Merge branch 'master' into staging-next

2020-04-16 10:09:43 +02:00 · 2020-04-16 10:09:43 +02:00 · 3d8e436917
commit 3d8e436917
parent a04625379a 342eaba9eb
277 changed files with 8102 additions and 4662 deletions
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@ -25,6 +25,12 @@ If applicable, add screenshots to help explain your problem.
 **Additional context**
 Add any other context about the problem here.

+**Notify maintainers**
+<!--
+Please @ people who are in the `meta.maintainers` list of the offending package or module.
+If in doubt, check `git blame` for whoever last touched something.
+-->
+
 **Metadata**
 Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.

--- a/.gitignore
+++ b/.gitignore
@ -16,3 +16,6 @@ result-*
 /pkgs/development/libraries/qt-5/*/tmp/
 /pkgs/desktops/kde-5/*/tmp/
 /pkgs/development/mobile/androidenv/xml/*
+
+# generated by pkgs/common-updater/update-script.nix
+update-git-commits.txt
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@ -1295,7 +1295,7 @@ installTargets = "install-bin install-doc";</programlisting>
     </term>
     <listitem>
      <para>
-       List of directories to search for libraries and executables from which only debugging-related symbols should be stripped. It defaults to <literal>lib bin sbin</literal>.
+       List of directories to search for libraries and executables from which only debugging-related symbols should be stripped. It defaults to <literal>lib lib32 lib64 libexec bin sbin</literal>.
      </para>
     </listitem>
    </varlistentry>
--- a/lib/options.nix
+++ b/lib/options.nix
@ -191,7 +191,14 @@ rec {

     Example:
       (showOption ["foo" "bar" "baz"]) == "foo.bar.baz"
-       (showOption ["foo" "bar.baz" "tux"]) == "foo.\"bar.baz\".tux"
+       (showOption ["foo" "bar.baz" "tux"]) == "foo.bar.baz.tux"
+
+     Placeholders will not be quoted as they are not actual values:
+       (showOption ["foo" "*" "bar"]) == "foo.*.bar"
+       (showOption ["foo" "<name>" "bar"]) == "foo.<name>.bar"
+
+     Unlike attributes, options can also start with numbers:
+       (showOption ["windowManager" "2bwm" "enable"]) == "windowManager.2bwm.enable"
  */
  showOption = parts: let
    escapeOptionPart = part:
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -315,6 +315,21 @@ rec {
  */
  escapeNixString = s: escape ["$"] (builtins.toJSON s);

+  /* Quotes a string if it can't be used as an identifier directly.
+
+     Type: string -> string
+
+     Example:
+       escapeNixIdentifier "hello"
+       => "hello"
+       escapeNixIdentifier "0abc"
+       => "\"0abc\""
+  */
+  escapeNixIdentifier = s:
+    # Regex from https://github.com/NixOS/nix/blob/d048577909e383439c2549e849c5c2f2016c997e/src/libexpr/lexer.l#L91
+    if builtins.match "[a-zA-Z_][a-zA-Z0-9_'-]*" s != null
+    then s else escapeNixString s;
+
  # Obsolete - use replaceStrings instead.
  replaceChars = builtins.replaceStrings or (
    del: new: s:
--- a/lib/tests/maintainers.nix
+++ b/lib/tests/maintainers.nix
@ -0,0 +1,75 @@
+# to run these tests:
+# nix-build nixpkgs/lib/tests/maintainers.nix
+# If nothing is output, all tests passed
+{ pkgs ? import ../.. {} }:
+
+let
+  inherit (pkgs) lib;
+  inherit (lib) types;
+
+  maintainerModule = { config, ... }: {
+    options = {
+      name = lib.mkOption {
+        type = types.str;
+      };
+      email = lib.mkOption {
+        type = types.str;
+      };
+      github = lib.mkOption {
+        type = types.nullOr types.str;
+        default = null;
+      };
+      githubId = lib.mkOption {
+        type = types.nullOr types.ints.unsigned;
+        default = null;
+      };
+      keys = lib.mkOption {
+        type = types.listOf (types.submodule {
+          options.longkeyid = lib.mkOption { type = types.str; };
+          options.fingerprint = lib.mkOption { type = types.str; };
+        });
+        default = [];
+      };
+    };
+  };
+
+  checkMaintainer = handle: uncheckedAttrs:
+  let
+      prefix = [ "lib" "maintainers" handle ];
+      checkedAttrs = (lib.modules.evalModules {
+        inherit prefix;
+        modules = [
+          maintainerModule
+          {
+            _file = toString ../../maintainers/maintainer-list.nix;
+            config = uncheckedAttrs;
+          }
+        ];
+      }).config;
+
+      checkGithubId = lib.optional (checkedAttrs.github != null && checkedAttrs.githubId == null) ''
+        echo ${lib.escapeShellArg (lib.showOption prefix)}': If `github` is specified, `githubId` must be too.'
+        # Calling this too often would hit non-authenticated API limits, but this
+        # shouldn't happen since such errors will get fixed rather quickly
+        info=$(curl -sS https://api.github.com/users/${checkedAttrs.github})
+        id=$(jq -r '.id' <<< "$info")
+        echo "The GitHub ID for GitHub user ${checkedAttrs.github} is $id:"
+        echo -e "    githubId = $id;\n"
+      '';
+    in lib.deepSeq checkedAttrs checkGithubId;
+
+  missingGithubIds = lib.concatLists (lib.mapAttrsToList checkMaintainer lib.maintainers);
+
+  success = pkgs.runCommandNoCC "checked-maintainers-success" {} ">$out";
+
+  failure = pkgs.runCommandNoCC "checked-maintainers-failure" {
+    nativeBuildInputs = [ pkgs.curl pkgs.jq ];
+    outputHash = "sha256:${lib.fakeSha256}";
+    outputHAlgo = "sha256";
+    outputHashMode = "flat";
+    SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+  } ''
+    ${lib.concatStringsSep "\n" missingGithubIds}
+    exit 1
+  '';
+in if missingGithubIds == [] then success else failure
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -3,7 +3,10 @@
 # This script is used to test that the module system is working as expected.
 # By default it test the version of nixpkgs which is defined in the NIX_PATH.

-cd ./modules
+# https://stackoverflow.com/a/246128/6605742
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+
+cd "$DIR"/modules

 pass=0
 fail=0
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@ -1,7 +1,7 @@
-{ pkgs ? import ((import ../.).cleanSource ../..) {} }:
+{ pkgs ? import ../.. {} }:

 pkgs.runCommandNoCC "nixpkgs-lib-tests" {
-  buildInputs = [ pkgs.nix (import ./check-eval.nix) ];
+  buildInputs = [ pkgs.nix (import ./check-eval.nix) (import ./maintainers.nix { inherit pkgs; }) ];
  NIX_PATH = "nixpkgs=${toString pkgs.path}";
 } ''
    datadir="${pkgs.nix}/share"
@ -17,8 +17,8 @@ pkgs.runCommandNoCC "nixpkgs-lib-tests" {
    cacheDir=$TEST_ROOT/binary-cache
    nix-store --init

-    cd ${pkgs.path}/lib/tests
-    bash ./modules.sh
+    cp -r ${../.} lib
+    bash lib/tests/modules.sh

    touch $out
 ''
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -100,6 +100,7 @@
  abbradar = {
    email = "ab@fmap.me";
    github = "abbradar";
+    githubId = 1174810;
    name = "Nikolay Amiantov";
  };
  abhi18av = {
@ -135,6 +136,7 @@
  acairncross = {
    email = "acairncross@gmail.com";
    github = "acairncross";
+    githubId = 1517066;
    name = "Aiken Cairncross";
  };
  acowley = {
@ -146,6 +148,7 @@
  adamt = {
    email = "mail@adamtulinius.dk";
    github = "adamtulinius";
+    githubId = 749381;
    name = "Adam Tulinius";
  };
  adelbertc = {
@ -229,6 +232,7 @@
  aforemny = {
    email = "alexanderforemny@googlemail.com";
    github = "aforemny";
+    githubId = 610962;
    name = "Alexander Foremny";
  };
  afranchuk = {
@ -276,6 +280,7 @@
  ak = {
    email = "ak@formalprivacy.com";
    github = "alexanderkjeldaas";
+    githubId = 339369;
    name = "Alexander Kjeldaas";
  };
  akavel = {
@ -383,6 +388,7 @@
  alunduil = {
    email = "alunduil@gmail.com";
    github = "alunduil";
+    githubId = 169249;
    name = "Alex Brandt";
  };
  alva = {
@ -404,6 +410,7 @@
  ambrop72 = {
    email = "ambrop7@gmail.com";
    github = "ambrop72";
+    githubId = 2626481;
    name = "Ambroz Bizjak";
  };
  amiddelk = {
@ -473,11 +480,13 @@
  andreabedini = {
    email = "andrea@kzn.io";
    github = "andreabedini";
+    githubId = 69135;
    name = "Andrea Bedini";
  };
  andres = {
    email = "ksnixos@andres-loeh.de";
    github = "kosmikus";
+    githubId = 293191;
    name = "Andres Loeh";
  };
  andrestylianos = {
@ -507,6 +516,7 @@
  andsild = {
    email = "andsild@gmail.com";
    github = "andsild";
+    githubId = 3808928;
    name = "Anders Sildnes";
  };
  aneeshusa = {
@ -560,6 +570,7 @@
  antono = {
    email = "self@antono.info";
    github = "antono";
+    githubId = 7622;
    name = "Antono Vasiljev";
  };
  antonxy = {
@ -742,7 +753,8 @@
  };
  auntie = {
    email = "auntieNeo@gmail.com";
-    github = "auntie";
+    github = "auntieNeo";
+    githubId = 574938;
    name = "Jonathan Glines";
  };
  avaq = {
@ -760,6 +772,7 @@
  averelld = {
    email = "averell+nixos@rxd4.com";
    github = "averelld";
+    githubId = 687218;
    name = "averelld";
  };
  avitex = {
@ -815,11 +828,13 @@
  backuitist = {
    email = "biethb@gmail.com";
    github = "backuitist";
+    githubId = 1017537;
    name = "Bruno Bieth";
  };
  badi = {
    email = "abdulwahidc@gmail.com";
    github = "badi";
+    githubId = 35324;
    name = "Badi' Abdul-Wahid";
  };
  balajisivaraman = {
@ -943,6 +958,7 @@
  berdario = {
    email = "berdario@gmail.com";
    github = "berdario";
+    githubId = 752835;
    name = "Dario Bertini";
  };
  bergey = {
@ -1024,6 +1040,7 @@
  bluescreen303 = {
    email = "mathijs@bluescreen303.nl";
    github = "bluescreen303";
+    githubId = 16330;
    name = "Mathijs Kwik";
  };
  bobakker = {
@ -1053,6 +1070,7 @@
  boothead = {
    email = "ben@perurbis.com";
    github = "boothead";
+    githubId = 87764;
    name = "Ben Ford";
  };
  borisbabic = {
@ -1473,6 +1491,7 @@
  coconnor = {
    email = "coreyoconnor@gmail.com";
    github = "coreyoconnor";
+    githubId = 34317;
    name = "Corey O'Connor";
  };
  codsl = {
@ -1566,6 +1585,7 @@
  cransom = {
    email = "cransom@hubns.net";
    github = "cransom";
+    githubId = 1957293;
    name = "Casey Ransom";
  };
  CrazedProgrammer = {
@ -1725,6 +1745,7 @@
  davidrusu = {
    email = "davidrusu.me@gmail.com";
    github = "davidrusu";
+    githubId = 1832378;
    name = "David Rusu";
  };
  davidtwco = {
@ -1818,6 +1839,7 @@
  DerGuteMoritz = {
    email = "moritz@twoticketsplease.de";
    github = "DerGuteMoritz";
+    githubId = 19733;
    name = "Moritz Heidkamp";
  };
  dermetfan = {
@ -1835,6 +1857,7 @@
  desiderius = {
    email = "didier@devroye.name";
    github = "desiderius";
+    githubId = 1311761;
    name = "Didier J. Devroye";
  };
  devhell = {
@ -1864,6 +1887,7 @@
  dgonyeo = {
    email = "derek@gonyeo.com";
    github = "dgonyeo";
+    githubId = 2439413;
    name = "Derek Gonyeo";
  };
  dhkl = {
@ -1983,6 +2007,7 @@
  doublec = {
    email = "chris.double@double.co.nz";
    github = "doublec";
+    githubId = 16599;
    name = "Chris Double";
  };
  dpaetzel = {
@ -2048,6 +2073,7 @@
  dxf = {
    email = "dingxiangfei2009@gmail.com";
    github = "dingxiangfei2009";
+    githubId = 6884440;
    name = "Ding Xiang Fei";
  };
  dysinger = {
@ -2113,6 +2139,7 @@
  edanaher = {
    email = "nixos@edanaher.net";
    github = "edanaher";
+    githubId = 984691;
    name = "Evan Danaher";
  };
  edef = {
@ -2262,6 +2289,7 @@
  emmanuelrosa = {
    email = "emmanuel_rosa@aol.com";
    github = "emmanuelrosa";
+    githubId = 13485450;
    name = "Emmanuel Rosa";
  };
  endgame = {
@ -2279,7 +2307,7 @@
  Enteee = {
    email = "nix@duckpond.ch";
    github = "Enteee";
-    githubid = 5493775;
+    githubId = 5493775;
    name = "Ente";
  };
  enzime = {
@ -2337,6 +2365,7 @@
  ericsagnes = {
    email = "eric.sagnes@gmail.com";
    github = "ericsagnes";
+    githubId = 367880;
    name = "Eric Sagnes";
  };
  ericson2314 = {
@ -2376,6 +2405,7 @@
  ertes = {
    email = "esz@posteo.de";
    github = "ertes";
+    githubId = 1855930;
    name = "Ertugrul Söylemez";
  };
  esclear = {
@ -2485,6 +2515,7 @@
  fare = {
    email = "fahree@gmail.com";
    github = "fare";
+    githubId = 8073;
    name = "Francois-Rene Rideau";
  };
  farlion = {
@ -2496,6 +2527,7 @@
  fdns = {
    email = "fdns02@gmail.com";
    github = "fdns";
+    githubId = 541748;
    name = "Felipe Espinoza";
  };
  ffinkdevs = {
@ -2622,6 +2654,7 @@
  fragamus = {
    email = "innovative.engineer@gmail.com";
    github = "fragamus";
+    githubId = 119691;
    name = "Michael Gough";
  };

