qjzygxdwr8lvigpsiy5caa";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "1vj6whnx8gd5r66zric9163ddlqc4al4azj0dvhv5sq0r33871kv";
+  cargoSha256 = "1s93zxk85wa7zw8745ba1sgipal75w1y18nc9vca6sig4pzvvj41";

  RUSTC_BOOTSTRAP = 1;

--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -17,13 +17,13 @@

 mkDerivation rec {
  pname = "nextcloud-client";
-  version = "2.6.3";
+  version = "2.6.4";

  src = fetchFromGitHub {
    owner = "nextcloud";
    repo = "desktop";
    rev = "v${version}";
-    sha256 = "17w1bx305w656jkiv55lwncxwdly8rf2dsisqw3c9bc7vz19l6p8";
+    sha256 = "1wr57qwcjfzbpb4p0ybfjpw2hhwp91yrk2n3ywrqywcvjj38jg1q";
  };

  patches = [
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@ -5,7 +5,7 @@

 let
  sha256 = {
-    x86_64-linux = "0az7n4lhmd4pz0spjvyiwd4w1gnqbh8f1fvr1jinsssyq0j26ldj";
+    x86_64-linux = "1ry21zw5ghba4xjx8dvimlpprgap7n8j9lqhjsciahbvc16vx5ks";
    i386-linux   = "0vjxbg5hwkqkh600rr75xviwy848r1xw9mxwf6bb6l8b0isvlsgg";
  }.${stdenv.hostPlatform.system} or (throw "system ${stdenv.hostPlatform.system} not supported");

@ -28,7 +28,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "anydesk";
-  version = "5.5.2";
+  version = "5.5.4";

  src = fetchurl {
    urls = [
@ -81,7 +81,7 @@ in stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    inherit description;
-    homepage = https://www.anydesk.com;
+    homepage = "https://www.anydesk.com";
    license = licenses.unfree;
    platforms = platforms.linux;
    maintainers = with maintainers; [ shyim ];
--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, meson, pkg-config, ninja
+, pixman, libuv, libGL, libxkbcommon, wayland, neatvnc, libdrm, libX11
+}:
+
+stdenv.mkDerivation rec {
+  pname = "wayvnc";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "any1";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "17c30c33zzhhlqzc4a5dd1y74ch7c8gsm98wvcn4n1fv50fbmpbd";
+  };
+
+  nativeBuildInputs = [ meson pkg-config ninja ];
+  buildInputs = [ pixman libuv libGL libxkbcommon wayland neatvnc libdrm libX11 ];
+
+  meta = with stdenv.lib; {
+    description = "A VNC server for wlroots based Wayland compositors";
+    longDescription = ''
+      This is a VNC server for wlroots based Wayland compositors. It attaches
+      to a running Wayland session, creates virtual input devices and exposes a
+      single display via the RFB protocol. The Wayland session may be a
+      headless one, so it is also possible to run wayvnc without a physical
+      display attached.
+    '';
+    inherit (src.meta) homepage;
+    license = licenses.isc;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
--- a/pkgs/applications/office/aesop/default.nix
+++ b/pkgs/applications/office/aesop/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "aesop";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "lainsce";
    repo = pname;
    rev = version;
-    sha256 = "1aa1kp1rndi2dj1d9sf8zhssn5dw183yx1fm2xccdy9zjf9wi4jk";
+    sha256 = "1bqykr1mwanfm55w1v9ipqcqgzj8kbjvlm4d5b2swvhng77gnf3d";
  };

  nativeBuildInputs = [
@ -45,7 +45,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "The simplest PDF viewer around";
-    homepage = https://github.com/lainsce/aesop;
+    homepage = "https://github.com/lainsce/aesop";
    license = licenses.gpl2Plus;
    maintainers = pantheon.maintainers;
    platforms = platforms.linux;
--- a/pkgs/applications/radio/pyradio/default.nix
+++ b/pkgs/applications/radio/pyradio/default.nix
@ -0,0 +1,24 @@
+{ lib, python3Packages, fetchFromGitHub }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pyradio";
+  version = "0.8.7.1";
+
+  src = fetchFromGitHub {
+    owner = "coderholic";
+    repo = pname;
+    rev = version;
+    sha256 = "1f1dch5vrx2armrff19rh9gpqydspn3nvzc9p9j2jfi6gsxhppyb";
+  };
+
+  checkPhase = ''
+    $out/bin/pyradio --help
+  '';
+
+  meta = with lib; {
+    homepage = "http://www.coderholic.com/pyradio/";
+    description = "Curses based internet radio player";
+    license = licenses.mit;
+    maintainers = with maintainers; [ contrun ];
+  };
+}
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "picard-tools";
-  version = "2.21.8";
+  version = "2.22.0";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0wxacfyxqvd39mzmwkwz39g4mf0ig1zcgymwbhsnhmn9j60mdmrf";
+    sha256 = "1qgg8r81xn2z965v78kfj05vycrd2cz48gxk5csr6kvwk3ba286c";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "Tools for high-throughput sequencing (HTS) data and formats such as SAM/BAM/CRAM and VCF";
    license = licenses.mit;
-    homepage = https://broadinstitute.github.io/picard/;
+    homepage = "https://broadinstitute.github.io/picard/";
    maintainers = with maintainers; [ jbedo ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/science/biology/truvari/default.nix
+++ b/pkgs/applications/science/biology/truvari/default.nix
@ -5,13 +5,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "truvari";
-  version = "1.3.2";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "spiralgenetics";
    repo = "truvari";
    rev = "v${version}";
-    sha256 = "0wmjz8nzibvj0ixky1m0qi7iyd204prk7glbvig1cvaab33k19f1";
+    sha256 = "1bph7v48s7pyfagz8a2fzl5fycjliqzn5lcbv3m2bp2ih1f1gd1v";
  };

