Merge branch 'staging-next' into staging

Conflicts (simple):
	nixos/doc/manual/release-notes/rl-1909.xml

maintainers/maintainer-list.nix

@@ -62,6 +62,19 @@
     github = "aanderse";
     name = "Aaron Andersen";
   };
+  aaronjanse = {
+    email = "aaron@ajanse.me";
+    github = "aaronjanse";
+    name = "Aaron Janse";
+    keys = [
+      { longkeyid = "rsa2048/0x651BD4B37D75E234"; # Email only
+        fingerprint = "490F 5009 34E7 20BD 4C53  96C2 651B D4B3 7D75 E234";
+      }
+      { longkeyid = "rsa4096/0xBE6C92145BFF4A34"; # Git, etc
+        fingerprint = "CED9 6DF4 63D7 B86A 1C4B  1322 BE6C 9214 5BFF 4A34";
+      }
+    ];
+  };
   aaronschif = {
     email = "aaronschif@gmail.com";
     github = "aaronschif";
@@ -2461,6 +2474,11 @@
     github = "joncojonathan";
     name = "Jonathan Haddock";
   };
+  jonringer = {
+    email = "jonringer117@gmail.com";
+    github = "jonringer";
+    name = "Jonathan Ringer";
+  };
   jorsn = {
     name = "Johannes Rosenberger";
     email = "johannes@jorsn.eu";
@@ -2638,6 +2656,12 @@
     github = "Kmeakin";
   };
 
+  kmein = {
+    email = "kieran.meinhardt@gmail.com";
+    name = "Kierán Meinhardt";
+    github = "kmein";
+  };
+
   knedlsepp = {
     email = "josef.kemetmueller@gmail.com";
     github = "knedlsepp";
@@ -2938,6 +2962,11 @@
     github = "lukeadams";
     name = "Luke Adams";
   };
+  lukebfox = {
+    email = "lbentley-fox1@sheffield.ac.uk";
+    github = "lukebfox";
+    name = "Luke Bentley-Fox";
+  };
   lukego = {
     email = "luke@snabb.co";
     github = "lukego";
@@ -3891,6 +3920,11 @@
     github = "pierrechevalier83";
     name = "Pierre Chevalier";
   };
+  pierreis = {
+    email = "pierre@pierre.is";
+    github = "pierreis";
+    name = "Pierre Matri";
+  };
   pierrer = {
     email = "pierrer@pi3r.be";
     github = "pierrer";

nixos/doc/manual/release-notes/rl-1909.xml

@@ -93,6 +93,14 @@
       the module for some time and so was removed as cleanup.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The <option>services.mysql.pidDir</option> option was removed, as it was only used by the wordpress
+      apache-httpd service to wait for mysql to have started up.
+      This can be accomplished by either describing a dependency on mysql.service (preferred)
+      or waiting for the (hardcoded) <filename>/run/mysqld/mysql.sock</filename> file to appear.
+    </para>
+   </listitem>
    <listitem>
     <para>
       The <option>services.emby.enable</option> module has been removed, see
@@ -106,6 +114,13 @@
    </listitem>
    <listitem>
     <para>
+      The limesurvey apache subservice was replaced with a full NixOS module.
+      One can configure it using the <option>services.limesurvey.enable</option>
+      and <option>services.limesurvey.virtualHost</option> options.
+    </para>
+   </listitem>
+   <listitem>
+     <para>
       The option <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnlink</option>
       was renamed to <option>systemd.network.networks.&lt;name&gt;.routes.*.routeConfig.GatewayOnLink</option>
       (capital <literal>L</literal>). This follows
@@ -195,6 +210,17 @@
       The <literal>hunspellDicts.fr-any</literal> dictionary now ships with <literal>fr_FR.{aff,dic}</literal>
       which is linked to <literal>fr-toutesvariantes.{aff,dic}</literal>.
     </para>
+  </listitem>
+  <listitem>
+    <para>
+      The <literal>mysql</literal> service now runs as <literal>mysql</literal>
+      user. Previously, systemd did execute it as root, and mysql dropped privileges
+      itself.
+      This includes <literal>ExecStartPre=</literal> and
+      <literal>ExecStartPost=</literal> phases.
+      To accomplish that, runtime and data directory setup was delegated to
+      RuntimeDirectory and tmpfiles.
+    </para>
    </listitem>
    <listitem>
     <para>

nixos/lib/build-vms.nix

@@ -32,14 +32,14 @@ rec {
 
     import ./eval-config.nix {
       inherit system;
-      modules = configurations ++
+      modules = configurations ++ extraConfigurations;
+      baseModules =  (import ../modules/module-list.nix) ++
         [ ../modules/virtualisation/qemu-vm.nix
           ../modules/testing/test-instrumentation.nix # !!! should only get added for automated test runs
           { key = "no-manual"; documentation.nixos.enable = false; }
           { key = "qemu"; system.build.qemu = qemu; }
-        ] ++ optional minimal ../modules/testing/minimal-kernel.nix
+          { key = "nodes"; _module.args.nodes = nodes; }
-          ++ extraConfigurations;
+        ] ++ optional minimal ../modules/testing/minimal-kernel.nix;
-      extraArgs = { inherit nodes; };
     };
 
 

nixos/modules/config/malloc.nix

@@ -21,6 +21,15 @@ let
         and scalable concurrency support.
       '';
     };
+
+    "scudo" = {
+      libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo-x86_64.so";
+      description = ''
+        A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator,
+        which aims at providing additional mitigations against heap based
+        vulnerabilities, while maintaining good performance.
+      '';
+    };
   };
 
   providerConf = providers."${cfg.provider}";
@@ -82,5 +91,7 @@ in
 
   config = mkIf (cfg.provider != "libc") {
     environment.variables.LD_PRELOAD = providerLibPath;
+    systemd.extraConfig = "DefaultEnvironment=\"LD_PRELOAD=${providerLibPath}\"";
+    systemd.user.extraConfig = "DefaultEnvironment=\"LD_PRELOAD=${providerLibPath}\"";
   };
 }

nixos/modules/module-list.nix

@@ -95,6 +95,7 @@
   ./programs/ccache.nix
   ./programs/cdemu.nix
   ./programs/chromium.nix
+  ./programs/clickshare.nix
   ./programs/command-not-found/command-not-found.nix
   ./programs/criu.nix
   ./programs/dconf.nix
@@ -762,6 +763,7 @@
   ./services/web-apps/frab.nix
   ./services/web-apps/icingaweb2/icingaweb2.nix
   ./services/web-apps/icingaweb2/module-monitoring.nix
+  ./services/web-apps/limesurvey.nix
   ./services/web-apps/mattermost.nix
   ./services/web-apps/miniflux.nix
   ./services/web-apps/nextcloud.nix

nixos/modules/programs/clickshare.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+  options.programs.clickshare-csc1.enable =
+    lib.options.mkEnableOption ''
+      Barco ClickShare CSC-1 driver/client.
+      This allows users in the <literal>clickshare</literal>
+      group to access and use a ClickShare USB dongle
+      that is connected to the machine
+    '';
+
+  config = lib.modules.mkIf config.programs.clickshare-csc1.enable {
+    environment.systemPackages = [ pkgs.clickshare-csc1 ];
+    services.udev.packages = [ pkgs.clickshare-csc1 ];
+    users.groups.clickshare = {};
+  };
+
+  meta.maintainers = [ lib.maintainers.yarny ];
+
+}

nixos/modules/programs/tmux.nix

@@ -177,7 +177,7 @@ in {
       systemPackages = [ pkgs.tmux ];
 
       variables = {
-        TMUX_TMPDIR = lib.optional cfg.secureSocket ''''${XDG_RUNTIME_DIR:-"/run/user/\$(id -u)"}'';
+        TMUX_TMPDIR = lib.optional cfg.secureSocket ''''${XDG_RUNTIME_DIR:-"/run/user/$(id -u)"}'';
       };
     };
   };

nixos/modules/rename.nix

@@ -113,9 +113,10 @@ with lib;
 
     # murmur
     (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
+    (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
 
     # parsoid
-    (mkRemovedOptionModule [ "services" "parsoid" "interwikis" ] [ "services" "parsoid" "wikis" ])
+    (mkRemovedOptionModule [ "services" "parsoid" "interwikis" ] "Use services.parsoid.wikis instead")
 
     # plexpy / tautulli
     (mkRenamedOptionModule [ "services" "plexpy" ] [ "services" "tautulli" ])
@@ -211,6 +212,7 @@ with lib;
     (mkRemovedOptionModule [ "services" "logstash" "enableWeb" ] "The web interface was removed from logstash")
     (mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "winstone" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd")
 
     # ZSH
     (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])

nixos/modules/services/databases/mysql.nix

@@ -18,16 +18,12 @@ let
     in (pName mysql == pName pkgs.mysql57)
        && ((builtins.compareVersions mysql.version "5.7") >= 0);
 
-  pidFile = "${cfg.pidDir}/mysqld.pid";
-
-  mysqldAndInstallOptions =
-    "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${mysql}";
   mysqldOptions =
-    "${mysqldAndInstallOptions} --pid-file=${pidFile}";
+    "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${mysql}";
   # For MySQL 5.7+, --insecure creates the root user without password
   # (earlier versions and MariaDB do this by default).
   installOptions =
-    "${mysqldAndInstallOptions} ${lib.optionalString isMysqlAtLeast57 "--insecure"}";
+    "${mysqldOptions} ${lib.optionalString isMysqlAtLeast57 "--insecure"}";
 
 in
 
@@ -80,11 +76,6 @@ in
         description = "Location where MySQL stores its table files";
       };
 
-      pidDir = mkOption {
-        default = "/run/mysqld";
-        description = "Location of the file which stores the PID of the MySQL server";
-      };
-
       extraOptions = mkOption {
         type = types.lines;
         default = "";
@@ -296,6 +287,10 @@ in
       ${cfg.extraOptions}
     '';
 
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql -"
+    ];
+
     systemd.services.mysql = let
       hasNotify = (cfg.package == pkgs.mariadb);
     in {
@@ -313,70 +308,69 @@ in
           pkgs.nettools
         ];
 
-        preStart =
+        preStart = ''
-          ''
+          if ! test -e ${cfg.dataDir}/mysql; then
-            if ! test -e ${cfg.dataDir}/mysql; then
+            ${mysql}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${installOptions}
-                mkdir -m 0700 -p ${cfg.dataDir}
+            touch /tmp/mysql_init
-                chown -R ${cfg.user} ${cfg.dataDir}
+          fi
-                ${mysql}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${installOptions}
+        '';
-                touch /tmp/mysql_init
-            fi
-
-            mkdir -m 0755 -p ${cfg.pidDir}
-            chown -R ${cfg.user} ${cfg.pidDir}
-          '';
 
         serviceConfig = {
+          User = cfg.user;
+          Group = "mysql";
           Type = if hasNotify then "notify" else "simple";
           RuntimeDirectory = "mysqld";
+          RuntimeDirectoryMode = "0755";
           # The last two environment variables are used for starting Galera clusters
           ExecStart = "${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION";
         };
 
-        postStart = ''
+        postStart =
-          ${lib.optionalString (!hasNotify) ''
+          let
-            # Wait until the MySQL server is available for use
+            cmdWatchForMysqlSocket = ''
-            count=0
+              # Wait until the MySQL server is available for use
-            while [ ! -e /run/mysqld/mysqld.sock ]
+              count=0
-            do
+              while [ ! -e /run/mysqld/mysqld.sock ]
-                if [ $count -eq 30 ]
+              do
-                then
+                  if [ $count -eq 30 ]
-                    echo "Tried 30 times, giving up..."
+                  then
-                    exit 1
+                      echo "Tried 30 times, giving up..."
-                fi
+                      exit 1
+                  fi
 
-                echo "MySQL daemon not yet started. Waiting for 1 second..."
+                  echo "MySQL daemon not yet started. Waiting for 1 second..."
-                count=$((count++))
+                  count=$((count++))
-                sleep 1
+                  sleep 1
-            done
+              done
-          ''}
+            '';
+            cmdInitialDatabases = concatMapStrings (database: ''
+              # Create initial databases
+              if ! test -e "${cfg.dataDir}/${database.name}"; then
+                  echo "Creating initial database: ${database.name}"
+                  ( echo 'create database `${database.name}`;'
 