@ -2640,11 +2673,13 @@
  freezeboy = {
    email = "freezeboy@users.noreply.github.com";
    github = "freezeboy";
+    githubId = 13279982;
    name = "freezeboy";
  };
  Fresheyeball = {
    email = "fresheyeball@gmail.com";
-    github = "fresheyeball";
+    github = "Fresheyeball";
+    githubId = 609279;
    name = "Isaac Shapira";
  };
  fridh = {
@ -2748,6 +2783,7 @@
  garbas = {
    email = "rok@garbas.si";
    github = "garbas";
+    githubId = 20208;
    name = "Rok Garbas";
  };
  garrison = {
@ -2759,6 +2795,7 @@
  gavin = {
    email = "gavin.rogers@holo.host";
    github = "gavinrogers";
+    githubId = 2430469;
    name = "Gavin Rogers";
  };
  gazally = {
@ -2906,6 +2943,7 @@
  gridaphobe = {
    email = "eric@seidel.io";
    github = "gridaphobe";
+    githubId = 201997;
    name = "Eric Seidel";
  };
  guibert = {
@ -3035,6 +3073,7 @@
    name = "Guanpeng Xu";
  };
  hexa = {
+    email = "hexa@darmstadt.ccc.de";
    github = "mweinelt";
    githubId = 131599;
    name = "Martin Weinelt";
@ -3053,6 +3092,7 @@
    email = "me@hkjn.me";
    name = "Henrik Jonsson";
    github = "hkjn";
+    githubId = 287215;
    keys = [{
      longkeyid = "rsa4096/0x03EFBF839A5FDC15";
      fingerprint = "D618 7A03 A40A 3D56 62F5  4B46 03EF BF83 9A5F DC15";
@ -3225,6 +3265,7 @@
    name = "Michele Catalano";
  };
  isgy = {
+    name = "isgy";
    email = "isgy@teiyg.com";
    github = "isgy";
    githubId = 13622947;
@ -3263,7 +3304,7 @@
    email = "ivar.scholten@protonmail.com";
    github = "IvarWithoutBones";
    githubId = 41924494;
-    Name = "Ivar";
+    name = "Ivar";
  };
  ivegotasthma = {
    email = "ivegotasthma@protonmail.com";
@ -3302,6 +3343,7 @@
  jasoncarr = {
    email = "jcarr250@gmail.com";
    github = "jasoncarr0";
+    githubId = 6874204;
    name = "Jason Carr";
  };
  j-keck = {
@ -3313,6 +3355,7 @@
  j03 = {
    email = "github@johannesloetzsch.de";
    github = "johannesloetzsch";
+    githubId = 175537;
    name = "Johannes Lötzsch";
  };
  jagajaga = {
@ -3439,7 +3482,8 @@
  };
  jeschli = {
    email = "jeschli@gmail.com";
-    github = "jeschli";
+    github = "Jeschli";
+    githubId = 10786794;
    name = "Markus Hihn";
  };
  jethro = {
@ -3451,6 +3495,7 @@
  jfb = {
    email = "james@yamtime.com";
    github = "tftio";
+    githubId = 143075;
    name = "James Felix Black";
  };
  jflanglois = {
@ -3510,6 +3555,7 @@
  jitwit = {
    email = "jrn@bluefarm.ca";
    github = "jitwit";
+    githubId = 51518420;
    name = "jitwit";
  };
  jlesquembre = {
@ -3551,6 +3597,7 @@
  joamaki = {
    email = "joamaki@gmail.com";
    github = "joamaki";
+    githubId = 1102396;
    name = "Jussi Maki";
  };
  joelburget = {
@ -3573,6 +3620,7 @@
    email = "admin@cryto.net";
    name = "Sven Slootweg";
    github = "joepie91";
+    githubId = 1663259;
  };
  joesalisbury = {
    email = "salisbury.joseph@gmail.com";
@ -3646,6 +3694,7 @@
  jonathanmarler = {
    email = "johnnymarler@gmail.com";
    github = "marler8997";
+    githubId = 304904;
    name = "Jonathan Marler";
  };
  jonathanreeve = {
@ -3751,6 +3800,7 @@
  juliendehos = {
    email = "dehos@lisic.univ-littoral.fr";
    github = "juliendehos";
+    githubId = 11947756;
    name = "Julien Dehos";
  };
  jumper149 = {
@ -3784,6 +3834,7 @@
  jyp = {
    email = "jeanphilippe.bernardy@gmail.com";
    github = "jyp";
+    githubId = 27747;
    name = "Jean-Philippe Bernardy";
  };
  jzellner = {
@ -3797,7 +3848,7 @@
    email = "KAction@disroot.org";
    github = "kaction";
    githubId = 44864956;
-    key = [{
+    keys = [{
      longkeyid = "ed25519/0x749FD4DFA2E94236";
      fingerprint = "3F87 0A7C A7B4 3731 2F13  6083 749F D4DF A2E9 4236";
    }];
@ -3833,6 +3884,7 @@
  kampfschlaefer = {
    email = "arnold@arnoldarts.de";
    github = "kampfschlaefer";
+    githubId = 3831860;
    name = "Arnold Krille";
  };
  karantan = {
@ -3990,6 +4042,7 @@
    email = "adrian@kummerlaender.eu";
    name = "Adrian Kummerlaender";
    github = "KnairdA";
+    githubId = 498373;
  };
  knedlsepp = {
    email = "josef.kemetmueller@gmail.com";
@ -4012,6 +4065,7 @@
  kolbycrouch = {
    email = "kjc.devel@gmail.com";
    github = "kolbycrouch";
+    githubId = 6346418;
    name = "Kolby Crouch";
  };
  konimex = {
@ -4023,6 +4077,7 @@
  koral = {
    email = "koral@mailoo.org";
    github = "k0ral";
+    githubId = 524268;
    name = "Koral";
  };
  kovirobi = {
@ -4064,7 +4119,7 @@
  kristian-brucaj = {
    email = "kbrucaj@gmail.com";
    github = "kristian-brucaj";
-    githubID = "8893110";
+    githubId = 8893110;
    name = "Kristian Brucaj";
  };
  kristoff3r = {
@ -4124,6 +4179,7 @@
  laikq = {
    email = "gwen@quasebarth.de";
    github = "laikq";
+    githubId = 55911173;
    name = "Gwendolyn Quasebarth";
  };
  lasandell = {
@ -4141,6 +4197,7 @@
  lassulus = {
    email = "lassulus@gmail.com";
    github = "Lassulus";
+    githubId = 621759;
    name = "Lassulus";
  };
  lattfein = {
@ -4195,6 +4252,7 @@
  lebastr = {
    email = "lebastr@gmail.com";
    github = "lebastr";
+    githubId = 887072;
    name = "Alexander Lebedev";
  };
  ledif = {
@ -4230,6 +4288,7 @@
  leonardoce = {
    email = "leonardo.cecchi@gmail.com";
    github = "leonardoce";
+    githubId = 1572058;
    name = "Leonardo Cecchi";
  };
  leshainc = {
@ -4393,6 +4452,7 @@
  lovek323 = {
    email = "jason@oconal.id.au";
    github = "lovek323";
+    githubId = 265084;
    name = "Jason O'Conal";
  };
  lovesegfault = {
@ -4432,6 +4492,7 @@
  ltavard = {
    email = "laure.tavard@univ-grenoble-alpes.fr";
    github = "ltavard";
+    githubId = 8555953;
    name = "Laure Tavard";
  };
  luc65r = {
@ -4495,6 +4556,7 @@
  lumi = {
    email = "lumi@pew.im";
    github = "lumi-me-not";
+    githubId = 26020062;
    name = "lumi";
  };
  luz = {
@ -4678,6 +4740,7 @@
  matthewbauer = {
    email = "mjbauer95@gmail.com";
    github = "matthewbauer";
+    githubId = 19036;
    name = "Matthew Bauer";
  };
  matthiasbeyer = {
@ -4695,6 +4758,7 @@
  matti-kariluoma = {
    email = "matti@kariluo.ma";
    github = "matti-kariluoma";
+    githubId = 279868;
    name = "Matti Kariluoma";
  };
  maurer = {
@ -4820,6 +4884,7 @@
  melsigl = {
    email = "melanie.bianca.sigl@gmail.com";
    github = "melsigl";
+    githubId = 15093162;
    name = "Melanie B. Sigl";
  };
  melkor333 = {
@ -4888,6 +4953,7 @@
  michaelpj = {
    email = "michaelpj@gmail.com";
    github = "michaelpj";
+    githubId = 1699466;
    name = "Michael Peyton Jones";
  };
  michalrus = {
@ -4899,6 +4965,7 @@
  michelk = {
    email = "michel@kuhlmanns.info";
    github = "michelk";
+    githubId = 1404919;
    name = "Michel Kuhlmann";
  };
  michojel = {
@ -4972,6 +5039,7 @@
  mirdhyn = {
    email = "mirdhyn@gmail.com";
    github = "mirdhyn";
+    githubId = 149558;
    name = "Merlin Gaillard";
  };
  mirrexagon = {
@ -5007,6 +5075,7 @@
  mkf = {
    email = "m@mikf.pl";
    github = "mkf";
+    githubId = 7753506;
    name = "Michał Krzysztof Feiler";
    keys = [{
      longkeyid = "rsa4096/0xE35C2D7C2C6AC724";
@ -5056,6 +5125,7 @@
  mmlb = {
    email = "manny@peekaboo.mmlb.icu";
    github = "mmlb";
+    githubId = 708570;
    name = "Manuel Mendez";
  };
  mnacamura = {
@ -5085,6 +5155,7 @@
  Mogria = {
    email = "m0gr14@gmail.com";
    github = "mogria";
+    githubId = 754512;
    name = "Mogria";
  };
  monsieurp = {
@ -5142,6 +5213,7 @@
  MP2E = {
    email = "MP2E@archlinux.us";
    github = "MP2E";
+    githubId = 167708;
    name = "Cray Elliott";
  };
  mpcsh = {
@ -5165,6 +5237,7 @@
  mpscholten = {
    email = "marc@mpscholten.de";
    github = "mpscholten";
+    githubId = 2072185;
    name = "Marc Scholten";
  };
  mpsyco = {
@ -5182,6 +5255,7 @@
  mredaelli = {
    email = "massimo@typish.io";
    github = "mredaelli";
+    githubId = 3073833;
    name = "Massimo Redaelli";
  };
  mrkkrp = {
@ -5228,6 +5302,12 @@
    githubId = 133448;
    name = "Mikołaj Siedlarek";
  };
+  msm = {
+    email = "msm@tailcall.net";
+    github = "msm-code";
+    githubId = 7026881;
+    name = "Jarosław Jedynak";
+  };
  mstarzyk = {
    email = "mstarzyk@gmail.com";
    github = "mstarzyk";
@ -5249,6 +5329,7 @@
  MtP = {
    email = "marko.nixos@poikonen.de";
    github = "MtP76";
+    githubId = 2176611;
    name = "Marko Poikonen";
  };
  mtreskin = {
@ -5314,6 +5395,7 @@
  nand0p = {
    email = "nando@hex7.com";
    github = "nand0p";
+    githubId = 1916245;
    name = "Fernando Jose Pando";
  };
  Nate-Devv = {
@ -5587,6 +5669,7 @@
  olynch = {
    email = "owen@olynch.me";
    github = "olynch";
+    githubId = 4728903;
    name = "Owen Lynch";
  };
  omnipotententity = {
@ -5610,6 +5693,7 @@
  orbitz = {
    email = "mmatalka@gmail.com";
    github = "orbitz";
+    githubId = 75299;
    name = "Malcolm Matalka";
  };
  orivej = {
@ -5636,6 +5720,16 @@
    githubId = 108072;
    name = "Slawomir Gonet";
  };
+  oxalica = {
+    email = "oxalicc@pm.me";
+    github = "oxalica";
+    githubId = 14816024;
+    name = "oxalica";
+    keys = [{
+      longkeyid = "rsa4096/0xCED392DE0C483D00";
+      fingerprint = "5CB0 E9E5 D5D5 71F5 7F54  0FEA CED3 92DE 0C48 3D00";
+    }];
+  };
  oxij = {
    email = "oxij@oxij.org";
    github = "oxij";
@ -5745,6 +5839,7 @@
  pcarrier = {
    email = "pc@rrier.ca";
    github = "pcarrier";
+    githubId = 8641;
    name = "Pierre Carrier";
  };
  periklis = {
@ -5890,6 +5985,7 @@
  plchldr = {
    email = "mail@oddco.de";
    github = "plchldr";
+    githubId = 11639001;
    name = "Jonas Beyer";
  };
  plcplc = {
@ -5913,6 +6009,7 @@
  pmeunier = {
    email = "pierre-etienne.meunier@inria.fr";
    github = "P-E-Meunier";
+    githubId = 17021304;
    name = "Pierre-Étienne Meunier";
  };
  pmiddend = {
@ -5942,6 +6039,7 @@
  polyrod = {
    email = "dc1mdp@gmail.com";
    github = "polyrod";
+    githubId = 24878306;
    name = "Maurizio Di Pietro";
  };
  pombeirp = {
@ -6121,11 +6219,13 @@
  raboof = {
    email = "arnout@bzzt.net";
    github = "raboof";
+    githubId = 131856;
    name = "Arnout Engelen";
  };
  rafaelgg = {
    email = "rafael.garcia.gallego@gmail.com";
    github = "rafaelgg";
+    githubId = 1016742;
    name = "Rafael García";
  };
  raquelgb = {
@ -6297,6 +6397,7 @@
  rickynils = {
    email = "rickynils@gmail.com";
    github = "rickynils";
+    githubId = 16779;
    name = "Rickard Nilsson";
  };
  rika = {
@ -6380,11 +6481,13 @@
  rob = {
    email = "rob.vermaas@gmail.com";
    github = "rbvermaa";
+    githubId = 353885;
    name = "Rob Vermaas";
  };
  robberer = {
    email = "robberer@freakmail.de";
    github = "robberer";
+    githubId = 6204883;
    name = "Longrin Wischnewski";
  };
  robbinch = {
@ -6504,6 +6607,7 @@
  rvolosatovs = {
    email = "rvolosatovs@riseup.net";
    github = "rvolosatovs";
+    githubId = 12877905;
    name = "Roman Volosatovs";
  };
  ryanartecona = {
@ -6515,6 +6619,7 @@
  ryansydnor = {
    email = "ryan.t.sydnor@gmail.com";
    github = "ryansydnor";
+    githubId = 1832096;
    name = "Ryan Sydnor";
  };
  ryantm = {
@ -6606,6 +6711,7 @@
  sander = {
    email = "s.vanderburg@tudelft.nl";
    github = "svanderburg";
+    githubId = 1153271;
    name = "Sander van der Burg";
  };
  sargon = {
@ -6641,6 +6747,7 @@
  scalavision = {
    email = "scalavision@gmail.com";
    github = "scalavision";
+    githubId = 3958212;
    name = "Tom Sorlie";
  };
  schmitthenner = {
@ -6650,8 +6757,10 @@
    name = "Fabian Schmitthenner";
  };
  schmittlauch = {
+    name = "Trolli Schmittlauch";
    email = "t.schmittlauch+nixos@orlives.de";
    github = "schmittlauch";
+    githubId = 1479555;
  };
  schneefux = {
    email = "schneefux+nixos_pkg@schneefux.xyz";
@ -6690,6 +6799,7 @@
  scubed2 = {
    email = "scubed2@gmail.com";
    github = "scubed2";
+    githubId = 7401858;
    name = "Sterling Stein";
  };
  sdier = {
@ -6749,7 +6859,7 @@
  servalcatty = {
    email = "servalcat@pm.me";
    github = "servalcatty";
-    githubid = 51969817;
+    githubId = 51969817;
    name = "Serval";
    keys = [{
      longkeyid = "rsa4096/0x4A2AAAA382F8294C";
@ -6795,6 +6905,7 @@
  shazow = {
    email = "andrey.petrov@shazow.net";
    github = "shazow";
+    githubId = 6292;
    name = "Andrey Petrov";
  };
  sheenobu = {
@ -6818,16 +6929,19 @@
  shlevy = {
    email = "shea@shealevy.com";
    github = "shlevy";
+    githubId = 487050;
    name = "Shea Levy";
  };
  shmish111 = {
    email = "shmish111@gmail.com";
    github = "shmish111";
+    githubId = 934267;
    name = "David Smith";
  };
  shnarazk = {
    email = "shujinarazaki@protonmail.com";
    github = "shnarazk";
+    githubId = 997855;
    name = "Narazaki Shuji";
  };
  shou = {
@ -6915,6 +7029,7 @@
  sjmackenzie = {
    email = "setori88@gmail.com";
    github = "sjmackenzie";
+    githubId = 158321;
    name = "Stewart Mackenzie";
  };
  sjourdois = {
@ -7048,6 +7163,7 @@
  sprock = {
    email = "rmason@mun.ca";
    github = "sprock";
+    githubId = 6391601;
    name = "Roger Mason";
  };
  spwhitt = {
@ -7059,6 +7175,7 @@
  srghma = {
    email = "srghma@gmail.com";
    github = "srghma";
+    githubId = 7573215;
    name = "Sergei Khoma";
  };
  srgom = {
@ -7276,6 +7393,7 @@
  taha = {
    email = "xrcrod@gmail.com";
    github = "tgharib";
+    githubId = 6457015;
    name = "Taha Gharib";
  };
  tailhook = {
@ -7359,6 +7477,7 @@
  tckmn = {
    email = "andy@tck.mn";
    github = "tckmn";
+    githubId = 2389333;
    name = "Andy Tockman";
  };
  teh = {
@ -7388,11 +7507,13 @@
  tesq0 = {
    email = "mikolaj.galkowski@gmail.com";
    github = "tesq0";
+    githubId = 26417242;
    name = "Mikolaj Galkowski";
  };
  teto = {
    email = "mcoudron@hotmail.com";
    github = "teto";
+    githubId = 886074;
    name = "Matthieu Coudron";
  };
  tex = {
@ -7434,6 +7555,7 @@
  the-kenny = {
    email = "moritz@tarn-vedra.de";
    github = "the-kenny";
+    githubId = 31167;
    name = "Moritz Ulrich";
  };
  thedavidmeister = {
@ -7521,11 +7643,13 @@
  timbertson = {
    email = "tim@gfxmonk.net";
    github = "timbertson";
+    githubId = 14172;
    name = "Tim Cuthbertson";
  };
  timma = {
    email = "kunduru.it.iitb@gmail.com";
    github = "ktrsoft";
+    githubId = 12712927;
    name = "Timma";
  };
  timokau = {
@ -7577,6 +7701,7 @@
  tnias = {
    email = "phil@grmr.de";
    github = "tnias";
+    githubId = 9853194;
    name = "Philipp Bartsch";
  };
  tobim = {
@ -7672,6 +7797,7 @@
  tscholak = {
    email = "torsten.scholak@googlemail.com";
    github = "tscholak";
+    githubId = 1568873;
    name = "Torsten Scholak";
  };
  tstrobel = {
@ -7693,6 +7819,7 @@
  tvestelind = {
    email = "tomas.vestelind@fripost.org";
    github = "tvestelind";
+    githubId = 699403;
    name = "Tomas Vestelind";
  };
  tvorog = {
@ -7704,11 +7831,13 @@
  tweber = {
    email = "tw+nixpkgs@360vier.de";
    github = "thorstenweber83";
+    githubId = 9413924;
    name = "Thorsten Weber";
  };
  twey = {
    email = "twey@twey.co.uk";
-    github = "twey";
+    github = "Twey";
+    githubId = 101639;
    name = "James ‘Twey’ Kay";
  };
  twhitehead = {
@ -7772,6 +7901,7 @@
  uwap = {
    email = "me@uwap.name";
    github = "uwap";
+    githubId = 2212422;
    name = "uwap";
  };
  va1entin = {
@ -7789,12 +7919,13 @@
  valebes = {
    email = "valebes@gmail.com";
    github = "valebes";
-    githubid = 10956211;
+    githubId = 10956211;
    name = "Valerio Besozzi";
  };
  valeriangalliat = {
    email = "val@codejam.info";
    github = "valeriangalliat";
+    githubId = 3929133;
    name = "Valérian Galliat";
  };
  valodim = {
@ -7842,6 +7973,7 @@
  vcanadi = {
    email = "vito.canadi@gmail.com";
    github = "vcanadi";
+    githubId = 8889722;
    name = "Vitomir Čanadi";
  };
  vcunat = {
@ -7904,6 +8036,7 @@
  viric = {
    email = "viric@viric.name";
    github = "viric";
+    githubId = 66664;
    name = "Lluís Batlle i Rossell";
  };
  virusdave = {
@ -7915,6 +8048,7 @@
  vizanto = {
    email = "danny@prime.vc";
    github = "vizanto";
+    githubId = 326263;
    name = "Danny Wilson";
  };
  vklquevs = {
@ -7944,6 +8078,7 @@
  vmchale = {
    email = "tmchale@wisc.edu";
    github = "vmchale";
+    githubId = 13259982;
    name = "Vanessa McHale";
  };
  volhovm = {
@ -8067,6 +8202,7 @@
  wscott = {
    email = "wsc9tt@gmail.com";
    github = "wscott";
+    githubId = 31487;
    name = "Wayne Scott";
  };
  wucke13 = {
@ -8120,6 +8256,7 @@
  xnaveira = {
    email = "xnaveira@gmail.com";
    github = "xnaveira";
+    githubId = 2534411;
    name = "Xavier Naveira";
  };
  xnwdd = {
@ -8161,6 +8298,7 @@
  y0no = {
    email = "y0no@y0no.fr";
    github = "y0no";
+    githubId = 2242427;
    name = "Yoann Ono";
  };
  yarny = {
@ -8242,6 +8380,7 @@
  yvesf = {
    email = "yvesf+nix@xapek.org";
    github = "yvesf";
+    githubId = 179548;
    name = "Yves Fischer";
  };
  yvt = {
@ -8271,6 +8410,7 @@
  zalakain = {
    email = "ping@umazalakain.info";
    github = "umazalakain";
+    githubId = 1319905;
    name = "Uma Zalakain";
  };
  zaninime = {
@ -8431,6 +8571,7 @@
    name  = "Nicholas Gerstle";
    email = "ngerstle@gmail.com";
    github = "ngerstle";
+    githubId = 1023752;
  };
  xavierzwirtz = {
    email = "me@xavierzwirtz.com";
--- a/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
+++ b/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
@ -3,7 +3,12 @@
 , networkExpr
 }:

