Merge remote-tracking branch 'origin/release-19.09' into staging-19.09

2026-09-30 20:00:10 +00:00 · 2019-09-16 08:54:11 +02:00
parent f21863ddcc 755c9f3ba2
commit 08ef9a84fd
115 changed files with 2171 additions and 1931 deletions
--- a/doc/package-specific-user-notes.xml
+++ b/doc/package-specific-user-notes.xml
@@ -416,7 +416,7 @@ overrides = self: super: rec {
    <para>
     Please note that the <literal>citrix_receiver</literal> package has been deprecated since its
     development was <link xlink:href="https://docs.citrix.com/en-us/citrix-workspace-app.html">discontinued by upstream</link>
-     and will be replaced by <link xlink:href="https://www.citrix.com/products/workspace-app/">the citrix workspace app</link>.
+     and has been replaced by <link xlink:href="https://www.citrix.com/products/workspace-app/">the citrix workspace app</link>.
    </para>
   </note>
   <link xlink:href="https://www.citrix.com/products/receiver/">Citrix Receiver</link> and
@@ -458,7 +458,7 @@ overrides = self: super: rec {
   <title>Custom certificates</title>

   <para>
-    The <literal>Citrix Receiver</literal> and <literal>Citrix Workspace App</literal>
+    The <literal>Citrix Workspace App</literal>
    in <literal>nixpkgs</literal> trust several certificates
    <link xlink:href="https://curl.haxx.se/docs/caextract.html">from the
    Mozilla database</link> by default. However several companies using Citrix
@@ -472,7 +472,7 @@ overrides = self: super: rec {
 <programlisting>
 <![CDATA[with import <nixpkgs> { config.allowUnfree = true; };
 let extraCerts = [ ./custom-cert-1.pem ./custom-cert-2.pem /* ... */ ]; in
-citrix_workspace.override { # the same applies for `citrix_receiver` if used.
+citrix_workspace.override {
  inherit extraCerts;
 }]]>
 </programlisting>
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -891,6 +891,12 @@
     Prometheus 2 is now configured with <literal>services.prometheus</literal>.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       Citrix Receiver (<literal>citrix_receiver</literal>) has been dropped in favor of Citrix Workspace
+       (<literal>citrix_workspace</literal>).
+     </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/installer/tools/nixos-option.sh
+++ b/nixos/modules/installer/tools/nixos-option.sh
@@ -82,7 +82,7 @@ evalNix(){
  set -e

  if test $exit_code -eq 0; then
-      sed '/^warning: Nix search path/d' <<EOF
+      sed '/^warning: Nix search path/d;/^trace:/d' <<EOF
 $result
 EOF
      return 0;
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -273,20 +273,6 @@ with lib;
    (mkRenamedOptionModule [ "networking" "extraResolvconfConf" ] [ "networking" "resolvconf" "extraConfig" ])
    (mkRenamedOptionModule [ "networking" "resolvconfOptions" ] [ "networking" "resolvconf" "extraOptions" ])

-    # Redshift
-    (mkChangedOptionModule [ "services" "redshift" "latitude" ] [ "location" "latitude" ]
-      (config:
-        let value = getAttrFromPath [ "services" "redshift" "latitude" ] config;
-        in if value == null then
-          throw "services.redshift.latitude is set to null, you can remove this"
-          else builtins.fromJSON value))
-    (mkChangedOptionModule [ "services" "redshift" "longitude" ] [ "location" "longitude" ]
-      (config:
-        let value = getAttrFromPath [ "services" "redshift" "longitude" ] config;
-        in if value == null then
-          throw "services.redshift.longitude is set to null, you can remove this"
-          else builtins.fromJSON value))
-
    # Redis
    (mkRemovedOptionModule [ "services" "redis" "user" ] "The redis module now is hardcoded to the redis user.")
    (mkRemovedOptionModule [ "services" "redis" "dbpath" ] "The redis module now uses /var/lib/redis as data directory.")
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -275,6 +275,7 @@ in
              ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O hydra hydra
              touch ${baseDir}/.db-created
            fi
+            echo "create extension if not exists pg_trgm" | ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra
          ''}

          if [ ! -e ${cfg.gcRootsDir} ]; then
@@ -379,6 +380,23 @@ in
          };
      };

