Merge staging-next into staging

.github/workflows/editorconfig.yml

@@ -11,7 +11,7 @@ jobs:
       with:
         fetch-depth: 0
     - uses: technote-space/get-diff-action@v2.0.3
-    - name: fetch editorconfig-checker
+    - name: Fetch editorconfig-checker
       env:
         VERSION: "2.1.0"
         OS: "linux"

.github/workflows/wait-ofborg.yml

@@ -7,8 +7,9 @@ jobs:
     steps:
     - name: Wait for ofborg CI
       run: |
+        # Wait for ofborg ...
         # eval sometimes takes a bit longer on staging.
-        if [[ "$BASE_BRANCH" == "refs/heads/staging" ]]; then
+        if [[ "$BASE_BRANCH" == "staging" ]]; then
           COUNTDOWN=$((COUNTDOWN*2))
         fi
         # ..in future a better fix would be to make ofborg mark CI as pending right away.
@@ -30,7 +31,7 @@ jobs:
       if: github.repository_owner == 'NixOS'
       env:
         BASE_BRANCH: ${{ github.base_ref }}
-        COUNTDOWN: 360 # wait for ~30min...
+        COUNTDOWN: 540 # wait for ~45min...
         GITHUB_TOKEN: ${{ github.token }}
         COMMIT: ${{ github.event.pull_request.head.sha }}
         OFBORG_APP_ID: 20500

maintainers/maintainer-list.nix

@@ -2180,6 +2180,16 @@
     githubId = 974130;
     name = "David Pätzel";
   };
+  dpausp = {
+    email = "dpausp@posteo.de";
+    github = "dpausp";
+    githubId = 1965950;
+    name = "Tobias Stenzel";
+    keys = [{
+      longkeyid = "rsa2048/0x78C7DD40DF23FB16";
+      fingerprint = "4749 0887 CF3B 85A1 6355  C671 78C7 DD40 DF23 FB16";
+    }];
+  };
   dpflug = {
     email = "david@pflug.email";
     github = "dpflug";

nixos/doc/manual/release-notes/rl-2009.xml

@@ -615,6 +615,17 @@ services.dokuwiki."mywiki" = {
   };
   ...
 };
+</programlisting>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+      The <xref linkend="opt-services.postgresql.dataDir"/> option is now set to <literal>"/var/lib/postgresql/${cfg.package.psqlSchema}"</literal> regardless of your
+      <xref linkend="opt-system.stateVersion"/>. Users with an existing postgresql install that have a <xref linkend="opt-system.stateVersion"/> of <literal>17.09</literal> or below
+      should double check what the value of their <xref linkend="opt-services.postgresql.dataDir"/> option is (<literal>/var/db/postgresql</literal>) and then explicitly
+      set this value to maintain compatibility:
+<programlisting>
+services.postgresql.dataDir = "/var/db/postgresql";
 </programlisting>
     </para>
    </listitem>
@@ -710,6 +721,37 @@ services.dokuwiki."mywiki" = {
      was removed, as udev gained native support to handle FIDO security tokens.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>services.transmission</literal> module
+     was enhanced with the new options:
+     <xref linkend="opt-services.transmission.credentialsFile"/>,
+     <xref linkend="opt-services.transmission.openFirewall"/>,
+     and <xref linkend="opt-services.transmission.performanceNetParameters"/>.
+    </para>
+    <para>
+     <literal>transmission-daemon</literal> is now started with additional systemd sandbox/hardening options for better security.
+     Please <link xlink:href="https://github.com/NixOS/nixpkgs/issues">report</link>
+     any use case where this is not working well.
+     In particular, the <literal>RootDirectory</literal> option newly set
+     forbids uploading or downloading a torrent outside of the default directory
+     configured at <link linkend="opt-services.transmission.settings">settings.download-dir</link>.
+     If you really need Transmission to access other directories,
+     you must include those directories into the <literal>BindPaths</literal> of the service:
+<programlisting>
+systemd.services.transmission.serviceConfig.BindPaths = [ "/path/to/alternative/download-dir" ];
+</programlisting>
+    </para>
+    <para>
+     Also, connection to the RPC (Remote Procedure Call) of <literal>transmission-daemon</literal>
+     is now only available on the local network interface by default.
+     Use:
+<programlisting>
+services.transmission.settings.rpc-bind-address = "0.0.0.0";
+</programlisting>
+     to get the previous behavior of listening on all network interfaces.
+    </para>
+   </listitem>
    <listitem>
     <para>
      With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -417,6 +417,14 @@ in
       '';
     };
 
+    isoImage.squashfsCompression = mkOption {
+      default = "xz -Xdict-size 100%";
+      description = ''
+        Compression settings to use for the squashfs nix store.
+      '';
+      example = "zstd -Xcompression-level 6";
+    };
+
     isoImage.edition = mkOption {
       default = "";
       description = ''
@@ -614,6 +622,7 @@ in
     # Create the squashfs image that contains the Nix store.
     system.build.squashfsStore = pkgs.callPackage ../../../lib/make-squashfs.nix {
       storeContents = config.isoImage.storeContents;
+      comp = config.isoImage.squashfsCompression;
     };
 
     # Individual files to be included on the CD, outside of the Nix

nixos/modules/services/databases/postgresql.nix

@@ -55,9 +55,13 @@ in
 
       dataDir = mkOption {
         type = types.path;
+        defaultText = "/var/lib/postgresql/\${config.services.postgresql.package.psqlSchema}";
         example = "/var/lib/postgresql/11";
         description = ''
-          Data directory for PostgreSQL.
+          The data directory for PostgreSQL. If left as the default value
+          this directory will automatically be created before the PostgreSQL server starts, otherwise
+          the sysadmin is responsible for ensuring the directory exists with appropriate ownership
+          and permissions.
         '';
       };
 
@@ -249,10 +253,7 @@ in
             else if versionAtLeast config.system.stateVersion "16.03" then pkgs.postgresql_9_5
             else throw "postgresql_9_4 was removed, please upgrade your postgresql version.");
 
-    services.postgresql.dataDir =
+    services.postgresql.dataDir = mkDefault "/var/lib/postgresql/${cfg.package.psqlSchema}";
-      mkDefault (if versionAtLeast config.system.stateVersion "17.09"
-                  then "/var/lib/postgresql/${cfg.package.psqlSchema}"
-                  else "/var/db/postgresql");
 
     services.postgresql.authentication = mkAfter
       ''
@@ -291,40 +292,28 @@ in
 
         preStart =
           ''
-            # Create data directory.
             if ! test -e ${cfg.dataDir}/PG_VERSION; then
-              mkdir -m 0700 -p ${cfg.dataDir}
+              # Cleanup the data directory.
               rm -f ${cfg.dataDir}/*.conf
-              chown -R postgres:postgres ${cfg.dataDir}
-            fi
-          ''; # */
 
-        script =
-          ''
               # Initialise the database.
-            if ! test -e ${cfg.dataDir}/PG_VERSION; then
               initdb -U ${cfg.superUser} ${concatStringsSep " " cfg.initdbArgs}
+
               # See postStart!
               touch "${cfg.dataDir}/.first_startup"
             fi
+
             ln -sfn "${configFile}" "${cfg.dataDir}/postgresql.conf"
             ${optionalString (cfg.recoveryConfig != null) ''
               ln -sfn "${pkgs.writeText "recovery.conf" cfg.recoveryConfig}" \
                 "${cfg.dataDir}/recovery.conf"
             ''}
-            ${optionalString (!groupAccessAvailable) ''
-              # postgresql pre 11.0 doesn't start if state directory mode is group accessible
-              chmod 0700 "${cfg.dataDir}"
-            ''}
-
-            exec postgres
           '';
 
-        serviceConfig =
+        serviceConfig = mkMerge [
           { ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
             User = "postgres";
             Group = "postgres";
-            PermissionsStartOnly = true;
             RuntimeDirectory = "postgresql";
             Type = if versionAtLeast cfg.package.version "9.6"
                    then "notify"
@@ -338,11 +327,15 @@ in
             # Give Postgres a decent amount of time to clean up after
             # receiving systemd's SIGINT.
             TimeoutSec = 120;
-          };
+
+            ExecStart = "${postgresql}/bin/postgres";
 
             # Wait for PostgreSQL to be ready to accept connections.
-        postStart =
+            ExecStartPost =
-          ''
+              let
+                setupScript = pkgs.writeScript "postgresql-setup" (''
+                  #!${pkgs.runtimeShell} -e
+
                   PSQL="${pkgs.utillinux}/bin/runuser -u ${cfg.superUser} -- psql --port=${toString cfg.port}"
 
                   while ! $PSQL -d postgres -c "" 2> /dev/null; do
@@ -367,7 +360,15 @@ in
                       $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"'
                     '') user.ensurePermissions)}
                   '') cfg.ensureUsers}
-          '';
+                '');
+              in
+                "+${setupScript}";
+          }
+          (mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") {
+            StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}";
+            StateDirectoryMode = if groupAccessAvailable then "0750" else "0700";
+          })
+        ];
 
         unitConfig.RequiresMountsFor = "${cfg.dataDir}";
       };

nixos/modules/services/misc/gitlab.nix

@@ -618,12 +618,19 @@ in {
       enable = true;
       ensureUsers = singleton { name = cfg.databaseUsername; };
     };
+
     # The postgresql module doesn't currently support concepts like
     # objects owners and extensions; for now we tack on what's needed
     # here.
-    systemd.services.postgresql.postStart = mkAfter (optionalString databaseActuallyCreateLocally ''
+    systemd.services.gitlab-postgresql = let pgsql = config.services.postgresql; in mkIf databaseActuallyCreateLocally {
+      after = [ "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pgsql.package ];
+      script = ''
         set -eu
 
+        PSQL="${pkgs.utillinux}/bin/runuser -u ${pgsql.superUser} -- psql --port=${toString pgsql.port}"
+
         $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
         current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
         if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
@@ -637,7 +644,12 @@ in {
             rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
         fi
         $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
-    '');
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
 
     # Use postfix to send out mails.
     services.postfix.enable = mkDefault true;
@@ -767,7 +779,7 @@ in {
     };
 
     systemd.services.gitlab = {
-      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "postgresql.service" "redis.service" ];
+      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
       requires = [ "gitlab-sidekiq.service" ];
       wantedBy = [ "multi-user.target" ];
       environment = gitlabEnv;

nixos/modules/services/monitoring/smartd.nix

@@ -18,7 +18,7 @@ let
     ${optionalString nm.enable ''
       {
       ${pkgs.coreutils}/bin/cat << EOF
-      From: smartd on ${host} <root>
+      From: smartd on ${host} <${nm.sender}>
       To: undisclosed-recipients:;
       Subject: SMART error on $SMARTD_DEVICESTRING: $SMARTD_FAILTYPE
 
@@ -129,6 +129,16 @@ in
             description = "Whenever to send e-mail notifications.";
           };
 
+          sender = mkOption {
+            default = "root";
+            example = "example@domain.tld";
+            type = types.str;
+            description = ''
+              Sender of the notification messages.
+              Acts as the value of <literal>email</literal> in the emails' <literal>From: ... </literal> field.
+            '';
+          };
+
           recipient = mkOption {
             default = "root";
             type = types.str;

nixos/modules/services/torrent/transmission.nix

@@ -1,52 +1,51 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, options, ... }:
 
 with lib;
 
 let
   cfg = config.services.transmission;
+  inherit (config.environment) etc;
   apparmor = config.security.apparmor.enable;
-
+  rootDir = "/run/transmission";
-  homeDir = cfg.home;
+  homeDir = "/var/lib/transmission";
-  downloadDirPermissions = cfg.downloadDirPermissions;
+  settingsDir = ".config/transmission-daemon";
-  downloadDir = "${homeDir}/Downloads";
+  downloadsDir = "Downloads";
-  incompleteDir = "${homeDir}/.incomplete";
+  incompleteDir = ".incomplete";
-
+  # TODO: switch to configGen.json once RFC0042 is implemented
-  settingsDir = "${homeDir}/config";
+  settingsFile = pkgs.writeText "settings.json" (builtins.toJSON cfg.settings);
-  settingsFile = pkgs.writeText "settings.json" (builtins.toJSON fullSettings);
-
-  # for users in group "transmission" to have access to torrents
-  fullSettings = { umask = 2; download-dir = downloadDir; incomplete-dir = incompleteDir; } // cfg.settings;
-
-  preStart = pkgs.writeScript "transmission-pre-start" ''
-    #!${pkgs.runtimeShell}
-    set -ex
-    cp -f ${settingsFile} ${settingsDir}/settings.json
-  '';
 in
 {
   options = {
     services.transmission = {
-      enable = mkOption {
+      enable = mkEnableOption ''the headless Transmission BitTorrent daemon.
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether or not to enable the headless Transmission BitTorrent daemon.
 
         Transmission daemon can be controlled via the RPC interface using
-          transmission-remote or the WebUI (http://localhost:9091/ by default).
+        transmission-remote, the WebUI (http://127.0.0.1:9091/ by default),
+        or other clients like stig or tremc.
 
-          Torrents are downloaded to ${downloadDir} by default and are
+        Torrents are downloaded to ${homeDir}/${downloadsDir} by default and are
-          accessible to users in the "transmission" group.
+        accessible to users in the "transmission" group'';
-        '';
-      };
 
-      settings = mkOption {
+      settings = mkOption rec {
+        # TODO: switch to types.config.json as prescribed by RFC0042 once it's implemented
         type = types.attrs;
+        apply = recursiveUpdate default;
         default =
           {
-            download-dir = downloadDir;
+            download-dir = "${cfg.home}/${downloadsDir}";
-            incomplete-dir = incompleteDir;
+            incomplete-dir = "${cfg.home}/${incompleteDir}";
             incomplete-dir-enabled = true;
+            message-level = 1;
+            peer-port = 51413;
+            peer-port-random-high = 65535;
+            peer-port-random-low = 49152;
+            peer-port-random-on-start = false;
+            rpc-bind-address = "127.0.0.1";
+            rpc-port = 9091;
+            script-torrent-done-enabled = false;
+            script-torrent-done-filename = "";
+            umask = 2; # 0o002 in decimal as expected by Transmission
+            utp-enabled = true;
           };
         example =
           {
@@ -56,11 +55,12 @@ in
             rpc-whitelist = "127.0.0.1,192.168.*.*";
           };
         description = ''
-          Attribute set whos fields overwrites fields in settings.json (each
+          Attribute set whose fields overwrites fields in
-          time the service starts). String values must be quoted, integer and
+          <literal>.config/transmission-daemon/settings.json</literal>
+          (each time the service starts). String values must be quoted, integer and
           boolean values must not.
 
