Merge branch 'master' into auto-update/chipsec

2024-11-21 05:00:16 +00:00 · 2020-04-06 19:26:10 +02:00 · 2020-04-06 19:26:10 +02:00 · 6689065a3b
parent cc41ff0288 a3358eeeb4
commit 6689065a3b
586 changed files with 10493 additions and 9148 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -178,6 +178,7 @@
 /nixos/tests/prometheus-exporters.nix                        @WilliButz

 # PHP
-/pkgs/development/interpreters/php  @etu
-/pkgs/top-level/php-packages.nix    @etu
-/pkgs/build-support/build-pecl.nix  @etu
+/doc/languages-frameworks/php.section.md @etu
+/pkgs/development/interpreters/php       @etu
+/pkgs/top-level/php-packages.nix         @etu
+/pkgs/build-support/build-pecl.nix       @etu
--- a/doc/languages-frameworks/android.section.md
+++ b/doc/languages-frameworks/android.section.md
@ -186,7 +186,7 @@ with import <nixpkgs> {};
 androidenv.emulateApp {
  name = "emulate-MyAndroidApp";
  platformVersion = "28";
-  abiVersion = "x86_64"; # armeabi-v7a, mips, x86
+  abiVersion = "x86"; # armeabi-v7a, mips, x86_64
  systemImageType = "google_apis_playstore";
 }
 ```
--- a/doc/languages-frameworks/php.section.md
+++ b/doc/languages-frameworks/php.section.md
@ -0,0 +1,112 @@
+# PHP
+
+## User Guide
+
+### Using PHP
+
+#### Overview
+
+Several versions of PHP are available on Nix, each of which having a
+wide variety of extensions and libraries available.
+
+The attribute `php` refers to the version of PHP considered most
+stable and thoroughly tested in nixpkgs for any given release of
+NixOS. Note that while this version of PHP may not be the latest major
+release from upstream, any version of PHP supported in nixpkgs may be
+utilized by specifying the desired attribute by version, such as
+`php74`.
+
+Only versions of PHP that are supported by upstream for the entirety
+of a given NixOS release will be included in that release of
+NixOS. See [PHP Supported
+Versions](https://www.php.net/supported-versions.php).
+
+Interactive tools built on PHP are put in `php.packages`; composer is
+for example available at `php.packages.composer`.
+
+Most extensions that come with PHP, as well as some popular
+third-party ones, are available in `php.extensions`; for example, the
+opcache extension shipped with PHP is available at
+`php.extensions.opcache` and the third-party ImageMagick extension at
+`php.extensions.imagick`.
+
+The different versions of PHP that nixpkgs provides is located under
+attributes named based on major and minor version number; e.g.,
+`php74` is PHP 7.4 with commonly used extensions installed,
+`php74base` is the same PHP runtime without extensions.
+
+#### Installing PHP with packages
+
+A PHP package with specific extensions enabled can be built using
+`php.withExtensions`. This is a function which accepts an anonymous
+function as its only argument; the function should take one argument,
+the set of all extensions, and return a list of wanted extensions. For
+example, a PHP package with the opcache and ImageMagick extensions
+enabled:
+
+```nix
+php.withExtensions (e: with e; [ imagick opcache ])
+```
+
+Note that this will give you a package with _only_ opcache and
+ImageMagick, none of the other extensions which are enabled by default
+in the `php` package will be available.
+
+To enable building on a previous PHP package, the currently enabled
+extensions are made available in its `enabledExtensions`
+attribute. For example, to generate a package with all default
+extensions enabled, except opcache, but with ImageMagick:
+
+```nix
+php.withExtensions (e:
+  (lib.filter (e: e != php.extensions.opcache) php.enabledExtensions)
+  ++ [ e.imagick ])
+```
+
+If you want a PHP build with extra configuration in the `php.ini`
+file, you can use `php.buildEnv`. This function takes two named and
+optional parameters: `extensions` and `extraConfig`. `extensions`
+takes an extension specification equivalent to that of
+`php.withExtensions`, `extraConfig` a string of additional `php.ini`
+configuration parameters. For example, a PHP package with the opcache
+and ImageMagick extensions enabled, and `memory_limit` set to `256M`:
+
+```nix
+php.buildEnv {
+  extensions = e: with e; [ imagick opcache ];
+  extraConfig = "memory_limit=256M";
+}
+```
+
+##### Example setup for `phpfpm`
+
+You can use the previous examples in a `phpfpm` pool called `foo` as
+follows:
+
+```nix
+let
+  myPhp = php.withExtensions (e: with e; [ imagick opcache ]);
+in {
+  services.phpfpm.pools."foo".phpPackage = myPhp;
+};
+```
+
+```nix
+let
+  myPhp = php.buildEnv {
+    extensions = e: with e; [ imagick opcache ];
+    extraConfig = "memory_limit=256M";
+  };
+in {
+  services.phpfpm.pools."foo".phpPackage = myPhp;
+};
+```
+
+##### Example usage with `nix-shell`
+
+This brings up a temporary environment that contains a PHP interpreter
+with the extensions `imagick` and `opcache` enabled.
+
+```sh
+nix-shell -p 'php.buildEnv { extensions = e: with e; [ imagick opcache ]; }'
+```
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -981,6 +981,12 @@
    githubId = 2071583;
    name = "Benjamin Hipple";
  };
+  bhougland = {
+    email = "benjamin.hougland@gmail.com";
+    github = "bhougland18";
+    githubId = 28444296;
+    name = "Benjamin Hougland";
+  };
  binarin = {
    email = "binarin@binarin.ru";
    github = "binarin";
@ -2398,6 +2404,12 @@
      fingerprint = "67FE 98F2 8C44 CF22 1828  E12F D57E FA62 5C9A 925F";
    }];
  };
+  euank = {
+    email = "euank-nixpkg@euank.com";
+    github = "euank";
+    githubId = 2147649;
+    name = "Euan Kemp";
+  };
  evanjs = {
    email = "evanjsx@gmail.com";
    github = "evanjs";
@ -3227,6 +3239,12 @@
    githubId = 4458;
    name = "Ivan Kozik";
  };
+  ivan-timokhin = {
+    email = "nixpkgs@ivan.timokhin.name";
+    name = "Ivan Timokhin";
+    github = "ivan-timokhin";
+    githubId = 9802104;
+  };
  ivan-tkatchev = {
    email = "tkatchev@gmail.com";
    name = "Ivan Tkatchev";
@ -6771,6 +6789,11 @@
    github = "shmish111";
    name = "David Smith";
  };
+  shnarazk = {
+    email = "shujinarazaki@protonmail.com";
+    github = "shnarazk";
+    name = "Narazaki Shuji";
+  };
  shou = {
    email = "x+g@shou.io";
    github = "Shou";
@ -8040,6 +8063,12 @@
    githubId = 13489144;
    name = "Calle Rosenquist";
  };
+  xe = {
+    email = "me@christine.website";
+    github = "Xe";
+    githubId = 529003;
+    name = "Christine Dodrill";
+  };
  xeji = {
    email = "xeji@cat3.de";
    github = "xeji";
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -827,8 +827,8 @@ auth required pam_succeed_if.so uid >= 1000 quiet
   </listitem>
   <listitem>
    <para>
-     Predicatbly named network-interfaces get renamed in stage-1. This means that it's possible
-     to use the proper interface name for e.g. dropbear-setups.
+     Predictably named network interfaces get renamed in stage-1. This means that it is possible
+     to use the proper interface name for e.g. Dropbear setups.
    </para>
    <para>
     For further reference, please read <link xlink:href="https://github.com/NixOS/nixpkgs/pull/68953">#68953</link> or the corresponding <link xlink:href="https://discourse.nixos.org/t/predictable-network-interface-names-in-initrd/4055">discourse thread</link>.
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -23,6 +23,9 @@
     Support is planned until the end of April 2021, handing over to 21.03.
    </para>
   </listitem>
+   <listitem>
+    <para>GNOME desktop environment was upgraded to 3.36, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release notes</link>.</para>
+   </listitem>
   <listitem>
    <para>
     PHP now defaults to PHP 7.4, updated from 7.3.
@ -125,6 +128,73 @@
     documentation for instructions.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       Since this release there's an easy way to customize your PHP install to get a much smaller
+       base PHP with only wanted extensions enabled. See the following snippet installing a smaller PHP
+       with the extensions <literal>imagick</literal>, <literal>opcache</literal> and
+       <literal>pdo_mysql</literal> loaded:
+
+       <programlisting>
+environment.systemPackages = [
+(pkgs.php.buildEnv { extensions = pp: with pp; [
+    imagick
+    opcache
+    pdo_mysql
+  ]; })
+];</programlisting>
+
+       The default <literal>php</literal> attribute hasn't lost any extensions -
+       the <literal>opcache</literal> extension was added there.
+
+       All upstream PHP extensions are available under <package><![CDATA[php.extensions.<name?>]]></package>.
+     </para>
+     <para>
+       The updated <literal>php</literal> attribute is now easily customizable to your liking
+       by using extensions instead of writing config files or changing configure flags.
+
+       Therefore we have removed the following configure flags:
+
+       <itemizedlist>
+         <title>PHP <literal>config</literal> flags that we don't read anymore:</title>
+         <listitem><para><literal>config.php.argon2</literal></para></listitem>
+         <listitem><para><literal>config.php.bcmath</literal></para></listitem>
+         <listitem><para><literal>config.php.bz2</literal></para></listitem>
+         <listitem><para><literal>config.php.calendar</literal></para></listitem>
+         <listitem><para><literal>config.php.curl</literal></para></listitem>
+         <listitem><para><literal>config.php.exif</literal></para></listitem>
+         <listitem><para><literal>config.php.ftp</literal></para></listitem>
+         <listitem><para><literal>config.php.gd</literal></para></listitem>
+         <listitem><para><literal>config.php.gettext</literal></para></listitem>
+         <listitem><para><literal>config.php.gmp</literal></para></listitem>
+         <listitem><para><literal>config.php.imap</literal></para></listitem>
+         <listitem><para><literal>config.php.intl</literal></para></listitem>
+         <listitem><para><literal>config.php.ldap</literal></para></listitem>
+         <listitem><para><literal>config.php.libxml2</literal></para></listitem>
+         <listitem><para><literal>config.php.libzip</literal></para></listitem>
+         <listitem><para><literal>config.php.mbstring</literal></para></listitem>
+         <listitem><para><literal>config.php.mysqli</literal></para></listitem>
+         <listitem><para><literal>config.php.mysqlnd</literal></para></listitem>
+         <listitem><para><literal>config.php.openssl</literal></para></listitem>
+         <listitem><para><literal>config.php.pcntl</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_mysql</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_odbc</literal></para></listitem>
+         <listitem><para><literal>config.php.pdo_pgsql</literal></para></listitem>
+         <listitem><para><literal>config.php.phpdbg</literal></para></listitem>
+         <listitem><para><literal>config.php.postgresql</literal></para></listitem>
+         <listitem><para><literal>config.php.readline</literal></para></listitem>
+         <listitem><para><literal>config.php.soap</literal></para></listitem>
+         <listitem><para><literal>config.php.sockets</literal></para></listitem>
+         <listitem><para><literal>config.php.sodium</literal></para></listitem>
+         <listitem><para><literal>config.php.sqlite</literal></para></listitem>
+         <listitem><para><literal>config.php.tidy</literal></para></listitem>
+         <listitem><para><literal>config.php.xmlrpc</literal></para></listitem>
+         <listitem><para><literal>config.php.xsl</literal></para></listitem>
+         <listitem><para><literal>config.php.zip</literal></para></listitem>
+         <listitem><para><literal>config.php.zlib</literal></para></listitem>
+       </itemizedlist>
+     </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/config/gtk/gtk-icon-cache.nix
+++ b/nixos/modules/config/gtk/gtk-icon-cache.nix
@ -77,7 +77,7 @@ with lib;

        if [ -w "$themedir" ]; then
          rm -f "$themedir"/icon-theme.cache
-          ${pkgs.gtk3.out}/bin/gtk-update-icon-cache --ignore-theme-index "$themedir"
+          ${pkgs.buildPackages.gtk3.out}/bin/gtk-update-icon-cache --ignore-theme-index "$themedir"
        fi
      done
    '';
--- a/nixos/modules/i18n/input-method/ibus.nix
+++ b/nixos/modules/i18n/input-method/ibus.nix
@ -76,7 +76,7 @@ in
      XMODIFIERS = "@im=ibus";
    };

-    xdg.portal.extraPortals = mkIf xdg.portal.enable [
+    xdg.portal.extraPortals = mkIf config.xdg.portal.enable [
      ibusPackage
    ];
  };
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -23,8 +23,6 @@ with lib;

  security.allowUserNamespaces = mkDefault false;

-  nix.useSandbox = mkDefault false;
-
  security.protectKernelImage = mkDefault true;

  security.allowSimultaneousMultithreading = mkDefault false;
--- a/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-keyring.nix
@ -39,6 +39,8 @@ with lib;

    services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ];

+    xdg.portal.extraPortals = [ pkgs.gnome3.gnome-keyring ];
+
    security.pam.services.login.enableGnomeKeyring = true;

    security.wrappers.gnome-keyring-daemon = {
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@ -31,7 +31,6 @@ bind_host: "${cfg.bind_host}"
 ''}
 server_name: "${cfg.server_name}"
 pid_file: "/run/matrix-synapse.pid"
-web_client: ${boolToString cfg.web_client}
 ${optionalString (cfg.public_baseurl != null) ''
 public_baseurl: "${cfg.public_baseurl}"
 ''}
@ -202,13 +201,6 @@ in {
          This is also the last part of your UserID.
        '';
      };
-      web_client = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to serve a web client from the HTTP/HTTPS root resource.
-        '';
-      };
      public_baseurl = mkOption {
        type = types.nullOr types.str;
        default = null;
@ -719,6 +711,7 @@ in {
      Database configuration must be done manually. An exemplary setup is demonstrated in
      <nixpkgs/nixos/tests/matrix-synapse.nix>
    '')
+    (mkRemovedOptionModule [ "services" "matrix-synapse" "web_client" ] "")
  ];

  meta.doc = ./matrix-synapse.xml;
--- a/nixos/modules/services/networking/rxe.nix
+++ b/nixos/modules/services/networking/rxe.nix
@ -5,20 +5,6 @@ with lib;
 let
  cfg = config.networking.rxe;

-  runRxeCmd = cmd: ifcs:
-    concatStrings ( map (x: "${pkgs.rdma-core}/bin/rxe_cfg -n ${cmd} ${x};") ifcs);
-
-  startScript = pkgs.writeShellScriptBin "rxe-start" ''
-    ${pkgs.rdma-core}/bin/rxe_cfg -n start
-    ${runRxeCmd "add" cfg.interfaces}
-    ${pkgs.rdma-core}/bin/rxe_cfg
-  '';
-
-  stopScript = pkgs.writeShellScriptBin "rxe-stop" ''
-    ${runRxeCmd "remove" cfg.interfaces }
-    ${pkgs.rdma-core}/bin/rxe_cfg -n stop
-  '';
-
 in {
  ###### interface

@ -31,9 +17,8 @@ in {
        example = [ "eth0" ];
        description = ''
          Enable RDMA on the listed interfaces. The corresponding virtual
-          RDMA interfaces will be named rxe0 ... rxeN where the ordering
-          will be as they are named in the list. UDP port 4791 must be
-          open on the respective ethernet interfaces.