+                    ${optionalString (database.schema != null) ''
+                    echo 'use `${database.name}`;'
+
+                    # TODO: this silently falls through if database.schema does not exist,
+                    # we should catch this somehow and exit, but can't do it here because we're in a subshell.
+                    if [ -f "${database.schema}" ]
+                    then
+                        cat ${database.schema}
+                    elif [ -d "${database.schema}" ]
+                    then
+                        cat ${database.schema}/mysql-databases/*.sql
+                    fi
+                    ''}
+                  ) | ${mysql}/bin/mysql -u root -N
+              fi
+            '') cfg.initialDatabases;
+          in
+
+          lib.optionalString (!hasNotify) cmdWatchForMysqlSocket + ''
             if [ -f /tmp/mysql_init ]
             then
-                ${concatMapStrings (database:
+                ${cmdInitialDatabases}
-                  ''
-                    # Create initial databases
-                    if ! test -e "${cfg.dataDir}/${database.name}"; then
-                        echo "Creating initial database: ${database.name}"
-                        ( echo 'create database `${database.name}`;'
-
-                          ${optionalString (database.schema != null) ''
-                          echo 'use `${database.name}`;'
-
-                          # TODO: this silently falls through if database.schema does not exist,
-                          # we should catch this somehow and exit, but can't do it here because we're in a subshell.
-                          if [ -f "${database.schema}" ]
-                          then
-                              cat ${database.schema}
-                          elif [ -d "${database.schema}" ]
-                          then
-                              cat ${database.schema}/mysql-databases/*.sql
-                          fi
-                          ''}
-                        ) | ${mysql}/bin/mysql -u root -N
-                    fi
-                  '') cfg.initialDatabases}
-
                 ${optionalString (cfg.replication.role == "master")
                   ''
                     # Set up the replication master

nixos/modules/services/misc/octoprint.nix

@@ -7,7 +7,7 @@ let
   cfg = config.services.octoprint;
 
   baseConfig = {
-    plugins.cura.cura_engine = "${pkgs.curaengine_stable}/bin/CuraEngine";
+    plugins.curalegacy.cura_engine = "${pkgs.curaengine_stable}/bin/CuraEngine";
     server.host = cfg.host;
     server.port = cfg.port;
     webcam.ffmpeg = "${pkgs.ffmpeg.bin}/bin/ffmpeg";

nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix

@@ -28,7 +28,7 @@ in
     serviceConfig = {
       DynamicUser = true;
       ExecStart = ''
-        ${pkgs.prometheus-fritzbox-exporter}/bin/fritzbox_exporter \
+        ${pkgs.prometheus-fritzbox-exporter}/bin/exporter \
           -listen-address ${cfg.listenAddress}:${toString cfg.port} \
           -gateway-address ${cfg.gatewayAddress} \
           -gateway-port ${toString cfg.gatewayPort} \

nixos/modules/services/networking/murmur.nix

@@ -4,6 +4,7 @@ with lib;
 
 let
   cfg = config.services.murmur;
+  forking = cfg.logFile != null;
   configFile = pkgs.writeText "murmurd.ini" ''
     database=/var/lib/murmur/murmur.sqlite
     dbDriver=QSQLITE
@@ -12,8 +13,8 @@ let
     autobanTimeframe=${toString cfg.autobanTimeframe}
     autobanTime=${toString cfg.autobanTime}
 
-    logfile=/var/log/murmur/murmurd.log
+    logfile=${optionalString (cfg.logFile != null) cfg.logFile}
-    pidfile=${cfg.pidfile}
+    ${optionalString forking "pidfile=/run/murmur/murmurd.pid"}
 
     welcometext="${cfg.welcometext}"
     port=${toString cfg.port}
@@ -78,10 +79,11 @@ in
         description = "The amount of time an IP ban lasts (in seconds).";
       };
 
-      pidfile = mkOption {
+      logFile = mkOption {
-        type = types.path;
+        type = types.nullOr types.path;
-        default = "/run/murmur/murmurd.pid";
+        default = null;
-        description = "Path to PID file for Murmur daemon.";
+        example = "/var/log/murmur/murmurd.log";
+        description = "Path to the log file for Murmur daemon. Empty means log to journald.";
       };
 
       welcometext = mkOption {
@@ -251,19 +253,13 @@ in
       after       = [ "network-online.target "];
 
       serviceConfig = {
-        Type      = "forking";
+        # murmurd doesn't fork when logging to the console.
-        RuntimeDirectory = "murmur";
+        Type      = if forking then "forking" else "simple";
-        PIDFile   = cfg.pidfile;
+        PIDFile   = mkIf forking "/run/murmur/murmurd.pid";
-        Restart   = "always";
+        RuntimeDirectory = mkIf forking "murmur";
         User      = "murmur";
         ExecStart = "${pkgs.murmur}/bin/murmurd -ini ${configFile}";
-        PermissionsStartOnly = true;
       };
-
-      preStart = ''
-        mkdir -p /var/log/murmur
-        chown -R murmur /var/log/murmur
-      '';
     };
   };
 }

nixos/modules/services/networking/networkmanager.nix

@@ -477,6 +477,10 @@ in {
       '';
     };
 
+    systemd.services.NetworkManager-wait-online = {
+      wantedBy = [ "network-online.target" ];
+    };
+
     systemd.services.nm-setup-hostsdirs = mkIf dynamicHostsEnabled {
       wantedBy = [ "NetworkManager.service" ];
       before = [ "NetworkManager.service" ];

nixos/modules/services/networking/syncthing.nix

@@ -426,7 +426,9 @@ in {
           '';
         };
       };
-      syncthing-init = {
+      syncthing-init = mkIf (
+        cfg.declarative.devices != {} || cfg.declarative.folders != {}
+      ) {
         after = [ "syncthing.service" ];
         wantedBy = [ "multi-user.target" ];
 

nixos/modules/services/networking/wireguard.nix

@@ -229,8 +229,61 @@ let
         '';
       };
 
+  generatePeerUnit = { interfaceName, interfaceCfg, peer }:
+    let
+      keyToUnitName = replaceChars
+        [ "/" "-"    " "     "+"     "="      ]
+        [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ];
+      unitName = keyToUnitName peer.publicKey;
+      psk =
+        if peer.presharedKey != null
+          then pkgs.writeText "wg-psk" peer.presharedKey
+          else peer.presharedKeyFile;
+    in nameValuePair "wireguard-${interfaceName}-peer-${unitName}"
+      {
+        description = "WireGuard Peer - ${interfaceName} - ${peer.publicKey}";
+        requires = [ "wireguard-${interfaceName}.service" ];
+        after = [ "wireguard-${interfaceName}.service" ];
+        wantedBy = [ "multi-user.target" ];
+        environment.DEVICE = interfaceName;
+        environment.WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
+        path = with pkgs; [ iproute wireguard-tools ];
 
-  generateSetupServiceUnit = name: values:
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+
+        script = let
+          wg_setup = "wg set ${interfaceName} peer ${peer.publicKey}" +
+            optionalString (psk != null) " preshared-key ${psk}" +
+            optionalString (peer.endpoint != null) " endpoint ${peer.endpoint}" +
+            optionalString (peer.persistentKeepalive != null) " persistent-keepalive ${toString peer.persistentKeepalive}" +
+            optionalString (peer.allowedIPs != []) " allowed-ips ${concatStringsSep "," peer.allowedIPs}";
+          route_setup =
+            optionalString (interfaceCfg.allowedIPsAsRoutes != false)
+              (concatMapStringsSep "\n"
+                (allowedIP:
+                  "ip route replace ${allowedIP} dev ${interfaceName} table ${interfaceCfg.table}"
+                ) peer.allowedIPs);
+        in ''
+          ${wg_setup}
+          ${route_setup}
+        '';
+
+        postStop = let
+          route_destroy = optionalString (interfaceCfg.allowedIPsAsRoutes != false)
+            (concatMapStringsSep "\n"
+              (allowedIP:
+                "ip route delete ${allowedIP} dev ${interfaceName} table ${interfaceCfg.table}"
+              ) peer.allowedIPs);
+        in ''
+          wg set ${interfaceName} peer ${peer.publicKey} remove
+          ${route_destroy}
+        '';
+      };
+
+  generateInterfaceUnit = name: values:
     # exactly one way to specify the private key must be set
     #assert (values.privateKey != null) != (values.privateKeyFile != null);
     let privKey = if values.privateKeyFile != null then values.privateKeyFile else pkgs.writeText "wg-key" values.privateKey;
@@ -245,9 +298,7 @@ let
         path = with pkgs; [ kmod iproute wireguard-tools ];
 
         serviceConfig = {
-          Type = "simple";
+          Type = "oneshot";
-          Restart = "on-failure";
-          RestartSec = "5s";
           RemainAfterExit = true;
         };
 
@@ -265,25 +316,8 @@ let
           wg set ${name} private-key ${privKey} ${
             optionalString (values.listenPort != null) " listen-port ${toString values.listenPort}"}
 
-          ${concatMapStringsSep "\n" (peer:
-            assert (peer.presharedKeyFile == null) || (peer.presharedKey == null); # at most one of the two must be set
-            let psk = if peer.presharedKey != null then pkgs.writeText "wg-psk" peer.presharedKey else peer.presharedKeyFile;
-            in
-              "wg set ${name} peer ${peer.publicKey}" +
-              optionalString (psk != null) " preshared-key ${psk}" +
-              optionalString (peer.endpoint != null) " endpoint ${peer.endpoint}" +
-              optionalString (peer.persistentKeepalive != null) " persistent-keepalive ${toString peer.persistentKeepalive}" +
-              optionalString (peer.allowedIPs != []) " allowed-ips ${concatStringsSep "," peer.allowedIPs}"
-            ) values.peers}
-
           ip link set up dev ${name}
 
-          ${optionalString (values.allowedIPsAsRoutes != false) (concatStringsSep "\n" (concatMap (peer:
-              (map (allowedIP:
-                "ip route replace ${allowedIP} dev ${name} table ${values.table}"
-              ) peer.allowedIPs)
-            ) values.peers))}
-
           ${values.postSetup}
         '';
 
@@ -335,7 +369,12 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable (let
+    all_peers = flatten
+      (mapAttrsToList (interfaceName: interfaceCfg:
+        map (peer: { inherit interfaceName interfaceCfg peer;}) interfaceCfg.peers
+      ) cfg.interfaces);
+  in {
 
     assertions = (attrValues (
         mapAttrs (name: value: {
@@ -346,19 +385,24 @@ in
         mapAttrs (name: value: {
           assertion = value.generatePrivateKeyFile -> (value.privateKey == null);
           message = "networking.wireguard.interfaces.${name}.generatePrivateKey must not be set if networking.wireguard.interfaces.${name}.privateKey is set.";
-        }) cfg.interfaces));
+        }) cfg.interfaces))
-
+        ++ map ({ interfaceName, peer, ... }: {
+          assertion = (peer.presharedKey == null) || (peer.presharedKeyFile == null);
+          message = "networking.wireguard.interfaces.${interfaceName} peer «${peer.publicKey}» has both presharedKey and presharedKeyFile set, but only one can be used.";
+        }) all_peers;
 
     boot.extraModulePackages = [ kernel.wireguard ];
     environment.systemPackages = [ pkgs.wireguard-tools ];
 
-    systemd.services = (mapAttrs' generateSetupServiceUnit cfg.interfaces)
+    systemd.services =
+      (mapAttrs' generateInterfaceUnit cfg.interfaces)
+      // (listToAttrs (map generatePeerUnit all_peers))
       // (mapAttrs' generateKeyServiceUnit
       (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));
 
     systemd.paths = mapAttrs' generatePathUnit
       (filterAttrs (name: value: value.privateKeyFile != null) cfg.interfaces);
 
-  };
+  });
 
 }

nixos/modules/services/printing/cupsd.nix

@@ -60,6 +60,8 @@ let
 
     TempDir ${cfg.tempDir}
 
+    SetEnv PATH /var/lib/cups/path/lib/cups/filter:/var/lib/cups/path/bin
+
     # User and group used to run external programs, including
     # those that actually send the job to the printer.  Note that
     # Udev sets the group of printer devices to `lp', so we want
@@ -76,8 +78,6 @@ let
     '') cfg.listenAddresses}
     Listen /run/cups/cups.sock
 
-    SetEnv PATH /var/lib/cups/path/lib/cups/filter:/var/lib/cups/path/bin
-
     DefaultShared ${if cfg.defaultShared then "Yes" else "No"}
 
