Merge master into staging-next

2025-02-06 12:14:40 +00:00 · 2020-08-13 08:52:26 +02:00 · 2020-08-13 08:52:26 +02:00 · 2e149209a7
commit 2e149209a7
parent e8bfa708c4 45d0002b90
161 changed files with 1310 additions and 676 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -7218,6 +7218,16 @@
    githubId = 132835;
    name = "Samuel Dionne-Riel";
  };
+  samuelgrf = {
+    email = "git@samuelgrf.com";
+    github = "samuelgrf";
+    githubId = 67663538;
+    name = "Samuel Gräfenstein";
+    keys = [{
+      longkeyid = "rsa4096/0xEF76A063F15C63C8";
+      fingerprint = "FF24 5832 8FAF 4660 18C6  186E EF76 A063 F15C 63C8";
+    }];
+  };
  samuelrivas = {
    email = "samuelrivas@gmail.com";
    github = "samuelrivas";
@ -9103,6 +9113,16 @@
    email = "zef@zef.me";
    name = "Zef Hemel";
  };
+  zeratax = {
+    email = "mail@zera.tax";
+    github = "ZerataX";
+    githubId = 5024958;
+    name = "Jona Abdinghoff";
+    keys = [{
+      longkeyid = "rsa4096/0x8333735E784DF9D4";
+      fingerprint = "44F7 B797 9D3A 27B1 89E0  841E 8333 735E 784D F9D4";
+    }];
+  };
  zfnmxt = {
    name = "zfnmxt";
    email = "zfnmxt@zfnmxt.com";
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -528,6 +528,46 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
   <listitem>
    <para>
     In the <literal>resilio</literal> module, <xref linkend="opt-services.resilio.httpListenAddr"/> has been changed to listen to <literal>[::1]</literal> instead of <literal>0.0.0.0</literal>.
+     </para>
+   </listitem>
+   <listitem>
+    <para>
+     Users of <link xlink:href="http://openafs.org">OpenAFS 1.6</link> must
+     upgrade their services to OpenAFS 1.8! In this release, the OpenAFS package
+     version 1.6.24 is marked broken but can be used during transition to
+     OpenAFS 1.8.x. Use the options
+     <option>services.openafsClient.packages.module</option>,
+     <option>services.openafsClient.packages.programs</option> and
+     <option>services.openafsServer.package</option> to select a different
+     OpenAFS package. OpenAFS 1.6 will be removed in the next release. The
+     package <literal>openafs</literal> and the service options will then
+     silently point to the OpenAFS 1.8 release.
+    </para>
+    <para>
+     See also the OpenAFS <link
+     xlink:href="http://docs.openafs.org/AdminGuide/index.html">Administrator
+     Guide</link> for instructions. Beware of the following when updating
+     servers:
+     <itemizedlist>
+      <listitem>
+       <para>
+       The storage format of the server key has changed and the key must be converted before running the new release.
+       </para>
+      </listitem>
+      <listitem>
+       <para>
+       When updating multiple database servers, turn off the database servers
+       from the highest IP down to the lowest with resting periods in
+       between. Start up in reverse order. Do not concurrently run database
+       servers working with different OpenAFS releases!
+       </para>
+      </listitem>
+      <listitem>
+       <para>
+       Update servers first, then clients.
+       </para>
+      </listitem>
+     </itemizedlist>
    </para>
   </listitem>
   <listitem>
@ -849,6 +889,12 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
     There are no functional changes, however this may require updating some configurations to use correct types for all attributes.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     The <literal>fontconfig</literal> module stopped generating fontconfig 2.10.x config and cache.
+     Fontconfig 2.10.x was removed from Nixpkgs - it hasn't been used in any nixpkgs package anymore.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -1,11 +1,6 @@
 /*

-NixOS support 2 fontconfig versions, "support" and "latest".
-
- "latest" refers to default fontconfig package (pkgs.fontconfig).
-  configuration files are linked to /etc/fonts/VERSION/conf.d/
- "support" refers to supportPkg (pkgs."fontconfig_${supportVersion}").
-  configuration files are linked to /etc/fonts/conf.d/
+Configuration files are linked to /etc/fonts/${pkgs.fontconfig.configVersion}/conf.d/

 This module generates a package containing configuration files and link it in /etc/fonts.

@ -22,40 +17,21 @@ let
  cfg = config.fonts.fontconfig;

  fcBool = x: "<bool>" + (boolToString x) + "</bool>";
-
-  # back-supported fontconfig version and package
-  # version is used for font cache generation
-  supportVersion = "210";
-  supportPkg     = pkgs."fontconfig_${supportVersion}";
-
-  # latest fontconfig version and package
-  # version is used for configuration folder name, /etc/fonts/VERSION/
-  # note: format differs from supportVersion and can not be used with makeCacheConf
-  latestVersion  = pkgs.fontconfig.configVersion;
-  latestPkg      = pkgs.fontconfig;
-
-  # supported version fonts.conf
-  supportFontsConf = pkgs.makeFontsConf { fontconfig = supportPkg; fontDirectories = config.fonts.fonts; };
+  pkg = pkgs.fontconfig;

  # configuration file to read fontconfig cache
-  # version dependent
  # priority 0
-  cacheConfSupport = makeCacheConf { version = supportVersion; };
-  cacheConfLatest  = makeCacheConf {};
+  cacheConf  = makeCacheConf {};

-  # generate the font cache setting file for a fontconfig version
-  # use latest when no version is passed
+  # generate the font cache setting file
  # When cross-compiling, we can’t generate the cache, so we skip the
  # <cachedir> part. fontconfig still works but is a little slower in
  # looking things up.
-  makeCacheConf = { version ? null }:
+  makeCacheConf = { }:
    let
-      fcPackage = if version == null
-                  then "fontconfig"
-                  else "fontconfig_${version}";
      makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
-      cache     = makeCache pkgs.${fcPackage};
-      cache32   = makeCache pkgs.pkgsi686Linux.${fcPackage};
+      cache     = makeCache pkgs.fontconfig;
+      cache32   = makeCache pkgs.pkgsi686Linux.fontconfig;
    in
    pkgs.writeText "fc-00-nixos-cache.conf" ''
      <?xml version='1.0'?>
@ -200,59 +176,49 @@ let
  confPkg = pkgs.runCommand "fontconfig-conf" {
    preferLocalBuild = true;
  } ''
-    support_folder=$out/etc/fonts/conf.d
-    latest_folder=$out/etc/fonts/${latestVersion}/conf.d
-
-    mkdir -p $support_folder
-    mkdir -p $latest_folder
+    dst=$out/etc/fonts/${pkg.configVersion}/conf.d
+    mkdir -p $dst

    # fonts.conf
-    ln -s ${supportFontsConf} $support_folder/../fonts.conf
-    ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
-          $latest_folder/../fonts.conf
+    ln -s ${pkg.out}/etc/fonts/fonts.conf \
+          $dst/../fonts.conf

    # fontconfig default config files
-    ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf \
-          $support_folder/
-    # Latest fontconfig is configured to look for the upstream defaults inside the package.
+    ln -s ${pkg.out}/etc/fonts/conf.d/*.conf \
+          $dst/
+
+    # update 51-local.conf path to look at local.conf
+    rm  $dst/51-local.conf
+
+    substitute ${pkg.out}/etc/fonts/conf.d/51-local.conf \
+               $dst/51-local.conf \
+               --replace local.conf /etc/fonts/${pkg.configVersion}/local.conf

    # 00-nixos-cache.conf
-    ln -s ${cacheConfSupport} \
-          $support_folder/00-nixos-cache.conf
-    ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf
+    ln -s ${cacheConf}  $dst/00-nixos-cache.conf

    # 10-nixos-rendering.conf
-    ln -s ${renderConf}       $support_folder/10-nixos-rendering.conf
-    ln -s ${renderConf}       $latest_folder/10-nixos-rendering.conf
+    ln -s ${renderConf}       $dst/10-nixos-rendering.conf

    # 50-user.conf
    ${optionalString (!cfg.includeUserConf) ''
-    rm $support_folder/50-user.conf
-    ''}
-    # Since latest fontconfig looks for default files inside the package,
-    # we had to move this one elsewhere to be able to exclude it here.
-    ${optionalString cfg.includeUserConf ''
-    ln -s ${latestPkg.out}/etc/fonts/conf.d.bak/50-user.conf $latest_folder/50-user.conf
+    rm $dst/50-user.conf
    ''}

    # local.conf (indirect priority 51)
    ${optionalString (cfg.localConf != "") ''
-    ln -s ${localConf}        $support_folder/../local.conf
-    ln -s ${localConf}        $latest_folder/../local.conf
+    ln -s ${localConf}        $dst/../local.conf
    ''}

    # 52-nixos-default-fonts.conf
-    ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf
-    ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf
+    ln -s ${defaultFontsConf} $dst/52-nixos-default-fonts.conf

    # 53-no-bitmaps.conf
-    ln -s ${rejectBitmaps} $support_folder/53-no-bitmaps.conf
-    ln -s ${rejectBitmaps} $latest_folder/53-no-bitmaps.conf
+    ln -s ${rejectBitmaps} $dst/53-no-bitmaps.conf

    ${optionalString (!cfg.allowType1) ''
    # 53-nixos-reject-type1.conf
-    ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf
-    ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf
+    ln -s ${rejectType1} $dst/53-nixos-reject-type1.conf
    ''}
  '';

--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -25,6 +25,8 @@ let

  clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);

+  smtpTlsSecurityLevel = if cfg.useDane then "dane" else "may";
+
  mainCf = let
    escape = replaceStrings ["$"] ["$$"];
    mkList = items: "\n  " + concatStringsSep ",\n  " items;
@ -508,6 +510,14 @@ in
        '';
      };

+      useDane = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Sets smtp_tls_security_level to "dane" rather than "may". See postconf(5) for details.
+        '';
+      };
+
      sslCert = mkOption {
        type = types.str;
        default = "";
@ -809,13 +819,13 @@ in
      // optionalAttrs cfg.enableHeaderChecks { header_checks = [ "regexp:/etc/postfix/header_checks" ]; }
      // optionalAttrs (cfg.tlsTrustedAuthorities != "") {
        smtp_tls_CAfile = cfg.tlsTrustedAuthorities;
-        smtp_tls_security_level = "may";
+        smtp_tls_security_level = smtpTlsSecurityLevel;
      }
      // optionalAttrs (cfg.sslCert != "") {
        smtp_tls_cert_file = cfg.sslCert;
        smtp_tls_key_file = cfg.sslKey;

-        smtp_tls_security_level = "may";
+        smtp_tls_security_level = smtpTlsSecurityLevel;

        smtpd_tls_cert_file = cfg.sslCert;
        smtpd_tls_key_file = cfg.sslKey;
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -162,6 +162,45 @@ in
            <manvolnum>7</manvolnum></citerefentry>.
          '';
        };
+
+        backupDir = mkOption {
+          type = types.str;
+          default = "${cfg.stateDir}/dump";
+          description = "Path to the dump files.";
+        };
+      };
+
+      ssh = {
+        enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Enable external SSH feature.";
+        };
+
+        clonePort = mkOption {
+          type = types.int;
+          default = 22;
+          example = 2222;
+          description = ''
+            SSH port displayed in clone URL.
+            The option is required to configure a service when the external visible port
+            differs from the local listening port i.e. if port forwarding is used.
+          '';
+        };
+      };
+
+      lfs = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enables git-lfs support.";
+        };
+
+        contentDir = mkOption {
+          type = types.str;
+          default = "${cfg.stateDir}/data/lfs";
+          description = "Where to store LFS files.";
+        };
      };

      appName = mkOption {
@ -200,6 +239,12 @@ in
        description = "HTTP listen port.";
      };

+      enableUnixSocket = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Configure Gitea to listen on a unix socket instead of the default TCP port.";
+      };
+
      cookieSecure = mkOption {
        type = types.bool;
        default = false;
@ -300,14 +345,34 @@ in
        ROOT = cfg.repositoryRoot;
      };

-      server = {
-        DOMAIN = cfg.domain;
-        HTTP_ADDR = cfg.httpAddress;
-        HTTP_PORT = cfg.httpPort;
-        ROOT_URL = cfg.rootUrl;
-        STATIC_ROOT_PATH = cfg.staticRootPath;
-        LFS_JWT_SECRET = "#jwtsecret#";
-      };
+      server = mkMerge [
+        {
+          DOMAIN = cfg.domain;
+          STATIC_ROOT_PATH = cfg.staticRootPath;
+          LFS_JWT_SECRET = "#jwtsecret#";
+          ROOT_URL = cfg.rootUrl;
+        }
+        (mkIf cfg.enableUnixSocket {
+          PROTOCOL = "unix";
+          HTTP_ADDR = "/run/gitea/gitea.sock";
+        })
+        (mkIf (!cfg.enableUnixSocket) {
+          HTTP_ADDR = cfg.httpAddress;
+          HTTP_PORT = cfg.httpPort;
+        })
+        (mkIf cfg.ssh.enable {
+          DISABLE_SSH = false;
+          SSH_PORT = cfg.ssh.clonePort;
+        })
+        (mkIf (!cfg.ssh.enable) {
+          DISABLE_SSH = true;
+        })
+        (mkIf cfg.lfs.enable {
+          LFS_START_SERVER = true;
+          LFS_CONTENT_PATH = cfg.lfs.contentDir;
+        })
+
+      ];

      session = {
        COOKIE_NAME = "session";
@ -357,12 +422,26 @@ in
    };

    systemd.tmpfiles.rules = [
-      "d '${cfg.stateDir}' - ${cfg.user} gitea - -"
-      "d '${cfg.stateDir}/conf' - ${cfg.user} gitea - -"
-      "d '${cfg.stateDir}/custom' - ${cfg.user} gitea - -"
-      "d '${cfg.stateDir}/custom/conf' - ${cfg.user} gitea - -"
-      "d '${cfg.stateDir}/log' - ${cfg.user} gitea - -"
-      "d '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
+      "d '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
+      "Z '${cfg.dump.backupDir}' - ${cfg.user} gitea - -"
+      "d '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
+      "Z '${cfg.lfs.contentDir}' - ${cfg.user} gitea - -"
+      "d '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
+      "Z '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
+      "d '${cfg.stateDir}' 0750 ${cfg.user} gitea - -"
+      "d '${cfg.stateDir}/conf' 0750 ${cfg.user} gitea - -"
+      "d '${cfg.stateDir}/custom' 0750 ${cfg.user} gitea - -"
+      "d '${cfg.stateDir}/custom/conf' 0750 ${cfg.user} gitea - -"
+      "d '${cfg.stateDir}/log' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.stateDir}' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.stateDir}/.ssh' 0700 ${cfg.user} gitea - -"
+      "z '${cfg.stateDir}/conf' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.stateDir}/custom' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.stateDir}/custom/conf' 0750 ${cfg.user} gitea - -"
+      "z '${cfg.stateDir}/log' 0750 ${cfg.user} gitea - -"
      "Z '${cfg.stateDir}' - ${cfg.user} gitea - -"