+          RDMA interfaces will be named rxe_&lt;interface&gt;.
+          UDP port 4791 must be open on the respective ethernet interfaces.
        '';
      };
    };
@ -44,7 +29,6 @@ in {
  config = mkIf cfg.enable {

    systemd.services.rxe = {
-      path = with pkgs; [ kmod rdma-core ];
      description = "RoCE interfaces";

      wantedBy = [ "multi-user.target" ];
@ -54,8 +38,13 @@ in {
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
-        ExecStart = "${startScript}/bin/rxe-start";
-        ExecStop = "${stopScript}/bin/rxe-stop";
+        ExecStart = map ( x:
+          "${pkgs.iproute}/bin/rdma link add rxe_${x} type rxe netdev ${x}"
+          ) cfg.interfaces;
+
+        ExecStop = map ( x:
+          "${pkgs.iproute}/bin/rdma link delete rxe_${x}"
+          ) cfg.interfaces;
      };
    };
  };
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@ -9,8 +9,8 @@ let
  # This middle-ground solution ensures *an* sshd can do their basic validation
  # on the configuration.
  validationPackage = if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform
-    then [ cfgc.package ]
-    else [ pkgs.buildPackages.openssh ];
+    then cfgc.package
+    else pkgs.buildPackages.openssh;

  sshconf = pkgs.runCommand "sshd.conf-validated" { nativeBuildInputs = [ validationPackage ]; } ''
    cat >$out <<EOL
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -6,27 +6,28 @@ let
  cfg = config.services.nextcloud;
  fpm = config.services.phpfpm.pools.nextcloud;

-  phpPackage = pkgs.php73;
-  phpPackages = pkgs.php73Packages;
+  phpPackage =
+    let
+      base = pkgs.php74;
+    in
+      base.buildEnv {
+        extensions = e: with e;
+          base.enabledExtensions ++ [
+            apcu redis memcached imagick
+          ];
+        extraConfig = phpOptionsStr;
+      };

  toKeyValue = generators.toKeyValue {
    mkKeyValue = generators.mkKeyValueDefault {} " = ";
  };

-  phpOptionsExtensions = ''
-    ${optionalString cfg.caching.apcu "extension=${phpPackages.apcu}/lib/php/extensions/apcu.so"}
-    ${optionalString cfg.caching.redis "extension=${phpPackages.redis}/lib/php/extensions/redis.so"}
-    ${optionalString cfg.caching.memcached "extension=${phpPackages.memcached}/lib/php/extensions/memcached.so"}
-    extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
-    zend_extension = opcache.so
-    opcache.enable = 1
-  '';
  phpOptions = {
    upload_max_filesize = cfg.maxUploadSize;
    post_max_size = cfg.maxUploadSize;
    memory_limit = cfg.maxUploadSize;
  } // cfg.phpOptions;
-  phpOptionsStr = phpOptionsExtensions + (toKeyValue phpOptions);
+  phpOptionsStr = toKeyValue phpOptions;

  occ = pkgs.writeScriptBin "nextcloud-occ" ''
    #! ${pkgs.stdenv.shell}
@ -38,7 +39,6 @@ let
    export NEXTCLOUD_CONFIG_DIR="${cfg.home}/config"
    $sudo \
      ${phpPackage}/bin/php \
-      -c ${pkgs.writeText "php.ini" phpOptionsStr}\
      occ $*
  '';

--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -38,7 +38,7 @@ in
      pkgs.gtk2 # To get GTK's themes.
      pkgs.tango-icon-theme

-      pkgs.gnome2.gnome_icon_theme
+      pkgs.gnome-icon-theme
      pkgs.xorg.xcursorthemes
    ];

--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -184,7 +184,7 @@ in
              wmCommand = "${pkgs.gnome3.metacity}/bin/metacity";
            } ++ cfg.flashback.customSessions);

-      security.pam.services.gnome-screensaver = {
+      security.pam.services.gnome-flashback = {
        enableGnomeKeyring = true;
      };

@ -195,9 +195,10 @@ in
          inherit (wm) wmName;
        }) cfg.flashback.customSessions);

-      services.dbus.packages = [
-        pkgs.gnome3.gnome-screensaver
-      ];
+        # gnome-panel needs these for menu applet
+        environment.sessionVariables.XDG_DATA_DIRS = [ "${pkgs.gnome3.gnome-flashback}/share" ];
+        # TODO: switch to sessionVariables (resolve conflict)
+        environment.variables.XDG_CONFIG_DIRS = [ "${pkgs.gnome3.gnome-flashback}/etc/xdg" ];
    })

    (mkIf serviceCfg.core-os-services.enable {
@ -256,7 +257,6 @@ in
      systemd.packages = with pkgs.gnome3; [
        gnome-session
        gnome-shell
-        vino
      ];

      services.avahi.enable = mkDefault true;
@ -308,7 +308,7 @@ in
        environment = mkForce {};
      };

-      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-32/elements/core/meta-gnome-core-shell.bst
+      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-36/elements/core/meta-gnome-core-shell.bst
      environment.systemPackages = with pkgs.gnome3; [
        adwaita-icon-theme
        gnome-backgrounds
@ -327,11 +327,10 @@ in
        pkgs.hicolor-icon-theme
        pkgs.shared-mime-info # for update-mime-database
        pkgs.xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
-        vino
      ];
    })

-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-32/elements/core/meta-gnome-core-utilities.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-36/elements/core/meta-gnome-core-utilities.bst
    (mkIf serviceCfg.core-utilities.enable {
      environment.systemPackages = (with pkgs.gnome3; removePackagesByName [
        baobab
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -181,7 +181,6 @@ in
        hicolor-icon-theme
        lightlocker
        onboard
-        plank
        qgnomeplatform
        shared-mime-info
        sound-theme-freedesktop
@ -195,6 +194,7 @@ in

        # Desktop
        elementary-default-settings
+        elementary-dock
        elementary-session-settings
        elementary-shortcut-overlay
        gala
@ -206,9 +206,9 @@ in
        })

        # Services
-        cerbere
        elementary-capnet-assist
        elementary-dpms-helper
+        elementary-notifications
        elementary-settings-daemon
        pantheon-agent-geoclue2
        pantheon-agent-polkit
--- a/nixos/modules/services/x11/desktop-managers/pantheon.xml
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.xml
@ -89,22 +89,6 @@ switchboard-with-plugs.override {
     </para>
    </listitem>
   </varlistentry>
-   <varlistentry xml:id="sec-pantheon-faq-slow-shutdown">
-    <term>
-     Using Pantheon sometimes makes my shutdown take a long time.
-    </term>
-    <listitem>
-     <para>
-      We have not yet determined what processes fight with systemd during shutdown, there are many reports. In elementary OS the default system timeout is lowered to lessen the impact of the issue. If you'd like to do this in NixOS, set
-<programlisting>
- <xref linkend="opt-systemd.extraConfig"/> = ''
-  DefaultTimeoutStopSec=10s
-  DefaultTimeoutStartSec=10s
-'';
-</programlisting>
-     </para>
-    </listitem>
-   </varlistentry>
   <varlistentry xml:id="sec-pantheon-faq-gnome3-and-pantheon">
    <term>
     I cannot enable both GNOME 3 and Pantheon.
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -188,6 +188,9 @@ in
      "systemd-machined.service"
      # setSessionScript wants AccountsService
      "accounts-daemon.service"
+      # Failed to open gpu '/dev/dri/card0': GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: Operation not permitted
+      # https://github.com/NixOS/nixpkgs/pull/25311#issuecomment-609417621
+      "systemd-udev-settle.service"
    ];

    systemd.services.display-manager.after = [
@ -197,6 +200,7 @@ in
      "getty@tty${gdm.initialVT}.service"
      "plymouth-quit.service"
      "plymouth-start.service"
+      "systemd-udev-settle.service"
    ];
    systemd.services.display-manager.conflicts = [
       "getty@tty${gdm.initialVT}.service"
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -112,7 +112,8 @@ in rec {
      "nixos.tests.nfs4.simple.x86_64-linux"
      "nixos.tests.openssh.x86_64-linux"
      "nixos.tests.pantheon.x86_64-linux"
-      "nixos.tests.php-pcre.x86_64-linux"
+      "nixos.tests.php.fpm.x86_64-linux"
+      "nixos.tests.php.pcre.x86_64-linux"
      "nixos.tests.plasma5.x86_64-linux"
      "nixos.tests.predictable-interface-names.predictableNetworkd.x86_64-linux"
      "nixos.tests.predictable-interface-names.predictable.x86_64-linux"
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@ -40,7 +40,7 @@ in rec {
        nat
        nfs3
        openssh
-        php-pcre
+        php
        predictable-interface-names
        proxy
        simple;
@ -108,7 +108,8 @@ in rec {
        "nixos.tests.nat.standalone.x86_64-linux"
        "nixos.tests.nfs3.simple.x86_64-linux"
        "nixos.tests.openssh.x86_64-linux"
-        "nixos.tests.php-pcre.x86_64-linux"
+        "nixos.tests.php.fpm.x86_64-linux"
+        "nixos.tests.php.pcre.x86_64-linux"
        "nixos.tests.predictable-interface-names.predictable.x86_64-linux"
        "nixos.tests.predictable-interface-names.predictableNetworkd.x86_64-linux"
        "nixos.tests.predictable-interface-names.unpredictable.x86_64-linux"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -241,7 +241,7 @@ in
  peerflix = handleTest ./peerflix.nix {};
  pgjwt = handleTest ./pgjwt.nix {};
  pgmanage = handleTest ./pgmanage.nix {};
-  php-pcre = handleTest ./php-pcre.nix {};
+  php = handleTest ./php {};
  plasma5 = handleTest ./plasma5.nix {};
  plotinus = handleTest ./plotinus.nix {};
  postgis = handleTest ./postgis.nix {};
--- a/nixos/tests/ceph-multi-node.nix
+++ b/nixos/tests/ceph-multi-node.nix
@ -183,15 +183,15 @@ let
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")

    monA.succeed(
-        "ceph osd pool create multi-node-test 100 100",
+        "ceph osd pool create multi-node-test 128 128",
        "ceph osd pool ls | grep 'multi-node-test'",
        "ceph osd pool rename multi-node-test multi-node-other-test",
        "ceph osd pool ls | grep 'multi-node-other-test'",
    )
-    monA.wait_until_succeeds("ceph -s | grep '1 pools, 100 pgs'")
+    monA.wait_until_succeeds("ceph -s | grep '1 pools, 128 pgs'")
    monA.succeed("ceph osd pool set multi-node-other-test size 2")
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    monA.wait_until_succeeds("ceph -s | grep '100 active+clean'")
+    monA.wait_until_succeeds("ceph -s | grep '128 active+clean'")
    monA.fail(
        "ceph osd pool ls | grep 'multi-node-test'",
        "ceph osd pool delete multi-node-other-test multi-node-other-test --yes-i-really-really-mean-it",
--- a/nixos/tests/ceph-single-node.nix
+++ b/nixos/tests/ceph-single-node.nix
@ -143,12 +143,12 @@ let
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")

    monA.succeed(
-        "ceph osd pool create single-node-test 100 100",
+        "ceph osd pool create single-node-test 128 128",
        "ceph osd pool ls | grep 'single-node-test'",
        "ceph osd pool rename single-node-test single-node-other-test",
        "ceph osd pool ls | grep 'single-node-other-test'",
    )
-    monA.wait_until_succeeds("ceph -s | grep '1 pools, 100 pgs'")
+    monA.wait_until_succeeds("ceph -s | grep '1 pools, 128 pgs'")
    monA.succeed(
        "ceph osd getcrushmap -o crush",
        "crushtool -d crush -o decrushed",
@ -158,7 +158,7 @@ let
        "ceph osd pool set single-node-other-test size 2",
    )
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    monA.wait_until_succeeds("ceph -s | grep '100 active+clean'")
+    monA.wait_until_succeeds("ceph -s | grep '128 active+clean'")
    monA.fail(
        "ceph osd pool ls | grep 'multi-node-test'",
        "ceph osd pool delete single-node-other-test single-node-other-test --yes-i-really-really-mean-it",
--- a/nixos/tests/php/default.nix
+++ b/nixos/tests/php/default.nix
@ -0,0 +1,7 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../../.. { inherit system config; }
+}: {
+  fpm = import ./fpm.nix { inherit system pkgs; };
+  pcre = import ./pcre.nix { inherit system pkgs; };
+}
--- a/nixos/tests/php/fpm.nix
+++ b/nixos/tests/php/fpm.nix
@ -0,0 +1,55 @@
+import ../make-test-python.nix ({pkgs, ...}: {
+  name = "php-fpm-nginx-test";
+  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ etu ];
+
+  machine = { config, lib, pkgs, ... }: {
+    services.nginx = {
+      enable = true;
+
+      virtualHosts."phpfpm" = let
+        testdir = pkgs.writeTextDir "web/index.php" "<?php phpinfo();";
+      in {
+        root = "${testdir}/web";
+        locations."~ \.php$".extraConfig = ''
+          fastcgi_pass unix:${config.services.phpfpm.pools.foobar.socket};
+          fastcgi_index index.php;
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          include ${pkgs.nginx}/conf/fastcgi.conf;
+        '';
+        locations."/" = {
+          tryFiles = "$uri $uri/ index.php";
+          index = "index.php index.html index.htm";
+        };
+      };
+    };
+
+    services.phpfpm.pools."foobar" = {
+      user = "nginx";
+      settings = {
+        "listen.group" = "nginx";
+        "listen.mode" = "0600";
+        "listen.owner" = "nginx";
