Merge branch 'master' into staging-next

nixos/modules/module-list.nix

@@ -316,6 +316,7 @@
   ./services/development/bloop.nix
   ./services/development/hoogle.nix
   ./services/development/jupyter/default.nix
+  ./services/development/lorri.nix
   ./services/editors/emacs.nix
   ./services/editors/infinoted.nix
   ./services/games/factorio.nix

nixos/modules/services/development/lorri.nix

@@ -0,0 +1,45 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.lorri;
+  socketPath = "lorri/daemon.socket";
+in {
+  options = {
+    services.lorri = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Enables the daemon for `lorri`, a nix-shell replacement for project
+          development. The socket-activated daemon starts on the first request
+          issued by the `lorri` command.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.user.sockets.lorri = {
+      description = "Socket for Lorri Daemon";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "%t/${socketPath}";
+        RuntimeDirectory = "lorri";
+      };
+    };
+
+    systemd.user.services.lorri = {
+      description = "Lorri Daemon";
+      requires = [ "lorri.socket" ];
+      after = [ "lorri.socket" ];
+      path = with pkgs; [ config.nix.package gnutar gzip ];
+      serviceConfig = {
+        ExecStart = "${pkgs.lorri}/bin/lorri daemon";
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = "read-only";
+        Restart = "on-failure";
+      };
+    };
+  };
+}

nixos/modules/services/monitoring/grafana.nix

@@ -43,7 +43,7 @@ let
 
     ANALYTICS_REPORTING_ENABLED = boolToString cfg.analytics.reporting.enable;
 
-    SMTP_ENABLE = boolToString cfg.smtp.enable;
+    SMTP_ENABLED = boolToString cfg.smtp.enable;
     SMTP_HOST = cfg.smtp.host;
     SMTP_USER = cfg.smtp.user;
     SMTP_PASSWORD = cfg.smtp.password;

nixos/tests/all-tests.nix

@@ -147,6 +147,7 @@ in
   login = handleTest ./login.nix {};
   loki = handleTest ./loki.nix {};
   #logstash = handleTest ./logstash.nix {};
+  lorri = handleTest ./lorri/default.nix {};
   mailcatcher = handleTest ./mailcatcher.nix {};
   mathics = handleTest ./mathics.nix {};
   matomo = handleTest ./matomo.nix {};

nixos/tests/lorri/builder.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+printf "%s" "${name:?}" > "${out:?}"

nixos/tests/lorri/default.nix

@@ -0,0 +1,26 @@
+import ../make-test-python.nix {
+  machine = { pkgs, ... }: {
+    imports = [ ../../modules/profiles/minimal.nix ];
+    environment.systemPackages = [ pkgs.lorri ];
+  };
+
+  testScript = ''
+    # Copy files over
+    machine.succeed(
+        "cp '${./fake-shell.nix}' shell.nix"
+    )
+    machine.succeed(
+        "cp '${./builder.sh}' builder.sh"
+    )
+
+    # Start the daemon and wait until it is ready
+    machine.execute("lorri daemon > lorri.stdout 2> lorri.stderr &")
+    machine.wait_until_succeeds("grep --fixed-strings 'lorri: ready' lorri.stdout")
+
+    # Ping the daemon
+    machine.execute("lorri ping_ $(readlink -f shell.nix)")
+
+    # Wait for the daemon to finish the build
+    machine.wait_until_succeeds("grep --fixed-strings 'OutputPaths' lorri.stdout")
+  '';
+}

nixos/tests/lorri/fake-shell.nix

@@ -0,0 +1,5 @@
+derivation {
+  system = builtins.currentSystem;
+  name = "fake-shell";
+  builder = ./builder.sh;
+}

pkgs/applications/graphics/renderdoc/default.nix

@@ -1,32 +1,34 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, mkDerivation
 , qtbase, qtx11extras, qtsvg, makeWrapper
-, vulkan-loader, xorg
+, vulkan-loader, xorg, python3, python3Packages
-, python3, bison, pcre, automake, autoconf
+, bison, pcre, automake, autoconf, addOpenGLRunpath
 }:
 let
   custom_swig = fetchFromGitHub {
     owner = "baldurk";
     repo = "swig";
-    rev = "renderdoc-modified-6";
+    rev = "renderdoc-modified-7";
-    sha256 = "00ykqlzx1k9iwqjlc54kfch7cnzsj53hxn7ql70dj3rxqzrnadc0";
+    sha256 = "15r2m5kcs0id64pa2fsw58qll3jyh71jzc04wy20pgsh2326zis6";
   };
+  pythonPackages = python3Packages;
 in
-stdenv.mkDerivation rec {
+mkDerivation rec {
-  version = "1.4";
+  version = "1.5";
   pname = "renderdoc";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "1iann73r4yzkwnm13h4zqipqrp5i5cnkv27yyap0axz6h3npw94r";
+    sha256 = "0a05f6qfq90wrf4fixchp9knx4nhqhwjxl02n03a7k56xzxxnlci";
   };
 
   buildInputs = [
     qtbase qtsvg xorg.libpthreadstubs xorg.libXdmcp qtx11extras vulkan-loader python3
-  ];
+  ]; # ++ (with pythonPackages; [pyside2 pyside2-tools shiboken2]);
+  # TODO: figure out how to make cmake recognise pyside2
 
-  nativeBuildInputs = [ cmake makeWrapper pkgconfig bison pcre automake autoconf ];
+  nativeBuildInputs = [ cmake makeWrapper pkgconfig bison pcre automake autoconf addOpenGLRunpath ];
 
   postUnpack = ''
     cp -r ${custom_swig} swig
@@ -40,19 +42,23 @@ stdenv.mkDerivation rec {
     "-DBUILD_VERSION_DIST_VER=${version}"
     "-DBUILD_VERSION_DIST_CONTACT=https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/graphics/renderdoc"
     "-DBUILD_VERSION_STABLE=ON"
-    # TODO: add once pyside2 is in nixpkgs
-    #"-DPYSIDE2_PACKAGE_DIR=${python36Packages.pyside2}"
   ];
 
-  # Future work: define these in the above array via placeholders
+  # TODO: define these in the above array via placeholders, once those are widely supported
   preConfigure = ''
     cmakeFlags+=" -DVULKAN_LAYER_FOLDER=$out/share/vulkan/implicit_layer.d/"
     cmakeFlags+=" -DRENDERDOC_SWIG_PACKAGE=$PWD/../swig"
   '';
 