      # If we have a folder or symlink with gitea locales, remove it
@ -431,28 +510,39 @@ in
        User = cfg.user;
        Group = "gitea";
        WorkingDirectory = cfg.stateDir;
-        ExecStart = "${gitea}/bin/gitea web";
+        ExecStart = "${gitea}/bin/gitea web --pid /run/gitea/gitea.pid";
        Restart = "always";
-
-        # Filesystem
+        # Runtime directory and mode
+        RuntimeDirectory = "gitea";
+        RuntimeDirectoryMode = "0755";
+        # Access write directories
+        ReadWritePaths = [ cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir cfg.lfs.contentDir ];
+        UMask = "0027";
+        # Capabilities
+        CapabilityBoundingSet = "";
+        # Security
+        NoNewPrivileges = true;
+        # Sandboxing
+        ProtectSystem = "strict";
        ProtectHome = true;
+        PrivateTmp = true;
        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectClock = true;
        ProtectKernelTunables = true;
        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
        ProtectControlGroups = true;
-        ReadWritePaths = cfg.stateDir;
-        # Caps
-        CapabilityBoundingSet = "";
-        NoNewPrivileges = true;
-        # Misc.
+        RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
        LockPersonality = true;
-        RestrictRealtime = true;
-        PrivateMounts = true;
-        PrivateUsers = true;
        MemoryDenyWriteExecute = true;
-        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @resources @setuid @swap";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        PrivateMounts = true;
+        # System Call Filtering
        SystemCallArchitectures = "native";
-        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @reboot @resources @setuid @swap";
      };

      environment = {
@ -504,7 +594,7 @@ in
         Type = "oneshot";
         User = cfg.user;
         ExecStart = "${gitea}/bin/gitea dump";
-         WorkingDirectory = cfg.stateDir;
+         WorkingDirectory = cfg.dump.backupDir;
       };
    };

--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@ -98,7 +98,7 @@ in
          ${pkgs.gollum}/bin/gollum \
            --port ${toString cfg.port} \
            --host ${cfg.address} \
-            --config ${builtins.toFile "gollum-config.rb" cfg.extraConfig} \
+            --config ${pkgs.writeText "gollum-config.rb" cfg.extraConfig} \
            --ref ${cfg.branch} \
            ${optionalString cfg.mathjax "--mathjax"} \
            ${optionalString cfg.emoji "--emoji"} \
--- a/nixos/modules/services/network-filesystems/ipfs.nix
+++ b/nixos/modules/services/network-filesystems/ipfs.nix
@ -25,6 +25,15 @@ let
      then "/${lib.concatStringsSep "/" (lib.tail addr)}"
    else null; # not valid for listen stream, skip

+  multiaddrToListenDatagram = addrRaw: let
+      addr = splitMulitaddr addrRaw;
+      s = builtins.elemAt addr;
+    in if s 0 == "ip4" && s 2 == "udp"
+      then "${s 1}:${s 3}"
+    else if s 0 == "ip6" && s 2 == "udp"
+      then "[${s 1}]:${s 3}"
+    else null; # not valid for listen datagram, skip
+
 in {

  ###### interface
@ -268,9 +277,14 @@ in {

    systemd.sockets.ipfs-gateway = {
      wantedBy = [ "sockets.target" ];
-      socketConfig.ListenStream = let
-          fromCfg = multiaddrToListenStream cfg.gatewayAddress;
-        in [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+      socketConfig = {
+        ListenStream = let
+            fromCfg = multiaddrToListenStream cfg.gatewayAddress;
+          in [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+        ListenDatagram = let
+            fromCfg = multiaddrToListenDatagram cfg.gatewayAddress;
+          in [ "" ] ++ lib.optional (fromCfg != null) fromCfg;
+      };
    };

    systemd.sockets.ipfs-api = {
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -531,81 +531,65 @@ in {

      environment.systemPackages = [ occ ];

-      services.nginx = mkDefault {
-        enable = true;
-        virtualHosts.${cfg.hostName} = {
-          root = cfg.package;
-          locations = {
-            "= /robots.txt" = {
-              priority = 100;
-              extraConfig = ''
-                allow all;
-                log_not_found off;
-                access_log off;
-              '';
-            };
-            "/" = {
-              priority = 200;
-              extraConfig = "rewrite ^ /index.php;";
-            };
-            "~ ^/store-apps" = {
-              priority = 201;
-              extraConfig = "root ${cfg.home};";
-            };
-            "= /.well-known/carddav" = {
-              priority = 210;
-              extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-            };
-            "= /.well-known/caldav" = {
-              priority = 210;
-              extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-            };
-            "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
-              priority = 300;
-              extraConfig = "deny all;";
-            };
-            "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
-              priority = 300;
-              extraConfig = "deny all;";
-            };
-            "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
-              priority = 500;
-              extraConfig = ''
-                include ${config.services.nginx.package}/conf/fastcgi.conf;
-                fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
-                try_files $fastcgi_script_name =404;
-                fastcgi_param PATH_INFO $fastcgi_path_info;
-                fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
-                fastcgi_param modHeadersAvailable true;
-                fastcgi_param front_controller_active true;
-                fastcgi_pass unix:${fpm.socket};
-                fastcgi_intercept_errors on;
-                fastcgi_request_buffering off;
-                fastcgi_read_timeout 120s;
-              '';
-            };
-            "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
-              try_files $uri/ =404;
-              index index.php;
-            '';
-            "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
-              try_files $uri /index.php$request_uri;
-              add_header Cache-Control "public, max-age=15778463";
-              add_header X-Content-Type-Options nosniff;
-              add_header X-XSS-Protection "1; mode=block";
-              add_header X-Robots-Tag none;
-              add_header X-Download-Options noopen;
-              add_header X-Permitted-Cross-Domain-Policies none;
-              add_header X-Frame-Options sameorigin;
-              add_header Referrer-Policy no-referrer;
-              access_log off;
-            '';
-            "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
-              try_files $uri /index.php$request_uri;
+      services.nginx.enable = mkDefault true;
+      services.nginx.virtualHosts.${cfg.hostName} = {
+        root = cfg.package;
+        locations = {
+          "= /robots.txt" = {
+            priority = 100;
+            extraConfig = ''
+              allow all;
+              log_not_found off;
              access_log off;
            '';
          };
-          extraConfig = ''
+          "/" = {
+            priority = 200;
+            extraConfig = "rewrite ^ /index.php;";
+          };
+          "~ ^/store-apps" = {
+            priority = 201;
+            extraConfig = "root ${cfg.home};";
+          };
+          "= /.well-known/carddav" = {
+            priority = 210;
+            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+          };
+          "= /.well-known/caldav" = {
+            priority = 210;
+            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+          };
+          "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
+            priority = 300;
+            extraConfig = "deny all;";
+          };
+          "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
+            priority = 300;
+            extraConfig = "deny all;";
+          };
+          "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
+            priority = 500;
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi.conf;
+              fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
+              try_files $fastcgi_script_name =404;
+              fastcgi_param PATH_INFO $fastcgi_path_info;
+              fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
+              fastcgi_param modHeadersAvailable true;
+              fastcgi_param front_controller_active true;
+              fastcgi_pass unix:${fpm.socket};
+              fastcgi_intercept_errors on;
+              fastcgi_request_buffering off;
+              fastcgi_read_timeout 120s;
+            '';
+          };
+          "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
+            try_files $uri/ =404;
+            index index.php;
+          '';
+          "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
+            try_files $uri /index.php$request_uri;
+            add_header Cache-Control "public, max-age=15778463";
            add_header X-Content-Type-Options nosniff;
            add_header X-XSS-Protection "1; mode=block";
            add_header X-Robots-Tag none;
@ -613,25 +597,39 @@ in {
            add_header X-Permitted-Cross-Domain-Policies none;
            add_header X-Frame-Options sameorigin;
            add_header Referrer-Policy no-referrer;
-            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-            error_page 403 /core/templates/403.php;
-            error_page 404 /core/templates/404.php;
-            client_max_body_size ${cfg.maxUploadSize};
-            fastcgi_buffers 64 4K;
-            fastcgi_hide_header X-Powered-By;
-            gzip on;
-            gzip_vary on;
-            gzip_comp_level 4;
-            gzip_min_length 256;
-            gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-            gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-            ${optionalString cfg.webfinger ''
-              rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-              rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
-            ''}
+            access_log off;
+          '';
+          "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
+            try_files $uri /index.php$request_uri;
+            access_log off;
          '';
        };
+        extraConfig = ''
+          add_header X-Content-Type-Options nosniff;
+          add_header X-XSS-Protection "1; mode=block";
+          add_header X-Robots-Tag none;
+          add_header X-Download-Options noopen;
+          add_header X-Permitted-Cross-Domain-Policies none;
+          add_header X-Frame-Options sameorigin;
+          add_header Referrer-Policy no-referrer;
+          add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+          error_page 403 /core/templates/403.php;
+          error_page 404 /core/templates/404.php;
+          client_max_body_size ${cfg.maxUploadSize};
+          fastcgi_buffers 64 4K;
+          fastcgi_hide_header X-Powered-By;
+          gzip on;
+          gzip_vary on;
+          gzip_comp_level 4;
+          gzip_min_length 256;
+          gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+          gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+          ${optionalString cfg.webfinger ''
+            rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+            rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+          ''}
+        '';
      };
    }
  ]);
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -704,7 +704,10 @@ in
      '';
      serviceConfig = {
        ExecStart = execCommand;
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        ExecReload = [
+          "${execCommand} -t"
+          "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
+        ];
        Restart = "always";
        RestartSec = "10s";
        StartLimitInterval = "1min";
@ -761,8 +764,7 @@ in
      serviceConfig.TimeoutSec = 60;
      script = ''
        if /run/current-system/systemd/bin/systemctl -q is-active nginx.service ; then
-          ${execCommand} -t && \
-            /run/current-system/systemd/bin/systemctl reload nginx.service
+          /run/current-system/systemd/bin/systemctl reload nginx.service
        fi
      '';
      serviceConfig.RemainAfterExit = true;
--- a/nixos/modules/system/boot/systemd-unit-options.nix
+++ b/nixos/modules/system/boot/systemd-unit-options.nix
@ -379,6 +379,16 @@ in rec {
      '';
    };

+    listenDatagrams = mkOption {
+      default = [];
+      type = types.listOf types.str;
+      example = [ "0.0.0.0:993" "/run/my-socket" ];
+      description = ''
+        For each item in this list, a <literal>ListenDatagram</literal>
+        option in the <literal>[Socket]</literal> section will be created.
+      '';
+    };
+
    socketConfig = mkOption {
      default = {};
      example = { ListenStream = "/run/my-socket"; };
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -354,6 +354,7 @@ let
          [Socket]
          ${attrsToSection def.socketConfig}
          ${concatStringsSep "\n" (map (s: "ListenStream=${s}") def.listenStreams)}
+          ${concatStringsSep "\n" (map (s: "ListenDatagram=${s}") def.listenDatagrams)}
        '';
    };

--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -40,6 +40,8 @@ let

    mopidy-iris = callPackage ./iris.nix { };

