Merge master into staging-next

2019-12-13 11:43:39 +01:00 · 2019-12-13 11:43:39 +01:00 · dfdf1597a7
parent d5d8b3514d 418ad571c3
commit dfdf1597a7
154 changed files with 2448 additions and 2272 deletions
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@ -1123,6 +1123,16 @@ preBuild = ''

   <variablelist>
    <title>Variables controlling the install phase</title>
+     <varlistentry>
+     <term>
+       <varname>dontInstall</varname>
+     </term>
+     <listitem>
+      <para>
+       Set to true to skip the install phase.
+      </para>
+     </listitem>
+    </varlistentry>
    <varlistentry>
     <term>
      <varname>makeFlags</varname> / <varname>makeFlagsArray</varname> / <varname>makefile</varname>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2496,6 +2496,12 @@
    githubId = 40521440;
    name = "Haruka Akiyama";
  };
+  fuzen = {
+    email = "me@fuzen.cafe";
+    github = "fuzen-py";
+    githubId = 17859309;
+    name = "Fuzen";
+  };
  fuzzy-id = {
    email = "hacking+nixos@babibo.de";
    name = "Thomas Bach";
@ -2868,6 +2874,12 @@
    githubId = 69209;
    name = "Ian Duncan";
  };
+  ianmjones = {
+    email = "ian@ianmjones.com";
+    github = "ianmjones";
+    githubId = 4710;
+    name = "Ian M. Jones";
+  };
  ianwookim = {
    email = "ianwookim@gmail.com";
    github = "wavewave";
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -478,7 +478,7 @@ Retype new UNIX password: ***</screen>
     shows what packages are available, and
 <screen>
 <prompt>$ </prompt>nix-env -f '&lt;nixpkgs&gt;' -iA w3m</screen>
-     install the <literal>w3m</literal> browser.
+     installs the <literal>w3m</literal> browser.
    </para>
   </listitem>
  </orderedlist>
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -233,6 +233,16 @@
     The fourStore and fourStoreEndpoint modules have been removed.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     Polkit no longer has the user of uid 0 (root) as an admin identity.
+     We now follow the upstream default of only having every member of the wheel
+     group admin privileged. Before it was root and members of wheel.
+     The positive outcome of this is pkexec GUI popups or terminal prompts
+     will no longer require the user to choose between two essentially equivalent
+     choices (whether to perform the action as themselves with wheel permissions, or as the root user).
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -603,9 +603,6 @@ in
        { source = config.system.build.squashfsStore;
          target = "/nix-store.squashfs";
        }
-        { source = config.isoImage.efiSplashImage;
-          target = "/EFI/boot/efi-background.png";
-        }
        { source = config.isoImage.splashImage;
          target = "/isolinux/background.png";
        }
@ -630,8 +627,8 @@ in
        { source = "${efiDir}/EFI";
          target = "/EFI";
        }
-        { source = pkgs.writeText "loopback.cfg" "source /EFI/boot/grub.cfg";
-          target = "/boot/grub/loopback.cfg";
+        { source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/boot/grub.cfg") + "/grub";
+          target = "/boot/grub";
        }
      ] ++ optionals (config.boot.loader.grub.memtest86.enable && canx86BiosBoot) [
        { source = "${pkgs.memtest86plus}/memtest.bin";
@ -641,6 +638,10 @@ in
        { source = config.isoImage.grubTheme;
          target = "/EFI/boot/grub-theme";
        }
+      ] ++ [
+        { source = config.isoImage.efiSplashImage;
+          target = "/EFI/boot/efi-background.png";
+        }
      ];

    boot.loader.timeout = 10;
--- a/nixos/modules/programs/oblogout.nix
+++ b/nixos/modules/programs/oblogout.nix
@ -1,176 +1,11 @@
-# Global configuration for oblogout.
-
 { config, lib, pkgs, ... }:

 with lib;

-let cfg = config.programs.oblogout;
-
-in
 {
-  ###### interface

-  options = {
+  imports = [
+    (mkRemovedOptionModule [ "programs" "oblogout" ] "programs.oblogout has been removed from NixOS. This is because the oblogout repository has been archived upstream.")
+  ];

-    programs.oblogout = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to install OBLogout and create <filename>/etc/oblogout.conf</filename>.
-          See <filename>${pkgs.oblogout}/share/doc/README</filename>.
-        '';
-      };
-
-      opacity = mkOption {
-        type = types.int;
-        default = 70;
-        description = ''
-          Opacity percentage of Cairo rendered backgrounds.
-        '';
-      };
-
-      bgcolor = mkOption {
-        type = types.str;
-        default = "black";
-        description = ''
-          Colour name or hex code (#ffffff) of the background color.
-        '';
-      };
-
-      buttontheme = mkOption {
-        type = types.str;
-        default = "simplistic";
-        description = ''
-          Icon theme for the buttons, must be in the themes folder of
-          the package, or in
-          <filename>~/.themes/&lt;name&gt;/oblogout/</filename>.
-        '';
-      };
-
-      buttons = mkOption {
-        type = types.str;
-        default =  "cancel, logout, restart, shutdown, suspend, hibernate";
-        description = ''
-          List and order of buttons to show.
-        '';
-      };
-
-      cancel = mkOption {
-        type = types.str;
-        default =  "Escape";
-        description = ''
-          Cancel logout/shutdown shortcut.
-        '';
-      };
-
-      shutdown = mkOption {
-        type = types.str;
-        default = "S";
-        description = ''
-          Shutdown shortcut.
-        '';
-      };
-
-      restart = mkOption {
-        type = types.str;
-        default = "R";
-        description = ''
-          Restart shortcut.
-        '';
-      };
-
-      suspend = mkOption {
-        type = types.str;
-        default = "U";
-        description = ''
-          Suspend shortcut.
-        '';
-      };
-
-      logout = mkOption {
-        type = types.str;
-        default = "L";
-        description = ''
-          Logout shortcut.
-        '';
-      };
-
-      lock = mkOption {
-        type = types.str;
-        default = "K";
-        description = ''
-          Lock session shortcut.
-        '';
-      };
-
-      hibernate = mkOption {
-        type = types.str;
-        default =  "H";
-        description = ''
-          Hibernate shortcut.
-        '';
-      };
-
-      clogout = mkOption {
-        type = types.str;
-        default = "openbox --exit";
-        description = ''
-          Command to logout.
-        '';
-      };
-
-      clock = mkOption {
-        type = types.str;
-        default = "";
-        description = ''
-          Command to lock screen.
-        '';
-      };
-
-      cswitchuser = mkOption {
-        type = types.str;
-        default = "";
-        description = ''
-          Command to switch user.
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.oblogout ];
-
-    environment.etc."oblogout.conf".text = ''
-      [settings]
-      usehal = false
-
-      [looks]
-      opacity = ${toString cfg.opacity}
-      bgcolor = ${cfg.bgcolor}
-      buttontheme = ${cfg.buttontheme}
-      buttons = ${cfg.buttons}
-
-      [shortcuts]
-      cancel = ${cfg.cancel}
-      shutdown = ${cfg.shutdown}
-      restart = ${cfg.restart}
-      suspend = ${cfg.suspend}
-      logout = ${cfg.logout}
-      lock = ${cfg.lock}
-      hibernate = ${cfg.hibernate}
-
-      [commands]
-      shutdown = systemctl poweroff
-      restart = systemctl reboot
-      suspend = systemctl suspend
-      hibernate = systemctl hibernate
-      logout = ${cfg.clogout}
-      lock = ${cfg.clock}
-      switchuser = ${cfg.cswitchuser}
-    '';
-  };
 }
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@ -42,15 +42,14 @@ in

    security.polkit.adminIdentities = mkOption {
      type = types.listOf types.str;
-      default = [ "unix-user:0" "unix-group:wheel" ];
+      default = [ "unix-group:wheel" ];
      example = [ "unix-user:alice" "unix-group:admin" ];
      description =
        ''
          Specifies which users are considered “administrators”, for those
          actions that require the user to authenticate as an
          administrator (i.e. have an <literal>auth_admin</literal>
-          value).  By default, this is the <literal>root</literal>
-          user and all users in the <literal>wheel</literal> group.
+          value).  By default, this is all users in the <literal>wheel</literal> group.
        '';
    };

--- a/nixos/modules/services/backup/bacula.nix
+++ b/nixos/modules/services/backup/bacula.nix
@ -44,7 +44,17 @@ let
        Pid Directory = "/run";
        ${sd_cfg.extraStorageConfig}
      }
- 
+
+      ${concatStringsSep "\n" (mapAttrsToList (name: value: ''
+      Autochanger {
+        Name = "${name}";
+        Device = ${concatStringsSep ", " (map (a: "\"${a}\"") value.devices)};
+        Changer Device =  "${value.changerDevice}";
+        Changer Command = "${value.changerCommand}";
+        ${value.extraAutochangerConfig}
+      }
+      '') sd_cfg.autochanger)}
+
      ${concatStringsSep "\n" (mapAttrsToList (name: value: ''
      Device {
        Name = "${name}";
@ -103,7 +113,19 @@ let
      password = mkOption {
        # TODO: required?
        description = ''
-           Specifies the password that must be supplied for a Director to b
+          Specifies the password that must be supplied for the default Bacula
+          Console to be authorized. The same password must appear in the
+          Director resource of the Console configuration file. For added
+          security, the password is never passed across the network but instead
+          a challenge response hash code created with the password. This
+          directive is required. If you have either /dev/random or bc on your
+          machine, Bacula will generate a random password during the
+          configuration process, otherwise it will be left blank and you must
+          manually supply it.
+
+          The password is plain text. It is not generated through any special
+          process but as noted above, it is better to use random text for
+          security reasons. 
        '';
      };
      
@ -111,26 +133,133 @@ let
        default = "no";
        example = "yes";
        description = ''
-           If Monitor is set to no (default), this director will have full 
+          If Monitor is set to <literal>no</literal>, this director will have
+          full access to this Storage daemon. If Monitor is set to
+          <literal>yes</literal>, this director will only be able to fetch the
+          current status of this Storage daemon.
+
+          Please note that if this director is being used by a Monitor, we
+          highly recommend to set this directive to yes to avoid serious
+          security problems. 
        '';
      };
    };
  };

+  autochangerOptions = {...}:
+  {
+    options = {
+      changerDevice = mkOption {
+        description = ''
+          The specified name-string must be the generic SCSI device name of the
+          autochanger that corresponds to the normal read/write Archive Device
+          specified in the Device resource. This generic SCSI device name
+          should be specified if you have an autochanger or if you have a
+          standard tape drive and want to use the Alert Command (see below).
+          For example, on Linux systems, for an Archive Device name of
+          <literal>/dev/nst0</literal>, you would specify
+          <literal>/dev/sg0</literal> for the Changer Device name.  Depending
+          on your exact configuration, and the number of autochangers or the
+          type of autochanger, what you specify here can vary. This directive
+          is optional. See the Using AutochangersAutochangersChapter chapter of
+          this manual for more details of using this and the following
+          autochanger directives.         
+          '';
+      };
+
+      changerCommand = mkOption {
+        description = ''
+          The name-string specifies an external program to be called that will
+          automatically change volumes as required by Bacula. Normally, this
+          directive will be specified only in the AutoChanger resource, which
+          is then used for all devices. However, you may also specify the
+          different Changer Command in each Device resource. Most frequently,
+          you will specify the Bacula supplied mtx-changer script as follows:
+
+          <literal>"/path/mtx-changer %c %o %S %a %d"</literal>
+
+          and you will install the mtx on your system (found in the depkgs
+          release). An example of this command is in the default bacula-sd.conf
+          file. For more details on the substitution characters that may be
+          specified to configure your autochanger please see the
+          AutochangersAutochangersChapter chapter of this manual. For FreeBSD
+          users, you might want to see one of the several chio scripts in
+          examples/autochangers.
+          '';
+        default = "/etc/bacula/mtx-changer %c %o %S %a %d";
+      };
+
+      devices = mkOption {
+        description = ''
+        '';
+      };
+
+      extraAutochangerConfig = mkOption {
+        default = "";
+        description = ''
+          Extra configuration to be passed in Autochanger directive.
+        '';
+        example = ''
+   
+        '';
+      };
+    };
+  };
+
+
  deviceOptions = {...}:
  {
    options = {
      archiveDevice = mkOption {
        # TODO: required?
        description = ''
-          The specified name-string gives the system file name of the storage device managed by this storage daemon. This will usually be the device file name of a removable storage device (tape drive), for example " /dev/nst0" or "/dev/rmt/0mbn". For a DVD-writer, it will be for example /dev/hdc. It may also be a directory name if you are archiving to disk storage.
+          The specified name-string gives the system file name of the storage
+          device managed by this storage daemon. This will usually be the
+          device file name of a removable storage device (tape drive), for
+          example <literal>/dev/nst0</literal> or
+          <literal>/dev/rmt/0mbn</literal>. For a DVD-writer, it will be for
+          example <literal>/dev/hdc</literal>. It may also be a directory name
+          if you are archiving to disk storage. In this case, you must supply
+          the full absolute path to the directory. When specifying a tape
+          device, it is preferable that the "non-rewind" variant of the device
+          file name be given. 
        '';
      };

      mediaType = mkOption {
        # TODO: required?
        description = ''
-          The specified name-string names the type of media supported by this device, for example, "DLT7000". Media type names are arbitrary in that you set them to anything you want, but they must be known to the volume database to keep track of which storage daemons can read which volumes. In general, each different storage type should have a unique Media Type associated with it. The same name-string must appear in the appropriate Storage resource definition in the Director's configuration file.
+          The specified name-string names the type of media supported by this
+          device, for example, <literal>DLT7000</literal>. Media type names are
+          arbitrary in that you set them to anything you want, but they must be
+          known to the volume database to keep track of which storage daemons
+          can read which volumes. In general, each different storage type
+          should have a unique Media Type associated with it. The same
+          name-string must appear in the appropriate Storage resource
+          definition in the Director's configuration file.
+
+          Even though the names you assign are arbitrary (i.e. you choose the
+          name you want), you should take care in specifying them because the
+          Media Type is used to determine which storage device Bacula will
+          select during restore. Thus you should probably use the same Media
+          Type specification for all drives where the Media can be freely
+          interchanged. This is not generally an issue if you have a single
+          Storage daemon, but it is with multiple Storage daemons, especially
+          if they have incompatible media.
+
+          For example, if you specify a Media Type of <literal>DDS-4</literal>
+          then during the restore, Bacula will be able to choose any Storage
+          Daemon that handles <literal>DDS-4</literal>. If you have an
+          autochanger, you might want to name the Media Type in a way that is
+          unique to the autochanger, unless you wish to possibly use the
+          Volumes in other drives. You should also ensure to have unique Media
+          Type names if the Media is not compatible between drives. This
+          specification is required for all devices.
+
+          In addition, if you are using disk storage, each Device resource will
+          generally have a different mount point or directory. In order for
+          Bacula to select the correct Device resource, each one must have a
+          unique Media Type.
        '';
      };

@ -166,8 +295,8 @@ in {
        default = "${config.networking.hostName}-fd";
        description = ''
          The client name that must be used by the Director when connecting.
-          Generally, it is a good idea to use a name related to the machine
-          so that error messages can be easily identified if you have multiple
+          Generally, it is a good idea to use a name related to the machine so
+          that error messages can be easily identified if you have multiple
          Clients. This directive is required.
        '';
      };
@ -232,7 +361,8 @@ in {
        default = 9103;
        type = types.int;
        description = ''
-          Specifies port number on which the Storage daemon listens for Director connections. The default is 9103.
+          Specifies port number on which the Storage daemon listens for
+          Director connections.
        '';
      };

@ -251,7 +381,15 @@ in {
        '';
        type = with types; attrsOf (submodule deviceOptions);
      };
- 
+
+      autochanger = mkOption {
+        default = {};
+        description = ''
+          This option defines Autochanger resources in Bacula Storage Daemon.
+        '';
+        type = with types; attrsOf (submodule autochangerOptions);
+      };
+
      extraStorageConfig = mkOption {
        default = "";
        description = ''
@ -287,7 +425,8 @@ in {
      name = mkOption {
        default = "${config.networking.hostName}-dir";
        description = ''
-          The director name used by the system administrator. This directive is required.
+          The director name used by the system administrator. This directive is
+          required.
        '';
      };
 
@ -295,7 +434,12 @@ in {
        default = 9101;
        type = types.int;
        description = ''
-          Specify the port (a positive integer) on which the Director daemon will listen for Bacula Console connections. This same port number must be specified in the Director resource of the Console configuration file. The default is 9101, so normally this directive need not be specified. This directive should not be used if you specify DirAddresses (N.B plural) directive.
+          Specify the port (a positive integer) on which the Director daemon
+          will listen for Bacula Console connections. This same port number
+          must be specified in the Director resource of the Console
+          configuration file. The default is 9101, so normally this directive
+          need not be specified. This directive should not be used if you
+          specify DirAddresses (N.B plural) directive.
        '';
      };
 
--- a/nixos/modules/services/networking/nat.nix
+++ b/nixos/modules/services/networking/nat.nix
@ -13,20 +13,24 @@ let
  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

  flushNat = ''
-    iptables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true
-    iptables -w -t nat -F nixos-nat-pre 2>/dev/null || true
-    iptables -w -t nat -X nixos-nat-pre 2>/dev/null || true
-    iptables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
-    iptables -w -t nat -F nixos-nat-post 2>/dev/null || true
-    iptables -w -t nat -X nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true
+    ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true
+    ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true
+    ip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true
+    ip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true
+    ip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true
+    ip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true

    ${cfg.extraStopCommands}
  '';

  setupNat = ''
    # Create subchain where we store rules
-    iptables -w -t nat -N nixos-nat-pre
-    iptables -w -t nat -N nixos-nat-post
+    ip46tables -w -t nat -N nixos-nat-pre
+    ip46tables -w -t nat -N nixos-nat-post
+    ip46tables -w -t nat -N nixos-nat-out

    # We can't match on incoming interface in POSTROUTING, so
    # mark packets coming from the internal interfaces.
@ -88,8 +92,9 @@ let
    ${cfg.extraCommands}

    # Append our chains to the nat tables
-    iptables -w -t nat -A PREROUTING -j nixos-nat-pre
-    iptables -w -t nat -A POSTROUTING -j nixos-nat-post
+    ip46tables -w -t nat -A PREROUTING -j nixos-nat-pre
+    ip46tables -w -t nat -A POSTROUTING -j nixos-nat-post
+    ip46tables -w -t nat -A OUTPUT -j nixos-nat-out
  '';

 in
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@ -53,6 +53,13 @@ in

      enable = mkEnableOption "Unbound domain name server";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.unbound;
+        defaultText = "pkgs.unbound";
+        description = "The unbound package to use";
+      };
+
      allowedAccess = mkOption {
        default = [ "127.0.0.0/24" ];
        type = types.listOf types.str;
@ -94,7 +101,7 @@ in

  config = mkIf cfg.enable {

-    environment.systemPackages = [ pkgs.unbound ];
+    environment.systemPackages = [ cfg.package ];

    users.users.unbound = {
      description = "unbound daemon user";
@ -114,7 +121,7 @@ in
        mkdir -m 0755 -p ${stateDir}/dev/
        cp ${confFile} ${stateDir}/unbound.conf
        ${optionalString cfg.enableRootTrustAnchor ''
-          ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
+          ${cfg.package}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
          chown unbound ${stateDir} ${rootTrustAnchorFile}
        ''}
        touch ${stateDir}/dev/random
@ -122,7 +129,7 @@ in
      '';

      serviceConfig = {
-        ExecStart = "${pkgs.unbound}/bin/unbound -d -c ${stateDir}/unbound.conf";
+        ExecStart = "${cfg.package}/bin/unbound -d -c ${stateDir}/unbound.conf";
        ExecStopPost="${pkgs.utillinux}/bin/umount ${stateDir}/dev/random";

        ProtectSystem = true;
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -71,7 +71,7 @@ in
      };

      downloadDirPermissions = mkOption {
-        type = types.string;
+        type = types.str;
        default = "770";
        example = "775";
        description = ''
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -204,9 +204,12 @@ in
          cat - > /run/gdm/.config/gnome-initial-setup-done <<- EOF
          yes
          EOF
-        '' + optionalString hasDefaultUserSession ''
-          ${setSessionScript}/bin/set-session ${defaultSessionName}
-        '';
+        ''
+        # TODO: Make setSessionScript aware of previously used sessions
+        # + optionalString hasDefaultUserSession ''
+        #   ${setSessionScript}/bin/set-session ${defaultSessionName}
+        # ''
+        ;
      };

    # Because sd_login_monitor_new requires /run/systemd/machines
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -57,6 +57,7 @@ in
  containers-ip = handleTest ./containers-ip.nix {};
  containers-macvlans = handleTest ./containers-macvlans.nix {};
  containers-physical_interfaces = handleTest ./containers-physical_interfaces.nix {};
+  containers-portforward = handleTest ./containers-portforward.nix {};
  containers-restart_networking = handleTest ./containers-restart_networking.nix {};
  containers-tmpfs = handleTest ./containers-tmpfs.nix {};
  couchdb = handleTest ./couchdb.nix {};
@ -261,6 +262,7 @@ in
  syncthing-init = handleTest ./syncthing-init.nix {};
  syncthing-relay = handleTest ./syncthing-relay.nix {};
  systemd = handleTest ./systemd.nix {};
+  systemd-analyze = handleTest ./systemd-analyze.nix {};
  systemd-confinement = handleTest ./systemd-confinement.nix {};
  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
  systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
--- a/nixos/tests/containers-extra_veth.nix
+++ b/nixos/tests/containers-extra_veth.nix
@ -1,7 +1,7 @@
 # Test for NixOS' container support.