+        "pm" = "dynamic";
+        "pm.max_children" = 5;
+        "pm.max_requests" = 500;
+        "pm.max_spare_servers" = 3;
+        "pm.min_spare_servers" = 1;
+        "pm.start_servers" = 2;
+      };
+    };
+  };
+  testScript = { ... }: ''
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("phpfpm-foobar.service")
+
+    # Check so we get an evaluated PHP back
+    assert "PHP Version ${pkgs.php.version}" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+
+    # Check so we have database and some other extensions loaded
+    assert "json" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "opcache" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "pdo_mysql" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "pdo_pgsql" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+    assert "pdo_sqlite" in machine.succeed("curl -vvv -s http://127.0.0.1:80/")
+  '';
+})
--- a/nixos/tests/php/pcre.nix
+++ b/nixos/tests/php/pcre.nix
@ -1,7 +1,6 @@
-
-let testString = "can-use-subgroups"; in
-
-import ./make-test-python.nix ({ ...}: {
+let
+  testString = "can-use-subgroups";
+in import ../make-test-python.nix ({ ...}: {
  name = "php-httpd-pcre-jit-test";
  machine = { lib, pkgs, ... }: {
    time.timeZone = "UTC";
@ -10,15 +9,13 @@ import ./make-test-python.nix ({ ...}: {
      adminAddr = "please@dont.contact";
      enablePHP = true;
      phpOptions = "pcre.jit = true";
-      extraConfig =
-      let
+      extraConfig = let
        testRoot = pkgs.writeText "index.php"
-        ''
-          <?php
+          ''
+            <?php
            preg_match('/(${testString})/', '${testString}', $result);
            var_dump($result);
-          ?>
-        '';
+          '';
      in
        ''
          Alias / ${testRoot}/
@ -30,11 +27,11 @@ import ./make-test-python.nix ({ ...}: {
    };
  };
  testScript = { ... }:
-  ''
-    machine.wait_for_unit("httpd.service")
-    # Ensure php evaluation by matching on the var_dump syntax
-    assert 'string(${toString (builtins.stringLength testString)}) "${testString}"' in machine.succeed(
-        "curl -vvv -s http://127.0.0.1:80/index.php"
-    )
-  '';
+    ''
+      machine.wait_for_unit("httpd.service")
+      # Ensure php evaluation by matching on the var_dump syntax
+      assert 'string(${toString (builtins.stringLength testString)}) "${testString}"' in machine.succeed(
+          "curl -vvv -s http://127.0.0.1:80/index.php"
+      )
+    '';
 })
--- a/nixos/tests/rxe.nix
+++ b/nixos/tests/rxe.nix
@ -28,7 +28,7 @@ in {
    # Test if rxe interface comes up
    server.wait_for_unit("default.target")
    server.succeed("systemctl status rxe.service")
-    server.succeed("ibv_devices | grep rxe0")
+    server.succeed("ibv_devices | grep rxe_eth1")

    client.wait_for_unit("default.target")

--- a/pkgs/applications/accessibility/contrast/default.nix
+++ b/pkgs/applications/accessibility/contrast/default.nix
@ -40,6 +40,7 @@ rustPlatform.buildRustPackage rec {
    pkgconfig
    python3
    wrapGAppsHook
+    glib # for glib-compile-resources
  ];

  buildInputs = [
--- a/pkgs/applications/audio/bshapr/default.nix
+++ b/pkgs/applications/audio/bshapr/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "BShapr";
-  version = "0.7";
+  version = "0.8";

  src = fetchFromGitHub {
    owner = "sjaehn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1422xay28jkmqlj5y4vhb57kljy6ysvxh20cxpfxm980m8n54gq5";
+    sha256 = "0jlq5rjicc4fxlpk869dg0l5bwwz8k9aj2wfk9v89b0qw8l8kaxl";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/audio/jackmix/default.nix
+++ b/pkgs/applications/audio/jackmix/default.nix
@ -9,9 +9,8 @@ stdenv.mkDerivation {

  patches = [ ./no_error.patch ];

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ scons.py2 pkgconfig ];
  buildInputs = [
-    scons
    qt4
    lash
    jack
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -28,10 +28,11 @@ mkDerivation rec {
    sha256 = "1h7q25fv62c5m74d4cn1m6mpanmqpbl2wqbch4qvn488jb2jw1dv";
  };

+  nativeBuildInputs = [ scons.py2 ];
  buildInputs = [
    chromaprint fftw flac faad2 glibcLocales mp4v2 libid3tag libmad libopus libshout241 libsndfile
    libusb1 libvorbis libxcb libGLU lilv lv2 opusfile pkgconfig portaudio portmidi protobuf qtbase qtscript qtsvg
-    qtx11extras rubberband scons sqlite taglib upower vamp-plugin-sdk
+    qtx11extras rubberband sqlite taglib upower vamp-plugin-sdk
  ];

  enableParallelBuilding = true;
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -4,13 +4,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "mopidy";
-  version = "3.0.1";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "mopidy";
    repo = "mopidy";
    rev = "v${version}";
-    sha256 = "0fpjprjw143ixak68iwxjpscdjgyb7rsr1cxj7fsdrw6hc83nq4z";
+    sha256 = "1n9lpgq0p112cjgsrc1cd6mnffk56y36g2c5skk9cqzw27qrkd15";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
@ -32,7 +32,7 @@ python3Packages.buildPythonApplication rec {
  '';

  meta = with stdenv.lib; {
-    homepage = https://www.mopidy.com/;
+    homepage = "https://www.mopidy.com/";
    description = ''
      An extensible music server that plays music from local disk, Spotify,
      SoundCloud, Google Play Music, and more
--- a/pkgs/applications/audio/rhvoice/default.nix
+++ b/pkgs/applications/audio/rhvoice/default.nix
@ -15,7 +15,7 @@ in stdenv.mkDerivation {
  };

  nativeBuildInputs = [
-    scons pkgconfig
+    scons.py2 pkgconfig
  ];

  buildInputs = [
--- a/pkgs/applications/audio/sound-juicer/default.nix
+++ b/pkgs/applications/audio/sound-juicer/default.nix
@ -27,7 +27,6 @@ in stdenv.mkDerivation rec{
  passthru = {
    updateScript = gnome3.updateScript {
      packageName = pname;
-      attrPath = "gnome3.${pname}";
    };
  };

--- a/pkgs/applications/blockchains/tessera.nix
+++ b/pkgs/applications/blockchains/tessera.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "tessera";
-  version = "0.10.4";
+  version = "0.10.2";

  src = fetchurl {
    url = "https://oss.sonatype.org/service/local/repositories/releases/content/com/jpmorgan/quorum/${pname}-app/${version}/${pname}-app-${version}-app.jar";
-    sha256 = "1sqj0mc80922yavx9hlwnl1kpmavpza2g2aycz1qd0zv0s31z9wj";
+    sha256 = "1zn8w7q0q5man0407kb82lw4mlvyiy9whq2f6izf2b5415f9s0m4";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/aseprite/default.nix
+++ b/pkgs/applications/editors/aseprite/default.nix
@ -98,6 +98,8 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  passthru = { inherit skia; };
+
  meta = with lib; {
    homepage = https://www.aseprite.org/;
    description = "Animated sprite editor & pixel art tool";
--- a/pkgs/applications/editors/aseprite/skia.nix
+++ b/pkgs/applications/editors/aseprite/skia.nix
@ -6,6 +6,14 @@
 let
  # skia-deps.nix is generated by: ./skia-make-deps.sh 'angle2|dng_sdk|piex|sfntly'
  depSrcs = import ./skia-deps.nix { inherit fetchgit; };
+  gnOld = gn.overrideAttrs (oldAttrs: rec {
+    version = "20190403";
+    src = fetchgit {
+      url = "https://gn.googlesource.com/gn";
+      rev = "64b846c96daeb3eaf08e26d8a84d8451c6cb712b";
+      sha256 = "1v2kzsshhxn0ck6gd5w16gi2m3higwd9vkyylmsczxfxnw8skgpy";
+    };
+  });
 in
 stdenv.mkDerivation {
  name = "skia-aseprite-m71";
@ -14,11 +22,11 @@ stdenv.mkDerivation {
    owner = "aseprite";
    repo = "skia";
    # latest commit from aseprite-m71 branch
-    rev = "89e4ca4352d05adc892f5983b108433f29b2c0c2";
+    rev = "89e4ca4352d05adc892f5983b108433f29b2c0c2"; # TODO: Remove the gnOld override
    sha256 = "0n3vrkswvi6rib9zv2pzi18h3j5wm7flmgkgaikcm6q7iw4l2c7x";
  };

-  nativeBuildInputs = [ python2 gn ninja ];
+  nativeBuildInputs = [ python2 gnOld ninja ];

  buildInputs = [
    fontconfig expat icu58 libglvnd libjpeg libpng libwebp zlib
--- a/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
@ -58556,7 +58556,7 @@
    1434
   ],
   "commit": "1f596a93b3f1caadd7bba01030f8c179b029600b",
-   "sha256": "0fdnkv37m7nf8yjjf01c856g2wrzyzqicv67fnbrnx7abrrfb1nd"
+   "sha256": "0swnan2v2lc7s1jsnmkyzv7gajx08akgm6dvbsgm5hzp0mjbbpy4"
  },
  "stable": {
   "version": [
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@ -5,7 +5,6 @@
 , docbook_xsl
 , docbook_xml_dtd_43
 , fetchurl
-, fetchpatch
 , flatpak
 , gnome3
 , libgit2-glib
@ -18,6 +17,7 @@
 , jsonrpc-glib
 , libdazzle
 , libpeas
+, libportal
 , libxml2
 , meson
 , ninja
@ -39,25 +39,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-builder";
-  version = "3.34.1";
+  version = "3.36.0";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "19018pq94cxf6fywd7fsmy98x56by5zfmh140pl530gaaw84cvhb";
+    sha256 = "G0nl6DVzb3k6cN2guFIe/XNhFNhKbaq5e8wz62VA0Qo=";
  };

-  patches = [
-    # Fix build with Meson 0.52
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-builder/commit/c8b862b491cfbbb4f79b24d7cd90e4fb1f37cb9f.patch";
-      sha256 = "0n8kg7nnjqmbnyag1ps6dvrlqrxc94djjncqx10d6y7ijwdxf4w8";
-    })
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-builder/commit/da26dfbf78468f5ed724e022b300a07862a95833.patch";
-      sha256 = "0psa65bzjpjj7vc5rknv2w2dz3p50jjv10s6j2fd6lpw8j2800k4";
-    })
-  ];
-
  nativeBuildInputs = [
    appstream-glib
    desktop-file-utils
@ -65,7 +53,7 @@ stdenv.mkDerivation rec {
    docbook_xml_dtd_43
    gobject-introspection
    gtk-doc
-    (meson.override ({ inherit stdenv; }))
+    meson
    ninja
    pkgconfig
    python3
@ -80,6 +68,7 @@ stdenv.mkDerivation rec {
    gnome3.glade
    libgit2-glib
    libpeas
+    libportal
    vte
    gspell
    gtk3
@ -109,8 +98,6 @@ stdenv.mkDerivation rec {
    patchShebangs build-aux/meson/post_install.py
  '';

-  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
-
  mesonFlags = [
    "-Dpython_libprefix=${python3.libPrefix}"
    "-Ddocs=true"
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage = http://kakoune.org/;
+    homepage = "http://kakoune.org/";
    description = "A vim inspired text editor";
    license = licenses.publicDomain;
    maintainers = with maintainers; [ vrthra ];
--- a/pkgs/applications/graphics/fluxus/default.nix
+++ b/pkgs/applications/graphics/fluxus/default.nix
@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
    openssl.dev
    racket
  ];
-  nativeBuildInputs = [ scons ];
+  nativeBuildInputs = [ scons.py2 ];

  patches = [ ./fix-build.patch ];
  sconsFlags = [
--- a/pkgs/applications/kde/kitinerary.nix
+++ b/pkgs/applications/kde/kitinerary.nix
@ -2,6 +2,7 @@
  mkDerivation, lib, extra-cmake-modules
 , qtbase, qtdeclarative, ki18n, kmime, kpkpass
 , poppler, kcontacts, kcalendarcore
+, shared-mime-info
 }:

 mkDerivation {
@ -10,7 +11,10 @@ mkDerivation {
    license = with lib.licenses; [ lgpl21 ];
    maintainers = [ lib.maintainers.bkchr ];
  };
-  nativeBuildInputs = [ extra-cmake-modules ];
+  nativeBuildInputs = [
+    extra-cmake-modules
+    shared-mime-info # for update-mime-database
+  ];
  buildInputs = [
    qtbase qtdeclarative ki18n kmime kpkpass poppler
    kcontacts kcalendarcore
--- a/pkgs/applications/misc/gpsprune/default.nix
+++ b/pkgs/applications/misc/gpsprune/default.nix
@ -1,16 +1,16 @@
-{ fetchurl, stdenv, makeDesktopItem, makeWrapper, unzip, jre8 }:
+{ fetchurl, stdenv, makeDesktopItem, makeWrapper, unzip, jdk11 }:

 stdenv.mkDerivation rec {
  pname = "gpsprune";
-  version = "19.2";
+  version = "20";

  src = fetchurl {
    url = "https://activityworkshop.net/software/gpsprune/gpsprune_${version}.jar";
-    sha256 = "1q2kpkkh75b9l1x7fkmv88s8k84gzcdnrg5sgf8ih0zrp49lawg9";
+    sha256 = "1i9p6h98azgradrrkcwx18zwz4c6zkxp4bfykpa2imi1z3ry5q2b";
  };

  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ jre8 ];
+  buildInputs = [ jdk11 ];

  desktopItem = makeDesktopItem {
    name = "gpsprune";
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
  buildCommand = ''
    mkdir -p $out/bin $out/share/java
    cp -v $src $out/share/java/gpsprune.jar
-    makeWrapper ${jre8}/bin/java $out/bin/gpsprune \
+    makeWrapper ${jdk11}/bin/java $out/bin/gpsprune \
      --add-flags "-jar $out/share/java/gpsprune.jar"
    mkdir -p $out/share/applications
    cp $desktopItem/share/applications"/"* $out/share/applications
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Application for viewing, editing and converting GPS coordinate data";
-    homepage = https://activityworkshop.net/software/gpsprune/;
+    homepage = "https://activityworkshop.net/software/gpsprune/";
    license = licenses.gpl2Plus;
    maintainers = [ maintainers.rycee ];
    platforms = platforms.all;
--- a/pkgs/applications/misc/khard/default.nix
+++ b/pkgs/applications/misc/khard/default.nix
@ -1,12 +1,12 @@
 { stdenv, glibcLocales, python3 }:

 python3.pkgs.buildPythonApplication rec {
-  version = "0.15.1";
+  version = "0.16.0";
  pname = "khard";

  src = python3.pkgs.fetchPypi {
    inherit pname version;
-    sha256 = "18ba2xgfq8sw0bg6xmlfjpizid1hkzgswcfcc54gl21y2dwfda2w";