+  dontWrapQtApps = true;
   preFixup = ''
-    wrapProgram $out/bin/qrenderdoc --suffix LD_LIBRARY_PATH : $out/lib --suffix LD_LIBRARY_PATH : ${vulkan-loader}/lib
+    wrapQtApp $out/bin/qrenderdoc --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib"
-    wrapProgram $out/bin/renderdoccmd --suffix LD_LIBRARY_PATH : $out/lib --suffix LD_LIBRARY_PATH : ${vulkan-loader}/lib
+    wrapProgram $out/bin/renderdoccmd --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib"
+  '';
+
+  # The only documentation for this so far is in pkgs/build-support/add-opengl-runpath/setup-hook.sh
+  postFixup = ''
+    addOpenGLRunpath $out/lib/librenderdoc.so
   '';
 
   enableParallelBuilding = true;

pkgs/applications/networking/browsers/brave/default.nix

@@ -82,11 +82,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "0.69.135";
+  version = "1.0.0";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "1ahxciiilpaz2zdmi25lpw0x2mgwvd8acjn7h11i2ciqw0xbl3iy";
+    sha256 = "0mfwwyc00v6kny1fh20kaad8b6sshaxrlf35z9qcdsbm4n19wg1l";
   };
 
   dontConfigure = true;
@@ -151,7 +151,7 @@ stdenv.mkDerivation rec {
       contribute to your favorite creators automatically.
     '';
     license = licenses.mpl20;
-    maintainers = [ maintainers.uskudnik ];
+    maintainers = with maintainers; [ uskudnik rht ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/networking/cluster/helm/default.nix

@@ -1,48 +1,25 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
-  version = "2.15.1";
   pname = "helm";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "1afbymgpax7kgjjv1c9xb4dm7gcrhn2g69piamdq1k0ng348k5w0";
+    sha256 = "0gx5gmj1470q3gj8v043dmm31skf83p1ckzdcfzx8wdjlglsljrj";
   };
+  modSha256 = "0xjzzwmq3i77anb7w2qfnz7vc0gxq02lylj0xs6dzwl543winshm";
 
   goPackagePath = "k8s.io/helm";
-  subPackages = [ "cmd/helm" "cmd/tiller" "cmd/rudder" ];
+  subPackages = [ "cmd/helm" ];
-
+  buildFlagsArray = [ "-ldflags=-w -s -X helm.sh/helm/v3/internal/version.gitCommit=v${version}" ];
-  goDeps = ./deps.nix;
-
-  # Thsese are the original flags from the helm makefile
-  buildFlagsArray = ''
-    -ldflags=-X k8s.io/helm/pkg/version.Version=v${version} -X k8s.io/helm/pkg/version.GitTreeState=clean -X k8s.io/helm/pkg/version.BuildMetadata=
-    -w
-    -s
-  '';
-
-  preBuild = ''
-    # This is a hack(?) to flatten the dependency tree the same way glide or dep would
-    # Otherwise you'll get errors like
-    # have DeepCopyObject() "k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/runtime".Object
-    # want DeepCopyObject() "k8s.io/apimachinery/pkg/runtime".Object
-    rm -rf $NIX_BUILD_TOP/go/src/k8s.io/kubernetes/vendor
-    rm -rf $NIX_BUILD_TOP/go/src/k8s.io/apiextensions-apiserver/vendor
-  '';
-
-  postInstall = ''
-    mkdir -p $bin/share/bash-completion/completions
-    mkdir -p $bin/share/zsh/site-functions
-    $bin/bin/helm completion bash > $bin/share/bash-completion/completions/helm
-    $bin/bin/helm completion zsh > $bin/share/zsh/site-functions/_helm
-  '';
 
   meta = with stdenv.lib; {
     homepage = https://github.com/kubernetes/helm;
     description = "A package manager for kubernetes";
     license = licenses.asl20;
-    maintainers = [ maintainers.rlupton20 maintainers.edude03 ];
+    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert ];
   };
 }

pkgs/applications/networking/cluster/terraform/default.nix

@@ -1,20 +1,12 @@
-{ stdenv
+{ stdenv, lib, buildEnv, buildGoPackage, fetchFromGitHub, makeWrapper
-, lib
+, runCommand, writeText, terraform-providers }:
-, buildEnv
-, buildGoPackage
-, fetchFromGitHub
-, makeWrapper
-, runCommand
-, writeText
-, terraform-providers
-}:
 
 let
   goPackagePath = "github.com/hashicorp/terraform";
 
   generic = { version, sha256, ... }@attrs:
-    let attrs' = builtins.removeAttrs attrs ["version" "sha256"]; in
+    let attrs' = builtins.removeAttrs attrs [ "version" "sha256" ];
-    buildGoPackage ({
+    in buildGoPackage ({
       name = "terraform-${version}";
 
       inherit goPackagePath;
@@ -40,10 +32,17 @@ let
       '';
 
       meta = with stdenv.lib; {
-        description = "Tool for building, changing, and versioning infrastructure";
+        description =
-        homepage = https://www.terraform.io/;
+          "Tool for building, changing, and versioning infrastructure";
+        homepage = "https://www.terraform.io/";
         license = licenses.mpl20;
-        maintainers = with maintainers; [ zimbatm peterhoeg kalbasit marsam ];
+        maintainers = with maintainers; [
+          zimbatm
+          peterhoeg
+          kalbasit
+          marsam
+          babariviere
+        ];
       };
     } // attrs');
 
@@ -54,30 +53,42 @@ let
           actualPlugins = plugins terraform.plugins;
 
           # Wrap PATH of plugins propagatedBuildInputs, plugins may have runtime dependencies on external binaries
-          wrapperInputs = lib.unique (lib.flatten (lib.catAttrs "propagatedBuildInputs" (builtins.filter (x: x != null) actualPlugins)));
+          wrapperInputs = lib.unique (lib.flatten
+            (lib.catAttrs "propagatedBuildInputs"
+              (builtins.filter (x: x != null) actualPlugins)));
 
           passthru = {
-            withPlugins = newplugins: withPlugins (x: newplugins x ++ actualPlugins);
+            withPlugins = newplugins:
+              withPlugins (x: newplugins x ++ actualPlugins);
             full = withPlugins lib.attrValues;
 