-import ./make-test.nix ({ pkgs, ...} : {
-  name = "containers-bridge";
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "containers-extra_veth";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ kampfschlaefer ];
  };
@ -52,52 +52,43 @@ import ./make-test.nix ({ pkgs, ...} : {

  testScript =
    ''
-      $machine->waitForUnit("default.target");
-      $machine->succeed("nixos-container list") =~ /webserver/ or die;
+      machine.wait_for_unit("default.target")
+      assert "webserver" in machine.succeed("nixos-container list")

-      # Status of the webserver container.
-      $machine->succeed("nixos-container status webserver") =~ /up/ or die;
+      with subtest("Status of the webserver container is up"):
+          assert "up" in machine.succeed("nixos-container status webserver")

-      # Debug
-      #$machine->succeed("nixos-container run webserver -- ip link >&2");
+      with subtest("Ensure that the veths are inside the container"):
+          assert "state UP" in machine.succeed(
+              "nixos-container run webserver -- ip link show veth1"
+          )
+          assert "state UP" in machine.succeed(
+              "nixos-container run webserver -- ip link show veth2"
+          )

-      # Ensure that the veths are inside the container
-      $machine->succeed("nixos-container run webserver -- ip link show veth1") =~ /state UP/ or die;
-      $machine->succeed("nixos-container run webserver -- ip link show veth2") =~ /state UP/ or die;
+      with subtest("Ensure the presence of the extra veths"):
+          assert "state UP" in machine.succeed("ip link show veth1")
+          assert "state UP" in machine.succeed("ip link show veth2")

-      # Debug
-      #$machine->succeed("ip link >&2");
+      with subtest("Ensure the veth1 is part of br1 on the host"):
+          assert "master br1" in machine.succeed("ip link show veth1")

-      # Ensure the presence of the extra veths
-      $machine->succeed("ip link show veth1") =~ /state UP/ or die;
-      $machine->succeed("ip link show veth2") =~ /state UP/ or die;
+      with subtest("Ping on main veth"):
+          machine.succeed("ping -n -c 1 192.168.0.100")
+          machine.succeed("ping -n -c 1 fc00::2")

-      # Ensure the veth1 is part of br1 on the host
-      $machine->succeed("ip link show veth1") =~ /master br1/ or die;
+      with subtest("Ping on the first extra veth"):
+          machine.succeed("ping -n -c 1 192.168.1.100 >&2")

-      # Debug
-      #$machine->succeed("ip -4 a >&2");
-      #$machine->succeed("ip -4 r >&2");
-      #$machine->succeed("nixos-container run webserver -- ip link >&2");
-      #$machine->succeed("nixos-container run webserver -- ip -4 a >&2");
-      #$machine->succeed("nixos-container run webserver -- ip -4 r >&2");
+      with subtest("Ping on the second extra veth"):
+          machine.succeed("ping -n -c 1 192.168.2.100 >&2")

-      # Ping on main veth
-      $machine->succeed("ping -n -c 1 192.168.0.100");
-      $machine->succeed("ping -n -c 1 fc00::2");
+      with subtest("Container can be stopped"):
+          machine.succeed("nixos-container stop webserver")
+          machine.fail("ping -n -c 1 192.168.1.100 >&2")
+          machine.fail("ping -n -c 1 192.168.2.100 >&2")

-      # Ping on the first extra veth
-      $machine->succeed("ping -n -c 1 192.168.1.100 >&2");
-
-      # Ping on the second extra veth
-      $machine->succeed("ping -n -c 1 192.168.2.100 >&2");
-
-      # Stop the container.
-      $machine->succeed("nixos-container stop webserver");
-      $machine->fail("ping -n -c 1 192.168.1.100 >&2");
-      $machine->fail("ping -n -c 1 192.168.2.100 >&2");
-
-      # Destroying a declarative container should fail.
-      $machine->fail("nixos-container destroy webserver");
+      with subtest("Destroying a declarative container should fail"):
+          machine.fail("nixos-container destroy webserver")
    '';
 })
--- a/nixos/tests/containers-macvlans.nix
+++ b/nixos/tests/containers-macvlans.nix
@ -6,7 +6,7 @@ let
  containerIp2 = "192.168.1.254";
 in

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-macvlans";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ montag451 ];
@ -64,19 +64,23 @@ import ./make-test.nix ({ pkgs, ...} : {
  };

  testScript = ''
-    startAll;
-    $machine1->waitForUnit("default.target");
-    $machine2->waitForUnit("default.target");
+    start_all()
+    machine1.wait_for_unit("default.target")
+    machine2.wait_for_unit("default.target")

-    # Ping between containers to check that macvlans are created in bridge mode
-    $machine1->succeed("nixos-container run test1 -- ping -n -c 1 ${containerIp2}");
+    with subtest(
+        "Ping between containers to check that macvlans are created in bridge mode"
+    ):
+        machine1.succeed("nixos-container run test1 -- ping -n -c 1 ${containerIp2}")

-    # Ping containers from the host (machine1)
-    $machine1->succeed("ping -n -c 1 ${containerIp1}");
-    $machine1->succeed("ping -n -c 1 ${containerIp2}");
+    with subtest("Ping containers from the host (machine1)"):
+        machine1.succeed("ping -n -c 1 ${containerIp1}")
+        machine1.succeed("ping -n -c 1 ${containerIp2}")

-    # Ping containers from the second machine to check that containers are reachable from the outside
-    $machine2->succeed("ping -n -c 1 ${containerIp1}");
-    $machine2->succeed("ping -n -c 1 ${containerIp2}");
+    with subtest(
+        "Ping containers from the second machine to check that containers are reachable from the outside"
+    ):
+        machine2.succeed("ping -n -c 1 ${containerIp1}")
+        machine2.succeed("ping -n -c 1 ${containerIp2}")
  '';
 })
--- a/nixos/tests/containers-physical_interfaces.nix
+++ b/nixos/tests/containers-physical_interfaces.nix
@ -1,5 +1,5 @@

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-physical_interfaces";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ kampfschlaefer ];
@ -86,48 +86,51 @@ import ./make-test.nix ({ pkgs, ...} : {
  };

  testScript = ''
-    startAll;
+    start_all()

-    subtest "prepare server", sub {
-      $server->waitForUnit("default.target");
-      $server->succeed("ip link show dev eth1 >&2");
-    };
+    with subtest("Prepare server"):
+        server.wait_for_unit("default.target")
+        server.succeed("ip link show dev eth1 >&2")

-    subtest "simple physical interface", sub {
-      $server->succeed("nixos-container start server");
-      $server->waitForUnit("container\@server");
-      $server->succeed("systemctl -M server list-dependencies network-addresses-eth1.service >&2");
+    with subtest("Simple physical interface is up"):
+        server.succeed("nixos-container start server")
+        server.wait_for_unit("container@server")
+        server.succeed(
+            "systemctl -M server list-dependencies network-addresses-eth1.service >&2"
+        )

-      # The other tests will ping this container on its ip. Here we just check
-      # that the device is present in the container.
-      $server->succeed("nixos-container run server -- ip a show dev eth1 >&2");
-    };
+        # The other tests will ping this container on its ip. Here we just check
+        # that the device is present in the container.
+        server.succeed("nixos-container run server -- ip a show dev eth1 >&2")

-    subtest "physical device in bridge in container", sub {
-      $bridged->waitForUnit("default.target");
-      $bridged->succeed("nixos-container start bridged");
-      $bridged->waitForUnit("container\@bridged");
-      $bridged->succeed("systemctl -M bridged list-dependencies network-addresses-br0.service >&2");
-      $bridged->succeed("systemctl -M bridged status -n 30 -l network-addresses-br0.service");
-      $bridged->succeed("nixos-container run bridged -- ping -w 10 -c 1 -n 10.10.0.1");
-    };
+    with subtest("Physical device in bridge in container can ping server"):
+        bridged.wait_for_unit("default.target")
+        bridged.succeed("nixos-container start bridged")
+        bridged.wait_for_unit("container@bridged")
+        bridged.succeed(
+            "systemctl -M bridged list-dependencies network-addresses-br0.service >&2",
+            "systemctl -M bridged status -n 30 -l network-addresses-br0.service",
+            "nixos-container run bridged -- ping -w 10 -c 1 -n 10.10.0.1",
+        )

-    subtest "physical device in bond in container", sub {
-      $bonded->waitForUnit("default.target");
-      $bonded->succeed("nixos-container start bonded");
-      $bonded->waitForUnit("container\@bonded");
-      $bonded->succeed("systemctl -M bonded list-dependencies network-addresses-bond0 >&2");
-      $bonded->succeed("systemctl -M bonded status -n 30 -l network-addresses-bond0 >&2");
-      $bonded->succeed("nixos-container run bonded -- ping -w 10 -c 1 -n 10.10.0.1");
-    };
+    with subtest("Physical device in bond in container can ping server"):
+        bonded.wait_for_unit("default.target")
+        bonded.succeed("nixos-container start bonded")
+        bonded.wait_for_unit("container@bonded")
+        bonded.succeed(
+            "systemctl -M bonded list-dependencies network-addresses-bond0 >&2",
+            "systemctl -M bonded status -n 30 -l network-addresses-bond0 >&2",
+            "nixos-container run bonded -- ping -w 10 -c 1 -n 10.10.0.1",
+        )

-    subtest "physical device in bond in bridge in container", sub {
-      $bridgedbond->waitForUnit("default.target");
-      $bridgedbond->succeed("nixos-container start bridgedbond");
-      $bridgedbond->waitForUnit("container\@bridgedbond");
-      $bridgedbond->succeed("systemctl -M bridgedbond list-dependencies network-addresses-br0.service >&2");
-      $bridgedbond->succeed("systemctl -M bridgedbond status -n 30 -l network-addresses-br0.service");
-      $bridgedbond->succeed("nixos-container run bridgedbond -- ping -w 10 -c 1 -n 10.10.0.1");
-    };
+    with subtest("Physical device in bond in bridge in container can ping server"):
+        bridgedbond.wait_for_unit("default.target")
+        bridgedbond.succeed("nixos-container start bridgedbond")
+        bridgedbond.wait_for_unit("container@bridgedbond")
+        bridgedbond.succeed(
+            "systemctl -M bridgedbond list-dependencies network-addresses-br0.service >&2",
+            "systemctl -M bridgedbond status -n 30 -l network-addresses-br0.service",
+            "nixos-container run bridgedbond -- ping -w 10 -c 1 -n 10.10.0.1",
+        )
  '';
 })
--- a/nixos/tests/containers-portforward.nix
+++ b/nixos/tests/containers-portforward.nix
@ -7,7 +7,7 @@ let
  containerPort = 80;
 in 

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "containers-portforward";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ aristid aszlig eelco kampfschlaefer ianwookim ];
@ -36,27 +36,27 @@ import ./make-test.nix ({ pkgs, ...} : {

  testScript =
    ''
-      $machine->succeed("nixos-container list") =~ /webserver/ or die;
+      container_list = machine.succeed("nixos-container list")
+      assert "webserver" in container_list

      # Start the webserver container.
-      $machine->succeed("nixos-container start webserver");
+      machine.succeed("nixos-container start webserver")

      # wait two seconds for the container to start and the network to be up
-      sleep 2;
+      machine.sleep(2)

      # Since "start" returns after the container has reached
      # multi-user.target, we should now be able to access it.
-      #my $ip = $machine->succeed("nixos-container show-ip webserver");
-      #chomp $ip;
-      $machine->succeed("ping -n -c1 ${hostIp}");
-      $machine->succeed("curl --fail http://${hostIp}:${toString hostPort}/ > /dev/null");
+      # ip = machine.succeed("nixos-container show-ip webserver").strip()
+      machine.succeed("ping -n -c1 ${hostIp}")
+      machine.succeed("curl --fail http://${hostIp}:${toString hostPort}/ > /dev/null")

      # Stop the container.
-      $machine->succeed("nixos-container stop webserver");
-      $machine->fail("curl --fail --connect-timeout 2 http://${hostIp}:${toString hostPort}/ > /dev/null");
+      machine.succeed("nixos-container stop webserver")
+      machine.fail("curl --fail --connect-timeout 2 http://${hostIp}:${toString hostPort}/ > /dev/null")

      # Destroying a declarative container should fail.
-      $machine->fail("nixos-container destroy webserver");
+      machine.fail("nixos-container destroy webserver")
    '';

 })
--- a/nixos/tests/containers-restart_networking.nix
+++ b/nixos/tests/containers-restart_networking.nix
@ -16,7 +16,7 @@ let
      };
    };
  };
-in import ./make-test.nix ({ pkgs, ...} :
+in import ./make-test-python.nix ({ pkgs, ...} :
 {
  name = "containers-restart_networking";
  meta = with pkgs.stdenv.lib.maintainers; {
@ -64,50 +64,52 @@ in import ./make-test.nix ({ pkgs, ...} :
    eth1_bridged = nodes.client_eth1.config.system.build.toplevel;
    eth1_rstp = nodes.client_eth1_rstp.config.system.build.toplevel;
  in ''
-    $client->start();
+    client.start()

-    $client->waitForUnit("default.target");
+    client.wait_for_unit("default.target")

-    subtest "initial state", sub {
-      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2");
+    with subtest("Initial configuration connectivity check"):
+        client.succeed("ping 192.168.1.122 -c 1 -n >&2")
+        client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")

-      $client->fail("ip l show eth1 |grep \"master br0\" >&2");
-      $client->fail("grep eth1 /run/br0.interfaces >&2");
-    };
+        client.fail("ip l show eth1 |grep 'master br0' >&2")
+        client.fail("grep eth1 /run/br0.interfaces >&2")

-    subtest "interfaces without stp", sub {
-      $client->succeed("${eth1_bridged}/bin/switch-to-configuration test >&2");
+    with subtest("Bridged configuration without STP preserves connectivity"):
+        client.succeed(
+            "${eth1_bridged}/bin/switch-to-configuration test >&2"
+        )

-      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2");
+        client.succeed(
+            "ping 192.168.1.122 -c 1 -n >&2",
+            "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
+            "ip l show eth1 |grep 'master br0' >&2",
+            "grep eth1 /run/br0.interfaces >&2",
+        )

-      $client->succeed("ip l show eth1 |grep \"master br0\" >&2");
-      $client->succeed("grep eth1 /run/br0.interfaces >&2");
-    };
-
-    # activating rstp needs another service, therefor the bridge will restart and the container will loose its connectivity
-    #subtest "interfaces with rstp", sub {
-    #  $client->succeed("${eth1_rstp}/bin/switch-to-configuration test >&2");
-    #  $client->execute("ip -4 a >&2");
-    #  $client->execute("ip l >&2");
+    #  activating rstp needs another service, therefore the bridge will restart and the container will lose its connectivity
+    # with subtest("Bridged configuration with STP"):
+    #     client.succeed("${eth1_rstp}/bin/switch-to-configuration test >&2")
+    #     client.execute("ip -4 a >&2")
+    #     client.execute("ip l >&2")
    #
-    #  $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-    #  $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2");
-    #
-    #  $client->succeed("ip l show eth1 |grep \"master br0\" >&2");
-    #  $client->succeed("grep eth1 /run/br0.interfaces >&2");
-    #};
+    #     client.succeed(
+    #         "ping 192.168.1.122 -c 1 -n >&2",
+    #         "nixos-container run webserver -- ping -c 1 -n 192.168.1.2 >&2",
+    #         "ip l show eth1 |grep 'master br0' >&2",
+    #         "grep eth1 /run/br0.interfaces >&2",
+    #     )

-    subtest "back to no interfaces and no stp", sub {
-      $client->succeed("${originalSystem}/bin/switch-to-configuration test >&2");
+    with subtest("Reverting to initial configuration preserves connectivity"):
+        client.succeed(
+            "${originalSystem}/bin/switch-to-configuration test >&2"
+        )

-      $client->succeed("ping 192.168.1.122 -c 1 -n >&2");
-      $client->succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2");
+        client.succeed("ping 192.168.1.122 -c 1 -n >&2")
+        client.succeed("nixos-container run webserver -- ping -c 1 -n 192.168.1.1 >&2")

-      $client->fail("ip l show eth1 |grep \"master br0\" >&2");
-      $client->fail("grep eth1 /run/br0.interfaces >&2");
-    };
+        client.fail("ip l show eth1 |grep 'master br0' >&2")
+        client.fail("grep eth1 /run/br0.interfaces >&2")
  '';

 })
--- a/nixos/tests/gitea.nix
+++ b/nixos/tests/gitea.nix
@ -6,64 +6,104 @@
 with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;

-{
-  mysql = makeTest {
-    name = "gitea-mysql";
-    meta.maintainers = with maintainers; [ aanderse kolaente ];
+let
+  supportedDbTypes = [ "mysql" "postgres" "sqlite3" ];
+  makeGiteaTest = type: nameValuePair type (makeTest {
+    name = "gitea-${type}";
+    meta.maintainers = with maintainers; [ aanderse kolaente ma27 ];

-    machine =
-      { config, pkgs, ... }:
-      { services.gitea.enable = true;
-        services.gitea.database.type = "mysql";
+    nodes = {
+      server = { config, pkgs, ... }: {
+        services.gitea = {
+          enable = true;
+          database = { inherit type; };
+          disableRegistration = true;
+        };
+        environment.systemPackages = [ pkgs.gitea pkgs.jq ];
+        services.openssh.enable = true;
      };
+      client1 = { config, pkgs, ... }: {
+        environment.systemPackages = [ pkgs.git ];
+      };
+      client2 = { config, pkgs, ... }: {
+        environment.systemPackages = [ pkgs.git ];
+      };
+    };
+
+    testScript = let
+      inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+    in ''
+      GIT_SSH_COMMAND = "ssh -i $HOME/.ssh/privk -o StrictHostKeyChecking=no"
+      REPO = "gitea@server:test/repo"
+      PRIVK = "${snakeOilPrivateKey}"

-    testScript = ''
      start_all()