     Browsing ${if cfg.browsing then "Yes" else "No"}

nixos/modules/services/web-apps/limesurvey.nix

@@ -0,0 +1,288 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkMerge mkOption;
+  inherit (lib) mapAttrs optional optionalString types;
+
+  cfg = config.services.limesurvey;
+
+  user = "limesurvey";
+  group = config.services.httpd.group;
+  stateDir = "/var/lib/limesurvey";
+
+  php = pkgs.php;
+  pkg = pkgs.limesurvey;
+
+  configType = with types; either (either (attrsOf configType) str) (either int bool) // {
+    description = "limesurvey config type (str, int, bool or attribute set thereof)";
+  };
+
+  limesurveyConfig = pkgs.writeText "config.php" ''
+    <?php
+      return json_decode('${builtins.toJSON cfg.config}', true);
+    ?>
+  '';
+
+  mysqlLocal = cfg.database.createLocally && cfg.database.type == "mysql";
+  pgsqlLocal = cfg.database.createLocally && cfg.database.type == "pgsql";
+
+in
+{
+  # interface
+
+  options.services.limesurvey = {
+    enable = mkEnableOption "Limesurvey web application.";
+
+    database = {
+      type = mkOption {
+        type = types.enum [ "mysql" "pgsql" "odbc" "mssql" ];
+        example = "pgsql";
+        default = "mysql";
+        description = "Database engine to use.";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Database host address.";
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = if cfg.database.type == "pgsql" then 5442 else 3306;
+        defaultText = "3306";
+        description = "Database host port.";
+      };
+
+      name = mkOption {
+        type = types.str;
+        default = "limesurvey";
+        description = "Database name.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "limesurvey";
+        description = "Database user.";
+      };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/run/keys/limesurvey-dbpassword";
+        description = ''
+          A file containing the password corresponding to
+          <option>database.user</option>.
+        '';
+      };
+
+      socket = mkOption {
+        type = types.nullOr types.path;
+        default =
+          if mysqlLocal then "/run/mysqld/mysqld.sock"
+          else if pgsqlLocal then "/run/postgresql"
+          else null
+        ;
+        defaultText = "/run/mysqld/mysqld.sock";
+        description = "Path to the unix socket file to use for authentication.";
+      };
+
+      createLocally = mkOption {
+        type = types.bool;
+        default = cfg.database.type == "mysql";
+        defaultText = "true";
+        description = ''
+          Create the database and database user locally.
+          This currently only applies if database type "mysql" is selected.
+        '';
+      };
+    };
+
+    virtualHost = mkOption {
+      type = types.submodule ({
+        options = import ../web-servers/apache-httpd/per-server-options.nix {
+          inherit lib;
+          forMainServer = false;
+        };
+      });
+      example = {
+        hostName = "survey.example.org";
+        enableSSL = true;
+        adminAddr = "webmaster@example.org";
+        sslServerCert = "/var/lib/acme/survey.example.org/full.pem";
+        sslServerKey = "/var/lib/acme/survey.example.org/key.pem";
+      };
+      description = ''
+        Apache configuration can be done by adapting <literal>services.httpd.virtualHosts.&lt;name&gt;</literal>.
+        See <xref linkend="opt-services.httpd.virtualHosts"/> for further information.
+      '';
+    };
+
+    poolConfig = mkOption {
+      type = types.lines;
+      default = ''
+        pm = dynamic
+        pm.max_children = 32
+        pm.start_servers = 2
+        pm.min_spare_servers = 2
+        pm.max_spare_servers = 4
+        pm.max_requests = 500
+      '';
+      description = ''
+        Options for LimeSurvey's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
+      '';
+    };
+
+    config = mkOption {
+      type = configType;
+      default = {};
+      description = ''
+        LimeSurvey configuration. Refer to
+        <link xlink:href="https://manual.limesurvey.org/Optional_settings"/>
+        for details on supported values.
+      '';
+    };
+  };
+
+  # implementation
+
+  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = cfg.database.createLocally -> cfg.database.type == "mysql";
+        message = "services.limesurvey.createLocally is currently only supported for database type 'mysql'";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.user == user;
+        message = "services.limesurvey.database.user must be set to ${user} if services.limesurvey.database.createLocally is set true";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.socket != null;
+        message = "services.limesurvey.database.socket must be set if services.limesurvey.database.createLocally is set to true";
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = "a password cannot be specified if services.limesurvey.database.createLocally is set to true";
+      }
+    ];
+
+    services.limesurvey.config = mapAttrs (name: mkDefault) {
+      runtimePath = "${stateDir}/tmp/runtime";
+      components = {
+        db = {
+          connectionString = "${cfg.database.type}:dbname=${cfg.database.name};host=${if pgsqlLocal then cfg.database.socket else cfg.database.host};port=${toString cfg.database.port}" +
+            optionalString mysqlLocal ";socket=${cfg.database.socket}";
+          username = cfg.database.user;
+          password = mkIf (cfg.database.passwordFile != null) "file_get_contents(\"${toString cfg.database.passwordFile}\");";
+          tablePrefix = "limesurvey_";
+        };
+        assetManager.basePath = "${stateDir}/tmp/assets";
+        urlManager = {
+          urlFormat = "path";
+          showScriptName = false;
+        };
+      };
+      config = {
+        tempdir = "${stateDir}/tmp";
+        uploaddir = "${stateDir}/upload";
+        force_ssl = mkIf cfg.virtualHost.enableSSL "on";
+        config.defaultlang = "en";
+      };
+    };
+
+    services.mysql = mkIf mysqlLocal {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        { name = cfg.database.user;
+          ensurePermissions = {
+            "${cfg.database.name}.*" = "SELECT, CREATE, INSERT, UPDATE, DELETE, ALTER, DROP, INDEX";
+          };
+        }
+      ];
+    };
+
+    services.phpfpm.pools.limesurvey = {
+      phpPackage = php;
+      listen = "/run/phpfpm/limesurvey.sock";
+      extraConfig = ''
+        listen.owner = ${config.services.httpd.user};
+        listen.group = ${config.services.httpd.group};
+        user = ${user};
+        group = ${group};
+
+        env[LIMESURVEY_CONFIG] = ${limesurveyConfig}
+
+        ${cfg.poolConfig}
+      '';
+    };
+
+    services.httpd = {
+      enable = true;
+      adminAddr = mkDefault cfg.virtualHost.adminAddr;
+      extraModules = [ "proxy_fcgi" ];
+      virtualHosts = [
+        (cfg.virtualHost // {
+          documentRoot = mkForce "${pkg}/share/limesurvey";
+          extraConfig = ''
+            Alias "/tmp" "${stateDir}/tmp"
+            <Directory "${stateDir}">
+              AllowOverride all
+              Require all granted
+              Options -Indexes +FollowSymlinks
+            </Directory>
+
+            Alias "/upload" "${stateDir}/upload"
+            <Directory "${stateDir}/upload">
+              AllowOverride all
+              Require all granted
+              Options -Indexes
+            </Directory>
+
+            <Directory "${pkg}/share/limesurvey">
+              <FilesMatch "\.php$">
+                <If "-f %{REQUEST_FILENAME}">
+                  SetHandler "proxy:unix:/run/phpfpm/limesurvey.sock|fcgi://localhost/"
+                </If>
+              </FilesMatch>
+
+              AllowOverride all
+              Options -Indexes
+              DirectoryIndex index.php
+            </Directory>
+          '';
+        })
+      ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${stateDir} 0750 ${user} ${group} - -"
+      "d ${stateDir}/tmp 0750 ${user} ${group} - -"
+      "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
+      "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
+      "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
+      "C ${stateDir}/upload 0750 ${user} ${group} - ${pkg}/share/limesurvey/upload"
+    ];
+
+    systemd.services.limesurvey-init = {
+      wantedBy = [ "multi-user.target" ];
+      before = [ "phpfpm-limesurvey.service" ];
+      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+      environment.LIMESURVEY_CONFIG = limesurveyConfig;
+      script = ''
+        # update or install the database as required
+        ${php}/bin/php ${pkg}/share/limesurvey/application/commands/console.php updatedb || \
+        ${php}/bin/php ${pkg}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
+      '';
+      serviceConfig = {
+        User = user;
+        Group = group;
+        Type = "oneshot";
+      };
+    };
+
+    systemd.services.httpd.after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+
+    users.users."${user}".group = group;
+
+  };
+}

nixos/modules/services/web-servers/apache-httpd/limesurvey.nix

@@ -1,196 +0,0 @@
-{ config, lib, pkgs, serverInfo, ... }:
-
-with lib;
-
-let
-
-  httpd = serverInfo.serverConfig.package;
-
-  version24 = !versionOlder httpd.version "2.4";
-
-  allGranted = if version24 then ''
-    Require all granted
-  '' else ''
-    Order allow,deny
-    Allow from all
-  '';
-
-  limesurveyConfig = pkgs.writeText "config.php" ''
-    <?php
-    $config = array();
-    $config['name']  = "${config.siteName}";
-    $config['runtimePath'] = "${config.dataDir}/tmp/runtime";
-    $config['components'] = array();
-    $config['components']['db'] = array();
-    $config['components']['db']['connectionString'] = '${config.dbType}:host=${config.dbHost};port=${toString config.dbPort};user=${config.dbUser};password=${config.dbPassword};dbname=${config.dbName};';
-    $config['components']['db']['username'] = '${config.dbUser}';
-    $config['components']['db']['password'] = '${config.dbPassword}';
-    $config['components']['db']['charset'] = 'utf-8';
-    $config['components']['db']['tablePrefix'] = "prefix_";
-    $config['components']['assetManager'] = array();
-    $config['components']['assetManager']['basePath'] = '${config.dataDir}/tmp/assets';
-    $config['config'] = array();
-    $config['config']['debug'] = 1;
-    $config['config']['tempdir']  = "${config.dataDir}/tmp";
-    $config['config']['tempdir']  = "${config.dataDir}/tmp";
-    $config['config']['uploaddir']  = "${config.dataDir}/upload";
-    $config['config']['force_ssl'] = '${if config.forceSSL then "on" else ""}';
-    $config['config']['defaultlang'] = '${config.defaultLang}';
-    return $config;
-    ?>
-  '';
-
-  limesurveyRoot = "${pkgs.limesurvey}/share/limesurvey/";
-
-in rec {
-
-  extraConfig = ''
-    Alias ${config.urlPrefix}/tmp ${config.dataDir}/tmp
-
-    <Directory ${config.dataDir}/tmp>
-      ${allGranted}
-      Options -Indexes +FollowSymlinks
-    </Directory>
-
-    Alias ${config.urlPrefix}/upload ${config.dataDir}/upload
-
-    <Directory ${config.dataDir}/upload>
-      ${allGranted}
-      Options -Indexes
-    </Directory>
-
-    ${if config.urlPrefix != "" then ''
-      Alias ${config.urlPrefix} ${limesurveyRoot}
-    '' else ''
-      RewriteEngine On
-      RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-f
-      RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-d
-    ''}
-
-    <Directory ${limesurveyRoot}>
-      DirectoryIndex index.php
-    </Directory>
-  '';
-
-  globalEnvVars = [
-    { name = "LIMESURVEY_CONFIG"; value = limesurveyConfig; }
-  ];
-
-  documentRoot = if config.urlPrefix == "" then limesurveyRoot else null;
-
-  enablePHP = true;
-
-  options = {
-
-    id = mkOption {
-      default = "main";
-      description = ''
-        A unique identifier necessary to keep multiple Limesurvey server
-        instances on the same machine apart.  This is used to
-        disambiguate the administrative scripts, which get names like
-        mediawiki-$id-change-password.
-      '';
-    };
-
-    urlPrefix = mkOption {
-      default = "";
-      description = "Url prefix for site.";
-      type = types.str;
-    };
-
-    dbType = mkOption {
-      default = "pgsql";
-      description = "Type of database for limesurvey, for now, only pgsql.";
-      type = types.enum ["pgsql"];
-    };
-
-    dbName = mkOption {
-      default = "limesurvey";
-      description = "Name of the database that holds the limesurvey data.";
-      type = types.str;
-    };
-
-    dbHost = mkOption {
-      default = "localhost";
-      description = "Limesurvey database host.";
-      type = types.str;
-    };
-
-    dbPort = mkOption {
-      default = 5432;
-      description = "Limesurvey database port.";
-      type = types.int;
-    };
-
-    dbUser = mkOption {
-      default = "limesurvey";
-      description = "Limesurvey database user.";
-      type = types.str;
-    };
-
-    dbPassword = mkOption {
-      example = "foobar";
-      description = "Limesurvey database password.";
-      type = types.str;
-    };
-
-    adminUser = mkOption {
-      description = "Limesurvey admin username.";
-      default = "admin";
-      type = types.str;
-    };
-
-    adminPassword = mkOption {
-      description = "Default limesurvey admin password.";
-      default = "admin";
-      type = types.str;
-    };
-
-    adminEmail = mkOption {
-      description = "Limesurvey admin email.";
-      default = "admin@admin.com";
-      type = types.str;
-    };
-
-    forceSSL = mkOption {
-      default = false;
-      description = "Force use of HTTPS connection.";
-      type = types.bool;
-    };
-
-    siteName = mkOption {
-      default = "LimeSurvey";
-      description = "LimeSurvey name of the site.";
-      type = types.str;
-    };
-
-    defaultLang = mkOption {
-      default = "en";
-      description = "LimeSurvey default language.";
-      type = types.str;
-    };
-
-    dataDir = mkOption {
-      default = "/var/lib/limesurvey";
-      description = "LimeSurvey data directory.";
-      type = types.path;
-    };
-  };
-
-  startupScript = pkgs.writeScript "limesurvey_startup.sh" ''
-    if [ ! -f ${config.dataDir}/.created ]; then
-      mkdir -p ${config.dataDir}/{tmp/runtime,tmp/assets,tmp/upload,upload}
-      chmod -R ug+rw ${config.dataDir}
-      chmod -R o-rwx ${config.dataDir}
-      chown -R wwwrun:wwwrun ${config.dataDir}
-
-      ${pkgs.postgresql}/bin/createuser --no-superuser --no-createdb --no-createrole "${config.dbUser}" || true
-      ${pkgs.postgresql}/bin/createdb "${config.dbName}" -O "${config.dbUser}" || true
-      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/psql -U postgres -d postgres -c "alter user ${config.dbUser} with password '${config.dbPassword}';" || true
-
-      ${pkgs.limesurvey}/bin/limesurvey-console install '${config.adminUser}' '${config.adminPassword}' '${config.adminUser}' '${config.adminEmail}'
-
-      touch ${config.dataDir}/.created
-    fi
-  '';
-}

nixos/modules/services/web-servers/apache-httpd/wordpress.nix

@@ -273,7 +273,7 @@ in
     if [ ! -d ${serverInfo.fullConfig.services.mysql.dataDir}/${config.dbName} ]; then
       echo "Need to create the database '${config.dbName}' and grant permissions to user named '${config.dbUser}'."
       # Wait until MySQL is up
-      while [ ! -e ${serverInfo.fullConfig.services.mysql.pidDir}/mysqld.pid ]; do
+      while [ ! -S /run/mysqld/mysqld.sock ]; do
         sleep 1
       done
       ${pkgs.mysql}/bin/mysql -e 'CREATE DATABASE ${config.dbName};'

nixos/modules/services/web-servers/hydron.nix

@@ -2,7 +2,6 @@
 
 let
   cfg = config.services.hydron;
-  postgres = config.services.postgresql;
 in with lib; {
   options.services.hydron = {
     enable = mkEnableOption "hydron";
@@ -81,40 +80,40 @@ in with lib; {
   };
 
   config = mkIf cfg.enable {
-    security.sudo.enable = cfg.enable;
-    services.postgresql.enable = cfg.enable;
     services.hydron.passwordFile = mkDefault (pkgs.writeText "hydron-password-file" cfg.password);
     services.hydron.postgresArgsFile = mkDefault (pkgs.writeText "hydron-postgres-args" cfg.postgresArgs);
     services.hydron.postgresArgs = mkDefault ''
       {
         "driver": "postgres",
-        "connection": "user=hydron password=${cfg.password} dbname=hydron sslmode=disable"
+        "connection": "user=hydron password=${cfg.password} host=/run/postgresql dbname=hydron sslmode=disable"
       }
     '';
 
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "hydron" ];
+      ensureUsers = [
+        { name = "hydron";
+          ensurePermissions = { "DATABASE hydron" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' 0750 hydron hydron - -"
+      "d '${cfg.dataDir}/.hydron' - hydron hydron - -"
+      "d '${cfg.dataDir}/images' - hydron hydron - -"
+      "Z '${cfg.dataDir}' - hydron hydron - -"
+
+      "L+ '${cfg.dataDir}/.hydron/db_conf.json' - - - - ${cfg.postgresArgsFile}"
+    ];
+
     systemd.services.hydron = {
       description = "hydron";
       after = [ "network.target" "postgresql.service" ];
       wantedBy = [ "multi-user.target" ];
 