             # Ouch
-            overrideDerivation = f: (pluggable (terraform.overrideDerivation f)).withPlugins plugins;
+            overrideDerivation = f:
-            overrideAttrs = f: (pluggable (terraform.overrideAttrs f)).withPlugins plugins;
+              (pluggable (terraform.overrideDerivation f)).withPlugins plugins;
-            override = x: (pluggable (terraform.override x)).withPlugins plugins;
+            overrideAttrs = f:
+              (pluggable (terraform.overrideAttrs f)).withPlugins plugins;
+            override = x:
+              (pluggable (terraform.override x)).withPlugins plugins;
           };
-        in
           # Don't bother wrapping unless we actually have plugins, since the wrapper will stop automatic downloading
           # of plugins, which might be counterintuitive if someone just wants a vanilla Terraform.
-          if actualPlugins == []
+        in if actualPlugins == [ ] then
-            then terraform.overrideAttrs (orig: { passthru = orig.passthru // passthru; })
+          terraform.overrideAttrs
-            else lib.appendToName "with-plugins"(stdenv.mkDerivation {
+          (orig: { passthru = orig.passthru // passthru; })
+        else
+          lib.appendToName "with-plugins" (stdenv.mkDerivation {
             inherit (terraform) name;
             buildInputs = [ makeWrapper ];
 
             buildCommand = ''
               mkdir -p $out/bin/
               makeWrapper "${terraform.bin}/bin/terraform" "$out/bin/terraform" \
-                  --set NIX_TERRAFORM_PLUGIN_DIR "${buildEnv { name = "tf-plugin-env"; paths = actualPlugins; }}/bin" \
+                --set NIX_TERRAFORM_PLUGIN_DIR "${
+                  buildEnv {
+                    name = "tf-plugin-env";
+                    paths = actualPlugins;
+                  }
+                }/bin" \
                 --prefix PATH : "${lib.makeBinPath wrapperInputs}"
             '';
 
@@ -85,7 +96,11 @@ let
           });
     in withPlugins (_: [ ]);
 
-  plugins = removeAttrs terraform-providers ["override" "overrideDerivation" "recurseForDerivations"];
+  plugins = removeAttrs terraform-providers [
+    "override"
+    "overrideDerivation"
+    "recurseForDerivations"
+  ];
 in rec {
   terraform_0_11 = pluggable (generic {
     version = "0.11.14";
@@ -97,8 +112,8 @@ in rec {
   terraform_0_11-full = terraform_0_11.full;
 
   terraform_0_12 = pluggable (generic {
-    version = "0.12.13";
+    version = "0.12.14";
-    sha256 = "11nbr9avw6jx349jdmxgxiawk8i5mpw3p4rrl89yly0wfhg0fh4a";
+    sha256 = "0pq4sfnnlj91gxyxvyzzrgglnvh8xpan90gnc9jvnnb23iv4q96l";
     patches = [ ./provider-path.patch ];
     passthru = { inherit plugins; };
   });
@@ -112,8 +127,8 @@ in rec {
       resource "random_id" "test" {}
     '';
     terraform = terraform_0_11.withPlugins (p: [ p.random ]);
-    test = runCommand "terraform-plugin-test" { buildInputs = [terraform]; }
+    test =
-      ''
+      runCommand "terraform-plugin-test" { buildInputs = [ terraform ]; } ''
         set -e
         # make it fail outside of sandbox
         export HTTP_PROXY=http://127.0.0.1:0 HTTPS_PROXY=https://127.0.0.1:0

pkgs/applications/networking/davmail/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "davmail";
-  version = "5.2.0";
+  version = "5.4.0";
   src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${version}/${pname}-${version}-2961.zip";
+    url = "mirror://sourceforge/${pname}/${version}/${pname}-${version}-3135.zip";
-    sha256 = "0jw6sjg7k7zg8ab0srz6cjjj5hnw5ppxx1w35sw055dlg54fh2m5";
+    sha256 = "05n2j5canh046744arvni6yfdsandvjkld93w3p7rg116jrh19gq";
   };
 
   sourceRoot = ".";

pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix

@@ -78,6 +78,9 @@ in
       rm $out/share/mattermost-desktop/create_desktop_file.sh
       mkdir -p $out/share/applications
       mv Mattermost.desktop $out/share/applications/Mattermost.desktop
+      substituteInPlace \
+        $out/share/applications/Mattermost.desktop \
+        --replace /share/mattermost-desktop/mattermost-desktop /bin/mattermost-desktop
 
       patchelf \
         --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -59,7 +59,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.27.4"; # Please backport all updates to the stable channel.
+  version = "1.28.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -69,7 +69,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1aza1s70xzx9qkv7b5mpfi4zgdn5dq3rl03lx3jixij3x3pxg5sj";
+    sha256 = "14cd635fax99l5jk70jy0mjnvw01b0gbv666szc4ajamm36l2bkr";
   };
 
   phases = [ "unpackPhase" "installPhase" ];

pkgs/applications/networking/protocol/default.nix

@@ -1,14 +1,14 @@
 { stdenv, buildPythonApplication, fetchFromGitHub }:
 
 buildPythonApplication {
-  pname = "protocol";
+  pname = "protocol-unstable";
-  version = "20171226";
+  version = "2019-03-28";
 
   src = fetchFromGitHub {
     owner = "luismartingarcia";
     repo = "protocol";
-    rev = "d450da7d8a58595d8ef82f1d199a80411029fc7d";
+    rev = "4e8326ea6c2d288be5464c3a7d9398df468c0ada";
-    sha256 = "1g31s2xx0bw8ak5ag1c6mv0p0b8bj5dp3lkk9mxaf2ndj1m1qdkw";
+    sha256 = "13l10jhf4vghanmhh3pn91b2jdciispxy0qadz4n08blp85qn9cm";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/science/math/mathematica/default.nix

@@ -93,13 +93,16 @@ stdenv.mkDerivation rec {
     # Fix library paths
     cd $out/libexec/Mathematica/Executables
     for path in mathematica MathKernel Mathematica WolframKernel wolfram math; do
-      sed -i -e 's#export LD_LIBRARY_PATH$#export LD_LIBRARY_PATH=${zlib}/lib:\''${LD_LIBRARY_PATH}#' $path
+      sed -i -e "2iexport LD_LIBRARY_PATH=${zlib}/lib:\''${LD_LIBRARY_PATH}\n" $path
     done
 
     # Fix xkeyboard config path for Qt
     for path in mathematica Mathematica; do
       sed -i -e "2iexport QT_XKB_CONFIG_ROOT=\"${xkeyboard_config}/share/X11/xkb\"\n" $path
     done
+
+    # Remove some broken libraries
+    rm $out/libexec/Mathematica/SystemFiles/Libraries/Linux-x86-64/libz.so*
   '';
 
   preFixup = ''

pkgs/applications/video/celluloid/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "celluloid";
-  version = "0.17";
+  version = "0.18";
 
   src = fetchFromGitHub {
     owner = "celluloid-player";
     repo = "celluloid";
     rev = "v${version}";
-    sha256 = "0pnxjv6n2q6igxdr8wzbahcj7vccw4nfjdk8fjdnaivf2lyrpv2d";
+    sha256 = "1j8z75y98liirr41rlcn89cshvp1xp71cspcclm6wx455i7q2cg1";
   };
 
   nativeBuildInputs = [
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs meson-post-install.py src/generate-authors.py
-    sed -i '/gtk-update-icon-cache/s/^/#/' meson-post-install.py
   '';
 
   doCheck = true;
@@ -59,6 +58,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/celluloid-player/celluloid";
     license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ worldofpeace ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/virtualization/conmon/default.nix