-      machine.wait_for_unit("gitea.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl --fail http://localhost:3000/")
-    '';
-  };
+      client1.succeed("mkdir /tmp/repo")
+      client1.succeed("mkdir -p $HOME/.ssh")
+      client1.succeed(f"cat {PRIVK} > $HOME/.ssh/privk")
+      client1.succeed("chmod 0400 $HOME/.ssh/privk")
+      client1.succeed("git -C /tmp/repo init")
+      client1.succeed("echo hello world > /tmp/repo/testfile")
+      client1.succeed("git -C /tmp/repo add .")
+      client1.succeed("git config --global user.email test@localhost")
+      client1.succeed("git config --global user.name test")
+      client1.succeed("git -C /tmp/repo commit -m 'Initial import'")
+      client1.succeed(f"git -C /tmp/repo remote add origin {REPO}")

-  postgres = makeTest {
-    name = "gitea-postgres";
-    meta.maintainers = [ maintainers.aanderse ];
+      server.wait_for_unit("gitea.service")
+      server.wait_for_open_port(3000)
+      server.succeed("curl --fail http://localhost:3000/")

-    machine =
-      { config, pkgs, ... }:
-      { services.gitea.enable = true;
-        services.gitea.database.type = "postgres";
-      };
-
-    testScript = ''
-      start_all()
-
-      machine.wait_for_unit("gitea.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl --fail http://localhost:3000/")
-    '';
-  };
-
-  sqlite = makeTest {
-    name = "gitea-sqlite";
-    meta.maintainers = [ maintainers.aanderse ];
-
-    machine =
-      { config, pkgs, ... }:
-      { services.gitea.enable = true;
-        services.gitea.disableRegistration = true;
-      };
-
-    testScript = ''
-      start_all()
-
-      machine.wait_for_unit("gitea.service")
-      machine.wait_for_open_port(3000)
-      machine.succeed("curl --fail http://localhost:3000/")
-      machine.succeed(
-          "curl --fail http://localhost:3000/user/sign_up | grep 'Registration is disabled. Please contact your site administrator.'"
+      server.succeed(
+          "curl --fail http://localhost:3000/user/sign_up | grep 'Registration is disabled. "
+          + "Please contact your site administrator.'"
      )
+      server.succeed(
+          "su -l gitea -c 'GITEA_WORK_DIR=/var/lib/gitea gitea admin create-user "
+          + "--username test --password totallysafe --email test@localhost'"
+      )
+
+      api_token = server.succeed(
+          "curl --fail -X POST http://test:totallysafe@localhost:3000/api/v1/users/test/tokens "
+          + "-H 'Accept: application/json' -H 'Content-Type: application/json' -d "
+          + "'{\"name\":\"token\"}' | jq '.sha1' | xargs echo -n"
+      )
+
+      server.succeed(
+          "curl --fail -X POST http://localhost:3000/api/v1/user/repos "
+          + "-H 'Accept: application/json' -H 'Content-Type: application/json' "
+          + f"-H 'Authorization: token {api_token}'"
+          + ' -d \'{"auto_init":false, "description":"string", "license":"mit", "name":"repo", "private":false}\'''
+      )
+
+      server.succeed(
+          "curl --fail -X POST http://localhost:3000/api/v1/user/keys "
+          + "-H 'Accept: application/json' -H 'Content-Type: application/json' "
+          + f"-H 'Authorization: token {api_token}'"
+          + ' -d \'{"key":"${snakeOilPublicKey}","read_only":true,"title":"SSH"}\'''
+      )
+
+      client1.succeed(
+          f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git -C /tmp/repo push origin master"
+      )
+
+      client2.succeed("mkdir -p $HOME/.ssh")
+      client2.succeed(f"cat {PRIVK} > $HOME/.ssh/privk")
+      client2.succeed("chmod 0400 $HOME/.ssh/privk")
+      client2.succeed(f"GIT_SSH_COMMAND='{GIT_SSH_COMMAND}' git clone {REPO}")
+      client2.succeed('test "$(cat repo/testfile | xargs echo -n)" = "hello world"')
+
+      server.succeed(
+          'test "$(curl http://localhost:3000/api/v1/repos/test/repo/commits '
+          + '-H "Accept: application/json" | jq length)" = "1"'
+      )
+
+      client1.shutdown()
+      client2.shutdown()
+      server.shutdown()
    '';
-  };
-}
+  });
+in
+
+listToAttrs (map makeGiteaTest supportedDbTypes)
--- a/nixos/tests/systemd-analyze.nix
+++ b/nixos/tests/systemd-analyze.nix
@ -0,0 +1,46 @@
+import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... }:
+
+{
+  name = "systemd-analyze";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ raskin ];
+  };
+
+  machine =
+    { pkgs, lib, ... }:
+    { boot.kernelPackages = lib.mkIf latestKernel pkgs.linuxPackages_latest;
+      sound.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    # We create a special output directory to copy it as a whole
+    with subtest("Prepare output dir"):
+        machine.succeed("mkdir systemd-analyze")
+
+
+    # Save the output into a file with given name inside the common
+    # output directory
+    def run_systemd_analyze(args, name):
+        tgt_dir = "systemd-analyze"
+        machine.succeed(
+            "systemd-analyze {} > {}/{} 2> {}/{}.err".format(
+                " ".join(args), tgt_dir, name, tgt_dir, name
+            )
+        )
+
+
+    with subtest("Print statistics"):
+        run_systemd_analyze(["blame"], "blame.txt")
+        run_systemd_analyze(["critical-chain"], "critical-chain.txt")
+        run_systemd_analyze(["dot"], "dependencies.dot")
+        run_systemd_analyze(["plot"], "systemd-analyze.svg")
+
+    # We copy the main graph into the $out (toplevel), and we also copy
+    # the entire output directory with additional data
+    with subtest("Copying the resulting data into $out"):
+        machine.copy_from_vm("systemd-analyze/", "")
+        machine.copy_from_vm("systemd-analyze/systemd-analyze.svg", "")
+  '';
+})
--- a/pkgs/applications/audio/MMA/default.nix
+++ b/pkgs/applications/audio/MMA/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, python3, alsaUtils, timidity }:

  stdenv.mkDerivation rec {
-  version = "16.06";
+  version = "19.08";
  pname = "mma";

  src = fetchurl {
    url = "https://www.mellowood.ca/mma/mma-bin-${version}.tar.gz";
-    sha256 = "1g4gvc0nr0qjc0fyqrnx037zpaasgymgmrm5s7cdxqnld9wqw8ww";
+    sha256 = "02g2q9f1hbrj1v4mbf7zx2571vqpfla5803hcjpkdkvn8g0dwci0";
  };

  buildInputs = [ makeWrapper python3 alsaUtils timidity ];
--- a/pkgs/applications/audio/bshapr/default.nix
+++ b/pkgs/applications/audio/bshapr/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "BShapr";
-  version = "0.4";
+  version = "0.6";

  src = fetchFromGitHub {
    owner = "sjaehn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "02b4wdfhr9y7z2k6ls086gv3vz4sjf7b1k8ryh573bzd8nr4896v";
+    sha256 = "0mi8f0svq1h9cmmxyskcazr5x2q4dls3j9jc6ahi5rlk7i0bpa74";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/editors/edbrowse/default.nix
+++ b/pkgs/applications/editors/edbrowse/default.nix
@ -1,19 +1,11 @@
-{ stdenv, fetchFromGitHub, fetchpatch, duktape, curl, pcre, readline, openssl, perl, html-tidy }:
+{ stdenv, fetchFromGitHub, duktape, curl, pcre, readline, openssl, perl, html-tidy }:

 stdenv.mkDerivation rec {
  pname = "edbrowse";
-  version = "3.7.4";
+  version = "3.7.6";

  buildInputs = [ curl pcre readline openssl duktape perl html-tidy ];

-  patches = [
-    # Fix build against recent libcurl
-    (fetchpatch {
-      url = https://github.com/CMB/edbrowse/commit/5d2b9e21fdf019f461ebe62738d615428d5db963.diff;
-      sha256 = "167q8n0syj3iv6lxrbpv4kvb63j4byj4qxrxayy08bah3pss3gky";
-    })
-  ];
-
  postPatch = ''
    for i in ./tools/*.pl
    do
@ -21,13 +13,16 @@ stdenv.mkDerivation rec {
    done
  '';

-  makeFlags = "-C src prefix=$(out)";
+  makeFlags = [ 
+    "-C src"
+    "prefix=${placeholder "out"}"
+  ];

  src = fetchFromGitHub {
    owner = "CMB";
    repo = "edbrowse";
    rev = "v${version}";
-    sha256 = "0i9ivyfy1dd16c89f392kwx6wxgkkpyq2hl32jhzra0fb0zyl0k6";
+    sha256 = "0yk4djb9q8ll94fs57y706bsqlar4pfx6ysasvkzj146926lrh8a";
  };
  meta = with stdenv.lib; {
    description = "Command Line Editor Browser";
@ -39,8 +34,8 @@ stdenv.mkDerivation rec {
      edbrowse can also tap into databases through odbc. It was primarily written by Karl Dahlke.
      '';
    license = licenses.gpl1Plus;
-    homepage = http://edbrowse.org/;
-    maintainers = [ maintainers.schmitthenner maintainers.vrthra ];
+    homepage = "https://edbrowse.org/";
+    maintainers = with maintainers; [ schmitthenner vrthra equirosa ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@ -38,6 +38,15 @@ in stdenv.mkDerivation rec {
    (stdenv.lib.enableFeature enableTiny "tiny")
  ];

+    patches = [
+      (fetchurl {
+        # fix compilation on macOS, where 'st_mtim' is unknown
+        # upstream patch not in 4.6
+        url = "https://git.savannah.gnu.org/cgit/nano.git/patch/?id=f516cddce749c3bf938271ef3182b9169ac8cbcc";
+        sha256 = "0gqymvr5vxxypr7y3sm252rsi4gjqp597l01x0lkxyvxsn45a4sx";
+      })
+  ];
+
  postInstall = ''
    cp ${nixSyntaxHighlight}/nix.nanorc $out/share/nano/
  '';
--- a/pkgs/applications/graphics/cinepaint/default.nix
+++ b/pkgs/applications/graphics/cinepaint/default.nix
@ -1,38 +0,0 @@
-{ stdenv, fetchurl, cmake, pkgconfig, gtk2, freetype, fontconfig, lcms,
-  flex, libtiff, libjpeg, libpng, libexif, zlib, perlPackages, libX11,
-  pythonPackages, gettext, intltool, babl, gegl,
-  glib, makedepend, xorgproto, libXmu, openexr,
-  libGLU, libGL, libXext, libXpm, libXau, libXxf86vm, pixman, libpthreadstubs, fltk } :
-
-let
-  inherit (pythonPackages) python pygtk;
-in stdenv.mkDerivation rec {
-  name = "cinepaint-1.1";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/cinepaint/${name}.tgz";
-    sha256 = "0b5g4bkq62yiz1cnb2vfij0a8fw5w5z202v5dm4dh89k7cj0yq4w";
-  };
-
-  buildInputs = [ libpng gtk2 freetype fontconfig lcms flex libtiff libjpeg
-    libexif zlib libX11 python pygtk gettext intltool babl
-    gegl glib makedepend xorgproto libXmu openexr libGLU libGL
-    libXext libXpm libXau libXxf86vm pixman libpthreadstubs fltk
-  ] ++ (with perlPackages; [ perl XMLParser ]);
-
-  hardeningDisable = [ "format" ];
-
-  patches = [ ./install.patch ];
-
-  nativeBuildInputs = [ cmake pkgconfig ];
-
-  NIX_LDFLAGS = "-lm -llcms -ljpeg -lpng -lX11";
-
-  meta = {
-    homepage = http://www.cinepaint.org/;
-    license = stdenv.lib.licenses.free;
-    description = "Image editor which supports images over 8bpp and ICC profiles";
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/applications/graphics/cinepaint/install.patch
+++ b/pkgs/applications/graphics/cinepaint/install.patch
@ -1,24 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index dfb182f..5adaaa5 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -138,7 +138,7 @@ STRING(REPLACE "/" "\\/" ESCAPEDPREFIX ${PREFIX})
- # Note that for MacOS this needs to be revised 
- # for the @OSX_ICC...@ variables
- ADD_CUSTOM_COMMAND(
-   OUTPUT ${CMAKE_CURRENT_SOURCE_DIR}/gimprc
-+   OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/gimprc
-    COMMAND  sed -e s/\@platform\@//g
- 		-e s/\@prefix\@/${ESCAPEDPREFIX}/g 
- 	        -e s/\@exec_prefix\@/\${prefix}/g
-@@ -155,8 +155,8 @@ ADD_CUSTOM_COMMAND(
- 
- ADD_CUSTOM_TARGET(RCFile ALL echo
-       ""
-      DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/user_install 
-              ${CMAKE_CURRENT_SOURCE_DIR}/gimprc
-+      DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/user_install 
-+              ${CMAKE_CURRENT_BINARY_DIR}/gimprc
-    )
- 
- 
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@ -60,11 +60,11 @@ let

 in mkDerivation rec {
  pname = "drawpile";
-  version = "2.1.14";
+  version = "2.1.15";

  src = fetchurl {
    url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "0vpsq8swvli6xiykjqjmdcz33jd44nvhq1n350dm9qap9s9wdr47";
+    sha256 = "0w6bdg1rnnjzjg8xzqv3a9qhw41q41sjvp6f8m0sqxjfax05lqin";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/mcomix/default.nix
+++ b/pkgs/applications/graphics/mcomix/default.nix
@ -1,34 +0,0 @@
-{ stdenv, fetchurl, python27Packages }:
-
-python27Packages.buildPythonApplication rec {
-    name = "mcomix-${version}";
-    version = "1.2.1";
-
-    src = fetchurl {
-      url = "mirror://sourceforge/mcomix/${name}.tar.bz2";
-      sha256 = "0fzsf9pklhfs1rzwzj64c0v30b74nk94p93h371rpg45qnfiahvy";
-    };
-
-    propagatedBuildInputs = with python27Packages; [ pygtk pillow setuptools ];
-
-    doCheck = false;
-
-    meta = {
-      description = "Image viewer designed to handle comic books";
-      longDescription = ''
-        MComix is an user-friendly, customizable image viewer. It is specifically
-        designed to handle comic books, but also serves as a generic viewer.
-        It reads images in ZIP, RAR, 7Zip or tar archives as well as plain image
-        files. It is written in Python and uses GTK through the PyGTK bindings,
-        and runs on both Linux and Windows.
-
-        MComix is a fork of the Comix project, and aims to add bug fixes and
-        stability improvements after Comix development came to a halt in late 2009.
-      '';
-      homepage = http://mcomix.sourceforge.net/;
-      license = stdenv.lib.licenses.gpl2;
-      maintainers = with stdenv.lib.maintainers; [ AndersonTorres ];
-    };
-}
-# TODO:
-# - error in check phase
--- a/pkgs/applications/graphics/mirage/default.nix
+++ b/pkgs/applications/graphics/mirage/default.nix
@ -1,31 +0,0 @@
-{ stdenv, fetchurl, pythonPackages, libX11, gettext }:
-
-pythonPackages.buildPythonApplication rec {
-    pname = "mirage";
-    version = "0.9.5.2";
-
-    src = fetchurl {
-      url = "mirror://sourceforge/mirageiv/${pname}-${version}.tar.bz2";
-      sha256 = "d214a1b6d99d1d1e83da5848a2cef181f6781e0990e93f7ebff5880b0c43f43c";
-    };
-
-    doCheck = false;
-
-    nativeBuildInputs = [ gettext ];
-
-    buildInputs = [ stdenv libX11 gettext ];
-
-    patchPhase = ''
-      sed -i "s@/usr/local/share/locale@$out/share/locale@" mirage.py
-    '';
-
-    propagatedBuildInputs = with pythonPackages; [ pygtk pillow ];
-
-    meta = {
-      description = "Simple image viewer written in PyGTK";
-
-      homepage = http://mirageiv.sourceforge.net/;
-
-      license = stdenv.lib.licenses.gpl2;
-    };
-}
--- a/pkgs/applications/misc/batti/default.nix
+++ b/pkgs/applications/misc/batti/default.nix
@ -1,51 +0,0 @@
-{ stdenv, fetchurl
-, pkgconfig, gettext, pythonPackages
-, gtk2, gdk-pixbuf, upower
-, makeWrapper }:
-
-let
-  inherit (pythonPackages) dbus-python pygtk python;
-in stdenv.mkDerivation rec {
-
-  pname = "batti";
-  version = "0.3.8";
-
-  src = fetchurl {
-    url = "https://batti-gtk.googlecode.com/files/${pname}-${version}.tar.gz";
-    sha256 = "072d92gpsiiin631589nj77i2w1425p6db0qxyml7myscfy9jgx6";
-  };
-
-  buildInputs = with stdenv.lib;
-  [ pkgconfig gettext python gtk2 pygtk dbus-python gdk-pixbuf upower makeWrapper ];
-
-  dontConfigure = true;
-
-  buildPhase = ''
-    python setup.py build
-  '';
-
-  installPhase = ''
-    python setup.py install --prefix $out
-    wrapProgram "$out/bin/batti" \
-      --set PYTHONPATH "$PYTHONPATH:$(toPythonPath $out)" \
-      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-
-  meta = with stdenv.lib; {
-    description = "An {UPower,GTK}-based battery monitor for the system tray";
-    longDescription = ''
-      Batti is a simple battery monitor for the system tray. Batti
-      uses UPower, and if that is missing DeviceKit.Power, for it's
-      power information.
-    '';
-    homepage = http://batti-gtk.googlecode.com/;
-    license = licenses.lgpl2Plus;
-    maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
-    broken = true;  # see https://github.com/NixOS/nixpkgs/pull/4031#issuecomment-56283520
-  };
-}
-
-# TODO: fix the "icon not found" problems...
--- a/pkgs/applications/misc/bleachbit/default.nix
+++ b/pkgs/applications/misc/bleachbit/default.nix
@ -1,4 +1,14 @@
-{ stdenv, pythonPackages, fetchurl, gettext }:
+{ stdenv
+, pythonPackages
+, fetchurl
+, gettext
+, gobject-introspection
+, wrapGAppsHook
+, glib
+, gtk3
+, libnotify
+}:
+
 pythonPackages.buildPythonApplication rec {
  pname = "bleachbit";
  version = "3.0";
@ -10,7 +20,24 @@ pythonPackages.buildPythonApplication rec {
    sha256 = "18ns9hms671b4l0189m1m2agprkydnpvyky9q2f5hxf35i9cn67d";
  };

-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [
+    gettext
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libnotify
+  ];
+
+  propagatedBuildInputs = with pythonPackages; [
+    chardet
+    pygobject3
+    requests
+    scandir
+  ];

  # Patch the many hardcoded uses of /usr/share/ and /usr/bin
  postPatch = ''
@ -20,15 +47,17 @@ pythonPackages.buildPythonApplication rec {

  dontBuild = true;

-  installFlags = [ "prefix=${placeholder "out"}" ];
+  installFlags = [
+    "prefix=${placeholder "out"}"
+  ];

-  propagatedBuildInputs = with pythonPackages; [ pygtk ];
+  strictDeps = false;