+    mopidy-tunein = callPackage ./tunein.nix { };
+
  };

 in self
--- a/pkgs/applications/audio/mopidy/tunein.nix
+++ b/pkgs/applications/audio/mopidy/tunein.nix
@ -0,0 +1,28 @@
+{ stdenv, python3Packages, mopidy }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mopidy-tunein";
+  version = "1.0.0";
+
+  src = python3Packages.fetchPypi {
+    inherit version;
+    pname = "Mopidy-TuneIn";
+    sha256 = "0insasf4w8ajsqjh5zmax7pkzmrk1p245vh4y8ddicldj45p6qfj";
+  };
+
+  propagatedBuildInputs = [
+    mopidy
+  ];
+
+  # tests fail with "ValueError: Namespace Gst not available" in mopidy itself
+  doCheck = false;
+
+  pythonImportsCheck = [ "mopidy_tunein.tunein" ];
+
+  meta = with stdenv.lib; {
+    description = "Mopidy extension for playing music from tunein.";
+    homepage = "https://github.com/kingosticks/mopidy-tunein";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
--- a/pkgs/applications/blockchains/clightning.nix
+++ b/pkgs/applications/blockchains/clightning.nix
@ -4,11 +4,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "clightning";
-  version = "0.8.2.1";
+  version = "0.9.0";

  src = fetchurl {
    url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "02incjr59fv75q6hlrln9h4b5gq7ipd778scbz8b8dahj7x1a6i5";
+    sha256 = "11ig5bqxvhx82gq9nl7c5iqaf3x8xbwfx7cf2318pyqdimz4r1v6";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@ -5,20 +5,20 @@

 stdenv.mkDerivation rec {
  pname = "emacs";
-  version = "26.3";
+  version = "27.1";

  emacsName = "emacs-${version}";
-  macportVersion = "7.7";
+  macportVersion = "8.0";
  name = "emacs-mac-${version}-${macportVersion}";

  src = fetchurl {
    url = "mirror://gnu/emacs/${emacsName}.tar.xz";
-    sha256 = "119ldpk7sgn9jlpyngv5y4z3i7bb8q3xp4p0qqi7i5nq39syd42d";
+    sha256 = "0h9f2wpmp6rb5rfwvqwv1ia1nw86h74p7hnz3vb3gjazj67i4k2a";
  };

  macportSrc = fetchurl {
    url = "ftp://ftp.math.s.chiba-u.ac.jp/emacs/${emacsName}-mac-${macportVersion}.tar.gz";
-    sha256 = "18jadknm47ymbl7skrgc7y8xsdldcbgnlfl7qpgzm1ym8d92as6j";
+    sha256 = "0rjk82k9qp1g701pfd4f0q2myzvsnp9q8xzphlxwi5yzwbs91kjq";
  };

  hiresSrc = fetchurl {
@ -76,7 +76,16 @@ stdenv.mkDerivation rec {
    cp ${./site-start.el} $out/share/emacs/site-lisp/site-start.el
  '';

-  doCheck = true;
+  # fails with:
+
+  # Ran 3870 tests, 3759 results as expected, 6 unexpected, 105 skipped
+  # 5 files contained unexpected results:
+  #   lisp/url/url-handlers-test.log
+  #   lisp/simple-tests.log
+  #   lisp/files-x-tests.log
+  #   lisp/cedet/srecode-utest-template.log
+  #   lisp/net/tramp-tests.log
+  doCheck = false;

  meta = with stdenv.lib; {
    description = "The extensible, customizable text editor";
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@ -138,7 +138,7 @@ let
        ln -s ${rubyEnv}/bin/neovim-ruby-host $out/bin/nvim-ruby
      ''
      + optionalString withNodeJs ''
-        ln -s ${nodePackages.neovim}/bin/neovim-node $out/bin/nvim-node
+        ln -s ${nodePackages.neovim}/bin/neovim-node-host $out/bin/nvim-node
      ''
      + optionalString vimAlias ''
        ln -s $out/bin/nvim $out/bin/vim
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "tiled";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "bjorn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1x8jymmc56di1c1wxalsp6qhcban2hahn70ndd097b8mx52gckjr";
+    sha256 = "0b3xjcc86vs9lfxr7xann9d43dz3v3x1g7j1mcn31sy2n68a1wx3";
  };

  nativeBuildInputs = [ pkgconfig qmake ];
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@ -7,12 +7,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.0.2";
+  version = "3.2.1";
  pname = "darktable";

  src = fetchurl {
    url = "https://github.com/darktable-org/darktable/releases/download/release-${version}/darktable-${version}.tar.xz";
-    sha256 = "1yrnkw8c47kmy2x6m1xp69hwyk02xyc8pd9kvcmyj54lzrhzdfka";
+    sha256 = "035rvqmw386hm0jpi14lf4dnpr5rjkalzjkyprqh42nwi3m86dkf";
  };

  nativeBuildInputs = [ cmake ninja llvm pkgconfig intltool perl desktop-file-utils wrapGAppsHook ];
--- a/pkgs/applications/logging/humioctl/default.nix
+++ b/pkgs/applications/logging/humioctl/default.nix
@ -1,8 +1,8 @@
 { buildGoModule, fetchFromGitHub, installShellFiles, stdenv }:

 let
-  humioCtlVersion = "0.26.0";
-  sha256 = "1j33hmvhkb546dbi2qd5hmpcv715yg9rnpxicc1mayr9f1i2aj2i";
+  humioCtlVersion = "0.26.1";
+  sha256 = "1zpcbfv7zlym0jfyz78piggm8zhqlzbwpwq0dn255d0zc48zp773";
  vendorSha256 = "1l2wa4w43srfrkb4qrgiyzdb6bnaqvp9g3fnrln6bhrcw6jsgj4z";
 in buildGoModule {
    name = "humioctl-${humioCtlVersion}";
--- a/pkgs/applications/misc/olifant/default.nix
+++ b/pkgs/applications/misc/olifant/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "olifant";
-  version = "0.2.1-beta5";
+  version = "0.2.1-beta6";

  src = fetchFromGitHub {
    owner = "cleac";
    repo = pname;
    rev = version;
-    sha256 = "1fpyg3nii75vmsdhp8x4yvhi3npvp3xnbqmd0qcidn05mbsam68r";
+    sha256 = "sha256-3hnEa4Q1dH0R8Jp+Ew0+dH1PEm3F+56jYwqhJ+vll4M=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@ -16,10 +16,10 @@ let

  pname = "simplenote";

-  version = "1.20.0";
+  version = "1.21.0";

  sha256 = {
-    x86_64-linux = "0fzv8nbac5bnxvm2p7p4jsjvfrzk3h9j57zjmwvsi2dq6l80d2n7";
+    x86_64-linux = "073dg4agqgimsgs3ia7g0pjv4vxkh24bj7vpmssiysdxhm4li1j1";
  }.${system} or throwSystem;

  meta = with stdenv.lib; {
--- a/pkgs/applications/misc/taskell/default.nix
+++ b/pkgs/applications/misc/taskell/default.nix
@ -1,8 +1,8 @@
 { lib, haskellPackages, fetchFromGitHub }:

 let
-  version = "1.9.4";
-  sha256  = "0k8s1f0c99fz6jmqi6jqscsfxrrijnnpyw4jcj8zxpdf0sc07gca";
+  version = "1.10.0";
+  sha256  = "102iwn6011rypdlx07fzbdll3r5cd204qf96lzwkadvjb7h8clil";

 in (haskellPackages.mkDerivation {
  pname = "taskell";
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@ -44,11 +44,11 @@ let

  flash = stdenv.mkDerivation rec {
    pname = "flashplayer-ppapi";
-    version = "32.0.0.403";
+    version = "32.0.0.414";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1xirngiqypylgm8f3ddvny2ghqxgj8i98bm1carcj2vryw53wwal";
+      sha256 = "0wzf5i6qf5wgjm905kd3qh97rj47fybl9g7z72vasilbx8q5wfwk";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "flashplayer";
-  version = "32.0.0.403";
+  version = "32.0.0.414";

  src = fetchurl {
    url =
@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
    sha256 =
      if debug then
        if arch == "x86_64" then
-          "0nx0fxa6l438hvzgsxa561nrin8lx7l9ccqscjn9mdg42yw36k63"
+          "184qy9zxk9ynp6avz1j0ca5mxqqqlhrc0m7d1cjxv39jfdiyz51i"
        else
-          "0vbg4ijsbmn71kq5mynx0hfhazy10ghcxsxwbwaxdl11ilxikrli"
+          "1m8fay452zps5yw1qpsc6irxxdvqjhkwxg066ckxkjf68gln7cmn"
      else
        if arch == "x86_64" then
-          "1paz9y3pcisw5ck3v6a740sr7plmsbg6bjqrj2yfqdixf95fk2pl"
+          "0ng04yig7msq4mv01ngfsh7mkxia18j3k9clnp0y0sbpr60z8s83"
        else
-          "1b2r20yc94ibsw0vpr6xl1x1vbjgjw6qzxzr374ppck8famikyj2";
+          "0fndnhznqz28wfmm32fafx30pi517vvkxy1isp4krsfvyl7fmzhn";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@ -50,7 +50,7 @@

 stdenv.mkDerivation {
  pname = "flashplayer-standalone";
-  version = "32.0.0.403";
+  version = "32.0.0.414";

  src = fetchurl {
    url =
@ -60,9 +60,9 @@ stdenv.mkDerivation {
        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
    sha256 =
      if debug then
-        "164cah1h78vs068y19v0c40243sy2ip1n4jc6qvzv9acawy12ckw"
+        "1sfvxi0ngk1ny912hw1zp0l3v6md6qqpvnyab3h45562m2fm6vqz"
      else
-        "0508jzaji3z52dyp49xx2m7impz1fdpp20af0h8dwdph1q3mxn32";
+        "0pxb3fhwvajvb28w11iylx5rp0h1f4s2aiii53gz28sq082w9br4";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix
@ -44,11 +44,11 @@ let

  flash = stdenv.mkDerivation rec {
    pname = "flashplayer-ppapi";
-    version = "32.0.0.403";
+    version = "32.0.0.414";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1xirngiqypylgm8f3ddvny2ghqxgj8i98bm1carcj2vryw53wwal";
+      sha256 = "0wzf5i6qf5wgjm905kd3qh97rj47fybl9g7z72vasilbx8q5wfwk";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.6.6";
+  version = "1.6.7";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    sha256 = "0njchcb58lxk0cixk2rz4qj7b0zpp6zf3i5dda43j4hfsb37mifj";
+    sha256 = "0zqp78ilr39j4pyqyk8a0rc0dlmkgzdd2ksfjd7vyjns5mrrjfj7";
  };
  vendorSha256 = "0cc0lmjsxrn3f78k95wklf3yn5k7h8slwnwmssy1i1h0bkcg1bai";

--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -5,7 +5,6 @@ buildGoModule rec {
  version = "3.0.0";
  k3sVersion = "1.18.6-k3s1";

-  goPackagePath = "github.com/rancher/k3d";
  excludedPackages = ''tools'';

  src = fetchFromGitHub {
--- a/pkgs/applications/networking/cluster/nomad/0.11.nix
+++ b/pkgs/applications/networking/cluster/nomad/0.11.nix
@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "0.11.4";
+  sha256 = "1sykp9sji6f564s7bz0cvnr9w5x92n0l1r1djf1bl7jvv2mi1mcb";
+}
--- a/pkgs/applications/networking/cluster/nomad/0.12.nix
+++ b/pkgs/applications/networking/cluster/nomad/0.12.nix
@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "0.12.2";
+  sha256 = "1gc286ag6plk5kxw7jzr32cp3n5rwydj1z7rds1rfd0fyq7an404";
+}
--- a/pkgs/applications/networking/cluster/nomad/generic.nix
+++ b/pkgs/applications/networking/cluster/nomad/generic.nix
@ -1,8 +1,8 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub, version, sha256 }:

 buildGoPackage rec {
  pname = "nomad";
-  version = "0.11.3";
+  inherit version;
  rev = "v${version}";

  goPackagePath = "github.com/hashicorp/nomad";
@ -11,8 +11,7 @@ buildGoPackage rec {
  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
-    inherit rev;
-    sha256 = "1p7g7x2gl77h1w7aip3xji3s530fj46gspargz4j3i6h4wkyvafb";
+    inherit rev sha256;
  };

  # ui:
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -1,24 +1,23 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "tilt";
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
-     running in development environment and try to serve assets from the
-     source tree, which is not there once build completes.  */
-  version = "0.11.3";
+    running in development environment and try to serve assets from the
+    source tree, which is not there once build completes.  */
+  version = "0.17.0";

  src = fetchFromGitHub {
-    owner  = "windmilleng";
+    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "035czgr0rn6gcv24vnlr35n9yvy0fwq4spdzsc76gfxckcbcmzz0";
+    sha256 = "0bd01fmrf17njzf8ri4bw4qi7bxcvd3dx7yyf42qfvnp7hrfzipk";
  };
-
-  goPackagePath = "github.com/windmilleng/tilt";
+  vendorSha256 = null;

  subPackages = [ "cmd/tilt" ];

-  buildFlagsArray = ("-ldflags=-X main.version=${version} -X main.date=2020-01-25");
+  buildFlagsArray = [ "-ldflags=-X main.version=${version}" ];

  meta = with stdenv.lib; {
    description = "Local development tool to manage your developer instance when your team deploys to Kubernetes in production";
--- a/pkgs/applications/networking/instant-messengers/gomuks/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gomuks/default.nix
@ -4,8 +4,6 @@ buildGoModule rec {
  pname = "gomuks";
  version = "0.1.2";

-  goPackagePath = "maunium.net/go/gomuks";
-
  src = fetchFromGitHub {
    owner = "tulir";
    repo = pname;
--- a/pkgs/applications/networking/instant-messengers/profanity/default.nix
+++ b/pkgs/applications/networking/instant-messengers/profanity/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, glib, openssl
 , glibcLocales, expect, ncurses, libotr, curl, readline, libuuid
-, cmocka, libmicrohttpd, stabber, expat, libmesode
+, cmocka, libmicrohttpd, expat, sqlite, libmesode
 , autoconf-archive

 , autoAwaySupport ? true,       libXScrnSaver ? null, libX11 ? null
@ -22,16 +22,18 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "profanity";
-  version = "0.8.1";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "profanity-im";
    repo = "profanity";
    rev = version;
-    sha256 = "0fg5xcdlvhsi7a40w4jcxyj7m7wl42jy1cvsa8fi2gb6g9y568k8";
+    sha256 = "14vbblf639f90bb4npg2xv53cpvk9am9ic4pmc1vnv4m3zsndjg5";
  };

-  patches = [ ./patches/packages-osx.patch ./patches/undefined-macros.patch ];
+  patches = [
+    ./patches/packages-osx.patch
+  ];

  enableParallelBuilding = true;