+    sha256 = "0a1zpkq0pplmn9flxczq2wafs6zc07r9xx9qi6dqmyv9mhy9d87f";
  };

  propagatedBuildInputs = with python3.pkgs; [
@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
  '';

  meta = {
-    homepage = https://github.com/scheibler/khard;
+    homepage = "https://github.com/scheibler/khard";
    description = "Console carddav client";
    license = stdenv.lib.licenses.gpl3;
    maintainers = with stdenv.lib.maintainers; [ matthiasbeyer ];
--- a/pkgs/applications/misc/mwic/default.nix
+++ b/pkgs/applications/misc/mwic/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, pythonPackages }:

 stdenv.mkDerivation rec {
-  version = "0.7.7";
+  version = "0.7.8";
  pname = "mwic";

  src = fetchurl {
    url = "https://github.com/jwilk/mwic/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0l4anwiiqclymx0awwn4hzaj8n26ycg8nz76wjphsyscn7z2awad";
+    sha256 = "0nnhziz9v523hpciylnxfajmxabh2ig5iawzwrfpf7aww70v330x";
  };

  makeFlags=["PREFIX=\${out}"];
--- a/pkgs/applications/misc/orca/default.nix
+++ b/pkgs/applications/misc/orca/default.nix
@ -35,13 +35,13 @@

 buildPythonApplication rec {
  pname = "orca";
-  version = "3.34.2";
+  version = "3.36.0";

  format = "other";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0aaagz8mxvfigrsdbmg22q44vf5yhkbw4rh4cnizysbfvijk4dan";
+    sha256 = "0yrkl0j1mm4fd5zib8jvbfgm2iyanlx05vhhnmjcmvpm464c7pf9";
  };

  patches = [
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pueue";
-  version = "0.2.1";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "Nukesor";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1yx69pwdal0p5dfhabjdns9z6z3fa41wh7bxa4dpsjx37ziglcsp";
+    sha256 = "11x4y3ah9f7mv9jssws95sw7rd20fxwdh11mrhcb4vwk59cmqsjz";
  };

-  cargoSha256 = "1ksr5fw9p3j1bnlgfimb5nsryb4si8ic2x4prsra1mwkc91hr7x3";
+  cargoSha256 = "06zv3li14sg4a8bgj38zzx576ggm32ss0djmys1g0h5a0nxaaqfx";

  checkPhase = "cargo test -- --skip test_single_huge_payload";

--- a/pkgs/applications/misc/rofi-emoji/0001-Patch-plugindir-to-output.patch
+++ b/pkgs/applications/misc/rofi-emoji/0001-Patch-plugindir-to-output.patch
@ -0,0 +1,25 @@
+From 695e7a441fc28b874e65917fe2c0059b5b8ca749 Mon Sep 17 00:00:00 2001
+From: Cole Helbling <cole.e.helbling@outlook.com>
+Date: Sat, 28 Mar 2020 23:46:03 -0700
+Subject: [PATCH] Patch plugindir to output
+
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 75e476f..cb1ddf7 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -55,7 +55,7 @@ PKG_CHECK_MODULES([glib],     [glib-2.0 >= 2.40 gio-unix-2.0 gmodule-2.0 ])
+ PKG_CHECK_MODULES([cairo],    [cairo])
+ PKG_CHECK_MODULES([rofi],     [rofi])
+ 
+-[rofi_PLUGIN_INSTALL_DIR]="`$PKG_CONFIG --variable=pluginsdir rofi`"
+[rofi_PLUGIN_INSTALL_DIR]="`echo $out/lib/rofi`"
+ AC_SUBST([rofi_PLUGIN_INSTALL_DIR])
+ 
+ LT_INIT([disable-static])
+-- 
+2.25.1
+
--- a/pkgs/applications/misc/rofi-emoji/default.nix
+++ b/pkgs/applications/misc/rofi-emoji/default.nix
@ -0,0 +1,69 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, substituteAll
+, makeWrapper
+
+, autoreconfHook
+, pkgconfig
+
+, cairo
+, glib
+, libnotify
+, rofi-unwrapped
+, wl-clipboard
+, xclip
+, xsel
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rofi-emoji";
+  version = "2.1.2";
+
+  src = fetchFromGitHub {
+    owner = "Mange";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0knsvsdff2c7ww94120bq92735qrfriyd28mi0n72ccb2iikyi8b";
+  };
+
+  patches = [
+    # Look for plugin-related files in $out/lib/rofi
+    ./0001-Patch-plugindir-to-output.patch
+  ];
+
+  postPatch = ''
+    patchShebangs clipboard-adapter.sh
+  '';
+
+  postFixup = ''
+    chmod +x $out/share/rofi-emoji/clipboard-adapter.sh
+    wrapProgram $out/share/rofi-emoji/clipboard-adapter.sh \
+      --prefix PATH ":" ${lib.makeBinPath [ libnotify wl-clipboard xclip xsel ]}
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    cairo
+    glib
+    libnotify
+    makeWrapper
+    rofi-unwrapped
+    wl-clipboard
+    xclip
+    xsel
+  ];
+
+  meta = with lib; {
+    description = "An emoji selector plugin for Rofi";
+    homepage = "https://github.com/Mange/rofi-emoji";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cole-h ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/rofi/wrapper.nix
+++ b/pkgs/applications/misc/rofi/wrapper.nix
@ -18,6 +18,7 @@ symlinkJoin {
    rm $out/bin/rofi
    makeWrapper ${rofi-unwrapped}/bin/rofi $out/bin/rofi \
      --prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share \
+      ${lib.optionalString (plugins != []) ''--prefix XDG_DATA_DIRS : ${lib.concatStringsSep ":" (lib.forEach plugins (p: "${p.out}/share"))}''} \
      ${lib.optionalString (theme != null) ''--add-flags "-theme ${theme}"''} \
      ${lib.optionalString (plugins != []) ''--add-flags "-plugin-path $out/lib/rofi"''}

--- a/pkgs/applications/misc/tut/default.nix
+++ b/pkgs/applications/misc/tut/default.nix
@ -0,0 +1,24 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "tut";
+  version = "0.0.2";
+
+  goPackagePath = "github.com/RasmusLindroth/tut";
+  goDeps = ./deps.nix;
+
+  src = fetchFromGitHub {
+    owner = "RasmusLindroth";
+    repo = pname;
+    rev = version;
+    sha256 = "0c44mgkmjnfpf06cj63i6mscxcsm5cipm0l4n6pjxhc7k3qhgsfw";
+  };
+
+  meta = with stdenv.lib; {
+    description = "A TUI for Mastodon with vim inspired keys";
+    homepage = "https://github.com/RasmusLindroth/tut";
+    license = licenses.mit;
+    maintainers = with maintainers; [ equirosa ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/misc/tut/deps.nix
+++ b/pkgs/applications/misc/tut/deps.nix
@ -0,0 +1,273 @@
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
+[
+  {
+    goPackagePath = "github.com/BurntSushi/toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/BurntSushi/toml";
+      rev = "v0.3.1";
+      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
+    };
+  }
+  {
+    goPackagePath = "github.com/DATA-DOG/go-sqlmock";
+    fetch = {
+      type = "git";
+      url = "https://github.com/DATA-DOG/go-sqlmock";
+      rev = "v1.3.3";
+      sha256 = "1xrly2vmy1mgj9dbkmivhh8gvq6v9f9xy2yp2dw54i1895zzs928";
+    };
+  }
+  {
+    goPackagePath = "github.com/PuerkitoBio/goquery";
+    fetch = {
+      type = "git";
+      url = "https://github.com/PuerkitoBio/goquery";
+      rev = "v1.5.0";
+      sha256 = "1fqf4rs66wy02nxz6w4mvs2qawf2j8srz17i294v64y8gvxisp56";
+    };
+  }
+  {
+    goPackagePath = "github.com/andybalholm/cascadia";
+    fetch = {
+      type = "git";
+      url = "https://github.com/andybalholm/cascadia";
+      rev = "v1.0.0";
+      sha256 = "09j8cavbhqqdxjqrkwbc40g8p0i49zf3184rpjm5p2rjbprcghcc";
+    };
+  }
+  {
+    goPackagePath = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.1";
+      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
+    };
+  }
+  {
+    goPackagePath = "github.com/fatih/color";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fatih/color";
+      rev = "v1.9.0";
+      sha256 = "086z8ssmr1fn9ba4mqnw7pnccfpys6l5yfhvycv1gdrsk7n27mvs";
+    };
+  }
+  {
+    goPackagePath = "github.com/gdamore/encoding";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gdamore/encoding";
+      rev = "v1.0.0";
+      sha256 = "1vmm5zll92i2fm4ajqx0gyx0p9j36496x5nabi3y0x7h0inv0pk9";
+    };
+  }
+  {
+    goPackagePath = "github.com/gdamore/tcell";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gdamore/tcell";
+      rev = "v1.3.0";
+      sha256 = "1csg9qkmbg4ksj5247kgqcy7bxvqgz6b98r0rv2s4c1mkc99gx2r";
+    };
+  }
+  {
+    goPackagePath = "github.com/gorilla/websocket";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gorilla/websocket";
+      rev = "v1.4.1";
+      sha256 = "03n1n0nwz3k9qshmriycqznnnvd3dkzsfwpnfjzzvafjxk9kyapv";
+    };
+  }
+  {
+    goPackagePath = "github.com/kyoh86/xdg";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kyoh86/xdg";
+      rev = "v1.2.0";
+      sha256 = "0a5nz53fdz1c2qvwlf2dpjdd72nxri95i6q4b07c37kiipgaxncn";
+    };
+  }
+  {
+    goPackagePath = "github.com/lucasb-eyer/go-colorful";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lucasb-eyer/go-colorful";
+      rev = "v1.0.3";
+      sha256 = "12bgz6dxbb2ki1g3x7fg9ipsjgfkd58fp7cdpv63h4kvlj2n7j69";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-colorable";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-colorable";
+      rev = "v0.1.4";
+      sha256 = "1yxcz08kminqr1221zxpibnbzfcgs3fafin0z9zqb3gqvf74jywz";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-isatty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-isatty";
+      rev = "v0.0.11";
+      sha256 = "0h671sv7hfprja495kavazkalkx7xzaqksjh13brcnwq67ijrali";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-mastodon";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-mastodon";
+      rev = "3e91c76504df";
+      sha256 = "1wh2hqrzx80gfs1y34f4h68mnz83asx88v0bsw372ch5j1shswlr";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "v0.0.8";
+      sha256 = "14ilkbhnhl8yj443dd1ga4biapswv4g0b4vm2mix78a8srdww39j";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-tty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-tty";
+      rev = "v0.0.3";
+      sha256 = "0d1d63q02pc5k5ga8bw4yjbkrli2769vg237psajsskjirjy53vf";
+    };
+  }
+  {
+    goPackagePath = "github.com/microcosm-cc/bluemonday";
+    fetch = {
+      type = "git";
+      url = "https://github.com/microcosm-cc/bluemonday";
+      rev = "v1.0.2";
+      sha256 = "0j0aylsxqjcj49w7ph8cmpaqjlpvg7mb5mrcrd9bg71dlb9z9ir2";
+    };
+  }
+  {
+    goPackagePath = "github.com/pelletier/go-toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pelletier/go-toml";
+      rev = "v1.6.0";
+      sha256 = "0l2830pi64fg0bdsyd5afkbw0p7879pppzdqqk3c7vjrjfmi5xbq";
+    };
+  }
+  {
+    goPackagePath = "github.com/rivo/tview";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rivo/tview";
+      rev = "cd38d7432498";
+      sha256 = "1rs048gf1jip0p20qir99vy5k0f3m54h7bh56l1sh8lxij5qj406";
+    };
+  }
+  {
+    goPackagePath = "github.com/rivo/uniseg";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rivo/uniseg";
+      rev = "v0.1.0";
+      sha256 = "0flpc1px1l6b1lxzhdxi0mvpkkjchppvgxshxxnlmm40s76i9ww5";
+    };
+  }
+  {
+    goPackagePath = "github.com/tomnomnom/linkheader";
+    fetch = {
+      type = "git";
+      url = "https://github.com/tomnomnom/linkheader";
+      rev = "02ca5825eb80";
+      sha256 = "1ghrv28vrvvrpyr4d4q817yby8g1j04mid8ql00sds1pvfv67d32";
+    };
+  }
+  {
+    goPackagePath = "github.com/urfave/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/cli";
+      rev = "v1.20.0";
+      sha256 = "0y6f4sbzkiiwrxbl15biivj8c7qwxnvm3zl2dd3mw4wzg4x10ygj";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "c2843e01d9a2";
+      sha256 = "01xgxbj5r79nmisdvpq48zfy8pzaaj90bn6ngd4nf33j9ar1dp8r";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "118fecf932d8";
+      sha256 = "1rwrqfwh2yhnnhy7x0mbmlmk0rg1mi2jjad476y45i259a0c2ym6";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev = "cd5d95a43a6e";
+      sha256 = "1nqkyz2y1qvqcma52ijh02s8aiqmkfb95j08f6zcjhbga3ds6hds";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "12a6c2dcc1e4";
+      sha256 = "0z1g49d36kh459dz0xhnss2f88vw7n5b3l3637v46f7daddvln67";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/text";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/text";
+      rev = "v0.3.2";
+      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev = "90fa682c2a6e";
+      sha256 = "03ic2xsy51jw9749wl7gszdbz99iijbd2bckgygl6cm9w5m364ak";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/check.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/check.v1";
+      rev = "20d25e280405";
+      sha256 = "0k1m83ji9l1a7ng8a7v40psbymxasmssbrrhpdv2wl4rhs0nc3np";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "v2.2.4";
+      sha256 = "11bwj757wi8kdrcnlgfqb8vv2d2xdhlghmyagd19i62khrkchsg2";
+    };
+  }
+]
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -82,11 +82,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.5.115";
+  version = "1.5.123";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "04zyv5amqxax1z0da4bcgxwsq596zfs416nshg6ffg4ci9nfbiab";
+    sha256 = "1yv6hfjqzcd60b0bjpfbj8d4s2yf10swanxhbmnslcqp6ajb2nqr";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -1,4 +1,4 @@
-{ stdenv, llvmPackages, gn, ninja, which, nodejs, fetchpatch, gnutar
+{ stdenv, llvmPackages, gnChromium, ninja, which, nodejs, fetchpatch, gnutar

 # default dependencies
 , bzip2, flac, speex, libopus
@ -284,7 +284,7 @@ let
      libExecPath="${libExecPath}"
      python build/linux/unbundle/replace_gn_files.py \
        --system-libraries ${toString gnSystemLibraries}
-      ${gn}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
+      ${gnChromium}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt

      # Fail if `gn gen` contains a WARNING.
      grep -o WARNING gn-gen-outputs.txt && echo "Found gn WARNING, exiting nix build" && exit 1
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -1,6 +1,6 @@
 { newScope, config, stdenv, llvmPackages_9, llvmPackages_10
 , makeWrapper, ed
-, glib, gtk3, gnome3, gsettings-desktop-schemas
+, glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , gcc, nspr, nss, patchelfUnstable, runCommand
 , lib
@ -32,9 +32,20 @@ let

    upstream-info = (callPackage ./update.nix {}).getChannel channel;

-    mkChromiumDerivation = callPackage ./common.nix {
+    mkChromiumDerivation = callPackage ./common.nix ({
      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useVaapi useOzone;
-    };
+      gnChromium = gn;
+    } // lib.optionalAttrs (channel == "dev") {
+      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
+      gnChromium = gn.overrideAttrs (oldAttrs: {
+        version = "2020-03-23";
+        src = fetchgit {
+          url = "https://gn.googlesource.com/gn";
+          rev = "5ed3c9cc67b090d5e311e4bd2aba072173e82db9";
+          sha256 = "00y2d35wvqmx9glaqhfb62wdgbfpwr77v0934nnvh9ks71vnsjqy";
+        };
+      });
+    });

    browser = callPackage ./browser.nix { inherit channel enableWideVine; };

--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -1,4 +1,4 @@
-{ config, lib, callPackage, fetchurl }:
+{ config, stdenv, lib, callPackage, fetchurl }:

 let
  common = opts: callPackage (import ./common.nix opts) {};
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    ffversion = "74.0";
+    ffversion = "74.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "245n2ilfgx3rd0xlxzpg4gcwddcy0cgaqnaf5pwixjx0n8py1imiylwlsbihf70s41cq5q8awckchs287yysr4v6pdfqqbj7s0f02ki";
+      sha512 = "3aycj3wllsz97x30dxngpbwryqss209cisj91vs1yfgspp8nbl148fk37id6bgl33hga1irc4zxx7glmymibymkfkrmy0xx803w8dy4";
    };

    patches = [
@ -23,6 +23,8 @@ rec {
      maintainers = with lib.maintainers; [ eelco andir ];
      platforms = lib.platforms.unix;
      badPlatforms = lib.platforms.darwin;
+      broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
+                                             # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
      license = lib.licenses.mpl20;
    };
    updateScript = callPackage ./update.nix {
@ -33,10 +35,10 @@ rec {

  firefox-esr-68 = common rec {
    pname = "firefox-esr";
-    ffversion = "68.6.0esr";
+    ffversion = "68.6.1esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "2ipajk86s7hfz7qky9lh24i5fgzgpv9hl12invr1rr6jhpp0h6gbb44ffim0z9lmcj49cr01cgqis0swhb4vph8dl1jvgfq9rjmsml4";
+      sha512 = "1xg2hdk50ys9np5a0jdwr2wb543sq8ibmvr05h9apmb4yn1hhz3ml9yq9r4v2di4hnb3s181zvq4np5srka2v6aqz8rk7cq46096fls";
    };

    patches = [
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -17,11 +17,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "2.11.1811.51-1";
+  version = "2.11.1811.52-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "1a0qqkizidvaxvk9j9rqca1jxw17i1rkj83rz2ki3f09hnfssxn8";
+    sha256 = "0bq9ggk75xzka2nbrnc7vghq8s7jjy9nbfmyrf51kf0nni1zg1fp";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/pkgs/applications/networking/cluster/fluxctl/default.nix
@ -2,19 +2,21 @@

 buildGoModule rec {
  pname = "fluxctl";
-  version = "1.18.0";
+  version = "1.19.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = "flux";
    rev = version;
-    sha256 = "1sk82cnrj5ngcaml54rhh7ak8dg80r25623c4s8p7ybrj1m7krqj";
+    sha256 = "1w6ndp0nrpps6pkxnq38hikbnzwahi6j9gn8l0bxd0qkf7cjc5w0";
  };

-  modSha256 = "0ij5q31a0818nmqsdql1ii6rhq6nb0liplnw509qih8py7dk5xkg";
+  modSha256 = "0zwq7n1lggj27j5yxgfplbaccw5fhbm7vm0sja839r1jamrn3ips";

  subPackages = [ "cmd/fluxctl" ];

+  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
+
  meta = with stdenv.lib; {
    description = "CLI client for Flux, the GitOps Kubernetes operator";
    homepage = "https://github.com/fluxcd/flux";
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@ -0,0 +1,235 @@
+{ stdenv, lib, makeWrapper, socat, iptables, iproute, bridge-utils
+, conntrack-tools, buildGoPackage, git, runc, libseccomp, pkgconfig
+, autoPatchelfHook, breakpointHook, ethtool, utillinux, ipset
+, fetchFromGitHub, fetchurl, fetchzip, fetchgit
+}:
+
+with lib;
+
+# k3s is a kinda weird derivation. One of the main points of k3s is the
+# simplicity of it being one binary that can perform several tasks.
+# However, when you have a good package manager (like nix), that doesn't
+# actually make much of a difference; you don't really care if it's one binary
+# or 10 since with a good package manager, installing and running it is
+# identical.
+# Since upstream k3s packages itself as one large binary with several
+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
+# some exceptions.
+# K3s also carries patches to some packages (such as containerd and cni
+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
+# even if the upstream version of those binaries exist in nixpkgs already. In
+# the end, that means we have a thick k3s binary that behaves like the upstream
+# one for the most part.
+# However, k3s also bundles several pieces of unpatched software, from the
+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
+# Those pieces of software we entirely ignore upstream's handling of, and just
+# make sure they're in the path if desired.
+let
+  k3sVersion = "1.17.3+k3s1";     # k3s git tag
+  traefikChartVersion = "1.81.0"; # taken from ./scripts/version.sh at the above k3s tag
+  k3sRootVersion = "0.3.0";       # taken from .s/cripts/version.sh at the above k3s tag
+  # bundled into the k3s binary
+  traefikChart = fetchurl {
+    url = "https://kubernetes-charts.storage.googleapis.com/traefik-${traefikChartVersion}.tgz";
+    sha256 = "1aqpzgjlvqhil0g3angz94zd4xbl4iq0qmpjcy5aq1xv9qciwdi9";
+  };
+  # so, k3s is a complicated thing to package
+  # This derivation attempts to avoid including any random binaries from the
+  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
+  # we don't care about doing, we can add those as build or runtime
+  # dependencies using a real package manager).
+  # In addition to those binaries, it's also configuration though (right now
+  # mostly strongswan configuration), and k3s does use those files.
+  # As such, we download it in order to grab 'etc' and bundle it into the final
+  # k3s binary.
+  k3sRoot = fetchzip {
+    # Note: marked as apache 2.0 license
+    url = "https://github.com/rancher/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
+    sha256 = "12xafn5jivl8lqdcs25b28xrc4mf7yf1xif5np169nvvxgvmpdxp";
+    stripRoot=false;
+  };
+  k3sPlugins = buildGoPackage rec {
+    name = "k3s-cni-plugins";
+    version = "0.7.6-k3s1"; # from ./scripts/version.sh 'VERSION_CNIPLUGINS'; update when k3s's repo is updated.
+
+    goPackagePath = "github.com/containernetworking/plugins";
+    subPackages = [ "." ];
+
+    src = fetchFromGitHub {
+      owner = "rancher";
+      repo = "plugins";
+      rev = "v${version}";
+      sha256 = "0ax72z1ziann352bp6khfds8vlf3bbkqckrkpx4l4jxgqks45izs";
+    };
+
+    meta = {
+      description = "k3s-cni-plugins";
+      license = licenses.asl20;
+      homepage = https://k3s.io;
+      maintainers = [];
+      platforms = platforms.linux;
+    };
+  };
+  # Grab this separately from a build because it's used by both stages of the
+  # k3s build.
+  k3sRepo = fetchgit {
+    url = "https://github.com/rancher/k3s";
+    rev = "v${k3sVersion}";
+    leaveDotGit = true; # for version / build date below
+    sha256 = "0qahyc0mf9glxj49va6d20mcncqg4svfic2iz8b1lqid5c4g68mm";
+  };
+  # Stage 1 of the k3s build:
+  # Let's talk about how k3s is structured.
+  # One of the ideas of k3s is that there's the single "k3s" binary which can
+  # do everything you need, from running a k3s server, to being a worker node,
+  # to running kubectl.
+  # The way that actually works is that k3s is a single go binary that contains
+  # a bunch of bindata that it unpacks at runtime into directories (either the
+  # user's home directory or /var/lib/rancher if run as root).
+  # This bindata includes both binaries and configuration.
+  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
+  # First, we build all the binaries that get packed into the thick k3s binary
+  # (and output them from one derivation so they'll all be suitably patched up).
+  # Then, we bundle those binaries into our thick k3s binary and use that as
+  # the final single output.
+  # This approach was chosen because it ensures the bundled binaries all are
+  # correctly built to run with nix (we can lean on the existing buildGoPackage
+  # stuff), and we can again lean on that tooling for the final k3s binary too.
+  # Other alternatives would be to manually run the
+  # strip/patchelf/remove-references step ourselves in the installPhase of the
+  # derivation when we've built all the binaries, but haven't bundled them in
+  # with generated bindata yet.
+  k3sBuildStage1 = buildGoPackage rec {
+    name = "k3s-build-1";
+    version = "${k3sVersion}";
+
+    goPackagePath = "github.com/rancher/k3s";
+
+    src = k3sRepo;
+
+    patches = [ ./patches/00-k3s.patch ];
+
+    nativeBuildInputs = [ pkgconfig autoPatchelfHook breakpointHook ];
+    buildInputs = [ git runc libseccomp ];
+
+    buildPhase = ''
+      pushd go/src/${goPackagePath}
+
+      patchShebangs ./scripts/build ./scripts/version.sh
+      mkdir -p bin
+      ./scripts/build
+
+      popd
+    '';
+
+    installPhase = ''
+      pushd go/src/${goPackagePath}
+
+      mkdir -p "$bin/bin"
+      install -m 0755 -t "$bin/bin" ./bin/*
+
+      popd
+    '';
+
+    meta = {
+      description = "The various binaries that get packaged into the final k3s binary.";
+      license = licenses.asl20;
+      homepage = https://k3s.io;
+      maintainers = [];
+      platforms = platforms.linux;
+    };
+  };
+  k3sBuild = buildGoPackage rec {
+    name = "k3s-build";
+    version = "${k3sVersion}";
+
+    goPackagePath = "github.com/rancher/k3s";
+
+    src = k3sRepo;
+
+    patches = [ ./patches/00-k3s.patch ];
+
+    nativeBuildInputs = [ pkgconfig autoPatchelfHook breakpointHook ];
+    buildInputs = [ git k3sBuildStage1 ];
+
+    # In order to build the thick k3s binary (which is what
+    # ./scripts/package-cli does), we need to get all the binaries that script
+    # expects in place.
+    buildPhase = ''
+      pushd go/src/${goPackagePath}
+
+      patchShebangs ./scripts/build ./scripts/version.sh ./scripts/package-cli
+
+      mkdir -p bin
+
+      install -m 0755 -t ./bin ${k3sBuildStage1}/bin/*
+      install -m 0755 -T "${k3sPlugins}/bin/plugins" ./bin/cni
+      # Note: use the already-nixpkgs-bundled k3s rather than the one bundled
+      # in k3s because the k3s one is completely unmodified from upstream
+      # (unlike containerd, cni, etc)
+      install -m 0755 -T "${runc}/bin/runc" ./bin/runc
+      cp -R "${k3sRoot}/etc" ./etc
+      mkdir -p "build/static/charts"
+      cp "${traefikChart}" "build/static/charts/traefik-${traefikChartVersion}.tgz"
+
+      ./scripts/package-cli
+
+      popd
+    '';
+
+    installPhase = ''
+      pushd go/src/${goPackagePath}
+
+      mkdir -p "$bin/bin"
+      install -m 0755 -t "$bin/bin" ./dist/artifacts/k3s
+
+      popd
+    '';
+
+    meta = {
+      description = "The k3s go binary which is used by the final wrapped output below.";
+      license = licenses.asl20;
+      homepage = https://k3s.io;
+      maintainers = [];
+      platforms = platforms.linux;
+    };
+  };
+in
+stdenv.mkDerivation rec {
+  name = "k3s";
+
+  # Important utilities used by  the kubelet, see
+  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
+  # Note the list in that issue is stale and some aren't relevant for k3s.
+  k3sRuntimeDeps = [ 
+    socat iptables iproute bridge-utils ethtool utillinux ipset conntrack-tools
+  ];
+
+  buildInputs = [ 
+    k3sBuild makeWrapper
+  ] ++ k3sRuntimeDeps;
+
+  unpackPhase = "true";
+
+  # And, one final derivation (you thought the last one was it, right?)
+  # We got the binary we wanted above, but it doesn't have all the runtime
+  # dependencies k8s wants, including mount utilities for kubelet, networking
+  # tools for cni/kubelet stuff, etc
+  # Use a wrapper script to reference all the binaries that k3s tries to
+  # execute, but that we didn't bundle with it.