-      preStart = ''
-        # Ensure folder exists or create it and permissions are correct
-        mkdir -p ${escapeShellArg cfg.dataDir}/{.hydron,images}
-        ln -sf ${escapeShellArg cfg.postgresArgsFile} ${escapeShellArg cfg.dataDir}/.hydron/db_conf.json
-        chmod 750 ${escapeShellArg cfg.dataDir}
-        chown -R hydron:hydron ${escapeShellArg cfg.dataDir}
-
-        # Ensure the database is correct or create it
-        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createuser \
-          -SDR hydron || true
-        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createdb \
-          -T template0 -E UTF8 -O hydron hydron || true
-        ${pkgs.sudo}/bin/sudo -u hydron ${postgres.package}/bin/psql \
-          -c "ALTER ROLE hydron WITH PASSWORD '$(cat ${escapeShellArg cfg.passwordFile})';" || true
-      '';
-
       serviceConfig = {
-        PermissionsStartOnly = true;
         User = "hydron";
         Group = "hydron";
         ExecStart = "${pkgs.hydron}/bin/hydron serve"
@@ -139,7 +138,7 @@ in with lib; {
       description = "Automatically import paths into hydron and possibly fetch tags";
       after = [ "network.target" "hydron.service" ];
       wantedBy = [ "timers.target" ];
-      
+
       timerConfig = {
         Persistent = true;
         OnCalendar = cfg.interval;
@@ -148,11 +147,10 @@ in with lib; {
 
     users = {
       groups.hydron.gid = config.ids.gids.hydron;
-      
+
       users.hydron = {
         description = "hydron server service user";
         home = cfg.dataDir;
-        createHome = true;
         group = "hydron";
         uid = config.ids.uids.hydron;
       };

nixos/modules/services/web-servers/nginx/default.nix

@@ -64,7 +64,7 @@ let
       include ${cfg.package}/conf/uwsgi_params;
 
       ${optionalString (cfg.resolver.addresses != []) ''
-        resolver ${toString cfg.resolver.addresses} ${optionalString (cfg.resolver.valid != "") "valid=${cfg.resolver.valid}"};
+        resolver ${toString cfg.resolver.addresses} ${optionalString (cfg.resolver.valid != "") "valid=${cfg.resolver.valid}"} ${optionalString (!cfg.resolver.ipv6) "ipv6=off"};
       ''}
       ${upstreamConfig}
 
@@ -521,6 +521,15 @@ in
                 An optional valid parameter allows overriding it
               '';
             };
+            ipv6 = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                By default, nginx will look up both IPv4 and IPv6 addresses while resolving.
+                If looking up of IPv6 addresses is not desired, the ipv6=off parameter can be
+                specified.
+              '';
+            };
           };
         };
         description = ''

nixos/modules/services/x11/desktop-managers/enlightenment.nix

@@ -25,7 +25,7 @@ in
 
   };
 
-  config = mkIf (xcfg.enable && cfg.enable) {
+  config = mkIf cfg.enable {
 
     environment.systemPackages = [
       e.efl e.enlightenment
@@ -38,10 +38,10 @@ in
       pkgs.xorg.xcursorthemes
     ];
 
-    environment.pathsToLink = [ 
+    environment.pathsToLink = [
-      "/etc/enlightenment" 
+      "/etc/enlightenment"
-      "/share/enlightenment" 
+      "/share/enlightenment"
-      "/share/elementary" 
+      "/share/elementary"
       "/share/locale"
     ];
 

nixos/modules/services/x11/desktop-managers/lumina.nix

@@ -21,7 +21,7 @@ in
   };
 
 
-  config = mkIf (xcfg.enable && cfg.enable) {
+  config = mkIf cfg.enable {
 
     services.xserver.desktopManager.session = singleton {
       name = "lumina";

nixos/modules/services/x11/desktop-managers/lxqt.nix

@@ -26,7 +26,7 @@ in
 
   };
 
-  config = mkIf (xcfg.enable && cfg.enable) {
+  config = mkIf cfg.enable {
 
     services.xserver.desktopManager.session = singleton {
       name = "lxqt";

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -42,7 +42,7 @@ in
 
   };
 
-  config = mkIf (xcfg.enable && cfg.enable) {
+  config = mkIf cfg.enable {
 
     services.xserver.desktopManager.session = singleton {
       name = "mate";

nixos/modules/services/x11/desktop-managers/maxx.nix

@@ -10,7 +10,7 @@ in {
     enable = mkEnableOption "MaXX desktop environment";
   };
 
-  config = mkIf (xcfg.enable && cfg.enable) {
+  config = mkIf cfg.enable {
     environment.systemPackages = [ pkgs.maxx ];
 
     # there is hardcoded path in binaries

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -36,7 +36,7 @@ in
 
 
   config = mkMerge [
-    (mkIf (xcfg.enable && cfg.enable) {
+    (mkIf cfg.enable {
       services.xserver.desktopManager.session = singleton {
         name = "plasma5";
         bgSupport = true;
@@ -161,7 +161,6 @@ in
 
           qtvirtualkeyboard
 
-          libsForQt56.phonon-backend-gstreamer
           libsForQt5.phonon-backend-gstreamer
 
           xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/

nixos/modules/services/x11/desktop-managers/xterm.nix

@@ -19,7 +19,7 @@ in
 
   };
 
-  config = mkIf (config.services.xserver.enable && cfg.enable) {
+  config = mkIf cfg.enable {
 
     services.xserver.desktopManager.session = singleton
       { name = "xterm";

nixos/modules/services/x11/display-managers/gdm.nix

@@ -14,6 +14,23 @@ let
       exec "$@"
     '';
 
+  # Solves problems like:
+  # https://wiki.archlinux.org/index.php/Talk:Bluetooth_headset#GDMs_pulseaudio_instance_captures_bluetooth_headset
+  # Instead of blacklisting plugins, we use Fedora's PulseAudio configuration for GDM:
+  # https://src.fedoraproject.org/rpms/gdm/blob/master/f/default.pa-for-gdm
+  pulseConfig = pkgs.writeText "default.pa" ''
+    load-module module-device-restore
+    load-module module-card-restore
+    load-module module-udev-detect
+    load-module module-native-protocol-unix
+    load-module module-default-device-restore
+    load-module module-rescue-streams
+    load-module module-always-sink
+    load-module module-intended-roles
+    load-module module-suspend-on-idle
+    load-module module-position-event-sounds
+  '';
+
 in
 
 {
@@ -126,6 +143,11 @@ in
           GDM_X_SESSION_WRAPPER = "${xSessionWrapper}";
         };
         execCmd = "exec ${gdm}/bin/gdm";
+        preStart = optionalString config.hardware.pulseaudio.enable ''
+          mkdir -p /run/gdm/.config/pulse
+          ln -sf ${pulseConfig} /run/gdm/.config/pulse/default.pa
+          chown -R gdm:gdm /run/gdm/.config
+        '';
       };
 
     # Because sd_login_monitor_new requires /run/systemd/machines

nixos/modules/services/x11/xserver.nix

@@ -347,6 +347,7 @@ in
 
       xkbDir = mkOption {
         type = types.path;
+        default = "${pkgs.xkeyboard_config}/etc/X11/xkb";
         description = ''
           Path used for -xkbdir xserver parameter.
         '';
@@ -708,8 +709,6 @@ in
         xorg.xf86inputevdev.out
       ];
 
-    services.xserver.xkbDir = mkDefault "${pkgs.xkeyboard_config}/etc/X11/xkb";
-
     system.extraDependencies = singleton (pkgs.runCommand "xkb-validated" {
       inherit (cfg) xkbModel layout xkbVariant xkbOptions;
       nativeBuildInputs = [ pkgs.xkbvalidate ];

nixos/tests/all-tests.nix

@@ -135,6 +135,7 @@ in
   leaps = handleTest ./leaps.nix {};
   lidarr = handleTest ./lidarr.nix {};
   #lightdm = handleTest ./lightdm.nix {};
+  limesurvey = handleTest ./limesurvey.nix {};
   login = handleTest ./login.nix {};
   #logstash = handleTest ./logstash.nix {};
   mailcatcher = handleTest ./mailcatcher.nix {};
@@ -161,6 +162,7 @@ in
   nat.standalone = handleTest ./nat.nix { withFirewall = false; };
   ndppd = handleTest ./ndppd.nix {};
   neo4j = handleTest ./neo4j.nix {};
+  nesting = handleTest ./nesting.nix {};
   netdata = handleTest ./netdata.nix {};
   networking.networkd = handleTest ./networking.nix { networkd = true; };
   networking.scripted = handleTest ./networking.nix { networkd = false; };

nixos/tests/limesurvey.nix

@@ -0,0 +1,21 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "limesurvey";
+  meta.maintainers = [ pkgs.stdenv.lib.maintainers.aanderse ];
+
+  machine =
+    { ... }:
+    { services.limesurvey.enable = true;
+      services.limesurvey.virtualHost.hostName = "example.local";
+      services.limesurvey.virtualHost.adminAddr = "root@example.local";
+
+      # limesurvey won't work without a dot in the hostname
+      networking.hosts."127.0.0.1" = [ "example.local" ];
+    };
+
+  testScript = ''
+    startAll;
+
+    $machine->waitForUnit('phpfpm-limesurvey.service');
+    $machine->succeed('curl http://example.local/') =~ /The following surveys are available/ or die;
+  '';
+})

nixos/tests/nesting.nix

@@ -0,0 +1,42 @@
+import ./make-test.nix {
+  name = "nesting";
+  nodes =  {
+    clone = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.cowsay ];
+      nesting.clone = [
+        ({ pkgs, ... }: {
+          environment.systemPackages = [ pkgs.hello ];
+        })
+      ];
+    };
+    children = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.cowsay ];
+      nesting.children = [
+        ({ pkgs, ... }: {
+          environment.systemPackages = [ pkgs.hello ];
+        })
+      ];
+    };
+  };
+  testScript = ''
+    $clone->waitForUnit("default.target");
+    $clone->succeed("cowsay hey");
+    $clone->fail("hello");
+
+    # Nested clones do inherit from parent
+    $clone->succeed("/run/current-system/fine-tune/child-1/bin/switch-to-configuration test");
+    $clone->succeed("cowsay hey");
+    $clone->succeed("hello");
+    
+
+    $children->waitForUnit("default.target");
+    $children->succeed("cowsay hey");
+    $children->fail("hello");
+
+    # Nested children do not inherit from parent
+    $children->succeed("/run/current-system/fine-tune/child-1/bin/switch-to-configuration test");
+    $children->fail("cowsay hey");
+    $children->succeed("hello");
+
+  '';
+}

nixos/tests/prometheus-exporters.nix

@@ -1,6 +1,13 @@
-import ./make-test.nix ({ lib, pkgs, ... }:
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with pkgs.lib;
+with import ../lib/testing.nix { inherit system pkgs; };
+
 let
-  escape' = str: lib.replaceChars [''"'' "$" "\n"] [''\\\"'' "\\$" ""] str;
+  escape' = str: replaceChars [''"'' "$" "\n"] [''\\\"'' "\\$" ""] str;
 
 /*
  * The attrset `exporterTests` contains one attribute
@@ -51,6 +58,25 @@ let
 
   exporterTests = {
 
+    bind = {
+      exporterConfig = {
+        enable = true;
+      };
+      metricProvider = {
+        services.bind.enable = true;
+        services.bind.extraConfig = ''
+          statistics-channels {
+            inet 127.0.0.1 port 8053 allow { localhost; };
+          };
+        '';
+      };
+      exporterTest = ''
+        waitForUnit("prometheus-bind-exporter.service");
+        waitForOpenPort(9119);
+        succeed("curl -sSf http://localhost:9119/metrics" | grep -q 'bind_query_recursions_total 0');
+      '';
+    };
+
     blackbox = {
       exporterConfig = {
         enable = true;
@@ -106,25 +132,6 @@ let
       '';
     };
 
-    bind = {
-      exporterConfig = {
-        enable = true;
-      };
-      metricProvider = {
-        services.bind.enable = true;
-        services.bind.extraConfig = ''
-          statistics-channels {
-            inet 127.0.0.1 port 8053 allow { localhost; };
-          };
-        '';
-      };
-      exporterTest = ''
-        waitForUnit("prometheus-bind-exporter.service");
-        waitForOpenPort(9119);
-        succeed("curl -sSf http://localhost:9119/metrics" | grep -q 'bind_query_recursions_total 0');
-      '';
-    };
-
     dovecot = {
       exporterConfig = {
         enable = true;
@@ -309,27 +316,23 @@ let
       '';
     };
   };
-
-  nodes = lib.mapAttrs (exporter: testConfig: lib.mkMerge [{
-    services.prometheus.exporters.${exporter} = testConfig.exporterConfig;
-  } testConfig.metricProvider or {}]) exporterTests;
-
-  testScript = lib.concatStrings (lib.mapAttrsToList (exporter: testConfig: (''
-    subtest "${exporter}", sub {
-      ${"$"+exporter}->start();
-      ${lib.concatStringsSep "  " (map (line: ''
-        ${"$"+exporter}->${line};
-      '') (lib.splitString "\n" (lib.removeSuffix "\n" testConfig.exporterTest)))}
-      ${"$"+exporter}->shutdown();
-    };
-  '')) exporterTests);
 in
-{
+mapAttrs (exporter: testConfig: (makeTest {
-  name = "prometheus-exporters";
+  name = "prometheus-${exporter}-exporter";
 
-  inherit nodes testScript;
+  nodes.${exporter} = mkMerge [{
+    services.prometheus.exporters.${exporter} = testConfig.exporterConfig;
+  } testConfig.metricProvider or {}];
 