@ -41,7 +43,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    expect readline libuuid glib openssl expat ncurses libotr
-    curl libmesode cmocka libmicrohttpd stabber
+    curl libmesode cmocka libmicrohttpd sqlite
  ] ++ optionals autoAwaySupport     [ libXScrnSaver libX11 ]
    ++ optionals notifySupport       [ libnotify gdk-pixbuf ]
    ++ optionals traySupport         [ gnome2.gtk ]
--- a/pkgs/applications/networking/instant-messengers/profanity/patches/undefined-macros.patch
+++ b/pkgs/applications/networking/instant-messengers/profanity/patches/undefined-macros.patch
@ -1,40 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 1e55b1cc..0832a387 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -83,12 +81,12 @@ elif test "x$enable_python_plugins" != xno; then
-         AM_CONDITIONAL([BUILD_PYTHON_API], [true])
-         AC_DEFINE([HAVE_PYTHON], [1], [Python support])
-     else
-        if test "x$enable_python_plugins" = xyes; then
-            AC_MSG_ERROR([Python not found, cannot enable Python plugins.])
-        else
-            AM_CONDITIONAL([BUILD_PYTHON_API], [false])
-            AC_MSG_NOTICE([Python development package not found, Python plugin support disabled.])
-        fi
-+        AS_IF(
-+            [test "x$enable_python_plugins" = xyes],
-+            [],
-+            [AM_CONDITIONAL([BUILD_PYTHON_API], [false])
-+            AC_MSG_NOTICE([Python development package not found, Python plugin support disabled.])]
-+        )
-     fi
-     AS_IF([test "x$PLATFORM" = xosx], [rm -f Python.framework])
- else
-@@ -107,7 +105,7 @@ else
-             [AM_CONDITIONAL([BUILD_C_API], [true]) LIBS="$LIBS -ldl" AC_DEFINE([HAVE_C], [1], [C support])],
-             [AS_IF(
-                 [test "x$enable_c_plugins" = xyes],
-                    [AC_MSG_ERROR([dl library needed to run C plugins])],
-+                [],
-                 [AM_CONDITIONAL([BUILD_C_API], [false])])
-             ])
-     else
-@@ -116,7 +114,6 @@ else
- fi
- 
- # threading
-ACX_PTHREAD([], [AC_MSG_ERROR([pthread is required])])
- LIBS="$PTHREAD_LIBS $LIBS"
- CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
- AS_IF([test "x$PTHREAD_CC" != x], [ CC="$PTHREAD_CC" ])
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, stdenv
+{ fetchurl, fetchgit, stdenv
 , pkgconfig, gnupg
 , xapian, gmime, talloc, zlib
 , doxygen, perl, texinfo
@ -12,17 +12,18 @@
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  version = "0.30";
+  version = "0.30.1c80020";
  pname = "notmuch";

  passthru = {
-    pythonSourceRoot = "${pname}-${version}/bindings/python";
+    pythonSourceRoot = "${src.name}/bindings/python";
    inherit version;
  };

-  src = fetchurl {
-    url = "https://notmuchmail.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "1ylnj12f7xr18v3ckb1nwc2aw2rj3ghqnj5f4rzccr8xw5pslfsy";
+  src = fetchgit {
+    url = "https://git.notmuchmail.org/git/notmuch";
+    sha256 = "0xj944c4ayps1bg21pksjih3y9v6lb34dd582df14i14q0yzji51";
+    rev = "1c80020e701c7323de137c0616fc8864443d7bd3";
  };

  nativeBuildInputs = [
@ -75,6 +76,7 @@ stdenv.mkDerivation rec {
      sha256 = "1lk91s00y4qy4pjh8638b5lfkgwyl282g1m27srsf7qfn58y16a2";
    };
  in ''
+    mkdir -p test/test-databases
    ln -s ${test-database} test/test-databases/database-v1.tar.xz
  '';
  doCheck = !stdenv.hostPlatform.isDarwin && (versionAtLeast gmime.version "3.0.3");
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -17,13 +17,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "freerdp";
-  version = "2.1.2";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    rev = version;
-    sha256 = "1yvi7zd0ic0rv7njd0wi9q1mfvz4d9qrx3i45dd6hcq465wg8dp7";
+    sha256 = "02zlg5r704zbryx09a5rjjf7q137kj16i9qh25dw9q1y69ri619n";
  };

  postPatch = ''
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -3,17 +3,17 @@
 let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
-      version = "1.7.1";
+      version = "1.8.0";
      name = "${stname}-${version}";

      src = fetchFromGitHub {
        owner  = "syncthing";
        repo   = "syncthing";
        rev    = "v${version}";
-        sha256 = "1kb324diaq48z1vf36zlcsy9zckr0c3mrd3bmcdn28z2ivqnsc4a";
+        sha256 = "047y2sy9zif19dlh098ihaski9f3b971q3mmqg97qgfzpa8z8fpr";
      };

-      vendorSha256 = "1gmdv0g0gymq6khrwvplw6yfp146kg5ar8vqdp5dlp0myxfzi22b";
+      vendorSha256 = "0l08d96226l135cqbv1qqw0136f5nzw7likc0nmhcm6ynzv83kj2";

      doCheck = false;

@ -43,7 +43,7 @@ let
      };

      meta = with lib; {
-        homepage = "https://www.syncthing.net/";
+        homepage = "https://syncthing.net/";
        description = "Open Source Continuous File Synchronization";
        license = licenses.mpl20;
        maintainers = with maintainers; [ pshendry joko peterhoeg andrew-d ];
--- a/pkgs/applications/radio/gnss-sdr/default.nix
+++ b/pkgs/applications/radio/gnss-sdr/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "gnss-sdr";
-  version = "0.0.12";
+  version = "0.0.13";

  src = fetchFromGitHub {
    owner = "gnss-sdr";
    repo = "gnss-sdr";
    rev = "v${version}";
-    sha256 = "0i9cz85jc2m758pzy3bq4dk4vj9wv7k2z118lasb09xldx01dwsq";
+    sha256 = "0a3k47fl5dizzhbqbrbmckl636lznyjby2d2nz6fz21637hvrnby";
  };

  buildInputs = [
--- a/pkgs/applications/radio/limesuite/default.nix
+++ b/pkgs/applications/radio/limesuite/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "limesuite";
-  version = "20.07.1";
+  version = "20.07.2";

  src = fetchFromGitHub {
    owner = "myriadrf";
    repo = "LimeSuite";
    rev = "v${version}";
-    sha256 = "14mxqc350j3rk1202n0ax1rfx49sy40965zj90d4pnakbgz5xr7g";
+    sha256 = "0v0w0f5ff1gwpfy13x1q1jsx9xfg4s3ccg05ikpnkzj4yg6sjps1";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/electronics/openhantek6022/default.nix
+++ b/pkgs/applications/science/electronics/openhantek6022/default.nix
@ -0,0 +1,31 @@
+{ mkDerivation, lib, fetchFromGitHub, makeWrapper, cmake, qtbase, qttools, fftw, libusb1, libglvnd }:
+
+mkDerivation rec {
+  pname = "openhantek6022";
+  version = "3.1.1";
+
+  src = fetchFromGitHub {
+    owner = "OpenHantek";
+    repo = "OpenHantek6022";
+    rev = version;
+    sha256 = "17b0qmz7g0nk7n7jhbh5xhs135dpj9kv41n42vvpdzwr6z5rk4qm";
+  };
+
+  nativeBuildInputs = [ cmake makeWrapper ];
+  buildInputs = [ fftw libusb1 libglvnd qtbase qttools ];
+
+  postPatch = ''
+    # Fix up install paths & checks
+    sed -i 's#if(EXISTS ".*")#if(1)#g' CMakeLists.txt
+    sed -i 's#/lib/udev#lib/udev#g' CMakeLists.txt
+    sed -i 's#/usr/share#share#g' CMakeLists.txt
+  '';
+
+  meta = with lib; {
+    description = "Free software for Hantek and compatible (Voltcraft/Darkwire/Protek/Acetech) USB digital signal oscilloscopes";
+    homepage    = "https://github.com/OpenHantek/OpenHantek6022";
+    license     = licenses.gpl3;
+    maintainers = with maintainers; [ baracoder ];
+    platforms = qtbase.meta.platforms;
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
@ -4,7 +4,6 @@ buildGoModule rec {
  pname = "git-bug";
  version = "0.7.1"; # the `rev` below pins the version of the source to get
  rev = "2d64b85db71a17ff3277bbbf7ac9d8e81f8e416c";
-  goPackagePath = "github.com/MichaelMure/git-bug";

  src = fetchFromGitHub {
    inherit rev;
@ -19,9 +18,9 @@ buildGoModule rec {

  buildFlagsArray = ''
    -ldflags=
-      -X ${goPackagePath}/commands.GitCommit=${rev}
-      -X ${goPackagePath}/commands.GitLastTag=${version}
-      -X ${goPackagePath}/commands.GitExactTag=${version}
+      -X github.com/MichaelMure/git-bug/commands.GitCommit=${rev}
+      -X github.com/MichaelMure/git-bug/commands.GitLastTag=${version}
+      -X github.com/MichaelMure/git-bug/commands.GitExactTag=${version}
  '';

  postInstall = ''
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gitkraken";
-  version = "7.1.0";
+  version = "7.2.0";

  src = fetchzip {
    url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-    sha256 = "1g7i7sq705x5jkp76z4car9na3qvklpi3a766yiv4h79kc5via48";
+    sha256 = "0nrrcwikx6dx1j1s0b80gh1s932zvxmijpddqp6a1vh3ddc5v1mp";
  };