+  installPhase = ''
+    mkdir -p "$out/bin"
+    makeWrapper ${k3sBuild}/bin/k3s "$out/bin/k3s" \
+      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
+      --prefix PATH : "$out/bin"
+  '';
+
+    meta = {
+      description = "A lightweight Kubernetes distribution.";
+      license = licenses.asl20;
+      homepage = https://k3s.io;
+      maintainers = with maintainers; [ euank ];
+      platforms = platforms.linux;
+    };
+}
--- a/pkgs/applications/networking/cluster/k3s/patches/00-k3s.patch
+++ b/pkgs/applications/networking/cluster/k3s/patches/00-k3s.patch
@ -0,0 +1,74 @@
+diff --git a/main.go b/main.go
+index 62908bb7bb..0527222887 100644
+--- a/main.go
+++ b/main.go
+@@ -1,5 +1,5 @@
+ //go:generate go run pkg/codegen/cleanup/main.go
+-//go:generate /bin/rm -rf pkg/generated
+//go:generate rm -rf pkg/generated
+ //go:generate go run pkg/codegen/main.go
+ //go:generate go fmt pkg/deploy/zz_generated_bindata.go
+ //go:generate go fmt pkg/static/zz_generated_bindata.go
+diff --git a/scripts/build b/scripts/build
+index 72d3c07ece..3e5455b262 100755
+--- a/scripts/build
+++ b/scripts/build
+@@ -10,7 +10,8 @@ PKG_CONTAINERD="github.com/containerd/containerd"
+ PKG_RANCHER_CONTAINERD="github.com/rancher/containerd"
+ PKG_CRICTL="github.com/kubernetes-sigs/cri-tools"
+ 
+-buildDate=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+# Deterministic build date
+buildDate="$(date -d "$(git log -1 --format=%ai)" -u "+%Y-%m-%dT%H:%M:%SZ")"
+ 
+ VENDOR_PREFIX="${PKG}/vendor/"
+ VERSIONFLAGS="
+@@ -82,17 +83,7 @@ cleanup() {
+ }
+ 
+ INSTALLBIN=$(pwd)/bin
+-if [ ! -x ${INSTALLBIN}/cni ]; then
+-(
+-    echo Building cni
+-    TMPDIR=$(mktemp -d)
+-    trap cleanup EXIT
+-    WORKDIR=$TMPDIR/src/github.com/containernetworking/plugins
+-    git clone -b $VERSION_CNIPLUGINS https://github.com/rancher/plugins.git $WORKDIR
+-    cd $WORKDIR
+-    GOPATH=$TMPDIR CGO_ENABLED=0 go build -tags "$TAGS" -ldflags "$LDFLAGS $STATIC" -o $INSTALLBIN/cni
+-)
+-fi
+# skip building cni, use our separately built one
+ # echo Building agent
+ # CGO_ENABLED=1 go build -tags "$TAGS" -ldflags "$VERSIONFLAGS $LDFLAGS $STATIC" -o bin/k3s-agent ./cmd/agent/main.go
+ echo Building server
+@@ -108,9 +99,8 @@ ln -s containerd ./bin/ctr
+ #CGO_ENABLED=1 go build -tags "$TAGS" -ldflags "$VERSIONFLAGS $LDFLAGS $STATIC_SQLITE" -o bin/ctr ./cmd/ctr/main.go
+ # echo Building containerd
+ # CGO_ENABLED=0 go build -tags "$TAGS" -ldflags "$VERSIONFLAGS $LDFLAGS $STATIC" -o bin/containerd ./cmd/containerd/
+-echo Building runc
+-make EXTRA_LDFLAGS="-w -s" BUILDTAGS="apparmor seccomp" -C ./vendor/github.com/opencontainers/runc static
+-cp -f ./vendor/github.com/opencontainers/runc/runc ./bin/runc
+
+# skip building runc; use our packaged one
+ 
+ echo Building containerd-shim
+ make -C ./vendor/github.com/containerd/containerd bin/containerd-shim
+diff --git a/scripts/package-cli b/scripts/package-cli
+index 4c66ce32df..6d1e0c03cb 100755
+--- a/scripts/package-cli
+++ b/scripts/package-cli
+@@ -55,10 +55,10 @@ LDFLAGS="
+     -X github.com/rancher/k3s/pkg/version.GitCommit=${COMMIT:0:8}
+     -w -s
+ "
+-STATIC="-extldflags '-static'"
+ if [ "$DQLITE" = "true" ]; then
+     DQLITE_TAGS="dqlite"
+ fi
+-CGO_ENABLED=0 go build -tags "$DQLITE_TAGS" -ldflags "$LDFLAGS $STATIC" -o ${CMD_NAME} ./cmd/k3s/main.go
+go build -tags "$DQLITE_TAGS" -ldflags "$LDFLAGS" -o ${CMD_NAME} ./cmd/k3s/main.go
+ 
+-./scripts/build-upload ${CMD_NAME} ${COMMIT}
+# for nixos, don't upload it
+# ./scripts/build-upload ${CMD_NAME} ${COMMIT}
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.10.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "14ahb02p1gqcqbjz6mn3axw436b6bi4ygq5ckm85jzs28s4wrfsv";
+    sha256 = "0z51iwdc4m0y8wyyx3mcvbzxlrgws7n5wkcd0g7nr73irnsld4lh";
  };

-  modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";
+  modSha256 = "029h0zr3fpzlsv9hf1d1x5j7aalxkcsyszsxjz8fqrhjafqc7zvq";

  subPackages = [ "cmd/kubeseal" ];

--- a/pkgs/applications/networking/instant-messengers/gomuks/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
@ -1,19 +1,34 @@
-{ stdenv, buildGoModule, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub, makeDesktopItem }:

 buildGoModule rec {
  pname = "gomuks";
-  version = "2020-02-19";
+  version = "2020-03-20";

  goPackagePath = "maunium.net/go/gomuks";

  src = fetchFromGitHub {
    owner = "tulir";
    repo = pname;
-    rev = "702592bf89dfcf1ec382c0a09d99318bce7a3943";
-    sha256 = "0g638q8ypkp6dbfy1s4hz798cpkld301f914il3yd70yf05vvysc";
+    rev = "bce30e32a049b3ee76081c8d3881a3820b0e7341";
+    sha256 = "0f7i88vrvl1xl4hmjplq3wwihqwijbgxy6nk5fkvc8pfmm5hsjcs";
  };

-  modSha256 = "03vbrh50pvx71rp6c23qc2sh0ir4jm1wl0gvi3z1c14ndzhsqky4";
+  modSha256 = "10w0bjhnf6bbqx5jbgfv2jxxyqswzx25p64kkjmvh5qamjzpbjz2";
+
+  postInstall = ''
+    cp -r ${
+      makeDesktopItem {
+        name = "net.maunium.gomuks.desktop";
+        exec = "@out@/bin/gomuks";
+        terminal = "true";
+        desktopName = "Gomuks";
+        genericName = "Matrix client";
+        categories = "Network;Chat";
+        comment = meta.description;
+      }
+    }/* $out/
+    substituteAllInPlace $out/share/applications/*
+  '';

  meta = with stdenv.lib; {
    homepage = "https://maunium.net/go/gomuks/";
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@ -1,5 +1,8 @@
-{ pkgs, stdenv, fetchFromGitHub, makeWrapper, makeDesktopItem, electron_7, riot-web, mkYarnPackage }:
-
+{ stdenv, fetchFromGitHub
+, makeWrapper, makeDesktopItem, mkYarnPackage
+, electron_7, riot-web, gtk3
+, wrapGAppsHook, glib
+}:
 # Notes for maintainers:
 # * versions of `riot-web` and `riot-desktop` should be kept in sync.
 # * the Yarn dependency expression must be updated with `./update-riot-desktop.sh <git release tag>`
@ -24,7 +27,14 @@ in mkYarnPackage rec {
  packageJSON = ./riot-desktop-package.json;
  yarnNix = ./riot-desktop-yarndeps.nix;

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  extraBuildInputs = [
+    glib
+    gtk3
+  ];
+
+  dontWrapGApps = true;

  installPhase = ''
    # resources
@ -44,10 +54,13 @@ in mkYarnPackage rec {
    # desktop item
    mkdir -p "$out/share"
    ln -s "${desktopItem}/share/applications" "$out/share/applications"
+  '';

+  postFixup = ''
    # executable wrapper
    makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
-      --add-flags "$out/share/riot/electron"
+      --add-flags "$out/share/riot/electron" \
+      "''${gappsWrapperArgs[@]}"
  '';

  # Do not attempt generating a tarball for riot-web again.
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {

  patches = [ ./qt-5.11.patch ./scons.patch ];

-  nativeBuildInputs = [ pkgconfig qttools scons ];
+  nativeBuildInputs = [ pkgconfig qttools scons.py2 ];

  buildInputs = [
    GConf avahi boost hunspell libXScrnSaver libedit libidn libnatpmp libxml2
--- a/pkgs/applications/networking/instant-messengers/telepathy/mission-control/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/mission-control/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetchurl
+, fetchpatch
 , pkgconfig
 , dconf
 , telepathy-glib
@ -19,6 +20,16 @@ stdenv.mkDerivation rec {
    sha256 = "00xxv38cfdirnfvgyd56m60j0nkmsv5fz6p2ydyzsychicxl6ssc";
  };

+  patches = [
+    # Fix property name (new GLib is stricter)
+    # https://github.com/NixOS/nixpkgs/pull/81626#issuecomment-601494939
+    # https://gitlab.gnome.org/GNOME/polari/-/merge_requests/141
+    (fetchpatch {
+      url = "https://github.com/TelepathyIM/telepathy-mission-control/commit/d8dab08fe8db137c6bbd8bbdc3d9b01d98c48910.patch";
+      sha256 = "Sw+V5QcWQ5zugwTTdkwa3pqV+v5XD0OhH6xI5ymgkOU=";
+    })
+  ];
+
  buildInputs = [
    python3
  ]; # ToDo: optional stuff missing
--- a/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip/default.nix
@ -5,12 +5,12 @@

 let
  pname = "zulip";
-  version = "4.0.0";
+  version = "5.0.0";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    sha256 = "1pni02mb5bvwx3k45vd6ga269ghdl633gjklyslai24rrhp16h9z";
+    sha256 = "0qwlhkzb3lbzk3piyfx8nn827kcafrl3j1nxrn18f8px9gwasinz";
    name="${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/networking/ipfs-migrator/default.nix
+++ b/pkgs/applications/networking/ipfs-migrator/default.nix
@ -19,7 +19,7 @@ buildGoPackage {

  meta = with stdenv.lib; {
    description = "Migration tool for ipfs repositories";
-    homepage = https://ipfs.io/;
+    homepage = "https://ipfs.io/";
    license = licenses.mit;
    platforms = platforms.unix;
    maintainers = with maintainers; [ elitak ];
--- a/pkgs/applications/networking/ipfs-migrator/deps.nix
+++ b/pkgs/applications/networking/ipfs-migrator/deps.nix
@ -3,7 +3,7 @@
    goPackagePath = "github.com/jbenet/goprocess";
    fetch = {
      type = "git";
-      url = https://github.com/jbenet/goprocess;
+      url = "https://github.com/jbenet/goprocess";
      rev = "b497e2f366b8624394fb2e89c10ab607bebdde0b";
      sha256 = "1lnvkzki7vnqn5c4m6bigk0k85haicmg27w903kwg30rdvblm82s";
    };
@ -12,7 +12,7 @@
    goPackagePath = "github.com/jbenet/go-random";
    fetch = {
      type = "git";
-      url = https://github.com/jbenet/go-random;
+      url = "https://github.com/jbenet/go-random";
      rev = "384f606e91f542a98e779e652eed88051618f0f7";
      sha256 = "0gcshzl9n3apzc0jaxqrjsc038yfrzfyhpdqgbpcnajin83l2msa";
    };
@ -21,7 +21,7 @@
    goPackagePath = "github.com/jbenet/go-random-files";
    fetch = {
      type = "git";
-      url = https://github.com/jbenet/go-random-files;
+      url = "https://github.com/jbenet/go-random-files";
      rev = "737479700b40b4b50e914e963ce8d9d44603e3c8";
      sha256 = "1klpdc4qkrfy31r7qh00fcz42blswzabmcnry9byd5adhszxj9bw";
    };
@ -30,7 +30,7 @@
    goPackagePath = "github.com/hashicorp/golang-lru";
    fetch = {
      type = "git";
-      url = https://github.com/hashicorp/golang-lru;
+      url = "https://github.com/hashicorp/golang-lru";
      rev = "20f1fb78b0740ba8c3cb143a61e86ba5c8669768";
      sha256 = "12k2cp2k615fjvfa5hyb9k2alian77wivds8s65diwshwv41939f";
    };
--- a/pkgs/applications/networking/irc/qweechat/default.nix
+++ b/pkgs/applications/networking/irc/qweechat/default.nix
@ -18,7 +18,7 @@ python27Packages.buildPythonApplication rec {
  '';

  propagatedBuildInputs = with python27Packages; [
-     pyside
+     pyside setuptools
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/modem-manager-gui/default.nix
+++ b/pkgs/applications/networking/modem-manager-gui/default.nix
@ -2,6 +2,7 @@
 , pkgconfig
 , python3
 , fetchhg
+, fetchpatch
 , gtk3
 , glib
 , gdbm
@ -25,6 +26,14 @@ stdenv.mkDerivation rec {
    sha256 = "11iibh36567814h2bz41sa1072b86p1l13xyj670pwkh9k8kw8fd";
  };

+  patches = [
+    # Fix docs build
+    (fetchpatch {
+      url = "https://bitbucket.org/linuxonly/modem-manager-gui/commits/68fb09c12413b7de9b7477cbf4241c3527568325/raw";
+      sha256 = "58XIT/RTZ9sjUK2e47h+SqpRWhQ2vbKb2h9MKiHNdgw=";
+    })
+  ];
+
  nativeBuildInputs = [
    pkgconfig
    python3
--- a/pkgs/applications/networking/p2p/stig/default.nix
+++ b/pkgs/applications/networking/p2p/stig/default.nix
@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
      --replace "urwidtrees>=1.0.3dev0" "urwidtrees"
  '';

-  buildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3.pkgs; [
    urwid
    urwidtrees
    aiohttp
@ -43,8 +43,10 @@ python3.pkgs.buildPythonApplication rec {
    pytest
  ];

+  # test_string__month_day_hour_minute_second fails on darwin
  checkPhase = ''
-    pytest tests
+    LC_ALL=en_US.utf8 pytest tests \
+      --deselect=tests/client_test/ttypes_test.py::TestTimestamp::test_string__month_day_hour_minute_second
  '';

  meta = with lib; {
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@ -137,7 +137,7 @@ mkDerivation {
  updateScript = import ./update.nix { inherit writeScript runtimeShell; };

  meta = with stdenv.lib; {
-    homepage = https://www.mendeley.com;
+    homepage = "https://www.mendeley.com";
    description = "A reference manager and academic social network";
    license = licenses.unfree;
    platforms = [ "x86_64-linux" "i686-linux" ];
--- a/pkgs/applications/office/notes-up/default.nix
+++ b/pkgs/applications/office/notes-up/default.nix
@ -2,7 +2,7 @@
 , fetchFromGitHub
 , pantheon
 , pkgconfig
-, vala
+, vala_0_46
 , cmake
 , ninja
 , gtk3
@ -30,7 +30,8 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    cmake
    ninja
-    vala
+    # fails with newer vala: https://github.com/Philip-Scott/Notes-up/issues/349
+    vala_0_46
    pkgconfig
    wrapGAppsHook
  ];
@ -59,7 +60,7 @@ stdenv.mkDerivation rec {
  meta = with stdenv.lib; {
    description = "Markdown notes editor and manager designed for elementary OS"
    + stdenv.lib.optionalString withPantheon " - built with Contractor support";
-    homepage = https://github.com/Philip-Scott/Notes-up;
+    homepage = "https://github.com/Philip-Scott/Notes-up";
    license = licenses.gpl2;
    maintainers = with maintainers; [ davidak worldofpeace ];
    platforms = platforms.linux;
--- a/pkgs/applications/radio/airspy/default.nix
+++ b/pkgs/applications/radio/airspy/default.nix
@ -1,36 +1,33 @@
 { stdenv, lib, fetchFromGitHub
-, cmake , pkgconfig, libusb
+, cmake , pkgconfig, libusb1
 }:

-let
+stdenv.mkDerivation rec {
+  pname = "airspy";
  version = "1.0.9";
-in
-  stdenv.mkDerivation {
-    pname = "airspy";
-    inherit version;

-    src = fetchFromGitHub {
-      owner = "airspy";