-let nodes = import networkExpr; in
+let
+  nodes = builtins.mapAttrs (vm: module: {
+    _file = "${networkExpr}@node-${vm}";
+    imports = [ module ];
+  }) (import networkExpr);
+in

 with import ../../../../lib/testing-python.nix {
  inherit system;
--- a/nixos/modules/programs/captive-browser.nix
+++ b/nixos/modules/programs/captive-browser.nix
@ -28,7 +28,7 @@ in
      browser = mkOption {
        type = types.str;
        default = concatStringsSep " " [ ''${pkgs.chromium}/bin/chromium''
-                                         ''--user-data-dir=$HOME/.chromium-captive''
+                                         ''--user-data-dir=''${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive''
                                         ''--proxy-server="socks5://$PROXY"''
                                         ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"''
                                         ''--no-first-run''
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@ -330,13 +330,14 @@ in
                    User = data.user;
                    Group = data.group;
                    PrivateTmp = true;
-                    StateDirectory = "acme/.lego/${cert} ${lpath}";
+                    StateDirectory = "acme/.lego/${cert} acme/.lego/accounts ${lpath}";
                    StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";
                    WorkingDirectory = spath;
                    # Only try loading the credentialsFile if the dns challenge is enabled
                    EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
                    ExecStart = pkgs.writeScript "acme-start" ''
                      #!${pkgs.runtimeShell} -e
+                      test -L ${spath}/accounts -o -d ${spath}/accounts || ln -s ../accounts ${spath}/accounts
                      ${pkgs.lego}/bin/lego ${renewOpts} || ${pkgs.lego}/bin/lego ${runOpts}
                    '';
                    ExecStartPost =
--- a/nixos/modules/services/computing/boinc/client.nix
+++ b/nixos/modules/services/computing/boinc/client.nix
@ -99,14 +99,16 @@ in
      environment.systemPackages = [cfg.package];

      users.users.boinc = {
+        group = "boinc";
        createHome = false;
        description = "BOINC Client";
        home = cfg.dataDir;
        isSystemUser = true;
      };
+      users.groups.boinc = {};

      systemd.tmpfiles.rules = [
-        "d '${cfg.dataDir}' - boinc - - -"
+        "d '${cfg.dataDir}' - boinc boinc - -"
      ];

      systemd.services.boinc = {
@ -114,7 +116,7 @@ in
        after = ["network.target"];
        wantedBy = ["multi-user.target"];
        script = ''
-          ${fhsEnvExecutable} --dir ${cfg.dataDir} --redirectio ${allowRemoteGuiRpcFlag}
+          ${fhsEnvExecutable} --dir ${cfg.dataDir} ${allowRemoteGuiRpcFlag}
        '';
        serviceConfig = {
          User = "boinc";
--- a/nixos/modules/services/misc/airsonic.nix
+++ b/nixos/modules/services/misc/airsonic.nix
@ -138,6 +138,7 @@ in {

    services.nginx = mkIf (cfg.virtualHost != null) {
      enable = true;
+      recommendedProxySettings = true;
      virtualHosts.${cfg.virtualHost} = {
        locations.${cfg.contextPath}.proxyPass = "http://${cfg.listenAddress}:${toString cfg.port}";
      };
--- a/nixos/modules/services/misc/dysnomia.nix
+++ b/nixos/modules/services/misc/dysnomia.nix
@ -177,7 +177,7 @@ in
      wrapper = {};
    }
    // lib.optionalAttrs (config.services.httpd.enable) { apache-webapplication = {
-      documentRoot = config.services.httpd.documentRoot;
+      documentRoot = config.services.httpd.virtualHosts.localhost.documentRoot;
    }; }
    // lib.optionalAttrs (config.services.tomcat.axis2.enable) { axis2-webservice = {}; }
    // lib.optionalAttrs (config.services.ejabberd.enable) { ejabberd-dump = {
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@ -21,6 +21,8 @@ let
    "--config.file /tmp/alert-manager-substituted.yaml"
    "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
    "--log.level ${cfg.logLevel}"
+    "--storage.path /var/lib/alertmanager"
+    (toString (map (peer: "--cluster.peer ${peer}:9094") cfg.clusterPeers))
    ] ++ (optional (cfg.webExternalUrl != null)
      "--web.external-url ${cfg.webExternalUrl}"
    ) ++ (optional (cfg.logFormat != null)
@ -120,6 +122,14 @@ in {
        '';
      };

+      clusterPeers = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Initial peers for HA cluster.
+        '';
+      };
+
      extraFlags = mkOption {
        type = types.listOf types.str;
        default = [];
@ -162,6 +172,7 @@ in {
        '';
        serviceConfig = {
          Restart  = "always";
+          StateDirectory = "alertmanager";
          DynamicUser = true; # implies PrivateTmp
          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
          WorkingDirectory = "/tmp";
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@ -4,56 +4,102 @@ with lib;

 let
  cfg = config.services.traefik;
-  configFile =
-    if cfg.configFile == null then
-      pkgs.runCommand "config.toml" {
-        buildInputs = [ pkgs.remarshal ];
-        preferLocalBuild = true;
-      } ''
-        remarshal -if json -of toml \
-          < ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \
-          > $out
-      ''
-    else cfg.configFile;
-
+  jsonValue = with types;
+    let
+      valueType = nullOr (oneOf [
+        bool
+        int
+        float
+        str
+        (lazyAttrsOf valueType)
+        (listOf valueType)
+      ]) // {
+        description = "JSON value";
+        emptyValue.value = { };
+      };
+    in valueType;
+  dynamicConfigFile = if cfg.dynamicConfigFile == null then
+    pkgs.runCommand "config.toml" {
+      buildInputs = [ pkgs.remarshal ];
+      preferLocalBuild = true;
+    } ''
+      remarshal -if json -of toml \
+        < ${
+          pkgs.writeText "dynamic_config.json"
+          (builtins.toJSON cfg.dynamicConfigOptions)
+        } \
+        > $out
+    ''
+  else
+    cfg.dynamicConfigFile;
+  staticConfigFile = if cfg.staticConfigFile == null then
+    pkgs.runCommand "config.toml" {
+      buildInputs = [ pkgs.yj ];
+      preferLocalBuild = true;
+    } ''
+      yj -jt -i \
+        < ${
+          pkgs.writeText "static_config.json" (builtins.toJSON
+            (recursiveUpdate cfg.staticConfigOptions {
+              providers.file.filename = "${dynamicConfigFile}";
+            }))
+        } \
+        > $out
+    ''
+  else
+    cfg.staticConfigFile;
 in {
  options.services.traefik = {
    enable = mkEnableOption "Traefik web server";

-    configFile = mkOption {
+    staticConfigFile = mkOption {
      default = null;
-      example = literalExample "/path/to/config.toml";
+      example = literalExample "/path/to/static_config.toml";
      type = types.nullOr types.path;
      description = ''
-        Path to verbatim traefik.toml to use.
-        (Using that option has precedence over <literal>configOptions</literal>)
+        Path to traefik's static configuration to use.
+        (Using that option has precedence over <literal>staticConfigOptions</literal> and <literal>dynamicConfigOptions</literal>)
      '';
    };

-    configOptions = mkOption {
+    staticConfigOptions = mkOption {
      description = ''
-        Config for Traefik.
+        Static configuration for Traefik.
      '';
-      type = types.attrs;
-      default = {
-        defaultEntryPoints = ["http"];
-        entryPoints.http.address = ":80";
-      };
+      type = jsonValue;
+      default = { entryPoints.http.address = ":80"; };
      example = {
-        defaultEntrypoints = [ "http" ];
-        web.address = ":8080";
+        entryPoints.web.address = ":8080";
        entryPoints.http.address = ":80";

-        file = {};
-        frontends = {
-          frontend1 = {
-            backend = "backend1";
-            routes.test_1.rule = "Host:localhost";
-          };
-        };
-        backends.backend1 = {
-          servers.server1.url = "http://localhost:8000";
+        api = { };
+      };
+    };
+
+    dynamicConfigFile = mkOption {
+      default = null;
+      example = literalExample "/path/to/dynamic_config.toml";
+      type = types.nullOr types.path;
+      description = ''
+        Path to traefik's dynamic configuration to use.
+        (Using that option has precedence over <literal>dynamicConfigOptions</literal>)
+      '';
+    };
+
+    dynamicConfigOptions = mkOption {
+      description = ''
+        Dynamic configuration for Traefik.
+      '';
+      type = jsonValue;
+      default = { };
+      example = {
+        http.routers.router1 = {
+          rule = "Host(`localhost`)";
+          service = "service1";
        };
+
+        http.services.service1.loadBalancer.servers =
+          [{ url = "http://localhost:8080"; }];
      };
    };

@ -61,7 +107,7 @@ in {
      default = "/var/lib/traefik";
      type = types.path;
      description = ''
-      Location for any persistent data traefik creates, ie. acme
+        Location for any persistent data traefik creates, ie. acme
      '';
    };

@ -84,16 +130,15 @@ in {
  };

  config = mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0700 traefik traefik - -"
-    ];
+    systemd.tmpfiles.rules = [ "d '${cfg.dataDir}' 0700 traefik traefik - -" ];

    systemd.services.traefik = {
      description = "Traefik web server";
      after = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
-        ExecStart = ''${cfg.package.bin}/bin/traefik --configfile=${configFile}'';
+        ExecStart =
+          "${cfg.package}/bin/traefik --configfile=${staticConfigFile}";
        Type = "simple";
        User = "traefik";
        Group = cfg.group;
@ -120,6 +165,6 @@ in {
      isSystemUser = true;
    };

-    users.groups.traefik = {};
+    users.groups.traefik = { };
  };
 }
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/mini.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/mini.nix
@ -14,7 +14,9 @@ let
    user = ${cfg.user}
    show-password-label = true
    password-label-text = Password:
+    invalid-password-text = Invalid Password
    show-input-cursor = true
+    password-alignment = right

    [greeter-hotkeys]
    mod-key = meta
@ -26,6 +28,8 @@ let
    [greeter-theme]
    font = Sans
    font-size = 1em
+    font-weight = bold
+    font-style = normal
    text-color = "#080800"
    error-color = "#F8F8F0"
    background-image = "${ldmcfg.background}"
@ -36,6 +40,8 @@ let
    layout-space = 15
    password-color = "#F8F8F0"
    password-background-color = "#1B1D1E"
+    password-border-color = "#080800"
+    password-border-width = 2px

    ${cfg.extraConfig}
    '';
--- a/nixos/modules/services/x11/hardware/libinput.nix
+++ b/nixos/modules/services/x11/hardware/libinput.nix
@ -184,7 +184,11 @@ in {
        ''
          Option "DragLockButtons" "L1 B1 L2 B2"
        '';
-        description = "Additional options for libinput touchpad driver.";
+        description = ''
+          Additional options for libinput touchpad driver. See
+          <citerefentry><refentrytitle>libinput</refentrytitle><manvolnum>4</manvolnum></citerefentry>
+          for available options.";
+        '';
      };

    };
--- a/nixos/modules/system/boot/systemd-lib.nix
+++ b/nixos/modules/system/boot/systemd-lib.nix
@ -114,7 +114,9 @@ in rec {
        (if isList value then value else [value]))
        as));

-  generateUnits = type: units: upstreamUnits: upstreamWants:
+  generateUnits = generateUnits' true;
+
+  generateUnits' = allowCollisions: type: units: upstreamUnits: upstreamWants:
    pkgs.runCommand "${type}-units"
      { preferLocalBuild = true;
        allowSubstitutes = false;
@ -182,8 +184,13 @@ in rec {
          if [ "$(readlink -f $i/$fn)" = /dev/null ]; then
            ln -sfn /dev/null $out/$fn
          else
-            mkdir -p $out/$fn.d
-            ln -s $i/$fn $out/$fn.d/overrides.conf
+            ${if allowCollisions then ''
+              mkdir -p $out/$fn.d
+              ln -s $i/$fn $out/$fn.d/overrides.conf
+            '' else ''
+              echo "Found multiple derivations configuring $fn!"
+              exit 1
+            ''}
          fi
       else
          ln -fs $i/$fn $out/
--- a/nixos/modules/system/boot/systemd-nspawn.nix
+++ b/nixos/modules/system/boot/systemd-nspawn.nix
@ -116,7 +116,7 @@ in {
    in 
      mkMerge [
        (mkIf (cfg != {}) { 
-          environment.etc."systemd/nspawn".source = mkIf (cfg != {}) (generateUnits "nspawn" units [] []);
+          environment.etc."systemd/nspawn".source = mkIf (cfg != {}) (generateUnits' false "nspawn" units [] []);
        })
        {
          systemd.targets.multi-user.wants = [ "machines.target" ];
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@ -237,6 +237,38 @@ let
            '';
          };

+        createNetworkLink = i:
+        let
+          deviceDependency = if (config.boot.isContainer || i.name == "lo")
+            then []
+            else [ (subsystemDevice i.name) ];
+        in
+        nameValuePair "network-link-${i.name}"
+        { description = "Link configuration of ${i.name}";
+          wantedBy = [ "network-interfaces.target" ];
+          before = [ "network-interfaces.target" ];
+          bindsTo = deviceDependency;
+          after = [ "network-pre.target" ] ++ deviceDependency;
+          path = [ pkgs.iproute ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          script =
+            ''
+              echo "Configuring link..."
+            '' + optionalString (i.macAddress != null) ''
+              echo "setting MAC address to ${i.macAddress}..."
+              ip link set "${i.name}" address "${i.macAddress}"
+            '' + optionalString (i.mtu != null) ''
+              echo "setting MTU to ${toString i.mtu}..."
+              ip link set "${i.name}" mtu "${toString i.mtu}"
+            '' + ''
+              echo -n "bringing up interface... "
+              ip link set "${i.name}" up && echo "done" || (echo "failed"; exit 1)
+            '';
+        };
+
        createTunDevice = i: nameValuePair "${i.name}-netdev"
          { description = "Virtual Network Interface ${i.name}";
            bindsTo = [ "dev-net-tun.device" ];
@ -508,6 +540,7 @@ let
          });

      in listToAttrs (
+           map createNetworkLink interfaces ++
           map configureAddrs interfaces ++
           map createTunDevice (filter (i: i.virtual) interfaces))
         // mapAttrs' createBridgeDevice cfg.bridges
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -94,7 +94,12 @@ in
          address = forEach (interfaceIps i)
            (ip: "${ip.address}/${toString ip.prefixLength}");
          networkConfig.IPv6PrivacyExtensions = "kernel";
-        } ];
+          linkConfig = optionalAttrs (i.macAddress != null) {
+            MACAddress = i.macAddress;
+          } // optionalAttrs (i.mtu != null) {
+            MTUBytes = toString i.mtu;
+          };
+        }];
      })))
      (mkMerge (flip mapAttrsToList cfg.bridges (name: bridge: {
        netdevs."40-${name}" = {
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1031,6 +1031,11 @@ in
        message = ''
          Temporary addresses are only needed when IPv6 is enabled.
        '';
+      })) ++ (forEach interfaces (i: {
+        assertion = (i.virtual && i.virtualType == "tun") -> i.macAddress == null;
+        message = ''
+          Setting a MAC Address for tun device ${i.name} isn't supported.
+        '';
      })) ++ [
        {
          assertion = cfg.hostId == null || (stringLength cfg.hostId == 8 && isHexString cfg.hostId);
@ -1140,38 +1145,7 @@ in
          ${cfg.localCommands}
        '';
      };
-    } // (listToAttrs (forEach interfaces (i:
-      let
-        deviceDependency = if (config.boot.isContainer || i.name == "lo")
-          then []
-          else [ (subsystemDevice i.name) ];
-      in
-      nameValuePair "network-link-${i.name}"
-      { description = "Link configuration of ${i.name}";
-        wantedBy = [ "network-interfaces.target" ];
-        before = [ "network-interfaces.target" ];
-        bindsTo = deviceDependency;
-        after = [ "network-pre.target" ] ++ deviceDependency;
-        path = [ pkgs.iproute ];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-        };
-        script =
-          ''
-            echo "Configuring link..."
-          '' + optionalString (i.macAddress != null) ''
-            echo "setting MAC address to ${i.macAddress}..."
-            ip link set "${i.name}" address "${i.macAddress}"
-          '' + optionalString (i.mtu != null) ''
-            echo "setting MTU to ${toString i.mtu}..."
-            ip link set "${i.name}" mtu "${toString i.mtu}"
-          '' + ''
-            echo -n "bringing up interface... "
-            ip link set "${i.name}" up && echo "done" || (echo "failed"; exit 1)
-          '';
-      })));
-
+    };
    services.mstpd = mkIf needsMstpd { enable = true; };

    virtualisation.vswitch = mkIf (cfg.vswitches != { }) { enable = true; };
--- a/nixos/modules/virtualisation/hyperv-image.nix
+++ b/nixos/modules/virtualisation/hyperv-image.nix
@ -0,0 +1,69 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.hyperv;
+
+in {
+  options = {
+    hyperv = {
+      baseImageSize = mkOption {
+        type = types.int;
+        default = 2048;
+        description = ''
+          The size of the hyper-v base image in MiB.
+        '';
+      };
+      vmDerivationName = mkOption {
+        type = types.str;
+        default = "nixos-hyperv-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
+        description = ''
+          The name of the derivation for the hyper-v appliance.
+        '';
+      };
+      vmFileName = mkOption {
+        type = types.str;
+        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vhdx";
+        description = ''
+          The file name of the hyper-v appliance.
+        '';
+      };
+    };
+  };
+
+  config = {
+    system.build.hypervImage = import ../../lib/make-disk-image.nix {
+      name = cfg.vmDerivationName;
+      postVM = ''
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=dynamic -O vhdx $diskImage $out/${cfg.vmFileName}
+      '';
+      format = "raw";
+      diskSize = cfg.baseImageSize;
+      partitionTableType = "efi";
+      inherit config lib pkgs;
+    };
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      autoResize = true;
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-label/ESP";
+      fsType = "vfat";
+    };
+
+    boot.growPartition = true;
+
+    boot.loader.grub = {
+      version = 2;
+      device = "nodev";
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };
+
+    virtualisation.hypervGuest.enable = true;
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -303,6 +303,8 @@ in
  timezone = handleTest ./timezone.nix {};
  tinydns = handleTest ./tinydns.nix {};
  tor = handleTest ./tor.nix {};
+  # traefik test relies on docker-containers
+  traefik = handleTestOn ["x86_64-linux"] ./traefik.nix {};
  transmission = handleTest ./transmission.nix {};
  trac = handleTest ./trac.nix {};
  trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
--- a/nixos/tests/flannel.nix
+++ b/nixos/tests/flannel.nix
@ -1,20 +1,24 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ lib, ...} : {
  name = "flannel";

-  meta = with pkgs.stdenv.lib.maintainers; {
+  meta = with lib.maintainers; {
    maintainers = [ offline ];
  };

  nodes = let
-    flannelConfig = {
+    flannelConfig = { pkgs, ... } : {
      services.flannel = {
        enable = true;
+        backend = {
+          Type = "udp";
+          Port = 8285;
+        };
        network = "10.1.0.0/16";
        iface = "eth1";
        etcd.endpoints = ["http://etcd:2379"];
      };

-      networking.firewall.allowedUDPPorts = [ 8472 ];
+      networking.firewall.allowedUDPPorts = [ 8285 ];
    };
  in {
    etcd = { ... }: {
@ -32,25 +36,22 @@ import ./make-test.nix ({ pkgs, ...} : {
      networking.firewall.allowedTCPPorts = [ 2379 ];
    };

-    node1 = { ... }: {
-      require = [flannelConfig];
-    };
-
-    node2 = { ... }: {
-      require = [flannelConfig];
-    };
+    node1 = flannelConfig;
+    node2 = flannelConfig;
  };

  testScript = ''
-    startAll;
+    start_all()