+    systemd.services.hydra-notify =
+      { wantedBy = [ "multi-user.target" ];
+        requires = [ "hydra-init.service" ];
+        after = [ "hydra-init.service" ];
+        restartTriggers = [ hydraConf ];
+        environment = env // {
+          PGPASSFILE = "${baseDir}/pgpass-queue-runner";
+        };
+        serviceConfig =
+          { ExecStart = "@${cfg.package}/bin/hydra-notify hydra-notify";
+            # FIXME: run this under a less privileged user?
+            User = "hydra-queue-runner";
+            Restart = "always";
+            RestartSec = 5;
+          };
+      };
+
    # If there is less than a certain amount of free disk space, stop
    # the queue/evaluator to prevent builds from failing or aborting.
    systemd.services.hydra-check-space =
@@ -416,6 +434,8 @@ in
        hydra-users hydra-queue-runner hydra
        hydra-users hydra-www hydra
        hydra-users root hydra
+        # The postgres user is used to create the pg_trgm extension for the hydra database
+        hydra-users postgres postgres
      '';

    services.postgresql.authentication = optionalString haveLocalDB
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -6,16 +6,35 @@ let

  cfg = config.services.mailman;

-  pythonEnv = pkgs.python3.withPackages (ps: [ps.mailman]);
+  mailmanPyEnv = pkgs.python3.withPackages (ps: with ps; [mailman mailman-hyperkitty]);

  mailmanExe = with pkgs; stdenv.mkDerivation {
    name = "mailman-" + python3Packages.mailman.version;
+    buildInputs = [makeWrapper];
    unpackPhase = ":";
    installPhase = ''
      mkdir -p $out/bin
-      sed >"$out/bin/mailman" <"${pythonEnv}/bin/mailman" \
-        -e "2 iexport MAILMAN_CONFIG_FILE=/etc/mailman.cfg"
-      chmod +x $out/bin/mailman
+      makeWrapper ${mailmanPyEnv}/bin/mailman $out/bin/mailman \
+        --set MAILMAN_CONFIG_FILE /etc/mailman.cfg
+   '';
+  };
+
+  mailmanWeb = pkgs.python3Packages.mailman-web.override {
+    serverEMail = cfg.siteOwner;
+    archiverKey = cfg.hyperkittyApiKey;
+    allowedHosts = cfg.webHosts;
+  };
+
+  mailmanWebPyEnv = pkgs.python3.withPackages (x: with x; [mailman-web]);
+
+  mailmanWebExe = with pkgs; stdenv.mkDerivation {
+    inherit (mailmanWeb) name;
+    buildInputs = [makeWrapper];
+    unpackPhase = ":";
+    installPhase = ''
+      mkdir -p $out/bin
+      makeWrapper ${mailmanWebPyEnv}/bin/django-admin $out/bin/mailman-web \
+        --set DJANGO_SETTINGS_MODULE settings
    '';
  };

@@ -28,11 +47,30 @@ let
    bin_dir: ${pkgs.python3Packages.mailman}/bin
    var_dir: /var/lib/mailman
    queue_dir: $var_dir/queue
+    template_dir: $var_dir/templates
    log_dir: $var_dir/log
    lock_dir: $var_dir/lock
    etc_dir: /etc
    ext_dir: $etc_dir/mailman.d
    pid_file: /run/mailman/master.pid
+  '' + optionalString (cfg.hyperkittyApiKey != null) ''
+    [archiver.hyperkitty]
+    class: mailman_hyperkitty.Archiver
+    enable: yes
+    configuration: ${pkgs.writeText "mailman-hyperkitty.cfg" mailmanHyperkittyCfg}
+  '';
+
+  mailmanHyperkittyCfg = ''
+    [general]
+    # This is your HyperKitty installation, preferably on the localhost. This
+    # address will be used by Mailman to forward incoming emails to HyperKitty
+    # for archiving. It does not need to be publicly available, in fact it's
+    # better if it is not.
+    base_url: ${cfg.hyperkittyBaseUrl}
+
+    # Shared API key, must be the identical to the value in HyperKitty's
+    # settings.
+    api_key: ${cfg.hyperkittyApiKey}
  '';

 in {
@@ -51,7 +89,7 @@ in {

      siteOwner = mkOption {
        type = types.str;
-        default = "postmaster";
+        default = "postmaster@example.org";
        description = ''
          Certain messages that must be delivered to a human, but which can't
          be delivered to a list owner (e.g. a bounce from a list owner), will
@@ -59,6 +97,48 @@ in {
        '';
      };