-  meta = {
+  meta = with stdenv.lib; {
    homepage = http://bleachbit.sourceforge.net;
    description = "A program to clean your computer";
    longDescription = "BleachBit helps you easily clean your computer to free space and maintain privacy.";
-    license = stdenv.lib.licenses.gpl3;
-    maintainers = with stdenv.lib.maintainers; [ leonardoce ];
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ leonardoce ];
  };
 }
--- a/pkgs/applications/misc/gnome15/default.nix
+++ b/pkgs/applications/misc/gnome15/default.nix
@ -1,39 +0,0 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, python2, gnome_python, gnome_python_desktop }:
-
-stdenv.mkDerivation {
-  name = "gnome15-2016-06-10";
-
-  src = fetchFromGitHub {
-    owner = "achilleas-k";
-    repo = "gnome15";
-    rev = "1077c890d9ba8ef7a5e448e70a792de5c7443c84";
-    sha256 = "0z5k2rgvv5zyi3lbbk6svncypidj44qzfchivb4vlr7clmh16m95";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkgconfig python2.pkgs.wrapPython ];
-  buildInputs = [ python2 ];
-  propagatedBuildInputs = with python2.pkgs; [
-    pygtk keyring virtkey pillow dbus-python pyinotify lxml pyxdg pyusb gnome_python gnome_python_desktop
-    python-uinput xlib pyudev pyinputevent
-  ];
-
-  postPatch = ''
-    touch README
-    export UDEV_RULES_PATH="$out/lib/udev/rules.d"
-  '';
-
-  postFixup = ''
-    wrapPythonPrograms
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A set of tools for configuring the Logitech G15 keyboard";
-    # Doesn't work with new `keyring` library which is Python 3-only now.
-    # https://github.com/Gnome15/gnome15/issues/29
-    broken = true;
-    license = licenses.gpl3;
-    homepage = https://gnome15.org/;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ abbradar ];
-  };
-}
--- a/pkgs/applications/misc/hamster-time-tracker/default.nix
+++ b/pkgs/applications/misc/hamster-time-tracker/default.nix
@ -1,42 +0,0 @@
-{ stdenv, fetchzip, pythonPackages, docbook2x, libxslt, gnome-doc-utils
-, intltool, dbus-glib, gnome_python
-, hicolor-icon-theme
-, wafHook
-}:
-
-# TODO: Add optional dependency 'wnck', for "workspace tracking" support. Fixes
-# this message:
-#
-#   WARNING:root:Could not import wnck - workspace tracking will be disabled
-
-pythonPackages.buildPythonApplication rec {
-  name = "hamster-time-tracker-1.04";
-
-  src = fetchzip {
-    name = "${name}-src";
-    url = "https://github.com/projecthamster/hamster/archive/${name}.tar.gz";
-    sha256 = "1a85rcg561792kdyv744cgzw7mmpmgv6d6li1sijfdpqa1ninf8g";
-  };
-
-  nativeBuildInputs = [ wafHook intltool ];
-  buildInputs = [
-    docbook2x libxslt gnome-doc-utils dbus-glib hicolor-icon-theme
-  ];
-
-  propagatedBuildInputs = with pythonPackages; [ pygobject2 pygtk pyxdg gnome_python dbus-python ];
-
-  postFixup = ''
-    wrapPythonProgramsIn $out/lib/hamster-time-tracker "$out $pythonPath"
-  '';
-
-  # error: invalid command 'test'
-  doCheck = false;
-
-  meta = with stdenv.lib; {
-    description = "Time tracking application";
-    homepage = https://projecthamster.wordpress.com/;
-    license = licenses.gpl3;
-    platforms = platforms.all;
-    maintainers = [ maintainers.bjornfor ];
-  };
-}
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.60.1";
+  version = "0.61.0";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,10 +10,10 @@ buildGoModule rec {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0l8n87y5zrs09s693rqvqwz0233wlr4jwib7r36ilss1qgm7x6n5";
+    sha256 = "1ad70g4gb44dk48pbgk48jzs44b6l7ksxb739ahp7vs1nyvvgffr";
  };

-  modSha256 = "1an4plbx06fzz2iqzgs08r6vsjpkl5lbqck5jqmv6fv7b7psf7iw";
+  modSha256 = "1jb1iqlp1005aj8smcgznmwnqaysi5g5wcsj8nvvm70hhc9j8wns";

  buildFlags = "-tags extended";

--- a/pkgs/applications/misc/latte-dock/default.nix
+++ b/pkgs/applications/misc/latte-dock/default.nix
@ -3,11 +3,11 @@

 mkDerivation rec {
  pname = "latte-dock";
-  version = "0.8.9";
+  version = "0.9.5";

  src = fetchurl {
    url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1kkpxa39crjpqgamrcpgp1mrcdg0aq9850yb6cf7lw7d3x2fdrxj";
+    sha256 = "1g8a2lmg9agcs2kwbwh6sj9hkrbzad7bkxk39nx5536svnifbg1c";
    name = "${pname}-${version}.tar.xz";
  };

--- a/pkgs/applications/misc/pmenu/default.nix
+++ b/pkgs/applications/misc/pmenu/default.nix
@ -1,36 +0,0 @@
-{ stdenv, fetchFromGitLab, python2Packages, gnome-menus }:
-
-stdenv.mkDerivation {
-  pname = "pmenu";
-  version = "2018-01-01";
-
-  src = fetchFromGitLab {
-    owner = "o9000";
-    repo = "pmenu";
-    rev = "f98a5bdf20deb0b7f0543e5ce6a8f5574f695e07";
-    sha256 = "131nqafbmbfpgsgss27pz4cyb9fb29m5h1ai1fyvcn286rr9dnp2";
-  };
-
-  nativeBuildInputs = [ python2Packages.wrapPython ];
-
-  buildInputs = [ python2Packages.pygtk gnome-menus ];
-
-  pythonPath = [ python2Packages.pygtk ];
-    
-  installPhase = ''
-    mkdir -p $out/bin $out/share/applications
-    ./install.sh $out
-  '';
-
-  postFixup = ''
-    wrapPythonPrograms
-  '';
-
-  meta = {
-    homepage = https://gitlab.com/o9000/pmenu;
-    description = "Start menu for Linux/BSD";
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.romildo ];
-  };
-}
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@ -9,7 +9,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "prusa-slicer";
-  version = "2.1.0";
+  version = "2.1.1";

  enableParallelBuilding = true;

@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "prusa3d";
    repo = "PrusaSlicer";
-    sha256 = "172nz01iiqfjzkpcbl78j6almq6av70l71jgrzrcdw6ham1wqnpr";
+    sha256 = "0i393nbc2salb4j5l2hvy03ng7hmf90d2xj653pw9bsikhj0r3jd";
    rev = "version_${version}";
  };

--- a/pkgs/applications/misc/vym/default.nix
+++ b/pkgs/applications/misc/vym/default.nix
@ -1,18 +1,45 @@
-{ stdenv, fetchurl, pkgconfig, qmake, qtsvg }:
+{ stdenv, mkDerivation, fetchurl, pkgconfig, qmake, qtscript, qtsvg }:

-stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "vym";
-  version = "2.6.11";
+  version = "2.7.0";

  src = fetchurl {
-    url = "mirror://sourceforge/project/vym/2.6.0/${pname}-${version}.tar.bz2";
-    sha256 = "1yznlb47jahd662a2blgh1ccwpl5dp5rjz9chsxjzhj3vbkzx3nl";
+    url = "mirror://sourceforge/project/vym/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "1rnrfqlff7wv6yni8bvff8n90pmn82k82zd4sn1jsx9r1n3qsfkh";
  };

+  # Hardcoded paths scattered about all have form share/vym
+  # which is encouraging, although we'll need to patch them (below).
+  qmakeFlags = [
+    "DATADIR=${placeholder "out"}/share"
+    "DOCDIR=${placeholder "out"}/share/doc/vym"
+  ];
+
+  postPatch = ''
+    for x in \
+      exportoofiledialog.cpp \
+      main.cpp \
+      mainwindow.cpp \
+      tex/*.{tex,lyx}; \
+    do
+      substituteInPlace $x \
+        --replace /usr/share/vym $out/share/vym \
+        --replace /usr/local/share/vym $out/share/vym \
+        --replace /usr/share/doc $out/share/doc/vym
+    done
+  '';
+
  hardeningDisable = [ "format" ];

  nativeBuildInputs = [ pkgconfig qmake ];
-  buildInputs = [ qtsvg ];
+  buildInputs = [ qtscript qtsvg ];
+
+  postInstall = ''
+    install -Dm755 -t $out/share/man/man1 doc/*.1.gz
+  '';
+
+  dontGzipMan = true;

  meta = with stdenv.lib; {
    description = "A mind-mapping software";
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "argo";
-  version = "2.4.1";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "v${version}";
-    sha256 = "1f9l9d4r0qfhpr2fn17faczcwmwmdz8f56f27cmmnhxz4r7qcm48";
+    sha256 = "15726n5rrbzszq5dpmrxbw9cn7ahihn28jqk274270140gz5aak1";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "0k59n40rmxjdn0xi8gr08zlxk0irfc7crra9x8qdljvivqshma3z";
+    sha256 = "09ds5qn13l6l8kl2i01hgy6pqr30z1rm447ax32lf79zp8hca3r3";
  };

  modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -112,8 +112,8 @@ in rec {
  terraform_0_11-full = terraform_0_11.full;

  terraform_0_12 = pluggable (generic {
-    version = "0.12.17";
-    sha256 = "1pmvjbmzws5qjzz34dw0fcb6p36vafqs0h8i87g7lmhckb9bqihv";
+    version = "0.12.18";
+    sha256 = "1p2rvs9dw2rzzggf3q2lifwbd82b7xb3jpb4yz5nmggn5g22qlc1";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "zeek";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchurl {
    url = "https://www.zeek.org/downloads/zeek-${version}.tar.gz";
-    sha256 = "16pz5fh0z1hmvhn8pxqmdm5a9d8mqrp4gxpxkaywnaqk2h598lmm";
+    sha256 = "1lhik212wrbi092qizc08f3i0b9pj318sxwm0abc5jc3v3pz7x3r";
  };

  nativeBuildInputs = [ cmake flex bison file ];
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -17,9 +17,13 @@ stdenv.mkDerivation rec {
      then writeText "riot-config.json" conf
      else "$out/config.sample.json";
  in ''
+    runHook preInstall
+
    mkdir -p $out/
    cp -R . $out/
    ln -s ${configFile} $out/config.json
+
+    runHook postInstall
  '';

  meta = {
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -6,7 +6,7 @@ at-spi2-atk, at-spi2-core, libuuid, nodePackages, libpulseaudio

 let

-  version = "4.1.2";
+  version = "4.2.0";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -53,7 +53,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://downloads.slack-edge.com/linux_releases/slack-desktop-${version}-amd64.deb";
-        sha256 = "0a1b2k81hm1lfrdb47gmd07jqb7hva9sxsiph7b3iwzpzw8pjrkh";
+        sha256 = "01b2klhky04fijdqcpfafgdqx2c5nh2fpnzvzgvz10hv7h16cinv";
      }
    else
      throw "Slack is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, wrapGAppsHook
+, dpkg
+, atomEnv
+, libuuid
+, pulseaudio
+, at-spi2-atk
+, coreutils
+, gawk
+, xdg_utils
+, systemd }:
+
+stdenv.mkDerivation rec {
+  pname = "teams";
+  version = "1.2.00.32451";
+
+  src = fetchurl {
+    url = "https://packages.microsoft.com/repos/ms-teams/pool/main/t/teams/teams_${version}_amd64.deb";
+    sha256 = "1p053kg5qksr78v2h7cxia5mb9kzgfwm6n99x579vfx48kka1n18";
+  };
+
+  nativeBuildInputs = [ dpkg autoPatchelfHook wrapGAppsHook ];
+
+  unpackCmd = "dpkg -x $curSrc .";
+
+  buildInputs = atomEnv.packages ++ [
+    libuuid
+    at-spi2-atk
+  ];
+
+  runtimeDependencies = [
+    systemd.lib
+    pulseaudio
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PATH : "${coreutils}/bin:${gawk}/bin:${xdg_utils}/bin")
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{opt,bin}
+
+    mv share/teams $out/opt/
+    mv share $out/share
+
+    substituteInPlace $out/share/applications/teams.desktop \
+      --replace /usr/bin/ $out/bin/
+
+    ln -s $out/opt/teams/teams $out/bin/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Microsoft Teams";
+    homepage = "https://teams.microsoft.com";
+    downloadPage = "https://teams.microsoft.com/downloads";
+    license = licenses.unfree;
+    maintainers = [ maintainers.liff ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, fetchpatch, pkgconfig, gtk2, lua, perl, python3
 , pciutils, dbus-glib, libcanberra-gtk2, libproxy
-, libsexy, enchant2, libnotify, openssl, isocodes
+, enchant2, libnotify, openssl, isocodes
 , desktop-file-utils
 , meson, ninja
 }:
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    gtk2 lua perl python3 pciutils dbus-glib libcanberra-gtk2 libproxy
-    libsexy libnotify openssl desktop-file-utils
+    libnotify openssl desktop-file-utils
    isocodes
  ];

--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@ -1,213 +1,339 @@
-{ lib, stdenv, fetchurl, pkgconfig, gtk2, pango, perl, python2, python3, nodejs
-, libIDL, libjpeg, zlib, dbus, dbus-glib, bzip2, xorg
-, freetype, fontconfig, file, nspr, nss, libnotify
-, yasm, libGLU, libGL, sqlite, zip, unzip
-, libevent, libstartup_notification
-, icu, libpng, jemalloc
-, autoconf213, which, m4, fetchpatch
-, writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl
-, runtimeShell
-, cargo, rustc, rust-cbindgen, llvmPackages, nasm
-, enableGTK3 ? false, gtk3, gnome3, wrapGAppsHook, makeWrapper
-, enableCalendar ? true
-, debugBuild ? false
-, # If you want the resulting program to call itself "Thunderbird" instead
-  # of "Earlybird" or whatever, enable this option.  However, those
-  # binaries may not be distributed without permission from the
-  # Mozilla Foundation, see
-  # http://www.mozilla.org/foundation/trademarks/.
-  enableOfficialBranding ? false
+{ autoconf213
+, bzip2
+, cargo
+, common-updater-scripts
+, coreutils
+, curl
+, dbus
+, dbus-glib
+, fetchurl
+, file
+, fontconfig
+, freetype
+, glib
+, gnugrep
+, gnused
+, icu
+, jemalloc
+, lib
+, libGL
+, libGLU
+, libIDL
+, libevent
+, libjpeg
+, libnotify
+, libpng
+, libstartup_notification
+, libvpx
+, libwebp
+, llvmPackages
+, m4
 , makeDesktopItem
+, nasm
+, nodejs
+, nspr
+, nss
+, pango
+, perl
+, pkgconfig
+, python2
+, python3
+, runtimeShell
+, rust-cbindgen
+, rustc
+, sqlite
+, stdenv
+, unzip
+, which
+, writeScript
+, xidel
+, xorg
+, yasm
+, zip
+, zlib
+
+, debugBuild ? false
+
+, alsaSupport ? stdenv.isLinux, alsaLib
+, pulseaudioSupport ? stdenv.isLinux, libpulseaudio
+, gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
+, waylandSupport ? true
+, libxkbcommon, calendarSupport ? true
+
+, # If you want the resulting program to call itself "Thunderbird" instead
+# of "Earlybird" or whatever, enable this option.  However, those
+# binaries may not be distributed without permission from the
+# Mozilla Foundation, see
+# http://www.mozilla.org/foundation/trademarks/.
+enableOfficialBranding ? false
 }:

-let
-  wrapperTool = if enableGTK3 then wrapGAppsHook else makeWrapper;
-  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
-in stdenv.mkDerivation rec {
+assert waylandSupport -> gtk3Support == true;
+
+stdenv.mkDerivation rec {
  pname = "thunderbird";
-  version = "68.2.2";
+  version = "68.3.0";

  src = fetchurl {
-    url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "3mvanjfc35f14lsfa4zjlhsvwij1n9dz9xmisd5s376r5wp9y33sva5ly914b2hmdl85ypdwv90zyi6whj7jb2f2xmqk480havxgjcn";
+    url =
+      "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
+    sha512 =
+      "3aqr3dj5laws516k6jf8f35a1964p0s75sp682yy87xnzgd8m1iha55z79dcavis2ma9hiyacjnznjz04qhqd4q8swjgfg7lj8lyiwl";
  };

-  # from firefox, but without sound libraries
-  buildInputs =
-    [ gtk2 zip libIDL libjpeg zlib bzip2
-      dbus dbus-glib pango freetype fontconfig xorg.libXi
-      xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
-      nspr nss libnotify xorg.pixman yasm libGLU libGL
-      xorg.libXScrnSaver xorg.xorgproto
-      xorg.libXext sqlite unzip
-      libevent libstartup_notification /* cairo */
-      icu libpng jemalloc nasm
-    ]
-    ++ lib.optionals enableGTK3 [ gtk3 gnome3.adwaita-icon-theme ];
+  nativeBuildInputs = [
+    autoconf213
+    cargo
+    gnused
+    llvmPackages.llvm
+    m4
+    nasm
+    nodejs
+    perl
+    pkgconfig
+    python2
+    python3
+    rust-cbindgen
+    rustc
+    which
+    yasm
+  ] ++ lib.optional gtk3Support wrapGAppsHook;

-  # from firefox + m4 + wrapperTool
-  # llvm is for llvm-objdump
-  nativeBuildInputs = [ m4 autoconf213 which gnused pkgconfig perl python2 python3 nodejs wrapperTool cargo rustc rust-cbindgen llvmPackages.llvm ];
+  buildInputs = [
+    bzip2
+    dbus
+    dbus-glib
+    file
+    fontconfig
+    freetype
+    glib
+    gtk2
+    icu
+    jemalloc
+    libGL
+    libGLU
+    libIDL
+    libevent
+    libjpeg
+    libnotify
+    libpng
+    libstartup_notification
+    libvpx
+    libwebp
+    nspr
+    nss
+    pango
+    perl
+    sqlite
+    unzip
+    xorg.libX11
+    xorg.libXScrnSaver
+    xorg.libXcursor
+    xorg.libXext
+    xorg.libXft
+    xorg.libXi
+    xorg.libXrender
+    xorg.libXt
+    xorg.pixman
+    xorg.xorgproto
+    zip
+    zlib
+  ] ++ lib.optional alsaSupport alsaLib
+    ++ lib.optional gtk3Support gtk3
+    ++ lib.optional pulseaudioSupport libpulseaudio
+    ++ lib.optional waylandSupport libxkbcommon;
+
+  NIX_CFLAGS_COMPILE =[
+    "-I${glib.dev}/include/gio-unix-2.0"
+    "-I${nss.dev}/include/nss"
+  ];

  patches = [
-    # Remove buildconfig.html to prevent a dependency on clang etc.
    ./no-buildconfig.patch
-  ]
-  ++ lib.optional (lib.versionOlder version "69")
-    (fetchpatch { # https://bugzilla.mozilla.org/show_bug.cgi?id=1500436#c29
-      name = "write_error-parallel_make.diff";
-      url = "https://hg.mozilla.org/mozilla-central/raw-diff/562655fe/python/mozbuild/mozbuild/action/node.py";
-      sha256 = "11d7rgzinb4mwl7yzhidjkajynmxgmffr4l9isgskfapyax9p88y";
-    });
+  ];

-  configureFlags =
-    [ # from firefox, but without sound libraries (alsa, libvpx, pulseaudio)
-      "--enable-application=comm/mail"
-      "--disable-alsa"
-      "--disable-pulseaudio"
+  postPatch = ''
+    rm -rf obj-x86_64-pc-linux-gnu
+  '';