-  meta = with lib.maintainers; {
+  testScript = ''
+    ${"$"+exporter}->start();
+    ${concatStringsSep "  " (map (line: ''
+      ${"$"+exporter}->${line};
+    '') (splitString "\n" (removeSuffix "\n" testConfig.exporterTest)))}
+    ${"$"+exporter}->shutdown();
+  '';
+
+  meta = with maintainers; {
     maintainers = [ willibutz ];
   };
-})
+})) exporterTests

pkgs/applications/altcoins/ethabi.nix

@@ -13,7 +13,7 @@ buildRustPackage rec {
     sha256 = "1gqd3vwsvv1wvi659qcdywgmh41swblpwmmxb033k8irw581dwq4";
   };
 
-  cargoSha256 = "0ckj5s5fr7xdqpnn4m9zwa1w71g6wwqqvax6f4xkijxdcx83n6c2";
+  cargoSha256 = "0zkdai31jf8f5syklaxq43ydjvp5xclr8pd6y1q6vkwjz6z49hzm";
 
   cargoBuildFlags = ["--features cli"];
 

pkgs/applications/altcoins/polkadot/default.nix

@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0v7g03rbml2afw0splmyjh9nqpjg0ldjw09hyc0jqd3qlhgxiiyj";
   }; 
 
-  cargoSha256 = "0wwkaxqj2v5zach5xcqfzf6prc0gxy2v47janglp44xbxbx9xk08";
+  cargoSha256 = "19xcxpbkrbygghz9qi52vzviksxg28m7ibvl359vlhqv1cjxmpsq";
 
   buildInputs = [ pkgconfig openssl openssl.dev ];
 

pkgs/applications/altcoins/zcash/librustzcash/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "02l1f46frpvw1r6k1wfh77mrsnmsdvifqx0vnscxz4xgb9ia9d1c";
   };
 
-  cargoSha256 = "1b0kal53ggcr59hbrsdj8fifjycahrmzwq677n9h3fywv4r237m6";
+  cargoSha256 = "1xlq8vkzfyr5q8gxvzkwi8r1kxg4rg8l1ckdwfdxlkhnw0yscbra";
 
   installPhase = ''
     mkdir -p $out/lib

pkgs/applications/audio/pulseeffects/default.nix

@@ -47,13 +47,13 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "pulseeffects";
-  version = "4.6.0";
+  version = "4.6.2";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "pulseeffects";
     rev = "v${version}";
-    sha256 = "1ap07sw4j1a0al2hqh781m8ivlplxlaw515gkf65q100q80kr0zj";
+    sha256 = "042qc48h1h8kr4arlbk1psqw6s0cvhspzfi8ih2xqqyifwl1i93g";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/android-studio/default.nix

@@ -18,9 +18,9 @@ let
     sha256Hash = "0b9yj3rf3nk8y9qfmf5kjh8rwn73v7ghym1bhz864r079h7lwr53";
   };
   latestVersion = { # canary & dev
-    version = "3.6.0.1"; # "Android Studio 3.6 Canary 1"
+    version = "3.6.0.2"; # "Android Studio 3.6 Canary 2"
-    build = "191.5595896";
+    build = "191.5599242";
-    sha256Hash = "1nd0xmq1aplznxbsnmzgszbblj6vdyhir708mks5ss6achn21xxc";
+    sha256Hash = "0aivw3lz09v7sq28ply9nczaxkwdlkb5byr8yym5qydkcv35x9gl";
   };
 in rec {
   # Attributes are named by their corresponding release channels

pkgs/applications/editors/jetbrains/default.nix

@@ -250,12 +250,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2019.1.3"; /* updated by script */
+    version = "2019.1.4"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "04ykwylg2h5l28h7wb7v41nslb82fvcm6p4d6f9k8aw3zhkaalv4"; /* updated by script */
+      sha256 = "1ccb7g5nzipfmvx6ycg9cn3s7bykpwws62239hg0frlb6xx9y969"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -276,12 +276,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2019.1.2"; /* updated by script */
+    version = "2019.1.3"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "162mkjmbznxwn7z1zv3x4kik8wx0fvavcdfdmnn9pads5zg2s4b3"; /* updated by script */
+      sha256 = "0nw9s4vc7dbj2daxi88m1hqyl3rbzvahbw4mhp409ngac3l2pqmh"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
@@ -289,12 +289,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2019.1.2"; /* updated by script */
+    version = "2019.1.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "01mlnjs7ak7xv9zk3v9r99chrcnw10qkv49gsydsm6a0wqac29xg"; /* updated by script */
+      sha256 = "02ddxqwflqrr5xf27s1gmaz7ai400cxzlbiz2wrs9vqsdcpj9jbr"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -302,12 +302,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2019.1.2"; /* updated by script */
+    version = "2019.1.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "09c8135rm45k7yyqadnf715i8k2jllqc1p5jdh6cnb29fwmyk5m5"; /* updated by script */
+      sha256 = "0qhj3wai0jb3bg8ddck27ivx2q60xsbk8pj6ryqp5dh75ja4zx1s"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -328,12 +328,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2019.1.2"; /* updated by script */
+    version = "2019.1.3"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "05axjd2b2648sxs93d84va90373i8nma541c619xvb967kx1gzdh"; /* updated by script */
+      sha256 = "0acwfxp0ky3014zcvmlsig1732h87jvmf2wwjankamrk6ynmlvgh"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
@@ -341,12 +341,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2019.1.2"; /* updated by script */
+    version = "2019.1.3"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1s9llgjxdg99fql62kx6skpd545xqmrxwpbg19mjrjlz6pm71z3r"; /* updated by script */
+      sha256 = "0948jlpfz5d4k12mn2xrl8z5kc44a3986kl5znvzr5b8h65xw8l3"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";

pkgs/applications/editors/neovim/default.nix

@@ -21,13 +21,13 @@ let
 in
   stdenv.mkDerivation rec {
     name = "neovim-unwrapped-${version}";
-    version = "0.3.5";
+    version = "0.3.7";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
       rev = "v${version}";
-      sha256 = "113lrr9gwimvvzlkwlishm4cjqcf30xq9jfxn7vh41ckgnbiwf3w";
+      sha256 = "1j6w5jvq5v7kf7diad91qs1acr427nidnk9s24yyrz0hwdd1c2lh";
     };
 
     patches = [
@@ -37,6 +37,7 @@ in
       ./system_rplugin_manifest.patch
     ];
 
+    dontFixCmake = true;
     enableParallelBuilding = true;
 
     buildInputs = [
@@ -76,7 +77,7 @@ in
     disallowedReferences = [ stdenv.cc ];
 
     cmakeFlags = [
-      "-DLUA_PRG=${neovimLuaEnv}/bin/lua"
+      "-DLUA_PRG=${neovimLuaEnv.interpreter}"
       "-DGPERF_PRG=${gperf}/bin/gperf"
     ]
     ++ optional doCheck "-DBUSTED_PRG=${neovimLuaEnv}/bin/busted"

pkgs/applications/editors/neovim/wrapper.nix

@@ -12,7 +12,8 @@ neovim:
 
 let
   wrapper = {
-      withPython ? true,  extraPythonPackages ? (_: []) /* the function you would have passed to python.withPackages */
+      extraMakeWrapperArgs ? ""
+    , withPython ? true,  extraPythonPackages ? (_: []) /* the function you would have passed to python.withPackages */
     , withPython3 ? true,  extraPython3Packages ? (_: []) /* the function you would have passed to python.withPackages */
     , withNodeJs? false
     , withRuby ? true
@@ -113,7 +114,7 @@ let
         # https://github.com/neovim/neovim/issues/9413
         wrapProgram $out/bin/nvim \
           --set NVIM_SYSTEM_RPLUGIN_MANIFEST $out/rplugin.vim \
-          --add-flags "-u ${vimUtils.vimrcFile configure}"
+          --add-flags "-u ${vimUtils.vimrcFile configure}" ${extraMakeWrapperArgs}
       '';
 
     preferLocalBuild = true;

pkgs/applications/gis/whitebox-tools/default.nix

@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "1gbgirng21ak0kl3fiyr6lxwzrjd5v79gcrbzf941nb8y8rlvz7k";
+  cargoSha256 = "11m13h9b75xz8dfisfcykar53qsl1crrp3l75s73gkkkvczlfd24";
 
   meta = with stdenv.lib; {
     description = "An advanced geospatial data analysis platform";

pkgs/applications/graphics/avocode/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "avocode-${version}";
-  version = "3.7.2";
+  version = "3.8.0";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "0qwghs9q91ifywvrn8jgnnqzfrbbsi4lf92ikxq0dmdv734pdw0c";
+    sha256 = "1m5shx4xnjrf5lfxivh3ns0a08wdrkhfyk6hbmkv65j9pwc1sr8n";
   };
 
   libPath = stdenv.lib.makeLibraryPath (with xorg; [

pkgs/applications/graphics/freecad/default.nix

@@ -9,11 +9,11 @@ let
   pythonPackages = python27Packages;
 in stdenv.mkDerivation rec {
   name = "freecad-${version}";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchurl {
     url = "https://github.com/FreeCAD/FreeCAD/archive/${version}.tar.gz";
-    sha256 = "0lamrs84zv99v4z7yi6d9amjmnh7r6frairc2aajgfic380720bc";
+    sha256 = "1r5rhaiq22yhrfpmcmzx6bflqj6q9asbyjyfja4x4rzfy9yh0a4v";
   };
 
   buildInputs = [ cmake coin3d xercesc ode eigen qt4 opencascade gts

pkgs/applications/graphics/krita/default.nix

@@ -4,14 +4,14 @@
 , kio, kcrash
 , boost, libraw, fftw, eigen, exiv2, libheif, lcms2, gsl, openexr, giflib
 , openjpeg, opencolorio, vc, poppler, curl, ilmbase
-, qtmultimedia, qtx11extras
+, qtmultimedia, qtx11extras, quazip
 , python3Packages
 }:
 
 let
 
-major = "4.1";
+major = "4.2";
-minor = "8";
+minor = "0";
 patch = null;
 
 in
@@ -22,7 +22,7 @@ mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.kde.org/stable/krita/${major}.${minor}/${name}.tar.gz";
-    sha256 = "0h2rplc76r82b8smk61zci1ijj9xkjmf20pdqa8fc2lz4zicjxh4";
+    sha256 = "1l5bhk4b2f3qdzg9jk2sxz2bq8cqs10nm3wgkrkbqs6vig75rsym";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip makeWrapper ];
@@ -32,7 +32,7 @@ mkDerivation rec {
     ki18n kitemmodels kitemviews kwindowsystem kio kcrash
     boost libraw fftw eigen exiv2 lcms2 gsl openexr libheif giflib
     openjpeg opencolorio poppler curl ilmbase
-    qtmultimedia qtx11extras
+    qtmultimedia qtx11extras quazip
     python3Packages.pyqt5
   ] ++ lib.optional (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) vc;
 

pkgs/applications/graphics/nomacs/default.nix

@@ -17,16 +17,16 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.10.2";
+  name = "nomacs-${version}";
+  version = "3.12";
+
   src = fetchFromGitHub {
     owner = "nomacs";
     repo = "nomacs";
     rev = version;
-    sha256 = "0v2gsdc8caswf2b5aa023d8kil1fqf4r9mlg15180h3c92f8jzvh";
+    sha256 = "12582i5v85da7vwjxj8grj99hxg34ij5cn3b1578wspdfw1xfy1i";
   };
 
-  name = "nomacs-${version}";
-
   enableParallelBuilding = true;
 
   setSourceRoot = ''

pkgs/applications/graphics/openimageio/2.x.nix

@@ -0,0 +1,60 @@
+{ stdenv
+, fetchFromGitHub
+, boost
+, cmake
+, ilmbase
+, libjpeg
+, libpng
+, libtiff
+, opencolorio
+, openexr
+, robin-map
+, unzip
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openimageio";
+  version = "2.0.8";
+
+  src = fetchFromGitHub {
+    owner = "OpenImageIO";
+    repo = "oiio";
+    rev = "Release-${version}";
+    sha256 = "0nk72h7q1n664b268zkhibb7a3i7fb3nl2z7fg31ys5r9zlq6mnp";
+  };
+
+  outputs = [ "bin" "out" "dev" "doc" ];
+
+  nativeBuildInputs = [
+    cmake
+    unzip
+  ];
+
+  buildInputs = [
+    boost
+    ilmbase
+    libjpeg
+    libpng
+    libtiff
+    opencolorio
+    openexr
+    robin-map
+  ];
+
+  cmakeFlags = [
+    "-DUSE_PYTHON=OFF"
+    "-DUSE_QT=OFF"
+    # GNUInstallDirs
+    "-DCMAKE_INSTALL_BINDIR=${placeholder "bin"}/bin"
+    "-DCMAKE_INSTALL_INCLUDEDIR=${placeholder "dev"}/include"
+    "-DCMAKE_INSTALL_LIBDIR=lib" # needs relative path for pkgconfig
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = http://www.openimageio.org;
+    description = "A library and tools for reading and writing images";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ goibhniu jtojnar ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/graphics/openimageio/default.nix

@@ -3,7 +3,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "openimageio-${version}";
+  pname = "openimageio";
   version = "1.8.16";
 
   src = fetchFromGitHub {
@@ -15,28 +15,25 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "out" "dev" "doc" ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake unzip ];
   buildInputs = [
     boost ilmbase libjpeg libpng
     libtiff opencolorio openexr
-    unzip
   ];
 
   cmakeFlags = [
     "-DUSE_PYTHON=OFF"
+    # GNUInstallDirs
+    "-DCMAKE_INSTALL_BINDIR=${placeholder "bin"}/bin"
   ];
 