-          See https://github.com/transmission/transmission/wiki/Editing-Configuration-Files
+          See <link xlink:href="https://github.com/transmission/transmission/wiki/Editing-Configuration-Files">Transmission's Wiki</link>
           for documentation.
         '';
       };
@@ -70,22 +70,32 @@ in
         default = "770";
         example = "775";
         description = ''
-          The permissions to set for download-dir and incomplete-dir.
+          The permissions set by <literal>systemd.activationScripts.transmission-daemon</literal>
-          They will be applied on every service start.
+          on the directories <link linkend="opt-services.transmission.settings">settings.download-dir</link>
+          and <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link>.
+          Note that you may also want to change
+          <link linkend="opt-services.transmission.settings">settings.umask</link>.
         '';
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
-        default = 9091;
+        description = ''
-        description = "TCP port number to run the RPC/web interface.";
+          TCP port number to run the RPC/web interface.
+
+          If instead you want to change the peer port,
+          use <link linkend="opt-services.transmission.settings">settings.peer-port</link>
+          or <link linkend="opt-services.transmission.settings">settings.peer-port-random-on-start</link>.
+        '';
       };
 
       home = mkOption {
         type = types.path;
-        default = "/var/lib/transmission";
+        default = homeDir;
         description = ''
-          The directory where transmission will create files.
+          The directory where Transmission will create <literal>${settingsDir}</literal>.
+          as well as <literal>${downloadsDir}/</literal> unless <link linkend="opt-services.transmission.settings">settings.download-dir</link> is changed,
+          and <literal>${incompleteDir}/</literal> unless <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link> is changed.
         '';
       };
 
@@ -100,32 +110,174 @@ in
         default = "transmission";
         description = "Group account under which Transmission runs.";
       };
+
+      credentialsFile = mkOption {
+        type = types.path;
+        description = ''
+          Path to a JSON file to be merged with the settings.
+          Useful to merge a file which is better kept out of the Nix store
+          because it contains sensible data like <link linkend="opt-services.transmission.settings">settings.rpc-password</link>.
+        '';
+        default = "/dev/null";
+        example = "/var/lib/secrets/transmission/settings.json";
+      };
+
+      openFirewall = mkEnableOption "opening of the peer port(s) in the firewall";
+
+      performanceNetParameters = mkEnableOption ''tweaking of kernel parameters
+        to open many more connections at the same time.
+
+        Note that you may also want to increase
+        <link linkend="opt-services.transmission.settings">settings.peer-limit-global</link>.
+        And be aware that these settings are quite aggressive
+        and might not suite your regular desktop use.
+        For instance, SSH sessions may time out more easily'';
     };
   };
 
   config = mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
+    # Note that using systemd.tmpfiles would not work here
-      "d '${homeDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
+    # because it would fail when creating a directory
-      "d '${settingsDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
+    # with a different owner than its parent directory, by saying:
-      "d '${fullSettings.download-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
+    # Detected unsafe path transition /home/foo → /home/foo/Downloads during canonicalization of /home/foo/Downloads
-      "d '${fullSettings.incomplete-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
+    # when /home/foo is not owned by cfg.user.
+    # Note also that using an ExecStartPre= wouldn't work either
+    # because BindPaths= needs these directories before.
+    system.activationScripts.transmission-daemon = ''
+      install -d -m 700 '${cfg.home}/${settingsDir}'
+      chown -R '${cfg.user}:${cfg.group}' ${cfg.home}/${settingsDir}
+      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.download-dir}'
+      '' + optionalString cfg.settings.incomplete-dir-enabled ''
+      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.incomplete-dir}'
+      '';
+
+    assertions = [
+      { assertion = builtins.match "^/.*" cfg.home != null;
+        message = "`services.transmission.home' must be an absolute path.";
+      }
+      { assertion = types.path.check cfg.settings.download-dir;
+        message = "`services.transmission.settings.download-dir' must be an absolute path.";
+      }
+      { assertion = types.path.check cfg.settings.incomplete-dir;
+        message = "`services.transmission.settings.incomplete-dir' must be an absolute path.";
+      }
+      { assertion = cfg.settings.script-torrent-done-filename == "" || types.path.check cfg.settings.script-torrent-done-filename;
+        message = "`services.transmission.settings.script-torrent-done-filename' must be an absolute path.";
+      }
+      { assertion = types.port.check cfg.settings.rpc-port;
+        message = "${toString cfg.settings.rpc-port} is not a valid port number for `services.transmission.settings.rpc-port`.";
+      }
+      # In case both port and settings.rpc-port are explicitely defined: they must be the same.
+      { assertion = !options.services.transmission.port.isDefined || cfg.port == cfg.settings.rpc-port;
+        message = "`services.transmission.port' is not equal to `services.transmission.settings.rpc-port'";
+      }
     ];
 
+    services.transmission.settings =
+      optionalAttrs options.services.transmission.port.isDefined { rpc-port = cfg.port; };
+
     systemd.services.transmission = {
       description = "Transmission BitTorrent Service";
       after = [ "network.target" ] ++ optional apparmor "apparmor.service";
-      requires = mkIf apparmor [ "apparmor.service" ];
+      requires = optional apparmor "apparmor.service";
       wantedBy = [ "multi-user.target" ];
+      environment.CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;
 
-      # 1) Only the "transmission" user and group have access to torrents.
+      serviceConfig = {
-      # 2) Optionally update/force specific fields into the configuration file.
+        # Use "+" because credentialsFile may not be accessible to User= or Group=.
-      serviceConfig.ExecStartPre = preStart;
+        ExecStartPre = [("+" + pkgs.writeShellScript "transmission-prestart" ''
-      serviceConfig.ExecStart = "${pkgs.transmission}/bin/transmission-daemon -f --port ${toString config.services.transmission.port} --config-dir ${settingsDir}";
+          set -eu${lib.optionalString (cfg.settings.message-level >= 3) "x"}
-      serviceConfig.ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          ${pkgs.jq}/bin/jq --slurp add ${settingsFile} '${cfg.credentialsFile}' |
-      serviceConfig.User = cfg.user;
+          install -D -m 600 -o '${cfg.user}' -g '${cfg.group}' /dev/stdin \
-      serviceConfig.Group = cfg.group;
+           '${cfg.home}/${settingsDir}/settings.json'
-      # NOTE: transmission has an internal umask that also must be set (in settings.json)
+        '')];
-      serviceConfig.UMask = "0002";
+        ExecStart="${pkgs.transmission}/bin/transmission-daemon -f";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        User = cfg.user;
+        Group = cfg.group;
+        # Create rootDir in the host's mount namespace.
+        RuntimeDirectory = [(baseNameOf rootDir)];
+        RuntimeDirectoryMode = "755";
+        # Avoid mounting rootDir in the own rootDir of ExecStart='s mount namespace.
+        InaccessiblePaths = ["-+${rootDir}"];
+        # This is for BindPaths= and BindReadOnlyPaths=
+        # to allow traversal of directories they create in RootDirectory=.
+        UMask = "0066";
+        # Using RootDirectory= makes it possible
+        # to use the same paths download-dir/incomplete-dir
+        # (which appear in user's interfaces) without requiring cfg.user
+        # to have access to their parent directories,
+        # by using BindPaths=/BindReadOnlyPaths=.
+        # Note that TemporaryFileSystem= could have been used instead
+        # but not without adding some BindPaths=/BindReadOnlyPaths=
+        # that would only be needed for ExecStartPre=,
+        # because RootDirectoryStartOnly=true would not help.
+        RootDirectory = rootDir;
+        RootDirectoryStartOnly = true;
+        MountAPIVFS = true;
+        BindPaths =
+          [ "${cfg.home}/${settingsDir}"
+            cfg.settings.download-dir
+          ] ++
+          optional cfg.settings.incomplete-dir-enabled
+            cfg.settings.incomplete-dir;
+        BindReadOnlyPaths = [
+          # No confinement done of /nix/store here like in systemd-confinement.nix,
+          # an AppArmor profile is provided to get a confinement based upon paths and rights.
+          builtins.storeDir
+          "-/etc/hosts"
+          "-/etc/ld-nix.so.preload"
+          "-/etc/localtime"
+          ] ++
+          optional (cfg.settings.script-torrent-done-enabled &&
+                    cfg.settings.script-torrent-done-filename != "")
+            cfg.settings.script-torrent-done-filename;
+        # The following options are only for optimizing:
+        # systemd-analyze security transmission
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateNetwork = mkDefault false;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        # ProtectHome=true would not allow BindPaths= to work accross /home,
+        # and ProtectHome=tmpfs would break statfs(),
+        # preventing transmission-daemon to report the available free space.
+        # However, RootDirectory= is used, so this is not a security concern
+        # since there would be nothing in /home but any BindPaths= wanted by the user.
+        ProtectHome = "read-only";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        # AF_UNIX may become usable one day:
+        # https://github.com/transmission/transmission/issues/441
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = [
+          "@system-service"
+          # Groups in @system-service which do not contain a syscall
+          # listed by perf stat -e 'syscalls:sys_enter_*' transmission-daemon -f
+          # in tests, and seem likely not necessary for transmission-daemon.
+          "~@aio" "~@chown" "~@keyring" "~@memlock" "~@resources" "~@setuid" "~@timer"
+          # In the @privileged group, but reached when querying infos through RPC (eg. with stig).
+          "quotactl"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+      };
     };
 
     # It's useful to have transmission in path, e.g. for remote control
@@ -133,70 +285,153 @@ in
 
     users.users = optionalAttrs (cfg.user == "transmission") ({
       transmission = {
-        name = "transmission";
         group = cfg.group;
         uid = config.ids.uids.transmission;
         description = "Transmission BitTorrent user";
-        home = homeDir;
+        home = cfg.home;
-        createHome = true;
       };
     });
 
     users.groups = optionalAttrs (cfg.group == "transmission") ({
       transmission = {
-        name = "transmission";
         gid = config.ids.gids.transmission;
       };
     });
 
-    # AppArmor profile
+    networking.firewall = mkIf cfg.openFirewall (
+      if cfg.settings.peer-port-random-on-start
+      then
+        { allowedTCPPortRanges =
+            [ { from = cfg.settings.peer-port-random-low;
+                to   = cfg.settings.peer-port-random-high;
+              }
+            ];
+          allowedUDPPortRanges =
+            [ { from = cfg.settings.peer-port-random-low;
+                to   = cfg.settings.peer-port-random-high;
+              }
+            ];
+        }
+      else
+        { allowedTCPPorts = [ cfg.settings.peer-port ];
+          allowedUDPPorts = [ cfg.settings.peer-port ];
+        }
+    );
+
+    boot.kernel.sysctl = mkMerge [
+      # Transmission uses a single UDP socket in order to implement multiple uTP sockets,
+      # and thus expects large kernel buffers for the UDP socket,
+      # https://trac.transmissionbt.com/browser/trunk/libtransmission/tr-udp.c?rev=11956.
+      # at least up to the values hardcoded here:
+      (mkIf cfg.settings.utp-enabled {
+        "net.core.rmem_max" = mkDefault "4194304"; # 4MB
+        "net.core.wmem_max" = mkDefault "1048576"; # 1MB
+      })
+      (mkIf cfg.performanceNetParameters {
+        # Increase the number of available source (local) TCP and UDP ports to 49151.
+        # Usual default is 32768 60999, ie. 28231 ports.
+        # Find out your current usage with: ss -s
+        "net.ipv4.ip_local_port_range" = "16384 65535";
+        # Timeout faster generic TCP states.
+        # Usual default is 600.
+        # Find out your current usage with: watch -n 1 netstat -nptuo
+        "net.netfilter.nf_conntrack_generic_timeout" = 60;
+        # Timeout faster established but inactive connections.
+        # Usual default is 432000.
+        "net.netfilter.nf_conntrack_tcp_timeout_established" = 600;
+        # Clear immediately TCP states after timeout.
+        # Usual default is 120.
+        "net.netfilter.nf_conntrack_tcp_timeout_time_wait" = 1;
+        # Increase the number of trackable connections.
+        # Usual default is 262144.
+        # Find out your current usage with: conntrack -C
+        "net.netfilter.nf_conntrack_max" = 1048576;
+      })
+    ];
+
     security.apparmor.profiles = mkIf apparmor [
       (pkgs.writeText "apparmor-transmission-daemon" ''
-        #include <tunables/global>
+        include <tunables/global>
 
         ${pkgs.transmission}/bin/transmission-daemon {
-          #include <abstractions/base>
+          include <abstractions/base>
-          #include <abstractions/nameservice>
+          include <abstractions/nameservice>
 