  dontBuild = true;
--- a/pkgs/applications/version-management/redmine/0001-python3.patch
+++ b/pkgs/applications/version-management/redmine/0001-python3.patch
@ -0,0 +1,275 @@
+--- a/lib/redmine/scm/adapters/mercurial/redminehelper.py
+++ b/lib/redmine/scm/adapters/mercurial/redminehelper.py
+@@ -45,17 +45,20 @@ Output example of rhmanifest::
+       </repository>
+     </rhmanifest>
+ """
+-import re, time, cgi, urllib
+import re, time, html, urllib
+ from mercurial import cmdutil, commands, node, error, hg, registrar
+ 
+ cmdtable = {}
+ command = registrar.command(cmdtable) if hasattr(registrar, 'command') else cmdutil.command(cmdtable)
+ 
+-_x = cgi.escape
+-_u = lambda s: cgi.escape(urllib.quote(s))
+_x = lambda s: html.escape(s.decode('utf-8')).encode('utf-8')
+_u = lambda s: html.escape(urllib.parse.quote(s)).encode('utf-8')
+
+def unquoteplus(*args, **kwargs):
+    return urllib.parse.unquote_to_bytes(*args, **kwargs).replace(b'+', b' ')
+ 
+ def _changectx(repo, rev):
+-    if isinstance(rev, str):
+    if isinstance(rev, bytes):
+        rev = repo.lookup(rev)
+     if hasattr(repo, 'changectx'):
+         return repo.changectx(rev)
+@@ -70,10 +73,10 @@ def _tip(ui, repo):
+         except TypeError:  # Mercurial < 1.1
+             return repo.changelog.count() - 1
+     tipctx = _changectx(repo, tiprev())
+-    ui.write('<tip revision="%d" node="%s"/>\n'
+    ui.write(b'<tip revision="%d" node="%s"/>\n'
+              % (tipctx.rev(), _x(node.hex(tipctx.node()))))
+ 
+-_SPECIAL_TAGS = ('tip',)
+_SPECIAL_TAGS = (b'tip',)
+ 
+ def _tags(ui, repo):
+     # see mercurial/commands.py:tags
+@@ -84,7 +87,7 @@ def _tags(ui, repo):
+             r = repo.changelog.rev(n)
+         except error.LookupError:
+             continue
+-        ui.write('<tag revision="%d" node="%s" name="%s"/>\n'
+        ui.write(b'<tag revision="%d" node="%s" name="%s"/>\n'
+                  % (r, _x(node.hex(n)), _x(t)))
+ 
+ def _branches(ui, repo):
+@@ -104,136 +107,148 @@ def _branches(ui, repo):
+             return repo.branchheads(branch)
+     def lookup(rev, n):
+         try:
+-            return repo.lookup(rev)
+            return repo.lookup(str(rev).encode('utf-8'))
+         except RuntimeError:
+             return n
+     for t, n, r in sorted(iterbranches(), key=lambda e: e[2], reverse=True):
+         if lookup(r, n) in branchheads(t):
+-            ui.write('<branch revision="%d" node="%s" name="%s"/>\n'
+            ui.write(b'<branch revision="%d" node="%s" name="%s"/>\n'
+                      % (r, _x(node.hex(n)), _x(t)))
+ 
+ def _manifest(ui, repo, path, rev):
+     ctx = _changectx(repo, rev)
+-    ui.write('<manifest revision="%d" path="%s">\n'
+    ui.write(b'<manifest revision="%d" path="%s">\n'
+              % (ctx.rev(), _u(path)))
+ 
+     known = set()
+-    pathprefix = (path.rstrip('/') + '/').lstrip('/')
+    pathprefix = (path.decode('utf-8').rstrip('/') + '/').lstrip('/')
+     for f, n in sorted(ctx.manifest().iteritems(), key=lambda e: e[0]):
+-        if not f.startswith(pathprefix):
+        fstr = f.decode('utf-8')
+        if not fstr.startswith(pathprefix):
+             continue
+-        name = re.sub(r'/.*', '/', f[len(pathprefix):])
+        name = re.sub(r'/.*', '/', fstr[len(pathprefix):])
+         if name in known:
+             continue
+         known.add(name)
+ 
+         if name.endswith('/'):
+-            ui.write('<dir name="%s"/>\n'
+            ui.write(b'<dir name="%s"/>\n'
+                      % _x(urllib.quote(name[:-1])))
+         else:
+             fctx = repo.filectx(f, fileid=n)
+             tm, tzoffset = fctx.date()
+-            ui.write('<file name="%s" revision="%d" node="%s" '
+-                     'time="%d" size="%d"/>\n'
+            ui.write(b'<file name="%s" revision="%d" node="%s" '
+                     b'time="%d" size="%d"/>\n'
+                      % (_u(name), fctx.rev(), _x(node.hex(fctx.node())),
+                         tm, fctx.size(), ))
+ 
+-    ui.write('</manifest>\n')
+    ui.write(b'</manifest>\n')
+ 
+-@command('rhannotate',
+-         [('r', 'rev', '', 'revision'),
+-          ('u', 'user', None, 'list the author (long with -v)'),
+-          ('n', 'number', None, 'list the revision number (default)'),
+-          ('c', 'changeset', None, 'list the changeset'),
+@command(b'rhannotate',
+         [(b'r', b'rev', b'', b'revision'),
+          (b'u', b'user', None, b'list the author (long with -v)'),
+          (b'n', b'number', None, b'list the revision number (default)'),
+          (b'c', b'changeset', None, b'list the changeset'),
+          ],
+-         'hg rhannotate [-r REV] [-u] [-n] [-c] FILE...')
+         b'hg rhannotate [-r REV] [-u] [-n] [-c] FILE...')
+ def rhannotate(ui, repo, *pats, **opts):
+-    rev = urllib.unquote_plus(opts.pop('rev', None))
+    rev = unquoteplus(opts.pop('rev', b''))
+     opts['rev'] = rev
+-    return commands.annotate(ui, repo, *map(urllib.unquote_plus, pats), **opts)
+    return commands.annotate(ui, repo, *map(unquoteplus, pats), **opts)
+ 
+-@command('rhcat',
+-               [('r', 'rev', '', 'revision')],
+-               'hg rhcat ([-r REV] ...) FILE...')
+@command(b'rhcat',
+               [(b'r', b'rev', b'', b'revision')],
+               b'hg rhcat ([-r REV] ...) FILE...')
+ def rhcat(ui, repo, file1, *pats, **opts):
+-    rev = urllib.unquote_plus(opts.pop('rev', None))
+    rev = unquoteplus(opts.pop('rev', b''))
+     opts['rev'] = rev
+-    return commands.cat(ui, repo, urllib.unquote_plus(file1), *map(urllib.unquote_plus, pats), **opts)
+    return commands.cat(ui, repo, unquoteplus(file1), *map(unquoteplus, pats), **opts)
+ 
+-@command('rhdiff',
+-               [('r', 'rev', [], 'revision'),
+-                ('c', 'change', '', 'change made by revision')],
+-               'hg rhdiff ([-c REV] | [-r REV] ...) [FILE]...')
+@command(b'rhdiff',
+               [(b'r', b'rev', [], b'revision'),
+                (b'c', b'change', b'', b'change made by revision')],
+               b'hg rhdiff ([-c REV] | [-r REV] ...) [FILE]...')
+ def rhdiff(ui, repo, *pats, **opts):
+     """diff repository (or selected files)"""
+     change = opts.pop('change', None)
+     if change:  # add -c option for Mercurial<1.1
+         base = _changectx(repo, change).parents()[0].rev()
+-        opts['rev'] = [str(base), change]
+        opts['rev'] = [base, change]
+     opts['nodates'] = True
+-    return commands.diff(ui, repo, *map(urllib.unquote_plus, pats), **opts)
+-
+-@command('rhlog',
+-                   [
+-                    ('r', 'rev', [], 'show the specified revision'),
+-                    ('b', 'branch', [],
+-                       'show changesets within the given named branch'),
+-                    ('l', 'limit', '',
+-                         'limit number of changes displayed'),
+-                    ('d', 'date', '',
+-                         'show revisions matching date spec'),
+-                    ('u', 'user', [],
+-                      'revisions committed by user'),
+-                    ('', 'from', '',
+-                      ''),
+-                    ('', 'to', '',
+-                      ''),
+-                    ('', 'rhbranch', '',
+-                      ''),
+-                    ('', 'template', '',
+-                       'display with template')],
+-                   'hg rhlog [OPTION]... [FILE]')
+    return commands.diff(ui, repo, *map(unquoteplus, pats), **opts)
+
+@command(b'rhlog',
+                  [
+                    (b'r', b'rev', [], b'show the specified revision'),
+                    (b'b', b'branch', [],
+                       b'show changesets within the given named branch'),
+                    (b'l', b'limit', b'',
+                         b'limit number of changes displayed'),
+                    (b'd', b'date', b'',
+                         b'show revisions matching date spec'),
+                    (b'u', b'user', [],
+                      b'revisions committed by user'),
+                    (b'', b'from', b'',
+                      b''),
+                    (b'', b'to', b'',
+                      b''),
+                    (b'', b'rhbranch', b'',
+                      b''),
+                    (b'', b'template', b'',
+                       b'display with template')],
+                   b'hg rhlog [OPTION]... [FILE]')
+
+ def rhlog(ui, repo, *pats, **opts):
+     rev      = opts.pop('rev')
+     bra0     = opts.pop('branch')
+-    from_rev = urllib.unquote_plus(opts.pop('from', None))
+-    to_rev   = urllib.unquote_plus(opts.pop('to'  , None))
+-    bra      = urllib.unquote_plus(opts.pop('rhbranch', None))
+-    from_rev = from_rev.replace('"', '\\"')
+-    to_rev   = to_rev.replace('"', '\\"')
+-    if hg.util.version() >= '1.6':
+-      opts['rev'] = ['"%s":"%s"' % (from_rev, to_rev)]
+    from_rev = unquoteplus(opts.pop('from', b''))
+    to_rev   = unquoteplus(opts.pop('to'  , b''))
+    bra      = unquoteplus(opts.pop('rhbranch', b''))
+    from_rev = from_rev.replace(b'"', b'\\"')
+    to_rev   = to_rev.replace(b'"', b'\\"')
+    if (from_rev != b'') or (to_rev != b''):
+        if from_rev != b'':
+            quotefrom = b'"%s"' % (from_rev)
+        else:
+            quotefrom = from_rev
+        if to_rev != b'':
+            quoteto = b'"%s"' % (to_rev)
+        else:
+            quoteto = to_rev
+        opts['rev'] = [b'%s:%s' % (quotefrom, quoteto)]
+     else:
+-      opts['rev'] = ['%s:%s' % (from_rev, to_rev)]
+-    opts['branch'] = [bra]
+-    return commands.log(ui, repo, *map(urllib.unquote_plus, pats), **opts)
+-
+-@command('rhmanifest',
+-                   [('r', 'rev', '', 'show the specified revision')],
+-                   'hg rhmanifest [-r REV] [PATH]')
+-def rhmanifest(ui, repo, path='', **opts):
+        opts['rev'] = rev
+    if (bra != b''):
+        opts['branch'] = [bra]
+    return commands.log(ui, repo, *map(unquoteplus, pats), **opts)
+
+
+@command(b'rhmanifest',
+                   [(b'r', b'rev', b'', b'show the specified revision')],
+                   b'hg rhmanifest -r REV [PATH]')
+def rhmanifest(ui, repo, path=b'', **opts):
+     """output the sub-manifest of the specified directory"""
+-    ui.write('<?xml version="1.0"?>\n')
+-    ui.write('<rhmanifest>\n')
+-    ui.write('<repository root="%s">\n' % _u(repo.root))
+    ui.write(b'<?xml version="1.0"?>\n')
+    ui.write(b'<rhmanifest>\n')
+    ui.write(b'<repository root="%s">\n' % _u(repo.root))
+     try:
+-        _manifest(ui, repo, urllib.unquote_plus(path), urllib.unquote_plus(opts.get('rev')))
+        _manifest(ui, repo, unquoteplus(path), unquoteplus(opts.get('rev')))
+     finally:
+-        ui.write('</repository>\n')
+-        ui.write('</rhmanifest>\n')
+        ui.write(b'</repository>\n')
+        ui.write(b'</rhmanifest>\n')
+ 
+-@command('rhsummary',[], 'hg rhsummary')
+@command(b'rhsummary',[], b'hg rhsummary')
+ def rhsummary(ui, repo, **opts):
+     """output the summary of the repository"""
+-    ui.write('<?xml version="1.0"?>\n')
+-    ui.write('<rhsummary>\n')
+-    ui.write('<repository root="%s">\n' % _u(repo.root))
+    ui.write(b'<?xml version="1.0"?>\n')
+    ui.write(b'<rhsummary>\n')
+    ui.write(b'<repository root="%s">\n' % _u(repo.root))
+     try:
+         _tip(ui, repo)
+         _tags(ui, repo)
+         _branches(ui, repo)
+         # TODO: bookmarks in core (Mercurial>=1.8)
+     finally:
+-        ui.write('</repository>\n')
+-        ui.write('</rhsummary>\n')
+        ui.write(b'</repository>\n')
+        ui.write(b'</rhsummary>\n')
+ 
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -21,6 +21,10 @@ in

    buildInputs = [ rubyEnv rubyEnv.wrappedRuby rubyEnv.bundler ];

+    # taken from https://www.redmine.org/issues/33784
+    # can be dropped when the upstream bug is closed and the fix is present in the upstream release
+    patches = [ ./0001-python3.patch ];
+
    buildPhase = ''
      mv config config.dist
      mv public/themes public/themes.dist
--- a/pkgs/applications/version-management/sourcehut/builds.nix
+++ b/pkgs/applications/version-management/sourcehut/builds.nix
@ -9,11 +9,10 @@ let
  buildWorker = src: buildGoModule {
    inherit src version;
    pname = "builds-sr-ht-worker";
-    goPackagePath = "git.sr.ht/~sircmpwn/builds.sr.ht/worker";

-  vendorSha256 = "0prdlihcy5yz760llwyby747yy2981dn3gy401a48df7ndlfj6lp";
+    vendorSha256 = "0prdlihcy5yz760llwyby747yy2981dn3gy401a48df7ndlfj6lp";

-  doCheck = false;
+    doCheck = false;
  };
 in buildPythonPackage rec {
  inherit version;
--- a/pkgs/applications/version-management/sourcehut/git.nix
+++ b/pkgs/applications/version-management/sourcehut/git.nix
@ -9,41 +9,37 @@ let
  buildShell = src: buildGoModule {
    inherit src version;
    pname = "gitsrht-shell";
-    goPackagePath = "git.sr.ht/~sircmpwn/git.sr.ht/gitsrht-shell";

-  vendorSha256 = "1zvbqn4r940mibn4h1cqz94gbr476scm281ps361n0rfqlimw8g5";
+    vendorSha256 = "1zvbqn4r940mibn4h1cqz94gbr476scm281ps361n0rfqlimw8g5";

-  doCheck = false;
+    doCheck = false;
  };

  buildDispatcher = src: buildGoModule {
    inherit src version;
    pname = "gitsrht-dispatcher";
-    goPackagePath = "git.sr.ht/~sircmpwn/git.sr.ht/gitsrht-dispatch";

-  vendorSha256 = "1lzkf13m54pq0gnn3bcxc80nfg76hgck4l8q8jpaicrsiwgcyrd9";
+    vendorSha256 = "1lzkf13m54pq0gnn3bcxc80nfg76hgck4l8q8jpaicrsiwgcyrd9";

-  doCheck = false;
+    doCheck = false;
  };

  buildKeys = src: buildGoModule {
    inherit src version;
    pname = "gitsrht-keys";
-    goPackagePath = "git.sr.ht/~sircmpwn/git.sr.ht/gitsrht-keys";

-  vendorSha256 = "16j7kpar318s4766pln8xn6d51xqblwig5n1jywhj0sl80qjl5cv";
+    vendorSha256 = "16j7kpar318s4766pln8xn6d51xqblwig5n1jywhj0sl80qjl5cv";

-  doCheck = false;
+    doCheck = false;
  };

  buildUpdateHook = src: buildGoModule {
    inherit src version;
    pname = "gitsrht-update-hook";
-    goPackagePath = "git.sr.ht/~sircmpwn/git.sr.ht/gitsrht-update-hook";

-  vendorSha256 = "1rmv3p60g6w4h4v9wx99jkyx0q02snslyjrjy9n1flardjs01b63";
+    vendorSha256 = "1rmv3p60g6w4h4v9wx99jkyx0q02snslyjrjy9n1flardjs01b63";

-  doCheck = false;
+    doCheck = false;
  };
 in buildPythonPackage rec {
  inherit version;
--- a/pkgs/applications/virtualization/qemu/utils.nix
+++ b/pkgs/applications/virtualization/qemu/utils.nix
@ -1,9 +1,10 @@
-{ stdenv, qemu }:
+{ stdenv, installShellFiles, qemu }:

 stdenv.mkDerivation rec {
  name = "qemu-utils-${version}";
  version = qemu.version;

+  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ qemu ];
  unpackPhase = "true";

@ -12,6 +13,9 @@ stdenv.mkDerivation rec {
    cp "${qemu}/bin/qemu-img" "$out/bin/qemu-img"
    cp "${qemu}/bin/qemu-io"  "$out/bin/qemu-io"
    cp "${qemu}/bin/qemu-nbd" "$out/bin/qemu-nbd"
+
+    installManPage ${qemu}/share/man/man1/qemu-img.1.gz
+    installManPage ${qemu}/share/man/man8/qemu-nbd.8.gz
  '';

  inherit (qemu) meta;
--- a/pkgs/data/misc/spdx-license-list-data/default.nix
+++ b/pkgs/data/misc/spdx-license-list-data/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "spdx-license-list-data";
-  version = "3.9";
+  version = "3.10";

  src = fetchFromGitHub {
    owner = "spdx";
    repo = "license-list-data";
    rev = "v${version}";
-    sha256 = "0qf0g7a3jby8sngdjdic30xrb6ch56d6gzpphs8lkm6giir142rj";
+    sha256 = "1zza0jrs82112dcjqgkyck2b7hv4kg9s10pmlripi6c1rs37av14";
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@ -4,11 +4,11 @@
 , swingSupport ? true }:

 let
-  version = "8.28.0.1";
-  openjdk = "8.0.163";
+  version = "8.48.0.53";
+  openjdk = "8.0.265";