-      "--with-system-jpeg"
-      "--with-system-zlib"
-      "--with-system-bz2"
-      "--with-system-nspr"
-      "--with-system-nss"
-      "--with-system-libevent"
-      "--with-system-png" # needs APNG support
-      "--with-system-icu"
-      #"--enable-rust-simd" # not supported since rustc 1.32.0 -> 1.33.0; TODO: probably OK since 68.0.0
-      "--enable-system-ffi"
-      "--enable-system-pixman"
-      "--enable-system-sqlite"
-      #"--enable-system-cairo"
-      "--enable-startup-notification"
-      "--disable-crashreporter"
-      "--disable-tests"
-      "--disable-necko-wifi" # maybe we want to enable this at some point
-      "--disable-updater"
-      "--enable-jemalloc"
-      "--disable-gconf"
-      "--enable-default-toolkit=cairo-gtk${if enableGTK3 then "3" else "2"}"
-      "--enable-js-shell"
-    ]
-      ++ lib.optional enableCalendar "--enable-calendar"
-      ++ (if debugBuild then [ "--enable-debug" "--enable-profiling"]
-                        else [ "--disable-debug" "--enable-release"
-                               "--disable-debug-symbols"
-                               "--enable-optimize" "--enable-strip" ])
-      ++ lib.optional enableOfficialBranding "--enable-official-branding"
-      ++ lib.optionals (lib.versionAtLeast version "56" && !stdenv.hostPlatform.isi686) [
-        # on i686-linux: --with-libclang-path is not available in this configuration
-        "--with-libclang-path=${llvmPackages.libclang}/lib"
-        "--with-clang-path=${llvmPackages.clang}/bin/clang"
-      ];
+  preConfigure = ''
+    # remove distributed configuration files
+    rm -f configure
+    rm -f js/src/configure
+    rm -f .mozconfig*
+
+    configureScript="$(realpath ./mach) configure"
+    # AS=as in the environment causes build failure https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
+    unset AS
+
+    export MOZCONFIG=$(pwd)/mozconfig
+
+    # Set C flags for Rust's bindgen program. Unlike ordinary C
+    # compilation, bindgen does not invoke $CC directly. Instead it
+    # uses LLVM's libclang. To make sure all necessary flags are
+    # included we need to look in a few places.
+    # TODO: generalize this process for other use-cases.
+
+    BINDGEN_CFLAGS="$(< ${stdenv.cc}/nix-support/libc-cflags) \
+      $(< ${stdenv.cc}/nix-support/cc-cflags) \
+      ${stdenv.cc.default_cxx_stdlib_compile} \
+      ${
+        lib.optionalString stdenv.cc.isClang
+        "-idirafter ${stdenv.cc.cc}/lib/clang/${
+          lib.getVersion stdenv.cc.cc
+        }/include"
+      } \
+      ${
+        lib.optionalString stdenv.cc.isGNU
+        "-isystem ${stdenv.cc.cc}/include/c++/${
+          lib.getVersion stdenv.cc.cc
+        } -isystem ${stdenv.cc.cc}/include/c++/${
+          lib.getVersion stdenv.cc.cc
+        }/$(cc -dumpmachine)"
+      } \
+      $NIX_CFLAGS_COMPILE"
+
+    echo "ac_add_options BINDGEN_CFLAGS='$BINDGEN_CFLAGS'" >> $MOZCONFIG
+  '';
+
+  configureFlags = let
+    toolkitSlug = if gtk3Support then
+      "3${lib.optionalString waylandSupport "-wayland"}"
+    else
+      "2";
+    toolkitValue = "cairo-gtk${toolkitSlug}";
+  in [
+    "--enable-application=comm/mail"
+
+    "--with-system-bz2"
+    "--with-system-icu"
+    "--with-system-jpeg"
+    "--with-system-libevent"
+    "--with-system-nspr"
+    "--with-system-nss"
+    "--with-system-png" # needs APNG support
+    "--with-system-icu"
+    "--with-system-zlib"
+    "--with-system-webp"
+    "--with-system-libvpx"
+
+    "--enable-rust-simd"
+    "--enable-crashreporter"
+    "--enable-default-toolkit=${toolkitValue}"
+    "--enable-js-shell"
+    "--enable-necko-wifi"
+    "--enable-startup-notification"
+    "--enable-system-ffi"
+    "--enable-system-pixman"
+    "--enable-system-sqlite"
+
+    "--disable-gconf"
+    "--disable-tests"
+    "--disable-updater"
+    "--enable-jemalloc"
+  ] ++ (if debugBuild then [
+    "--enable-debug"
+    "--enable-profiling"
+  ] else [
+    "--disable-debug"
+    "--enable-release"
+    "--disable-debug-symbols"
+    "--enable-optimize"
+    "--enable-strip"
+  ]) ++ lib.optionals (!stdenv.hostPlatform.isi686) [
+    # on i686-linux: --with-libclang-path is not available in this configuration
+    "--with-libclang-path=${llvmPackages.libclang}/lib"
+    "--with-clang-path=${llvmPackages.clang}/bin/clang"
+  ] ++ lib.optional alsaSupport "--enable-alsa"
+  ++ lib.optional calendarSupport "--enable-calendar"
+  ++ lib.optional enableOfficialBranding "--enable-official-branding"
+  ++ lib.optional pulseaudioSupport "--enable-pulseaudio";

  enableParallelBuilding = true;

-  preConfigure =
-    ''
-      cxxLib=$( echo -n ${gcc}/include/c++/* )
-      archLib=$cxxLib/$( ${gcc}/bin/gcc -dumpmachine )
+  postConfigure = ''
+    cd obj-*
+  '';

-      test -f layout/style/ServoBindings.toml && sed -i -e '/"-DRUST_BINDGEN"/ a , "-cxx-isystem", "'$cxxLib'", "-isystem", "'$archLib'"' layout/style/ServoBindings.toml
+  makeFlags = lib.optionals enableOfficialBranding [
+    "MOZILLA_OFFICIAL=1"
+    "BUILD_OFFICIAL=1"
+  ];

-      configureScript="$(realpath ./configure)"
-      mkdir ../objdir
-      cd ../objdir
+  doCheck = false;

-      # AS=as in the environment causes build failure https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
-      unset AS
-    '';
+  postInstall = let
+    desktopItem = makeDesktopItem {
+      categories = lib.concatStringsSep ";" [ "Application" "Network" ];
+      desktopName = "Thunderbird";
+      genericName = "Mail Reader";
+      name = "thunderbird";
+      exec = "thunderbird %U";
+      icon = "$out/lib/thunderbird/chrome/icons/default/default256.png";
+      mimeType = lib.concatStringsSep ";" [
+        # Email
+        "x-scheme-handler/mailto"
+        "message/rfc822"
+        # Feeds
+        "x-scheme-handler/feed"
+        "application/rss+xml"
+        "application/x-extension-rss"
+        # Newsgroups
+        "x-scheme-handler/news"
+        "x-scheme-handler/snews"
+        "x-scheme-handler/nntp"
+      ];
+    };
+  in ''
+    # TODO: Move to a dev output?
+    rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl

-  dontWrapGApps = true; # we do it ourselves
-  postInstall =
-    ''
-      # TODO: Move to a dev output?
-      rm -rf $out/include $out/lib/thunderbird-devel-* $out/share/idl
+    ${desktopItem.buildCommand}
+  '';

-      # $binary is a symlink to $target.
-      # We wrap $target by replacing the $binary symlink.
-      local target="$out/lib/thunderbird/thunderbird"
-      local binary="$out/bin/thunderbird"
+  preFixup = ''
+    # Needed to find Mozilla runtime
+    gappsWrapperArgs+=(
+      --argv0 "$out/bin/thunderbird"
+      --set MOZ_APP_LAUNCHER thunderbird
+      # https://github.com/NixOS/nixpkgs/pull/61980
+      --set SNAP_NAME "thunderbird"
+      --set MOZ_LEGACY_PROFILES 1
+      --set MOZ_ALLOW_DOWNGRADE 1
+    )
+  '';

-      # Wrap correctly, this is needed to
-      # 1) find Mozilla runtime, because argv0 must be the real thing,
-      #    or a symlink thereto. It cannot be the wrapper itself
-      # 2) detect itself as the default mailreader across builds
-      gappsWrapperArgs+=(
-        --argv0 "$target"
-        --set MOZ_APP_LAUNCHER thunderbird
-        # See commit 87e261843c4236c541ee0113988286f77d2fa1ee
-        --set MOZ_LEGACY_PROFILES 1
-        --set MOZ_ALLOW_DOWNGRADE 1
-        # https://github.com/NixOS/nixpkgs/pull/61980
-        --set SNAP_NAME "thunderbird"
-      )
-      ${
-        # We wrap manually because wrapGAppsHook does not detect the symlink
-        # To mimic wrapGAppsHook, we run it with dontWrapGApps, so
-        # gappsWrapperArgs gets defined correctly
-        lib.optionalString enableGTK3 "wrapGAppsHook"
-      }
-
-      # "$binary" is a symlink, replace it by the wrapper
-      rm "$binary"
-      makeWrapper "$target" "$binary" "''${gappsWrapperArgs[@]}"
-
-      ${ let desktopItem = makeDesktopItem {
-          name = "thunderbird";
-          exec = "thunderbird %U";
-          desktopName = "Thunderbird";
-          icon = "$out/lib/thunderbird/chrome/icons/default/default256.png";
-          genericName = "Mail Reader";
-          categories = "Application;Network";
-          mimeType = stdenv.lib.concatStringsSep ";" [
-            # Email
-            "x-scheme-handler/mailto"
-            "message/rfc822"
-            # Newsgroup
-            "x-scheme-handler/news"
-            "x-scheme-handler/snews"
-            "x-scheme-handler/nntp"
-            # Feed
-            "x-scheme-handler/feed"
-            "application/rss+xml"
-            "application/x-extension-rss"
-          ];
-        }; in desktopItem.buildCommand
-      }
-    '';
-
-  postFixup =
-    # Fix notifications. LibXUL uses dlopen for this, unfortunately; see #18712.
-    ''
-      patchelf --set-rpath "${lib.getLib libnotify
-        }/lib:$(patchelf --print-rpath "$out"/lib/thunderbird*/libxul.so)" \
-          "$out"/lib/thunderbird*/libxul.so
-    '';
+  # FIXME: This can probably be removed as soon as we package a
+  # Thunderbird >=71.0 since XUL shouldn't be anymore (in use)?
+  postFixup = ''
+    local xul="$out/lib/thunderbird/libxul.so"
+    patchelf --set-rpath "${libnotify}/lib:$(patchelf --print-rpath $xul)" $xul
+  '';

  doInstallCheck = true;
-  installCheckPhase =
-    ''
-      # Some basic testing
-      "$out/bin/thunderbird" --version
-    '';
+  installCheckPhase = ''
+    "$out/bin/thunderbird" --version
+  '';

-  disallowedRequisites = [ stdenv.cc ];
-
-  meta = with stdenv.lib; {
-    description = "A full-featured e-mail client";
-    homepage = http://www.mozilla.org/thunderbird/;
-    license =
-      # Official branding implies thunderbird name and logo cannot be reuse,
-      # see http://www.mozilla.org/foundation/licensing.html
-      if enableOfficialBranding then licenses.proprietary else licenses.mpl11;
-    maintainers = [ maintainers.pierron maintainers.eelco ];
-    platforms = platforms.linux;
-  };
+  disallowedRequisites = [
+    stdenv.cc
+  ];

  passthru.updateScript = import ./../../browsers/firefox/update.nix {
    attrPath = "thunderbird";
    baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
-    inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl runtimeShell;
+    inherit writeScript lib common-updater-scripts xidel coreutils gnused
+      gnugrep curl runtimeShell;
+  };
+
+  meta = with stdenv.lib; {
+    description = "A full-featured e-mail client";
+    homepage = "https://www.thunderbird.net";
+    maintainers = with maintainers; [
+      eelco
+      lovesegfault
+      pierron
+    ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "gnunet";
-  version = "0.11.6";
+  version = "0.11.8";

  src = fetchurl {
    url = "mirror://gnu/gnunet/${pname}-${version}.tar.gz";
-    sha256 = "1gspr1lh885sb9r2anh7bi4zan3zjqx33lpyhq9hm2g0n5ip187q";
+    sha256 = "1zkmcq75sfr3iyg8rgxp9dbl7fwsvc1a71rc0vgisghcbrx1n7yj";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@ -31,7 +31,10 @@ in stdenv.mkDerivation rec {
  version = "5.5.1";

  src = fetchurl {
-    url = "https://download.anydesk.com/linux/${pname}-${version}-${arch}.tar.gz";
+    urls = [
+      "https://download.anydesk.com/linux/${pname}-${version}-${arch}.tar.gz"
+      "https://download.anydesk.com/linux/generic-linux/${pname}-${version}-${arch}.tar.gz"
+    ];
    inherit sha256;
  };

--- a/pkgs/applications/office/flexibee/default.nix
+++ b/pkgs/applications/office/flexibee/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, makeWrapper, jre }:

 let
-  version = "2019.3.0.7";
+  version = "2019.3.1.1";
  majorVersion = builtins.substring 0 6 version;
 in

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://download.flexibee.eu/download/${majorVersion}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "01n2pkh17s2iab7n9xgq9vqcf1fnzmb382zmmd1lwyw3x57f5rq2";
+    sha256 = "0zlxbdwcb0xb0bx4nvj6dn0vpw21czgf196bjlkk1547j6146p1p";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/office/tryton/default.nix
+++ b/pkgs/applications/office/tryton/default.nix
@ -1,5 +1,5 @@
 { stdenv
-, python2Packages
+, python3Packages
 , pkgconfig
 , librsvg
 , gobject-introspection
@ -7,40 +7,59 @@
 , gtk3
 , gtkspell3
 , gnome3
+, glib
 , goocanvas2
+, gdk-pixbuf
+, pango
+, fontconfig
+, freetype
+, wrapGAppsHook
 }:

 with stdenv.lib;

-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "tryton";
-  version = "4.8.5";
-  src = python2Packages.fetchPypi {
+  version = "5.4.0";
+
+  disabled = !python3Packages.isPy3k;
+
+  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "43759d22b061a7a392a534d19a045fafd442ce98a0e390ee830127367dcaf4b4";
+    sha256 = "0wbq8y8z0n6c5b3h5ynlawn3z79a3hkb1fkmblz4pwnj0jfnbswd";
  };
-  nativeBuildInputs = [ pkgconfig gobject-introspection ];
-  propagatedBuildInputs = with python2Packages; [
-    chardet
+
+  nativeBuildInputs = [
+    pkgconfig
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
    dateutil
-    pygtk
-    librsvg
    pygobject3
    goocalendar
-    cdecimal
+    pycairo
  ];
+
  buildInputs = [
    atk
-    gtk3
+    gdk-pixbuf
+    glib
    gnome3.adwaita-icon-theme
-    gtkspell3
    goocanvas2
+    fontconfig
+    freetype
+    gtk3
+    gtkspell3
+    librsvg
+    pango
  ];
-  makeWrapperArgs = [
-    ''--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"''
-    ''--set GI_TYPELIB_PATH "$GI_TYPELIB_PATH"''
-    ''--suffix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"''
-  ];
+
+  strictDeps = false;
+
+  doCheck = false;
+
  meta = {
    description = "The client of the Tryton application platform";
    longDescription = ''
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -35,11 +35,11 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "5.0.77";
+  version = "5.0.80";

  src = fetchurl {
    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "1dgxzprpb8f5wpmvlvkxix0xxckfgjsi3wfcy9mb221a17cv0029";
+    sha256 = "0a5xjliml6rwxvi450l42iw6m9mk3aahnp90sr22jyijz9qii2al";
  };

  buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme dconf ];
--- a/pkgs/applications/radio/chirp/default.nix
+++ b/pkgs/applications/radio/chirp/default.nix
@ -1,31 +1,20 @@
-{ stdenv, fetchurl, libxml2Python, libxslt, makeWrapper
-, pyserial, pygtk }:
-
-stdenv.mkDerivation rec {
+{ stdenv
+, fetchurl
+, python2
+}:
+python2.pkgs.buildPythonApplication rec {
  pname = "chirp-daily";
-  version = "20190925";
+  version = "20191123";

  src = fetchurl {
    url = "https://trac.chirp.danplanet.com/chirp_daily/daily-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0immgss7nj7395r3csiypksnbn1r2f3j45c5v8qpybz65lpbplps";
+    sha256 = "11wzk0c9fa3gp185gyd47g3sh7gfallw7qapr6qp913q2zfmif8v";
  };

-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [
-    pyserial pygtk libxml2Python libxslt
+  propagatedBuildInputs = with python2.pkgs; [
+    pygtk pyserial libxml2
  ];

-  installPhase = ''
-    mkdir -p $out/bin $out/share/chirp
-    cp -r . $out/share/chirp/
-    ln -s $out/share/chirp/chirpw $out/bin/chirpw
-
-    for file in "$out"/bin/*; do
-      wrapProgram "$file" \
-        --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath "$out")
-    done
-  '';
-
  meta = with stdenv.lib; {
    description = "A free, open-source tool for programming your amateur radio";
    homepage = https://chirp.danplanet.com/;
--- a/pkgs/applications/radio/wsjtx/default.nix
+++ b/pkgs/applications/radio/wsjtx/default.nix
@ -4,12 +4,12 @@

 stdenv.mkDerivation rec {
  pname = "wsjtx";
-  version = "2.1.0";
+  version = "2.1.2";

  # This is a "superbuild" tarball containing both wsjtx and a hamlib fork
  src = fetchurl {
    url = "http://physics.princeton.edu/pulsar/k1jt/wsjtx-${version}.tgz";
-    sha256 = "04flhyfw0djnnbrzh3f5lx06bnn92khchz3bmswk8if8n8j58v4y";
+    sha256 = "0aj3wg5xjjqwjvw6lra171ag5wq86w0hf1ra4k8mnaf0mc1qgbyl";
  };

  # Hamlib builds with autotools, wsjtx builds with cmake
--- a/pkgs/applications/science/biology/bedtools/default.nix
+++ b/pkgs/applications/science/biology/bedtools/default.nix
@ -2,19 +2,20 @@

 stdenv.mkDerivation rec {
  pname = "bedtools";
-  version = "2.29.0";
+  version = "2.29.1";

  src = fetchFromGitHub {
    owner = "arq5x";
    repo = "bedtools2";
    rev = "v${version}";
-    sha256 = "0d6i985qqxp92ddq4n6558m70qi5rqhl724wrfys0hm0p6a9h56x";
+    sha256 = "1vbpjvzl4ppzkan9qgm84bkn9kl3h3m5xz92y18wn1sksxcdq50x";
  };

  buildInputs = [ zlib python bzip2 lzma ];
-  cc = if stdenv.cc.isClang then "clang++" else "g++";
-  buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cc} -j $NIX_BUILD_CORES";
-  installPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cc} install";
+  cxx = if stdenv.cc.isClang then "clang++" else "g++";
+  cc = if stdenv.cc.isClang then "clang" else "gcc";
+  buildPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} -j $NIX_BUILD_CORES";
+  installPhase = "make prefix=$out SHELL=${stdenv.shell} CXX=${cxx} CC=${cc} install";

  meta = with stdenv.lib; {
    description = "A powerful toolset for genome arithmetic.";
--- a/pkgs/applications/science/logic/boolector/default.nix
+++ b/pkgs/applications/science/logic/boolector/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, fetchpatch
 , cmake, lingeling, btor2tools
 }:

@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
    sha256 = "15i3ni5klss423m57wcy1gx0m5wfrjmglapwg85pm7fb3jj1y7sz";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-7560.patch";
+      url = "https://github.com/Boolector/boolector/commit/8d979d02e0482c7137c9f3a34e6d430dbfd1f5c5.patch";
+      sha256 = "1a1g02mk8b0azzjcigdn5zpshn0dn05fciwi8sd5q38yxvnvpbbi";
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];
  buildInputs = [ lingeling btor2tools ];