-      repo = "airspyone_host";
-      rev = "v${version}";
-      sha256 = "04kx2p461sqd4q354n1a99zcabg9h29dwcnyhakykq8bpg3mgf1x";
-    };
+  src = fetchFromGitHub {
+    owner = "airspy";
+    repo = "airspyone_host";
+    rev = "v${version}";
+    sha256 = "04kx2p461sqd4q354n1a99zcabg9h29dwcnyhakykq8bpg3mgf1x";
+  };

-    postPatch = ''
-      substituteInPlace airspy-tools/CMakeLists.txt --replace "/etc/udev/rules.d" "$out/etc/udev/rules.d"
-    '';
+  postPatch = ''
+    substituteInPlace airspy-tools/CMakeLists.txt --replace "/etc/udev/rules.d" "$out/etc/udev/rules.d"
+  '';

-    nativeBuildInputs = [ cmake pkgconfig ];
-    buildInputs = [ libusb ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ libusb1 ];

-    cmakeFlags =
-      lib.optionals stdenv.isLinux [ "-DINSTALL_UDEV_RULES=ON" ];
+  cmakeFlags =
+    lib.optionals stdenv.isLinux [ "-DINSTALL_UDEV_RULES=ON" ];

-    meta = with stdenv.lib; {
-      homepage = https://github.com/airspy/airspyone_host;
-      description = "Host tools and driver library for the AirSpy SDR";
-      license = licenses.bsd3;
-      platforms = with platforms; linux ++ darwin;
-      maintainers = with maintainers; [ markuskowa ];
-    };
-  }
+  meta = with stdenv.lib; {
+    homepage = https://github.com/airspy/airspyone_host;
+    description = "Host tools and driver library for the AirSpy SDR";
+    license = licenses.bsd3;
+    platforms = with platforms; linux ++ darwin;
+    maintainers = with maintainers; [ markuskowa ];
+  };
+}
--- a/pkgs/applications/radio/dump1090/default.nix
+++ b/pkgs/applications/radio/dump1090/default.nix
@ -2,7 +2,7 @@
 , fetchFromGitHub
 , pkgconfig
 , libbladeRF
-, libusb
+, libusb1
 , ncurses
 , rtl-sdr
 }:
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    libbladeRF
-    libusb
+    libusb1
    ncurses
    rtl-sdr
  ];
--- a/pkgs/applications/radio/hackrf/default.nix
+++ b/pkgs/applications/radio/hackrf/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, libusb, fftwSinglePrec }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, libusb1, fftwSinglePrec }:

 stdenv.mkDerivation rec {
  pname = "hackrf";
@ -11,9 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "0idh983xh6gndk9kdgx5nzz76x3mxb42b02c5xvdqahadsfx3b9w";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
+    cmake
+    pkgconfig
+  ];
+
  buildInputs = [
-    cmake libusb fftwSinglePrec
+    libusb1
+    fftwSinglePrec
  ];

  cmakeFlags = [ "-DUDEV_RULES_GROUP=plugdev" "-DUDEV_RULES_PATH=lib/udev/rules.d" ];
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@ -1,57 +1,129 @@
-{ stdenv, fetchurl, fetchFromGitHub, cmake, pkgconfig
-, python, orc, libusb1, boost }:
-
-# You need these udev rules to not have to run as root (copied from
-# ${uhd}/share/uhd/utils/uhd-usrp.rules):
-#
-#   SUBSYSTEMS=="usb", ATTRS{idVendor}=="fffe", ATTRS{idProduct}=="0002", MODE:="0666"
-#   SUBSYSTEMS=="usb", ATTRS{idVendor}=="2500", ATTRS{idProduct}=="0002", MODE:="0666"
+{ stdenv
+, fetchurl
+, fetchFromGitHub
+, cmake
+, pkgconfig
+# See https://files.ettus.com/manual_archive/v3.15.0.0/html/page_build_guide.html for dependencies explanations
+, boost
+, enableLibuhd_C_api ? true
+# requires numpy
+, enableLibuhd_Python_api ? false
+, python3 ? null
+, enableExamples ? false
+, enableUtils ? false
+, enableLiberio ? false
+, liberio ? null
+, libusb1 ? null
+, enableDpdk ? false
+, dpdk ? null
+# Devices
+, enableOctoClock ? true
+, enableMpmd ? true
+, enableB100 ? true
+, enableB200 ? true
+, enableUsrp1 ? true
+, enableUsrp2 ? true
+, enableX300 ? true
+, enableN230 ? true
+, enableN300 ? true
+, enableN320 ? true
+, enableE300 ? true
+, enableE320 ? true
+}:

 let
-  uhdVer = "v" + version;
+  onOffBool = b: if b then "ON" else "OFF";
+  inherit (stdenv.lib) optionals;
+in

+stdenv.mkDerivation rec {
+  pname = "uhd";
  # UHD seems to use three different version number styles: x.y.z, xxx_yyy_zzz
  # and xxx.yyy.zzz. Hrmpf... style keeps changing
-  version = "3.14.0.0";
-
-  # Firmware images are downloaded (pre-built) from the respective release on Github
-  uhdImagesSrc = fetchurl {
-    url = "https://github.com/EttusResearch/uhd/releases/download/${uhdVer}/uhd-images_${version}.tar.xz";
-    sha256 = "1fp37wgqkbr14cxg9l7ghfd4r92y2bxwgb7cfjzs96hbpd9s6al0";
-  };
-
-in stdenv.mkDerivation {
-  pname = "uhd";
-  inherit version;
+  version = "3.15.0.0";

  src = fetchFromGitHub {
    owner = "EttusResearch";
    repo = "uhd";
-    rev = uhdVer;
-    sha256 = "0y1hff4vslfv36vxgvjqajg4862a11d4wgr0vcb0visgh1bi8qgy";
+    rev = "v${version}";
+    sha256 = "0jknln88a69fh244670nb7qrflbyv0vvdxfddb5g8ncpb6hcg8qf";
+  };
+  # Firmware images are downloaded (pre-built) from the respective release on Github
+  uhdImagesSrc = fetchurl {
+    url = "https://github.com/EttusResearch/uhd/releases/download/v${version}/uhd-images_${version}.tar.xz";
+    sha256 = "1fir1a13ac07mqhm4sr34cixiqj2difxq0870qv1wr7a7cbfw6vp";
  };

  enableParallelBuilding = true;

-  # ABI differences GCC 7.1
-  # /nix/store/wd6r25miqbk9ia53pp669gn4wrg9n9cj-gcc-7.3.0/include/c++/7.3.0/bits/vector.tcc:394:7: note: parameter passing for argument of type 'std::vector<uhd::range_t>::iterator {aka __gnu_cxx::__normal_iterator<uhd::range_t*, std::vector<uhd::range_t> >}' changed in GCC 7.1
+  cmakeFlags = [
+    "-DENABLE_LIBUHD=ON"
+    "-DENABLE_USB=ON"
+    "-DENABLE_TESTS=ON" # This installs tests as well so we delete them via postPhases
+    "-DENABLE_EXAMPLES=${onOffBool enableExamples}"
+    "-DENABLE_UTILS=${onOffBool enableUtils}"
+    "-DENABLE_LIBUHD_C_API=${onOffBool enableLibuhd_C_api}"
+    "-DENABLE_LIBUHD_PYTHON_API=${onOffBool enableLibuhd_Python_api}"
+    "-DENABLE_LIBERIO=${onOffBool enableLiberio}"
+    "-DENABLE_DPDK=${onOffBool enableDpdk}"
+    # Devices
+    "-DENABLE_OCTOCLOCK=${onOffBool enableOctoClock}"
+    "-DENABLE_MPMD=${onOffBool enableMpmd}"
+    "-DENABLE_B100=${onOffBool enableB100}"
+    "-DENABLE_B200=${onOffBool enableB200}"
+    "-DENABLE_USRP1=${onOffBool enableUsrp1}"
+    "-DENABLE_USRP2=${onOffBool enableUsrp2}"
+    "-DENABLE_X300=${onOffBool enableX300}"
+    "-DENABLE_N230=${onOffBool enableN230}"
+    "-DENABLE_N300=${onOffBool enableN300}"
+    "-DENABLE_N320=${onOffBool enableN320}"
+    "-DENABLE_E300=${onOffBool enableE300}"
+    "-DENABLE_E320=${onOffBool enableE320}"
+  ]
+    # TODO: Check if this still needed
+    # ABI differences GCC 7.1
+    # /nix/store/wd6r25miqbk9ia53pp669gn4wrg9n9cj-gcc-7.3.0/include/c++/7.3.0/bits/vector.tcc:394:7: note: parameter passing for argument of type 'std::vector<uhd::range_t>::iterator {aka __gnu_cxx::__normal_iterator<uhd::range_t*, std::vector<uhd::range_t> >}' changed in GCC 7.1
+    ++ [ (stdenv.lib.optionalString stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi") ]
+  ;

-  cmakeFlags = [ "-DLIBUSB_INCLUDE_DIRS=${libusb1.dev}/include/libusb-1.0"] ++
-               [ (stdenv.lib.optionalString stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi") ];
+  # Python + Mako are always required for the build itself but not necessary for runtime.
+  pythonEnv = python3.withPackages (ps: with ps; [ Mako ]
+    ++ optionals (enableLibuhd_Python_api) [ numpy setuptools ]
+    ++ optionals (enableUtils) [ requests six ]
+  );

-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [
+    cmake
+    pkgconfig
+  ]
+    # If both enableLibuhd_Python_api and enableUtils are off, we don't need
+    # pythonEnv in buildInputs as it's a 'build' dependency and not a runtime
+    # dependency
+    ++ optionals (!enableLibuhd_Python_api && !enableUtils) [ pythonEnv ]
+  ;
  buildInputs = [
-    (python.withPackages (ps: with ps; [ Mako six requests ]))
-    orc
-    libusb1
    boost
-  ];
+    libusb1
+  ]
+    # However, if enableLibuhd_Python_api *or* enableUtils is on, we need
+    # pythonEnv for runtime as well. The utilities' runtime dependencies are
+    # handled at the environment
+    ++ optionals (enableLibuhd_Python_api || enableUtils) [ pythonEnv ]
+    ++ optionals (enableLiberio) [ liberio ]
+    ++ optionals (enableDpdk) [ dpdk ]
+  ;
+
+  doCheck = true;

  # Build only the host software
  preConfigure = "cd host";
+  # TODO: Check if this still needed, perhaps relevant:
+  # https://files.ettus.com/manual_archive/v3.15.0.0/html/page_build_guide.html#build_instructions_unix_arm
  patches = if stdenv.isAarch32 then ./neon.patch else null;

-  postPhases = [ "installFirmware" ];
+  postPhases = [ "installFirmware" "removeInstalledTests" ]
+    ++ optionals (enableUtils) [ "moveUdevRules" ]
+  ;

  # UHD expects images in `$CMAKE_INSTALL_PREFIX/share/uhd/images`
  installFirmware = ''
@ -59,6 +131,18 @@ in stdenv.mkDerivation {
    tar --strip-components=1 -xvf "${uhdImagesSrc}" -C "$out/share/uhd/images"
  '';

+  # -DENABLE_TESTS=ON installs the tests, we don't need them in the output
+  removeInstalledTests = ''
+    rm -r $out/lib/uhd/tests
+  '';
+
+  # Moves the udev rules to the standard location, needed only if utils are
+  # enabled
+  moveUdevRules = ''
+    mkdir -p $out/lib/udev/rules.d
+    mv $out/lib/uhd/utils/uhd-usrp.rules $out/lib/udev/rules.d/
+  '';
+
  meta = with stdenv.lib; {
    description = "USRP Hardware Driver (for Software Defined Radio)";
    longDescription = ''
@ -68,7 +152,7 @@ in stdenv.mkDerivation {
      USRP devices are designed and sold by Ettus Research, LLC and its parent
      company, National Instruments.
    '';
-    homepage = https://uhd.ettus.com/;
+    homepage = "https://uhd.ettus.com/";
    license = licenses.gpl3Plus;
    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ bjornfor fpletz tomberek ];
--- a/pkgs/applications/science/electronics/dsview/default.nix
+++ b/pkgs/applications/science/electronics/dsview/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, pkgconfig, cmake,
 libzip, boost, fftw, qtbase,
-libusb, wrapQtAppsHook, libsigrok4dsl, libsigrokdecode4dsl
+libusb1, wrapQtAppsHook, libsigrok4dsl, libsigrokdecode4dsl
 }:

 stdenv.mkDerivation rec {
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];

  buildInputs = [
-   boost fftw qtbase libusb libzip libsigrokdecode4dsl libsigrok4dsl
+   boost fftw qtbase libusb1 libzip libsigrokdecode4dsl libsigrok4dsl
  ];

  enableParallelBuilding = true;
--- a/pkgs/applications/science/electronics/dsview/libsigrok4dsl.nix
+++ b/pkgs/applications/science/electronics/dsview/libsigrok4dsl.nix
@ -1,5 +1,5 @@
 { stdenv, pkgconfig, autoreconfHook,
-glib, libzip, libserialport, check, libusb, libftdi,
+glib, libzip, libserialport, check, libusb1, libftdi,
 systemd, alsaLib, dsview
 }:

@ -15,7 +15,7 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ pkgconfig autoreconfHook ];

  buildInputs = [
-    glib libzip libserialport libusb libftdi systemd check alsaLib
+    glib libzip libserialport libusb1 libftdi systemd check alsaLib
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/science/logic/cadical/default.nix
+++ b/pkgs/applications/science/logic/cadical/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "cadical";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "arminbiere";
+    repo = "cadical";
+    rev = "rel-${version}";
+    hash = "sha256:1a66xkw42ad330fvw8i0sawrmg913m8wrq5c85lw5qandkwvxdi6";
+  };
+
+  dontAddPrefix = true;
+  installPhase = ''
+    install -Dm0755 build/cadical "$out/bin/cadical"
+    install -Dm0755 build/mobical "$out/bin/mobical"
+    mkdir -p "$out/share/doc/${pname}-${version}/"
+    install -Dm0755 {LICEN?E,README*,VERSION} "$out/share/doc/${pname}-${version}/"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Simplified Satisfiability Solver";
+    maintainers = with maintainers; [ shnarazk ];
+    platforms = platforms.unix;
+    license = licenses.mit;
+    homepage = "http://fmv.jku.at/cadical";
+  };
+}
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -33,6 +33,7 @@ let
   "8.10.1" = "072v2zkjzf7gj48137wpr3c9j0hg9pdhlr5l8jrgrwynld8fp7i4";
   "8.10.2" = "0znxmpy71bfw0p6x47i82jf5k7v41zbz9bdpn901ysn3ir8l3wrz";
   "8.11.0" = "1rfdic6mp7acx2zfwz7ziqk12g95bl9nyj68z4n20a5bcjv2pxpn";
+   "8.11.1" = "0qriy9dy36dajsv5qmli8gd6v55mah02ya334nw49ky19v7518m0";
  }.${version};
  coq-version = stdenv.lib.versions.majorMinor version;
  versionAtLeast = stdenv.lib.versionAtLeast coq-version;
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "gmsh";
-  version = "4.5.4";
+  version = "4.5.6";

  src = fetchurl {
    url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "1k9f7qxlwja9i40qy55070sjnr21bl165677mdqw7qyb8d7wgy6c";
+    sha256 = "0gs65bgr1ph5lz7r6manqj8cra30s7c94pxilkd2z0p5vq6fpsj6";
  };

  buildInputs = [ openblasCompat gmm fltk libjpeg zlib libGLU libGL
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -95,7 +95,15 @@ stdenv.mkDerivation {
  ++ stdenv.lib.optionals stdenv.isSunOS ["INSTALL=install" "NO_INET_NTOP=" "NO_INET_PTON="]
  ++ (if stdenv.isDarwin then ["NO_APPLE_COMMON_CRYPTO=1"] else ["sysconfdir=/etc"])
  ++ stdenv.lib.optionals stdenv.hostPlatform.isMusl ["NO_SYS_POLL_H=1" "NO_GETTEXT=YesPlease"]
-  ++ stdenv.lib.optional withpcre2 "USE_LIBPCRE2=1";
+  ++ stdenv.lib.optional withpcre2 "USE_LIBPCRE2=1"
+  # git-gui refuses to start with the version of tk distributed with
+  # macOS Catalina. We can prevent git from building the .app bundle
+  # by specifying an invalid tk framework. The postInstall step will
+  # then ensure that git-gui uses tcl/tk from nixpkgs, which is an
+  # acceptable version.