-  sha256_linux = "1z8s3a948nvv92wybnhkyr27ipibcy45k0zv5h5gp37ynd91df45";
-  sha256_darwin = "0i0prjijsgg0yyycplpp9rlfl428126rqz7bb31pchrhi6jhk699";
+  sha256_linux = "ed32513524b32a83b3b388831c69d1884df5675bd5069c6d1485fd1a060be209";
+  sha256_darwin = "36f189bfbd0255195848835819377474ba9c1c868e3c204633c451c96e21f30a";

  platform = if stdenv.isDarwin then "macosx" else "linux";
  hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
@ -29,7 +29,7 @@ in stdenv.mkDerivation {
  pname = "zulu";

  src = fetchurl {
-    url = "https://cdn.azul.com/zulu/bin/zulu${version}-jdk${openjdk}-${platform}_x64.${extension}";
+    url = "https://cdn.azul.com/zulu/bin/zulu${version}-ca-jdk${openjdk}-${platform}_x64.${extension}";
    sha256 = hash;
  };

--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@ -4,11 +4,11 @@
 , swingSupport ? true }:

 let
-  version = "10.1+11";
-  openjdk = "10";
+  version = "11.41.23";
+  openjdk = "11.0.8";

-  sha256_linux = "0g51n2zc7inal29n5ly3mrrfj15c7vl87zb6b2r1q67n4mnbrgm8";
-  sha256_darwin = "1c5ib136nv6gz7ij31mg15nhzrl6zr7kp8spm17zwm1ib82bc73y";
+  sha256_linux = "f8aee4ab30ca11ab3c8f401477df0e455a9d6b06f2710b2d1b1ddcf06067bc79";
+  sha256_darwin = "643c6648cc4374f39e830e4fcb3d68f8667893d487c07eb7091df65937025cc3";

  platform = if stdenv.isDarwin then "macosx" else "linux";
  hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
@ -29,7 +29,7 @@ in stdenv.mkDerivation {
  pname = "zulu";

  src = fetchurl {
-    url = "https://cdn.azul.com/zulu/bin/zulu${version}-jdk${openjdk}-${platform}_x64.${extension}";
+    url = "https://cdn.azul.com/zulu/bin/zulu${version}-ca-jdk${openjdk}-${platform}_x64.${extension}";
    sha256 = hash;
  };

--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "evcxr";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "google";
    repo = "evcxr";
    rev = "v${version}";
-    sha256 = "09xziv2vmjd30yy095l3n33v9vdkbbkyjdcc5azyd76m2fk9vi42";
+    sha256 = "144xqi19d2nj9qgmhpx6d1kfhx9vfkmk7rnq6nzybpx4mbbl3ki2";
  };

-  cargoSha256 = "1cdj5qh3z4bnz2267s83chw6n1kg9zl1hrawkis5rr9vq7llrb24";
+  cargoSha256 = "07lzxh0wh6azrlzfaacg29zmkn8jdnkdqbwgd5ajy79y8nii3c7z";

  nativeBuildInputs = [ pkgconfig makeWrapper cmake ];
  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
--- a/pkgs/development/interpreters/luajit/2.0.nix
+++ b/pkgs/development/interpreters/luajit/2.0.nix
@ -1,10 +1,10 @@
 { self, callPackage, lib }:
 callPackage ./default.nix {
  inherit self;
-  version = "2.0.5-2020-03-20";
-  rev = "e613105";
+  version = "2.0.5-2020-08-05";
+  rev = "2211f6f";
  isStable = true;
-  sha256 = "0k843z90s4hi0qhri6ixy8sv21nig8jwbznpqgqg845ji530kqj7";
+  sha256 = "01adxmknq2xyb3w9sn8ilnar8181h7ksd9i80yrsbwzix5lwkn6m";
  extraMeta = { # this isn't precise but it at least stops the useless Hydra build
    platforms = with lib; filter (p: p != "aarch64-linux")
      (platforms.linux ++ platforms.darwin);
--- a/pkgs/development/interpreters/luajit/2.1.nix
+++ b/pkgs/development/interpreters/luajit/2.1.nix
@ -1,8 +1,8 @@
 { self, callPackage }:
 callPackage ./default.nix {
  inherit self;
-  version = "2.1.0-2020-03-20";
-  rev = "9143e86";
+  version = "2.1.0-2020-08-05";
+  rev = "10ddae7";
  isStable = false;
-  sha256 = "1zw1yr0375d6jr5x20zvkvk76hkaqamjynbswpl604w6r6id070b";
+  sha256 = "1lmjs0gz9vgbhh5f45jvvibpj7f3sz81r8cz4maln9yhc67f2zmk";
 }
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@ -104,6 +104,6 @@ stdenv.mkDerivation rec {
    homepage    = "http://luajit.org";
    license     = licenses.mit;
    platforms   = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ thoughtpolice smironov vcunat andir ];
+    maintainers = with maintainers; [ thoughtpolice smironov vcunat andir lblasc ];
  } // extraMeta;
 }
--- a/pkgs/development/libraries/agda/agda-categories/default.nix
+++ b/pkgs/development/libraries/agda/agda-categories/default.nix
@ -1,14 +1,14 @@
 { lib, mkDerivation, fetchFromGitHub, standard-library }:

 mkDerivation rec {
-  version = "0.1";
+  version = "0.1.3.1";
  pname = "agda-categories";

  src = fetchFromGitHub {
    owner = "agda";
    repo = "agda-categories";
-    rev = "release/v${version}";
-    sha256 = "0m4pjy92jg6zfziyv0bxv5if03g8k4413ld8c3ii2xa8bzfn04m2";
+    rev = "v${version}";
+    sha256 = "08mc20qaz9vp5rhi60rh8wvjkg5aby3bgwwdhfnxha1663qf1q24";
  };

  buildInputs = [ standard-library ];
@ -18,11 +18,6 @@ mkDerivation rec {
    description = "A new Categories library";
    license = licenses.bsd3;
    platforms = platforms.unix;
-    # agda categories takes a lot of memory to build.
-    # This can be removed if this is eventually fixed upstream.
-    hydraPlatforms = [];
-    # Waiting for release 0.2 for this to work
-    broken = true;
    maintainers = with maintainers; [ alexarice turion ];
  };
 }
--- a/pkgs/development/libraries/agda/generic/default.nix
+++ b/pkgs/development/libraries/agda/generic/default.nix
@ -0,0 +1,31 @@
+{ lib, mkDerivation, fetchFromGitHub, standard-library }:
+
+mkDerivation rec {
+  pname = "generic";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    repo = "Generic";
+    owner = "effectfully";
+    rev = "v${version}";
+    sha256 = "121121rg3daaqp91845fbyws6g28hyj1ywmh12n54r3nicb35g5q";
+  };
+
+  buildInputs = [
+    standard-library
+  ];
+
+  preBuild = ''
+    echo "module Everything where" > Everything.agda
+	  find src -name '*.agda' | sed -e 's/src\///;s/\//./g;s/\.agda$//;s/^/import /' >> Everything.agda
+  '';
+
+  meta = with lib; {
+    description =
+      "A library for doing generic programming in Agda";
+    homepage = src.meta.homepage;
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ alexarice turion ];
+  };
+}
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "cpp-utilities";
-  version = "5.5.0";
+  version = "5.6.0";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1kzwclf8l89dbw10ya0grhdj7dspmj7rg7rkaa8b7n5lgla968jr";
+    sha256 = "0998pyrxicpalm2w1wmv7qrfhzgr45kl6xh9gv0zxhx2a4xjqq5v";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/fontconfig/2.10.nix
+++ b/pkgs/development/libraries/fontconfig/2.10.nix
@ -1,47 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, freetype, expat
-}:
-
-stdenv.mkDerivation rec {
-  name = "fontconfig-2.10.2";
-
-  src = fetchurl {
-    url = "http://fontconfig.org/release/${name}.tar.bz2";
-    sha256 = "0llraqw86jmw4vzv7inskp3xxm2gc64my08iwq5mzncgfdbfza4f";
-  };
-
-  outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
-
-  propagatedBuildInputs = [ freetype ];
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ expat ];
-
-  configureFlags = [
-    "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
-    "--sysconfdir=/etc"
-    "--with-cache-dir=/var/cache/fontconfig"
-    "--disable-docs"
-    "--with-default-fonts="
-  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  # Don't try to write to /var/cache/fontconfig at install time.
-  installFlags = [ "sysconfdir=$(out)/etc" "fc_cachedir=$(TMPDIR)/dummy" "RUN_FC_CACHE_TEST=false" ];
-
-  passthru = {
-    # Empty for backward compatibility, there was no versioning before 2.11
-    configVersion = "";
-  };
-
-  meta = with stdenv.lib; {
-    description = "A library for font customization and configuration";
-    homepage = "http://fontconfig.org/";
-    license = licenses.bsd2; # custom but very bsd-like
-    platforms = platforms.all;
-    maintainers = [ maintainers.vcunat ];
-  };
-}
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@ -12,6 +12,9 @@ stdenv.mkDerivation rec {

  buildInputs = [ python ];

+  # https://trac.osgeo.org/geos/ticket/993
+  configureFlags = stdenv.lib.optional stdenv.isAarch32 "--disable-inline";
+
  meta = with stdenv.lib; {
    description = "C++ port of the Java Topology Suite (JTS)";
    homepage = "https://trac.osgeo.org/geos";
--- a/pkgs/development/libraries/gthree/default.nix
+++ b/pkgs/development/libraries/gthree/default.nix
@ -3,10 +3,10 @@
 , fetchpatch
 , ninja
 , meson
-, pkgconfig
+, pkg-config
 , gobject-introspection
 , gtk-doc
-, docbook_xsl
+, docbook-xsl-nons
 , docbook_xml_dtd_43
 , glib
 , gtk3
@ -17,7 +17,7 @@

 stdenv.mkDerivation rec {
  pname = "gthree";
-  version = "0.2.0";
+  version = "0.9.0";

  outputs = [ "out" "dev" "devdoc" ];

@ -25,32 +25,42 @@ stdenv.mkDerivation rec {
    owner = "alexlarsson";
    repo = "gthree";
    rev = version;
-    sha256 = "16ap1ampnzsyhrs84b168d6889lh8sjr2j5sqv9mdbnnhy72p5cd";
+    sha256 = "09fcnjc3j21lh5fjf067wm35sb4qni4vgzing61kixnn2shy79iy";
  };

+  patches = [
+    # Add option for disabling examples
+    (fetchpatch {
+      url = "https://github.com/alexlarsson/gthree/commit/75f05c40aba9d5f603d8a3c490c3406c1fe06776.patch";
+      sha256 = "PBwLz4DLhC+7BtypVTFMFiF3hKAJeskU3XBKFHa3a84=";
+    })
+  ];
+
  nativeBuildInputs = [
    ninja
    meson
-    pkgconfig
+    pkg-config
    gtk-doc
-    docbook_xsl
+    docbook-xsl-nons
    docbook_xml_dtd_43
    gobject-introspection
  ];

  buildInputs = [
    epoxy
+    json-glib
  ];

  propagatedBuildInputs = [
    glib
    gtk3
    graphene
-    json-glib
  ];

  mesonFlags = [
    "-Dgtk_doc=${if stdenv.isDarwin then "false" else "true"}"
+    # Data for examples is useless when the example programs are not installed.
+    "-Dexamples=false"
  ];

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/libmaxminddb/default.nix
+++ b/pkgs/development/libraries/libmaxminddb/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libmaxminddb";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchurl {
    url = meta.homepage + "/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0mnimbaxnnarlw7g1rh8lpxsyf7xnmzwcczcc3lxw8xyf6ljln6x";
+    sha256 = "0fd4a4sxiiwzbd5h74wl1ijnb7xybjyybb7q41vdq3w8nk3zdzd5";
  };

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/seasocks/default.nix
+++ b/pkgs/development/libraries/seasocks/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "seasocks";
-  version = "1.4.3";
+  version = "1.4.4";

  src = fetchFromGitHub {
    owner = "mattgodbolt";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1c2gc0k9wgbgn7y7wmq2ylp0gvdbmagc1x8c4jwbsncl1gy6x4g2";
+    sha256 = "1f9a3mx3yjmr5qry4rc1c7mrx3348iifxm7d8sj8yd41kqnzmfv4";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@ -28,12 +28,6 @@ stdenv.mkDerivation rec {

  mesonFlags = [ "-Dlogind-provider=systemd" ];