--- a/pkgs/applications/science/logic/btor2tools/default.nix
+++ b/pkgs/applications/science/logic/btor2tools/default.nix
@ -24,8 +24,8 @@ stdenv.mkDerivation {
  outputs = [ "out" "dev" "lib" ];

  meta = with stdenv.lib; {
-    description = "Fast SAT solver";
-    homepage    = http://fmv.jku.at/lingeling/;
+    description = "A generic parser and tool package for the BTOR2 format";
+    homepage    = "https://github.com/Boolector/btor2tools";
    license     = licenses.mit;
    platforms   = platforms.linux;
    maintainers = with maintainers; [ thoughtpolice ];
--- a/pkgs/applications/version-management/diffuse/default.nix
+++ b/pkgs/applications/version-management/diffuse/default.nix
@ -1,33 +0,0 @@
-{ stdenv, fetchurl, python27Packages, makeWrapper }:
-
-let
-  inherit (python27Packages) pygtk python;
-in stdenv.mkDerivation rec {
-  version = "0.4.8";
-  pname = "diffuse";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/diffuse/diffuse/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "0ayz8bywmk1z3zicb0a7hbxliqpc7xym60s0mawzqllkpadvgly1";
-  };
-
-  buildInputs = [ python pygtk makeWrapper ];
-
-  buildPhase = ''
-    python ./install.py --prefix="$out" --sysconfdir="$out/etc" --pythonbin="${python}/bin/python"
-    wrapProgram "$out/bin/diffuse" --prefix PYTHONPATH : $PYTHONPATH:${pygtk}/lib/${python.libPrefix}/site-packages/gtk-2.0
-  '';
-
-  # no-op, everything is done in buildPhase
-  installPhase = "true";
-
-  # NOTE: diffuse installs a .desktop file itself
-
-  meta = with stdenv.lib; {
-    description = "Graphical diff and merge tool";
-    homepage = http://diffuse.sourceforge.net/;
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
-  };
-}
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.24.0";
+  version = "2.24.1";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -33,7 +33,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "06rpakbwzck85ncfsgv4xmq3iwab9d4f5y6dqhl8nvb2fccxcwcz";
+    sha256 = "0ql5z31vgl7b785gwrf00m129mg7zi9pa65n12ij3mpxx3f28gvj";
  };

  outputs = [ "out" ];
@ -230,6 +230,7 @@ stdenv.mkDerivation {
                -e "s|exec wish|exec '${tk}/bin/wish'|g" \
                "$out/$prog"
       done
+       ln -s $out/share/git/contrib/completion/git-completion.bash $out/share/bash-completion/completions/gitk
     '' else ''
       # Don't wrap Tcl/Tk, replace them by notification scripts
       for prog in bin/gitk libexec/git-core/git-gui; do
--- a/pkgs/applications/version-management/git-and-tools/lab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lab/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "lab";
-  version = "0.16.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "zaquestion";
    repo = "lab";
    rev = "v${version}";
-    sha256 = "0f1gi4mlcxjvz2sgh0hzzsqxg5gfvq2ay7xjd0y1kz3pp8kxja7i";
+    sha256 = "1p8q21k8p1zw1g4fn6f7b80r3wziywbm1av1vg7hc8w1rfqj51wp";
  };

  subPackages = [ "." ];

-  modSha256 = "0bw47dd1b46ywsian2b957a4ipm77ncidipzri9ra39paqlv7abb";
+  modSha256 = "1cwj7p03j2bglj379h4hb25kxayx07msz0mnqwwbjv5i3zkc6kkg";

  postInstall = ''
    mkdir -p "$out/share/bash-completion/completions" "$out/share/zsh/site-functions"
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,9 +1,9 @@
 {
-  "version": "12.5.3",
-  "repo_hash": "1q76yhg4ygs9w5hb8hbv1908d5pfqzr8idmjp06pa4dw5qqqkv97",
+  "version": "12.5.4",
+  "repo_hash": "08jngv83pvxjyw3iaqzv484v4mwgwnzg9am3iqfidl9ihbm7i4h2",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v12.5.3-ee",
+  "rev": "v12.5.4-ee",
  "passthru": {
    "GITALY_SERVER_VERSION": "1.72.1",
    "GITLAB_PAGES_VERSION": "1.12.0",
--- a/pkgs/applications/video/key-mon/default.nix
+++ b/pkgs/applications/video/key-mon/default.nix
@ -1,28 +0,0 @@
-{ stdenv, fetchurl, gnome2, librsvg, pythonPackages }:
-
-pythonPackages.buildPythonApplication rec {
-  pname = "key-mon";
-  version = "1.17";
-  namePrefix = "";
-
-  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/key-mon/${pname}-${version}.tar.gz";
-    sha256 = "1liz0dxcqmchbnl1xhlxkqm3gh76wz9jxdxn9pa7dy77fnrjkl5q";
-  };
-
-  propagatedBuildInputs =
-    [ gnome2.python_rsvg librsvg pythonPackages.pygtk pythonPackages.xlib ];
-
-  doCheck = false;
-
-  preFixup = ''
-      export makeWrapperArgs="--set GDK_PIXBUF_MODULE_FILE $GDK_PIXBUF_MODULE_FILE"
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://code.google.com/archive/p/key-mon;
-    description = "Utility to show live keyboard and mouse status for teaching and screencasts";
-    license = licenses.asl20;
-    maintainers = [ maintainers.goibhniu ];
-  };
-}
--- a/pkgs/applications/video/recordmydesktop/default.nix
+++ b/pkgs/applications/video/recordmydesktop/default.nix
@ -1,29 +0,0 @@
-{ stdenv, fetchsvn, autoreconfHook, zlib, popt, alsaLib, libvorbis, libtheora
-, libICE, libSM, libX11, libXext, libXfixes, libXdamage }:
-
-stdenv.mkDerivation rec {
-  pname = "recordmydesktop";
-  version = "0.3.8.1-svn${rev}";
-  rev = "602";
-
-  src = fetchsvn {
-    url = https://recordmydesktop.svn.sourceforge.net/svnroot/recordmydesktop/trunk/recordmydesktop;
-    inherit rev;
-    sha256 = "1avirkc4ymrd575m616pi6wpgq1i0r5sb3qahps1g18sjpxks0lf";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-
-  buildInputs = [
-    zlib popt alsaLib libICE libSM libX11 libXext
-    libXfixes libXdamage libvorbis libtheora
-  ];
-
-  meta = with stdenv.lib; {
-    description = "Desktop session recorder";
-    homepage = http://recordmydesktop.sourceforge.net/;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/applications/video/recordmydesktop/gtk.nix
+++ b/pkgs/applications/video/recordmydesktop/gtk.nix
@ -1,37 +0,0 @@
-{ stdenv, lib, fetchsvn, recordmydesktop, autoreconfHook, pkgconfig
-, pythonPackages, jack2, xwininfo }:
-
-let
-  binPath = lib.makeBinPath [ recordmydesktop jack2 xwininfo ];
-
-in stdenv.mkDerivation {
-  pname = "gtk-recordmydesktop";
-  version = "0.3.8-svn${recordmydesktop.rev}";
-
-  src = fetchsvn {
-    url = https://recordmydesktop.svn.sourceforge.net/svnroot/recordmydesktop/trunk/gtk-recordmydesktop;
-    inherit (recordmydesktop) rev;
-    sha256 = "010aykgjfxhyiixq9a9fg3p1a1ixz59m1vkn16hpy0lybgf4dsby";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-
-  buildInputs = with pythonPackages; [
-    python pygtk wrapPython
-  ];
-
-  pythonPath = with pythonPackages; [ pygtk ];
-
-  postInstall = ''
-    makeWrapperArgs="--prefix PATH : ${binPath}"
-    wrapPythonPrograms
-  '';
-
-  meta = with stdenv.lib; {
-    description = "GTK frontend for recordmydesktop";
-    homepage = http://recordmydesktop.sourceforge.net/;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/applications/video/recordmydesktop/qt.nix
+++ b/pkgs/applications/video/recordmydesktop/qt.nix
@ -1,37 +0,0 @@
-{ stdenv, lib, fetchsvn, recordmydesktop, autoreconfHook, pkgconfig
-, glib, pythonPackages, qt4, jack2, xwininfo }:
-
-let
-  binPath = lib.makeBinPath [ recordmydesktop jack2 xwininfo ];
-
-in stdenv.mkDerivation {
-  pname = "qt-recordmydesktop";
-  version = "0.3.8-svn${recordmydesktop.rev}";
-
-  src = fetchsvn {
-    url = https://recordmydesktop.svn.sourceforge.net/svnroot/recordmydesktop/trunk/qt-recordmydesktop;
-    inherit (recordmydesktop) rev;
-    sha256 = "0vz7amrmz317sbx2cv2186d0r57as4l26xa9rpim5gbvzk20caqc";
-  };
-
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
-
-  buildInputs = [ glib qt4 ] ++ (with pythonPackages; [
-    python wrapPython pyqt4
-  ]);
-
-  pythonPath = with pythonPackages; [ pyqt4 ];
-
-  postInstall = ''
-    makeWrapperArgs="--prefix PATH : ${binPath}"
-    wrapPythonPrograms
-  '';
-
-  meta = with stdenv.lib; {
-    description = "GTK frontend for recordmydesktop";
-    homepage = http://recordmydesktop.sourceforge.net/;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@ -9,13 +9,13 @@
 stdenv.mkDerivation rec {
  project = "conmon";
  name = "${project}-${version}";
-  version = "2.0.4";
+  version = "2.0.6";

  src = fetchFromGitHub {
    owner = "containers";
    repo = project;
    rev = "v${version}";
-    sha256 = "1qma778h5fdvyf53ck8qr606aaf4f8msddb7pv5pgn1bywpcxs38";
+    sha256 = "0h0cfpay296pbz0912aifhbq6g6imarpa22rkm8fdipwkqhhdidz";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -2,7 +2,7 @@
 , libX11, xorgproto, libXext, libXcursor, libXmu, libIDL, SDL, libcap, libGL
 , libpng, glib, lvm2, libXrandr, libXinerama, libopus, qtbase, qtx11extras
 , qttools, qtsvg, qtwayland, pkgconfig, which, docbook_xsl, docbook_xml_dtd_43
-, alsaLib, curl, libvpx, nettools, dbus, substituteAll
+, alsaLib, curl, libvpx, nettools, dbus, substituteAll, fetchpatch
 , makeself, perl
 , javaBindings ? true, jdk ? null # Almost doesn't affect closure size
 , pythonBindings ? false, python3 ? null
@ -21,8 +21,8 @@ let
  buildType = "release";
  # Remember to change the extpackRev and version in extpack.nix and
  # guest-additions/default.nix as well.
-  main = "1hxbvr78b0fddcn7npz72ki89lpmbgqj4b5qvxm1wik7v0d8v1y8";
-  version = "6.0.12";
+  main = "036x2mvkk22lbg72cz6pik9z538j1ag6mmwjjmfikgrq1i7v24jy";
+  version = "6.0.14";
 in stdenv.mkDerivation {
  pname = "virtualbox";
  inherit version;
@ -92,9 +92,26 @@ in stdenv.mkDerivation {
    })
  ++ [
    ./qtx11extras.patch
-    # Kernel 5.3 fix, should be fixed with VirtualBox 6.0.14
-    # https://www.virtualbox.org/ticket/18911
-    ./kernel-5.3-fix.patch
+    # Kernel 5.4 fix, should be fixed with next upstream release
+    # https://www.virtualbox.org/ticket/18945
+    (fetchpatch {
+      name = "kernel-5.4-fix-1.patch";
+      url = "https://www.virtualbox.org/changeset/81586/vbox?format=diff";
+      sha256 = "0zbkc9v65pkdmjik53x29g39qyf7narkhpwpx5n1n1bfqnhf0k1r";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "kernel-5.4-fix-2.patch";
+      url = "https://www.virtualbox.org/changeset/81587/vbox?format=diff";
+      sha256 = "1j98cqxj8qlqwaqr4mvwwbkmchw8jmygjwgzz82gix7fj76j2y9c";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      name = "kernel-5.4-fix-3.patch";
+      url = "https://www.virtualbox.org/changeset/81649/vbox?format=diff";
+      sha256 = "1d6p5k5dgzmjglqfkbcbvpn1x3wxila30q4gcbb7pxwfgclaw2hk";
+      stripLen = 1;
+    })
  ];

  postPatch = ''
--- a/pkgs/applications/virtualization/virtualbox/extpack.nix
+++ b/pkgs/applications/virtualization/virtualbox/extpack.nix
@ -2,7 +2,7 @@

 with lib;

-let version = "6.0.12";
+let version = "6.0.14";
 in
 fetchurl rec {
  name = "Oracle_VM_VirtualBox_Extension_Pack-${version}.vbox-extpack";
@ -11,7 +11,7 @@ fetchurl rec {
    # Manually sha256sum the extensionPack file, must be hex!
    # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
    # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
-    let value = "27a0956940654b0accf4d79692078bd496d9f062e4ed3da69e5421cba8d1e444";
+    let value = "c8a5cc980c9c94cdac3d94e23cf159c2433aae76b416dbfb5b1a918758f21e63";
    in assert (builtins.stringLength value) == 64; value;

  meta = {
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchurl, lib, patchelf, cdrkit, kernel, which, makeWrapper
-, zlib, xorg, dbus, virtualbox, dos2unix }:
+, zlib, xorg, dbus, virtualbox, dos2unix, fetchpatch, findutils, patchutils }:

 let
  version = virtualbox.version;
@ -21,12 +21,12 @@ let
    { name = "libXfixes.so"; pkg = xorg.libXfixes; }
  ];

-in stdenv.mkDerivation {
+in stdenv.mkDerivation rec {
  name = "VirtualBox-GuestAdditions-${version}-${kernel.version}";

  src = fetchurl {
    url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-    sha256 = "0hflsbx70dli34mpx94vd33p55ycfs3ahzwcdzqxdiwiiskjpykq";
+    sha256 = "1c9ysx0fhxxginmp607b4fk74dvlr32n6w52gawm06prf4xg90nb";
  };

  KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
@ -43,13 +43,67 @@ in stdenv.mkDerivation {
  prePatch = ''
    substituteInPlace src/vboxguest-${version}/vboxvideo/vbox_ttm.c \
      --replace "<ttm/" "<drm/ttm/"
-    ${dos2unix}/bin/dos2unix src/vboxguest-${version}/vboxguest/r0drv/linux/mp-r0drv-linux.c
+    
+    echo ${lib.escapeShellArgs patches} | \
+      ${findutils}/bin/xargs -n1 ${patchutils}/bin/lsdiff --strip=1 --addprefix=src/vboxguest-${version}/ | \
+      ${findutils}/bin/xargs ${dos2unix}/bin/dos2unix
  '';

  patchFlags = [ "-p1" "-d" "src/vboxguest-${version}" ];
-  # Kernel 5.3 fix, should be fixed with VirtualBox 6.0.14
-  # https://www.virtualbox.org/ticket/18911
-  patches = [ ./kernel-5.3-fix.patch ];
+  # Kernel 5.4 fix, should be fixed with next upstream release
+  # https://www.virtualbox.org/ticket/18945
+  patches = lib.concatLists (lib.mapAttrsToList (changeset: args:
+    map (arg:
+      fetchpatch ({
+        name = "kernel-5.4-fix-${changeset}.patch";
+        url = "https://www.virtualbox.org/changeset/${changeset}/vbox?format=diff";
+      } // arg)) args) {
+        "81586" = [{
+          sha256 = "126z67x6vy65w6jlqbh4z4f1cffxnycwb69vns0154bawbsbxsiw";
+          stripLen = 5;
+          extraPrefix = "vboxguest/";
+        }];
+        "81587" = [
+          {
+            sha256 = "0simzswnl0wvnc2i9gixz99rfc7lxk1nrnskksrlrrl9hqnh0lva";
+            stripLen = 5;
+            extraPrefix = "vboxsf/";
+            includes = [ "*/the-linux-kernel.h" ];
+          }
+          {
+            sha256 = "0a8r9h3x3lcjq2fykgqhdaykp00rnnkbxz8xnxg847zgvca15y02";
+            stripLen = 5;
+            extraPrefix = "vboxguest/";
+            includes = [ "*/the-linux-kernel.h" ];
+          }
+        ];
+        "81649" = [
+          {
+            sha256 = "1p1skxlvqigydxr4sk7w51lpk7nxg0d9lppq39sdnfmgi1z0h0sc";
+            stripLen = 2;
+            extraPrefix = "vboxguest/";
+            includes = [ "*/cdefs.h" ];
+          }
+          {
+            sha256 = "1j060ggdnndyjdhkfvs15306gl7g932sim9xjmx2mnx8gjdmg37f";
+            stripLen = 2;
+            extraPrefix = "vboxsf/";
+            includes = [ "*/cdefs.h" ];
+          }
+          {
+            sha256 = "060h3a5k2yklbvlg0hyg4x87xrg37cvv3rjb67xizlwvlyy6ykkg";
+            stripLen = 5;
+            extraPrefix = "vboxguest/";
+            includes = [ "*/thread2-r0drv-linux.c" ];
+          }
+          {
+            sha256 = "0cxlkf7cy751gl8dgzr7vkims1kmx5pgzsrxyk8w18zyp5nk9glw";
+            stripLen = 7;
+            extraPrefix = "vboxvideo/";
+            includes = [ "*/vbox_*.c" ];
+          }
+        ];
+      });

  unpackPhase = ''
    ${if stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux" then ''
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/kernel-5.3-fix.patch
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/kernel-5.3-fix.patch
@ -1,50 +0,0 @@
--- a/vboxguest/r0drv/linux/mp-r0drv-linux.c
-+++ a/vboxguest/r0drv/linux/mp-r0drv-linux.c
-@@ -283,12 +283,15 @@
-     if (RTCpuSetCount(&OnlineSet) > 1)
-     {
-         /* Fire the function on all other CPUs without waiting for completion. */
-# if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
-+        smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* wait */);
-+# elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-         int rc = smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* wait */);
-+        Assert(!rc); NOREF(rc);
- # else
-         int rc = smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* retry */, 0 /* wait */);
-# endif
-         Assert(!rc); NOREF(rc);
-+# endif
-     }
- #endif
-
-@@ -326,7 +329,6 @@
- {
- #ifdef CONFIG_SMP
-     IPRT_LINUX_SAVE_EFL_AC();
-    int rc;
-     RTMPARGS Args;
-
-     RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
-@@ -337,14 +339,17 @@
-     Args.cHits = 0;
-
-     RTThreadPreemptDisable(&PreemptState);
-# if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-    rc = smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
-+    smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
-+# elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-+    int rc = smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
-+    Assert(rc == 0); NOREF(rc);
- # else /* older kernels */
-    rc = smp_call_function(rtmpLinuxWrapper, &Args, 0 /* retry */, 1 /* wait */);
-+    int rc = smp_call_function(rtmpLinuxWrapper, &Args, 0 /* retry */, 1 /* wait */);
-+    Assert(rc == 0); NOREF(rc);
- # endif /* older kernels */
-     RTThreadPreemptRestore(&PreemptState);
-
-    Assert(rc == 0); NOREF(rc);
-     IPRT_LINUX_RESTORE_EFL_AC();
- #else
-     RT_NOREF(pfnWorker, pvUser1, pvUser2);
--- a/pkgs/applications/virtualization/virtualbox/kernel-5.3-fix.patch
+++ b/pkgs/applications/virtualization/virtualbox/kernel-5.3-fix.patch
@ -1,72 +0,0 @@
--- a/src/VBox/HostDrivers/VBoxNetFlt/linux/VBoxNetFlt-linux.c
-+++ b/src/VBox/HostDrivers/VBoxNetFlt/linux/VBoxNetFlt-linux.c
-@@ -2123,7 +2123,9 @@
- #endif
-     if (in_dev != NULL)
-     {
-        for_ifa(in_dev) {
-+        struct in_ifaddr *ifa;
-+
-+        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
-             if (VBOX_IPV4_IS_LOOPBACK(ifa->ifa_address))
-                 return NOTIFY_OK;
-
-@@ -2137,7 +2139,7 @@
-
-             pThis->pSwitchPort->pfnNotifyHostAddress(pThis->pSwitchPort,
-                 /* :fAdded */ true, kIntNetAddrType_IPv4, &ifa->ifa_address);
-        } endfor_ifa(in_dev);
-+        }
-     }
-
-     /*
--- a/src/VBox/Runtime/r0drv/linux/mp-r0drv-linux.c
-+++ a/src/VBox/Runtime/r0drv/linux/mp-r0drv-linux.c
-@@ -283,12 +283,15 @@
-     if (RTCpuSetCount(&OnlineSet) > 1)
-     {
-         /* Fire the function on all other CPUs without waiting for completion. */
-# if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
-+        smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* wait */);
-+# elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-         int rc = smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* wait */);
-+        Assert(!rc); NOREF(rc);
- # else
-         int rc = smp_call_function(rtmpLinuxAllWrapper, &Args, 0 /* retry */, 0 /* wait */);
-# endif
-         Assert(!rc); NOREF(rc);
-+# endif
-     }
- #endif
-
-@@ -326,7 +329,6 @@
- {
- #ifdef CONFIG_SMP
-     IPRT_LINUX_SAVE_EFL_AC();
-    int rc;
-     RTMPARGS Args;
-
-     RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
-@@ -337,14 +339,17 @@
-     Args.cHits = 0;
-
-     RTThreadPreemptDisable(&PreemptState);
-# if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-    rc = smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
-+    smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
-+# elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
-+    int rc = smp_call_function(rtmpLinuxWrapper, &Args, 1 /* wait */);
-+    Assert(rc == 0); NOREF(rc);
- # else /* older kernels */
-    rc = smp_call_function(rtmpLinuxWrapper, &Args, 0 /* retry */, 1 /* wait */);
-+    int rc = smp_call_function(rtmpLinuxWrapper, &Args, 0 /* retry */, 1 /* wait */);
-+    Assert(rc == 0); NOREF(rc);
- # endif /* older kernels */
-     RTThreadPreemptRestore(&PreemptState);
-
-    Assert(rc == 0); NOREF(rc);
-     IPRT_LINUX_RESTORE_EFL_AC();
- #else
-     RT_NOREF(pfnWorker, pvUser1, pvUser2);
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3status-rust";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "greshake";
    repo = pname;
    rev = "v${version}";
-    sha256 = "15083nagd0kzpkay5jxcq5i16yvybd4sh03g9x4q9xq4cy0qwj11";
+    sha256 = "1banaiqj4gdsg886kb7l1fxhmf33vxnwwha46397s7gwfxkvxz4n";
  };

  cargoSha256 = "1cbx2jll0bj547dvwzjprzidndbqn1c4c6hmbfgjgdkxmmrpb0r1";
--- a/pkgs/build-support/kernel/modules-closure.sh
+++ b/pkgs/build-support/kernel/modules-closure.sh
@ -56,4 +56,12 @@ for module in $closure; do
    done
 done