+      webRoot = mkOption {
+        type = types.path;
+        default = "${mailmanWeb}/${pkgs.python3.sitePackages}";
+        defaultText = "pkgs.python3Packages.mailman-web";
+        description = ''
+          The web root for the Hyperkity + Postorius apps provided by Mailman.
+          This variable can be set, of course, but it mainly exists so that site
+          admins can refer to it in their own hand-written httpd configuration files.
+        '';
+      };
+
+      webHosts = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          The list of hostnames and/or IP addresses from which the Mailman Web
+          UI will accept requests. By default, "localhost" and "127.0.0.1" are
+          enabled. All additional names under which your web server accepts
+          requests for the UI must be listed here or incoming requests will be
+          rejected.
+        '';
+      };
+
+      hyperkittyBaseUrl = mkOption {
+        type = types.str;
+        default = "http://localhost/hyperkitty/";
+        description = ''
+          Where can Mailman connect to Hyperkitty's internal API, preferably on
+          localhost?
+        '';
+      };
+
+      hyperkittyApiKey = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          The shared secret used to authenticate Mailman's internal
+          communication with Hyperkitty. Must be set to enable support for the
+          Hyperkitty archiver. Note that this secret is going to be visible to
+          all local users in the Nix store.
+        '';
+      };

    };
  };
@@ -71,25 +151,22 @@ in {
      { assertion = cfg.enable -> config.services.postfix.enable;
        message = "Mailman requires Postfix";
      }
-      { assertion = config.services.postfix.recipientDelimiter == "+";
-        message = "Postfix's recipientDelimiter must be set to '+'.";
-      }
    ];

    users.users.mailman = { description = "GNU Mailman"; isSystemUser = true; };

    environment = {
-      systemPackages = [ mailmanExe ];
+      systemPackages = [ mailmanExe mailmanWebExe pkgs.sassc ];
      etc."mailman.cfg".text = mailmanCfg;
    };

    services.postfix = {
      relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
+      recipientDelimiter = "+";         # bake recipient addresses in mail envelopes via VERP
      config = {
        transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
        local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
-        # Mailman uses recipient delimiters, so we don't need special handling.
-        owner_request_special = "no";
+        owner_request_special = "no";   # Mailman handles -owner addresses on its own
      };
    };

@@ -109,6 +186,112 @@ in {
      };
    };