-  preBuild = ''
+  makeFlags = [
-    makeFlags="ILMBASE_HOME=${ilmbase.dev} OPENEXR_HOME=${openexr.dev} USE_PYTHON=0
+    "ILMBASE_HOME=${ilmbase.dev}"
-      INSTALLDIR=$out dist_dir="
+    "OPENEXR_HOME=${openexr.dev}"
-  '';
+    "USE_PYTHON=0"
-
+    "INSTALLDIR=${placeholder "out"}"
-  postInstall = ''
+    "dist_dir="
-    mkdir -p $bin
+  ];
-    mv $out/bin $bin/
-  '';
-
-  enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
     homepage = http://www.openimageio.org;

pkgs/applications/misc/buku/default.nix

@@ -1,14 +1,14 @@
 { stdenv, python3, fetchFromGitHub, fetchpatch }:
 
 with python3.pkgs; buildPythonApplication rec {
-  version = "4.2";
+  version = "4.2.2";
   pname = "buku";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "buku";
     rev = "v${version}";
-    sha256 = "1ipvhd9wa4iq0763b9h4f3xa6x31bssi6m0595w97mdhh9n6bgxg";
+    sha256 = "1wy5i1av1s98yr56ybiq66kv0vg48zci3fp91zfgj04nh2966w1w";
   };
 
   checkInputs = [

pkgs/applications/misc/cgminer/default.nix

@@ -1,5 +1,5 @@
 { fetchgit, stdenv, pkgconfig, libtool, autoconf, automake
-, curl, ncurses, amdappsdk, amdadlsdk, xorg, jansson }:
+, curl, ncurses, ocl-icd, opencl-headers, xorg, jansson }:
 
 stdenv.mkDerivation rec {
   version = "3.7.2";
@@ -13,17 +13,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
-    autoconf automake libtool curl ncurses amdappsdk amdadlsdk
+    autoconf automake libtool curl ncurses ocl-icd opencl-headers
     xorg.libX11 xorg.libXext xorg.libXinerama jansson
   ];
   configureScript = "./autogen.sh";
   configureFlags = [ "--enable-scrypt" "--enable-opencl" ];
   NIX_LDFLAGS = "-lgcc_s -lX11 -lXext -lXinerama";
 
-  preConfigure = ''
-    ln -s ${amdadlsdk}/include/* ADL_SDK/
-  '';
-
   postBuild = ''
     gcc api-example.c -o cgminer-api
   '';

pkgs/applications/misc/cura/default.nix

@@ -2,20 +2,20 @@
 
 mkDerivation rec {
   name = "cura-${version}";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "Cura";
     rev = version;
-    sha256 = "18pxlmrw8m2mir177f0j9bma7rk29vam91gd86c0d458nw21q2qf";
+    sha256 = "1mfpnjrh3splpkadgml3v71k939g56zb9hbmzghwfjwlrf8valmz";
   };
 
   materials = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "fdm_materials";
     rev = version;
-    sha256 = "0g2dkph0ll7d9109n17vmfwb4fpc8lhyb1z1q68j8vblyvg08d12";
+    sha256 = "0yp2162msxfwpixzvassn23p7r3swjpwk4nhsjka5w6fm8pv0wpl";
   };
 
   buildInputs = [ qtbase qtquickcontrols2 qtgraphicaleffects ];
@@ -27,12 +27,6 @@ mkDerivation rec {
   cmakeFlags = [
     "-DURANIUM_DIR=${python3.pkgs.uranium.src}"
     "-DCURA_VERSION=${version}"
-
-    # see https://github.com/Ultimaker/Cura/issues/5142
-    "-DCURA_SDK_VERSION=6.0.0"
-
-    # remove after 4.0.0, see https://github.com/void-linux/void-packages/pull/9880#issuecomment-475453025
-    "-DCURA_CLOUD_API_VERSION=1"
   ];
 
   postPatch = ''

pkgs/applications/misc/curaengine/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "curaengine-${version}";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "CuraEngine";
     rev = version;
-    sha256 = "0p4zcckrlrpyp5xdqgvp0phmawyh4cy8vipim9fvgsfcin4vhrv7";
+    sha256 = "14zy9ir46vndsi4l8kapm6byw02fimm7ava2rfi0kvcckf5yq9w8";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/misc/dbeaver/default.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   name = "dbeaver-ce-${version}";
-  version = "6.0.4";
+  version = "6.0.5";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1b3yv91bvwrkln63asn6ybkdhzb8pibz55rr99rv0z8rbmwnbjpn";
+    sha256 = "19gn6vkjl8dpmqpn26llhvc3yahjwj00wqvvimfsrqd32wgj2and";
   };
 
   installPhase = ''

pkgs/applications/misc/gcalcli/default.nix

@@ -5,13 +5,13 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "gcalcli";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner  = "insanum";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "06iijpwlvvn8bj81s4znhykilvwvydxjmzd3d4nsa5j2kj3iwshi";
+    sha256 = "1qlmslywm4dfimggly4p0ckn2gj165mq1p0wkry9jpb3sg1m5fdf";
   };
 
   postPatch = lib.optionalString stdenv.isLinux ''

pkgs/applications/misc/googler/default.nix

@@ -1,14 +1,14 @@
 {stdenv, fetchFromGitHub, python}:
 
 stdenv.mkDerivation rec {
-  version = "3.8";
+  version = "3.9";
   name = "googler-${version}";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "googler";
     rev = "v${version}";
-    sha256 = "0f15rivjdj8r7wwrckcsaxxx129yh41fj4rhz4cbvbsb5f0f2daj";
+    sha256 = "0zqq157i0rfrja8yqnqr9rfrp5apzc7cxb7d7ppv6abkc5bckyqc";
   };
 
   propagatedBuildInputs = [ python ];

pkgs/applications/misc/gpx-viewer/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, intltool, pkgconfig, gnome3, libchamplain, gdl, shared-mime-info, desktop-file-utils, wrapGAppsHook }:
+{ stdenv, fetchurl, intltool, libxml2, pkgconfig, gnome3, libchamplain, gdl, shared-mime-info, desktop-file-utils, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "gpx-viewer-${version}";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     desktop-file-utils # For update-desktop-database
     wrapGAppsHook # Fix error: GLib-GIO-ERROR **: No GSettings schemas are installed on the system
   ];
-  buildInputs = [ gdl libchamplain gnome3.adwaita-icon-theme ];
+  buildInputs = [ gdl libchamplain gnome3.adwaita-icon-theme libxml2 ];
 
   meta = with stdenv.lib; {
     homepage = https://blog.sarine.nl/tag/gpxviewer/;

pkgs/applications/misc/hubstaff/default.nix

@@ -60,6 +60,6 @@ stdenv.mkDerivation {
     homepage = https://hubstaff.com/;
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = [ maintainers.michalrus ];
+    maintainers = with maintainers; [ michalrus srghma ];
   };
 }

pkgs/applications/misc/hubstaff/revision.json

@@ -1,5 +1,5 @@
 {
-  "url": "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.4.5-c5b459ea/Hubstaff-1.4.5-c5b459ea.sh",
+  "url": "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.4.6-4aba8ab5/Hubstaff-1.4.6-4aba8ab5.sh",
-  "version": "1.4.5-c5b459ea",
+  "version": "1.4.6-4aba8ab5",
-  "sha256": "180qglbj175wln0kh8d5czhjvy7z503zxn4w6522hkz4ddz201nz"
+  "sha256": "14js4d7wazn5r5p9n3iic9kwqrinm079jj1k7r00v684jrgq62fc"
 }

pkgs/applications/misc/joplin-desktop/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "joplin-desktop";
-  version = "1.0.143";
+  version = "1.0.158";
 in appimageTools.wrapType2 rec {
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}-x86_64.AppImage";
-    sha256 = "1waglwxpr18a07m7ix9al6ac4hrdqzzqmy1qgp45b922nbkw9g10";
+    sha256 = "1xaamwcasihja3agwb0nnfnzc1wmmr0d2ng73qmfil9nhf9v3j6q";
   };
 
 

pkgs/applications/misc/keepassx/community.nix

@@ -55,7 +55,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./darwin.patch
-    ./quazip5.patch
   ];
 
   cmakeFlags = [

pkgs/applications/misc/keepassx/quazip5.patch

@@ -1,27 +0,0 @@
-diff --git a/cmake/FindQuaZip.cmake b/cmake/FindQuaZip.cmake
-index 8d309181..92aa892c 100644
---- a/cmake/FindQuaZip.cmake
-+++ b/cmake/FindQuaZip.cmake
-@@ -9,7 +9,6 @@ IF(QUAZIP_INCLUDE_DIRS AND QUAZIP_LIBRARIES)
-   SET(QUAZIP_FOUND TRUE)
- ELSE(QUAZIP_INCLUDE_DIRS AND QUAZIP_LIBRARIES)
-     IF(Qt5Core_FOUND)
--        set(QUAZIP_LIB_VERSION_SUFFIX 5)
-     ENDIF()
-   IF(WIN32)
-     FIND_PATH(QUAZIP_LIBRARY_DIR
-diff --git a/src/keeshare/ShareObserver.cpp b/src/keeshare/ShareObserver.cpp
-index 33f5ed1f..5fcd9202 100644
---- a/src/keeshare/ShareObserver.cpp
-+++ b/src/keeshare/ShareObserver.cpp
-@@ -46,8 +46,8 @@
- #include <QStringBuilder>
- 
- #if defined(WITH_XC_KEESHARE_SECURE)
--#include <quazip5/quazip.h>
--#include <quazip5/quazipfile.h>
-+#include <quazip/quazip.h>
-+#include <quazip/quazipfile.h>
- #endif
- 
- namespace

pkgs/applications/misc/kitty/default.nix

@@ -21,14 +21,14 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.14.0";
+  version = "0.14.1";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "v${version}";
-    sha256 = "122573l7xirs9dsi5p8gra47qpgxb3vahqp2r0c043pgz4i22v5z";
+    sha256 = "0nm8l8ki0csdapf5mj3vg605ki5hjsx7h7i3m01x1a4vjzjmk8bv";
   };
 
   buildInputs = [

pkgs/applications/misc/libosmocore/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "libosmocore-${version}";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "osmocom";
     repo = "libosmocore";
     rev = version;
-    sha256 = "08xbj2calh1zkp79kxbq01vnh0y7nkgd4cgsivrzlyqahilbzvd9";
+    sha256 = "1ayxpq03mv547sirdy3j9vnsjd1q07adhwwnl3wffz3c39wlax68";
   };
 
   propagatedBuildInputs = [

pkgs/applications/misc/octoprint/default.nix

@@ -15,13 +15,9 @@ let
     packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
       (mkOverride "flask"       "0.10.1" "0wrkavjdjndknhp8ya8j850jq7a1cli4g5a93mg8nh1xz2gq50sc")
       (mkOverride "flask_login" "0.2.11" "1rg3rsjs1gwi2pw6vr9jmhaqm9b3vc9c4hfcsvp4y8agbh7g3mc3")
-      (mkOverride "pylru"       "1.0.9"  "0b0pq0l7xv83dfsajsc49jcxzc99kb9jfx1a1dlx22hzcy962dvi")
       (mkOverride "sarge"       "0.1.4"  "08s8896973bz1gg0pkr592w6g4p6v47bkfvws5i91p9xf8b35yar")
       (mkOverride "tornado"     "4.5.3"  "02jzd23l4r6fswmwxaica9ldlyc2p6q8dk6dyff7j58fmdzf853d")
 
-      # https://github.com/NixOS/nixpkgs/pull/58179#issuecomment-478605134
-      (mkOverride "werkzeug"    "0.14.1" "c3fd7a7d41976d9f44db327260e263132466836cef6f91512889ed60ad26557c")
-
       # Octoprint holds back jinja2 to 2.8.1 due to breaking changes.
       # This old version does not have updated test config for pytest 4,
       # and pypi tarball doesn't contain tests dir anyways.
@@ -43,16 +39,15 @@ let
     "Flask-Assets"
     "Flask-Babel"
     "Flask-Principal"
-    "PyYAML"
     "emoji"
     "flask"
     "future"
     "futures"
     "monotonic"
+    "markdown"
     "pkginfo"
     "psutil"
     "pyserial"
-    "python-dateutil"
     "requests"
     "rsa"
     "sarge"
@@ -60,19 +55,19 @@ let
     "semantic_version"
     "watchdog"
     "websocket-client"
-    "werkzeug"
     "wrapt"
+    "sentry-sdk"
   ];
 
 in py.pkgs.buildPythonApplication rec {
   pname = "OctoPrint";
-  version = "1.3.10";
+  version = "1.3.11";
 
   src = fetchFromGitHub {
     owner  = "foosel";
     repo   = "OctoPrint";
     rev    = version;
-    sha256 = "1pvh7ay76zrvfzcsadh3sl48sgf3by9vpiaqlrkscsw02zirx9r7";
+    sha256 = "1102ki1819wsmkfg4riz4i0hjlr3w6nsvk8wrzqq0lc0s5ycf4jx";
   };
 
   propagatedBuildInputs = with py.pkgs; [
@@ -80,8 +75,8 @@ in py.pkgs.buildPythonApplication rec {
     semantic-version flask_principal werkzeug flaskbabel tornado
     psutil pyserial flask_login netaddr markdown sockjs-tornado
     pylru pyyaml sarge feedparser netifaces click websocket_client
-    scandir chainmap future dateutil futures wrapt monotonic emoji
+    scandir chainmap future futures wrapt monotonic emoji
-    frozendict
+    frozendict cachelib sentry-sdk typing
   ] ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ];
 
   checkInputs = with py.pkgs; [ nose mock ddt ];

pkgs/applications/misc/octoprint/plugins.nix

@@ -104,6 +104,25 @@ let
       };
     };
 