-          ${getLib pkgs.glibc}/lib/*.so                    mr,
+          # NOTE: https://github.com/NixOS/nixpkgs/pull/93457
-          ${getLib pkgs.libevent}/lib/libevent*.so*        mr,
+          # will remove the need for these by fixing <abstractions/base>
-          ${getLib pkgs.curl}/lib/libcurl*.so*             mr,
+          r ${etc."hosts".source},
-          ${getLib pkgs.openssl}/lib/libssl*.so*           mr,
+          r /etc/ld-nix.so.preload,
-          ${getLib pkgs.openssl}/lib/libcrypto*.so*        mr,
+          ${lib.optionalString (builtins.hasAttr "ld-nix.so.preload" etc) ''
-          ${getLib pkgs.zlib}/lib/libz*.so*                mr,
+            r ${etc."ld-nix.so.preload".source},
-          ${getLib pkgs.libssh2}/lib/libssh2*.so*          mr,
+            ${concatMapStrings (p: optionalString (p != "") ("mr ${p},\n"))
-          ${getLib pkgs.systemd}/lib/libsystemd*.so*       mr,
+              (splitString "\n" config.environment.etc."ld-nix.so.preload".text)}
-          ${getLib pkgs.xz}/lib/liblzma*.so*               mr,
-          ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*      mr,
-          ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so* mr,
-          ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*       mr,
-          ${getLib pkgs.c-ares}/lib/libcares*.so*          mr,
-          ${getLib pkgs.libcap}/lib/libcap*.so*            mr,
-          ${getLib pkgs.attr}/lib/libattr*.so*             mr,
-          ${getLib pkgs.lz4}/lib/liblz4*.so*               mr,
-          ${getLib pkgs.libkrb5}/lib/lib*.so*              mr,
-          ${getLib pkgs.keyutils}/lib/libkeyutils*.so*     mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so.* mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so.* mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so.* mr,
-          ${getLib pkgs.gcc.cc.lib}/lib/libstdc++.so.* mr,
-          ${getLib pkgs.gcc.cc.lib}/lib/libgcc_s.so.* mr,
-
-          @{PROC}/sys/kernel/random/uuid   r,
-          @{PROC}/sys/vm/overcommit_memory r,
-
-          ${pkgs.openssl.out}/etc/**                     r,
-          ${pkgs.transmission}/share/transmission/** r,
-
-          owner ${settingsDir}/** rw,
-
-          ${fullSettings.download-dir}/** rw,
-          ${optionalString fullSettings.incomplete-dir-enabled ''
-            ${fullSettings.incomplete-dir}/** rw,
           ''}
+          r ${etc."ssl/certs/ca-certificates.crt".source},
+          r ${pkgs.tzdata}/share/zoneinfo/**,
+          r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+          r ${pkgs.stdenv.cc.libc}/share/locale/**,
+
+          mr ${getLib pkgs.stdenv.cc.cc}/lib/*.so*,
+          mr ${getLib pkgs.stdenv.cc.libc}/lib/*.so*,
+          mr ${getLib pkgs.attr}/lib/libattr*.so*,
+          mr ${getLib pkgs.c-ares}/lib/libcares*.so*,
+          mr ${getLib pkgs.curl}/lib/libcurl*.so*,
+          mr ${getLib pkgs.keyutils}/lib/libkeyutils*.so*,
+          mr ${getLib pkgs.libcap}/lib/libcap*.so*,
+          mr ${getLib pkgs.libevent}/lib/libevent*.so*,
+          mr ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*,
+          mr ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so*,
+          mr ${getLib pkgs.libkrb5}/lib/lib*.so*,
+          mr ${getLib pkgs.libssh2}/lib/libssh2*.so*,
+          mr ${getLib pkgs.lz4}/lib/liblz4*.so*,
+          mr ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*,
+          mr ${getLib pkgs.openssl}/lib/libcrypto*.so*,
+          mr ${getLib pkgs.openssl}/lib/libssl*.so*,
+          mr ${getLib pkgs.systemd}/lib/libsystemd*.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so*,
+          mr ${getLib pkgs.xz}/lib/liblzma*.so*,
+          mr ${getLib pkgs.zlib}/lib/libz*.so*,
+
+          r @{PROC}/sys/kernel/random/uuid,
+          r @{PROC}/sys/vm/overcommit_memory,
+          # @{pid} is not a kernel variable yet but a regexp
+          #r @{PROC}/@{pid}/environ,
+          r @{PROC}/@{pid}/mounts,
+          rwk /tmp/tr_session_id_*,
+
+          r ${pkgs.openssl.out}/etc/**,
+          r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
+          r ${pkgs.transmission}/share/transmission/**,
+
+          owner rw ${cfg.home}/${settingsDir}/**,
+          rw ${cfg.settings.download-dir}/**,
+          ${optionalString cfg.settings.incomplete-dir-enabled ''
+            rw ${cfg.settings.incomplete-dir}/**,
+          ''}
+          profile dirs {
+            rw ${cfg.settings.download-dir}/**,
+            ${optionalString cfg.settings.incomplete-dir-enabled ''
+              rw ${cfg.settings.incomplete-dir}/**,
+            ''}
+          }
+
+          ${optionalString (cfg.settings.script-torrent-done-enabled &&
+                            cfg.settings.script-torrent-done-filename != "") ''
+            # Stack transmission_directories profile on top of
+            # any existing profile for script-torrent-done-filename
+            # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
+            # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
+            px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+          ''}
+
+          # FIXME: enable customizing using https://github.com/NixOS/nixpkgs/pull/93457
+          # include <local/transmission-daemon>
         }
       '')
     ];
   };
 
+  meta.maintainers = with lib.maintainers; [ julm ];
 }

nixos/modules/services/web-apps/dokuwiki.nix

@@ -95,7 +95,7 @@ let
 
       aclFile = mkOption {
         type = with types; nullOr str;
-        default = if (config.aclUse && config.acl == null) then "/var/lib/dokuwiki/${name}/users.auth.php" else null;
+        default = if (config.aclUse && config.acl == null) then "/var/lib/dokuwiki/${name}/acl.auth.php" else null;
         description = ''
           Location of the dokuwiki acl rules. Mutually exclusive with services.dokuwiki.acl
           Mutually exclusive with services.dokuwiki.acl which is preferred.

nixos/modules/services/web-apps/nextcloud.nix

@@ -45,6 +45,12 @@ let
   inherit (config.system) stateVersion;
 
 in {
+
+  imports = [
+    ( mkRemovedOptionModule [ "services" "nextcloud" "nginx" "enable" ]
+      "The nextcloud module dropped support for other webservers than nginx.")
+  ];
+
   options.services.nextcloud = {
     enable = mkEnableOption "nextcloud";
     hostName = mkOption {
@@ -91,16 +97,6 @@ in {
       '';
     };
 
-    nginx.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to enable nginx virtual host management.
-        Further nginx configuration can be done by adapting <literal>services.nginx.virtualHosts.&lt;name&gt;</literal>.
-        See <xref linkend="opt-services.nginx.virtualHosts"/> for further information.
-      '';
-    };
-
     webfinger = mkOption {
       type = types.bool;
       default = false;
@@ -468,10 +464,18 @@ in {
           script = ''
             chmod og+x ${cfg.home}
             ln -sf ${cfg.package}/apps ${cfg.home}/
-            mkdir -p ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps
-            ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php
 
-            chown -R nextcloud:nginx ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps
+            # create nextcloud directories.
+            # if the directories exist already with wrong permissions, we fix that
+            for dir in ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps; do
+              if [ ! -e $dir ]; then
+                install -o nextcloud -g nextcloud -d $dir
+              elif [ $(stat -c "%G" $dir) != "nextcloud" ]; then
+                chgrp -R nextcloud $dir
+              fi
+            done
+
+            ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php
 
             # Do not install if already installed
             if [[ ! -e ${cfg.home}/config/config.php ]]; then
@@ -484,6 +488,7 @@ in {
             ${occSetTrustedDomainsCmd}
           '';
           serviceConfig.Type = "oneshot";
+          serviceConfig.User = "nextcloud";
         };
         nextcloud-cron = {
           environment.NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config";
@@ -502,7 +507,7 @@ in {
       services.phpfpm = {
         pools.nextcloud = {
           user = "nextcloud";
-          group = "nginx";
+          group = "nextcloud";
           phpOptions = phpOptionsStr;
           phpPackage = phpPackage;
           phpEnv = {
@@ -510,27 +515,25 @@ in {
             PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin";
           };
           settings = mapAttrs (name: mkDefault) {
-            "listen.owner" = "nginx";
+            "listen.owner" = config.services.nginx.user;
-            "listen.group" = "nginx";
+            "listen.group" = config.services.nginx.group;
           } // cfg.poolSettings;
           extraConfig = cfg.poolConfig;
         };
       };
 
-      users.extraUsers.nextcloud = {
+      users.users.nextcloud = {
         home = "${cfg.home}";
-        group = "nginx";
+        group = "nextcloud";
         createHome = true;
       };
+      users.groups.nextcloud.members = [ "nextcloud" config.services.nginx.user ];
 
       environment.systemPackages = [ occ ];
-    }
 
-    (mkIf cfg.nginx.enable {
+      services.nginx = mkDefault {
-      services.nginx = {
         enable = true;
-        virtualHosts = {
+        virtualHosts.${cfg.hostName} = {
-          ${cfg.hostName} = {
           root = cfg.package;
           locations = {
             "= /robots.txt" = {
@@ -630,8 +633,7 @@ in {
           '';
         };
       };
-      };
+    }
-    })
   ]);
 
   meta.doc = ./nextcloud.xml;

nixos/modules/services/web-apps/nextcloud.xml

@@ -29,7 +29,6 @@
   services.nextcloud = {
     <link linkend="opt-services.nextcloud.enable">enable</link> = true;
     <link linkend="opt-services.nextcloud.hostName">hostName</link> = "nextcloud.tld";
-    <link linkend="opt-services.nextcloud.nginx.enable">nginx.enable</link> = true;
     config = {
       <link linkend="opt-services.nextcloud.config.dbtype">dbtype</link> = "pgsql";
       <link linkend="opt-services.nextcloud.config.dbuser">dbuser</link> = "nextcloud";
@@ -61,9 +60,8 @@
   </para>
 
   <para>
-   The options <literal>hostName</literal> and <literal>nginx.enable</literal>
+   The <literal>hostName</literal> option is used internally to configure an HTTP
-   are used internally to configure an HTTP server using
+   server using <literal><link xlink:href="https://php-fpm.org/">PHP-FPM</link></literal>
-   <literal><link xlink:href="https://php-fpm.org/">PHP-FPM</link></literal>
    and <literal>nginx</literal>. The <literal>config</literal> attribute set is
    used by the imperative installer and all values are written to an additional file
    to ensure that changes can be applied by changing the module's options.

nixos/modules/system/boot/systemd.nix

@@ -73,7 +73,7 @@ let
       "systemd-journald.service"
       "systemd-journal-flush.service"
       "systemd-journal-catalog-update.service"
-      "systemd-journald-audit.socket"
+      ] ++ (optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
       "systemd-journald-dev-log.socket"
       "syslog.socket"
 
@@ -101,7 +101,7 @@ let
       "dev-hugepages.mount"
       "dev-mqueue.mount"
       "sys-fs-fuse-connections.mount"
-      "sys-kernel-config.mount"
+      ] ++ (optional (!config.boot.isContainer) "sys-kernel-config.mount") ++ [
       "sys-kernel-debug.mount"
 
       # Maintaining state across reboots.

nixos/modules/tasks/auto-upgrade.nix

@@ -2,9 +2,9 @@
 
 with lib;
 
-let cfg = config.system.autoUpgrade; in
+let cfg = config.system.autoUpgrade;
 
-{
+in {
 
   options = {
 
@@ -21,6 +21,16 @@ let cfg = config.system.autoUpgrade; in
         '';
       };
 
+      flake = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "github:kloenk/nix";
+        description = ''
+          The Flake URI of the NixOS configuration to build.
+          Disables the option <option>system.autoUpgrade.channel</option>.
+        '';
+      };
+
       channel = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -35,10 +45,20 @@ let cfg = config.system.autoUpgrade; in
 
       flags = mkOption {
         type = types.listOf types.str;
-        default = [];
+        default = [ ];
-        example = [ "-I" "stuff=/home/alice/nixos-stuff" "--option" "extra-binary-caches" "http://my-cache.example.org/" ];
+        example = [
+          "-I"
+          "stuff=/home/alice/nixos-stuff"
+          "--option"
+          "extra-binary-caches"
+          "http://my-cache.example.org/"
+        ];
         description = ''
           Any additional flags passed to <command>nixos-rebuild</command>.
+
+          If you are using flakes and use a local repo you can add
+          <command>[ "--update-input" "nixpkgs" "--commit-lock-file" ]</command>
+          to update nixpkgs.
         '';
       };
 
@@ -82,11 +102,23 @@ let cfg = config.system.autoUpgrade; in
 
   config = lib.mkIf cfg.enable {
 
-    system.autoUpgrade.flags =
+    assertions = [{
-      [ "--no-build-output" ]
+      assertion = !((cfg.channel != null) && (cfg.flake != null));
-      ++ (if cfg.channel == null
+      message = ''
-          then [ "--upgrade" ]
+        The options 'system.autoUpgrade.channels' and 'system.autoUpgrade.flake' cannot both be set.
-          else [ "-I" "nixpkgs=${cfg.channel}/nixexprs.tar.xz" ]);
+      '';
+    }];
+
+    system.autoUpgrade.flags = [ "--no-build-output" ]
+      ++ (if cfg.flake == null then
+        (if cfg.channel == null then
+          [ "--upgrade" ]
+        else [
+          "-I"
+          "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
+        ])
+      else
+        [ "--flake ${cfg.flake}" ]);
 
     systemd.services.nixos-upgrade = {
       description = "NixOS Upgrade";
@@ -96,17 +128,24 @@ let cfg = config.system.autoUpgrade; in
 
       serviceConfig.Type = "oneshot";
 
-      environment = config.nix.envVars //
+      environment = config.nix.envVars // {
-        { inherit (config.environment.sessionVariables) NIX_PATH;
+        inherit (config.environment.sessionVariables) NIX_PATH;
         HOME = "/root";
       } // config.networking.proxy.envVars;
 
-      path = with pkgs; [ coreutils gnutar xz.bin gzip gitMinimal config.nix.package.out ];
+      path = with pkgs; [
+        coreutils
+        gnutar
+        xz.bin
+        gzip
+        gitMinimal
+        config.nix.package.out
+      ];
 
       script = let
-          nixos-rebuild = "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
+        nixos-rebuild =
-        in
+          "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
-        if cfg.allowReboot then ''
+      in if cfg.allowReboot then ''
         ${nixos-rebuild} boot ${toString cfg.flags}
         booted="$(readlink /run/booted-system/{initrd,kernel,kernel-modules})"
         built="$(readlink /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
@@ -122,7 +161,8 @@ let cfg = config.system.autoUpgrade; in
       startAt = cfg.dates;
     };
 
-    systemd.timers.nixos-upgrade.timerConfig.RandomizedDelaySec = cfg.randomizedDelaySec;
+    systemd.timers.nixos-upgrade.timerConfig.RandomizedDelaySec =
+      cfg.randomizedDelaySec;
 
   };
 

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -253,8 +253,8 @@ let
 
         createTunDevice = i: nameValuePair "${i.name}-netdev"
           { description = "Virtual Network Interface ${i.name}";
-            bindsTo = [ "dev-net-tun.device" ];
+            bindsTo = optional (!config.boot.isContainer) "dev-net-tun.device";
-            after = [ "dev-net-tun.device" "network-pre.target" ];
+            after = optional (!config.boot.isContainer) "dev-net-tun.device" ++ [ "network-pre.target" ];
             wantedBy = [ "network-setup.service" (subsystemDevice i.name) ];
             partOf = [ "network-setup.service" ];
             before = [ "network-setup.service" ];

nixos/modules/virtualisation/railcar.nix

@@ -46,7 +46,7 @@ let
         description = ''
           Mount options of the filesystem to be used.
 