@@ -9,13 +9,13 @@
 stdenv.mkDerivation rec {
   project = "conmon";
   name = "${project}-${version}";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = project;
     rev = "v${version}";
-    sha256 = "1ha5vhjlb12kshh0j1vpl1vjk8ym9w2j1x762y6zdspkdha1w3dv";
+    sha256 = "0xsirdsgq84bsjb1xgzv3pnjhm9l13vwj79zd8rjdd7p28wsxb0y";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/build-support/fetchgit/private.nix

@@ -1,26 +0,0 @@
-{ fetchgit, runCommand, makeWrapper, openssh }: args: derivation ((fetchgit args).drvAttrs // {
-  SSH_AUTH_SOCK = if (builtins.tryEval <ssh-auth-sock>).success
-    then builtins.toString <ssh-auth-sock>
-    else null;
-
-  GIT_SSH = let
-    config = let
-        sshConfigFile = if (builtins.tryEval <ssh-config-file>).success
-          then <ssh-config-file>
-          else builtins.trace ''
-            Please set your nix-path such that ssh-config-file points to a file that will allow ssh to access private repositories. The builder will not be able to see any running ssh agent sessions unless ssh-auth-sock is also set in the nix-path.
-
-            Note that the config file and any keys it points to must be readable by the build user, which depending on your nix configuration means making it readable by the build-users-group, the user of the running nix-daemon, or the user calling the nix command which started the build. Similarly, if using an ssh agent ssh-auth-sock must point to a socket the build user can access.
-
-            You may need StrictHostKeyChecking=no in the config file. Since ssh will refuse to use a group-readable private key, if using build-users you will likely want to use something like IdentityFile /some/directory/%u/key and have a directory for each build user accessible to that user.
-          '' "/var/lib/empty/config";
-      in builtins.toString sshConfigFile;
-
-    ssh-wrapped = runCommand "fetchgit-ssh" {
-      nativeBuildInputs = [ makeWrapper ];
-    } ''
-      mkdir -p $out/bin
-      makeWrapper ${openssh}/bin/ssh $out/bin/ssh --prefix PATH : "$out/bin" --add-flags "-F ${config}" "$@"
-    '';
-  in "${ssh-wrapped}/bin/ssh";
-})

pkgs/development/libraries/arb/default.nix

@@ -1,12 +1,12 @@
 {stdenv, fetchFromGitHub, mpir, gmp, mpfr, flint}:
 stdenv.mkDerivation rec {
   pname = "arb";
-  version = "2.16.0";
+  version = "2.17.0";
   src = fetchFromGitHub {
     owner = "fredrik-johansson";
     repo = pname;
     rev = version;
-    sha256 = "0478671wfwy3gl26sbxh1jq1ih36z4k72waa8y2y2lvn649gb7cd";
+    sha256 = "05lpy3hkl5f8ik19aw40cqydrb932xaf2n8hbq9ib5dnk7f010p1";
   };
   buildInputs = [mpir gmp mpfr flint];
   configureFlags = [
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     inherit version;
     description = ''A library for arbitrary-precision interval arithmetic'';
+    homepage = "http://arblib.org/";
     license = stdenv.lib.licenses.lgpl21Plus;
     maintainers = with maintainers; [ raskin timokau ];
     platforms = stdenv.lib.platforms.unix;

pkgs/development/libraries/argp-standalone/default.nix

@@ -43,6 +43,8 @@ stdenv.mkDerivation {
 
   doCheck = true;
 
+  makeFlags = [ "AR:=$(AR)" ];
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {

pkgs/development/libraries/qtpbfimageplugin/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtpbfimageplugin";
-  version = "1.4";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "QtPBFImagePlugin";
     rev = version;
-    sha256 = "0d39i7rmhrmm2df49gd47zm37gnz3fmyr6hfc6hhzvk08jb6956r";
+    sha256 = "16qsax1p09gldbg83df77ixaz7bkxl8wm806lc55y19pwnid9m7p";
   };
 
   nativeBuildInputs = [ qmake ];
@@ -31,9 +31,9 @@ stdenv.mkDerivation rec {
       displaying raster MBTiles maps or raster XYZ online maps to also display PBF
       vector tiles without (almost) any application modifications.
     '';
-    homepage = https://github.com/tumic0/QtPBFImagePlugin;
+    homepage = "https://github.com/tumic0/QtPBFImagePlugin";
     license = licenses.lgpl3;
-    maintainers = [ maintainers.sikmir ];
+    maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
   };
 }

pkgs/development/lua-modules/overrides.nix

@@ -224,7 +224,7 @@ with super;
   });
 
   luasystem = super.luasystem.override({
-    buildInputs = [
+    buildInputs = pkgs.lib.optionals pkgs.stdenv.isLinux [
       pkgs.glibc
     ];
   });

pkgs/development/python-modules/authlib/default.nix

@@ -0,0 +1,35 @@
+{ stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, pytest
+, mock
+, cryptography
+, requests
+}:
+
+buildPythonPackage rec {
+  version = "0.13";
+  pname = "authlib";
+
+  src = fetchFromGitHub {
+    owner = "lepture";
+    repo = "authlib";
+    rev = "v${version}";
+    sha256 = "1nv0jbsaqr9qjn7nnl55s42iyx655k7fsj8hs69652lqnfn5y3d5";
+  };
+
+  propagatedBuildInputs = [ cryptography requests ];
+
+  checkInputs = [ mock pytest ];
+
+  checkPhase = ''
+    PYTHONPATH=$PWD:$PYTHONPATH pytest tests/{core,files}
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/lepture/authlib;
+    description = "The ultimate Python library in building OAuth and OpenID Connect servers. JWS,JWE,JWK,JWA,JWT included.";
+    maintainers = with maintainers; [ flokli ];
+    license = licenses.bsd3;
+  };
+}

pkgs/development/python-modules/black/default.nix

@@ -22,8 +22,10 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   # Don't know why these tests fails
+  # Disable test_expression_diff, because it fails on darwin
   checkPhase = ''
     LC_ALL="en_US.UTF-8" pytest \
+      --deselect tests/test_black.py::BlackTestCase::test_expression_diff \
       --deselect tests/test_black.py::BlackTestCase::test_cache_multiple_files \
       --deselect tests/test_black.py::BlackTestCase::test_failed_formatting_does_not_get_cached
   '';

pkgs/development/python-modules/rbtools/default.nix

@@ -3,6 +3,7 @@
 , fetchurl
 , nose
 , six
+, setuptools
 , isPy3k
 }:
 