+  #
+  # See https://github.com/Homebrew/homebrew-core/commit/dfa3ccf1e7d3901e371b5140b935839ba9d8b706
+  ++ stdenv.lib.optional stdenv.isDarwin "TKFRAMEWORK=/nonexistent";


  postBuild = ''
@ -232,7 +240,6 @@ stdenv.mkDerivation {
       for prog in bin/gitk libexec/git-core/{git-gui,git-citool,git-gui--askpass}; do
         sed -i -e "s|exec 'wish'|exec '${tk}/bin/wish'|g" \
                -e "s|exec wish|exec '${tk}/bin/wish'|g" \
-                -e "s|exec \"[^\"]*/MacOS/Wish\"|exec '${tk}/bin/wish'|g" \
                "$out/$prog"
       done
       ln -s $out/share/git/contrib/completion/git-completion.bash $out/share/bash-completion/completions/gitk
--- a/pkgs/applications/video/bombono/default.nix
+++ b/pkgs/applications/video/bombono/default.nix
@ -17,7 +17,13 @@ stdenv.mkDerivation rec {
    sha256 = "1lz1vik6abn1i1pvxhm55c9g47nxxv755wb2ijszwswwrwgvq5b9";
  };

-  patches = map fetchPatchFromAur [
+  patches = [
+    (fetchpatch {
+      name = "bombono-dvd-1.2.4-scons3.patch";
+      url = "https://svnweb.mageia.org/packages/cauldron/bombono-dvd/current/SOURCES/bombono-dvd-1.2.4-scons-python3.patch?revision=1447925&view=co&pathrev=1484457";
+      sha256 = "081116d0if6s2r1rgqfr1n5gl3kpvzk01pf4v2k7gg2rnid83qp4";
+    })
+  ] ++ (map fetchPatchFromAur [
    {name="fix_ffmpeg_codecid.patch";         sha256="1asfc0lqzk4gjssrvjmsi1xr53ygnsx2sh7c8yzp5r3j2bagxhp7";}
    {name="fix_ptr2bool_cast.patch";          sha256="0iqzrmbg38ikh4x9cmx0v0rnm7a9lcq0kd8sh1z9yfmnz71qqahg";}
    {name="fix_c++11_literal_warnings.patch"; sha256="1zbf12i77p0j0090pz5lzg4a7kyahahzqssybv7vi0xikwvw57w9";}
@ -26,7 +32,7 @@ stdenv.mkDerivation rec {
    {name="fix_throw_specifications.patch";   sha256="1f5gi3qwm843hsxvijq7sjy0s62xm7rnr1vdp7f242fi0ldq6c1n";}
    {name="fix_operator_ambiguity.patch";     sha256="0r4scsbsqfg6wgzsbfxxpckamvgyrida0n1ypg1klx24pk5dc7n7";}
    {name="fix_ffmpeg30.patch";               sha256="1irva7a9bpbzs60ga8ypa3la9y84i5rz20jnd721qmfqp2yip8dw";}
-  ];
+  ]);

  nativeBuildInputs = [ wrapGAppsHook scons pkgconfig gettext ];

--- a/pkgs/applications/video/kodi/plugins.nix
+++ b/pkgs/applications/video/kodi/plugins.nix
@ -1,6 +1,6 @@
 { stdenv, callPackage, fetchFromGitHub
 , cmake, kodiPlain, libcec_platform, tinyxml, rapidxml
-, steam, libusb, pcre-cpp, jsoncpp, libhdhomerun, zlib
+, steam, udev, libusb1, jsoncpp, libhdhomerun, zlib
 , python2Packages, expat, glib, nspr, nss, openssl
 , libssh, libarchive, lzma, bzip2, lz4, lzo }:

@ -236,8 +236,7 @@ let self = rec {
      maintainers = with maintainers; [ edwtjo ];
    };

-    extraBuildInputs = [ libusb pcre-cpp ];
-
+    extraBuildInputs = [ udev ];
  };

  simpleplugin = mkKodiPlugin rec {
@ -300,7 +299,7 @@ let self = rec {
      sha256 = "1hbd8fdvn7xkr9csz1g9wah78nhnq1rkazl4zwa31y70830k3279";
    };

-    extraBuildInputs = [ libusb ];
+    extraBuildInputs = [ libusb1 ];

    meta = {
      description = "Binary addon for steam controller.";
--- a/pkgs/applications/window-managers/cage/default.nix
+++ b/pkgs/applications/window-managers/cage/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    sha256 = "1gkqx26pvlw00b3fgx6sh87yyjfzyj51jwxvbf9k117npkrf4b2g";
  };

-  nativeBuildInputs = [ meson ninja pkgconfig makeWrapper ];
+  nativeBuildInputs = [ meson ninja pkgconfig makeWrapper wayland ];

  buildInputs = [
    wlroots wayland wayland-protocols pixman libxkbcommon
--- a/pkgs/build-support/build-pecl.nix
+++ b/pkgs/build-support/build-pecl.nix
@ -1,9 +1,11 @@
-{ stdenv, php, autoreconfHook, fetchurl, re2c }:
+{ stdenv, lib, php, autoreconfHook, fetchurl, re2c }:

 { pname
 , version
+, internalDeps ? []
 , buildInputs ? []
 , nativeBuildInputs ? []
+, postPhpize ? ""
 , makeFlags ? []
 , src ? fetchurl {
    url = "http://pecl.php.net/get/${pname}-${version}.tgz";
@ -22,5 +24,11 @@ stdenv.mkDerivation (args // {

  makeFlags = [ "EXTENSION_DIR=$(out)/lib/php/extensions" ] ++ makeFlags;

-  autoreconfPhase = "phpize";
+  autoreconfPhase = ''
+    phpize
+    ${postPhpize}
+    ${lib.concatMapStringsSep "\n"
+      (dep: "mkdir -p ext; ln -s ${dep.dev}/include ext/${dep.extensionName}")
+      internalDeps}
+  '';
 })
--- a/pkgs/build-support/release/binary-tarball.nix
+++ b/pkgs/build-support/release/binary-tarball.nix
@ -51,29 +51,24 @@ stdenv.mkDerivation (
      configureFlags="--prefix=$prefix $configureFlags"
      dontAddPrefix=1
      prefix=$TMPDIR/inst$prefix
-    ''; # */
-
+    '';

    doDist = true;

-    distPhase =
-      ''
-        mkdir -p $out/tarballs
-        tar cvfj $out/tarballs/''${releaseName:-binary-dist}.tar.bz2 -C $TMPDIR/inst .
-      '';
+    distPhase = ''
+      mkdir -p $out/tarballs
+      tar cvfj $out/tarballs/''${releaseName:-binary-dist}.tar.bz2 -C $TMPDIR/inst .
+    '';

+    finalPhase = ''
+      for i in $out/tarballs/*; do
+          echo "file binary-dist $i" >> $out/nix-support/hydra-build-products
+      done

-    finalPhase =
-      ''
-        for i in $out/tarballs/*; do
-            echo "file binary-dist $i" >> $out/nix-support/hydra-build-products
-        done
-
-        # Propagate the release name of the source tarball.  This is
-        # to get nice package names in channels.
-        test -n "$releaseName" && (echo "$releaseName" >> $out/nix-support/hydra-release-name)
-      '';
-
+      # Propagate the release name of the source tarball.  This is
+      # to get nice package names in channels.
+      test -n "$releaseName" && (echo "$releaseName" >> $out/nix-support/hydra-release-name)
+    '';

    meta = (if args ? meta then args.meta else {}) // {
      description = "Build of a generic binary distribution";
--- a/pkgs/build-support/release/debian-build.nix
+++ b/pkgs/build-support/release/debian-build.nix
@ -88,7 +88,7 @@ vmTools.runInLinuxImage (stdenv.mkDerivation (
      done

      eval "$postInstall"
-    ''; # */
+    '';

    meta = (if args ? meta then args.meta else {}) // {
      description = "Deb package for ${diskImage.fullName}";
--- a/pkgs/build-support/release/default.nix
+++ b/pkgs/build-support/release/default.nix
@ -1,4 +1,4 @@
-{pkgs}:
+{ pkgs }:

 with pkgs;

@ -77,7 +77,7 @@ rec {
     its contituents. Channel jobs are a special type of jobs that are
     listed in the channel tab of Hydra and that can be suscribed.
     A tarball of the src attribute is distributed via the channel.
-     
+
     - constituents: a list of derivations on which the channel success depends.
     - name: the channel name that will be used in the hydra interface.
     - src: should point to the root folder of the nix-expressions used by the
@ -88,7 +88,7 @@ rec {
         name = "my-channel";
         src = ./.;
       };
-     
+
  */
  channel =
    { name, src, constituents ? [], meta ? {}, isNixOS ? true, ... }@args:
--- a/pkgs/build-support/release/maven-build.nix
+++ b/pkgs/build-support/release/maven-build.nix
@ -11,12 +11,12 @@
 , ...
 } @ args :

-let 
+let
  mvnFlags = "-Dmaven.repo.local=$M2_REPO ${if doTest then "" else "-Dmaven.test.skip.exec=true"} ${extraMvnFlags}";
 in

 stdenv.mkDerivation ( {
-  inherit name src; 
+  inherit name src;
  phases = "setupPhase unpackPhase patchPhase mvnCompile ${if doTestCompile then "mvnTestCompile mvnTestJar" else ""} ${if doTest then "mvnTest" else ""} ${if doJavadoc then "mvnJavadoc" else ""} ${if doCheckstyle then "mvnCheckstyle" else ""} mvnJar mvnAssembly mvnRelease finalPhase";

  setupPhase = ''
@ -32,15 +32,15 @@ stdenv.mkDerivation ( {

  mvnCompile = ''
    mvn compile ${mvnFlags}
-  '';  
+  '';

  mvnTestCompile = ''
    mvn test-compile ${mvnFlags}
-  '';  
+  '';

  mvnTestJar = ''
    mvn jar:test-jar ${mvnFlags}
-  '';  
+  '';

  mvnTest = ''
    mvn test ${mvnFlags}
@ -53,21 +53,21 @@ stdenv.mkDerivation ( {
      mvn surefire-report:report-only
      echo "report coverage $out/site/surefire-report.html" >> $out/nix-support/hydra-build-products
    fi
-  '';  
+  '';

  mvnJavadoc = ''
    mvn javadoc:javadoc ${mvnFlags}
    echo "report javadoc $out/site/apidocs" >> $out/nix-support/hydra-build-products
-  '';  
+  '';

  mvnCheckstyle = ''
    mvn checkstyle:checkstyle ${mvnFlags}
    echo "report checkstyle $out/site/checkstyle.html" >> $out/nix-support/hydra-build-products
-  '';  
+  '';

  mvnJar = ''
    mvn jar:jar ${mvnFlags}
-  '';  
+  '';

  mvnAssembly = ''
    mvn assembly:assembly -Dmaven.test.skip=true ${mvnFlags}
@ -80,13 +80,13 @@ stdenv.mkDerivation ( {
    releaseName=$(basename $zip .zip)
    releaseName="$releaseName-r${toString src.rev or "0"}"
    cp $zip $out/release/$releaseName.zip
-    
+
    echo "$releaseName" > $out/nix-support/hydra-release-name

    ${if doRelease then  ''
    echo "file zip $out/release/$releaseName.zip" >> $out/nix-support/hydra-build-products
    '' else ""}
-  '';  
+  '';

  finalPhase = ''
    if [ -d target/site ] ; then
@ -94,5 +94,5 @@ stdenv.mkDerivation ( {
      echo "report site $out/site" >> $out/nix-support/hydra-build-products
    fi
  '';
-} // args 
+} // args
 )
--- a/pkgs/build-support/release/rpm-build.nix
+++ b/pkgs/build-support/release/rpm-build.nix
@ -44,7 +44,7 @@ vmTools.buildRPM (
      for rpmdir in $extraRPMs ; do
        echo "file rpm-extra $(ls $rpmdir/rpms/*/*.rpm | grep -v 'src\.rpm' | sort | head -1)" >> $out/nix-support/hydra-build-products
      done
-    ''; # */
+    '';

    meta = (if args ? meta then args.meta else {}) // {
      description = "RPM package for ${diskImage.fullName}";
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@ -181,6 +181,8 @@ stdenv.mkDerivation (args // {

  doCheck = args.doCheck or true;

+  strictDeps = true;
+
  inherit releaseDir;

  installPhase = args.installPhase or ''
--- a/pkgs/build-support/setup-hooks/patch-shebangs.sh
+++ b/pkgs/build-support/setup-hooks/patch-shebangs.sh
@ -42,7 +42,7 @@ patchShebangs() {
    local newInterpreterLine

    if [ $# -eq 0 ]; then
-        echo "No arguments supplied to patchShebangs" >0
+        echo "No arguments supplied to patchShebangs" >&2
        return 0
    fi

@ -66,7 +66,7 @@ patchShebangs() {
            # - options: something starting with a '-'
            # - environment variables: foo=bar
            if $(echo "$arg0" | grep -q -- "^-.*\|.*=.*"); then
-                echo "$f: unsupported interpreter directive \"$oldInterpreterLine\" (set dontPatchShebangs=1 and handle shebang patching yourself)" >0
+                echo "$f: unsupported interpreter directive \"$oldInterpreterLine\" (set dontPatchShebangs=1 and handle shebang patching yourself)" >&2
                exit 1
            fi

--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -15,7 +15,7 @@ in fetchzip {
  sha256 = "1dfm1888rii5kfmkxp5hnx8ycji57cbs5gazpgkxg1mnmn7i35wl";

  meta = with stdenv.lib; {
-    homepage = https://be5invis.github.io/Iosevka/;
+    homepage = "https://be5invis.github.io/Iosevka/";
    downloadPage = "https://github.com/be5invis/Iosevka/releases";
    description = ''
      Slender monospace sans-serif and slab-serif typeface inspired by Pragmata
--- a/pkgs/data/fonts/junicode/default.nix
+++ b/pkgs/data/fonts/junicode/default.nix
@ -1,20 +1,24 @@
 { lib, fetchzip }:

-fetchzip {
-  name = "junicode-0.7.8";
+let
+  pname = "junicode";
+  version = "1.002";
+in fetchzip {
+  name = "${pname}-${version}";

-  url = mirror://sourceforge/junicode/junicode/junicode-0-7-8/junicode-0-7-8.zip;
+  url = "mirror://sourceforge/junicode/junicode/junicode-${version}/junicode-${version}.zip";

  postFetch = ''
    mkdir -p $out/share/fonts
    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/junicode-ttf
  '';

-  sha256 = "0q4si9pnbif36154sv49kzc7ygivgflv81nzmblpz3b2p77g9956";
+  sha256 = "1n170gw41lr0zr5958z5cgpg6i1aa7kj7iq9s6gdh1cqq7hhgd08";

  meta = {
    homepage = http://junicode.sourceforge.net/;
    description = "A Unicode font for medievalists";
-    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ ivan-timokhin ];
+    license = lib.licenses.ofl;
  };
 }
--- a/Show more
+++ b/Show more