-          Support optoions are listed in the mount(8) man page. Note that 
+          Support options are listed in the mount(8) man page. Note that
           both filesystem-independent and filesystem-specific options
           are listed.
         '';

nixos/tests/bittorrent.nix

@@ -19,6 +19,7 @@ let
   externalClient2Address = "80.100.100.2";
   externalTrackerAddress = "80.100.100.3";
 
+  download-dir = "/var/lib/transmission/Downloads";
   transmissionConfig = { ... }: {
     environment.systemPackages = [ pkgs.transmission ];
     services.transmission = {
@@ -26,6 +27,7 @@ let
       settings = {
         dht-enabled = false;
         message-level = 3;
+        inherit download-dir;
       };
     };
   };
@@ -117,12 +119,12 @@ in
       router.wait_for_unit("miniupnpd")
 
       # Create the torrent.
-      tracker.succeed("mkdir /tmp/data")
+      tracker.succeed("mkdir ${download-dir}/data")
       tracker.succeed(
-          "cp ${file} /tmp/data/test.tar.bz2"
+          "cp ${file} ${download-dir}/data/test.tar.bz2"
       )
       tracker.succeed(
-          "transmission-create /tmp/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
+          "transmission-create ${download-dir}/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
       )
       tracker.succeed("chmod 644 /tmp/test.torrent")
 
@@ -133,18 +135,16 @@ in
 
       # Start the initial seeder.
       tracker.succeed(
-          "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir /tmp/data"
+          "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir ${download-dir}/data"
       )
 
       # Now we should be able to download from the client behind the NAT.
       tracker.wait_for_unit("httpd")
       client1.wait_for_unit("network-online.target")
+      client1.succeed("transmission-remote --add http://${externalTrackerAddress}/test.torrent >&2 &")
+      client1.wait_for_file("${download-dir}/test.tar.bz2")
       client1.succeed(
-          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --download-dir /tmp >&2 &"
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
-      )
-      client1.wait_for_file("/tmp/test.tar.bz2")
-      client1.succeed(
-          "cmp /tmp/test.tar.bz2 ${file}"
       )
 
       # Bring down the initial seeder.
@@ -154,11 +154,11 @@ in
       # the first client created a NAT hole in the router.
       client2.wait_for_unit("network-online.target")
       client2.succeed(
-          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht --download-dir /tmp >&2 &"
+          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht >&2 &"
       )
-      client2.wait_for_file("/tmp/test.tar.bz2")
+      client2.wait_for_file("${download-dir}/test.tar.bz2")
       client2.succeed(
-          "cmp /tmp/test.tar.bz2 ${file}"
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
       )
     '';
 })

nixos/tests/nextcloud/basic.nix

@@ -33,7 +33,6 @@ in {
 
       services.nextcloud = {
         enable = true;
-        nginx.enable = true;
         hostName = "nextcloud";
         config = {
           # Don't inherit adminuser since "root" is supposed to be the default

nixos/tests/nextcloud/with-mysql-and-memcached.nix

@@ -17,7 +17,6 @@ in {
       services.nextcloud = {
         enable = true;
         hostName = "nextcloud";
-        nginx.enable = true;
         https = true;
         caching = {
           apcu = true;

nixos/tests/nextcloud/with-postgresql-and-redis.nix

@@ -17,7 +17,6 @@ in {
       services.nextcloud = {
         enable = true;
         hostName = "nextcloud";
-        nginx.enable = true;
         caching = {
           apcu = false;
           redis = true;

nixos/tests/postgresql-wal-receiver.nix

@@ -28,6 +28,10 @@ let
     meta.maintainers = with maintainers; [ pacien ];
 
     machine = { ... }: {
+      # Needed because this test uses a non-default 'services.postgresql.dataDir'.
+      systemd.tmpfiles.rules = [
+        "d /var/db/postgresql 0700 postgres postgres"
+      ];
       services.postgresql = {
         package = postgresqlPackage;
         enable = true;

pkgs/applications/audio/a2jmidid/default.nix

@@ -9,7 +9,7 @@ in stdenv.mkDerivation {
   version = "8";
 
   src = fetchurl {
-    url = "https://repo.or.cz/a2jmidid.git/snapshot/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
+    url = "https://github.com/linuxaudio/a2jmidid/archive/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
     sha256 = "06dgf5655znbvrd7fhrv8msv6zw8vk0hjqglcqkh90960mnnmwz7";
   };
 
@@ -18,13 +18,17 @@ in stdenv.mkDerivation {
 
   patches = [
     (fetchpatch {
-      url = "https://repo.or.cz/a2jmidid.git/patch/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2";
+      url = "https://github.com/linuxaudio/a2jmidid/commit/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2.diff";
       sha256 = "1nxrvnhxlgqc9wbxnp1gnpw4wjyzxvymwcg1gh2nqzmssgfykfkc";
     })
     (fetchpatch {
-      url = "https://repo.or.cz/a2jmidid.git/patch/7f82da7eb2f540a94db23331be98d42a58ddc269";
+      url = "https://github.com/linuxaudio/a2jmidid/commit/7f82da7eb2f540a94db23331be98d42a58ddc269.diff";
       sha256 = "1nab9zf0agbcj5pvhl90pz0cx1d204d4janqflc5ymjhy8jyrsdv";
     })
+    (fetchpatch {
+      url = "https://github.com/linuxaudio/a2jmidid/commit/c07775d021a71cb91bf64ce1391cf525415cb060.diff";
+      sha256 = "172v9hri03qdqi8a3zsg227k5qxldd8v5bj4jk7fyk5jf50fcxga";
+    })
   ];
 
   postInstall = ''
@@ -35,6 +39,6 @@ in stdenv.mkDerivation {
     description = "Daemon for exposing legacy ALSA sequencer applications in JACK MIDI system";
     license = licenses.gpl2;
     maintainers = [ maintainers.goibhniu ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
   };
 }

pkgs/applications/audio/adlplug/default.nix

@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, libjack2, alsaLib
 , freetype, libX11, libXrandr, libXinerama, libXext, libXcursor
-, fetchpatch
+, fetchpatch, fmt
 , adlplugChip ? "-DADLplug_CHIP=OPL3"
 , pname ? "ADLplug" }:
 
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "jpcima";
     repo = "ADLplug";
     rev = "v${version}";
-    sha256 = "0n9srdlgl1j528ap5xmllrqs1w6ibc5yf9sphvl1q9kjnizxrs2c";
+    sha256 = "0mqx4bzri8s880v7jwd24nb93m5i3aklqld0b3h0hjnz0lh2qz0f";
     fetchSubmodules = true;
   };
 
@@ -25,13 +25,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  cmakeFlags = [ adlplugChip ];
+  cmakeFlags = [ adlplugChip "-DADLplug_USE_SYSTEM_FMT=ON" ];
 
   buildInputs = [
     libjack2 alsaLib freetype libX11 libXrandr libXinerama libXext
     libXcursor
   ];
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig fmt ];
 
   meta = with stdenv.lib; {
     description = "OPL3 and OPN2 FM Chip Synthesizer";

pkgs/applications/audio/giada/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "giada";
-  version = "0.16.3";
+  version = "0.16.3.1";
 
   src = fetchFromGitHub {
     owner = "monocasual";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1sysv5d0wq6ib47bqsn3wdzkqzjpzjrgzg15bkllbm67hiz9abhh";
+    sha256 = "0z1jrkggdn630i3j59j30apaa9s242y1wiawqp4g1n9dkg3r9a1j";
   };
 
   configureFlags = [

pkgs/applications/audio/mellowplayer/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "MellowPlayer";
-  version = "3.6.4";
+  version = "3.6.5";
 
   src = fetchFromGitLab {
     owner = "ColinDuquesnoy";
     repo = "MellowPlayer";
     rev = version;
-    sha256 = "1ss7s3kal4vzhz7ld0yy2kvp1rk2w3i6fya0z3xd7nff9p31gqvw";
+    sha256 = "1fnfqyy52hnh9vwq4rcndcqwh0zsm1sd3vi4h5gzaj4zbniq5v2f";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];

pkgs/applications/audio/musikcube/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.92.1";
+  version = "0.93.1";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "0l4ncxqxvp5m014j7vlglhzxhhrxl0c2m71xn0i0a27hn4nc72mr";
+    sha256 = "05qsxyr7x8l0vlmn4yjg4gglxvcw9raf6vfzvblsl2ngsdsrnizy";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/yasr/default.nix

@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    ./10_fix_openpty_forkpty_declarations
+    ./10_fix_openpty_forkpty_declarations.patch
-    ./20_maxpathlen
+    ./20_maxpathlen.patch
-    ./30_conf
+    ./30_conf.patch
-    ./40_dectalk_extended_chars
+    ./40_dectalk_extended_chars.patch
   ]; # taken from the debian yasr package
 
   meta = {

pkgs/applications/blockchains/bitcoin-abc.nix

@@ -7,13 +7,13 @@ with stdenv.lib;
 mkDerivation rec {
 
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.21.10";
+  version = "0.21.12";
 
   src = fetchFromGitHub {
     owner = "bitcoin-ABC";
     repo = "bitcoin-abc";
     rev = "v${version}";
-    sha256 = "1m210g6db8f09m66v75ia1fdd1dlvs1srgk2jhd3wqbvnmjqa77f";
+    sha256 = "1mad3aqfwrxi06135nf8hv13d67nilmxpx4dw5vjcy1zi3lljj1j";
   };
 
   patches = [ ./fix-bitcoin-qt-build.patch ];

pkgs/applications/editors/jetbrains/default.nix

@@ -224,7 +224,8 @@ let
         interpreter=$(echo ${stdenv.glibc.out}/lib/ld-linux*.so.2)
         patchelf --set-interpreter "$interpreter" lib/ReSharperHost/linux-x64/mono/bin/mono-sgen
         rm -rf lib/ReSharperHost/linux-x64/dotnet
-        ln -s ${dotnet-sdk_3} lib/ReSharperHost/linux-x64/dotnet
+        mkdir -p lib/ReSharperHost/linux-x64/dotnet/
+        ln -s ${dotnet-sdk_3}/bin/dotnet lib/ReSharperHost/linux-x64/dotnet/dotnet
       '');
     });
 

pkgs/applications/editors/neovim/default.nix

@@ -23,13 +23,13 @@ let
 in
   stdenv.mkDerivation rec {
     pname = "neovim-unwrapped";
-    version = "0.4.3";
+    version = "0.4.4";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
       rev = "v${version}";
-      sha256 = "03p7pic7hw9yxxv7fbgls1f42apx3lik2k6mpaz1a109ngyc5kaj";
+      sha256 = "11zyj6jvkwas3n6w1ckj3pk6jf81z1g7ngg4smmwm7c27y2a6f2m";
     };
 
     patches = [

pkgs/applications/editors/okteta/default.nix

@@ -4,11 +4,11 @@
 
 mkDerivation rec {
   pname = "okteta";
-  version = "0.26.3";
+  version = "0.26.4";
 
   src = fetchurl {
     url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1454844s76skk18gpcf56y9pkmffs7p4z09ggmy37ifzf7yk1p19";
+    sha256 = "00qgzm5mqx0j8f0fznhnw76l9pjyw3lxirvy8ssq59nqqjbb08pg";
   };
 
   nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];

pkgs/applications/kde/marble.nix

@@ -1,6 +1,6 @@
 { mkDerivation, lib
 , extra-cmake-modules, kdoctools
-, qtscript, qtsvg, qtquickcontrols, qtwebkit
+, qtscript, qtsvg, qtquickcontrols, qtwebengine
 , krunner, shared-mime-info, kparts, knewstuff
 , gpsd, perl
 }:
@@ -11,7 +11,7 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
   propagatedBuildInputs = [
-    qtscript qtsvg qtquickcontrols qtwebkit shared-mime-info krunner kparts
+    qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
     knewstuff gpsd
   ];
   preConfigure = ''

pkgs/applications/misc/ArchiSteamFarm/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.3.3";
+  version = "4.2.3.6";
 
   src = fetchurl {
     url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
-    sha256 = "0v69rrs5fr1n5llfx42xkiish52al7kb36fjy3ng0j9qfp3g8pj7";
+    sha256 = "1a8baxrb8czndxxi16md1nyl2snfx215yvrygdpcblgngkp2z2y9";
   };
 
   nativeBuildInputs = [ unzip makeWrapper jq ];
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
       --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
       --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
       --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
-      --run "[ -d www ] || ln -sf $dist/www ."
+      --run "ln -sf $dist/www ."
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/misc/calibre/default.nix

@@ -30,11 +30,11 @@ let
 in
 mkDerivation rec {
   pname = "calibre";
-  version = "4.19.0";
+  version = "4.22.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1kpj65spwr9m88vshsljpdrw5jy7bbpqgqcrvqb17abh7fnnrb4x";
+    sha256 = "0d0wmd3ijk8px1d662igal4lfmpyzynfzs6ms1bb9nf42mq2pxai";
   };
 
   patches = [

pkgs/applications/misc/kitty/default.nix

@@ -136,6 +136,6 @@ buildPythonApplication rec {
     license = licenses.gpl3;
     changelog = "https://sw.kovidgoyal.net/kitty/changelog.html";
     platforms = platforms.darwin ++ platforms.linux;
-    maintainers = with maintainers; [ tex rvolosatovs ma27 Luflosi ];
+    maintainers = with maintainers; [ tex rvolosatovs Luflosi ];
   };
 }

pkgs/applications/misc/minder/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minder";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "phase1geo";
     repo = pname;
     rev = version;
-    sha256 = "1j3jk76rd0sc9sd9zrd24q3636559wd809yfnb9bv5jmvn9s1bkz";
+    sha256 = "1823nl9hgsa9l04ra1drj3c7r8s5ybx6c06d9ijpwqz191sz2jg2";
   };
 
   nativeBuildInputs = [ pkgconfig meson ninja python3 wrapGAppsHook vala shared-mime-info ];

pkgs/applications/misc/redshift/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, gettext, intltool
+{ stdenv, fetchFromGitHub, fetchFromGitLab
+, autoconf, automake, gettext, intltool
 , libtool, pkgconfig, wrapGAppsHook, wrapPython, gobject-introspection
 , gtk3, python, pygobject3, pyxdg
 
@@ -18,11 +19,16 @@ let
     stdenv.mkDerivation rec {
       inherit pname version src meta;
 
-      patches = [
+      patches = stdenv.lib.optionals (pname != "gammastep") [
         # https://github.com/jonls/redshift/pull/575
         ./575.patch
       ];
 
+      postPatch = stdenv.lib.optionalString (pname == "gammastep") ''
+        substituteInPlace configure.ac \
+          --replace "[gammastep], [2.0]" "[gammastep], [${version}]"
+      '';
+
       nativeBuildInputs = [
         autoconf
         automake
@@ -62,10 +68,15 @@ let
 
       # the geoclue agent may inspect these paths and expect them to be
       # valid without having the correct $PATH set
-      postInstall = ''
+      postInstall = if (pname == "gammastep") then ''
+        substituteInPlace $out/share/applications/gammastep.desktop \
+          --replace 'Exec=gammastep' "Exec=$out/bin/gammastep"
+        substituteInPlace $out/share/applications/gammastep-indicator.desktop \
+          --replace 'Exec=gammastep-indicator' "Exec=$out/bin/gammastep-indicator"
+      '' else ''
         substituteInPlace $out/share/applications/redshift.desktop \
           --replace 'Exec=redshift' "Exec=$out/bin/redshift"
-        substituteInPlace $out/share/applications/redshift.desktop \
+        substituteInPlace $out/share/applications/redshift-gtk.desktop \
           --replace 'Exec=redshift-gtk' "Exec=$out/bin/redshift-gtk"
       '';
 