@@ -17,7 +18,7 @@ buildPythonPackage {
   };
 
   checkInputs = [ nose ];
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [ six setuptools ];
 
   checkPhase = "LC_ALL=C nosetests";
 

pkgs/development/tools/build-managers/meson/default.nix

@@ -1,4 +1,11 @@
-{ lib, python3Packages, stdenv, writeTextDir, substituteAll, targetPackages }:
+{ lib
+, python3Packages
+, fetchpatch
+, stdenv
+, writeTextDir
+, substituteAll
+, targetPackages
+}:
 
 let
   # See https://mesonbuild.com/Reference-tables.html#cpu-families
@@ -54,6 +61,14 @@ python3Packages.buildPythonApplication rec {
       src = ./fix-rpath.patch;
       inherit (builtins) storeDir;
     })
+
+    # Fix detecting incorrect compiler in the store path hash.
+    # https://github.com/NixOS/nixpkgs/issues/73417#issuecomment-554077964
+    # https://github.com/mesonbuild/meson/pull/6185
+    (fetchpatch {
+      url = "https://github.com/mesonbuild/meson/commit/972ede1d14fdf17fe5bb8fb99be220f9395c2392.patch";
+      sha256 = "19bfsylhpy0b2xv3ks8ac9x3q6vvvyj1wjcy971v9d5f1455xhbb";
+    })
   ] ++ lib.optionals stdenv.isDarwin [
     # We use custom Clang, which makes Meson think *not Apple*, while still
     # relying on system linker. When it detects standard Clang, Meson will

pkgs/development/tools/jazzy/Gemfile.lock

@@ -12,10 +12,10 @@ GEM
       json (>= 1.5.1)
     atomos (0.1.3)
     claide (1.0.3)
-    cocoapods (1.8.0)
+    cocoapods (1.8.4)
       activesupport (>= 4.0.2, < 5)
       claide (>= 1.0.2, < 2.0)
-      cocoapods-core (= 1.8.0)
+      cocoapods-core (= 1.8.4)
       cocoapods-deintegrate (>= 1.0.3, < 2.0)
       cocoapods-downloader (>= 1.2.2, < 2.0)
       cocoapods-plugins (>= 1.0.0, < 2.0)
@@ -31,10 +31,10 @@ GEM
       nap (~> 1.0)
       ruby-macho (~> 1.4)
       xcodeproj (>= 1.11.1, < 2.0)
-    cocoapods-core (1.8.0)
+    cocoapods-core (1.8.4)
       activesupport (>= 4.0.2, < 6)
       algoliasearch (~> 1.0)
-      concurrent-ruby (~> 1.0)
+      concurrent-ruby (~> 1.1)
       fuzzy_match (~> 2.0.4)
       nap (~> 1.0)
     cocoapods-deintegrate (1.0.4)
@@ -50,14 +50,14 @@ GEM
     colored2 (3.1.2)
     concurrent-ruby (1.1.5)
     escape (0.0.4)
-    ffi (1.11.1)
+    ffi (1.11.2)
     fourflusher (2.3.1)
     fuzzy_match (2.0.4)
     gh_inspector (1.1.3)
     httpclient (2.8.3)
     i18n (0.9.5)
       concurrent-ruby (~> 1.0)
-    jazzy (0.11.2)
+    jazzy (0.12.0)
       cocoapods (~> 1.5)
       mustache (~> 1.1)
       open4
@@ -68,7 +68,7 @@ GEM
       xcinvoke (~> 0.3.0)
     json (2.2.0)
     liferaft (0.0.6)
-    minitest (5.12.0)
+    minitest (5.13.0)
     molinillo (0.6.6)
     mustache (1.1.0)
     nanaimo (0.2.6)
@@ -76,7 +76,7 @@ GEM
     netrc (0.11.0)
     open4 (1.3.4)
     redcarpet (3.5.0)
-    rouge (3.11.0)
+    rouge (3.13.0)
     ruby-macho (1.4.0)
     sassc (2.2.1)
       ffi (~> 1.9)
@@ -86,7 +86,7 @@ GEM
       thread_safe (~> 0.1)
     xcinvoke (0.3.0)
       liferaft (~> 0.0.6)
-    xcodeproj (1.12.0)
+    xcodeproj (1.13.0)
       CFPropertyList (>= 2.3.3, < 4.0)
       atomos (~> 0.1.3)
       claide (>= 1.0.2, < 2.0)
@@ -100,4 +100,4 @@ DEPENDENCIES
   jazzy
 
 BUNDLED WITH
-   1.17.2
+   1.17.3

pkgs/development/tools/jazzy/gemset.nix

@@ -57,10 +57,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07kwhlf8s5by0bwl07f8nyz0k1szgi801cb51n8wbargwhqk1xa4";
+      sha256 = "007ssx75588ji2d8l8s6c95dng1c7b6yacng8nngpy7maijzjgzc";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.8.4";
   };
   cocoapods-core = {
     dependencies = ["activesupport" "algoliasearch" "concurrent-ruby" "fuzzy_match" "nap"];
@@ -68,10 +68,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1clmsmc7407namv0b6d0zssjzamwvvb2k8hxggwmrcbs2gmd20ad";
+      sha256 = "0zcisqb404828n5d3lbk9y2yyx8v2yr6rk1l8y9a4i1hp743fiad";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.8.4";
   };
   cocoapods-deintegrate = {
     groups = ["default"];
@@ -170,10 +170,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06mvxpjply8qh4j3fj9wh08kdzwkbnvsiysh0vrhlk5cwxzjmblh";
+      sha256 = "0cbads5da12lb3j0mg2hjrd57s5qkkairxh2y6r9bqyblb5b8xbw";
       type = "gem";
     };
-    version = "1.11.1";
+    version = "1.11.2";
   };
   fourflusher = {
     groups = ["default"];
@@ -230,10 +230,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dw29rsdijr4dhpvn89m3934qrr80a4jyg3v813iy7jbkb6kspj4";
+      sha256 = "0a2pc4qlf531k85lp7kbwz4rqvs4lgdndmvv676x3qvm181p8blc";
       type = "gem";
     };
-    version = "0.11.2";
+    version = "0.12.0";
   };
   json = {
     groups = ["default"];
@@ -258,10 +258,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kj5m8gg643w8jh8nsdy15bpddmnnafhyzhjx7gp28l1acb4fik7";
+      sha256 = "0w16p7cvslh3hxd3cia8jg4pd85z7rz7xqb16vh42gj4rijn8rmi";
       type = "gem";
     };
-    version = "5.12.0";
+    version = "5.13.0";
   };
   molinillo = {
     groups = ["default"];
@@ -332,10 +332,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zsyv6abqrk7lpql5f1ja4m88bfy9qndi8xykpss6cpvjdmi3ydb";
+      sha256 = "1y90nx9ph9adnrpcsvs2adca2l3dyz8am2d2kzxkwd3a086ji7aw";
       type = "gem";
     };
-    version = "3.11.0";
+    version = "3.13.0";
   };
   ruby-macho = {
     groups = ["default"];
@@ -402,9 +402,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "162gwhrl7ppj6hlmnpp1scvy1ylcv5xqk51826v075sckdqjp8c8";
+      sha256 = "1c69yrhqd92q6nnpyhvnqyw9l7axnc91gnbd2gai8f5njdisd8wx";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.13.0";
   };
 }