+# copy module ordering hints for depmod
+cp $kernel/lib/modules/"$version"/modules.order $out/lib/modules/"$version"/.
+cp $kernel/lib/modules/"$version"/modules.builtin $out/lib/modules/"$version"/.
+
 depmod -b $out -a $version
+
+# remove original hints from final derivation
+rm $out/lib/modules/"$version"/modules.order
+rm $out/lib/modules/"$version"/modules.builtin
--- a/pkgs/data/themes/sweet/default.nix
+++ b/pkgs/data/themes/sweet/default.nix
@ -0,0 +1,47 @@
+{ stdenv, fetchurl, unzip }:
+
+stdenv.mkDerivation rec {
+  pname = "sweet";
+  version = "1.10.5";
+
+  srcs = [
+    (fetchurl {
+      url = "https://github.com/EliverLara/Sweet/releases/download/v${version}/Sweet-Ambar-Blue.zip";
+      sha256 = "11040hx8ci4vbnyaj63zj924v0ln7rjm9a28mcqdax60h3dp12lj";
+    })
+    (fetchurl {
+      url = "https://github.com/EliverLara/Sweet/releases/download/v${version}/Sweet-Ambar.zip";
+      sha256 = "0lvnjmirpwdav8q0bfbhybwkr2h6dilc7lhhj18xd2k57xadjmxr";
+    })
+    (fetchurl {
+      url = "https://github.com/EliverLara/Sweet/releases/download/v${version}/Sweet-Dark.zip";
+      sha256 = "0a7mh1pgvi8w1ahsmvgnmpdawm30lcjqk4zqvg0lqadsd04dn4h1";
+    })
+    (fetchurl {
+      url = "https://github.com/EliverLara/Sweet/releases/download/v${version}/Sweet-mars.zip";
+      sha256 = "0n2dkl35qrik10wvhvkayyra987p03g56pxhz5kc73cbsl5zd96l";
+    })
+    (fetchurl {
+      url = "https://github.com/EliverLara/Sweet/releases/download/v${version}/Sweet.zip";
+      sha256 = "0wwmc3wj2pjg4kimfkvcsimk3s4s7l7k000vxqi8yjlfs70f273c";
+    })
+  ];
+
+  nativeBuildInputs = [ unzip ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/share/themes/
+    cp -a Sweet* $out/share/themes/
+    rm $out/share/themes/*/{LICENSE,README*}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Light and dark colorful Gtk3.20+ theme";
+    homepage = "https://github.com/EliverLara/Sweet";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ fuzen ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/desktops/gnome-3/apps/evolution/default.nix
+++ b/pkgs/desktops/gnome-3/apps/evolution/default.nix
@ -43,11 +43,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution";
-  version = "3.34.1";
+  version = "3.34.2";

  src = fetchurl {
    url = "mirror://gnome/sources/evolution/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0hmxz3b9paqlpfjpqn379a8c01z3gb8lz0jgxxpgn6iygzfr4sk5";
+    sha256 = "164vy8h432pjglafn8y2ms4gsvk3kbgc63h5qp0mk5dv4smsp29c";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-desktop/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-desktop";
-  version = "3.34.1";
+  version = "3.34.2";

  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-desktop/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0nnwc837k244gjsmx8wff5sfvm8xnhm8xr39qxk73lnscrbfpny1";
+    sha256 = "1v983xirwp1y6ggz97bh742ak6gff0hxb359dgn37nikjxhvm0a0";
  };

  nativeBuildInputs = [
--- a/pkgs/development/chez-modules/chez-matchable/default.nix
+++ b/pkgs/development/chez-modules/chez-matchable/default.nix
@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, chez }:
+
+stdenv.mkDerivation rec {
+  pname = "chez-matchable";
+  version = "20160306";
+
+  src = fetchFromGitHub {
+    owner = "fedeinthemix";
+    repo = "chez-matchable";
+    rev = "v${version}";
+    sha256 = "02qn7x348p23z1x5lwhkyj7i8z6mgwpzpnwr8dyina0yzsdkr71s";
+  };
+
+  buildInputs = [ chez ];
+
+  buildPhase = ''
+    make PREFIX=$out CHEZ=${chez}/bin/scheme
+  '';
+
+  installPhase = ''
+    make install PREFIX=$out CHEZ=${chez}/bin/scheme
+  '';
+
+  doCheck = false;
+
+  meta = {
+    description = "This is a Library for ChezScheme providing the protable hygenic pattern matcher by Alex Shinn";
+    homepage = https://github.com/fedeinthemix/chez-matchable/;
+    maintainers = [ stdenv.lib.maintainers.jitwit ];
+    license = stdenv.lib.licenses.publicDomain;
+  };
+
+}
--- a/pkgs/development/compilers/osl/default.nix
+++ b/pkgs/development/compilers/osl/default.nix
@ -8,13 +8,13 @@ in clangStdenv.mkDerivation rec {
  # In theory this could use GCC + Clang rather than just Clang,
  # but https://github.com/NixOS/nixpkgs/issues/29877 stops this
  name = "openshadinglanguage-${version}";
-  version = "1.10.7";
+  version = "1.10.8";

  src = fetchFromGitHub {
    owner = "imageworks";
    repo = "OpenShadingLanguage";
-    rev = "Release-1.10.7";
-    sha256 = "15grach34grp8x65sq8xzs2s6nfzjhn4blpfnaicw46jdi4c2w59";
+    rev = "Release-1.10.8";
+    sha256 = "1vfdbs1yprr22nx64ff89jcqabfw0md8drifpbzqn2v6ipc8gz6a";
  };

  cmakeFlags = [ "-DUSE_BOOST_WAVE=ON" "-DENABLERTTI=ON" ];
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@ -2,30 +2,30 @@

 stdenv.mkDerivation rec {
  pname = "clojure";
-  version = "1.10.1.489";
+  version = "1.10.1.492";

  src = fetchurl {
    url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "12ks7adh5cx99l5vydppkqknk5nvv9vsj2k0afcwwxd897m794kz";
+    sha256 = "09mhy5xw9kdr10a1xpbn5v97qyyhngw5s1n1alrs45a4m3l11iky";
  };

  buildInputs = [ makeWrapper ];

-  outputs = [ "out" "prefix" ];
-
  installPhase = let
    binPath = stdenv.lib.makeBinPath [ rlwrap jdk11 ];
-  in ''
-    mkdir -p $prefix/libexec
-    cp clojure-tools-${version}.jar $prefix/libexec
-    cp example-deps.edn $prefix
+  in
+    ''
+      mkdir -p $out/libexec
+      cp clojure-tools-${version}.jar $out/libexec
+      cp example-deps.edn $out
+      cp deps.edn $out

-    substituteInPlace clojure --replace PREFIX $prefix
+      substituteInPlace clojure --replace PREFIX $out

-    install -Dt $out/bin clj clojure
-    wrapProgram $out/bin/clj --prefix PATH : $out/bin:${binPath}
-    wrapProgram $out/bin/clojure --prefix PATH : $out/bin:${binPath}
-  '';
+      install -Dt $out/bin clj clojure
+      wrapProgram $out/bin/clj --prefix PATH : $out/bin:${binPath}
+      wrapProgram $out/bin/clojure --prefix PATH : $out/bin:${binPath}
+    '';

  meta = with stdenv.lib; {
    description = "A Lisp dialect for the JVM";
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -182,6 +182,7 @@ let
      ++ optional mcryptSupport "--with-mcrypt=${libmcrypt'}"
      ++ optional bz2Support "--with-bz2=${bzip2.dev}"
      ++ optional (zipSupport && (versionOlder version "7.4")) "--enable-zip"
+      ++ optional (zipSupport && (versionAtLeast version "7.4")) "--with-zip"
      ++ optional ftpSupport "--enable-ftp"
      ++ optional fpmSupport "--enable-fpm"
      ++ optional ztsSupport "--enable-maintainer-zts"
--- a/pkgs/development/interpreters/python/manylinux/default.nix
+++ b/pkgs/development/interpreters/python/manylinux/default.nix
@ -33,8 +33,10 @@ let
    fi
  '';

+  getLibOutputs = lib.mapAttrs (k: v: lib.getLib v);
+
  # https://www.python.org/dev/peps/pep-0599/
-  manylinux2014Libs = with pkgs; {
+  manylinux2014Libs = getLibOutputs(with pkgs; {
    "libgcc_s.so.1" = glibc;
    "libstdc++.so.6" = stdenv.cc.cc;
    "libm.so.6" = glibc;
@ -54,17 +56,18 @@ let
    "libgobject-2.0.so.0" = glib;
    "libgthread-2.0.so.0" = glib;
    "libglib-2.0.so.0" = glib;
-  };
+    });

  # https://www.python.org/dev/peps/pep-0571/
  manylinux2010Libs = manylinux2014Libs;

  # https://www.python.org/dev/peps/pep-0513/
-  manylinux1Libs = manylinux2010Libs // (with pkgs; {
+  manylinux1Libs = getLibOutputs(manylinux2010Libs // (with pkgs; {
    "libpanelw.so.5" = ncurses5;
    "libncursesw.so.5" = ncurses5;
    "libcrypt.so.1" = glibc;
-  });
+    }));
+
 in {
  # List of libraries that are needed for manylinux compatibility.
  # When using a wheel that is manylinux1 compatible, just extend
--- a/pkgs/development/libraries/fplll/default.nix
+++ b/pkgs/development/libraries/fplll/default.nix
@ -1,22 +1,55 @@
-{stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext, autoreconfHook
-, gmp, mpfr
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, gettext
+, autoreconfHook
+, gmp
+, mpfr
 }:
+
 stdenv.mkDerivation rec {
  pname = "fplll";
-  version = "5.2.1";
+  version = "5.3.0";
+
  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "fplll";
+    repo = "fplll";
    rev = version;
-    sha256 = "015qmrd7nfaysbv1hbwiprz9g6hnww1y1z1xw8f43ysb7k1b5nbg";
+    sha256 = "0wxa4xs7as7y47h7i6prmk5r0srabdvrlkvza3j50pixir5swgvh";
  };
-  nativeBuildInputs = [autoconf automake libtool gettext autoreconfHook];
-  buildInputs = [gmp mpfr];
-  meta = {
-    inherit version;
+
+  patches = [
+    # https://github.com/fplll/fpylll/issues/161
+    (fetchpatch {
+      name = "fix-out-of-bounds-access.patch";
+      url = "https://github.com/fplll/fplll/pull/398/commits/f68e257228bf073ef380f996326d02197ce7b0e4.patch";
+      sha256 = "1rapkcf389lf579va6kbnvhzyv36n4l4d9n0vg2zxprvql8wvm7m";
+    })
+  ];
+
+  nativeBuildInputs = [
+    gettext
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    gmp
+    mpfr
+  ];
+
+  meta = with stdenv.lib; {
    description = ''Lattice algorithms using floating-point arithmetic'';
-    license = stdenv.lib.licenses.lgpl21Plus;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.unix;
+    changelog = [
+      # Some release notes are added to the github tags, though they are not
+      # always complete.
+      "https://github.com/fplll/fplll/releases/tag/${version}"
+      # Releases are announced on this mailing list. Unfortunately it is not
+      # possible to generate a direct link to the most recent announcement, but
+      # this search should find it.
+      "https://groups.google.com/forum/#!searchin/fplll-devel/FPLLL$20${version}"
+    ];
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [raskin timokau];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "leatherman";
-  version = "1.9.0";
+  version = "1.9.1";

  src = fetchFromGitHub {
-    sha256 = "029n16rsvj2abii6d1d4q01fygkicw8n3ja0iaribk4b4h5mc7vc";
+    sha256 = "1aij0prpf7rvxx25qjf1krf0szb922hq9m6q58p90f5bjgymfzwh";
    rev = version;
    repo = "leatherman";
    owner = "puppetlabs";
--- a/pkgs/development/libraries/libindicate/default.nix
+++ b/pkgs/development/libraries/libindicate/default.nix
@ -1,66 +0,0 @@
-# TODO: Resolve the issues with the Mono bindings.
-
-{ stdenv, fetchurl, lib, file
-, pkgconfig, autoconf
-, glib, dbus-glib, libdbusmenu
-, gtkVersion ? "3", gtk2 ? null, gtk3 ? null
-, python2Packages, gobject-introspection, vala, gnome-doc-utils
-, monoSupport ? false, mono ? null, gtk-sharp-2_0 ? null
- }:
-
-with lib;
-
-let
-  inherit (python2Packages) python pygobject2 pygtk;
-in stdenv.mkDerivation rec {
-  name = let postfix = if gtkVersion == "2" && monoSupport then "sharp" else "gtk${gtkVersion}";
-          in "libindicate-${postfix}-${version}";
-  version = "${versionMajor}.${versionMinor}";
-  versionMajor = "12.10";
-  versionMinor = "1";
-
-  src = fetchurl {
-    url = "${meta.homepage}/${versionMajor}/${version}/+download/libindicate-${version}.tar.gz";
-    sha256 = "10am0ymajx633b33anf6b79j37k61z30v9vaf5f9fwk1x5cw1q21";
-  };
-
-  nativeBuildInputs = [ pkgconfig autoconf gobject-introspection vala gnome-doc-utils ];
-
-  buildInputs = [
-    glib dbus-glib libdbusmenu
-    python pygobject2 pygtk
-  ] ++ (if gtkVersion == "2"
-    then [ gtk2 ] ++ optionals monoSupport [ mono gtk-sharp-2_0 ]
-    else [ gtk3 ]);
-
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace '=codegendir pygtk-2.0' '=codegendir pygobject-2.0' \
-      --replace 'pyglib-2.0-python$PYTHON_VERSION' 'pyglib-2.0-python'
-    autoconf
-    for f in {configure,ltmain.sh,m4/libtool.m4}; do
-      substituteInPlace $f \
-        --replace /usr/bin/file ${file}/bin/file
-    done
-  '';
-
-  configureFlags = [
-    "CFLAGS=-Wno-error"
-    "--sysconfdir=/etc"
-    "--localstatedir=/var"
-    "--with-gtk=${gtkVersion}"
-  ];
-
-  installFlags = [
-    "sysconfdir=\${out}/etc"
-    "localstatedir=\${TMPDIR}"
-  ];
-
-  meta = {
-    description = "Library for raising indicators via DBus";
-    homepage = https://launchpad.net/libindicate;
-    license = with licenses; [ lgpl21 lgpl3 ];
-    platforms = platforms.linux;
-    maintainers = [ maintainers.msteen ];
-  };
-}
--- a/pkgs/development/libraries/liblouis/default.nix
+++ b/pkgs/development/libraries/liblouis/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "liblouis";
-  version = "3.11.0";
+  version = "3.12.0";

  src = fetchFromGitHub {
    owner = "liblouis";
    repo = "liblouis";
    rev = "v${version}";
-    sha256 = "1y0pypgxchxczdnjkblibbvvy4gdk2pf8dzpqmbf824c7zpy8z5r";
+    sha256 = "0sw7iwb9158z7jslxj9jwh2vqbg0q8wq6fbmk9iz7sfkjqhi80hv";
  };

  outputs = [ "out" "dev" "man" "info" "doc" ];
--- a/pkgs/development/libraries/libofx/default.nix
+++ b/pkgs/development/libraries/libofx/default.nix
@ -1,23 +1,27 @@
-{ stdenv, fetchurl, opensp, pkgconfig, libxml2, curl }:
-        
-stdenv.mkDerivation rec {
-  name = "libofx-0.9.14";
+{ stdenv, fetchFromGitHub, opensp, pkgconfig, libxml2, curl
+, autoconf, automake, libtool, gengetopt, libiconv }:

-  src = fetchurl {
-    url = "mirror://sourceforge/libofx/${name}.tar.gz";
-    sha256 = "02i9zxkp66yxjpjay5dscfh53bz5vxy03zcxncpw09svl6zmf9xq";
+stdenv.mkDerivation rec {
+  pname = "libofx";
+  version = "0.9.15";
+
+  src = fetchFromGitHub {
+    owner = "LibOFX";
+    repo = pname;
+    rev = version;
+    sha256 = "1jx56ma351p8af8dvavygjwf6ipa7qbgq7bpdsymwj27apdnixfy";
  };