-    $node1->waitForUnit("flannel.service");
-    $node2->waitForUnit("flannel.service");
+    node1.wait_for_unit("flannel.service")
+    node2.wait_for_unit("flannel.service")

-    my $ip1 = $node1->succeed("ip -4 addr show flannel.1 | grep -oP '(?<=inet).*(?=/)'");
-    my $ip2 = $node2->succeed("ip -4 addr show flannel.1 | grep -oP '(?<=inet).*(?=/)'");
+    node1.wait_until_succeeds("ip l show dev flannel0")
+    ip1 = node1.succeed("ip -4 addr show flannel0 | grep -oP '(?<=inet).*(?=/)'")
+    node2.wait_until_succeeds("ip l show dev flannel0")
+    ip2 = node2.succeed("ip -4 addr show flannel0 | grep -oP '(?<=inet).*(?=/)'")

-    $node1->waitUntilSucceeds("ping -c 1 $ip2");
-    $node2->waitUntilSucceeds("ping -c 1 $ip1");
+    node1.wait_until_succeeds(f"ping -c 1 {ip2}")
+    node2.wait_until_succeeds(f"ping -c 1 {ip1}")
  '';
 })
--- a/nixos/tests/iodine.nix
+++ b/nixos/tests/iodine.nix
@ -1,6 +1,7 @@
 import ./make-test-python.nix (
  { pkgs, ... }: let
    domain = "whatever.example.com";
+    password = "false;foo;exit;withspecialcharacters";
  in
    {
      name = "iodine";
@ -21,7 +22,7 @@ import ./make-test-python.nix (
              services.iodine.server = {
                enable = true;
                ip = "10.53.53.1/24";
-                passwordFile = "${builtins.toFile "password" "foo"}";
+                passwordFile = "${builtins.toFile "password" password}";
                inherit domain;
              };

@ -41,7 +42,7 @@ import ./make-test-python.nix (
              server = domain;
            };
            systemd.tmpfiles.rules = [
-              "f /root/pw 0666 root root - foo"
+              "f /root/pw 0666 root root - ${password}"
            ];
            environment.systemPackages = [
              pkgs.nagiosPluginsOfficial
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@ -200,6 +200,7 @@ let
          useDHCP = false;
          interfaces.eth1 = {
            ipv4.addresses = mkOverride 0 [ ];
+            mtu = 1343;
            useDHCP = true;
          };
          interfaces.eth2.ipv4.addresses = mkOverride 0 [ ];
@ -216,6 +217,9 @@ let
          with subtest("Wait until we have an ip address on each interface"):
              client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")

+          with subtest("ensure MTU is set"):
+              assert "mtu 1343" in client.succeed("ip link show dev eth1")
+
          with subtest("Test vlan 1"):
              client.wait_until_succeeds("ping -c 1 192.168.1.1")
              client.wait_until_succeeds("ping -c 1 192.168.1.2")
@ -455,11 +459,14 @@ let
          ipv4.addresses = [ { address = "192.168.1.1"; prefixLength = 24; } ];
          ipv6.addresses = [ { address = "2001:1470:fffd:2096::"; prefixLength = 64; } ];
          virtual = true;
+          mtu = 1342;
+          macAddress = "02:de:ad:be:ef:01";
        };
        networking.interfaces.tun0 = {
          ipv4.addresses = [ { address = "192.168.1.2"; prefixLength = 24; } ];
          ipv6.addresses = [ { address = "2001:1470:fffd:2097::"; prefixLength = 64; } ];
          virtual = true;
+          mtu = 1343;
        };
      };

@ -471,7 +478,7 @@ let

        with subtest("Wait for networking to come up"):
            machine.start()
-            machine.wait_for_unit("network-online.target")
+            machine.wait_for_unit("network.target")

        with subtest("Test interfaces set up"):
            list = machine.succeed("ip tuntap list | sort").strip()
@ -486,7 +493,12 @@ let
            """.format(
                list, targetList
            )
-
+        with subtest("Test MTU and MAC Address are configured"):
+            assert "mtu 1342" in machine.succeed("ip link show dev tap0")
+            assert "mtu 1343" in machine.succeed("ip link show dev tun0")
+            assert "02:de:ad:be:ef:01" in machine.succeed("ip link show dev tap0")
+      '' # network-addresses-* only exist in scripted networking
+      + optionalString (!networkd) ''
        with subtest("Test interfaces clean up"):
            machine.succeed("systemctl stop network-addresses-tap0")
            machine.sleep(10)
@ -602,17 +614,17 @@ let
      };

      testScript = ''
-        targetIPv4Table = """
-        10.0.0.0/16 proto static scope link mtu 1500 
-        192.168.1.0/24 proto kernel scope link src 192.168.1.2 
-        192.168.2.0/24 via 192.168.1.1 proto static 
-        """.strip()
+        targetIPv4Table = [
+            "10.0.0.0/16 proto static scope link mtu 1500",
+            "192.168.1.0/24 proto kernel scope link src 192.168.1.2",
+            "192.168.2.0/24 via 192.168.1.1 proto static",
+        ]

-        targetIPv6Table = """
-        2001:1470:fffd:2097::/64 proto kernel metric 256 pref medium
-        2001:1470:fffd:2098::/64 via fdfd:b3f0::1 proto static metric 1024 pref medium
-        fdfd:b3f0::/48 proto static metric 1024 pref medium
-        """.strip()
+        targetIPv6Table = [
+            "2001:1470:fffd:2097::/64 proto kernel metric 256 pref medium",
+            "2001:1470:fffd:2098::/64 via fdfd:b3f0::1 proto static metric 1024 pref medium",
+            "fdfd:b3f0::/48 proto static metric 1024 pref medium",
+        ]

        machine.start()
        machine.wait_for_unit("network.target")
@ -620,9 +632,9 @@ let
        with subtest("test routing tables"):
            ipv4Table = machine.succeed("ip -4 route list dev eth0 | head -n3").strip()
            ipv6Table = machine.succeed("ip -6 route list dev eth0 | head -n3").strip()
-            assert (
-                ipv4Table == targetIPv4Table
-            ), """
+            assert [
+                l.strip() for l in ipv4Table.splitlines()
+            ] == targetIPv4Table, """
              The IPv4 routing table does not match the expected one:
                Result:
                  {}
@ -631,9 +643,9 @@ let
              """.format(
                ipv4Table, targetIPv4Table
            )
-            assert (
-                ipv6Table == targetIPv6Table
-            ), """
+            assert [
+                l.strip() for l in ipv6Table.splitlines()
+            ] == targetIPv6Table, """
              The IPv6 routing table does not match the expected one:
                Result:
                  {}
--- a/nixos/tests/traefik.nix
+++ b/nixos/tests/traefik.nix
@ -0,0 +1,87 @@
+# Test Traefik as a reverse proxy of a local web service
+# and a Docker container.
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "traefik";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ joko ];
+  };
+
+  nodes = {
+    client = { config, pkgs, ... }: {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+    traefik = { config, pkgs, ... }: {
+      docker-containers.nginx = {
+        extraDockerOptions = [
+          "-l" "traefik.enable=true"
+          "-l" "traefik.http.routers.nginx.entrypoints=web"
+          "-l" "traefik.http.routers.nginx.rule=Host(`nginx.traefik.test`)"
+        ];
+        image = "nginx-container";
+        imageFile = pkgs.dockerTools.examples.nginx;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      services.traefik = {
+        enable = true;
+
+        dynamicConfigOptions = {
+          http.routers.simplehttp = {
+            rule = "Host(`simplehttp.traefik.test`)";
+            entryPoints = [ "web" ];
+            service = "simplehttp";
+          };
+
+          http.services.simplehttp = {
+            loadBalancer.servers = [{
+              url = "http://127.0.0.1:8000";
+            }];
+          };
+        };
+
+        staticConfigOptions = {
+          global = {
+            checkNewVersion = false;
+            sendAnonymousUsage = false;
+          };
+
+          entryPoints.web.address = ":80";
+
+          providers.docker.exposedByDefault = false;
+        };
+      };
+
+      systemd.services.simplehttp = {
+        script = "${pkgs.python3}/bin/python -m http.server 8000";
+        serviceConfig.Type = "simple";
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      users.users.traefik.extraGroups = [ "docker" ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    traefik.wait_for_unit("docker-nginx.service")
+    traefik.wait_until_succeeds("docker ps | grep nginx-container")
+    traefik.wait_for_unit("simplehttp.service")
+    traefik.wait_for_unit("traefik.service")
+    traefik.wait_for_open_port(80)
+    traefik.wait_for_unit("multi-user.target")
+
+    client.wait_for_unit("multi-user.target")
+
+    with subtest("Check that a container can be reached via Traefik"):
+        assert "Hello from NGINX" in client.succeed(
+            "curl -sSf -H Host:nginx.traefik.test http://traefik/"
+        )
+
+    with subtest("Check that dynamic configuration works"):
+        assert "Directory listing for " in client.succeed(
+            "curl -sSf -H Host:simplehttp.traefik.test http://traefik/"
+        )
+  '';
+})
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@ -1,14 +1,51 @@
-{ stdenv, fetchgit, alsaLib, aubio, boost, cairomm, curl, doxygen
-, fftwSinglePrec, flac, glibc, glibmm, graphviz, gtkmm2, libjack2
-, libgnomecanvas, libgnomecanvasmm, liblo, libmad, libogg
-, librdf_raptor, librdf_rasqal, libsamplerate, libsigcxx, libsndfile
-, libusb, libuuid, libxml2, libxslt, lilv, lrdf, lv2, makeWrapper
-, perl, pkgconfig, python2, rubberband, serd, sord, sratom
-, taglib, vamp-plugin-sdk, dbus, fftw, pango, suil, libarchive
-, wafHook }:
-
+{ stdenv
+, fetchgit
+, alsaLib
+, aubio
+, boost
+, cairomm
+, curl
+, doxygen
+, fftwSinglePrec
+, flac
+, glibc
+, glibmm
+, graphviz
+, gtkmm2
+, libjack2
+, liblo
+, libogg
+, libsamplerate
+, libsigcxx
+, libsndfile
+, libusb1
+, fluidsynth_1
+, hidapi
+, libltc
+, qm-dsp
+, libxml2
+, lilv
+, lrdf
+, lv2
+, makeWrapper
+, perl
+, pkg-config
+, itstool
+, python2
+, rubberband
+, serd
+, sord
+, sratom
+, taglib
+, vamp-plugin-sdk
+, dbus
+, fftw
+, pango
+, suil
+, libarchive
+, wafHook
+}:
 let
-
  # Ardour git repo uses a mix of annotated and lightweight tags. Annotated
  # tags are used for MAJOR.MINOR versioning, and lightweight tags are used
  # in-between; MAJOR.MINOR.REV where REV is the number of commits since the
@ -18,10 +55,7 @@ let

  # Version to build.
  tag = "5.12";
-
-in
-
-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
  name = "ardour-${tag}";

  src = fetchgit {
@ -30,46 +64,84 @@ stdenv.mkDerivation rec {
    sha256 = "0mla5lm51ryikc2rrk53max2m7a5ds6i1ai921l2h95wrha45nkr";
  };

-  nativeBuildInputs = [ wafHook ];
-  buildInputs =
-    [ alsaLib aubio boost cairomm curl doxygen dbus fftw fftwSinglePrec flac
-      glibmm graphviz gtkmm2 libjack2 libgnomecanvas libgnomecanvasmm liblo
-      libmad libogg librdf_raptor librdf_rasqal libsamplerate
-      libsigcxx libsndfile libusb libuuid libxml2 libxslt lilv lrdf lv2
-      makeWrapper pango perl pkgconfig python2 rubberband serd sord
-      sratom suil taglib vamp-plugin-sdk libarchive
-    ];
+  nativeBuildInputs = [
+    wafHook
+    makeWrapper
+    pkg-config
+    itstool
+    doxygen
+    graphviz # for dot
+    perl
+    python2
+  ];

-  # ardour's wscript has a "tarball" target but that required the git revision
-  # be available. Since this is an unzipped tarball fetched from github we
-  # have to do that ourself.
-  patchPhase = ''
-    printf '#include "libs/ardour/ardour/revision.h"\nnamespace ARDOUR { const char* revision = \"${tag}-${builtins.substring 0 8 src.rev}\"; }\n' > libs/ardour/revision.cc
-    sed 's|/usr/include/libintl.h|${glibc.dev}/include/libintl.h|' -i wscript
-    patchShebangs ./tools/
-  '';
+  buildInputs = [
+    alsaLib
+    aubio
+    boost
+    cairomm
+    curl
+    dbus
+    fftw
+    fftwSinglePrec
+    flac
+    glibmm
+    gtkmm2
+    libjack2
+    liblo
+    libogg
+    libsamplerate
+    libsigcxx
+    libsndfile
+    libusb1
+    fluidsynth_1
+    hidapi
+    libltc
+    qm-dsp
+    libxml2
+    lilv
+    lrdf
+    lv2
+    pango
+    rubberband
+    serd
+    sord
+    sratom
+    suil
+    taglib
+    vamp-plugin-sdk
+    libarchive
+  ];

  wafConfigureFlags = [
    "--optimize"
    "--docs"
+    "--use-external-libs"
+    "--freedesktop"
    "--with-backends=jack,alsa,dummy"
  ];

+  NIX_CFLAGS_COMPILE = "-I${qm-dsp}/include/qm-dsp";
+
+  # ardour's wscript has a "tarball" target but that required the git revision
+  # be available. Since this is an unzipped tarball fetched from github we
+  # have to do that ourself.
+  postPatch = ''
+    printf '#include "libs/ardour/ardour/revision.h"\nnamespace ARDOUR { const char* revision = \"${tag}-${builtins.substring 0 8 src.rev}\"; }\n' > libs/ardour/revision.cc
+    patchShebangs ./tools/
+  '';
+
  postInstall = ''
-    # Install desktop file
-    mkdir -p "$out/share/applications"
-    cat > "$out/share/applications/ardour.desktop" << EOF
-    [Desktop Entry]
-    Name=Ardour 5
-    GenericName=Digital Audio Workstation
-    Comment=Multitrack harddisk recorder
-    Exec=$out/bin/ardour5
-    Icon=$out/share/ardour5/resources/Ardour-icon_256px.png
-    Terminal=false
-    Type=Application
-    X-MultipleArgs=false
-    Categories=GTK;Audio;AudioVideoEditing;AudioVideo;Video;
-    EOF
+    # wscript does not install these for some reason
+    install -vDm 644 "build/gtk2_ardour/ardour.xml" \
+      -t "$out/share/mime/packages"
+    install -vDm 644 "build/gtk2_ardour/ardour5.desktop" \
+      -t "$out/share/applications"
+    for size in 16 22 32 48 256 512; do
+      install -vDm 644 "gtk2_ardour/resources/Ardour-icon_''${size}px.png" \
+        "$out/share/icons/hicolor/''${size}x''${size}/apps/ardour5.png"
+    done
+    install -vDm 644 "ardour.1"* -t "$out/share/man/man1"
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/audio/carla/default.nix
+++ b/pkgs/applications/audio/carla/default.nix
@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null;

 stdenv.mkDerivation rec {
  pname = "carla";
-  version = "2.0.0";
+  version = "2.1";

  src = fetchFromGitHub {
    owner = "falkTX";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0fqgncqlr86n38yy7pa118mswfacmfczj7w9xx6c6k0jav3wk29k";
+    sha256 = "074y40yrgl3qrdr3a5vn0scsw0qv77r5p5m6gc89zhf20ic8ajzc";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-mini-greeter/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "lightdm-mini-greeter";
-  version = "0.3.4";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "prikhi";
    repo = "lightdm-mini-greeter";
    rev = version;
-    sha256 = "1qi0bsqi8z2zv3303ww0kd7bciz6qx8na5bkvgrqlwyvq31czai5";
+    sha256 = "10hga7pmfyjdvj4xwm3djwrhk50brcpycj3p3c57pa0vnx4ill3s";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig wrapGAppsHook ];
@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    maintainers = with maintainers; [ mnacamura prikhi ];
    platforms = platforms.linux;
+    changelog = "https://github.com/prikhi/lightdm-mini-greeter/blob/master/CHANGELOG.md";
  };
 }
--- a/pkgs/applications/editors/jupp/default.nix
+++ b/pkgs/applications/editors/jupp/default.nix
@ -1,18 +1,16 @@
-{ stdenv, fetchurl
-, ncurses, gpm
-}:
+{ stdenv, fetchurl, ncurses, gpm }:

 stdenv.mkDerivation rec {

  pname = "jupp";
-  version = "3.1";
-  srcName = "joe-3.1jupp31";
+  version = "39";
+  srcName = "joe-3.1${pname}${version}";

  src = fetchurl {
    urls = [
      "https://www.mirbsd.org/MirOS/dist/jupp/${srcName}.tgz"
      "https://pub.allbsd.org/MirOS/dist/jupp/${srcName}.tgz" ];
-    sha256 = "1fnf9jsd6p4jyybkhjjs328qx38ywy8w029ngc7j7kqp0ixn0l0s";
+    sha256 = "14gys92dy3kq9ikigry7q2x4w5v2z76d97vp212bddrxiqy5np8d";
  };

  preConfigure = "chmod +x ./configure";
@ -37,7 +35,7 @@ stdenv.mkDerivation rec {
      and has a lot of bugs fixed. It is based upon an older version of joe
      because these behave better overall.
    '';
-    homepage = "http://mirbsd.de/jupp";
+    homepage = "http://www.mirbsd.org/jupp.htm";
    license = licenses.gpl1;
    maintainers = with maintainers; [ AndersonTorres ];
  };
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -1,54 +1,62 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, perlPackages, libXft
-, libpng, zlib, popt, boehmgc, libxml2, libxslt, glib, gtkmm2
-, glibmm, libsigcxx, lcms, boost, gettext, makeWrapper
-, gsl, gtkspell2, cairo, python2, poppler, imagemagick, libwpg, librevenge
-, libvisio, libcdr, libexif, potrace, cmake
-, librsvg, wrapGAppsHook
+{ stdenv
+, boehmgc
+, boost
+, cairo
+, cmake
+, fetchpatch
+, fetchurl
+, gettext
+, glib
+, glibmm
+, gsl
+, gtkmm2
+, gtkspell2
+, imagemagick
+, lcms
+, libcdr
+, libexif
+, libpng
+, librevenge
+, librsvg
+, libsigcxx
+, libvisio
+, libwpg
+, libXft
+, libxml2
+, libxslt
+, makeWrapper
+, perlPackages
+, pkg-config
+, poppler
+, popt
+, potrace
+, python3
+, wrapGAppsHook
+, zlib
 }:
-
 let
-  python2Env = python2.withPackages(ps: with ps;
-    [ numpy lxml scour ]);
+  python3Env = python3.withPackages
+    (ps: with ps; [
+      numpy
+      lxml
+      scour
+    ]);
 in
-
 stdenv.mkDerivation rec {
-  name = "inkscape-0.92.4";
+  pname = "inkscape";
+  version = "0.92.5";

  src = fetchurl {
-    url = "https://media.inkscape.org/dl/resources/file/${name}.tar.bz2";
-    sha256 = "0pjinhjibfsz1aywdpgpj3k23xrsszpj4a1ya5562dkv2yl2vv2p";
+    url = "https://media.inkscape.org/dl/resources/file/${pname}-${version}.tar.bz2";
+    sha256 = "ge5/aeK9ZKlzQ9g5Wkp6eQWyG4YVZu1eXZF5F41Rmgs=";
  };