+    curaenginelegacy = buildPlugin rec {
+      pname = "CuraEngineLegacy";
+      version = "1.0.2";
+
+      src = fetchFromGitHub {
+        owner = "OctoPrint";
+        repo = "OctoPrint-${pname}";
+        rev = version;
+        sha256 = "1cdb276wfyf3wcfj5g3migd6b6aqmkrxncrqjfcfx4j4k3xac965";
+      };
+
+      meta = with stdenv.lib; {
+        description = "Plugin for slicing via Cura Legacy from within OctoPrint";
+        homepage = "https://github.com/OctoPrint/OctoPrint-CuraEngineLegacy";
+        license = licenses.agpl3;
+        maintainers = with maintainers; [ gebner ];
+      };
+    };
+
   };
 
 in self

pkgs/applications/misc/rxvt_unicode-plugins/urxvt-tabbedex/default.nix

@@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub, perl }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "urxvt-tabbedex-2016-08-17";
+  name = "urxvt-tabbedex-${version}";
+  version = "19.21";
 
   src = fetchFromGitHub {
     owner = "mina86";
     repo = "urxvt-tabbedex";
-    rev = "089d0cb724eeb62fa8a5dfcb00ced7761e794149";
+    rev = "v${version}";
-    sha256 = "0a5jrb7ryafj55fgi8fhpy3gmb1xh5j7pbn8p5j5k6s2fnh0g0hq";
+    sha256 = "06msd156h6r8ss7qg66sjz5jz8613qfq2yvp0pc24i6mxzj8vl77";
   };
 
   nativeBuildInputs = [ perl ];

pkgs/applications/misc/todiff/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1y0v8nkaqb8kn61xwarpbyrq019gxx1f5f5p1hzw73nqxadc1rcm";
   };
 
-  cargoSha256 = "1r7l9zbw6kq8yb5cv6h0qgl2gp71bkn9xv7b2n49a5r7by98jjqr";
+  cargoSha256 = "0xn5p71qk0ahd2drklja16xwv7zw0797kkzpiv563kffzvd1p8id";
 
   checkPhase = "cargo test --features=integration_tests";
 

pkgs/applications/misc/ulauncher/default.nix

@@ -0,0 +1,108 @@
+{ stdenv
+, fetchFromGitHub
+, fetchurl
+, python27Packages
+, substituteAll
+, gnome3
+, gobject-introspection
+, wrapGAppsHook
+, gtk3
+, webkitgtk
+, libnotify
+, keybinder3
+, libappindicator
+, intltool
+, wmctrl
+, hicolor-icon-theme
+, xvfb_run
+}:
+
+python27Packages.buildPythonApplication rec  {
+  pname = "ulauncher";
+  version = "4.4.0.r1";
+
+  # Python 3 support is currently in development
+  # on the dev branch and 5.x.x releases
+  disabled = ! python27Packages.isPy27;
+
+  src = fetchurl {
+    url = "https://github.com/Ulauncher/Ulauncher/releases/download/${version}/ulauncher_${version}.tar.gz";
+    sha256 = "12v7qpjhf0842ivsfflsl2zlvhiaw25f9ffv7vhnkvrhrmksim9f";
+  };
+
+  nativeBuildInputs = with python27Packages;  [
+    distutils_extra
+    intltool
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gnome3.adwaita-icon-theme
+    gobject-introspection
+    hicolor-icon-theme
+    keybinder3
+    libappindicator
+    libnotify
+    webkitgtk
+    wmctrl
+  ];
+
+  propagatedBuildInputs = with python27Packages; [
+    dbus-python
+    notify
+    pygobject3
+    pyinotify
+    pysqlite
+    python-Levenshtein
+    pyxdg
+    websocket_client
+  ];
+
+  checkInputs = with python27Packages; [
+    mock
+    pytest_3
+    pytest-mock
+    pytestpep8
+    xvfb_run
+  ];
+
+  patches = [
+    ./fix-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --subst-var out
+  '';
+
+  # https://github.com/Ulauncher/Ulauncher/issues/390
+  doCheck = false;
+
+  preCheck = ''
+    export PYTHONPATH=$PYTHONPATH:$out/${python27Packages.python.sitePackages}
+  '';
+
+  # Simple translation of
+  # - https://github.com/Ulauncher/Ulauncher/blob/f5a601bdca75198a6a31b9d84433496b63530e74/test
+  checkPhase = ''
+    runHook preCheck
+
+    # skip tests in invocation that handle paths that
+    # aren't nix friendly (i think)
+    xvfb-run -s '-screen 0 1024x768x16' \
+      pytest -k 'not TestPath and not test_handle_key_press_event' --pep8 tests
+
+    runHook postCheck
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PATH : "${stdenv.lib.makeBinPath [ wmctrl ]}")
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A fast application launcher for Linux, written in Python, using GTK";
+    homepage = https://ulauncher.io/;
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ aaronjanse worldofpeace ];
+  };
+}

pkgs/applications/misc/ulauncher/fix-path.patch

@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index 3616104..e9bbfda 100755
+--- a/setup.py
++++ b/setup.py
+@@ -112,7 +112,7 @@ class InstallAndUpdateDataDirectory(DistUtilsExtra.auto.install_auto):
+         DistUtilsExtra.auto.install_auto.run(self)
+ 
+         target_data = '/' + os.path.relpath(self.install_data, self.root) + '/'
+-        target_pkgdata = target_data + 'share/ulauncher/'
++        target_pkgdata = '@out@/share/ulauncher/'
+         target_scripts = '/' + os.path.relpath(self.install_scripts,
+                                                self.root) + '/'
+ 

pkgs/applications/misc/yubioath-desktop/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "yubioath-desktop";
-  version = "4.3.4";
+  version = "4.3.6";
 
   src = fetchurl {
     url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
-    sha256 = "0hb7j71032sigs8zd5r8yr0m59sjkb24vhs2l4jarpvj8q7hv30d";
+    sha256 = "0s04anjbb5zm98kfdpp9hr68k3mx3gqlp8fa1miy7nq87pr4f7a5";
   };
 
   doCheck = false;

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -244,17 +244,17 @@ in rec {
     gtk3Support = false;
   };
 
-  tor-browser-8-0 = tbcommon rec {
+  tor-browser-8-5 = tbcommon rec {
-    ffversion = "60.6.1esr";
+    ffversion = "60.7.0esr";
-    tbversion = "8.0.9";
+    tbversion = "8.5.0";
 
     # FIXME: fetchFromGitHub is not ideal, unpacked source is >900Mb
     src = fetchFromGitHub {
       owner = "SLNOS";
       repo  = "tor-browser";
-      # branch "tor-browser-60.6.1esr-8.0-1-r2-slnos"
+      # branch "tor-browser-60.7.0esr-8.5-1-slnos"
-      rev   = "d311540ce07f1f4f5e5789f9107f6e6ecc23988d";
+      rev   = "8c69066856962116205c5c7508a0991dfb8ccd11";
-      sha256 = "0nz8vxv53vnqyk3ahakrr5xg6sgapvlmsb6s1pwwsb86fxk6pm5f";
+      sha256 = "1dshn7g9y6233vdqidrkg886ad6qjnl13vz2382ymbx180r2j73k";
     };
 
     patches = [
@@ -262,6 +262,6 @@ in rec {
     ];
   };
 
-  tor-browser = tor-browser-8-0;
+  tor-browser = tor-browser-8-5;
 
 })

pkgs/applications/networking/browsers/lynx/default.nix

@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
   hardeningEnable = [ "pie" ];
 
   configureFlags = [
+    "--enable-default-colors"
     "--enable-widec"
     "--enable-ipv6"
   ] ++ stdenv.lib.optional sslSupport "--with-ssl";

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -16,11 +16,11 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "2.5.1525.46-1";
+  version = "2.5.1525.48-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "0hxmpd4j1cq4643x17syzqxfxki6jngvf28jd71pp58hngffh3g4";
+    sha256 = "19izljczg22cvymfim97x48fnxbdfql9ik5ixrs990zxq65hznzn";
   };
 
   unpackPhase = ''

pkgs/applications/networking/cluster/click/default.nix

@@ -13,7 +13,7 @@ buildRustPackage rec {
     sha256 = "0sbj41kypn637z1w115w2h5v6bxz3y6w5ikgpx3ihsh89lkc19d2";
   };
 
-  cargoSha256 = "05asqp5312a1g26pvf5hgqhc4kj3iw2hdvml2ycvga33sxb7zm7r";
+  cargoSha256 = "1179a17lfr3001vp1a2adbkhdm9677n56af2c0zvkr18jas6b2w7";
 
   patches = [ ./fix_cargo_lock_version.patch ];
 

pkgs/applications/networking/cluster/minishift/default.nix

@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "1.33.0";
+  version = "1.34.0";
 
   # Update these on version bumps according to Makefile
   centOsIsoVersion = "v1.15.0";
@@ -18,7 +18,7 @@ in buildGoPackage rec {
     owner = "minishift";
     repo = "minishift";
     rev = "v${version}";
-    sha256 = "0n3pj410bgjblv27p55piln0vi618mnyzzswcyfc2v73bfnzrydf";
+    sha256 = "0nc1g4lmz5ww6rjyyanp9vq4sj6fvi9zf9qjc4lpsmapddhjkdy7";
   };
 
   nativeBuildInputs = [ pkgconfig go-bindata makeWrapper ];

pkgs/applications/networking/dyndns/cfdyndns/default.nix

@@ -12,7 +12,7 @@ buildRustPackage rec {
     sha256 = "1mcdjykrgh0jq6k6y664lai8sbgzk6j7k0r944f43vg63d1jql5b";
   };
 
-  cargoSha256 = "0k9d6pxsb4gvkqs00g71c1nnz773iccg4vajgn33qdym6m6qsjwy";
+  cargoSha256 = "1d7jpffkw2m2v37bfdqsl9sqwsl19cgglpa00lwy4ih09kzbc2n9";
 
   buildInputs = [ makeWrapper openssl ];
 

pkgs/applications/networking/feedreaders/feedreader/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "feedreader";
-  version = "2.8.2";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "jangernert";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1qm7scrz8xm68zizcfn13ll4ksdd004fahki7gbwqagsr1fg62y8";
+    sha256 = "1468kl1gip7h2k5l9x3shp3vxdnx08mr1n4845zinaqz4dpa70jv";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   ]);
 
   postPatch = ''
-    patchShebangs meson_post_install.py
+    patchShebangs build-aux/meson_post_install.py
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/networking/feedreaders/newsboat/default.nix

@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1dqdcp34jmphqf3d8ik0xdhg0s66nd5rky0y8y591nidq29wws6s";
   };
 
-  cargoSha256 = "05pf020jp20ffmvin6d1g8zbwf1zk03bm1cb99b7iqkk4r54g6dn";
+  cargoSha256 = "06r682vvr8m7gl443qx9ncmq8dpmdxcls68f29d0mmf7llddy5sa";
 
   postPatch = ''
     substituteInPlace Makefile --replace "|| true" ""

pkgs/applications/networking/flexget/default.nix

@@ -24,16 +24,20 @@ with python'.pkgs;
 
 buildPythonApplication rec {
   pname = "FlexGet";
-  version = "2.20.22";
+  version = "2.21.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bk1ab7ivb6fikqw4v1f9df6brplgg4ybbn8d3vzgjabm5ic21nd";
+    sha256 = "3c11fd7c4bb7e1e9203acd4d452ae51d34843e65066a18c7c72445d7db28122a";
   };
 
   postPatch = ''
     # remove dependency constraints
     sed 's/==\([0-9]\.\?\)\+//' -i requirements.txt
+
+    # "zxcvbn-python" was renamed to "zxcvbn", and we don't have the former in
+    # nixpkgs. See: https://github.com/NixOS/nixpkgs/issues/62110
+    substituteInPlace requirements.txt --replace "zxcvbn-python" "zxcvbn"
   '';
 
   # ~400 failures
@@ -50,7 +54,7 @@ buildPythonApplication rec {
     cherrypy flask flask-restful
     flask-restplus flask-compress
     flask_login flask-cors
-    pyparsing zxcvbn-python future
+    pyparsing zxcvbn future
     progressbar
     # Optional requirements
     deluge-client

pkgs/applications/networking/gns3/default.nix

@@ -1,16 +1,16 @@
 { callPackage, stdenv }:
 
 let
-  stableVersion = "2.1.19";
+  stableVersion = "2.1.20";
-  previewVersion = "2.2.0b1";
+  previewVersion = "2.2.0b2";
   addVersion = args:
     let version = if args.stable then stableVersion else previewVersion;
         branch = if args.stable then "stable" else "preview";
     in args // { inherit version branch; };
   mkGui = args: callPackage (import ./gui.nix (addVersion args)) { };
   mkServer = args: callPackage (import ./server.nix (addVersion args)) { };
-  guiSrcHash = "0bn0qry0djw17zwa16cc69273crnfzppik07f9w20hhr8kjiyvnx";
+  guiSrcHash = "0hs4qxas8xfwpn8c0w1l89aypqj3dy5wskyis8dq08p6h3kjis1g";
-  serverSrcHash = "1af6pnmr24syx23pqvwchgwy74263k3ccrv7barxi71wsskjlw5a";
+  serverSrcHash = "06q5283mdafijbczd14whw8fqwhmkvvaa9r7q16m18d96mr1z8m5";
 in {
   guiStable = mkGui {
     stable = true;
@@ -18,7 +18,7 @@ in {
   };
   guiPreview = mkGui {
     stable = false;
-    sha256Hash = "0kx68r8kgnsb7710a1a5y64blmw2jl1gv37bzbbivi15dzgmykfh";
+    sha256Hash = "0hb22z7vd69dq6nayyyndlyqsnxb3lzgw3ac6m3fnxkv18n1nm6v";
   };
 
   serverStable = mkServer {
@@ -27,6 +27,6 @@ in {
   };
   serverPreview = mkServer {
     stable = false;
-    sha256Hash = "1jxkba7hc7271hjw3839r0yfzs87dzv1nqx62adhk9qrrcfqhg58";
+    sha256Hash = "1a6ki0asai9x8xm724kha9phr2z8vkqfjwv067p860dpv2d2crxc";
   };
 }

pkgs/applications/networking/instant-messengers/fractal/default.nix

@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
   checkPhase = null;
   installPhase = null;
 