+  preConfigure = "./autogen.sh";
  configureFlags = [ "--with-opensp-includes=${opensp}/include/OpenSP" ];
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ opensp libxml2 curl ];
+  nativeBuildInputs = [ pkgconfig libtool autoconf automake gengetopt ];
+  buildInputs = [ opensp libxml2 curl ] ++ stdenv.lib.optional stdenv.isDarwin libiconv;

  meta = { 
    description = "Opensource implementation of the Open Financial eXchange specification";
    homepage = http://libofx.sourceforge.net/;
    license = "LGPL";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = stdenv.lib.platforms.unix;
    maintainers = [ ];
  };
 }
-
--- a/pkgs/development/libraries/libsexy/default.nix
+++ b/pkgs/development/libraries/libsexy/default.nix
@ -1,24 +0,0 @@
-{ stdenv, fetchurl, pkgconfig
-, glib, gtk2, libxml2, pango
-}:
-
-stdenv.mkDerivation {
-  name = "libsexy-0.1.11";
-
-  src = fetchurl {
-    url = http://releases.chipx86.com/libsexy/libsexy/libsexy-0.1.11.tar.gz;
-    sha256 = "8c4101a8cda5fccbba85ba1a15f46f2cf75deaa8b3c525ce5b135b9e1a8fe49e";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-
-  buildInputs = [ glib gtk2 libxml2 pango ];
-
-  meta = with stdenv.lib; {
-    description = "A collection of GTK widgets";
-    homepage = https://blog.chipx86.com/tag/libsexy/;
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@ -1,12 +1,56 @@
-{ stdenv, fetchurl, perl, python2, ruby, bison, gperf, cmake, ninja
-, pkgconfig, gettext, gobject-introspection, libnotify, gnutls, libgcrypt
-, gtk3, wayland, libwebp, enchant2, xorg, libxkbcommon, epoxy, at-spi2-core
-, libxml2, libsoup, libsecret, libxslt, harfbuzz, libpthreadstubs, pcre, nettle, libtasn1, p11-kit
-, libidn, libedit, readline, libGL, libGLU, libintl, openjpeg
-, enableGeoLocation ? true, geoclue2, sqlite
-, enableGtk2Plugins ? false, gtk2 ? null
-, gst-plugins-base, gst-plugins-bad, woff2
-, bubblewrap, libseccomp, xdg-dbus-proxy, substituteAll
+{ stdenv
+, fetchurl
+, perl
+, python3
+, ruby
+, bison
+, gperf
+, cmake
+, ninja
+, pkgconfig
+, gettext
+, gobject-introspection
+, libnotify
+, gnutls
+, libgcrypt
+, gtk3
+, wayland
+, libwebp
+, enchant2
+, xorg
+, libxkbcommon
+, epoxy
+, at-spi2-core
+, libxml2
+, libsoup
+, libsecret
+, libxslt
+, harfbuzz
+, libpthreadstubs
+, pcre
+, nettle
+, libtasn1
+, p11-kit
+, libidn
+, libedit
+, readline
+, libGL
+, libGLU
+, libintl
+, openjpeg
+, enableGeoLocation ? true
+, geoclue2
+, sqlite
+, enableGtk2Plugins ? false
+, gtk2 ? null
+, gst-plugins-base
+, gst-plugins-bad
+, woff2
+, bubblewrap
+, libseccomp
+, xdg-dbus-proxy
+, substituteAll
+, gnome3
 }:

 assert enableGeoLocation -> geoclue2 != null;
@ -14,18 +58,12 @@ assert enableGtk2Plugins -> gtk2 != null;
 assert stdenv.isDarwin -> !enableGtk2Plugins;

 with stdenv.lib;
+
 stdenv.mkDerivation rec {
  pname = "webkitgtk";
  version = "2.26.2";

-  meta = {
-    description = "Web content rendering engine, GTK port";
-    homepage = https://webkitgtk.org/;
-    license = licenses.bsd2;
-    platforms = platforms.linux;
-    hydraPlatforms = [];
-    maintainers = with maintainers; [ ];
-  };
+  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
@ -40,54 +78,97 @@ stdenv.mkDerivation rec {
    ./libglvnd-headers.patch
  ];

+  nativeBuildInputs = [
+    bison
+    cmake
+    gettext
+    gobject-introspection
+    gperf
+    ninja
+    perl
+    pkgconfig
+    python3
+    ruby
+  ];
+
+  buildInputs = [
+    at-spi2-core
+    enchant2
+    epoxy
+    gnutls
+    gst-plugins-bad
+    gst-plugins-base
+    harfbuzz
+    libGL
+    libGLU
+    libgcrypt
+    libidn
+    libintl
+    libnotify
+    libpthreadstubs
+    libsecret
+    libtasn1
+    libwebp
+    libxkbcommon
+    libxml2
+    libxslt
+    nettle
+    openjpeg
+    p11-kit
+    pcre
+    sqlite
+    woff2
+  ] ++ (with xorg; [
+    libXdamage
+    libXdmcp
+    libXt
+    libXtst
+  ]) ++ optionals stdenv.isDarwin [
+    libedit
+    readline
+  ] ++ optionals stdenv.isLinux [
+    bubblewrap
+    libseccomp
+    wayland
+    xdg-dbus-proxy
+  ] ++ optional enableGeoLocation geoclue2
+    ++ optional enableGtk2Plugins gtk2;
+
+  propagatedBuildInputs = [
+    gtk3
+    libsoup
+  ];
+
+  cmakeFlags = [
+    "-DENABLE_INTROSPECTION=ON"
+    "-DPORT=GTK"
+    "-DUSE_LIBHYPHEN=OFF"
+    "-DUSE_WPE_RENDERER=OFF"
+  ] ++ optionals stdenv.isDarwin [
+    "-DENABLE_GRAPHICS_CONTEXT_3D=OFF"
+    "-DENABLE_GTKDOC=OFF"
+    "-DENABLE_MINIBROWSER=OFF"
+    "-DENABLE_OPENGL=OFF"
+    "-DENABLE_QUARTZ_TARGET=ON"
+    "-DENABLE_VIDEO=ON"
+    "-DENABLE_WEBGL=OFF"
+    "-DENABLE_WEB_AUDIO=OFF"
+    "-DENABLE_X11_TARGET=OFF"
+    "-DUSE_ACCELERATE=0"
+    "-DUSE_SYSTEM_MALLOC=ON"
+  ] ++ optional (!enableGtk2Plugins) "-DENABLE_PLUGIN_PROCESS_GTK2=OFF"
+    ++ optional stdenv.isLinux "-DENABLE_GLES2=ON";
+
  postPatch = ''
    patchShebangs .
  '';

-  cmakeFlags = [
-  "-DPORT=GTK"
-  "-DUSE_LIBHYPHEN=OFF"
-  "-DENABLE_INTROSPECTION=ON"
-  "-DUSE_WPE_RENDERER=OFF"
-  ]
-  ++ optional (!enableGtk2Plugins) "-DENABLE_PLUGIN_PROCESS_GTK2=OFF"
-  ++ optional stdenv.isLinux "-DENABLE_GLES2=ON"
-  ++ optionals stdenv.isDarwin [
-  "-DUSE_SYSTEM_MALLOC=ON"
-  "-DUSE_ACCELERATE=0"
-  "-DENABLE_MINIBROWSER=OFF"
-  "-DENABLE_VIDEO=ON"
-  "-DENABLE_QUARTZ_TARGET=ON"
-  "-DENABLE_X11_TARGET=OFF"
-  "-DENABLE_OPENGL=OFF"
-  "-DENABLE_WEB_AUDIO=OFF"
-  "-DENABLE_WEBGL=OFF"
-  "-DENABLE_GRAPHICS_CONTEXT_3D=OFF"
-  "-DENABLE_GTKDOC=OFF"
-  ];
-
-  nativeBuildInputs = [
-    cmake ninja perl python2 ruby bison gperf
-    pkgconfig gettext gobject-introspection
-  ];
-
-  buildInputs = [
-    libintl libwebp enchant2 libnotify gnutls pcre nettle libidn libgcrypt woff2
-    libxml2 libsecret libxslt harfbuzz libpthreadstubs libtasn1 p11-kit openjpeg
-    sqlite gst-plugins-base gst-plugins-bad libxkbcommon epoxy at-spi2-core
-    libGL libGLU
-  ] ++ optional enableGeoLocation geoclue2
-    ++ optional enableGtk2Plugins gtk2
-    ++ (with xorg; [ libXdmcp libXt libXtst libXdamage ])
-    ++ optionals stdenv.isDarwin [ libedit readline ]
-    ++ optionals stdenv.isLinux [
-      wayland bubblewrap libseccomp xdg-dbus-proxy
-  ];
-
-  propagatedBuildInputs = [
-    libsoup gtk3
-  ];
-
-  outputs = [ "out" "dev" ];
-
+  meta = {
+    description = "Web content rendering engine, GTK port";
+    homepage = https://webkitgtk.org/;
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    hydraPlatforms = [];
+    maintainers = gnome3.maintainers;
+  };
 }
--- a/pkgs/development/ocaml-modules/ppx_deriving_rpc/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving_rpc/default.nix
@ -1,11 +1,11 @@
-{ lib, buildDunePackage, rpclib, ppxfind, ppx_deriving, cppo }:
+{ lib, buildDunePackage, rpclib, ppxlib, ppx_deriving }:

 buildDunePackage rec {
  pname = "ppx_deriving_rpc";

  inherit (rpclib) version src;

-  buildInputs = [ ppxfind cppo ];
+  buildInputs = [ ppxlib ];

  propagatedBuildInputs = [ rpclib ppx_deriving ];

--- a/pkgs/development/ocaml-modules/rpclib/default.nix
+++ b/pkgs/development/ocaml-modules/rpclib/default.nix
@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, buildDunePackage, alcotest, cmdliner, rresult, result, xmlm, yojson }:
+{ lib, fetchFromGitHub, buildDunePackage, alcotest, cmdliner, rresult, result, xmlm, yojson }:

 buildDunePackage rec {
  pname = "rpclib";
-  version = "5.9.0";
+  version = "6.0.0";

  minimumOCamlVersion = "4.04";

@ -10,7 +10,7 @@ buildDunePackage rec {
    owner = "mirage";
    repo = "ocaml-rpc";
    rev = "v${version}";
-    sha256 = "1swnnmmnkn53mxqpckdnd1j8bz0wksqznjbv0zamspxyqybmancq";
+    sha256 = "0bmr20sj7kybjjlwd42irj0f5zlnxcw7mxa1mdgxkki9bmhsqr51";
  };

  buildInputs = [ alcotest cmdliner yojson ];
@ -18,7 +18,7 @@ buildDunePackage rec {

  doCheck = true;

-  meta = with stdenv.lib; {
+  meta = with lib; {
    homepage = "https://github.com/mirage/ocaml-rpc";
    description = "Light library to deal with RPCs in OCaml";
    license = licenses.isc;
--- a/pkgs/development/python-modules/arviz/default.nix
+++ b/pkgs/development/python-modules/arviz/default.nix
@ -0,0 +1,80 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, emcee
+, matplotlib
+, netcdf4
+, numba
+, numpy
+, pandas
+, pytest
+, scipy
+, setuptools
+, tensorflow-probability
+, xarray
+#, h5py (used by disabled tests)
+#, pymc3 (broken)
+#, pyro-ppl (broken)
+#, pystan (not packaged)
+#, numpyro (not packaged)
+}:
+
+buildPythonPackage rec {
+  pname = "arviz";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "arviz-devs";
+    repo = "arviz";
+    rev = version;
+    sha256 = "0p600cakix24wz2ridnzy6sp3l1p2kr5s60qc7s82wpv7fw0i9ry";
+  };
+
+  propagatedBuildInputs = [
+    # needed to install
+    matplotlib
+    netcdf4
+    pandas
+    xarray
+    # needed to import
+    setuptools
+    # not needed to import, but used by many functions
+    # and is listed as a dependency in the documentation
+    numpy
+    scipy
+  ];
+
+  checkInputs = [
+    emcee
+    numba
+    pytest
+    tensorflow-probability
+    #h5py (used by disabled tests)
+    #pymc3 (broken)
+    #pyro-ppl (broken)
+    #pystan (not packaged)
+    #numpyro (not packaged)
+  ];
+
+  # check requires pymc3 and pyro-ppl, which are currently broken, and pystan
+  # and numpyro, which are not yet packaged, some checks also need to make
+  # directories and do not have permission to do so. So we can only check part
+  # of the package
+  # Additionally, there are some failures with the plots test, which revolve
+  # around attempting to output .mp4 files through an interface that only wants
+  # to output .html files.
+  # The following test have been disabled as a result: data_cmdstanpy,
+  # data_numpyro, data_pyro, data_pystan, and plots.
+  checkPhase = ''
+    cd arviz/tests/
+    HOME=$TMPDIR pytest test_{data_cmdstan,data_emcee,data,data_tfp,\
+    diagnostics,plot_utils,rcparams,stats,stats_utils,utils}.py
+  '';
+
+  meta = with lib; {
+    description = "ArviZ is a Python package for exploratory analysis of Bayesian models";
+    homepage = "https://arviz-devs.github.io/arviz/";
+    license = licenses.asl20;
+    maintainers = [ maintainers.omnipotententity ];
+  };
+}
--- a/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-recoveryservicesbackup/default.nix
@ -9,12 +9,12 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-recoveryservicesbackup";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "0zssvzdip23yzaxlac9rlzg9mlyjl97fwr0gj8y27z8j58pwj72i";
+    sha256 = "0jhq8fi3dn2cncyv2rrgr4kldd254f30zgwf6p85rdgvg2p9k4hl";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/pkgs/development/python-modules/cassandra-driver/default.nix
@ -15,11 +15,11 @@

 buildPythonPackage rec {
  pname = "cassandra-driver";
-  version = "3.19.0";
+  version = "3.20.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1vy9yzsd9c29irq99m8lpkgnc634waai2phvr6b89pmmdirp2wm9";
+    sha256 = "03nycyn5nd1pnrg6fffq3wcjqnw13lgja137zq5zszx68mc15wnl";
  };

  nativeBuildInputs = [ cython ];
--- a/pkgs/development/python-modules/colored/default.nix
+++ b/pkgs/development/python-modules/colored/default.nix
@ -5,11 +5,11 @@

 buildPythonPackage rec {
  pname = "colored";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0wlsg7z406q31r5fpwkqfpyfpigazbmq9qm856wfbn861k2773zf";
+    sha256 = "0qf9470fsasimsmsri13jw1d2zpn3g24fv6vss64jq3ifwfkcs14";
  };

  # No proper test suite
--- a/pkgs/development/python-modules/dask-ml/default.nix
+++ b/pkgs/development/python-modules/dask-ml/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , dask
 , numpy, toolz # dask[array]
 , numba
@ -19,21 +20,41 @@
 }:

 buildPythonPackage rec {
-  version = "1.0.0";
+  version = "1.1.1";
  pname = "dask-ml";
+  disabled = pythonOlder "3.6"; # >= 3.6

  src = fetchPypi {
    inherit pname version;
-    sha256 = "dde926478653bd03a3fbc501d3873a1534836608217b94d04320d1e1c07e59dc";
+    sha256 = "1yad9b9hd02rbdf6m1gfj74cjgcbyp7lxdj22d5h5rhv7xa3127x";
  };

-  checkInputs = [ pytest xgboost tensorflow joblib distributed ];
-  propagatedBuildInputs = [ dask numpy toolz numba pandas scikitlearn scipy dask-glm six multipledispatch packaging ];
+  propagatedBuildInputs = [
+    dask
+    dask-glm
+    distributed
+    multipledispatch
+    numba
+    numpy
+    packaging
+    pandas
+    scikitlearn
+    scipy
+    six
+    toolz
+  ];

-  # dask-ml has some heavy test requirements
-  # and requires some very new packages
+  # has non-standard build from source, and pypi doesn't include tests
  doCheck = false;

+  # in lieu of proper tests
+  pythonImportsCheck = [
+    "dask_ml"
+    "dask_ml.naive_bayes"
+    "dask_ml.wrappers"
+    "dask_ml.utils"
+  ];
+
  meta = with stdenv.lib; {
    homepage = https://github.com/dask/dask-ml;
    description = "Scalable Machine Learn with Dask";
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@ -1,8 +1,9 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy27
+{ lib, stdenv, buildPythonPackage, fetchPypi, isPy27
 , backports_ssl_match_hostname
 , mock
 , paramiko
 , pytest
+, pytestCheckHook
 , requests
 , six
 , websocket_client
@ -17,25 +18,25 @@ buildPythonPackage rec {
    sha256 = "1hdgics03fz2fbhalzys7a7kjj54jnl5a37h6lzdgym41gkwa1kf";
  };

+  nativeBuildInputs = [
+    pytestCheckHook
+  ] ++ lib.optional isPy27 mock;
+
  propagatedBuildInputs = [
    paramiko
    requests
    six
    websocket_client
-  ] ++ stdenv.lib.optional isPy27 backports_ssl_match_hostname;
+  ] ++ lib.optional isPy27 backports_ssl_match_hostname;

-  checkInputs = [
-    mock
-    pytest
-  ];
-
-  # Other tests touch network
+  pytestFlagsArray = [ "tests/unit" ];
  # Deselect socket tests on Darwin because it hits the path length limit for a Unix domain socket
-  checkPhase = ''
-    ${pytest}/bin/pytest tests/unit/ ${stdenv.lib.optionalString stdenv.isDarwin "--deselect=tests/unit/api_test.py::TCPSocketStreamTest"}
-  '';
+  disabledTests = lib.optionals stdenv.isDarwin [ "stream_response" "socket_file" ];

-  meta = with stdenv.lib; {
+  # skip setuptoolsCheckPhase
+  doCheck = false;
+
+  meta = with lib; {
    description = "An API client for docker written in Python";
    homepage = "https://github.com/docker/docker-py";
    license = licenses.asl20;
--- a/pkgs/development/python-modules/fpylll/default.nix
+++ b/pkgs/development/python-modules/fpylll/default.nix
@ -14,13 +14,13 @@

 buildPythonPackage rec {
  pname = "fpylll";
-  version = "0.4.1dev";
+  version = "0.5.0dev";

  src = fetchFromGitHub {
    owner = "fplll";
    repo = "fpylll";
    rev = version;
-    sha256 = "01x2sqdv0sbjj4g4waj0hj4rcn4bq7h17442xaqwbznym9azmn9w";
+    sha256 = "091zqgsqd5cqma1hvimkq5xpr9f1jw80v9m2fr6k9hvssqjzgnab";
  };

  buildInputs = [
@ -45,11 +45,16 @@ buildPythonPackage rec {
  ];

  checkPhase = ''
-    py.test
+    # Since upstream introduced --doctest-modules in
+    # https://github.com/fplll/fpylll/commit/9732fdb40cf1bd43ad1f60762ec0a8401743fc79,
+    # it is necessary to ignore import mismatches. Not sure why, but the files
+    # should be identical anyway.
+    PY_IGNORE_IMPORTMISMATCH=1 pytest
  '';

  meta = {
    description = "A Python interface for fplll";
+    changelog = "https://github.com/fplll/fpylll/releases/tag/${version}";
    homepage = https://github.com/fplll/fpylll;
    maintainers = with lib.maintainers; [ timokau ];
    license = lib.licenses.gpl2Plus;
--- a/pkgs/development/python-modules/goocalendar/default.nix
+++ b/pkgs/development/python-modules/goocalendar/default.nix
@ -16,17 +16,22 @@ buildPythonPackage rec {
  pname = "GooCalendar";
  version = "0.6";

-  disabled = isPy3k;
+  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
    sha256 = "4c22c93e19b933d10d8ea1c67a67f485267af82175ef59419427dd39d1e3af18";
  };
-  nativeBuildInputs = [ pkgconfig gobject-introspection ];
+
+  nativeBuildInputs = [
+    pkgconfig
+    gobject-introspection
+  ];
+
  propagatedBuildInputs = [
-    pygtk
    pygobject3
  ];
+
  buildInputs = [
    gtk3
    goocanvas2
@ -37,8 +42,8 @@ buildPythonPackage rec {

  meta = with stdenv.lib; {
    description = "A calendar widget for GTK using PyGoocanvas.";
-    homepage    = https://goocalendar.tryton.org/;
-    license     = licenses.gpl2;
+    homepage = https://goocalendar.tryton.org/;
+    license = licenses.gpl2;
    maintainers = [ maintainers.udono ];
  };
 }
--- a/pkgs/development/python-modules/icalendar/default.nix
+++ b/pkgs/development/python-modules/icalendar/default.nix
@ -7,12 +7,12 @@
 }:

 buildPythonPackage rec {
-  version = "4.0.3";
+  version = "4.0.4";
  pname = "icalendar";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0mk3dk1dxkcm46jy48v27j2w2349iv4sbimqj1yb5js43mx49hh7";
+    sha256 = "16gjvqv0n05jrb9g228pdjgzd3amz2pdhvcgsn1jypszjg5m2w9l";
  };

  buildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@ -1,6 +1,6 @@
 { buildPythonPackage, fetchFromGitHub, pytest, six, clint, pyyaml, docopt
 , requests, jsonpatch, args, schema, responses, backports_csv, isPy3k
-, lib, glibcLocales }:
+, lib, glibcLocales, setuptools }:

 buildPythonPackage rec {
  pname = "internetarchive";
@ -23,6 +23,7 @@ buildPythonPackage rec {
    jsonpatch
    args
    schema
+    setuptools
  ] ++ lib.optional (!isPy3k) backports_csv;

  checkInputs = [ pytest responses glibcLocales ];
--- a/Show more
+++ b/Show more