-  patches = [
-    (fetchpatch {
-      name = "inkscape-poppler_0_76_compat.patch";
-      url = "https://gitlab.com/inkscape/inkscape/commit/e831b034746f8dc3c3c1b88372751f6dcb974831.diff";
-      sha256 = "096rdyi6ppjq1h9jwwsm9hb99nggfrfinik8rm23jkn4h2zl01zf";
-    })
-    (fetchpatch {
-      name = "inkscape-poppler_0_82_compat.patch";
-      url = "https://gitlab.com/inkscape/inkscape/commit/835b6bb62be565efab986d5a3f30a672ad56c7eb.patch";
-      sha256 = "02c6sxi2w52b885vr3pgani6kvxp9gdqqk2jgiykkdzv70hhrnm7";
-    })
-    (fetchpatch {
-      name = "inkscape-poppler_0_83_compat.patch";
-      url = "https://gitlab.com/inkscape/inkscape/commit/b5360a807b12d4e8318475ffd0464b84882788b5.patch";
-      sha256 = "1p44rr2q2i3zkd1y1j7xgdcbgx8yvlq6hq92im8s0bkjby6p5cpz";
-    })
-  ];
-
  # Inkscape hits the ARGMAX when linking on macOS. It appears to be
  # CMake’s ARGMAX check doesn’t offer enough padding for NIX_LDFLAGS.
  # Setting strictDeps it avoids duplicating some dependencies so it
  # will leave us under ARGMAX.
  strictDeps = true;

-  unpackPhase = ''
-    cp $src ${name}.tar.bz2
-    tar xvjf ${name}.tar.bz2 > /dev/null
-    cd ${name}
-  '';
-
  postPatch = ''
    patchShebangs share/extensions
    patchShebangs fix-roff-punct
@ -56,24 +64,52 @@ stdenv.mkDerivation rec {
    # Python is used at run-time to execute scripts, e.g., those from
    # the "Effects" menu.
    substituteInPlace src/extension/implementation/script.cpp \
-      --replace '"python-interpreter", "python"' '"python-interpreter", "${python2Env}/bin/python"'
+      --replace '"python-interpreter", "python"' '"python-interpreter", "${python3Env}/bin/python"'
  '';

-  nativeBuildInputs = [ pkgconfig cmake makeWrapper python2Env wrapGAppsHook ]
-    ++ (with perlPackages; [ perl XMLParser ]);
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    makeWrapper
+    python3Env
+    wrapGAppsHook
+  ] ++ (with perlPackages; [
+    perl
+    XMLParser
+  ]);
+
  buildInputs = [
-    libXft libpng zlib popt boehmgc
-    libxml2 libxslt glib gtkmm2 glibmm libsigcxx lcms boost gettext
-    gsl poppler imagemagick libwpg librevenge
-    libvisio libcdr libexif potrace
-
+    boehmgc
+    boost
+    gettext
+    glib
+    glibmm
+    gsl
+    gtkmm2
+    imagemagick
+    lcms
+    libcdr
+    libexif
+    libpng
+    librevenge
    librsvg # for loading icons
-
-    python2Env perlPackages.perl
-  ] ++ stdenv.lib.optional (!stdenv.isDarwin) gtkspell2
-    ++ stdenv.lib.optional stdenv.isDarwin cairo;
-
-  enableParallelBuilding = true;
+    libsigcxx
+    libvisio
+    libwpg
+    libXft
+    libxml2
+    libxslt
+    perlPackages.perl
+    poppler
+    popt
+    potrace
+    python3Env
+    zlib
+  ] ++ stdenv.lib.optionals (!stdenv.isDarwin) [
+    gtkspell2
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    cairo
+  ];

  # Make sure PyXML modules can be found at run-time.
  postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
@ -82,9 +118,10 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    license = "GPL";
-    homepage = "https://www.inkscape.org";
    description = "Vector graphics editor";
+    homepage = "https://www.inkscape.org";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.jtojnar ];
    platforms = platforms.all;
    longDescription = ''
      Inkscape is a feature-rich vector graphics editor that edits
--- a/pkgs/applications/graphics/kodelife/default.nix
+++ b/pkgs/applications/graphics/kodelife/default.nix
@ -21,9 +21,9 @@ stdenv.mkDerivation rec {
  src = fetchzip {
    url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.zip";
    sha256 = {
-      aarch64-linux = "1lcpj1mgkvksq1d08ibh59y0dmdh7zm77wi5ziqhg3p5g9nxyasd";
-      armv7l-linux  = "0sljy06302x567jqw5lagbyhpc3j140jk4wccacxjrbb6hcx3l42";
-      x86_64-darwin = "1b058s9kny026q395nj99v8hggxkgv43nnjkmx1a2siajw0db94c";
+      aarch64-linux = "0z2fqlf156348ha3zhv16kvqdx68fbwbzch2gzjm9x1na9n5k1ra";
+      armv7l-linux  = "1ppwgrmgl1j2ws9mhrscvvkamd69a6xw7x35df6d30cyj97r0mzy";
+      x86_64-darwin = "0f8vn6m3xzsiyxm2ka5wkbp63wvzrix6g1xrbpvcm3v2llmychkl";
      x86_64-linux  = "035c1nlw0nim057sz3axpkcgkafqbm6gpr8hwr097vlrqll6w3dv";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
  dontBuild = true;
  dontStrip = true;
  dontPatchELF = true;
+  preferLocalBuild = true;

  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/applications/graphics/luminance-hdr/default.nix
+++ b/pkgs/applications/graphics/luminance-hdr/default.nix
@ -1,9 +1,10 @@
-{ stdenv, cmake, fetchFromGitHub, pkgconfig, boost, exiv2, fftwFloat, gsl
+{ stdenv, mkDerivation, cmake, fetchFromGitHub, pkgconfig
+, boost, exiv2, fftwFloat, gsl
 , ilmbase, lcms2, libraw, libtiff, openexr
 , qtbase, qtdeclarative, qttools, qtwebengine, eigen
 }:

-stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "luminance-hdr";
  version = "2.6.0";

--- a/pkgs/applications/graphics/qimgv/default.nix
+++ b/pkgs/applications/graphics/qimgv/default.nix
@ -1,6 +1,15 @@
-{ mkDerivation, fetchFromGitHub, lib
-, pkgconfig, cmake
-, exiv2, qtbase, qtimageformats, qtsvg
+{ mkDerivation
+, lib
+, fetchFromGitHub
+
+, cmake
+, pkgconfig
+
+, exiv2
+, mpv
+, qtbase
+, qtimageformats
+, qtsvg
 }:

 mkDerivation rec {
@ -14,33 +23,32 @@ mkDerivation rec {
    sha256 = "0cmya06j466v0pirhxbzbj1vbz0346y7rbc1gbv4n9xcp6c6bln6";
  };

-  cmakeFlags = [
-    # Video support appears to be broken; the following gets printed upon
-    # attempting to view an mp4, webm, or mkv (and probably all video formats):
-    #
-    #   [VideoPlayerInitProxy] Error - could not load player library
-    #   "qimgv_player_mpv"
-    #
-    # GIFs are unaffected. If this ever gets addressed, all that is necessary is
-    # to add `mpv` to the arguments list and to `buildInputs`, and to remove
-    # `cmakeFlags`.
-    "-DVIDEO_SUPPORT=OFF"
-  ];
-
  nativeBuildInputs = [
-    pkgconfig
    cmake
+    pkgconfig
  ];

  buildInputs = [
    exiv2
+    mpv
    qtbase
    qtimageformats
    qtsvg
  ];

+  postPatch = ''
+    sed -i "s@/usr/bin/mpv@${mpv}/bin/mpv@" \
+      qimgv/settings.cpp
+  '';
+
+  # Wrap the library path so it can see `libqimgv_player_mpv.so`, which is used
+  # to play video files within qimgv itself.
+  qtWrapperArgs = [
+    "--prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib"
+  ];
+
  meta = with lib; {
-    description = "Qt5 image viewer with optional video support";
+    description = "A Qt5 image viewer with optional video support";
    homepage = "https://github.com/easymodo/qimgv";
    license = licenses.gpl3;
    platforms = platforms.linux;
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -90,6 +90,7 @@ let
      kalarm = callPackage ./kalarm.nix {};
      kalarmcal = callPackage ./kalarmcal.nix {};
      kate = callPackage ./kate.nix {};
+      kbreakout = callPackage ./kbreakout.nix {};
      kcachegrind = callPackage ./kcachegrind.nix {};
      kcalc = callPackage ./kcalc.nix {};
      kcalutils = callPackage ./kcalutils.nix {};
@ -146,6 +147,7 @@ let
      krdc = callPackage ./krdc.nix {};
      krfb = callPackage ./krfb.nix {};
      kruler = callPackage ./kruler.nix {};
+      kspaceduel = callPackage ./kspaceduel.nix {};
      ksudoku = callPackage ./ksudoku.nix {};
      ksystemlog = callPackage ./ksystemlog.nix {};
      ktnef = callPackage ./ktnef.nix {};
--- a/pkgs/applications/kde/kbreakout.nix
+++ b/pkgs/applications/kde/kbreakout.nix
@ -0,0 +1,22 @@
+{ mkDerivation, lib
+, extra-cmake-modules
+, cmake
+, kdbusaddons
+, ki18n
+, kconfigwidgets
+, kcrash
+, kxmlgui
+, libkdegames
+}:
+
+mkDerivation {
+  name = "kbreakout";
+  meta.license = with lib.licenses; [ lgpl21 gpl3 ];
+  outputs = [ "out" "dev" ];
+  nativeBuildInputs = [
+    cmake extra-cmake-modules
+  ];
+  propagatedBuildInputs = [
+    kdbusaddons ki18n kconfigwidgets kcrash kxmlgui libkdegames
+  ];
+}
--- a/pkgs/applications/kde/kspaceduel.nix
+++ b/pkgs/applications/kde/kspaceduel.nix
@ -0,0 +1,22 @@
+{ mkDerivation, lib
+, extra-cmake-modules
+, cmake
+, kdbusaddons
+, ki18n
+, kconfigwidgets
+, kcrash
+, kxmlgui
+, libkdegames
+}:
+
+mkDerivation {
+  name = "kspaceduel";
+  meta.license = with lib.licenses; [ lgpl21 gpl3 ];
+  outputs = [ "out" "dev" ];
+  nativeBuildInputs = [ 
+    cmake extra-cmake-modules
+  ];
+  propagatedBuildInputs = [
+    kdbusaddons ki18n kconfigwidgets kcrash kxmlgui libkdegames
+  ];
+}
--- a/pkgs/applications/misc/blugon/default.nix
+++ b/pkgs/applications/misc/blugon/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "blugon";
-  version = "1.12.0";
+  version = "1.12.1";

  src = fetchFromGitHub {
    owner = "jumper149";
    repo = pname;
    rev = version;
-    sha256 = "0vdhq8v011awhpkccbcmigj9c46widyzh0m5knafapanai3kv7ii";
+    sha256 = "1i67v8jxvavgax3dwvns200iwwdcvgki04liq0x64q52lg0vrh7m";
  };

  buildInputs = [ python3 libX11 libXrandr ];
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -122,7 +122,16 @@ mkDerivation rec {
    export PODOFO_INC_DIR=${podofo.dev}/include/podofo
    export PODOFO_LIB_DIR=${podofo.lib}/lib
    export SIP_BIN=${pypkgs.sip}/bin/sip
-    ${pypkgs.python.interpreter} setup.py install --prefix=$out
+    export XDG_DATA_HOME=$out/share
+    export XDG_UTILS_INSTALL_MODE="user"
+
+    ${pypkgs.python.interpreter} setup.py install --root=$out \
+      --prefix=$out \
+      --libdir=$out/lib \
+      --staging-root=$out \
+      --staging-libdir=$out/lib \
+      --staging-sharedir=$out/share
+

    PYFILES="$out/bin/* $out/lib/calibre/calibre/web/feeds/*.py
      $out/lib/calibre/calibre/ebooks/metadata/*.py
@ -131,13 +140,6 @@ mkDerivation rec {
    sed -i "s/env python[0-9.]*/python/" $PYFILES
    sed -i "2i import sys; sys.argv[0] = 'calibre'" $out/bin/calibre

-    # Replace @out@ by the output path.
-    mkdir -p $out/share/applications/
-    cp {$calibreDesktopItem,$ebookEditDesktopItem,$ebookViewerDesktopItem}/share/applications/* $out/share/applications/
-    for entry in $out/share/applications/*.desktop; do
-      substituteAllInPlace $entry
-    done
-
    mkdir -p $out/share
    cp -a man-pages $out/share/man

@ -165,79 +167,6 @@ mkDerivation rec {

  disallowedReferences = [ podofo.dev ];

-  calibreDesktopItem = makeDesktopItem {
-    fileValidation = false; # fails before substitution
-    name = "calibre-gui";
-    desktopName = "calibre";
-    exec = "@out@/bin/calibre --detach %F";
-    genericName = "E-book library management";
-    icon = "@out@/share/calibre/images/library.png";
-    comment = "Manage, convert, edit, and read e-books";
-    mimeType = lib.concatStringsSep ";" [
-      "application/x-mobipocket-subscription"
-      "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
-      "text/html"
-      "application/x-cbc"
-      "application/ereader"
-      "application/oebps-package+xml"
-      "image/vnd.djvu"
-      "application/x-sony-bbeb"
-      "application/vnd.ms-word.document.macroenabled.12"
-      "text/rtf"
-      "text/x-markdown"
-      "application/pdf"
-      "application/x-cbz"
-      "application/x-mobipocket-ebook"
-      "application/x-cbr"
-      "application/x-mobi8-ebook"
-      "text/fb2+xml"
-      "application/vnd.oasis.opendocument.text"
-      "application/epub+zip"
-      "text/plain"
-      "application/xhtml+xml"
-    ];
-    categories = "Office";
-    extraEntries = ''
-      Actions=Edit;Viewer;
-
-      [Desktop Action Edit]
-      Name=Edit E-book
-      Icon=@out@/share/calibre/images/tweak.png
-      Exec=@out@/bin/ebook-edit --detach %F
-
-      [Desktop Action Viewer]
-      Name=E-book Viewer
-      Icon=@out@/share/calibre/images/viewer.png
-      Exec=@out@/bin/ebook-viewer --detach %F
-    '';
-  };
-
-  ebookEditDesktopItem = makeDesktopItem {
-    fileValidation = false; # fails before substitution
-    name = "calibre-edit-book";
-    desktopName = "Edit E-book";
-    genericName = "E-book Editor";
-    comment = "Edit e-books";
-    icon = "@out@/share/calibre/images/tweak.png";
-    exec = "@out@/bin/ebook-edit --detach %F";
-    categories = "Office;Publishing";
-    mimeType = "application/epub+zip";
-    extraEntries = "NoDisplay=true";
-  };
-
-  ebookViewerDesktopItem = makeDesktopItem {
-    fileValidation = false; # fails before substitution
-    name = "calibre-ebook-viewer";
-    desktopName = "E-book Viewer";
-    genericName = "E-book Viewer";
-    comment = "Read e-books in all the major formats";
-    icon = "@out@/share/calibre/images/viewer.png";
-    exec = "@out@/bin/ebook-viewer --detach %F";
-    categories = "Office;Viewer";
-    mimeType = "application/epub+zip";
-    extraEntries = "NoDisplay=true";
-  };
-
  meta = with lib; {
    description = "Comprehensive e-book software";
    homepage = "https://calibre-ebook.com";
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@ -1,12 +1,15 @@
-{ lib, fetchurl, pythonPackages, gettext }:
+{ lib, fetchFromGitHub, pythonPackages, gettext }:

 pythonPackages.buildPythonApplication rec {
  pname = "cherrytree";
-  version = "0.39.1";
+  version = "0.39.2";
+
+  src = fetchFromGitHub {
+    owner = "giuspen";
+    repo = "cherrytree";
+    rev = version;
+    sha256 = "1l6wh24bhp4yhmsfmc0r4n2n10nlilkv4cmv5sfl80i250fiw7xa";

-  src = fetchurl {
-    url = "https://www.giuspen.com/software/${pname}-${version}.tar.xz";
-    sha256 = "0qhycblnixvbybzr8psgmgcpfs6jc9m0p2h9lmd5zmiaggqlcsv7";
  };

  nativeBuildInputs = [ gettext ];
@ -20,17 +23,16 @@ pythonPackages.buildPythonApplication rec {
  meta = with lib; {
    description = "An hierarchical note taking application";
    longDescription = ''
-      Cherrytree is an hierarchical note taking application,
-      featuring rich text, syntax highlighting and powerful search
-      capabilities. It organizes all information in units called
-      "nodes", as in a tree, and can be very useful to store any piece
-      of information, from tables and links to pictures and even entire
-      documents. All those little bits of information you have scattered
-      around your hard drive can be conveniently placed into a
-      Cherrytree document where you can easily find it.
+      Cherrytree is an hierarchical note taking application, featuring rich
+      text, syntax highlighting and powerful search capabilities. It organizes
+      all information in units called "nodes", as in a tree, and can be very
+      useful to store any piece of information, from tables and links to
+      pictures and even entire documents. All those little bits of information
+      you have scattered around your hard drive can be conveniently placed into
+      a Cherrytree document where you can easily find it.
    '';
    homepage = "http://www.giuspen.com/cherrytree";
    license = licenses.gpl3;
-    maintainers = with maintainers; [ AndersonTorres ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/far2l/default.nix
+++ b/pkgs/applications/misc/far2l/default.nix
@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/far2l --argv0 $out/bin/far2l
  '';

-  stripDebugList = "bin share";
+  stripDebugList = [ "bin" "share" ];

  enableParallelBuilding = true;