@@ -118,4 +129,24 @@ rec {
       homepage = "https://github.com/minus7/redshift";
     };
   };
+
+  gammastep = mkRedshift rec {
+    pname = "gammastep";
+    version = "2.0.1";
+
+    src = fetchFromGitLab {
+      owner = "chinstrap";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "1ky4h892sg2mfbwwq5xv0vnjflsl2x3nsy5q456r1kyk1gwkj0rg";
+    };
+
+    meta = redshift.meta // {
+      name = "${pname}-${version}";
+      longDescription = "Gammastep"
+        + stdenv.lib.removePrefix "Redshift" redshift.meta.longDescription;
+      homepage = "https://gitlab.com/chinstrap/gammastep";
+      maintainers = [ stdenv.lib.maintainers.primeos ] ++ redshift.meta.maintainers;
+    };
+  };
 }

pkgs/applications/misc/waybar/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, meson, pkgconfig, ninja, wrapGAppsHook
-, wayland, wlroots, gtkmm3, libinput, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
+, wayland, wlroots, gtkmm3, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
 , howard-hinnant-date, cmake
 , traySupport  ? true,  libdbusmenu-gtk3
 , pulseSupport ? false, libpulseaudio
@@ -11,13 +11,13 @@
 }:
   stdenv.mkDerivation rec {
     pname = "waybar";
-    version = "0.9.2";
+    version = "0.9.3";
 
     src = fetchFromGitHub {
       owner = "Alexays";
       repo = "Waybar";
       rev = version;
-      sha256 = "1gfxyjzwfqznyrpyr3322z3w844i1lh77kly4hcpy9y5gsfmlafy";
+      sha256 = "0ks719khhg2zwpyiwa2079i6962qcxpapm28hmr4ckpsp2n659ck";
     };
 
     nativeBuildInputs = [
@@ -32,7 +32,7 @@
     strictDeps = false;
 
     buildInputs = with stdenv.lib;
-      [ wayland wlroots gtkmm3 libinput libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
+      [ wayland wlroots gtkmm3 libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
       ++ optional  traySupport  libdbusmenu-gtk3
       ++ optional  pulseSupport libpulseaudio
       ++ optional  nlSupport    libnl

pkgs/applications/networking/cluster/argo/default.nix

@@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "156102xqwmsq3g9jammfib0ri22a0nzk96zrv5774gidjvy2xb55";
+    sha256 = "1x44mgvnbn47a33xnhnh9bxxvj1vsr32lvh9bq6w5hpmxb7qbq4f";
   };
 
   vendorSha256 = "1vqmzz76lcwwnw89n4lyg4jjf7wbdgn9sdzwsgrjwkj8ax7d48cv";

pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,15 +11,15 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.12.1";
+  version = "1.12.2";
 
-  vendorSha256 = "0v2lnzdv5nmg4jf10hqyvrsyz5yg7brm4p3gil7n88w6n100phfn";
+  vendorSha256 = "0smjj2sq09k1ai79lk74gi056hfls7qy8x08wkq2g24fxi06cr94";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "0ya6mp081vs48c0nh4nys9z04kz79mjfpm4gs0hlmh2kpa5kmc9h";
+    sha256 = "1x28s6d2nibm76qd3kjsa7wkyhqvnwdy9rfwk9xf45hzrx9700sm";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.23.31";
+  version = "0.23.32";
 
    src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wpb749hc6pbmxcba1k4yrwcg8547rnsskxb45bzqyqyj1nj775s";
+    sha256 = "1pa3k0hjdb5bj0bp4aj3lfcgz98l3wd9kfa12rn9zzbcmp087kih";
   };
 
   vendorSha256 = "1xn7c6y32vpanqvf1sfpw6bs73dbjniavjbf00j0vx83bfyklsr4";

pkgs/applications/networking/gopher/sacc/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, fetchgit, ncurses
+, patches ? [] # allow users to easily override config.def.h
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sacc";
+  version = "1.01";
+
+  src = fetchgit {
+    url = "git://bitreich.org/sacc";
+    rev = version;
+    sha256 = "0n6ghbi715m7hrxzqggx1bpqj8h7569s72b9bzk6m4gd29jaq9hz";
+  };
+
+  inherit patches;
+
+  buildInputs = [ ncurses ];
+
+  postPatch = ''
+    substituteInPlace config.mk \
+      --replace curses ncurses \
+      --replace "/usr/local" "$out"
+    '';
+
+  meta = with stdenv.lib; {
+    description = "A terminal gopher client";
+    homepage = "gopher://bitreich.org/1/scm/sacc";
+    license = licenses.isc;
+    maintainers = [ maintainers.sternenseemann ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -7,30 +7,30 @@ in {
     pname = "discord";
     binaryName = "Discord";
     desktopName = "Discord";
-    version = "0.0.10";
+    version = "0.0.11";
     src = fetchurl {
       url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-      sha256 = "0kx92i8naqr3algmyy3wyzbh8146z7gigxwf1nbpg1gl16wlplaq";
+      sha256 = "1saqwigi1gjgy4q8rgnwyni57aaszi0w9vqssgyvfgzff8fpcx54";
     };
   };
   ptb = callPackage ./base.nix rec {
     pname = "discord-ptb";
     binaryName = "DiscordPTB";
     desktopName = "Discord PTB";
-    version = "0.0.20";
+    version = "0.0.21";
     src = fetchurl {
       url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-      sha256 = "0wn2qdv0a4n59xl451y7fcq11klp2g63qwx40qkshllvnf5lzzsx";
+      sha256 = "1i164wpi07d45w19i7l5hs47crc29k3plg4y9kc97x75rhh4xym1";
     };
   };
   canary = callPackage ./base.nix rec {
     pname = "discord-canary";
     binaryName = "DiscordCanary";
     desktopName = "Discord Canary";
-    version = "0.0.105";
+    version = "0.0.106";
     src = fetchurl {
       url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-      sha256 = "1jc2zr8q33ras5mkifg19kcxpb84vsqx01rj66w62hsjw1nsbidg";
+      sha256 = "1bqlf7iixdy6c7lhbva4lizvhd6w0xqn69izxcy26wk35xcqgfh8";
     };
   };
 }.${branch}

pkgs/applications/networking/instant-messengers/element/element-desktop-package.json

@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "src/electron-main.js",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {
@@ -43,13 +43,10 @@
     "electron-devtools-installer": "^2.2.4",
     "electron-notarize": "^0.2.0",
     "eslint": "7.3.1",
-    "eslint-config-google": "^0.7.1",
     "eslint-config-matrix-org": "^0.1.2",
-    "eslint-plugin-babel": "^4.1.2",
     "find-npm-prefix": "^1.0.2",
     "fs-extra": "^8.1.0",
     "glob": "^7.1.6",
-    "matrix-js-sdk": "8.0.0",
     "mkdirp": "^1.0.3",
     "needle": "^2.5.0",
     "node-pre-gyp": "^0.15.0",

pkgs/applications/networking/instant-messengers/element/element-desktop-yarndeps.nix

@@ -97,14 +97,6 @@
         sha1 = "e7c6bf5a7deff957cec9f04b551e2762909d826b";
       };
     }
-    {
-      name = "_babel_runtime___runtime_7.9.2.tgz";
-      path = fetchurl {
-        name = "_babel_runtime___runtime_7.9.2.tgz";
-        url  = "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.9.2.tgz";
-        sha1 = "d90df0583a3a252f09aaa619665367bae518db06";
-      };
-    }
     {
       name = "_babel_template___template_7.10.4.tgz";
       path = fetchurl {
@@ -377,14 +369,6 @@
         sha1 = "c629c5eced17baf314437918d2da88c99d5958cd";
       };
     }
-    {
-      name = "another_json___another_json_0.2.0.tgz";
-      path = fetchurl {
-        name = "another_json___another_json_0.2.0.tgz";
-        url  = "https://registry.yarnpkg.com/another-json/-/another-json-0.2.0.tgz";
-        sha1 = "b5f4019c973b6dd5c6506a2d93469cb6d32aeedc";
-      };
-    }
     {
       name = "ansi_align___ansi_align_2.0.0.tgz";
       path = fetchurl {
@@ -705,14 +689,6 @@
         sha1 = "89b4d199ab2bee49de164ea02b89ce462d71b767";
       };
     }
-    {
-      name = "base_x___base_x_3.0.7.tgz";
-      path = fetchurl {
-        name = "base_x___base_x_3.0.7.tgz";
-        url  = "https://registry.yarnpkg.com/base-x/-/base-x-3.0.7.tgz";
-        sha1 = "1c5a7fafe8f66b4114063e8da102799d4e7c408f";
-      };
-    }
     {
       name = "base64_js___base64_js_1.3.1.tgz";
       path = fetchurl {
@@ -801,22 +777,6 @@
         sha1 = "3c7fcbf529d87226f3d2f52b966ff5271eb441dd";
       };
     }
-    {
-      name = "browser_request___browser_request_0.3.3.tgz";
-      path = fetchurl {
-        name = "browser_request___browser_request_0.3.3.tgz";
-        url  = "https://registry.yarnpkg.com/browser-request/-/browser-request-0.3.3.tgz";
-        sha1 = "9ece5b5aca89a29932242e18bf933def9876cc17";
-      };
-    }
-    {
-      name = "bs58___bs58_4.0.1.tgz";
-      path = fetchurl {
-        name = "bs58___bs58_4.0.1.tgz";
-        url  = "https://registry.yarnpkg.com/bs58/-/bs58-4.0.1.tgz";
-        sha1 = "be161e76c354f6f788ae4071f63f34e8c4f0a42a";
-      };
-    }
     {
       name = "buffer_crc32___buffer_crc32_0.2.13.tgz";
       path = fetchurl {
@@ -1281,14 +1241,6 @@
         sha1 = "fe8cf184ff6670b6baef01a9d4861a5cbec4120a";
       };
     }
-    {
-      name = "content_type___content_type_1.0.4.tgz";
-      path = fetchurl {
-        name = "content_type___content_type_1.0.4.tgz";
-        url  = "https://registry.yarnpkg.com/content-type/-/content-type-1.0.4.tgz";
-        sha1 = "e138cc75e040c727b1966fe5e5f8c9aee256fe3b";
-      };
-    }
     {
       name = "copy_concurrently___copy_concurrently_1.0.5.tgz";
       path = fetchurl {
@@ -1905,14 +1857,6 @@
         sha1 = "4f5f8759ba6e11b424294a219dbfa18c508bcc1a";
       };
     }
-    {
-      name = "eslint_config_google___eslint_config_google_0.7.1.tgz";
-      path = fetchurl {
-        name = "eslint_config_google___eslint_config_google_0.7.1.tgz";
-        url  = "https://registry.yarnpkg.com/eslint-config-google/-/eslint-config-google-0.7.1.tgz";
-        sha1 = "5598f8498e9e078420f34b80495b8d959f651fb2";
-      };
-    }
     {
       name = "eslint_config_matrix_org___eslint_config_matrix_org_0.1.2.tgz";
       path = fetchurl {
@@ -1961,14 +1905,6 @@
         sha1 = "579ebd094f56af7797d19c9866c9c9486629bfa6";
       };
     }
-    {
-      name = "eslint_plugin_babel___eslint_plugin_babel_4.1.2.tgz";
-      path = fetchurl {
-        name = "eslint_plugin_babel___eslint_plugin_babel_4.1.2.tgz";
-        url  = "https://registry.yarnpkg.com/eslint-plugin-babel/-/eslint-plugin-babel-4.1.2.tgz";
-        sha1 = "79202a0e35757dd92780919b2336f1fa2fe53c1e";
-      };
-    }
     {
       name = "eslint_plugin_babel___eslint_plugin_babel_5.3.1.tgz";
       path = fetchurl {
@@ -3697,14 +3633,6 @@
         sha1 = "e48ddedbe30b3321783c5b4301fbd353bc1e4a4b";
       };
     }
-    {
-      name = "loglevel___loglevel_1.6.6.tgz";
-      path = fetchurl {
-        name = "loglevel___loglevel_1.6.6.tgz";
-        url  = "https://registry.yarnpkg.com/loglevel/-/loglevel-1.6.6.tgz";
-        sha1 = "0ee6300cc058db6b3551fa1c4bf73b83bb771312";
-      };
-    }
     {
       name = "loose_envify___loose_envify_1.4.0.tgz";
       path = fetchurl {
@@ -3777,14 +3705,6 @@
         sha1 = "7d583a7306434c055fe474b0f45078e6e1b4b92a";
       };
     }
-    {
-      name = "matrix_js_sdk___matrix_js_sdk_8.0.0.tgz";
-      path = fetchurl {
-        name = "matrix_js_sdk___matrix_js_sdk_8.0.0.tgz";
-        url  = "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-8.0.0.tgz";
-        sha1 = "78efb071ed1f6430553a9d6937d7bcfbae24cce8";
-      };
-    }
     {
       name = "meant___meant_1.0.1.tgz";
       path = fetchurl {
@@ -4905,14 +4825,6 @@
         sha1 = "bb5b699ef7f9f0505092a3748be4464fe71b5819";
       };
     }
-    {
-      name = "qs___qs_6.9.1.tgz";
-      path = fetchurl {
-        name = "qs___qs_6.9.1.tgz";
-        url  = "https://registry.yarnpkg.com/qs/-/qs-6.9.1.tgz";
-        sha1 = "20082c65cb78223635ab1a9eaca8875a29bf8ec9";
-      };
-    }
     {
       name = "qs___qs_6.5.2.tgz";
       path = fetchurl {
@@ -5073,14 +4985,6 @@
         sha1 = "8d45407b4f870a0dcaebc0e28670d18e74514309";
       };
     }
-    {
-      name = "regenerator_runtime___regenerator_runtime_0.13.5.tgz";
-      path = fetchurl {
-        name = "regenerator_runtime___regenerator_runtime_0.13.5.tgz";
-        url  = "https://registry.yarnpkg.com/regenerator-runtime/-/regenerator-runtime-0.13.5.tgz";
-        sha1 = "d878a1d094b4306d10b9096484b33ebd55e26697";
-      };
-    }
     {
       name = "regexp.prototype.flags___regexp.prototype.flags_1.2.0.tgz";
       path = fetchurl {
@@ -6097,14 +6001,6 @@
         sha1 = "f29cebf01df517912bb58ff9c4e50fde8e33320d";
       };
     }
-    {
-      name = "unhomoglyph___unhomoglyph_1.0.3.tgz";
-      path = fetchurl {
-        name = "unhomoglyph___unhomoglyph_1.0.3.tgz";
-        url  = "https://registry.yarnpkg.com/unhomoglyph/-/unhomoglyph-1.0.3.tgz";
-        sha1 = "8d3551622b57754e10a831bf81442d7f15d1ddfd";
-      };
-    }
     {
       name = "unique_filename___unique_filename_1.1.1.tgz";
       path = fetchurl {

pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "element-web";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "0wjr5pd25c31f2w48amqvfmd720ih8hfr1rzd8mljvqb1fbakry3";
+    sha256 = "0vlh89kilnpg90kdxlikfak03zdwhwj754xskgb27jal0iaw0r8s";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix

@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.62.0.85";
+  version = "8.63.0.76";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -65,7 +65,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "0qlm2hbshxgycczv227bbj2fbiw3b76rp24mh8amhq4xbscazl38";
+        sha256 = "0gmrk1giabr53imiwdflf6ykwpcj2q5zn3bynvrncnhivsbvaavy";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";

pkgs/applications/networking/instant-messengers/wire-desktop/default.nix

@@ -20,13 +20,13 @@ let
   pname = "wire-desktop";
 
   version = {
-    x86_64-darwin = "3.18.3728";
+    x86_64-darwin = "3.19.3799";
-    x86_64-linux = "3.18.2925";
+    x86_64-linux = "3.19.2928";
   }.${system} or throwSystem;
 
   sha256 = {
-    x86_64-darwin = "0xi3k95yw59xsfavncc1giwxlwjz26z34qm3i604ksjjalvpzy5l";
+    x86_64-darwin = "1sv8n4g1pd4nwpwsg0m61zhrfjlh7sj29rnh46xjw1qg332g6cw9";
-    x86_64-linux = "01g39hncj1w0zyfrzv4mgv8npwvx0g0lw99azyai99877b30bm8j";
+    x86_64-linux = "038h1j59qfj5ckaxk823qpfflxay47v0jrqc0hmrdmnd2y59dpx7";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {

pkgs/applications/networking/p2p/gnunet-gtk/default.nix

@@ -1,28 +0,0 @@
-{ stdenv, fetchgit, pkgconfig
-, autoreconfHook, wrapGAppsHook
-, libgcrypt, libextractor, libxml2
-, gnome3, gnunet, gnutls, gtk3 }:
-
-stdenv.mkDerivation rec {
-  pname = "gnunet-gtk";
-  version = "0.12.0";
-
-  src = fetchgit {
-    url = "https://git.gnunet.org/gnunet-gtk.git";
-    rev = "v${version}";
-    sha256 = "1ccasng1b4bj0kqhbfhiv0j1gnc4v2ka5f7wxvka3iwp90g7rax6";
-  };
-
-  nativeBuildInputs= [ autoreconfHook wrapGAppsHook pkgconfig ];
-  buildInputs = [ libgcrypt libextractor libxml2 gnunet gnome3.glade gnutls gtk3 ];
-
-  patchPhase = "patchShebangs pixmaps/icon-theme-installer";
-
-  meta = with stdenv.lib; {
-    description = "GNUnet GTK User Interface";
-    homepage = "https://git.gnunet.org/gnunet-gtk.git";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ pstn ];
-    platforms = platforms.gnu ++ platforms.linux;
-  };
-}

pkgs/applications/networking/p2p/gnunet/default.nix

@@ -1,15 +1,15 @@
 { stdenv, fetchurl, adns, curl, gettext, gmp, gnutls, libextractor
 , libgcrypt, libgnurl, libidn, libmicrohttpd, libtool, libunistring
 , makeWrapper, ncurses, pkgconfig, libxml2, sqlite, zlib
-, libpulseaudio, libopus, libogg, jansson }:
+, libpulseaudio, libopus, libogg, jansson, libsodium }:
 
 stdenv.mkDerivation rec {
   pname = "gnunet";
-  version = "0.12.2";
+  version = "0.13.1";
 
   src = fetchurl {
     url = "mirror://gnu/gnunet/${pname}-${version}.tar.gz";
-    sha256 = "1mwcy7fj1rpd39w7j7k3jdwlil5s889b2qlhfdggqmhigl28na5c";
+    sha256 = "15jnca5zxng7r6m3qzq9lr73xxq0v6mvcp0lny3zrlkz5s2nmmq3";
   };
 
   enableParallelBuilding = true;
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig libtool makeWrapper ];
   buildInputs = [
     adns curl gmp gnutls libextractor libgcrypt libgnurl libidn
-    libmicrohttpd libunistring libxml2 ncurses gettext
+    libmicrohttpd libunistring libxml2 ncurses gettext libsodium
     sqlite zlib libpulseaudio libopus libogg jansson
   ];
 
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
     homepage = "https://gnunet.org/";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ vrthra ];
+    maintainers = with maintainers; [ pstn vrthra ];
     platforms = platforms.gnu ++ platforms.linux;
   };
 }

pkgs/applications/networking/p2p/gnunet/gtk.nix

@@ -0,0 +1,43 @@
+{ stdenv, fetchurl
+, gnome3
+, gnunet
+, gnutls
+, gtk3
+, libextractor
+, libgcrypt
+, libxml2
+, pkg-config
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnunet-gtk";
+  inherit (gnunet) version;
+
+  src = fetchurl {
+    url = "mirror://gnu/gnunet/${pname}-${version}.tar.gz";
+    sha256 = "1zdzgq16h77w6ybwg3lqjsjr965np6iqvncqvkbj07glqd4wss0j";
+  };
+
+  nativeBuildInputs= [
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gnome3.glade
+    gnunet
+    gnutls
+    gtk3
+    libextractor
+    libgcrypt
+    libxml2
+  ];
+
+  patchPhase = "patchShebangs pixmaps/icon-theme-installer";
+
+  meta = gnunet.meta // {
+    description = "GNUnet GTK User Interface";
+    homepage = "https://git.gnunet.org/gnunet-gtk.git";
+  };
+}

pkgs/applications/office/gtg/default.nix

@@ -2,7 +2,6 @@
 , fetchFromGitHub
 , meson
 , python3Packages
-, pkgconfig
 , ninja
 , gtk3
 , wrapGAppsHook
@@ -16,7 +15,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gtg";
-  version = "0.4";
+  version = "unstable-2020-08-02";
 
   src = fetchFromGitHub {
     owner = "getting-things-gnome";
@@ -29,7 +28,8 @@ python3Packages.buildPythonApplication rec {
   nativeBuildInputs = [
     meson
     ninja
-    pkgconfig
+    itstool
+    gettext
     wrapGAppsHook
     gobject-introspection
   ];
@@ -37,8 +37,6 @@ python3Packages.buildPythonApplication rec {
   buildInputs = [
     glib
     gtk3
-    itstool
-    gettext
     pango
     gdk-pixbuf
   ];
@@ -50,24 +48,21 @@ python3Packages.buildPythonApplication rec {
     dbus-python
     gst-python
     liblarch
-    pyxdg # can probably be removed after next release
   ];
 
   format = "other";
-  strictDeps = false;
+  strictDeps = false; # gobject-introspection does not run with strictDeps (https://github.com/NixOS/nixpkgs/issues/56943)
 
   meta = with stdenv.lib; {
-    description = "
+    description = " A personal tasks and TODO-list items organizer.";
-      Getting Things GNOME! (GTG) is a personal tasks and TODO-list items organizer for the GNOME desktop environment and inspired by the ''Getting Things Done'' (GTD) methodology.
+    longDescription = ''
-    ";
+      "Getting Things GNOME" (GTG) is a personal tasks and ToDo list organizer inspired by the "Getting Things Done" (GTD) methodology.
-    longDescription = "
-      GTG is designed with flexibility, adaptability, and ease of use in mind so it can be used as more than just GTD software.
       GTG is intended to help you track everything you need to do and need to know, from small tasks to large projects.
-    ";
+    '';
     homepage = "https://wiki.gnome.org/Apps/GTG";
     downloadPage = "https://github.com/getting-things-gnome/gtg/releases";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ oyren ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/office/ledger/default.nix

@@ -1,37 +1,48 @@
-{ stdenv, fetchFromGitHub, cmake, boost, gmp, mpfr, libedit, python
+{ stdenv, lib, fetchFromGitHub, cmake, boost, gmp, mpfr, libedit, python
 , texinfo, gnused, usePython ? true }:
 
 stdenv.mkDerivation rec {
   pname = "ledger";
-  version = "3.1.3";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner  = "ledger";
     repo   = "ledger";
     rev    = "v${version}";
-    sha256 = "0bfnrqrd6wqgsngfpqi30xh6yy86pwl25iwzrqy44q31r0zl4mm3";
+    sha256 = "0x6jxwss3wwzbzlwmnwb8yzjk8f9wfawif4f1b74z2qg6hc4r7f6";
   };
 
+  outputs = [ "out" "dev" ];
+
   buildInputs = [
     (boost.override { enablePython = usePython; })
-    gmp mpfr libedit python texinfo gnused
+    gmp mpfr libedit python gnused
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake texinfo ];
 
   enableParallelBuilding = true;
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DBUILD_DOCS:BOOL=ON"
-    (stdenv.lib.optionalString usePython "-DUSE_PYTHON=true")
+    (lib.optionalString usePython "-DUSE_PYTHON=true")
+  ] ++ lib.optionals (usePython && stdenv.isDarwin) [
+    # Fix python lookup on Darwin. Not necessary after
+    # https://github.com/NixOS/nixpkgs/pull/94090 lands in master
+    "-DPython_ROOT_DIR=${python}"
   ];
 
-  postBuild = ''
+  # by default, it will query the python interpreter for it's sitepackages location
-    make doc
+  # however, that would write to a different nixstore path, pass our own sitePackages location
+  prePatch = lib.optionalString usePython ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace 'DESTINATION ''${Python_SITEARCH}' 'DESTINATION "${python.sitePackages}"'
   '';
 
-  meta = with stdenv.lib; {
+  installTargets = [ "doc" "install" ];
+
+  meta = with lib; {
     homepage = "https://ledger-cli.org/";
     description = "A double-entry accounting system with a command-line reporting interface";
     license = licenses.bsd3;

pkgs/applications/science/chemistry/octopus/default.nix

@@ -6,13 +6,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "octopus";
-  version = "9.2";
+  version = "10.0";
 
   src = fetchFromGitLab {
     owner = "octopus-code";
     repo = "octopus";
     rev = version;
-    sha256 = "083z51sjv70asr04rv53wb9gf4396nblq1zl22qw7jdr28hji4is";
+    sha256 = "1c6q20y0x9aacwa7vp6gj3yvfzain7hnk6skxmvg3wazp02l91kn";
   };
 
   nativeBuildInputs = [ perl procps autoreconfHook ];

pkgs/applications/science/electronics/csxcad/default.nix

@@ -0,0 +1,49 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, fparser
+, tinyxml
+, hdf5
+, cgal_5
+, vtk
+, boost
+, gmp
+, mpfr
+}:
+
+stdenv.mkDerivation rec {
+  pname = "csxcad";
+  version = "unstable-2020-02-08";
+
+  src = fetchFromGitHub {
+    owner = "thliebig";
+    repo = "CSXCAD";
+    rev = "ef6e40931dbd80e0959f37c8e9614c437bf7e518";
+    sha256 = "072s765jyzpdq8qqysdy0dld17m6sr9zfcs0ip2zk8c4imxaysnb";
+  };
+
+  patches = [./searchPath.patch ];
+
+  buildInputs = [
+    cgal_5
+    boost
+    gmp
+    mpfr
+    vtk
+    fparser
+    tinyxml
+    hdf5
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "A C++ library to describe geometrical objects";
+    homepage = "https://github.com/thliebig/CSXCAD";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ matthuszagh ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/science/electronics/csxcad/searchPath.patch

@@ -0,0 +1,11 @@
+--- CSXCAD/matlab/searchBinary.m	2019-07-14 09:24:02.154291745 -0700
++++ CSXCAD/matlab/searchBinary.m	2019-07-14 09:20:20.900248280 -0700
+@@ -33,7 +33,7 @@
+
+ % try all search paths
+ for n=1:numel(searchpath)
+-    binary_location = [searchpath{n} name];
++    binary_location = [searchpath{n} filesep name];
+     if exist(binary_location, 'file')
+         return
+     end

pkgs/applications/science/electronics/fritzing/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, fetchpatch, fetchFromGitHub, qmake, pkgconfig
+{ mkDerivation, stdenv, fetchpatch, fetchFromGitHub, qmake, pkgconfig
 , qtbase, qtsvg, qtserialport, boost, libgit2
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "fritzing";
   version = "0.9.3b";
 

pkgs/applications/science/electronics/hyp2mat/default.nix

@@ -0,0 +1,53 @@
+{ stdenv
+, fetchFromGitHub
+, bison
+, flex
+, gengetopt
+, help2man
+, groff
+, libharu
+, autoreconfHook
+, pkgconfig
+, libpng
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hyp2mat";
+  version = "0.0.17";
+
+  src = fetchFromGitHub {
+    owner = "koendv";
+    repo = "hyp2mat";
+    rev = "v${version}";
+    sha256 = "04bd2vrn8y1izir7pwl34a60cg2v05baqcrmpfdx5fvf33bbflaj";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    libharu
+    libpng
+    zlib
+    bison
+    flex
+    gengetopt
+    help2man
+    groff
+  ];
+
+  configureFlags = [ "--enable-library" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Import Hyperlynx Boardsim files to openEMS, an open source 3D full-wave electromagnetic field solver";
+    homepage = https://github.com/koendv/hyp2mat;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ matthuszagh ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/science/machine-learning/finalfusion-utils/default.nix

@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, blas
+, gfortran
+, lapack
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "finalfusion-utils";
+  version = "0.11.2";
+
+  src = fetchFromGitHub {
+    owner = "finalfusion";
+    repo = pname;
+    rev = version;
+    sha256 = "1y2ik3qj2wbjnnk7bbglwbvyvbm5zfk7mbd1gpxg4495nzlf2jhf";
+  };
+
+  cargoSha256 = "19yay31f76ns1d6b6k9mgw5mrl8zg69y229ca6ssyb2z82gyhsnw";
+
+  # Enables build against a generic BLAS.
+  cargoBuildFlags = [
+    "--features"
+    "netlib"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = [
+    blas
+    gfortran.cc.lib
+    lapack
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
+  postInstall = ''
+    # Install shell completions
+    for shell in bash fish zsh; do
+      $out/bin/finalfusion completions $shell > finalfusion.$shell
+    done
+    installShellCompletion finalfusion.{bash,fish,zsh}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Utility for converting, quantizing, and querying word embeddings";
+    homepage = "https://github.com/finalfusion/finalfusion-utils/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ danieldk ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/version-management/git-and-tools/ghq/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ghq";
-  version = "1.1.2";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "x-motemen";
     repo = "ghq";
     rev = "v${version}";
-    sha256 = "1qzrycmd26f4q36z3rblfxp7jngqgmspb9385vpfwv9laiw3sqrg";
+    sha256 = "098fik155viylq07az7crzbgswcvhpx0hr68xpvyx0rpri792jbq";
   };
 