+    systemd.services.mailman-web = {
+      description = "Init Postorius DB";
+      before = [ "httpd.service" ];
+      requiredBy = [ "httpd.service" ];
+      script = ''
+        ${mailmanWebExe}/bin/mailman-web migrate
+        rm -rf static
+        ${mailmanWebExe}/bin/mailman-web collectstatic
+        ${mailmanWebExe}/bin/mailman-web compress
+      '';
+      serviceConfig = {
+        User = config.services.httpd.user;
+        Type = "oneshot";
+        StateDirectory = "mailman-web";
+        StateDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
+    systemd.services.mailman-daily = {
+      description = "Trigger daily Mailman events";
+      startAt = "daily";
+      serviceConfig = {
+        ExecStart = "${mailmanExe}/bin/mailman digests --send";
+        User = "mailman";
+      };
+    };
+
+    systemd.services.hyperkitty = {
+      enable = cfg.hyperkittyApiKey != null;
+      description = "GNU Hyperkitty QCluster Process";
+      after = [ "network.target" ];
+      wantedBy = [ "mailman.service" "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${mailmanWebExe}/bin/mailman-web qcluster";
+        User = config.services.httpd.user;
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
+    systemd.services.hyperkitty-minutely = {
+      enable = cfg.hyperkittyApiKey != null;
+      description = "Trigger minutely Hyperkitty events";
+      startAt = "minutely";
+      serviceConfig = {
+        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs minutely";
+        User = config.services.httpd.user;
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
+    systemd.services.hyperkitty-quarter-hourly = {
+      enable = cfg.hyperkittyApiKey != null;
+      description = "Trigger quarter-hourly Hyperkitty events";
+      startAt = "*:00/15";
+      serviceConfig = {
+        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs quarter_hourly";
+        User = config.services.httpd.user;
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
+    systemd.services.hyperkitty-hourly = {
+      enable = cfg.hyperkittyApiKey != null;
+      description = "Trigger hourly Hyperkitty events";
+      startAt = "hourly";
+      serviceConfig = {
+        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs hourly";
+        User = config.services.httpd.user;
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
+    systemd.services.hyperkitty-daily = {
+      enable = cfg.hyperkittyApiKey != null;
+      description = "Trigger daily Hyperkitty events";
+      startAt = "daily";
+      serviceConfig = {
+        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs daily";
+        User = config.services.httpd.user;
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
+    systemd.services.hyperkitty-weekly = {
+      enable = cfg.hyperkittyApiKey != null;
+      description = "Trigger weekly Hyperkitty events";
+      startAt = "weekly";
+      serviceConfig = {
+        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs weekly";
+        User = config.services.httpd.user;
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
+    systemd.services.hyperkitty-yearly = {
+      enable = cfg.hyperkittyApiKey != null;
+      description = "Trigger yearly Hyperkitty events";
+      startAt = "yearly";
+      serviceConfig = {
+        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs yearly";
+        User = config.services.httpd.user;
+        WorkingDirectory = "/var/lib/mailman-web";
+      };
+    };
+
  };

 }
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -806,8 +806,8 @@ in {
          export otp="$(<'${cfg.secrets.otpFile}')"
          export jws="$(<'${cfg.secrets.jwsFile}')"
          ${pkgs.jq}/bin/jq -n '{production: {secret_key_base: $ENV.secret,
-                                              otp_key_base: $ENV.db,
-                                              db_key_base: $ENV.otp,
+                                              otp_key_base: $ENV.otp,
+                                              db_key_base: $ENV.db,
                                              openid_connect_signing_key: $ENV.jws}}' \
                            > '${cfg.statePath}/config/secrets.yml'
        )
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -120,16 +120,24 @@ in {
      '';
    };

-    poolConfig = mkOption {
-      type = types.lines;
-      default = ''
-        pm = dynamic
-        pm.max_children = 32
-        pm.start_servers = 2
-        pm.min_spare_servers = 2
-        pm.max_spare_servers = 4
-        pm.max_requests = 500
+    poolSettings = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = "32";
+        "pm.start_servers" = "2";
+        "pm.min_spare_servers" = "2";
+        "pm.max_spare_servers" = "4";
+        "pm.max_requests" = "500";
+      };
+      description = ''
+        Options for nextcloud's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
      '';
+    };
+
+    poolConfig = mkOption {
+      type = types.nullOr types.lines;
+      default = null;
      description = ''
        Options for nextcloud's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
      '';
@@ -287,6 +295,11 @@ in {
          message = "Please specify exactly one of adminpass or adminpassFile";
        }
      ];
+
+      warnings = optional (cfg.poolConfig != null) ''
+        Using config.services.nextcloud.poolConfig is deprecated and will become unsupported in a future release.
+        Please migrate your configuration to config.services.nextcloud.poolSettings.
+      '';
    }

    { systemd.timers.nextcloud-cron = {
@@ -423,7 +436,7 @@ in {
          settings = mapAttrs (name: mkDefault) {
            "listen.owner" = "nginx";
            "listen.group" = "nginx";
-          };
+          } // cfg.poolSettings;
          extraConfig = cfg.poolConfig;
        };
      };
--- a/nixos/modules/services/x11/redshift.nix
+++ b/nixos/modules/services/x11/redshift.nix
@@ -9,6 +9,22 @@ let