--- a/pkgs/applications/misc/notejot/default.nix
+++ b/pkgs/applications/misc/notejot/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "notejot";
-  version = "1.6.0";
+  version = "1.6.3";

  src = fetchFromGitHub {
    owner = "lainsce";
    repo = pname;
    rev = version;
-    sha256 = "1b65m9gvq8ziqqgnw3vgjpjb1qw7bww40ngd3gardsjg9lcwpxaf";
+    sha256 = "170dzgd6cnf2k3hfifjysmdggpskx6v1pjmblqgbwaj2d3snf3h8";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/sequeler/default.nix
+++ b/pkgs/applications/misc/sequeler/default.nix
@ -11,13 +11,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "sequeler";
-  version = "0.7.4";
+  version = "0.7.9";

  src = fetchFromGitHub {
    owner = "Alecaddd";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0ki8dganj6hmvg5qwdlc3y0a4pdmx7454np790yf5wnqb6ixb6gv";
+    sha256 = "117gcc41rd24y5hpm3drqxfcfz52smpcr8w76xnykx8wb1ac50jf";
  };

  nativeBuildInputs = [ meson ninja pkgconfig vala gettext wrapGAppsHook python3 desktop-file-utils ];
--- a/pkgs/applications/misc/subsurface/0001-core-fix-libgit-ifdef-to-handle-libgit2-v1.0-and-onw.patch
+++ b/pkgs/applications/misc/subsurface/0001-core-fix-libgit-ifdef-to-handle-libgit2-v1.0-and-onw.patch
@ -0,0 +1,41 @@
+From dfa4bcafec4425659a409550085417af3c5c787b Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Sat, 11 Apr 2020 12:38:38 +0200
+Subject: [PATCH] core: fix libgit ifdef to handle libgit2 v1.0 and onwards
+
+Conditional code for older libgit versions was removed in
+https://github.com/Subsurface-divelog/subsurface/pull/2737,
+but it's a non-trivial backport, and master currently isn't really ready
+for a release.
+
+So instead ship a patch fixing the one broken libgit2 conditional until
+a 4.10 release has been made.
+
+Note the inverted logic - the if branch now handles the old libgit
+condition, and the else branch the newer versions, consistent with how
+it's done in the rest of the subsurface codebase.
+---
+ core/git-access.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/core/git-access.c b/core/git-access.c
+index 3688cb90c..9997fc8fd 100644
+--- a/core/git-access.c
+++ b/core/git-access.c
+@@ -359,10 +359,10 @@ static int try_to_git_merge(git_repository *repo, git_reference **local_p, git_r
+ 	}
+ 
+ 	git_merge_init_options(&merge_options, GIT_MERGE_OPTIONS_VERSION);
+-#if !LIBGIT2_VER_MAJOR && LIBGIT2_VER_MINOR > 23
+-	merge_options.flags = GIT_MERGE_FIND_RENAMES;
+-#else
+#if !LIBGIT2_VER_MAJOR && LIBGIT2_VER_MINOR <= 22
+ 	merge_options.tree_flags = GIT_MERGE_TREE_FIND_RENAMES;
+#else
+	merge_options.flags = GIT_MERGE_FIND_RENAMES;
+ #endif
+ 	merge_options.file_favor = GIT_MERGE_FILE_FAVOR_UNION;
+ 	merge_options.rename_threshold = 100;
+-- 
+2.25.1
+
--- a/pkgs/applications/misc/subsurface/default.nix
+++ b/pkgs/applications/misc/subsurface/default.nix
@ -4,16 +4,22 @@
 }:

 let
-  version = "4.8.2";
+  version = "4.9.3";
+
+  subsurfaceSrc = (fetchFromGitHub {
+    owner = "Subsurface-divelog";
+    repo = "subsurface";
+    rev = "v${version}";
+    sha256 = "1i07f7appifx9j205x5a7ng01wsipxr6n9a3692pm60jli2nsir5";
+    fetchSubmodules = true;
+  });

  libdc = stdenv.mkDerivation {
    pname = "libdivecomputer-ssrf";
    inherit version;

-    src = fetchurl {
-      url = "https://subsurface-divelog.org/downloads/libdivecomputer-subsurface-branch-${version}.tgz";
-      sha256 = "167qan59raibmilkc574gdqxfjg2f5ww2frn86xzk2kn4qg8190w";
-    };
+    src = subsurfaceSrc;
+    sourceRoot = "source/libdivecomputer";

    nativeBuildInputs = [ autoreconfHook ];

@ -70,10 +76,10 @@ in stdenv.mkDerivation {
  pname = "subsurface";
  inherit version;

-  src = fetchurl {
-    url = "https://subsurface-divelog.org/downloads/Subsurface-${version}.tgz";
-    sha256 = "1fzrq6rqb6pzs36wxar2453cl509dqpcy9w7nq4gw7b1v2331wfy";
-  };
+  src = subsurfaceSrc;
+
+  # remove with the 4.10 release
+  patches = [ ./0001-core-fix-libgit-ifdef-to-handle-libgit2-v1.0-and-onw.patch ];

  buildInputs = [
    libdc googlemaps
--- a/pkgs/applications/misc/ulauncher/default.nix
+++ b/pkgs/applications/misc/ulauncher/default.nix
@ -17,18 +17,18 @@
 , librsvg
 }:

-python3Packages.buildPythonApplication rec  {
+python3Packages.buildPythonApplication rec {
  pname = "ulauncher";
-  version = "5.6.1";
+  version = "5.7.3";

  disabled = python3Packages.isPy27;

  src = fetchurl {
    url = "https://github.com/Ulauncher/Ulauncher/releases/download/${version}/ulauncher_${version}.tar.gz";
-    sha256 = "14k68lp58wldldhaq4cf0ffkhi81czv4ps9xa86iw1j5b1gd2vbl";
+    sha256 = "0wq2zsq3496fjfg89q01dsm7sb7kv92sycvqm6ad8z1z2kpisrbh";
  };

-  nativeBuildInputs = with python3Packages;  [
+  nativeBuildInputs = with python3Packages; [
    distutils_extra
    intltool
    wrapGAppsHook
@ -71,7 +71,6 @@ python3Packages.buildPythonApplication rec  {

  patches = [
    ./fix-path.patch
-    ./fix-permissions.patch # ulauncher PR #523
    ./0001-Adjust-get_data_path-for-NixOS.patch
    ./fix-extensions.patch
  ];
--- a/pkgs/applications/misc/ulauncher/fix-permissions.patch
+++ b/pkgs/applications/misc/ulauncher/fix-permissions.patch
@ -1,12 +0,0 @@
-diff --git a/ulauncher/utils/Theme.py b/ulauncher/utils/Theme.py
-index 9cde624..4e36c4f 100644
--- a/ulauncher/utils/Theme.py
-+++ b/ulauncher/utils/Theme.py
-@@ -138,6 +138,9 @@ class Theme:
-         rmtree(new_theme_dir)
-         copytree(self.path, new_theme_dir)
- 
-+        # change file permissions (because Nix store is read-only)
-+        os.chmod(new_theme_dir, 0o755)
-+
-         return os.path.join(new_theme_dir, 'generated.css')
--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@ -2,7 +2,7 @@

 let
  pname = "Sylk";
-  version = "2.5.0";
+  version = "2.6.1";
 in

 appimageTools.wrapType2 rec {
@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {

  src = fetchurl {
    url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    sha256 = "1jhs25zzdac3r2wz886vlpb0bz77p52mdlrbsbv28h6is79pbd69";
+    hash = "sha256:0417qk925k7p3fiq1zha9al86jrz6mqspda7mi3h9blpbyvlcy7w";
  };

  profile = ''
--- a/pkgs/applications/networking/browsers/ephemeral/default.nix
+++ b/pkgs/applications/networking/browsers/ephemeral/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "ephemeral";
-  version = "6.3.1";
+  version = "6.3.3";

  src = fetchFromGitHub {
    owner = "cassidyjames";
    repo = "ephemeral";
    rev = version;
-    sha256 = "13rl26lv5xgagiv21yp5pz69bkwh4nnz1lx9wryhsplki45xm1sq";
+    sha256 = "093bqc40p4s8jc1s5rg49363x24vnwwjayvgzmi4xag28f1x6kn8";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -15,13 +15,13 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "kubernetes";
-  version = "1.17.3";
+  version = "1.18.0";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "0caqczz8hrwqb8j94158hz6919i7c9v1v0zknh9m2zbbng4b1awi";
+    sha256 = "1jp54aahwpx9w73byfyadgffrig9fy6x8xzw27xv0anj2v9bm1fw";
  };

  nativeBuildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
--- a/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-discord/default.nix
@ -3,13 +3,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "bitlbee-discord";
-  version = "0.4.2";
+  version = "0.4.3";

  src = fetchFromGitHub {
    rev = version;
    owner = "sm00th";
    repo = "bitlbee-discord";
-    sha256 = "02pigk2vbz0jdz11f96sygdvp1j762yjn62h124fkcsc070g7a2f";
+    sha256 = "00qgdvrp7hv02n0ns685igp810zxmv3adsama8601122al6x041n";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig ];
--- a/pkgs/applications/networking/instant-messengers/deltachat-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-electron/default.nix
@ -2,13 +2,13 @@

 let
  pname = "deltachat-electron";
-  version = "1.1.0";
+  version = "1.2.0";
  name = "${pname}-${version}";

  src = fetchurl {
    url =
-      "https://download.delta.chat/desktop/r${version}/DeltaChat-${version}.AppImage";
-    sha256 = "0pbn45cyv0h3fp7s9v9q93v12ah2gj7daaq0r3z140im6zv0rkrc";
+      "https://download.delta.chat/desktop/v${version}/DeltaChat-${version}.AppImage";
+    sha256 = "Cyb34bfQEdwOA6XYZO+1Ri/2e/PRat15aUMn7IElmUI=";
  };

  appimageContents = appimageTools.extract { inherit name src; };
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@ -0,0 +1,57 @@
+{ stdenv
+, fetchurl
+, appimageTools
+, makeWrapper
+, electron_8
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jitsi-meet-electron";
+  version = "2.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/jitsi/jitsi-meet-electron/releases/download/v${version}/jitsi-meet-x86_64.AppImage";
+    sha256 = "11ci9dqhy8hkb4fwykjvcvai20ahqhjil825n1y1xf663ch8by93";
+    name="${pname}-${version}.AppImage";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    name = "${pname}-${version}";
+    inherit src;
+  };
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/${pname} $out/share/applications
+
+    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
+    cp -a ${appimageContents}/jitsi-meet.desktop $out/share/applications/${pname}.desktop
+    cp -a ${appimageContents}/usr/share/icons $out/share
+
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron_8}/bin/electron $out/bin/${pname} \
+      --add-flags $out/share/${pname}/resources/app.asar \
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Jitsi Meet desktop application powered by Electron";
+    homepage = "https://github.com/jitsi/jitsi-meet-electron";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ prusnak ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@ -1,7 +1,6 @@
 { stdenv, fetchFromGitHub
 , makeWrapper, makeDesktopItem, mkYarnPackage
-, electron_7, riot-web, gtk3
-, wrapGAppsHook, glib
+, electron_7, riot-web
 }:
 # Notes for maintainers:
 # * versions of `riot-web` and `riot-desktop` should be kept in sync.
@ -27,14 +26,7 @@ in mkYarnPackage rec {
  packageJSON = ./riot-desktop-package.json;
  yarnNix = ./riot-desktop-yarndeps.nix;

-  nativeBuildInputs = [ wrapGAppsHook ];
-
-  extraBuildInputs = [
-    glib
-    gtk3
-  ];
-
-  dontWrapGApps = true;
+  nativeBuildInputs = [ makeWrapper ];

  installPhase = ''
    # resources
@ -54,13 +46,10 @@ in mkYarnPackage rec {
    # desktop item
    mkdir -p "$out/share"
    ln -s "${desktopItem}/share/applications" "$out/share/applications"
-  '';

-  postFixup = ''
    # executable wrapper
    makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
-      --add-flags "$out/share/riot/electron" \
-      "''${gappsWrapperArgs[@]}"
+      --add-flags "$out/share/riot/electron"
  '';

  # Do not attempt generating a tarball for riot-web again.
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -15,11 +15,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "3.5.383291.0407";
+  version = "3.5.385850.0413";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "1l560gv1wpfiggxylz3f62mcjjchpq3p0i1j4b2b68ckgc5sj80k";
+      sha256 = "049kxgkyaxknxpk0hf1a7bxn0c08dk250z3q2ba9pc1xkrn5kdnw";
    };
  };

--- a/pkgs/applications/networking/ping/default.nix
+++ b/pkgs/applications/networking/ping/default.nix
@ -12,7 +12,9 @@
 , json-glib
 , libsoup
 , libgee
-, wrapGAppsHook }:
+, wrapGAppsHook
+, vala_0_40
+}:

 stdenv.mkDerivation rec {
  pname = "ping";
@ -28,7 +30,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    meson
    ninja
-    vala
+    vala_0_40
    pkgconfig
    python3
    wrapGAppsHook
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -1,34 +1,41 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkgconfig
-, alsaLib, ffmpeg, glib, openssl, pcre, zlib
-, libX11, libXcursor, libXdamage, libXext, libXi, libXinerama, libXrandr, libXrender, libXv, libXtst
-, libxkbcommon, libxkbfile
-, wayland
-, gstreamer, gst-plugins-base, gst-plugins-good, libunwind, orc
-, libxslt
-, libusb1
-, libpulseaudio ? null
-, cups ? null
-, pcsclite ? null
-, systemd ? null
-, buildServer ? true
-, nocaps ? false
-}:
+{ stdenv, lib, fetchFromGitHub, cmake, pkgconfig, alsaLib, ffmpeg, glib, openssl
+, pcre, zlib, libX11, libXcursor, libXdamage, libXext, libXi, libXinerama
+, libXrandr, libXrender, libXv, libXtst, libxkbcommon, libxkbfile, wayland
+, gstreamer, gst-plugins-base, gst-plugins-good, libunwind, orc, libxslt
+, libusb1, libpulseaudio ? null, cups ? null, pcsclite ? null, systemd ? null
+, buildServer ? true, nocaps ? false }:

-stdenv.mkDerivation rec {
+let
+  cmFlag = flag: if flag then "ON" else "OFF";
+  disabledTests = [
+    # this one is probably due to our sandbox
+    {
+      dir = "libfreerdp/crypto/test";
+      file = "Test_x509_cert_info.c";
+    }
+  ];
+
+in stdenv.mkDerivation rec {
  pname = "freerdp";
  version = "2.0.0";

  src = fetchFromGitHub {
-    owner  = "FreeRDP";
-    repo   = "FreeRDP";
-    rev    = version;
+    owner = "FreeRDP";
+    repo = "FreeRDP";
+    rev = version;
    sha256 = "0d2559v0z1jnq6jlrvsgdf8p6gd27m8kwdnxckl1x0ygaxs50bqc";
  };

-  # outputs = [ "bin" "out" "dev" ];
-
-  prePatch = ''
+  postPatch = ''
    export HOME=$TMP
+
+    # failing test(s)
+    ${lib.concatMapStringsSep "\n" (e: ''
+      substituteInPlace ${e.dir}/CMakeLists.txt \
+        --replace ${e.file} ""
+      rm ${e.dir}/${e.file}
+    '') disabledTests}
+
    substituteInPlace "libfreerdp/freerdp.pc.in" \
      --replace "Requires:" "Requires: @WINPR_PKG_CONFIG_FILENAME@"
  '' + lib.optionalString (pcsclite != null) ''
@ -39,32 +46,54 @@ stdenv.mkDerivation rec {
      --replace "RDP_SCANCODE_CAPSLOCK" "RDP_SCANCODE_LCONTROL"
  '';

-  buildInputs = with lib; [
-    alsaLib cups ffmpeg glib openssl pcre pcsclite libpulseaudio zlib
-    gstreamer gst-plugins-base gst-plugins-good libunwind orc
-    libX11 libXcursor libXdamage libXext libXi libXinerama libXrandr libXrender libXv libXtst
-    libxkbcommon libxkbfile
-    wayland libusb1
-    libxslt
-  ] ++ optional stdenv.isLinux systemd;
+  buildInputs = with lib;
+    [
+      alsaLib
+      cups
+      ffmpeg
+      glib
+      gst-plugins-base
+      gst-plugins-good
+      gstreamer
+      libX11
+      libXcursor
+      libXdamage
+      libXext
+      libXi
+      libXinerama
+      libXrandr
+      libXrender
+      libXtst
+      libXv
+      libpulseaudio
+      libunwind
+      libusb1
+      libxkbcommon
+      libxkbfile
+      libxslt
+      openssl
+      orc
+      pcre
+      pcsclite
+      wayland
+      zlib
+    ] ++ optional stdenv.isLinux systemd;

-  nativeBuildInputs = [
-    cmake pkgconfig
-  ];
+  nativeBuildInputs = [ cmake pkgconfig ];

-  enableParallelBuilding = true;
+  doCheck = true;

-  doCheck = false;
-
-  cmakeFlags = with lib; [
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DWITH_CUNIT=OFF"
-    "-DWITH_OSS=OFF"
-  ] ++ optional (libpulseaudio != null)       "-DWITH_PULSE=ON"
-    ++ optional (cups != null)                "-DWITH_CUPS=ON"
-    ++ optional (pcsclite != null)            "-DWITH_PCSC=ON"
-    ++ optional buildServer                   "-DWITH_SERVER=ON"
-    ++ optional (stdenv.isx86_64)             "-DWITH_SSE2=ON";
+  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" ]
+    ++ lib.mapAttrsToList (k: v: "-D${k}=${if v then "ON" else "OFF"}") {
+      BUILD_TESTING = doCheck;
+      WITH_CUNIT = doCheck;
+      WITH_CUPS = (cups != null);
+      WITH_OSS = false;
+      WITH_PCSC = (pcsclite != null);
+      WITH_PULSE = (libpulseaudio != null);
+      WITH_SERVER = buildServer;
+      WITH_SSE2 = stdenv.isx86_64;
+    };

  meta = with lib; {
    description = "A Remote Desktop Protocol Client";
@ -72,7 +101,7 @@ stdenv.mkDerivation rec {
      FreeRDP is a client-side implementation of the Remote Desktop Protocol (RDP)
      following the Microsoft Open Specifications.
    '';
-    homepage = "http://www.freerdp.com/";
+    homepage = "https://www.freerdp.com/";
    license = licenses.asl20;
    maintainers = with maintainers; [ peterhoeg lheckemann ];
    platforms = platforms.unix;
--- a/pkgs/applications/networking/testssl/default.nix
+++ b/pkgs/applications/networking/testssl/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "testssl.sh";
-  version = "3.0rc6";
+  version = "3.0";

  src = fetchFromGitHub {
    owner = "drwetter";
    repo = pname;
    rev = version;
-    sha256 = "1ks7pqgrg382ry0a0jf1dwgcwv81snhkrhkjdbcpym6w5flmpjsv";
+    sha256 = "08i1l835zlzb3qmsnsd5vhsrr82li6fnp5jqxiybbqr5wjz67ssd";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/office/agenda/default.nix
+++ b/pkgs/applications/office/agenda/default.nix
@ -1,7 +1,9 @@
 { stdenv
 , fetchFromGitHub
 , pantheon
-, cmake
+, meson
+, ninja
+, python3
 , pkg-config
 , vala
 , gettext
@ -13,20 +15,23 @@

 stdenv.mkDerivation rec {
  pname = "agenda";
-  version = "1.0.12";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "dahenson";
    repo = pname;
    rev = version;
-    sha256 = "128c9p2jkc90imlq25xg5alqlam8q4i3gd5p1kcggf7s4amv8l8w";
+    sha256 = "0yfapapsanqacaa83iagar88i335yy2jvay8y6z7gkri7avbs4am";
  };

  nativeBuildInputs = [
-    cmake
    gettext
-    vala
+    glib # for glib-compile-schemas
+    meson
+    ninja
    pkg-config
+    python3
+    vala
    wrapGAppsHook
  ];