pkgs/games/openrct2/default.nix

@@ -5,27 +5,27 @@
 
 let
   name = "openrct2-${version}";
-  version = "0.2.3";
+  version = "0.2.4";
 
   openrct2-src = fetchFromGitHub {
     owner = "OpenRCT2";
     repo = "OpenRCT2";
     rev = "v${version}";
-    sha256 = "01mj6jlbl2cn3wpk6sy34ldzdl0qykpn7fncznjykklj2nqzr4ig";
+    sha256 = "1rlw3w20llg36sj3bk50g661qw766ng8ma3p42sdkj8br9dw800h";
   };
 
   objects-src = fetchFromGitHub {
     owner = "OpenRCT2";
     repo = "objects";
-    rev = "v1.0.11";
+    rev = "v1.0.12";
-    sha256 = "1bh7mngpqnhzwnhhawq5y3a6hbvwxis2yagk4dcmc4w1fifq2y66";
+    sha256 = "0vfhyldc8nfvkg4d9kry669haxz2165walbxzgza7pqpnd7aqgrf";
   };
 
   title-sequences-src = fetchFromGitHub {
     owner = "OpenRCT2";
     repo = "title-sequences";
-    rev = "v0.1.2";
+    rev = "v0.1.2c";
-    sha256 = "1yb1ynkfmiankii3fngr9km5wbc07rp30nh0apkj6wryrhy7imgm";
+    sha256 = "1qdrm4q75bznmgdrpjdaiqvbf3q4vwbkkmls45izxvyg1djrpsdf";
   };
 in
 stdenv.mkDerivation {
@@ -33,9 +33,13 @@ stdenv.mkDerivation {
 
   src = openrct2-src;
 
+  nativeBuildInputs = [
+    cmake
+    pkgconfig
+  ];
+
   buildInputs = [
     SDL2
-    cmake
     curl
     fontconfig
     freetype
@@ -47,7 +51,6 @@ stdenv.mkDerivation {
     libzip
     libGLU
     openssl
-    pkgconfig
     speexdsp
     zlib
   ];

pkgs/servers/monitoring/consul-alerts/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "consul-alerts";
-  version = "0.5.0";
+  version = "0.6.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/AcalephStorage/consul-alerts";
@@ -13,7 +13,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "AcalephStorage";
     repo = "consul-alerts";
-    sha256 = "0dff2cpk3lkgjsh97rvlrpacpka0kwm29691diyvj7lb9ydzlx3r";
+    sha256 = "0836zicv76sd6ljhbbii1mrzh65pch10w3gfa128iynaviksbgn5";
   };
 
   meta = with stdenv.lib; {

pkgs/servers/monitoring/prometheus/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "prometheus";
-  version = "2.13.1";
+  version = "2.14.0";
 
   goPackagePath = "github.com/prometheus/prometheus";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "prometheus";
     repo = "prometheus";
-    sha256 = "055qliv683b87dwj7pkprdpjgyp6s4s3cwvpbsl1gxidhlr4y69b";
+    sha256 = "0zmxj78h3cnqbhsqab940hyzpim5i9r81b15a57f3dnrrd10p287";
   };
 
   buildFlagsArray = let
@@ -31,6 +31,12 @@ buildGoPackage rec {
     cp -a $src/console_libraries $src/consoles $bin/etc/prometheus
   '';
 
+  # Disable module-mode, because Go 1.13 automatically enables it if there is
+  # go.mod file. Remove after https://github.com/NixOS/nixpkgs/pull/73380
+  preCheck = ''
+    export GO111MODULE=off
+  '';
+
   doCheck = true;
 
   meta = with lib; {

pkgs/servers/plex/raw.nix

@@ -8,13 +8,13 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.18.0.1944-f2cae8d6b";
+  version = "1.18.1.1973-0f4abfbcc";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/redhat/plexmediaserver-${version}.x86_64.rpm";
-    sha256 = "1yq926j817aqngq5n8gjpcq5pr8lc5mi3xff1r834vkym1i5nz7q";
+    sha256 = "1lmj4yal1f072w5rwxn9m09lbclzy87xnvy89iva1kmqzl3bfz2q";
   };
 
   outputs = [ "out" "basedb" ];

pkgs/servers/sql/mariadb/default.nix

@@ -2,8 +2,7 @@
 , libiconv, openssl, pcre, boost, judy, bison, libxml2, libkrb5, linux-pam, curl
 , libaio, libevent, jemalloc, cracklib, systemd, numactl, perl
 , fixDarwinDylibNames, cctools, CoreServices
-, asio, buildEnv, check, scons
+, asio, buildEnv, check, scons, less
-, less, fetchpatch
 , withoutClient ? false
 }:
 
@@ -21,14 +20,14 @@ mariadb = server // {
 };
 
 common = rec { # attributes common to both builds
-  version = "10.3.18";
+  version = "10.3.20";
 
   src = fetchurl {
     urls = [
       "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz"
       "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz"
     ];
-    sha256 = "1p6yvmahnkmsz50zjzp20ak7jzbqysly5bdl51nnrngrbfl6qib9";
+    sha256 = "14n4zfpwhvafz02r95bidmkwq2bz9jj3safqni1h21jfd0nqz0ak";
     name   = "mariadb-${version}.tar.gz";
   };
 