 in {

+  imports = [
+    (mkChangedOptionModule [ "services" "redshift" "latitude" ] [ "location" "latitude" ]
+      (config:
+        let value = getAttrFromPath [ "services" "redshift" "latitude" ] config;
+        in if value == null then
+          throw "services.redshift.latitude is set to null, you can remove this"
+          else builtins.fromJSON value))
+    (mkChangedOptionModule [ "services" "redshift" "longitude" ] [ "location" "longitude" ]
+      (config:
+        let value = getAttrFromPath [ "services" "redshift" "longitude" ] config;
+        in if value == null then
+          throw "services.redshift.longitude is set to null, you can remove this"
+          else builtins.fromJSON value))
+    (mkRenamedOptionModule [ "services" "redshift" "provider" ] [ "location" "provider" ])
+  ];
+
  options.services.redshift = {
    enable = mkOption {
      type = types.bool;
--- a/nixos/tests/hydra/create-trivial-project.sh
+++ b/nixos/tests/hydra/create-trivial-project.sh
@@ -44,6 +44,8 @@ cat >data.json <<EOF
  "enabled": "1",
  "visible": "1",
  "keepnr": "1",
+  "enableemail": true,
+  "emailoverride": "hydra@localhost",
  "nixexprinput": "trivial",
  "nixexprpath": "trivial.nix",
  "inputs": {
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@@ -8,8 +8,10 @@ let
  trivialJob = pkgs.writeTextDir "trivial.nix" ''
   { trivial = builtins.derivation {
       name = "trivial";
-       system = "x86_64-linux";
+       system = "${system}";
       builder = "/bin/sh";
+       allowSubstitutes = false;
+       preferLocalBuild = true;
       args = ["-c" "echo success > $out; exit 0"];
     };
   }
@@ -53,11 +55,16 @@ let
              notificationSender = "example@example.com";

              package = pkgs.hydra.override { inherit nix; };
+
+              extraConfig = ''
+                email_notification = 1
+              '';
            };
+            services.postfix.enable = true;
            nix = {
              buildMachines = [{
                hostName = "localhost";
-                systems = [ "x86_64-linux" ];
+                systems = [ system ];
              }];

              binaryCaches = [];
@@ -68,12 +75,12 @@ let
          # let the system boot up
          $machine->waitForUnit("multi-user.target");
          # test whether the database is running
-          $machine->succeed("systemctl status postgresql.service");
+          $machine->waitForUnit("postgresql.service");
          # test whether the actual hydra daemons are running
-          $machine->succeed("systemctl status hydra-queue-runner.service");
-          $machine->succeed("systemctl status hydra-init.service");
-          $machine->succeed("systemctl status hydra-evaluator.service");
-          $machine->succeed("systemctl status hydra-send-stats.service");
+          $machine->waitForUnit("hydra-init.service");
+          $machine->requireActiveUnit("hydra-queue-runner.service");
+          $machine->requireActiveUnit("hydra-evaluator.service");
+          $machine->requireActiveUnit("hydra-notify.service");

          $machine->succeed("hydra-create-user admin --role admin --password admin");

@@ -84,6 +91,8 @@ let
          $machine->succeed("create-trivial-project.sh");

          $machine->waitUntilSucceeds('curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq');
+
+          $machine->waitUntilSucceeds('journalctl -eu hydra-notify.service -o cat | grep -q "sending mail notification to hydra@localhost"');
        '';
      })));

--- a/nixos/tests/mumble.nix
+++ b/nixos/tests/mumble.nix
@@ -63,8 +63,8 @@ in
    $client2->sendChars("y");

    # Find clients in logs
-    $server->waitUntilSucceeds("grep -q 'client1' /var/log/murmur/murmurd.log");
-    $server->waitUntilSucceeds("grep -q 'client2' /var/log/murmur/murmurd.log");
+    $server->waitUntilSucceeds("journalctl -eu murmur -o cat | grep -q client1");
+    $server->waitUntilSucceeds("journalctl -eu murmur -o cat | grep -q client2");