-  vendorSha256 = "0x347ljj9q3zi0zf8x13dhvsydv9vg4qc5l1kc2y56v0w8hlb4p7";
+  vendorSha256 = "0gll132g111vn1hdmdjpkha9rbyppz0qj1ld89gwlk2mqd57jxkd";
 
   buildFlagsArray = ''
     -ldflags=

pkgs/applications/version-management/git-and-tools/gitstatus/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gitstatus";
-  version = "1.1.3";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "gitstatus";
     rev = "v${version}";
-    sha256 = "16s09d2kpw0v0kyr2ada99qmsi0pqnsiis22mzq69hay0hdg8p1n";
+    sha256 = "1kspz2fhryyjhn6gqf029rv0386a1ga08sf6g0l6smivw628k71l";
   };
 
   buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];

pkgs/applications/video/obs-studio/wlrobs.nix

@@ -13,12 +13,12 @@ assert dmabufSupport -> libdrm != null && libGL != null;
 
 stdenv.mkDerivation {
   pname = "obs-wlrobs";
-  version = "20200111";
+  version = "20200622";
 
   src = fetchhg {
     url = "https://hg.sr.ht/~scoopta/wlrobs";
-    rev = "8345bf985e390896d89e35e2feae1fa37722f4be";
+    rev = "1d3acaaf64049da3da9721aa8b9b47582fe0081b";
-    sha256 = "0j01wkhwhhla4qx8mwyrq2qj9cfhxksxaq2k8rskmy2qbdkvvdpb";
+    sha256 = "0qrcf8024r4ynfjw0zx8vn59ygx9q5rb196s6nyxmy3gkv2lfxlq";
   };
 
   buildInputs = [ libX11 libGL libdrm meson ninja pkgconfig wayland obs-studio ];

pkgs/applications/virtualization/runc/default.nix

@@ -14,13 +14,13 @@
 
 buildGoPackage rec {
   pname = "runc";
-  version = "1.0.0-rc91";
+  version = "1.0.0-rc92";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    sha256 = "1hg3hbbjsz76q1piz86q8la6dym86d65xd7h6q12krfmwd2lbhkw";
+    sha256 = "0r4zbxbs03xr639r7848282j1ybhibfdhnxyap9p76j5w8ixms94";
   };
 
   goPackagePath = "github.com/opencontainers/runc";

pkgs/desktops/enlightenment/default.nix

@@ -1,14 +1,14 @@
 { callPackage, pkgs }:
 {
   #### CORE EFL
-  efl = callPackage ./efl.nix { };
+  efl = callPackage ./efl { };
 
   #### WINDOW MANAGER
-  enlightenment = callPackage ./enlightenment.nix { };
+  enlightenment = callPackage ./enlightenment { };
 
   #### APPLICATIONS
-  econnman = callPackage ./econnman.nix { };
+  econnman = callPackage ./econnman { };
-  terminology = callPackage ./terminology.nix { };
+  terminology = callPackage ./terminology { };
-  rage = callPackage ./rage.nix { };
+  rage = callPackage ./rage { };
-  ephoto = callPackage ./ephoto.nix { };
+  ephoto = callPackage ./ephoto { };
 }

pkgs/desktops/mate/marco/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "marco";
-  version = "1.24.0";
+  version = "1.24.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0hcbyv8czymhwz5q9rwig7kkhlhik6y080bls736f3wsbqnnirc2";
+    sha256 = "109b41pjrc1b4slw6sx1lakdhrc46x829vczzk4bz3j15kcszg54";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/ghc/8.10.1.nix

@@ -24,7 +24,7 @@
   enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform
 
   # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
 
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
@@ -68,7 +68,7 @@ let
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
     BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
     GhcLibWays = "v dyn"
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
     GhcLibHcOpts += -fPIC

pkgs/development/compilers/ghc/8.8.3.nix

@@ -23,6 +23,9 @@
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform
 
+  # aarch64 outputs otherwise exceed 2GB limit
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
+
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
   enableShared ? !stdenv.targetPlatform.isWindows && !stdenv.targetPlatform.useiOSPrebuilt
@@ -30,9 +33,6 @@
 , # Whether to build terminfo.
   enableTerminfo ? !stdenv.targetPlatform.isWindows
 
-  # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
-
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
   ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
@@ -68,7 +68,7 @@ let
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
     BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
     GhcLibWays = "v dyn"
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
     GhcLibHcOpts += -fPIC

pkgs/development/compilers/ghc/8.8.4.nix

@@ -24,7 +24,7 @@
   enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform
 
   # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
 
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
@@ -68,7 +68,7 @@ let
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
     BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
     GhcLibWays = "v dyn"
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
     GhcLibHcOpts += -fPIC

pkgs/development/compilers/ghc/head.nix

@@ -20,9 +20,9 @@
   # build-time dependency too.
   buildLlvmPackages, llvmPackages
 
-, # If enabled, GHC will be built with the GPL-free but slower integer-simple
+, # If enabled, GHC will be built with the GPL-free but slightly slower native
-  # library instead of the faster but GPLed integer-gmp library.
+  # bignum backend instead of the faster but GPLed gmp backend.
-  enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms)
+  enableNativeBignum ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms)
 , gmp
 
 , # If enabled, use -fPIC when compiling static libs.
@@ -35,7 +35,7 @@
 , # Whether to build terminfo.
   enableTerminfo ? !stdenv.targetPlatform.isWindows
 
-, version ? "8.11.20200505"
+, version ? "8.11.20200731"
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
   ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
@@ -46,7 +46,7 @@
   disableLargeAddressSpace ? stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64
 }:
 
-assert !enableIntegerSimple -> gmp != null;
+assert !enableNativeBignum -> gmp != null;
 
 let
   inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -64,7 +64,7 @@ let
     include mk/flavours/\$(BuildFlavour).mk
     endif
     DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
-    INTEGER_LIBRARY = ${if enableIntegerSimple then "integer-simple" else "integer-gmp"}
+    BIGNUM_BACKEND = ${if enableNativeBignum then "native" else "gmp"}
   '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
     Stage1Only = ${if targetPlatform.system == hostPlatform.system then "NO" else "YES"}
     CrossCompilePrefix = ${targetPrefix}
@@ -81,7 +81,7 @@ let
   # Splicer will pull out correct variations
   libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
     ++ [libffi]
-    ++ stdenv.lib.optional (!enableIntegerSimple) gmp
+    ++ stdenv.lib.optional (!enableNativeBignum) gmp
     ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv
     ++ stdenv.lib.optional enableDwarf elfutils;
 
@@ -103,8 +103,8 @@ stdenv.mkDerivation (rec {
 
   src = fetchgit {
     url = "https://gitlab.haskell.org/ghc/ghc.git/";
-    rev = "40c71c2cf38b4e134d81b7184a4d5e02949ae70c";
+    rev = "380638a33691ba43fdcd2e18bca636750e5f66f1";
-    sha256 = "04h9rcyzm9w3an1z00hjs062dp7dl19b8pkyxjsypr7a2i9dmvkb";
+    sha256 = "029cgiyhddvwnx5zx31i0vgj13zsvzb8fna99zr6ifscz6x7rid1";
   };
 
   enableParallelBuilding = true;
@@ -173,7 +173,7 @@ stdenv.mkDerivation (rec {
     "--with-system-libffi"
     "--with-ffi-includes=${targetPackages.libffi.dev}/include"
     "--with-ffi-libraries=${targetPackages.libffi.out}/lib"
-  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableNativeBignum) [
     "--with-gmp-includes=${targetPackages.gmp.dev}/include"
     "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [

pkgs/development/compilers/go/1.13.nix

@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.13.14";
+  version = "1.13.15";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "01mbqzn1hj8idbyn2f9gghvirfnw348dcf7pjs3ymschfblk6wqr";
+    sha256 = "0pfgixca3a0svblzivkia11q79l8bzai6yg64m1piy3c0iqk3d2z";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/nim/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nim";
-  version = "1.2.4";
+  version = "1.2.6";
 
   src = fetchurl {
     url = "https://nim-lang.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0dnn60slvp3ynlx3zhv3cjkanv8zglljxws0db8g0rdyz8r8zwgf";
+    sha256 = "0zk5qzxayqjw7kq6p92j4008g9bbyilyymhdc5xq9sln5rqym26z";
   };
 
   enableParallelBuilding = true;

pkgs/development/compilers/openjdk/8.nix

@@ -19,8 +19,8 @@ let
     aarch64-linux = "aarch64";
   }.${stdenv.system} or (throw "Unsupported platform");
 
-  update = "242";
+  update = "265";
-  build = "b08";
+  build = if stdenv.isAarch64 then "b01" else "ga";
   baseurl = if stdenv.isAarch64 then "https://hg.openjdk.java.net/aarch64-port/jdk8u-shenandoah"
             else "https://hg.openjdk.java.net/jdk8u/jdk8u";
   repover = lib.optionalString stdenv.isAarch64 "aarch64-shenandoah-"
@@ -29,50 +29,50 @@ let
   jdk8 = fetchurl {
              name = "jdk8-${repover}.tar.gz";
              url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0qpmr267qcxhmw398zbl1axd161yxn4k4hfz1jlxlmdvg70p7h90"
+             sha256 = if stdenv.isAarch64 then "1a2adw51af064rzlngsdlhs9gl47h3lv6dzvr8swqgl2n93nlbxa"
-                      else "1crs4hmzmgm6fkwfq0d3xz9lph0nd33fngrqv2rz1mkkqcrjx18z";
+                      else "02j1nbf3rxl581fqzc6i3ri6wwxx1dhkmj5klkh5xlp8dkhclr30";
           };
   langtools = fetchurl {
              name = "langtools-${repover}.tar.gz";
              url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "1rhhi4kgmxvnyl3ic5p008p1n7zyji5nw99blm1lr5fw7ry7df24"
+             sha256 = if stdenv.isAarch64 then "0hfrbz7421s2barfrfp0fvmh45iksw2zx1z4ykjg3giv8zbmswfm"
-                      else "1aaxd1rl7dlk4kxdivvqvripsbn0d5vny0jvjksycsm97vrfiry4";
+                      else "1r2adp7sn3y45rb5h059qygz18bgmkqr2g2jc9mpzskl5vwsqiw4";
           };
   hotspot = fetchurl {
              name = "hotspot-${repover}.tar.gz";
              url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0lphrhjqlavd6qlkh7h4sd2bqf5gd0cchkcnvy87703fbd7gy5ii"
+             sha256 = if stdenv.isAarch64 then "0g5h74snfl2dj2xwlvb5hgfbqmnbhxax68axadz11mq7r2bhd0lk"
-                      else "18i4if16zikgda9k5bgqyx0p2104db23zlnclq512178z0p9yycb";
+                      else "10xj8qr499r6nla74bjh4dmq7pkj63iircijk1wyv9xz5v777pcc";
           };
   corba = fetchurl {
              name = "corba-${repover}.tar.gz";
              url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "18h0v566v420d00na6x4jrs41v4aa39byk15fi8k6dcn0dmirhvg"
+             sha256 = if stdenv.isAarch64 then "0wfqrpr5m4gnavgsl6zcy2l3c7sgn3yl7yhp2crh9icp44ld2cj9"
-                      else "1298k8p2dsj7xc4h2ayk5nl4ssrcgncn06ysyqrmnwrb8gj8s1w4";
+                      else "0lk4jimrafgphffsj5yyyhl6pib0y5xxqcr09bgr2w8sjkp4s04s";
           };
   jdk = fetchurl {
              name = "jdk-${repover}.tar.gz";
              url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0xxy7rkj8ah263nnzkd4mg9dai5qix3l9cyilm47dig5hv7g8aq0"
+             sha256 = if stdenv.isAarch64 then "0ss49bv2dzb9vkabpv1ag04wli5722p0a8gqkzqmzw4nj67snfqw"
-                      else "0vqlbks3cy3cnmnrnhbjkqinvp8bcy2h96xvx81cvlza4s2hszvz";
+                      else "0anbp4vq8bzhqsqxlgjd0dx0irf57x4i5ddbpljl36vy2pi9xsm7";
           };
   jaxws = fetchurl {
              name = "jaxws-${repover}.tar.gz";
              url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0ajqm2l9g5w5ag5s4vl4ldpbm99pqa6d342hrzvv7psqn3zf6ar5"
+             sha256 = if stdenv.isAarch64 then "1nwn6mz38app6pk5f1x3vya1x9qfckyl7z6bi62k6mj2c72ikfh5"
-                      else "1wg9fbiz09arj0llavnzrmbhw8nx0dw8dcjkrzxw78rj1cadflzc";
+                      else "113d5nx2mp30m6xy2m2wh0nixk45q8abimlszkiq09w1w1ckzpba";
           };
   jaxp = fetchurl {
              name = "jaxp-${repover}.tar.gz";
              url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "03zjh6xvza05abxz9d9j2w9xndw9n07f8lrn6dymj7f4imals831"
+             sha256 = if stdenv.isAarch64 then "1rhgbwvp7xls7r3f5jm69dw7x521vamchv917dwiz1byvm2bwn7s"
-                      else "1i5xrk8r8pcgnc68zrgp3hd1a1nzcm99swpmdnlb424qlg5nnrcf";
+                      else "0nvqidjssmamcrchq15cg3lfv5v3cnrw05a4h20xmhlpgb9im0vj";
           };
   nashorn = fetchurl {
              name = "nashorn-${repover}.tar.gz";
              url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0n809w264ndxksva9c81x0m1fsyg8c627w571f72xxxl9c1bnrmp"
+             sha256 = if stdenv.isAarch64 then "14gp8q6jw1hq2wlmcalfwn1kgmnq5w9svqnbjww20f25phxkicij"
-                      else "0qlxaz7sriy709vcyzz48s2v4p5h4d31my33whip018c4j5gkfqq";
+                      else "0fm9ldps7ayk7r3wjqiyxp1s6hvi242kl7f92ydkmlxqyfajx60a";
           };
   openjdk8 = stdenv.mkDerivation {
     pname = "openjdk" + lib.optionalString headless "-headless";

pkgs/development/haskell-modules/configuration-common.nix

@@ -1336,7 +1336,7 @@ self: super: {
         })).override {
           # we are faster than stack here
           hie-bios = dontCheck self.hie-bios_0_6_1;
-          lsp-test = dontCheck self.lsp-test_0_11_0_3;
+          lsp-test = dontCheck self.lsp-test_0_11_0_4;
         });
 
   haskell-language-server = (overrideCabal super.haskell-language-server
@@ -1356,7 +1356,7 @@ self: super: {
       ghcide = self.hls-ghcide;
       # we are faster than stack here
       hie-bios = dontCheck self.hie-bios_0_6_1;
-      lsp-test = dontCheck self.lsp-test_0_11_0_3;
+      lsp-test = dontCheck self.lsp-test_0_11_0_4;
     };
 