@@ -46,12 +45,7 @@ common = rec { # attributes common to both builds
   patches = [
     ./cmake-includedir.patch
     ./cmake-libmariadb-includedir.patch
-  ] ++ optional stdenv.hostPlatform.isDarwin (fetchpatch {
+  ];
-    url = "https://github.com/MariaDB/mariadb-connector-c/commit/ee91b2c98a63acb787114dee4f2694e154630928.patch";
-    extraPrefix = "libmariadb/";
-    sha256 = "06i865zwyhs9fvrgmargzn09pbg1cmably3c4wifd241bj8ig8qk";
-    stripLen = 1;
-  });
 
   cmakeFlags = [
     "-DBUILD_CONFIG=mysql_release"

pkgs/tools/admin/awslogs/default.nix

@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   propagatedBuildInputs = with python3Packages; [
-    boto3 termcolor dateutil docutils
+    boto3 termcolor dateutil docutils setuptools
   ];
 
   meta = with stdenv.lib; {

pkgs/tools/inputmethods/libinput-gestures/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper,
   libinput, wmctrl, python3,
-  xdotool ? null,
+  coreutils, xdotool ? null,
   extraUtilsPath ? lib.optional (xdotool != null) xdotool
 }:
 stdenv.mkDerivation rec {
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
       rm "$out/bin/libinput-gestures-setup"
       substituteInPlace "$out/share/applications/libinput-gestures.desktop" --replace "/usr" "$out"
       chmod +x "$out/share/applications/libinput-gestures.desktop"
-      wrapProgram "$out/bin/libinput-gestures" --prefix PATH : "${lib.makeBinPath extraUtilsPath}"
+      wrapProgram "$out/bin/libinput-gestures" --prefix PATH : "${lib.makeBinPath ([coreutils] ++ extraUtilsPath)}"
     '';
 
   meta = with stdenv.lib; {

pkgs/tools/misc/lorri/default.nix

@@ -0,0 +1,56 @@
+{ stdenv
+, pkgs
+, fetchFromGitHub
+, rustPlatform
+  # Updater script
+, runtimeShell
+, writeScript
+  # Tests
+, nixosTests
+  # Apple dependencies
+, CoreServices
+, Security
+, cf-private
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "lorri";
+  version = "unstable-2019-10-30";
+
+  meta = with stdenv.lib; {
+    description = "Your project's nix-env";
+    homepage = "https://github.com/target/lorri";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ grahamc Profpatsch ];
+  };
+
+  src = fetchFromGitHub {
+    owner = "target";
+    repo = pname;
+    # Run `eval $(nix-build -A lorri.updater)` after updating the revision!
+    rev = "03f10395943449b1fc5026d3386ab8c94c520ee3";
+    sha256 = "0fcl79ndaziwd8d74mk1lsijz34p2inn64b4b4am3wsyk184brzq";
+  };
+
+  cargoSha256 = "1daff4plh7hwclfp21hkx4fiflh9r80y2c7k2sd3zm4lmpy0jpfz";
+  doCheck = false;
+
+  BUILD_REV_COUNT = src.revCount or 1;
+  RUN_TIME_CLOSURE = pkgs.callPackage ./runtime.nix {};
+
+  nativeBuildInputs = with pkgs; [ nix direnv which ];
+  buildInputs =
+    stdenv.lib.optionals stdenv.isDarwin [ CoreServices Security cf-private ];
+
+  passthru = {
+    updater = with builtins; writeScript "copy-runtime-nix.sh" ''
+      #!${runtimeShell}
+      set -euo pipefail
+      cp ${src}/nix/runtime.nix ${toString ./runtime.nix}
+      cp ${src}/nix/runtime-closure.nix.template ${toString ./runtime-closure.nix.template}
+    '';
+    tests = {
+      nixos = nixosTests.lorri;
+    };
+  };
+}

pkgs/tools/misc/lorri/runtime-closure.nix.template

@@ -0,0 +1,37 @@
+# Nix with sandboxing requires every path used at build time be
+# explicitly declared. If we simply passed in the paths, they
+# would be copied in as sources. Using builtins.storePath we're
+# able to tell Nix that, no, in fact, treat these not as sources
+# to copy, but instead of a regular store path.
+#
+# Include the explicit closure, too, otherwise we'll get mysterious
+# "file not found" errors due to the glibc interpreter being
+# missing.
+let
+  # Magic inspired by Nix's config.nix:
+  # https://github.com/NixOS/nix/blob/f9a2ea44867cd1dbb408bca4df0ced806137b7f7/corepkgs/config.nix.in#L23
+  #
+  # If the dependency is in the Nix store we're using, refer to
+  # it as a literal store path. If it isn't, refer to it "normally".
+  #
+  # This makes sandboxing happy when in a nix-build, and the
+  # evaluation happy when in a «cargo build».
+  tools_build_host = @tools_build_host@;
+
+  # Compare the stringified version of the tools_build_host Nix store
+  # path to the evaluator's stringified Nix store path. Otherwise,
+  # Nix will read the sources in to the /nix/store, and, well,
+  # you can only copy the /nix/store in to the /nix/store so many
+  # times before you run out of disk space.
+  dep = if ("${toString (dirOf tools_build_host)}" == "${toString builtins.storeDir}")
+    then (builtins.trace "using storePath"  builtins.storePath)
+    else (builtins.trace "using toString" toString) # assume we have no sandboxing
+    ;
+
+  tools = dep tools_build_host;
+
+in {
+  path = "${tools}/bin";
+  builder = "${tools}/bin/bash";
+  closure = import @runtime_closure_list@ { inherit dep; };
+}

pkgs/tools/misc/lorri/runtime.nix

@@ -0,0 +1,33 @@
+{
+  # Plumbing tools:
+  closureInfo, runCommand, writeText, buildEnv,
+
+  # Actual dependencies to propagate:
+  bash, coreutils }:
+let
+  tools = buildEnv {
+    name = "lorri-runtime-tools";
+    paths = [ coreutils bash ];
+  };
+
+  runtimeClosureInfo = closureInfo {
+    rootPaths = [ tools ];
+  };
+
+  closureToNix = runCommand "closure.nix" {}
+  ''
+    (
+      echo '{ dep, ... }: ['
+      sed -E 's/^(.*)$/    (dep \1)/' ${runtimeClosureInfo}/store-paths
+      echo ']'
+    ) > $out
+  '';
+
+  runtimeClosureInfoAsNix = runCommand "runtime-closure.nix" {
+    runtime_closure_list = closureToNix;
+    tools_build_host = tools;
+  }
+  ''
+    substituteAll ${./runtime-closure.nix.template} $out
+  '';
+in runtimeClosureInfoAsNix