@ -37,6 +42,13 @@ stdenv.mkDerivation rec {
    pantheon.granite
  ];

+  postPatch = ''
+    chmod +x meson/post_install.py
+    patchShebangs meson/post_install.py
+  '';
+
+  doCheck = true;
+
  passthru = {
    updateScript = pantheon.updateScript {
      attrPath = pname;
--- a/pkgs/applications/office/atlassian-cli/default.nix
+++ b/pkgs/applications/office/atlassian-cli/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "atlassian-cli";
-  version = "9.1.1";
+  version = "9.2.0";
  
  src = fetchzip {
    url  = "https://bobswift.atlassian.net/wiki/download/attachments/16285777/${pname}-${version}-distribution.zip";
-    sha256  = "0mdf4ybp0a6c816210g76lx901qwxw727ipyiph5kbdzl4jlrpgm";
+    sha256  = "0rdnbx3zfz3lpgka7bb8jzapkr81l2yvgsbmn8hrhva5k61xwx3d";
    extraPostFetch = "chmod go-w $out";
  };
  
--- a/pkgs/applications/office/bookworm/default.nix
+++ b/pkgs/applications/office/bookworm/default.nix
@ -1,15 +1,16 @@
 { stdenv, fetchFromGitHub, pantheon, vala, python3, python2, pkgconfig, libxml2, meson, ninja, gtk3, gnome3, glib, webkitgtk, libgee
-, gobject-introspection, sqlite, poppler, poppler_utils, html2text, curl, gnugrep, coreutils, bash, unzip, unar, wrapGAppsHook }:
+, gobject-introspection, sqlite, poppler, poppler_utils, html2text, curl, gnugrep, coreutils, bash, unzip, unar, wrapGAppsHook
+, appstream, desktop-file-utils }:

 stdenv.mkDerivation rec {
  pname = "bookworm";
-  version = "unstable-2018-11-19";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "babluboy";
    repo = pname;
-    rev = "4c3061784ff42151cac77d12bf2a28bf831fdfc5";
-    sha256 = "0yrqxa60xlvz249kx966z5krx8i7h17ac0hjgq9p8f0irzy5yp0n";
+    rev = version;
+    sha256 = "0w0rlyahpgx0l6inkbj106agbnr2czil0vdcy1zzv70apnjz488j";
  };

  nativeBuildInputs = [
@ -35,6 +36,8 @@ stdenv.mkDerivation rec {
    python2
    sqlite
    webkitgtk
+    appstream
+    desktop-file-utils
  ];

  postPatch = ''
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@ -1,67 +1,112 @@
-{ stdenv, fetchurl
-, libX11, glib, xorg, fontconfig, freetype
-, zlib, libpng12, libICE, libXrender, cups
-, alsaLib, atk, cairo, dbus, expat
-, gdk-pixbuf, gtk2-x11, lzma, pango, zotero
-, sqlite, libuuid, qt5, dpkg }:
+{ stdenv
+, mkDerivation
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, wrapGAppsHook
+, wrapQtAppsHook
+, alsaLib
+, atk
+, bzip2
+, cairo
+, cups
+, dbus
+, expat
+, ffmpeg_3
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, gperftools
+, gtk2-x11
+, libpng12
+, libtool
+, libuuid
+, libxml2
+, lzma
+, nspr
+, nss
+, openssl
+, pango
+, qt4
+, qtbase
+, sqlite
+, unixODBC
+, xorg
+, zlib
+}:

 stdenv.mkDerivation rec{
  pname = "wpsoffice";
-  version = "11.1.0.9080";
+  version = "11.1.0.9505";

  src = fetchurl {
-    url = "http://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/9080/wps-office_11.1.0.9080.XA_amd64.deb";
-    sha256 = "1731e9aea22ef4e558ad66b1373d863452b4f570aecf09d448ae28a821333454";
+    url = "http://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/9505/wps-office_11.1.0.9505.XA_amd64.deb";
+    sha256 = "1bvaxwd3npw3kswk7k1p6mcbfg37x0ym4sp6xis6ykz870qivqk5";
  };
  unpackCmd = "dpkg -x $src .";
  sourceRoot = ".";

-  nativeBuildInputs = [ qt5.wrapQtAppsHook dpkg ];
+  postUnpack = stdenv.lib.optionalString (version == "11.1.0.9505") ''
+    # distribution is missing libjsapiservice.so, so we should not let
+    # autoPatchelfHook fail on the following dead libraries
+    rm opt/kingsoft/wps-office/office6/{libjsetapi.so,libjswppapi.so,libjswpsapi.so}
+  '';
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook wrapQtAppsHook ];

  meta = {
    description = "Office program originally named Kingsoft Office";
    homepage = "http://wps-community.org/";
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
    hydraPlatforms = [];
    license = stdenv.lib.licenses.unfreeRedistributable;
    maintainers = [ stdenv.lib.maintainers.mlatus ];
  };

-  libPath = with xorg; stdenv.lib.makeLibraryPath [
-    libX11
-    libpng12
-    glib
-    libSM
-    libXext
-    fontconfig
-    zlib
-    freetype
-    libICE
-    cups
-    libXrender
-    libxcb
-
+  buildInputs = with xorg; [
    alsaLib
    atk
+    bzip2
    cairo
-    dbus.daemon.lib
+    dbus.lib
    expat
-    fontconfig.lib
+    ffmpeg_3
+    fontconfig
+    freetype
    gdk-pixbuf
+    glib
+    gperftools
    gtk2-x11
-    lzma
-    pango
-    zotero
-    sqlite
-    libuuid
+    libICE
+    libSM
+    libX11
+    libX11
+    libXScrnSaver
    libXcomposite
    libXcursor
    libXdamage
+    libXext
    libXfixes
    libXi
    libXrandr
-    libXScrnSaver
+    libXrender
    libXtst
+    libpng12
+    libtool
+    libuuid
+    libxcb
+    libxml2
+    lzma
+    nspr
+    nss
+    openssl
+    pango
+    qt4
+    qtbase
+    sqlite
+    unixODBC
+    zlib
  ];

  dontPatchELF = true;
@ -70,25 +115,59 @@ stdenv.mkDerivation rec{
  # references to nix own build directory
  noAuditTmpdir = true;

+  unvendoredLibraries = [
+    # Have to use parts of the vendored qt4
+    #"Qt"
+    "SDL2"
+    "bz2"
+    "avcodec"
+    "avdevice"
+    "avformat"
+    "avutil"
+    "swresample"
+    "swscale"
+    "jpeg"
+    "png"
+    # File saving breaks unless we are using vendored llvmPackages_8.libcxx
+    #"c++"
+    "ssl" "crypto"
+    "nspr"
+    "nss"
+    "odbc"
+    "tcmalloc" # gperftools
+  ];
+
  installPhase = ''
    prefix=$out/opt/kingsoft/wps-office
    mkdir -p $out
    cp -r opt $out
    cp -r usr/* $out
-    # Avoid forbidden reference error due use of patchelf
-    rm -r *
+    for lib in $unvendoredLibraries; do
+      rm -v "$prefix/office6/lib$lib"*.so{,.*}
+    done
    for i in wps wpp et wpspdf; do
-      patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --force-rpath --set-rpath "$(patchelf --print-rpath $prefix/office6/$i):${stdenv.cc.cc.lib}/lib64:${libPath}" \
-        $prefix/office6/$i
      substituteInPlace $out/bin/$i \
        --replace /opt/kingsoft/wps-office $prefix
    done
    for i in $out/share/applications/*;do
      substituteInPlace $i \
-        --replace /usr/bin $out/bin \
-        --replace /opt/kingsoft/wps-office $prefix
+        --replace /usr/bin $out/bin
+    done
+  '';
+
+  runtimeLibPath = stdenv.lib.makeLibraryPath [
+    cups.lib
+  ];
+
+  dontWrapQtApps = true;
+  dontWrapGApps = true;
+  postFixup = ''
+    for f in "$out"/bin/*; do
+      echo "Wrapping $f"
+      wrapProgram "$f" \
+        "''${gappsWrapperArgs[@]}" \
+        "''${qtWrapperArgs[@]}" \
+        --suffix LD_LIBRARY_PATH : "$runtimeLibPath"
    done
  '';
 }
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@ -4,11 +4,11 @@
 }:
 python2.pkgs.buildPythonApplication rec {
  pname = "chirp-daily";
-  version = "20200213";
+  version = "20200409";

  src = fetchurl {
    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${pname}-${version}.tar.gz";
-    sha256 = "189kg3425wggib1cggcj49bk01pq3j4b8mks7najpp1rjsl5f2i1";
+    sha256 = "16zhwg2xmp5kpqx5isavwwkfq1212zgfj8gbp453ngjcrvp3m4lq";
  };

  propagatedBuildInputs = with python2.pkgs; [
--- a/pkgs/applications/science/math/nasc/default.nix
+++ b/pkgs/applications/science/math/nasc/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, fetchpatch
 , pkgconfig
 , vala
 , gtk3
@ -25,6 +26,14 @@ stdenv.mkDerivation rec {
    sha256 = "036v3dx8yasp19j88lflibqnpfi5d0nk7qkcnr80zn1lvawf4wgn";
  };

+  patches = [
+    # fix build with gcc9
+    (fetchpatch {
+      url = "https://github.com/parnold-x/nasc/commit/46b9b80e228b6b86001bded45d85e073a9411549.patch";
+      sha256 = "1sm2aw0xhw2chk036r231nmp2f2ypxcmzggwljkn7wfzgg3h1mx3";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    vala
--- a/pkgs/applications/science/math/pari/gp2c.nix
+++ b/pkgs/applications/science/math/pari/gp2c.nix
@ -4,11 +4,11 @@
 stdenv.mkDerivation rec {

  pname = "gp2c";
-  version = "0.0.11pl2";
+  version = "0.0.11pl3";

  src = fetchurl {
    url = "https://pari.math.u-bordeaux.fr/pub/pari/GP2C/${pname}-${version}.tar.gz";
-    sha256 = "0wqsf05wgkqvmmsx7jinvzdqav6rl56sr8haibgs31nzz4x9xz9g";
+    sha256 = "0yymbrgyjw500hqgmkj5m4nmscd7c9rs9w2c96lxgrcyab8krhrm";
  };

  buildInputs = [ pari perl ];
@ -25,4 +25,3 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ AndersonTorres ];
  };
 }
-# TODO: add it as "source file" for default package
--- a/pkgs/applications/system/monitor/default.nix
+++ b/pkgs/applications/system/monitor/default.nix
@ -18,13 +18,14 @@

 stdenv.mkDerivation rec {
  pname = "monitor";
-  version = "0.6.2";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "stsdc";
    repo = "monitor";
    rev = version;
-    sha256 = "0cqzxlzdbij26qgbbngqx6njcpcymkgvm29b7ipldgkssxp1mkkg";
+    sha256 ="194s9rjh3yd2c3rf3zwxsxr2lwqfswjazj39yiyccy0wcxmxpv34";
+    fetchSubmodules = true;
  };

  nativeBuildInputs = [
@ -61,6 +62,11 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Manage processes and monitor system resources";
+    longDescription = ''
+      Manage processes and monitor system resources.
+      To use the wingpanel indicator in this application, see the Pantheon
+      section in the NixOS manual.
+    '';
    homepage = "https://github.com/stsdc/monitor";
    maintainers = with maintainers; [ kjuvi ] ++ pantheon.maintainers;
    platforms = platforms.linux;
--- a/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
@ -2,23 +2,23 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-trim";
-  version = "0.2.4";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "foriequal0";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0gfmv9bwhh6bv0s9kfbxq9wsvrk3zz3ibavbpp9l8cpqc3145pqy";
+    sha256 = "06wni47s8yq274bh5f7bcy0sah23938kjiw5pdxnma5kwwnrccrr";
  };

-  cargoSha256 = "0xklczk4vbh2mqf76r3rsfyclyza9imf6yss7vbkm9w4ir3ar9f3";
+  cargoSha256 = "06ndja8212xy4rybh1117wijsyj70w4z8h6km538a7598s49vzdk";

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ openssl ] ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];

  postInstall = ''
-    install -Dm644 docs/git-trim.md.1 $out/share/man/man1/git-trim.1
+    install -Dm644 -t $out/share/man/man1/ docs/git-trim.1
  '';

  # fails with sandbox
--- a/pkgs/applications/version-management/git-and-tools/git/update.sh
+++ b/pkgs/applications/version-management/git-and-tools/git/update.sh
@ -5,14 +5,15 @@ set -eu -o pipefail

 oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion git" | tr -d '"')"
 latestTag="$(git ls-remote --tags --sort="v:refname" git://github.com/git/git.git | grep -v '\{\}' | grep -v '\-rc' | tail -1 | sed 's|^.*/v\(.*\)|\1|')"
+targetVersion="${1:-latestTag}"

-if [ ! "${oldVersion}" = "${latestTag}" ]; then
-  update-source-version git "${latestTag}"
+if [ ! "${oldVersion}" = "${targetVersion}" ]; then
+  update-source-version git "${targetVersion}"
  nixpkgs="$(git rev-parse --show-toplevel)"
  default_nix="$nixpkgs/pkgs/applications/version-management/git-and-tools/git/default.nix"
  nix-build -A git
  git add "${default_nix}"
-  git commit -m "git: ${oldVersion} -> ${latestTag}"
+  git commit -m "git: ${oldVersion} -> ${targetVersion}"
 else
  echo "git is already up-to-date"
 fi
--- a/pkgs/applications/version-management/git-and-tools/tig/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/tig/default.nix
@ -31,10 +31,13 @@ stdenv.mkDerivation rec {
    make install
    make install-doc

-    substituteInPlace contrib/tig-completion.zsh \
-      --replace 'e=$(dirname ''${funcsourcetrace[1]%:*})/tig-completion.bash' "e=$out/etc/bash_completion.d/tig-completion.bash"
+    # fixes tig-completion __git-complete dependency
+    sed -i '1s;^;source ${git}/share/bash-completion/completions/git\n;' contrib/tig-completion.bash

-    install -D contrib/tig-completion.bash $out/etc/bash_completion.d/tig-completion.bash
+    substituteInPlace contrib/tig-completion.zsh \
+      --replace 'e=$(dirname ''${funcsourcetrace[1]%:*})/tig-completion.bash' "e=$out/share/bash-completion/completions/tig"
+
+    install -D contrib/tig-completion.bash $out/share/bash-completion/completions/tig
    install -D contrib/tig-completion.zsh $out/share/zsh/site-functions/_tig
    cp contrib/vim.tigrc $out/etc/

--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -52,7 +52,7 @@
 , xvSupport          ? stdenv.isLinux, libXv         ? null
 , youtubeSupport     ? true,           youtube-dl    ? null
 , zimgSupport        ? true,           zimg          ? null
-, archiveSupport     ? false,          libarchive    ? null
+, archiveSupport     ? true,           libarchive    ? null
 , jackaudioSupport   ? false,          libjack2      ? null
 , openalSupport      ? true,           openalSoft    ? null
 , vapoursynthSupport ? false,          vapoursynth   ? null
--- a/pkgs/applications/video/wf-recorder/default.nix
+++ b/pkgs/applications/video/wf-recorder/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "wf-recorder";
-  version = "0.2";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "ammen99";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1772hrd7j8b32y65x5c392kdijlcn13iqg9hrlagfar92102vsbf";
+    sha256 = "1cw6kpcbl33wh95pvy32xrsrm6kkk1awccr3phyh885xjs3b3iim";
  };

  nativeBuildInputs = [ meson ninja pkg-config wayland scdoc ];
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@ -20,7 +20,7 @@ let
  buildTags = "apparmor seccomp selinux containers_image_ostree_stub";
 in buildGoPackage rec {
  project = "cri-o";
-  version = "1.17.1";
+  version = "1.17.3";
  name = "${project}-${version}${flavor}";

  goPackagePath = "github.com/${project}/${project}";
@ -29,7 +29,7 @@ in buildGoPackage rec {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    sha256 = "0zipigjcnhcnn0w69dkd8312qb6z98l65ir175wp3jfvj4cx3g28";
+    sha256 = "1cy2lqasfn5n20vlm3ckb6myci8ya6qv08dw8fq7z4ycnm39r1a6";
  };

  outputs = [ "bin" "out" ];
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -1,24 +1,32 @@
-{ stdenv, fetchFromGitHub, pkgconfig, installShellFiles
-, buildGoPackage, gpgme, lvm2, btrfs-progs, libseccomp, systemd
+{ stdenv
+, fetchFromGitHub
+, pkg-config
+, installShellFiles
+, buildGoPackage
+, gpgme
+, lvm2
+, btrfs-progs
+, libseccomp
+, systemd
 , go-md2man
 }:

 buildGoPackage rec {
  pname = "podman";
-  version = "1.8.2";
+  version = "1.9.0";

  src = fetchFromGitHub {
-    owner  = "containers";
-    repo   = "libpod";
-    rev    = "v${version}";
-    sha256 = "1nxlkqz1ffa3l2yf4rmsxj788dx6xdp8pbi55m9jc9k1vqwc9hxs";
+    owner = "containers";
+    repo = "libpod";
+    rev = "v${version}";
+    sha256 = "19y48lpf7pvw5f5pzpknn92rq9xwbrpvi8mj7mc4dby6skqadrk4";
  };

  goPackagePath = "github.com/containers/libpod";

  outputs = [ "bin" "out" "man" ];

-  nativeBuildInputs = [ pkgconfig go-md2man installShellFiles ];
+  nativeBuildInputs = [ pkg-config go-md2man installShellFiles ];

  buildInputs = stdenv.lib.optionals stdenv.isLinux [ btrfs-progs libseccomp gpgme lvm2 systemd ];

--- a/pkgs/applications/window-managers/icewm/default.nix
+++ b/pkgs/applications/window-managers/icewm/default.nix
@ -6,6 +6,7 @@
 , libpthreadstubs, pcre, libXdamage, libXcomposite, libXfixes
 , libsndfile, fribidi }:

+with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "icewm";
  version = "1.6.5";
@ -34,13 +35,13 @@ stdenv.mkDerivation rec {
    cp -r ../lib/themes/{gtk2,Natural,nice,nice2,warp3,warp4,yellowmotif} $out/share/icewm/themes/
  '';