   # https://github.com/kowainik/policeman/issues/57

pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix

@@ -67,9 +67,9 @@ self: super: {
   unliftio-core = doJailbreak super.unliftio-core;
 
   # Use the latest version to fix the build.
-  dhall = self.dhall_1_33_1;
+  dhall = self.dhall_1_34_0;
   lens = self.lens_4_19_2;
-  optics-core = self.optics-core_0_3;
+  optics-core = self.optics-core_0_3_0_1;
   repline = self.repline_0_4_0_0;
   singletons = self.singletons_2_7;
   th-desugar = self.th-desugar_1_11;

pkgs/development/haskell-modules/configuration-ghc-head.nix

@@ -26,6 +26,7 @@ self: super: {
   filepath = null;
   ghc-boot = null;
   ghc-boot-th = null;
+  ghc-bignum = null;
   ghc-compact = null;
   ghc-heap = null;
   ghci = null;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -72,7 +72,7 @@ default-package-overrides:
   # gi-gdkx11-4.x requires gtk-4.x, which is still under development and
   # not yet available in Nixpkgs
   - gi-gdkx11 < 4
-  # LTS Haskell 16.7
+  # LTS Haskell 16.8
   - abstract-deque ==0.3
   - abstract-par ==0.3.3
   - AC-Angle ==1.0
@@ -323,7 +323,7 @@ default-package-overrides:
   - bins ==0.1.2.0
   - bitarray ==0.0.1.1
   - bits ==0.5.2
-  - bitset-word8 ==0.1.1.1
+  - bitset-word8 ==0.1.1.2
   - bits-extra ==0.0.2.0
   - bitvec ==1.0.3.0
   - blake2 ==0.3.0
@@ -439,9 +439,9 @@ default-package-overrides:
   - cipher-des ==0.0.6
   - cipher-rc4 ==0.1.4
   - circle-packing ==0.1.0.6
-  - clash-ghc ==1.2.3
+  - clash-ghc ==1.2.4
-  - clash-lib ==1.2.3
+  - clash-lib ==1.2.4
-  - clash-prelude ==1.2.3
+  - clash-prelude ==1.2.4
   - classy-prelude ==1.5.0
   - classy-prelude-conduit ==1.5.0
   - classy-prelude-yesod ==1.5.0
@@ -518,9 +518,9 @@ default-package-overrides:
   - control-monad-omega ==0.3.2
   - convertible ==1.1.1.0
   - cookie ==0.4.5
-  - core-data ==0.2.1.5
+  - core-data ==0.2.1.7
-  - core-program ==0.2.4.2
+  - core-program ==0.2.4.4
-  - core-text ==0.2.3.3
+  - core-text ==0.2.3.5
   - countable ==1.0
   - cpio-conduit ==0.7.0
   - cpphs ==1.20.9.1
@@ -787,7 +787,7 @@ default-package-overrides:
   - file-path-th ==0.1.0.0
   - filepattern ==0.1.2
   - fileplow ==0.1.0.0
-  - filtrable ==0.1.3.0
+  - filtrable ==0.1.4.0
   - fin ==0.1.1
   - FindBin ==0.0.5
   - fingertree ==0.1.4.2
@@ -976,6 +976,7 @@ default-package-overrides:
   - hadoop-streaming ==0.2.0.3
   - hakyll ==4.13.4.0
   - half ==0.3
+  - hall-symbols ==0.1.0.6
   - hamtsolo ==1.0.3
   - HandsomeSoup ==0.4.2
   - hapistrano ==0.4.1.0
@@ -1046,7 +1047,7 @@ default-package-overrides:
   - hint ==0.9.0.3
   - hjsmin ==0.2.0.4
   - hkd-default ==1.1.0.0
-  - hkgr ==0.2.6
+  - hkgr ==0.2.6.1
   - hlibcpuid ==0.2.0
   - hlibgit2 ==0.18.0.16
   - hmatrix ==0.20.0.0
@@ -1144,7 +1145,7 @@ default-package-overrides:
   - http-link-header ==1.0.3.1
   - http-media ==0.8.0.0
   - http-reverse-proxy ==0.6.0
-  - http-streams ==0.8.7.1
+  - http-streams ==0.8.7.2
   - http-types ==0.12.3
   - human-readable-duration ==0.2.1.4
   - HUnit ==1.6.0.0
@@ -1511,7 +1512,7 @@ default-package-overrides:
   - MusicBrainz ==0.4.1
   - mustache ==2.3.1
   - mutable-containers ==0.3.4
-  - mwc-probability ==2.3.0
+  - mwc-probability ==2.3.1
   - mwc-random ==0.14.0.0
   - mx-state-codes ==1.0.0.0
   - mysql ==0.1.7
@@ -1732,11 +1733,11 @@ default-package-overrides:
   - pretty-class ==1.0.1.1
   - pretty-hex ==1.1
   - prettyprinter ==1.6.2
-  - prettyprinter-ansi-terminal ==1.1.1.2
+  - prettyprinter-ansi-terminal ==1.1.2
   - prettyprinter-compat-annotated-wl-pprint ==1
   - prettyprinter-compat-ansi-wl-pprint ==1.0.1
   - prettyprinter-compat-wl-pprint ==1.0.0.1
-  - prettyprinter-convert-ansi-wl-pprint ==1.1
+  - prettyprinter-convert-ansi-wl-pprint ==1.1.1
   - pretty-relative-time ==0.2.0.0
   - pretty-show ==1.10
   - pretty-simple ==3.2.3.0
@@ -1825,7 +1826,7 @@ default-package-overrides:
   - rawstring-qm ==0.2.3.0
   - raw-strings-qq ==1.1
   - rcu ==0.2.4
-  - rdf ==0.1.0.3
+  - rdf ==0.1.0.4
   - rdtsc ==1.3.0.1
   - re2 ==0.3
   - readable ==0.3.1
@@ -1914,7 +1915,7 @@ default-package-overrides:
   - salve ==1.0.10
   - sample-frame ==0.0.3
   - sample-frame-np ==0.0.4.1
-  - sampling ==0.3.4
+  - sampling ==0.3.5
   - say ==0.1.0.1
   - sbp ==2.6.3
   - scalpel ==0.6.2
@@ -2137,6 +2138,7 @@ default-package-overrides:
   - syb ==0.7.1
   - symbol ==0.2.4
   - symengine ==0.1.2.0
+  - symmetry-operations-symbols ==0.0.1.4
   - sysinfo ==0.1.1
   - system-argv0 ==0.1.1
   - systemd ==2.3.0
@@ -2231,10 +2233,10 @@ default-package-overrides:
   - th-nowq ==0.1.0.5
   - th-orphans ==0.13.10
   - th-printf ==0.7
-  - thread-hierarchy ==0.3.0.1
+  - thread-hierarchy ==0.3.0.2
   - thread-local-storage ==0.2
   - threads ==0.5.1.6
-  - thread-supervisor ==0.1.0.0
+  - thread-supervisor ==0.1.0.1
   - threepenny-gui ==0.9.0.0
   - th-reify-compat ==0.0.1.5
   - th-reify-many ==0.1.9
@@ -2426,9 +2428,9 @@ default-package-overrides:
   - wave ==0.2.0
   - wcwidth ==0.0.2
   - webdriver ==0.9.0.1
-  - webex-teams-api ==0.2.0.0
+  - webex-teams-api ==0.2.0.1
-  - webex-teams-conduit ==0.2.0.0
+  - webex-teams-conduit ==0.2.0.1
-  - webex-teams-pipes ==0.2.0.0
+  - webex-teams-pipes ==0.2.0.1
   - webrtc-vad ==0.1.0.3
   - websockets ==0.12.7.1
   - websockets-snap ==0.10.3.1
@@ -3745,6 +3747,7 @@ broken-packages:
   - chart-histogram
   - Chart-simple
   - chart-svg
+  - chart-svg-various
   - chart-unit
   - chatter
   - chatty-text
@@ -7615,6 +7618,7 @@ broken-packages:
   - mDNSResponder-client
   - mdp
   - mealstrom
+  - mealy
   - MeanShift
   - Measure
   - mecab
@@ -8661,6 +8665,8 @@ broken-packages:
   - postgresql-simple-sop
   - postgresql-simple-typed
   - postgresql-syntax
+  - postgresql-tx-query
+  - postgresql-tx-squeal
   - postgresql-typed
   - postgresql-typed-lifted
   - postgrest-ws
@@ -9334,6 +9340,7 @@ broken-packages:
   - SCalendar
   - scalendar
   - scalp-webhooks
+  - scalpel-search
   - scan-vector-machine
   - scc
   - scenegraph
@@ -10164,6 +10171,7 @@ broken-packages:
   - taskell
   - TaskMonad
   - tasty-auto
+  - tasty-bdd
   - tasty-fail-fast
   - tasty-groundhog-converters
   - tasty-hedgehog-coverage

pkgs/development/libraries/audio/libmysofa/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
 
-  cmakeFlags = [ "-DBUILD_TESTS=OFF" ];
+  cmakeFlags = [ "-DBUILD_TESTS=OFF" "-DCODE_COVERAGE=OFF" ];
 
   meta = with stdenv.lib; {
     description = "Reader for AES SOFA files to get better HRTFs";

pkgs/development/libraries/ayatana-ido/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub
+, pkgconfig, autoreconfHook
+, gtk3, gobject-introspection, gtk-doc, vala
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ayatana-ido";
+  version = "0.4.90";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = pname;
+    rev = version;
+    sha256 = "02vqjryni96zzrpkq5d7kvgw7nf252d2fm2xq8fklvvb2vz3fa0w";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook gtk-doc vala ];
+
+  buildInputs = [ gtk3 gobject-introspection ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Display Indicator Objects";
+    homepage = "https://github.com/AyatanaIndicators/ayatana-ido";
+    changelog = "https://github.com/AyatanaIndicators/ayatana-ido/blob/${version}/ChangeLog";
+    license = [ licenses.gpl3 licenses.lgpl21 ];
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}

pkgs/development/libraries/faudio/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "faudio";
-  version = "20.07";
+  version = "20.08";
 
   src = fetchFromGitHub {
     owner = "FNA-XNA";
     repo = "FAudio";
     rev = version;
-    sha256 = "14fi0jwax9qzn2k89qazdkhxvklk5zcwhbi6pxi1l5i9zk4ly2h7";
+    sha256 = "1fs0h5wl0ndix61mz7h59c15kpqikrk7nn1rc7m2a44jiw8mzdnx";
   };
 
 	nativeBuildInputs = [cmake];

pkgs/development/libraries/gl2ps/default.nix

@@ -1,17 +1,27 @@
-{ stdenv, fetchurl, cmake
+{ stdenv
-, zlib, libGL, libGLU, libpng, freeglut }:
+, fetchurl
+, cmake
+, zlib
+, libGL
+, libGLU
+, libpng
+, freeglut
+}:
 
 stdenv.mkDerivation rec {
-  version = "1.4.2";
   pname = "gl2ps";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "http://geuz.org/gl2ps/src/${pname}-${version}.tgz";
     sha256 = "1sgzv547h7hrskb9qd0x5yp45kmhvibjwj2mfswv95lg070h074d";
   };
 
-  buildInputs = [
+  nativeBuildInputs = [
     cmake
+  ];
+
+  buildInputs = [
     zlib
     libGL
     libGLU

pkgs/development/libraries/grpc/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, fetchpatch, cmake, zlib, c-ares, pkgconfig, openssl, protobuf, gflags, abseil-cpp }:
 
 stdenv.mkDerivation rec {
-  version = "1.29.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
+  version = "1.31.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
   pname = "grpc";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    sha256 = "1n604grkf2amzrmwcz6am0rpbp3yfb062lpgmhv943hj8wk7xw27";
+    sha256 = "1h7gmhkjijfkpqhz8vswhkz2gkphs638g10dlkayic8xg9xdl4gj";
     fetchSubmodules = true;
   };
   patches = [

pkgs/development/libraries/kmsxx/default.nix

@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation {
   pname = "kmsxx";
-  version = "2020-02-14";
+  version = "2020-08-04";
 
   src = fetchFromGitHub {
     owner = "tomba";
     repo = "kmsxx";
     fetchSubmodules = true;
-    rev = "7c5e645112a899ad018219365c3898b0e896353f";
+    rev = "38bee3092f2d477f1baebfcae464f888d3d04bbe";
-    sha256 = "1hj4gk4gwlvpjprjbrmrbrzqjhdgszsndrb1i4f9z7mjvdv8gij2";
+    sha256 = "0xz4m9bk0naawxwpx5cy1j3cm6c8c9m5y551csk88y88x1g0z0xh";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/ldb/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ldb";
-  version = "2.1.4";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    sha256 = "0kmzs2s7fvar9ksaxyiqlh8q8mbwc7bxrq9w1y91zlyb23p142wy";
+    sha256 = "0pxxb3sn9lignkf80kndd84shxqk9m2qwimz62gzb6khd4bvajqk";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libayatana-appindicator/default.nix

@@ -0,0 +1,49 @@
+{ stdenv, fetchFromGitHub, lib
+, pkgconfig, autoreconfHook , gtk-doc
+, gtkVersion ? "3"
+, gtk2, libayatana-indicator-gtk2, libdbusmenu-gtk2
+, gtk3, libayatana-indicator-gtk3, libdbusmenu-gtk3
+, dbus-glib, python2, python2Packages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libayatana-appindicator-gtk${gtkVersion}";
+  version = "0.5.4";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = "libayatana-appindicator";
+    rev = version;
+    sha256 = "0bqjqb7gabdk7mifk8azi630qw39z978f973fx2ylgdgr4a66j1v";
+  };
+
+  patchPhase = ''
+    substituteInPlace configure.ac \
+      --replace "codegendir pygtk-2.0" "codegendir pygobject-2.0"
+  '';
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook gtk-doc ];
+
+  buildInputs = [ dbus-glib python2 python2Packages.pygtk ]
+    ++ lib.lists.optional (gtkVersion == "2") libayatana-indicator-gtk2
+    ++ lib.lists.optional (gtkVersion == "3") libayatana-indicator-gtk3;
+
+  propagatedBuildInputs =
+    lib.lists.optionals (gtkVersion == "2") [ gtk2 libdbusmenu-gtk2 ]
+    ++ lib.lists.optionals (gtkVersion == "3") [ gtk3 libdbusmenu-gtk3 ];
+
+  preAutoreconf = ''
+    gtkdocize
+  '';
+
+  configureFlags = [ "--with-gtk=${gtkVersion}" ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Application Indicators Shared Library";
+    homepage = "https://github.com/AyatanaIndicators/libayatana-appindicator";
+    changelog = "https://github.com/AyatanaIndicators/libayatana-appindicator/blob/${version}/ChangeLog";
+    license = [ licenses.gpl3 licenses.lgpl21 ];
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}