  propagatedBuildInputs = with python3Packages; [
@ -25,8 +25,9 @@ python3Packages.buildPythonApplication rec {

  prePatch = ''
    substituteInPlace ./setup.py \
-      --replace '"progressbar2==3.41.0",' "" \
-      --replace '"pysam==0.15.2",' ""
+      --replace '"progressbar2==3.41.0",' '"progressbar2==3.47.0",' \
+      --replace '"pysam==0.15.2",' '"pysam==0.15.4",' \
+      --replace '"pyfaidx==0.5.5.2",' '"pyfaidx==0.5.8",'
  '';

  meta = with lib; {
--- a/pkgs/applications/science/chemistry/marvin/default.nix
+++ b/pkgs/applications/science/chemistry/marvin/default.nix
@ -4,12 +4,12 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "marvin";
-  version = "20.4.0";
+  version = "20.6.0";

  src = fetchurl {
    name = "marvin-${version}.deb";
    url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "12kygxq24in7hbp7shkx1baqig8rwmzvv0d3kc3ld9sj9hb0a2n1";
+    sha256 = "1vd1hsj36wzghpn6xnppjmva35kdcin7h0xdj3xmi4w5l3qw7fl6";
  };

  nativeBuildInputs = [ dpkg makeWrapper ];
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "octopus";
-  version = "9.1";
+  version = "9.2";

  src = fetchFromGitLab {
    owner = "octopus-code";
    repo = "octopus";
    rev = version;
-    sha256 = "1l5fqgllk7rij16q7a3la7qq6isy8a5n37vk400qcscw1v32s90h";
+    sha256 = "083z51sjv70asr04rv53wb9gf4396nblq1zl22qw7jdr28hji4is";
  };

  nativeBuildInputs = [ perl procps autoreconfHook ];
--- a/pkgs/applications/science/chemistry/quantum-espresso/default.nix
+++ b/pkgs/applications/science/chemistry/quantum-espresso/default.nix
@ -4,12 +4,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "6.4.1";
+  version = "6.5";
  pname = "quantum-espresso";

  src = fetchurl {
    url = "https://gitlab.com/QEF/q-e/-/archive/qe-${version}/q-e-qe-${version}.tar.gz";
-    sha256 = "027skhp2zzx0f4mh6azqjljdimchak5cdn13v4x7aj5q2zvfkmxh";
+    sha256 = "00nnsq1vq579xsmkvwrgs6bdqdcbdlsmcp4yfynnvs40ca52m2r5";
  };

  passthru = {
@ -35,7 +35,7 @@ configureFlags = if (mpi != null) then [ "LD=${mpi}/bin/mpif90" ] else [ "LD=${g
        nanoscale. It is based on density-functional theory, plane waves, and
        pseudopotentials.
      '';
-    homepage = https://www.quantum-espresso.org/;
+    homepage = "https://www.quantum-espresso.org/";
    license = licenses.gpl2;
    platforms = [ "x86_64-linux" ];
    maintainers = [ maintainers.costrouc ];
--- a/pkgs/applications/science/electronics/fped/default.nix
+++ b/pkgs/applications/science/electronics/fped/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation {
  makeFlags = [
    "PREFIX=${placeholder "out"}"
    "LEX=flex"
-    "RGBDEF=${netpbm}/share/netpbm/misc/rgb.txt"
+    "RGBDEF=${netpbm.out}/share/netpbm/misc/rgb.txt"
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.6.0";
+  version = "3.6.1";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
    repo   = "lean";
    rev    = "v${version}";
-    sha256 = "1filkhyqcjglbavbkjra0nk3y7hw8993wyl7r87ikydb2bjishsc";
+    sha256 = "0crcpzbz75mdyi1vi4mygw3mj4lx73vff58fkic1gfxlpwrwgi20";
  };

  nativeBuildInputs = [ cmake ];
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Automatic and interactive theorem prover";
-    homepage    = https://leanprover.github.io/;
+    homepage    = "https://leanprover.github.io/";
    license     = licenses.asl20;
    platforms   = platforms.unix;
    maintainers = with maintainers; [ thoughtpolice gebner ];
--- a/Show More
+++ b/Show More