-  meta = with stdenv.lib; {
+  meta = {
    description = "A simple, lightweight X window manager";
    longDescription = ''
      IceWM is a window manager for the X Window System. The goal of
      IceWM is speed, simplicity, and not getting in the user's way.
    '';
-    homepage = "http://www.icewm.org/";
+    homepage = "https://www.ice-wm.org/";
    license = licenses.lgpl2;
    maintainers = [ maintainers.AndersonTorres ];
    platforms = platforms.linux;
--- a/pkgs/build-support/rust/build-rust-crate/build-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/build-crate.nix
@ -16,6 +16,9 @@
      ++ [crateFeatures]
      ++ extraRustcOpts
      ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--target ${rust.toRustTarget stdenv.hostPlatform} -C linker=${stdenv.hostPlatform.config}-gcc"
+      # since rustc 1.42 the "proc_macro" crate is part of the default crate prelude
+      # https://github.com/rust-lang/cargo/commit/4d64eb99a4#diff-7f98585dbf9d30aa100c8318e2c77e79R1021-R1022
+      ++ lib.optional (lib.elem "proc-macro" crateType) "--extern proc_macro"
    ;
    rustcMeta = "-C metadata=${metadata} -C extra-filename=-${metadata}";

--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@ -457,6 +457,18 @@ let
              "test ignore_main ... ok"
            ];
          };
+      procMacroInPrelude = {
+        procMacro = true;
+        edition = "2018";
+        src = symlinkJoin {
+          name = "proc-macro-in-prelude";
+          paths = [
+            (mkFile "src/lib.rs" ''
+              use proc_macro::TokenTree;
+            '')
+          ];
+        };
+      };
    };
    brotliCrates = (callPackage ./brotli-crates.nix {});
    tests = lib.mapAttrs (key: value: mkTest (value // lib.optionalAttrs (!value?crateName) { crateName = key; })) cases;
--- a/pkgs/common-updater/scripts.nix
+++ b/pkgs/common-updater/scripts.nix
@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, coreutils, gnused, gnugrep, diffutils, nix }:
+{ stdenv, makeWrapper, coreutils, gnused, gnugrep, diffutils, nix, git }:

 stdenv.mkDerivation {
  name = "common-updater-scripts";
@ -12,7 +12,7 @@ stdenv.mkDerivation {
    cp ${./scripts}/* $out/bin

    for f in $out/bin/*; do
-      wrapProgram $f --prefix PATH : ${stdenv.lib.makeBinPath [ coreutils gnused gnugrep nix diffutils ]}
+      wrapProgram $f --prefix PATH : ${stdenv.lib.makeBinPath [ coreutils gnused gnugrep nix diffutils git ]}
    done
  '';
 }
--- a/pkgs/common-updater/scripts/list-archive-two-level-versions
+++ b/pkgs/common-updater/scripts/list-archive-two-level-versions
@ -0,0 +1,35 @@
+#! /bin/sh
+
+# lists all available versions listed for a package in a site (http)
+
+scriptName=list-archive-two-level-versions # do not use the .wrapped name
+
+usage() {
+    echo "Usage: $scriptName <archive url> [<package name> [<debug file path>]]"
+}
+
+archive="$1"  # archive url
+pname="$2"  # package name
+file="$3"  # file for writing debugging information
+
+if [ -z "$archive" ]; then
+    echo "$scriptName: Missing archive url"
+    usage
+    exit 1
+fi
+
+# print a debugging message
+if [ -n "$file" ]; then
+    echo "# Listing versions for $pname at $archive" >> $file
+fi
+
+# list all major-minor versions from archive
+tags1=$(curl -sS "$archive/")
+tags1=$(echo "$tags1" | sed -rne 's,^<a href="([0-9]+\.[0-9]+)/">.*,\1,p')
+
+# print available versions
+for tag in $tags1; do
+    tags2=$(curl -sS "$archive/$tag/")
+    tags2=$(echo "$tags2" | sed -rne "s,^<a href=\"$pname-([0-9.]+)\\.[^0-9].*\">.*,\\1,p")
+    echo "$tags2"
+done
--- a/pkgs/common-updater/scripts/list-git-tags
+++ b/pkgs/common-updater/scripts/list-git-tags
@ -0,0 +1,32 @@
+#! /bin/sh -x
+
+# lists all available tags from a git repository
+
+scriptName=list-git-tags # do not use the .wrapped name
+
+usage() {
+    echo "Usage: $scriptName <repository url> [<package name> [<debug file path>]]"
+}
+
+repo="$1" # git repository url
+pname="$2" # package name
+file="$3" # file for writing debugging information
+
+if [ -z "$repo" ]; then
+    echo "$scriptName: Missing git repository url"
+    usage
+    exit 1
+fi
+
+# print a debugging message
+if [ -n "$file" ]; then
+    echo "# Listing tags for $pname at $repo" >> $file
+fi
+
+# list all tags from the remote repository
+tags=$(git ls-remote --tags --refs "$repo")
+
+# keep only the version part of the tag
+tags=$(echo "$tags" | cut --delimiter=/ --field=3)
+
+echo "$tags"
--- a/pkgs/common-updater/update-script.nix
+++ b/pkgs/common-updater/update-script.nix
@ -0,0 +1,98 @@
+{ stdenv, writeScript, coreutils, gnugrep, gnused, common-updater-scripts, nix }:
+
+{ pname
+, version
+, attrPath ? pname
+, versionLister
+, rev-prefix ? ""
+, odd-unstable ? true
+, patchlevel-unstable ? true
+}:
+
+let
+  # where to print git commands and debugging messages
+  fileForGitCommands = "update-git-commits.txt";
+
+  # shell script to update package
+  updateScript = writeScript "update-script.sh" ''
+    #! ${stdenv.shell}
+    set -o errexit
+    set -x
+
+    pname="$1"
+    version="$2"
+    attr_path="$3"
+    version_lister="$4"
+    rev_prefix="$5"
+    odd_unstable="$6"
+    patchlevel_unstable="$7"
+
+    # print header
+    echo "# $pname-$version" >> ${fileForGitCommands}
+
+    function version_is_unstable() {
+      local tag="$1"
+      local enforce="$2"
+      if [ -n "$odd_unstable" -o -n "$enforce" ]; then
+        local minor=$(echo "$tag" | ${gnused}/bin/sed -rne 's,^[0-9]+\.([0-9]+).*,\1,p')
+        if [ $((minor % 2)) -eq 1 ]; then
+          return 0
+        fi
+      fi
+      if [ -n "$patchlevel_unstable" -o -n "$enforce" ]; then
+        local patchlevel=$(echo "$tag" | ${gnused}/bin/sed -rne 's,^[0-9]+\.[0-9]+\.([0-9]+).*$,\1,p')
+        if ((patchlevel >= 90)); then
+          return 0
+        fi
+      fi
+      return 1
+    }
+
+    tags=$($version_lister $pname ${fileForGitCommands}) || exit 1
+
+    # print available tags
+    for tag in $tags; do
+        echo "#	found $pname version: $tag" >> ${fileForGitCommands}
+    done
+
+    # cut any revision prefix not used in the NixOS package version
+    if [ -n "$rev_prefix" ]; then
+      tags=$(echo "$tags" | ${gnugrep}/bin/grep "^$rev_prefix")
+      tags=$(echo "$tags" | ${gnused}/bin/sed -e "s,^$rev_prefix,,")
+    fi
+    tags=$(echo "$tags" | ${gnugrep}/bin/grep "^[0-9]")
+
+    # sort the tags in decreasing order
+    tags=$(echo "$tags" | ${coreutils}/bin/sort --reverse --version-sort)
+
+    # find the newest tag
+    # do not consider development versions
+    for latest_tag in $tags; do
+      if version_is_unstable "$latest_tag"; then
+        echo "#   skip development version: $pname-$latest_tag" >> ${fileForGitCommands}
+        latest_tag=
+      else
+        if version_is_unstable "$latest_tag" "enforce"; then
+          echo "#   use potential development version: $pname-$latest_tag" >> ${fileForGitCommands}
+        fi
+        break
+      fi
+    done
+
+    if [ -n "$latest_tag" ]; then
+      # print commands to commit the changes
+      if [ "$version" != "$latest_tag" ]; then
+        pfile=$(EDITOR=echo ${nix}/bin/nix edit -f. "$attr_path")
+        echo "   git add $pfile " >> ${fileForGitCommands}
+        echo "   git commit -m '$attr_path: $version -> $latest_tag'" >> ${fileForGitCommands}
+      fi
+
+      # update the nix expression
+      ${common-updater-scripts}/bin/update-source-version "$attr_path" "$latest_tag"
+    fi
+
+    echo "" >> ${fileForGitCommands}
+  '';
+
+in
+[ updateScript pname version attrPath versionLister rev-prefix odd-unstable patchlevel-unstable ]
--- a/pkgs/data/fonts/fira-code/default.nix
+++ b/pkgs/data/fonts/fira-code/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchzip }:

 let
-  version = "3";
+  version = "3.1";
 in fetchzip {
  name = "fira-code-${version}";

@ -13,7 +13,7 @@ in fetchzip {
    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
  '';

-  sha256 = "19kcqqd6c61v137q88zsvf2ra154n009sbqh6zs7l8f7r5bbipj2";
+  sha256 = "1rk5hiix282b1gsxq9kqma2q9fnydj0xl9vbrd88rf7ywvn75817";

  meta = with stdenv.lib; {
    homepage = "https://github.com/tonsky/FiraCode";
--- a/pkgs/data/fonts/line-awesome/default.nix
+++ b/pkgs/data/fonts/line-awesome/default.nix
@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl, unzip }:
+
+stdenv.mkDerivation rec {
+  pname = "line-awesome";
+  version = "1.3.0";
+
+  src = fetchurl {
+    url =
+      "https://maxst.icons8.com/vue-static/landings/line-awesome/line-awesome/${version}/line-awesome-${version}.zip";
+    hash = "sha256:07qkz8s1wjh5xwqlq1b4lpihr1zah3kh6bnqvfwvncld8l9wjqfk";
+  };
+
+  nativeBuildInputs = [ unzip ];
+
+  sourceRoot = "${version}/fonts";
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/truetype
+    mkdir -p $out/share/fonts/woff
+    mkdir -p $out/share/fonts/woff2
+    cp *.ttf $out/share/fonts/truetype
+    cp *.woff $out/share/fonts/woff
+    cp *.woff2 $out/share/fonts/woff2
+  '';
+
+  meta = with lib; {
+    description = "Replace Font Awesome with modern line icons";
+    longDescription = ''
+      This package includes only the TTF, WOFF and WOFF2 fonts. For full CSS etc. see the project website.
+    '';
+    homepage = "https://icons8.com/line-awesome";
+    license = licenses.mit;
+    maintainers = with maintainers; [ puzzlewolf ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/data/icons/humanity-icon-theme/default.nix
+++ b/pkgs/data/icons/humanity-icon-theme/default.nix
@ -0,0 +1,44 @@
+{ stdenv, fetchurl, gtk3, gnome3, hicolor-icon-theme }:
+
+stdenv.mkDerivation rec {
+  pname = "humanity-icon-theme";
+  version = "0.6.15";
+
+  src = fetchurl {
+    url = "https://launchpad.net/ubuntu/+archive/primary/+files/${pname}_${version}.tar.xz";
+    sha256 = "19ja47468s3jfabvakq9wknyfclfr31a9vd11p3mhapfq8jv9g4x";
+  };
+
+  nativeBuildInputs = [
+    gtk3
+  ];
+
+  propagatedBuildInputs = [
+    gnome3.adwaita-icon-theme
+    hicolor-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/icons
+    cp -a Humanity* $out/share/icons
+    rm $out/share/icons/*/{AUTHORS,CONTRIBUTORS,COPYING}
+
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache $theme
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Humanity icons from Ubuntu";
+    homepage = "https://launchpad.net/humanity/";
+    license = licenses.gpl2;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.romildo ];
+  };
+}
--- a/pkgs/data/icons/zafiro-icons/default.nix
+++ b/pkgs/data/icons/zafiro-icons/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zafiro-icons";
-  version = "1.0";
+  version = "1.1";

  src = fetchFromGitHub {
    owner = "zayronxio";
    repo = pname;
    rev = "${version}";
-    sha256 = "0gy3c0jkj1icnwcs23b6km9cj9cccv8y5z1w11nfdv91cq3mdhmb";
+    sha256 = "05h8qm9izjbp8pnl9jpbw3y9sddhp0zmg94fm1k4d4hhdqnakqhv";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-videos";
-  version = "2.7.0";
+  version = "2.7.1";

  repoName = "videos";

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1b6dqqmxa83fwlh9r0v918ikxd3mnwk0j5xssw1wk5l7q72s43w7";
+    sha256 = "00arim4i9bv9mbms1irkp44grkgrfnmqzraswyn1xiz9nvl1bsb9";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
+++ b/pkgs/desktops/pantheon/services/pantheon-agent-geoclue2/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "pantheon-agent-geoclue2";
-  version = "1.0.3";
+  version = "1.0.4";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1fhgdcykn0ykn8fp7inn2akygpglhdwfpdkpnih86kqmqj8siahv";
+    sha256 = "1lky7pw47d5mdza3bhq0ahdhgdv159ixngdsc1ys6j1kszsfxc1f";
  };

  passthru = {
--- a/pkgs/desktops/xfce/applications/gigolo/default.nix
+++ b/pkgs/desktops/xfce/applications/gigolo/default.nix
@ -4,6 +4,7 @@ mkXfceDerivation {
  category = "apps";
  pname = "gigolo";
  version = "0.5.0";
+  odd-unstable = false;

  sha256 = "1lqsxb0d5i8p9vbzx8s4p3rga7va5h1q146xgmsa41j5v40wrlw6";

--- a/pkgs/desktops/xfce/applications/orage/default.nix
+++ b/pkgs/desktops/xfce/applications/orage/default.nix
@ -8,7 +8,7 @@ let
 in

 mkXfceDerivation {
-  category = "apps";
+  category = "archive";
  pname = "orage";
  version = "4.12.1";

--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@ -4,6 +4,7 @@ mkXfceDerivation {
  category = "apps";
  pname = "xfce4-screenshooter";
  version = "1.9.5";
+  odd-unstable = false;

  sha256 = "1h14sywvk9l06p3z1cpb79911j8w2wqbk03ldknjkia2rfymjk06";

--- a/pkgs/desktops/xfce/applications/xfce4-volumed/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-volumed/default.nix
@ -1,9 +1,11 @@
 { stdenv, fetchurl, pkgconfig, makeWrapper
 , gstreamer, gtk2, gst-plugins-base, libnotify
-, keybinder, xfconf
+, keybinder, xfconf, xfce
 }:

 let
+  category = "apps";
+
  # The usual Gstreamer plugins package has a zillion dependencies
  # that we don't need for a simple mixer, so build a minimal package.
  gst_plugins_minimal = gst-plugins-base.override {
@ -13,15 +15,13 @@ let
 in

 stdenv.mkDerivation rec {
-  p_name  = "xfce4-volumed";
-  ver_maj = "0.1";
-  ver_min = "13";
+  pname  = "xfce4-volumed";
+  version = "0.1.13";

  src = fetchurl {
-    url = "mirror://xfce/src/apps/${p_name}/${ver_maj}/${name}.tar.bz2";
+    url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
    sha256 = "1aa0a1sbf9yzi7bc78kw044m0xzg1li3y4w9kf20wqv5kfjs7v2c";
  };
-  name = "${p_name}-${ver_maj}.${ver_min}";

  buildInputs =
    [ gstreamer gst_plugins_minimal gtk2
@ -36,6 +36,12 @@ stdenv.mkDerivation rec {
        --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
    '';

+  passthru.updateScript = xfce.updateScript {
+    inherit pname version;
+    attrPath = "xfce.${pname}";
+    versionLister = xfce.archiveLister category pname;
+  };
+
  meta = with stdenv.lib; {
    homepage = "https://www.xfce.org/projects/xfce4-volumed"; # referenced but inactive
    description = "A volume keys control daemon for the Xfce desktop environment";
--- a/pkgs/desktops/xfce/applications/xfdashboard/default.nix
+++ b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
@ -18,7 +18,8 @@ mkXfceDerivation {
  category = "apps";
  pname = "xfdashboard";
  version = "0.7.5";
-  rev = "0.7.5";
+  rev-prefix = "";
+  odd-unstable = false;

  sha256 = "0d0kg90h3li41bs75z3xldljsglkz220pba39c54qznnzb8v8a2i";

--- a/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
+++ b/pkgs/desktops/xfce/art/xfce4-icon-theme.nix
@ -1,23 +1,31 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gtk2 }:
+{ stdenv, fetchurl, pkgconfig, intltool, gtk2, xfce }:
+
+let
+  category = "art";
+in

 stdenv.mkDerivation rec {
-  p_name  = "xfce4-icon-theme";
-  ver_maj = "4.4";
-  ver_min = "3";
+  pname  = "xfce4-icon-theme";
+  version = "4.4.3";

  src = fetchurl {
-    url = "mirror://xfce/src/art/${p_name}/${ver_maj}/${name}.tar.bz2";
+    url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
    sha256 = "1yk6rx3zr9grm4jwpjvqdkl13pisy7qn1wm5cqzmd2kbsn96cy6l";
  };
-  name = "${p_name}-${ver_maj}.${ver_min}";

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ intltool gtk2 ];
+  
+  passthru.updateScript = xfce.updateScript {
+    inherit pname version;
+    attrPath = "xfce.${pname}";
+    versionLister = xfce.archiveLister category pname;
+  };

-  meta = {
+  meta = with stdenv.lib; {
    homepage = "https://www.xfce.org/";
    description = "Icons for Xfce";
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.eelco ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.eelco ];
  };
 }
--- a/pkgs/desktops/xfce/art/xfwm4-themes.nix
+++ b/pkgs/desktops/xfce/art/xfwm4-themes.nix
@ -1,15 +1,23 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, xfce }:
+
+let
+  category = "art";
+in

 stdenv.mkDerivation rec {
-  p_name  = "xfwm4-themes";
-  ver_maj = "4.10";
-  ver_min = "0";
+  pname  = "xfwm4-themes";
+  version = "4.10.0";

  src = fetchurl {
-    url = "mirror://xfce/src/art/${p_name}/${ver_maj}/${name}.tar.bz2";
+    url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
    sha256 = "0xfmdykav4rf6gdxbd6fhmrfrvbdc1yjihz7r7lba0wp1vqda51j";
  };
-  name = "${p_name}-${ver_maj}.${ver_min}";
+  
+  passthru.updateScript = xfce.updateScript {
+    inherit pname version;
+    attrPath = "xfce.${pname}";
+    versionLister = xfce.archiveLister category pname;
+  };

  meta = with stdenv.lib; {
    homepage = "https://www.xfce.org/";
--- a/pkgs/desktops/xfce/core/thunar-volman/default.nix
+++ b/pkgs/desktops/xfce/core/thunar-volman/default.nix
@ -9,6 +9,8 @@ mkXfceDerivation {

  sha256 = "1qrlpn0q5g9psd41l6y80r3bvbg8jaic92m6r400zzwcvivf95z0";

+  odd-unstable = false;
+
  meta = {
    description = "Thunar extension for automatic management of removable drives and media";
  };
--- a/Show More
+++ b/Show More