-  postInstall = ''
-    # Copy the library to $examples
-    mkdir -p $examples/lib
-    cp -P libwlroots* $examples/lib/
-  '';
-
  postFixup = ''
    # Install ALL example programs to $examples:
    # screencopy dmabuf-capture input-inhibitor layer-shell idle-inhibit idle
--- a/pkgs/development/lua-modules/luaexpat.patch
+++ b/pkgs/development/lua-modules/luaexpat.patch
@ -0,0 +1,36 @@
+diff --git a/src/lxplib.c b/src/lxplib.c
+index 1c972db..5712611 100644
+--- a/src/lxplib.c
+++ b/src/lxplib.c
+@@ -590,7 +590,7 @@ static void set_info (lua_State *L) {
+ /*
+ ** Adapted from Lua 5.2.0
+ */
+-static void luaL_setfuncs (lua_State *L, const luaL_Reg *l, int nup) {
+static void compat_luaL_setfuncs (lua_State *L, const luaL_Reg *l, int nup) {
+   luaL_checkstack(L, nup, "too many upvalues");
+   for (; l->name != NULL; l++) {  /* fill the table with given functions */
+     int i;
+@@ -602,6 +602,8 @@ static void luaL_setfuncs (lua_State *L, const luaL_Reg *l, int nup) {
+   }
+   lua_pop(L, nup);  /* remove upvalues */
+ }
+#else
+#define compat_luaL_setfuncs(L, reg, nup) luaL_setfuncs(L, reg, nup)
+ #endif
+ 
+ 
+@@ -612,11 +614,11 @@ int luaopen_lxp (lua_State *L) {
+ 	lua_pushvalue(L, -2);
+ 	lua_rawset(L, -3);
+ 
+-	luaL_setfuncs (L, lxp_meths, 0);
+	compat_luaL_setfuncs (L, lxp_meths, 0);
+ 	lua_pop (L, 1); /* remove metatable */
+ 
+ 	lua_newtable (L);
+-	luaL_setfuncs (L, lxp_funcs, 0);
+	compat_luaL_setfuncs (L, lxp_funcs, 0);
+ 	set_info (L);
+ 	return 1;
+ }
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@ -204,6 +204,9 @@ with super;
    externalDeps = [
      { name = "EXPAT"; dep = pkgs.expat; }
    ];
+    patches = [
+      ./luaexpat.patch
+    ];
  });

  # TODO Somehow automatically amend buildInputs for things that need luaffi
--- a/pkgs/development/mobile/cocoapods/Gemfile-beta.lock
+++ b/pkgs/development/mobile/cocoapods/Gemfile-beta.lock
@ -14,11 +14,10 @@ GEM
      json (>= 1.5.1)
    atomos (0.1.3)
    claide (1.0.3)
-    cocoapods (1.10.0.beta.1)
-      activesupport (> 5)
+    cocoapods (1.10.0.beta.2)
      addressable (~> 2.6)
      claide (>= 1.0.2, < 2.0)
-      cocoapods-core (= 1.10.0.beta.1)
+      cocoapods-core (= 1.10.0.beta.2)
      cocoapods-deintegrate (>= 1.0.3, < 2.0)
      cocoapods-downloader (>= 1.4.0, < 2.0)
      cocoapods-plugins (>= 1.0.0, < 2.0)
@ -33,7 +32,7 @@ GEM
      nap (~> 1.0)
      ruby-macho (~> 1.4)
      xcodeproj (>= 1.17.0, < 2.0)
-    cocoapods-core (1.10.0.beta.1)
+    cocoapods-core (1.10.0.beta.2)
      activesupport (> 5.0, < 6)
      addressable (~> 2.6)
      algoliasearch (~> 1.0)
@ -53,7 +52,7 @@ GEM
      netrc (~> 0.11)
    cocoapods-try (1.2.0)
    colored2 (3.1.2)
-    concurrent-ruby (1.1.6)
+    concurrent-ruby (1.1.7)
    escape (0.0.4)
    ethon (0.12.0)
      ffi (>= 1.3.0)
@ -77,7 +76,7 @@ GEM
      ethon (>= 0.9.0)
    tzinfo (1.2.7)
      thread_safe (~> 0.1)
-    xcodeproj (1.17.1)
+    xcodeproj (1.18.0)
      CFPropertyList (>= 2.3.3, < 4.0)
      atomos (~> 0.1.3)
      claide (>= 1.0.2, < 2.0)
--- a/pkgs/development/mobile/cocoapods/gemset-beta.nix
+++ b/pkgs/development/mobile/cocoapods/gemset-beta.nix
@ -63,15 +63,15 @@
    version = "1.0.3";
  };
  cocoapods = {
-    dependencies = ["activesupport" "addressable" "claide" "cocoapods-core" "cocoapods-deintegrate" "cocoapods-downloader" "cocoapods-plugins" "cocoapods-search" "cocoapods-trunk" "cocoapods-try" "colored2" "escape" "fourflusher" "gh_inspector" "molinillo" "nap" "ruby-macho" "xcodeproj"];
+    dependencies = ["addressable" "claide" "cocoapods-core" "cocoapods-deintegrate" "cocoapods-downloader" "cocoapods-plugins" "cocoapods-search" "cocoapods-trunk" "cocoapods-try" "colored2" "escape" "fourflusher" "gh_inspector" "molinillo" "nap" "ruby-macho" "xcodeproj"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0mx6gzs1d9za7crgwmk37ybmn395055kzya88iamgcj3yzvv3sqg";
+      sha256 = "0jf5q75h410b6gymy86j4zy9yhb6n28wa7hrk8p7y2dsafdzbric";
      type = "gem";
    };
-    version = "1.10.0.beta.1";
+    version = "1.10.0.beta.2";
  };
  cocoapods-core = {
    dependencies = ["activesupport" "addressable" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap" "netrc" "public_suffix" "typhoeus"];
@ -79,10 +79,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ibc5sx2iqjwrgmd4y2cq6hyd6s37aqyh2w61vw71ap8khcjnwh4";
+      sha256 = "0vrw6v5fp0m903ghvfwaw3mbxrr68x7hz9bj34rj4icirwp4ifyl";
      type = "gem";
    };
-    version = "1.10.0.beta.1";
+    version = "1.10.0.beta.2";
  };
  cocoapods-deintegrate = {
    groups = ["default"];
@ -161,10 +161,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "094387x4yasb797mv07cs3g6f08y56virc2rjcpb1k79rzaj3nhl";
+      sha256 = "1vnxrbhi7cq3p4y2v9iwd10v1c7l15is4var14hwnb2jip4fyjzz";
      type = "gem";
    };
-    version = "1.1.6";
+    version = "1.1.7";
  };
  escape = {
    groups = ["default"];
@ -366,9 +366,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0mv5rsbgwq4vzri31w2f1474arrsr5j69rdhklrci6jnjps8dmx9";
+      sha256 = "18idiqfbvyrcyflccwy4qw125psckrnqy7ggci33m8f3zs8h7hnm";
      type = "gem";
    };
-    version = "1.17.1";
+    version = "1.18.0";
  };
 }
--- a/pkgs/development/ocaml-modules/prof_spacetime/default.nix
+++ b/pkgs/development/ocaml-modules/prof_spacetime/default.nix
@ -0,0 +1,43 @@
+{ buildDunePackage
+, lib
+, fetchFromGitHub
+, cmdliner
+, spacetime_lib
+, yojson
+, cohttp
+, ocaml_lwt
+, cohttp-lwt-unix
+, lambdaTerm
+, stdlib-shims
+}:
+
+buildDunePackage rec {
+  pname = "prof_spacetime";
+  version = "0.3.0";
+  useDune2 = true;
+
+  src = fetchFromGitHub {
+    owner = "lpw25";
+    repo = pname;
+    rev = version;
+    sha256 = "1s88gf6x5almmyi58zx4q23w89mvahfjwhvyfg29ya5s1pjbc9hi";
+  };
+
+  buildInputs = [
+    cmdliner
+    spacetime_lib
+    yojson
+    cohttp
+    ocaml_lwt
+    cohttp-lwt-unix
+    lambdaTerm
+    stdlib-shims
+  ];
+
+  meta = {
+    description = "A viewer for OCaml spacetime profiles";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.symphorien ];
+    inherit (src.meta) homepage;
+  };
+}
--- a/pkgs/development/ocaml-modules/spacetime_lib/default.nix
+++ b/pkgs/development/ocaml-modules/spacetime_lib/default.nix
@ -13,6 +13,10 @@ buildDunePackage rec {

  propagatedBuildInputs = [ owee ];

+  preConfigure = ''
+    bash ./configure.sh
+  '';
+
  meta = {
    description = "An OCaml library providing some simple operations for handling OCaml “spacetime” profiles";
    inherit (src.meta) homepage;
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@ -18,13 +18,13 @@

 buildPythonPackage rec {
  pname = "ansible";
-  version = "2.9.11";
+  version = "2.9.12";

  src = fetchFromGitHub {
    owner = "ansible";
    repo = "ansible";
    rev = "v${version}";
-    sha256 = "0a9wgd1ri1av6rcwld36sa48v42003pdf1fx9hhkmhz4icyij0kx";
+    sha256 = "0c794k0cyl54807sh9in0l942ah6g6wlz5kf3qvy5lhd581zlgyb";
  };

  prePatch = ''
--- a/pkgs/development/python-modules/bids-validator/default.nix
+++ b/pkgs/development/python-modules/bids-validator/default.nix
@ -12,7 +12,10 @@ buildPythonPackage rec {
    sha256 = "b8292f4efb3617532f93c60acfec242150406bfd9e298d7f01187d67c311aa91";
  };

-  propagatedBuildInputs = [ ];
+  # needs packages which are not available in nixpkgs
+  doCheck = false;
+
+  pythonImportsCheck = [ "bids_validator" ];

  meta = with lib; {
    description = "Validator for the Brain Imaging Data Structure";
--- a/pkgs/development/python-modules/cheroot/default.nix
+++ b/pkgs/development/python-modules/cheroot/default.nix
@ -8,6 +8,7 @@
 , pytest-mock
 , pytest-testmon
 , requests
+, requests-toolbelt
 , requests-unixsocket
 , setuptools_scm
 , setuptools-scm-git-archive
@ -39,10 +40,15 @@ buildPythonPackage rec {
    pytest-mock
    pytest-testmon
    requests
+    requests-toolbelt
    requests-unixsocket
    trustme
  ];

+  # avoid attempting to use 3 packages not available on nixpkgs
+  # (jaraco.apt, jaraco.context, yg.lockfile)
+  pytestFlagsArray = [ "--ignore=cheroot/test/test_wsgi.py" ];
+
  # Disable doctest plugin because times out
  # Disable xdist (-n arg) because it's incompatible with testmon
  # Deselect test_bind_addr_unix on darwin because times out
--- a/pkgs/development/python-modules/construct/default.nix
+++ b/pkgs/development/python-modules/construct/default.nix
@ -1,27 +1,24 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub
-, six, pytest, arrow
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
+, six, pytestCheckHook, pytest-benchmark, numpy, arrow, ruamel_yaml
 }:

 buildPythonPackage rec {
  pname   = "construct";
-  version = "2.9.45";
+  version = "2.10.56";

+  disabled = pythonOlder "3.6";
+
+  # no tests in PyPI tarball
  src = fetchFromGitHub {
    owner  = pname;
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "0ig66xrzswpkhhmw123p2nvr15a9lxz54a1fmycfdh09327c1d3y";
+    sha256 = "1j4mqwyxkbdcsnnk5bbdcljv855w4fglaqc94q1xdzm8kgjxk4mr";
  };

-  propagatedBuildInputs = [ six ];
+  checkInputs = [ pytestCheckHook pytest-benchmark numpy arrow ruamel_yaml ];

-  checkInputs = [ pytest arrow ];
-
-  # TODO: figure out missing dependencies
-  doCheck = false;
-  checkPhase = ''
-    py.test -k 'not test_numpy and not test_gallery' tests
-  '';
+  pytestFlagsArray = [ "--benchmark-disable" ];

  meta = with stdenv.lib; {
    description = "Powerful declarative parser (and builder) for binary data";
--- a/pkgs/development/python-modules/jc/default.nix
+++ b/pkgs/development/python-modules/jc/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "jc";
-  version = "1.13.1";
+  version = "1.13.4";
  disabled = isPy27;

  src = fetchFromGitHub {
    owner = "kellyjonbrazil";
    repo = "jc";
    rev = "v${version}";
-    sha256 = "1q5s81izfvxlifa0kzj2qih03d4d0gf7jxkilrcv40rsag5jfb16";
+    sha256 = "0rwvyyrdnw43pixp8h51rncq2inc9pbbj1j2191y5si00pjw34zr";
  };

  propagatedBuildInputs = [ ruamel_yaml xmltodict pygments ];
--- a/pkgs/development/python-modules/pendulum/default.nix
+++ b/pkgs/development/python-modules/pendulum/default.nix
@ -1,16 +1,30 @@
 { lib, fetchPypi, buildPythonPackage, pythonOlder
-, dateutil, pytzdata, typing }:
+, dateutil
+, importlib-metadata
+, poetry
+, poetry-core
+, pytzdata
+, typing
+}:

 buildPythonPackage rec {
  pname = "pendulum";
  version = "2.1.2";
+  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
    sha256 = "b06a0ca1bfe41c990bbf0c029f0b6501a7f2ec4e38bfec730712015e8860f207";
  };

-  propagatedBuildInputs = [ dateutil pytzdata ] ++ lib.optional (pythonOlder "3.5") typing;
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
+  nativeBuildInputs = [ poetry-core ];
+  propagatedBuildInputs = [ dateutil pytzdata ]
+  ++ lib.optional (pythonOlder "3.5") typing
+  ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];