-  cargoSha256 = "0hlvdcdzkggc2adggmlxz0yxigwp3320wfav77gddlvfip1f90sw";
+  cargoSha256 = "1ax5dv200v8mfx0418bx8sbwpbp6zj469xg75hp78kqfiv83pn1g";
 
   meta = with stdenv.lib; {
     description = "Matrix group messaging app";

pkgs/applications/networking/instant-messengers/quaternion/default.nix

@@ -37,6 +37,7 @@ let
   };
 
 in rec {
-  quaternion     = generic "0.0.9.4"     "12mkwiqqbi4774kwl7gha72jyf0jf547acy6rw8ry249zl4lja54" "" libqmatrixclient_0_5;
+  quaternion     = generic "0.0.9.4c"     "12mkwiqqbi4774kwl7gha72jyf0jf547acy6rw8ry249zl4lja54" "" libqmatrixclient_0_5;
+
   quaternion-git = quaternion;
 }

pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json

@@ -2,7 +2,7 @@
   "name": "riot-web",
   "productName": "Riot",
   "main": "src/electron-main.js",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
   "dependencies": {

pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix

@@ -7,12 +7,12 @@ with (import ./yarn2nix.nix { inherit pkgs; });
 
 let
   executableName = "riot-desktop";
-  version = "1.1.0";
+  version = "1.2.1";
   riot-web-src = fetchFromGitHub {
     owner = "vector-im";
     repo = "riot-web";
     rev = "v${version}";
-    sha256 = "0h1rr70jg64v824k31mvb93nfssr572xlyicc8yh91bl7hdh342x";
+    sha256 = "0l50swqzdzbzbnrlkvwi133d54jgj15cj3awmlc1qdhnfdc3wxbb";
   };
 
 in mkYarnPackage rec {

pkgs/applications/networking/instant-messengers/riot/riot-web.nix

@@ -6,11 +6,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
   name= "riot-web-${version}";
-  version = "1.1.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "14ap57hv1c5nh17771l39inpa5yacpyckzqcmjlbrb57illakwrd";
+    sha256 = "1h96c4yy06ag5lmsbm5h2ws1l7sp4qm5dcchw25k3937fdhwq840";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -57,11 +57,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "signal-desktop-${version}";
-  version = "1.24.1";
+  version = "1.25.1";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "195rwx4xhgij5nrda1y6bhf5jyvcgb70g6ykangywhcagglqqair";
+    sha256 = "1185psv93amqj0s7rgm8bhl3y4jcxc1945paslvjbmw01vi3p1lp";
   };
 
   phases = [ "unpackPhase" "installPhase" ];

pkgs/applications/networking/libcoap/default.nix

@@ -0,0 +1,31 @@
+{ fetchFromGitHub, automake, autoconf, which, pkgconfig, libtool, stdenv }:
+stdenv.mkDerivation rec {
+  pname = "libcoap";
+  version = "4.2.0";
+  src = fetchFromGitHub {
+    repo = "libcoap";
+    owner = "obgm";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "0mmvkq72i4rda6b7g93qrwg2nwh2rvkq4xw70yppj51hsdrnpfl7";
+  };
+  nativeBuildInputs = [
+    automake
+    autoconf
+    which
+    libtool
+    pkgconfig
+  ];
+  preConfigure = "./autogen.sh";
+  configureFlags = [
+    "--disable-documentation"
+    "--disable-shared"
+  ];
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/obgm/libcoap";
+    description = "A CoAP (RFC 7252) implementation in C";
+    platforms = platforms.linux;
+    license = licenses.bsd2;
+    maintainers = [ maintainers.kmein ];
+  };
+}

pkgs/applications/networking/mailreaders/balsa/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "balsa-${version}";
-  version = "2.5.6";
+  version = "2.5.7";
 
   src = fetchurl {
     url = "https://pawsa.fedorapeople.org/balsa/${name}.tar.bz2";
-    sha256 = "17k6wcsl8gki7cskr3hhmfj6n54rha8ca3b6fzd8blsl5shsankx";
+    sha256 = "0yfqhfpwm1qnwmbpr6dfn2f5w8a8xxq51pn8ypgg0fw973l1c1nx";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/p2p/synapse-bt/default.nix

@@ -1,20 +1,21 @@
-{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl, Security }:
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl, CoreServices, Security }:
 
 rustPlatform.buildRustPackage rec {
-  name = "synapse-bt-unstable-${version}";
+  pname = "synapse-bt";
-  version = "2018-10-17";
+  version = "unstable-2019-05-26";
 
   src = fetchFromGitHub {
     owner = "Luminarys";
     repo = "synapse";
-    rev = "76d5e9a23ad00c25cfd0469b1adb479b9ded113a";
+    rev = "4a6e6c33b4c36eca89d216906d615797ba9a519e";
-    sha256 = "1lsfvcsmbsg51v8c2hkpwkx0zg25sdjc3q7x72b5bwwnw9l0iglz";
+    sha256 = "0110y3lkzfhgvmdg6q71jyp5q9jjp2bzdb6cwnkp8c734c2k1gfw";
   };
 
-  cargoSha256 = "1sc8c0w2dbvcdv16idw02y35x0jx5ff6ddzij09pmqjx55zgsjf7";
+  cargoSha256 = "0m4jigz6la3mf4yq217849ilcncb7d97mqyw2qicff4rbscdgf6h";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
+  buildInputs = [ openssl ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   cargoBuildFlags = [ "--all" ];
 

pkgs/applications/networking/remote/freerdp/legacy.nix

@@ -1,72 +0,0 @@
-{ stdenv
-, fetchurl
-, cmake
-, openssl
-, glib, pcre
-, printerSupport ? true, cups
-, pkgconfig
-, zlib
-, libX11
-, libXcursor
-, libXdamage
-, libXext
-, alsaLib
-, ffmpeg
-, libxkbfile
-#, xmlto, docbook_xml_dtd_412, docbook_xml_xslt
-, libXinerama
-, libXv
-, pulseaudioSupport ? true
-}:
-
-assert printerSupport -> cups != null;
-
-stdenv.mkDerivation rec {
-  name = "freerdp-${version}";
-  version = "1.2.0-beta1+android9";
-
-  src = fetchurl {
-    url = "https://github.com/FreeRDP/FreeRDP/archive/${version}.tar.gz";
-    sha256 = "181w4lkrk5h5kh2zjlx6h2cl1mfw2aaami3laq3q32pfj06q3rxl";
-  };
-
-  buildInputs = [
-    cmake
-    openssl
-    glib pcre
-    pkgconfig
-    zlib
-    libX11
-    libXcursor
-    libXdamage
-    libXext
-    alsaLib
-    ffmpeg
-    libxkbfile
-#    xmlto docbook_xml_dtd_412 docbook_xml_xslt
-    libXinerama
-    libXv
-  ] ++ stdenv.lib.optional printerSupport cups;
-
-  preConfigure = ''
-    export HOME=$TMP
-  '';
-
-  configureFlags = [
-    "--with-x" "-DWITH_MANPAGES=OFF"
-  ] ++ stdenv.lib.optional printerSupport "--with-printer=cups"
-    ++ stdenv.lib.optional pulseaudioSupport "-DWITH_PULSEAUDIO=ON";
-
-  meta = with stdenv.lib; {
-    description = "A Remote Desktop Protocol Client";
-
-    longDescription = ''
-      FreeRDP is a client-side implementation of the Remote Desktop Protocol (RDP)
-      following the Microsoft Open Specifications.
-    '';
-
-    homepage = http://www.freerdp.com/;
-    license = licenses.free;
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/office/homebank/default.nix

@@ -2,10 +2,10 @@
 , hicolor-icon-theme, libsoup, gnome3 }:
 
 stdenv.mkDerivation rec {
-  name = "homebank-5.2.5";
+  name = "homebank-5.2.6";
   src = fetchurl {
     url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "1716igj18792sp4rx0vwxvx95mahgb7wiyahd2018yq8z88vc36w";
+    sha256 = "10cqii1bsc7dmg8nzj6xhmk44r390vca49vbsw4g504h0bvwn54s";
   };
 
   nativeBuildInputs = [ pkgconfig wrapGAppsHook ];

pkgs/applications/office/qownnotes/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qownnotes";
-  version = "19.4.5";
+  version = "19.5.7";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Can grab official version like so:
     # $ curl https://download.tuxfamily.org/qownnotes/src/qownnotes-19.1.8.tar.xz.sha256
-    sha256 = "13yafcdqkl46awq2mxr1c5skydi44iwgcmfkx3wrhq85ird25cpy";
+    sha256 = "0dpzv1ww7a7bymgv1ljka5i0zaa1m4zii5ckl390vfpihqy766z3";
   };
 
   nativeBuildInputs = [ qmake qttools ];

pkgs/applications/office/vnote/default.nix

@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, qmake, qtbase, qtwebengine, hicolor-icon-theme, makeDesktopItem }:
+
+let
+  description = "A note-taking application that knows programmers and Markdown better";
+  desktopItem = makeDesktopItem {
+    name = "VNote";
+    exec = "vnote";
+    icon = "vnote";
+    comment = description;
+    desktopName = "VNote";
+    categories = "Office";
+  };
+in stdenv.mkDerivation rec {
+  version = "2.6";
+  pname = "vnote";
+
+  src = fetchFromGitHub {
+    owner = "tamlok";
+    repo = "vnote";
+    fetchSubmodules = true;
+    rev = "v${version}";
+    sha256 = "10lnzzwz7fjj55kbn3j6gdl9yi6a85mdjis586p3zcc4830mlv91";
+  };
+
+  nativeBuildInputs = [ qmake ];
+  buildInputs = [ qtbase qtwebengine hicolor-icon-theme ];
+
+  meta = with stdenv.lib; {
+    inherit description;
+    homepage = "https://tamlok.github.io/vnote";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.kuznero ];
+  };
+}

pkgs/applications/radio/flrig/default.nix

@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.43";
+  version = "1.3.44";
   pname = "flrig";
 
   src = fetchurl {
     url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "1ir47svjbz7dhgzxvb3xqnkcsnjqb935vhqfddx7yhaawiqrzhk1";
+    sha256 = "0y05qhjmqydh0lripb44jjkcchxzr8bfn1r2k3m48wb4aij607yj";
   };
 
   buildInputs = [

pkgs/applications/radio/uhd/default.nix

@@ -12,12 +12,12 @@ let
 
   # UHD seems to use three different version number styles: x.y.z, xxx_yyy_zzz
   # and xxx.yyy.zzz. Hrmpf... style keeps changing
-  version = "3.13.0.1";
+  version = "3.14.0.0";
 
   # Firmware images are downloaded (pre-built) from the respective release on Github
   uhdImagesSrc = fetchurl {
     url = "https://github.com/EttusResearch/uhd/releases/download/${uhdVer}/uhd-images_${version}.tar.xz";
-    sha256 = "0y9i93z188ch0hdlkvv0k9m0k7vns7rbxaqsnk35xnlqlxxgqdvj";
+    sha256 = "1fp37wgqkbr14cxg9l7ghfd4r92y2bxwgb7cfjzs96hbpd9s6al0";
   };
 
 in stdenv.mkDerivation {
@@ -27,7 +27,7 @@ in stdenv.mkDerivation {
     owner = "EttusResearch";
     repo = "uhd";
     rev = "${uhdVer}";
-    sha256 = "0si49qk96zhpanmcrzlr3igc5s1y30x4p0z973q60dx9fhqsbb6k";
+    sha256 = "0y1hff4vslfv36vxgvjqajg4862a11d4wgr0vcb0visgh1bi8qgy";
   };
 
   enableParallelBuilding = true;

pkgs/applications/science/chemistry/jmol/default.nix

@@ -17,14 +17,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "14.29.40";
+  version = "14.29.42";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "17skd67i6l7k96g2ddq0s0xkji8wmfr2z31j345ws9kdr0faw01x";
+    sha256 = "0fpsicxc6aazmz45q1bgnjfwcdmxmzl9h24hpz2q1gdk9cz5aqnp";
   };
 
   patchPhase = ''

pkgs/applications/science/logic/coq/default.nix

@@ -27,6 +27,7 @@ let
    "8.8.1" = "1hlf58gwazywbmfa48219amid38vqdl94yz21i11b4map6jfwhbk";
    "8.8.2" = "1lip3xja924dm6qblisk1bk0x8ai24s5xxqxphbdxj6djglj68fd";
    "8.9.0" = "1dkgdjc4n1m15m1p724hhi5cyxpqbjw6rxc5na6fl3v4qjjfnizh";
+   "8.9.1" = "1xrq6mkhpq994bncmnijf8jwmwn961kkpl4mwwlv7j3dgnysrcv2";
    "8.10+beta1" = "19wf39i0ap2vakglgdlqxpjd3l1h5w7dp460w8y7nc1y06b2153h";
   }."${version}";
   coq-version = stdenv.lib.versions.majorMinor version;

pkgs/applications/science/logic/cryptoverif/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "cryptoverif-${version}";
-  version = "2.00";
+  version = "2.01";
 
   src = fetchurl {
     url    = "http://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/cryptoverif${version}.tar.gz";
-    sha256 = "0g8pkj58b48zk4c0sgpln0qhbj82v75mz3w6cl3w5bvmxsbkwvy1";
+    sha256 = "122pryci8rsdzv9qszw11g3izh78r2lvd1raahv2j7qmvgi76nab";
   };
 
   buildInputs = [ ocaml ];

pkgs/applications/science/logic/elan/default.nix

@@ -4,7 +4,7 @@ rustPlatform.buildRustPackage rec {
   name = "elan-${version}";
   version = "0.7.5";
 
-  cargoSha256 = "0vv7kr7rc3lvas7ngp5dp99ajjd5v8k5937ish7zqz1k4970q2f1";
+  cargoSha256 = "0lc320m3vw76d6pa5wp6c9jblac6lmyf9qqnxmsnkn4ixdhnghsd";
 
   src = fetchFromGitHub {
     owner = "kha";