pkgs/tools/security/pass/extensions/genphrase.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pass-genphrase";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitHub {
     owner = "congma";
     repo = "pass-genphrase";
     rev = version;
-    sha256 = "0vcg3b79n1r949qfn8ns85bq2mfsmbf4jw2dlzif8425n8ppfsgd";
+    sha256 = "1sdkmz5s6wdx4vdlgqf5kmyrm17zwzy3n52s13qpx32bnnajap1h";
   };
 
   dontBuild = true;

pkgs/tools/security/vulnix/default.nix

@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vulnix";
-  version = "1.8.2";
+  version = "1.9.1";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0zn21j15vd1z7s40s45zr5wri3r770yvazxqmm60fqpzc5sg552y";
+    sha256 = "0pcg90j3g3lxrkbxlnjakrgcx5iwnhka03510zmcf0zcpwkrqakb";
   };
 
   outputs = [ "out" "doc" "man" ];
@@ -24,7 +24,6 @@ python3Packages.buildPythonApplication rec {
   ] ++ (with python3Packages; [
     click
     colorama
-    lxml
     pyyaml
     requests
     setuptools
@@ -47,8 +46,8 @@ python3Packages.buildPythonApplication rec {
 
   meta = with stdenv.lib; {
     description = "NixOS vulnerability scanner";
-    homepage = https://github.com/flyingcircusio/vulnix;
+    homepage = "https://github.com/flyingcircusio/vulnix";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ckauhaus plumps ];
+    maintainers = with maintainers; [ ckauhaus ];
   };
 }

pkgs/tools/typesetting/asciidoctorj/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchzip, jdk, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "asciidoctorj";
+  version = "2.1.0";
+
+  src = fetchzip {
+    url = "http://dl.bintray.com/asciidoctor/maven/org/asciidoctor/${pname}/${version}/${pname}-${version}-bin.zip";
+    sha256 = "19fl4y3xlkmmgf5vyyb3k9p6nyglck9l53r6x12zil01q49g0zba";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    rm bin/asciidoctorj.bat
+    cp -r . $out
+    wrapProgram $out/bin/asciidoctorj \
+      --prefix JAVA_HOME : ${jdk}
+  '';
+
+  meta = with stdenv.lib; {
+    description = ''
+      AsciidoctorJ is the official library for running Asciidoctor on the JVM.
+    '';
+    longDescription = ''
+      AsciidoctorJ is the official library for running Asciidoctor on the JVM. 
+      Using AsciidoctorJ, you can convert AsciiDoc content or analyze the 
+      structure of a parsed AsciiDoc document from Java and other JVM 
+      languages.
+    '';
+    homepage = https://asciidoctor.org/docs/asciidoctorj/;
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ moaxcp ];
+  };
+} 

pkgs/top-level/all-packages.nix

@@ -250,8 +250,6 @@ in
     cacert = buildPackages.cacert;
   };
 
-  fetchgitPrivate = callPackage ../build-support/fetchgit/private.nix { };
-
   fetchgitLocal = callPackage ../build-support/fetchgitlocal { };
 
   fetchmtn = callPackage ../build-support/fetchmtn (config.fetchmtn or {});
@@ -2128,6 +2126,8 @@ in
     epubcheck = null;
   };
 
+  asciidoctorj = callPackage ../tools/typesetting/asciidoctorj { };
+
   asunder = callPackage ../applications/audio/asunder { };
 
   autossh = callPackage ../tools/networking/autossh { };
@@ -4094,7 +4094,9 @@ in
 
   intecture-auth = callPackage ../tools/admin/intecture/auth.nix { };
 
-  intecture-cli = callPackage ../tools/admin/intecture/cli.nix { };
+  intecture-cli = callPackage ../tools/admin/intecture/cli.nix {
+    openssl = openssl_1_0_2;
+  };
 
   intel-media-sdk = callPackage ../development/libraries/intel-media-sdk { };
 
@@ -8434,7 +8436,10 @@ in
 
   llvmPackages_latest = llvmPackages_9;
 
-  lorri = throw "lorri is not stable yet. Please go to https://github.com/target/lorri and follow the installation instructions there, for the time being.";
+  lorri = callPackage ../tools/misc/lorri {
+    inherit (darwin) cf-private;
+    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
+  };
 
   manticore = callPackage ../development/compilers/manticore { };
 
@@ -15416,11 +15421,7 @@ in
   postgresql_jdbc = callPackage ../development/java-modules/postgresql_jdbc { };
 
   prom2json = callPackage ../servers/monitoring/prometheus/prom2json.nix { };
-  prometheus = callPackage ../servers/monitoring/prometheus {
+  prometheus = callPackage ../servers/monitoring/prometheus { };
-    # Version 2.12.0 fails to build with go 1.13 due to an incorrect module file
-    # compilation error :go: cloud.google.com/go@v0.44.1: Get https://proxy.golang.org/cloud.google.com/go/@v/v0.44.1.mod: dial tcp: lookup proxy.golang.org on [::1]:53: read udp [::1]:58980->[::1]:53: read: connection refused
-    buildGoPackage = buildGo112Package;
-  };
   prometheus-alertmanager = callPackage ../servers/monitoring/prometheus/alertmanager.nix { };
   prometheus-apcupsd-exporter = callPackage ../servers/monitoring/prometheus/apcupsd-exporter.nix { };
   prometheus-aws-s3-exporter = callPackage ../servers/monitoring/prometheus/aws-s3-exporter.nix { };

pkgs/top-level/lua-packages.nix

@@ -134,14 +134,14 @@ with self; {
 
   pulseaudio = buildLuaPackage rec {
     pname = "pulseaudio";
-    version = "0.1";
+    version = "0.2";
     name = "pulseaudio-${version}";
 
     src = fetchFromGitHub {
       owner = "doronbehar";
       repo = "lua-pulseaudio";
       rev = "v${version}";
-      sha256 = "0vldm34m3ysgn8gvwfdglpw4jl5680fvfay7pzs14gzkzcvgv25b";
+      sha256 = "140y1m6k798c4w7xfl0zb0a4ffjz6i1722bgkdcdg8g76hr5r8ys";
     };
     disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
     buildInputs = [ pkgs.libpulseaudio ];

pkgs/top-level/python-packages.nix

@@ -234,6 +234,8 @@ in {
 
   atomman = callPackage ../development/python-modules/atomman { };
 
+  authlib = callPackage ../development/python-modules/authlib { };
+
   # packages defined elsewhere
 
   amazon_kclpy = callPackage ../development/python-modules/amazon_kclpy { };