  # No tests
  doCheck = false;
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@ -0,0 +1,63 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder, isPy27
+, importlib-metadata
+, intreehooks
+, isort
+, pathlib2
+, pep517
+, pytest-mock
+, pytestCheckHook
+, tomlkit
+, typing
+, virtualenv
+}:
+
+buildPythonPackage rec {
+  pname = "poetry-core";
+  version = "1.0.0a9";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "python-poetry";
+    repo = pname;
+    rev = version;
+    sha256 = "1ln47x1bc1yvhdfwfnkqx4d2j7988a59v8vmcriw14whfgzfki75";
+  };
+
+  # avoid mass-rebuild of python packages
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "^1.7.0" "^1.6.0"
+  '';
+
+  nativeBuildInputs = [
+    intreehooks
+  ];
+
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ] ++ lib.optionals isPy27 [
+    pathlib2
+    typing
+  ];
+
+  checkInputs = [
+    isort
+    pep517
+    pytest-mock
+    pytestCheckHook
+    tomlkit
+    virtualenv
+  ];
+
+  # requires git history to work correctly
+  disabledTests = [ "default_with_excluded_data" ];
+
+  pythonImportsCheck = [ "poetry.core" ];
+
+  meta = with lib; {
+    description = "Core utilities for Poetry";
+    homepage = "https://github.com/python-poetry/poetry-core/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jonringer ];
+  };
+}
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@ -15,12 +15,12 @@
 }:

 buildPythonPackage rec {
-  version = "0.10.2";
+  version = "0.12.0";
  pname = "pybids";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6571ef82e03a958e56aa61cf5b15392f0b2d5dbca92f872061d81524e8da8525";
+    sha256 = "0flvrb61hfyjjgdz07dlm8m9pqwb8qrx027zfrwa9d5nw1az7g28";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pykeepass/default.nix
+++ b/pkgs/development/python-modules/pykeepass/default.nix
@ -1,5 +1,5 @@
 { lib, fetchPypi, buildPythonPackage
-, lxml, pycryptodome, construct
+, lxml, pycryptodomex, construct
 , argon2_cffi, dateutil, future
 }:

@ -12,8 +12,12 @@ buildPythonPackage rec {
    sha256 = "b3e07eb2dd3aeb1dfa1a2d2d17be77066ee560c1e770f1c72d7ea5608117d284";
  };

+  postPatch = ''
+    substituteInPlace setup.py --replace "==" ">="
+  '';
+
  propagatedBuildInputs = [
-    lxml pycryptodome construct
+    lxml pycryptodomex construct
    argon2_cffi dateutil future
  ];

--- a/pkgs/development/python-modules/pytesseract/default.nix
+++ b/pkgs/development/python-modules/pytesseract/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "pytesseract";
-  version = "0.3.4";
+  version = "0.3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "16l9b9f5v0a9j5jfgpd8irk9yhc9byzirrzv1rlkapdbz36sbn5g";
+    sha256 = "1xb5ydwgcfcxzs1k7g6frmhxf1mmivi9ay48qdmf5w4ascirm22l";
  };

  patches = [
--- a/pkgs/development/python-modules/pytzdata/default.nix
+++ b/pkgs/development/python-modules/pytzdata/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "pytzdata";
-  version = "2019.3";
+  version = "2020.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "fac06f7cdfa903188dc4848c655e4adaee67ee0f2fe08e7daf815cf2a761ee5e";
+    sha256 = "3efa13b335a00a8de1d345ae41ec78dd11c9f8807f522d39850f2dd828681540";
  };

  # No tests
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@ -26,11 +26,11 @@

 buildPythonPackage rec {
  pname = "scikit-build";
-  version = "0.10.0";
+  version = "0.11.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "7342017cc82dd6178e3b19377389b8a8d1f8b429d9cdb315cfb1094e34a0f526";
+    sha256 = "0p4smkl2rbpl00m5va5qa8hp2hqb3284p2cs6k8zlmi4kgbdyh6s";
  };

  propagatedBuildInputs = [
@ -59,15 +59,6 @@ buildPythonPackage rec {

  dontUseCmakeConfigure = true;

-  # scikit-build PR #458. Remove in version > 0.10.0
-  patches = [
-    (fetchpatch {
-      name = "python38-platform_linux_distribution-fix-458";
-      url = "https://github.com/scikit-build/scikit-build/commit/faa7284e5bc4c72bc8744987acdf3297b5d2e7e4.patch";
-      sha256 = "1hgl3cnkf266zaw534b64c88waxfz9721wha0m6j3hsnxk76ayjv";
-    })
-  ];
-
  disabledTests = lib.concatMapStringsSep " and " (s: "not " + s) ([
    "test_hello_develop" # tries setuptools develop install
    "test_source_distribution" # pip has no way to install missing dependencies
@ -75,6 +66,7 @@ buildPythonPackage rec {
    "test_fortran_compiler" # passes if gfortran is available
    "test_install_command" # tries to alter out path
    "test_test_command" # tries to alter out path
+    "test_setup" # tries to install using distutils
  ]);

  checkPhase = ''
--- a/pkgs/development/tools/ammonite/default.nix
+++ b/pkgs/development/tools/ammonite/default.nix
@ -8,7 +8,7 @@ let
 common = { scalaVersion, sha256 }:
 stdenv.mkDerivation rec {
  pname = "ammonite";
-  version = "2.0.4";
+  version = "2.2.0";

  src = fetchurl {
    url = "https://github.com/lihaoyi/Ammonite/releases/download/${version}/${scalaVersion}-${version}";
@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
  };
 };
 in {
-  ammonite_2_12 = common { scalaVersion = "2.12"; sha256 = "068lcdi1y3zcspr0qmppflad7a4kls9gi321rp8dc5qc6f9nnk04"; };
-  ammonite_2_13 = common { scalaVersion = "2.13"; sha256 = "0fa0q9nk00crr2ws2mmw6pp4vf0xy53bqqhnws524ywwg6zwrl9s"; };
+  ammonite_2_12 = common { scalaVersion = "2.12"; sha256 = "0nclfqwy3jfn1680z1hd0zzmc0b79wpvx6gn1jnm19aq7qcvh5zp"; };
+  ammonite_2_13 = common { scalaVersion = "2.13"; sha256 = "104bnahn382sb6vwjvchsg0jrnkkwjn08rfh0g5ra7lwhgcj2719"; };
 }
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "tfsec";
-  version = "0.24.1";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "liamg";
    repo = pname;
    rev = "v${version}";
-    sha256 = "10sl3gpjvgjigkb0v35w96xm414widh0ygb6pnzgyz1ph8ilm86p";
+    sha256 = "06sr20zrbhyj35cyw64bk6sjj9q9lh52kc8wg1ryaimr3dc6lrn1";
  };

  goPackagePath = "github.com/liamg/tfsec";
--- a/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
@ -419,6 +419,12 @@ stdenv.mkDerivation rec {

      # add nix environment vars to .bazelrc
      cat >> .bazelrc <<EOF
+      # Limit the resources Bazel is allowed to use during the build to 1/2 the
+      # available RAM and 3/4 the available CPU cores. This should help avoid
+      # overwhelming the build machine.
+      build --local_ram_resources=HOST_RAM*.5
+      build --local_cpu_resources=HOST_CPUS*.75
+
      build --distdir=${distDir}
      fetch --distdir=${distDir}
      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
--- a/pkgs/development/tools/continuous-integration/drone-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone-cli/default.nix
@ -5,7 +5,6 @@ in buildGoModule rec {
  inherit version;
  pname = "drone-cli";
  revision = "v${version}";
-  goPackagePath = "github.com/drone/drone-cli";

  vendorSha256 = "1ryh94cj37j8x6qwxr5ydyw6cnjppakg1w84sipm11d0vvv98bhi";

--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@ -3,7 +3,6 @@
 buildGoModule rec {
  name = "drone.io-${version}";
  version = "1.9.0";
-  goPackagePath = "github.com/drone/drone";

  vendorSha256 = "0idf11sr417lxcjryplgb87affr6lgzxazzlyvk0y40hp8zbhwsx";

--- a/pkgs/development/tools/godef/default.nix
+++ b/pkgs/development/tools/godef/default.nix
@ -5,7 +5,6 @@ buildGoModule rec {
  version = "1.1.2";
  rev = "v${version}";

-  goPackagePath = "github.com/rogpeppe/godef";
  subPackages = [ "." ];

  vendorSha256 = null;
--- a/pkgs/development/tools/gomodifytags/default.nix
+++ b/pkgs/development/tools/gomodifytags/default.nix
@ -8,8 +8,6 @@ buildGoModule rec {

  doCheck = false;

-  goPackagePath = "github.com/fatih/gomodifytags";
-
  src = fetchFromGitHub {
    owner = "fatih";
    repo = "gomodifytags";
--- a/pkgs/development/tools/gopkgs/default.nix
+++ b/pkgs/development/tools/gopkgs/default.nix
@ -4,8 +4,6 @@ buildGoModule rec {
  pname = "gopkgs";
  version = "2.1.2";

-  goPackagePath = "github.com/uudashr/gopkgs";
-
  subPackages = [ "cmd/gopkgs" ];

  src = fetchFromGitHub {
--- a/pkgs/development/tools/gosec/default.nix
+++ b/pkgs/development/tools/gosec/default.nix
@ -4,8 +4,6 @@ buildGoModule rec {
  pname = "gosec";
  version = "2.4.0";

-  goPackagePath = "github.com/securego/gosec";
-
  subPackages = [ "cmd/gosec" ];

  src = fetchFromGitHub {
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@ -4,8 +4,6 @@ buildGoModule rec {
  pname = "hcloud";
  version = "1.17.0";

-  goPackagePath = "github.com/hetznercloud/cli";
-
  src = fetchFromGitHub {
    owner = "hetznercloud";
    repo = "cli";
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@ -17,7 +17,6 @@ buildGoModule rec {

  doCheck = false;

-  goPackagePath = "sigs.k8s.io/kind";
  subPackages = [ "." ];

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/development/tools/kubeprompt/default.nix
+++ b/pkgs/development/tools/kubeprompt/default.nix
@ -15,10 +15,9 @@ buildGoModule rec {
    export buildFlagsArray+=(
      "-ldflags=
        -w -s
-        -X ${goPackagePath}/pkg/version.Version=${version}")
+        -X github.com/jlesquembre/kubeprompt/pkg/version.Version=${version}")
  '';

-  goPackagePath = "github.com/jlesquembre/kubeprompt";
  vendorSha256 = "089lfkvyf00f05kkmr935jbrddf2c0v7m2356whqnz7ad6a2whsi";

  doCheck = false;
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@ -23,11 +23,8 @@ buildGoModule rec {
  # avoid finding test and development commands
  sourceRoot = "source/kustomize";

-  deleteVendor = true;
  vendorSha256 = "01ff3w4hwp4ynqhg8cplv0i2ixs811d2x2j6xbh1lslyyh3z3wc5";

-  doCheck = false;
-
  meta = with lib; {
    description = "Customization of kubernetes YAML configurations";
    longDescription = ''
--- a/pkgs/development/tools/misc/mkcert/default.nix
+++ b/pkgs/development/tools/misc/mkcert/default.nix
@ -15,10 +15,8 @@ buildGoModule rec {

  doCheck = false;

-  goPackagePath = "github.com/FiloSottile/mkcert";
  buildFlagsArray = ''
-    -ldflags=
-      -X ${goPackagePath}/main.Version=${version}
+    -ldflags=-X main.Version=v${version}
  '';

  meta = with lib; {
--- a/pkgs/development/tools/misc/nix-build-uncached/default.nix
+++ b/pkgs/development/tools/misc/nix-build-uncached/default.nix
@ -11,7 +11,6 @@ buildGoModule rec {
    sha256 = "106k4234gpi8mr0n0rfsgwk4z7v0b2gim0r5bhjvg2v566j67g02";
  };

-  goPackagePath = "github.com/Mic92/nix-build-uncached";
  vendorSha256 = null;

  doCheck = false;
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "terraform-ls";
-  version = "0.5.4";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "05cij0qh1czxnms4zjyycidx84brsmlqw1c6fpk5yv58g3v8d3v7";
+    sha256 = "0bb6bpdjp9yzbxvc6mz22lawn41ay0frdpgbd7zrm8nkvspc0rl7";
  };

  goPackagePath = "github.com/hashicorp/terraform-ls";
--- a/pkgs/development/tools/reftools/default.nix
+++ b/pkgs/development/tools/reftools/default.nix
@ -12,7 +12,6 @@ buildGoModule rec {

  doCheck = false;

-  goPackagePath = "github.com/davidrjenni/reftools";
  excludedPackages = "\\(cmd/fillswitch/test-fixtures\\)";

  src = fetchFromGitHub {
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@ -0,0 +1,48 @@
+{ rustPlatform, stdenv, lib, fetchFromGitHub, fetchurl
+, pkg-config, openssl
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-c";
+  version = "0.6.7";
+
+  src = stdenv.mkDerivation rec {
+    name = "${pname}-source-${version}";
+
+    src = fetchFromGitHub {
+      owner = "lu-zero";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "0n52xh4qg12bvvp2dgx5wfj5f31qijdqahasa3qfa3c3aqq7cvvg";
+    };
+    cargoLock = fetchurl {
+      url = "https://github.com/lu-zero/${pname}/releases/download/v${version}/Cargo.lock";
+      sha256 = "0296187hsaxxmqhsrrva4qf313jwh3z08j1vxcbislxdq8xg32qb";
+    };
+
+    installPhase = ''
+      mkdir -p $out
+      cp -R ./* $out/
+      cp ${cargoLock} $out/Cargo.lock
+    '';
+  };
+
+  cargoSha256 = "1gwyszpcmss2d0lm5hvf3b48jy7b0fm7xizhrl3wd6rzw7pg06zd";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  meta = with lib; {
+    description = "A cargo subcommand to build and install C-ABI compatibile dynamic and static libraries";
+    longDescription = ''
+      Cargo C-ABI helpers. A cargo applet that produces and installs a correct
+      pkg-config file, a static library and a dynamic library, and a C header
+      to be used by any C (and C-compatible) software.
+    '';
+    homepage = "https://github.com/lu-zero/cargo-c";
+    changelog = "https://github.com/lu-zero/cargo-c/releases/tag/v${version}";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
--- a/Show More
+++ b/Show More