    $server->sleep(5); # wait to get screenshot
    $client1->screenshot("screen1");
--- a/nixos/tests/xmonad.nix
+++ b/nixos/tests/xmonad.nix
@@ -26,7 +26,7 @@ import ./make-test.nix ({ pkgs, ...} : {
    $machine->waitForFile("/home/alice/.Xauthority");
    $machine->succeed("xauth merge ~alice/.Xauthority");
    $machine->sendKeys("alt-ctrl-x");
-    $machine->waitForWindow(qr/machine.*alice/);
+    $machine->waitForWindow(qr/alice.*machine/);
    $machine->sleep(1);
    $machine->screenshot("terminal");
    $machine->waitUntilSucceeds("xmonad --restart");
--- a/pkgs/applications/audio/lollypop/default.nix
+++ b/pkgs/applications/audio/lollypop/default.nix
@@ -20,7 +20,7 @@

 python3.pkgs.buildPythonApplication rec  {
  pname = "lollypop";
-  version = "1.1.4.14";
+  version = "1.1.4.16";

  format = "other";
  doCheck = false;
@@ -29,7 +29,7 @@ python3.pkgs.buildPythonApplication rec  {
    url = "https://gitlab.gnome.org/World/lollypop";
    rev = "refs/tags/${version}";
    fetchSubmodules = true;
-    sha256 = "004cwbnxss6vmdsc6i0y83h3xbc2bzc0ra4z99pkizkky2mz6swj";
+    sha256 = "1azfxc1vc1j4ph0zrfsgz2gac1vwmbj65j6wjlxx3nr8kia4mccl";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/manuskript/default.nix
+++ b/pkgs/applications/editors/manuskript/default.nix
@@ -1,9 +1,11 @@
-{ stdenv, zlib, fetchFromGitHub, python3Packages }:
+{ stdenv, zlib, fetchFromGitHub, python3Packages, wrapQtAppsHook }:

 python3Packages.buildPythonApplication rec {
  pname = "manuskript";
  version = "0.9.0";

+  format = "other";
+
  src = fetchFromGitHub {
    repo = pname;
    owner = "olivierkes";
@@ -11,6 +13,8 @@ python3Packages.buildPythonApplication rec {
    sha256 = "13y1s0kba1ib6g977n7h920kyr7abdw03kpal512m7iwa9g2kdw8";
  };

+  nativeBuildInputs = [ wrapQtAppsHook ];
+
  propagatedBuildInputs = [
    python3Packages.pyqt5
    python3Packages.lxml
@@ -30,6 +34,10 @@ python3Packages.buildPythonApplication rec {
    cp -r sample-projects/ $out/share/${pname}
  '';

+  postFixup = ''
+    wrapQtApp $out/bin/manuskript
+  '';
+
  doCheck = false;

  meta = {
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -11,13 +11,13 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1iz36nhkg78346g5407df6jv4d1ydb22hhgs8hiaxql3hq5z7x3q";
-    x86_64-darwin = "1iijk0kx90rax39iradbbafyvd3vwnzsgvyb3s13asy42pbhhkky";
+    x86_64-linux = "1wxaxz2q4qizh6f23ipz8ihay6bpjdq0545vijqd84fqazcji6sq";
+    x86_64-darwin = "1gb9w3hvw3avn852an5v8m1ia64fkavnvaawjfc3455b248iiqvk";
  }.${system};
 in
  callPackage ./generic.nix rec {

-    version = "1.38.0";
+    version = "1.38.1";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -11,13 +11,13 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "09rq5jx7aicwp3qqi5pcv6bmyyp1rm5cfa96hvy3f4grhq1fi132";
-    x86_64-darwin = "1y1lbb3q5myaz7jg21x5sl0in8wr46brqj9zyrg3f16zahsagzr4";
+    x86_64-linux = "15m7mfb8gmx3pwydc37blj0rxwgmkrnqfj6y79rpqlr2dg92gwlb";
+    x86_64-darwin = "080k4fnfa5ylmmya6zprgci3gld9mrbqsfnk53hgcny91ykl5xj5";
  }.${system};
 in
  callPackage ./generic.nix rec {

-    version = "1.38.0";
+    version = "1.38.1";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/gis/whitebox-tools/default.nix
+++ b/pkgs/applications/gis/whitebox-tools/default.nix
@@ -1,18 +1,21 @@
 { stdenv, rustPlatform , fetchFromGitHub, Security }:
 rustPlatform.buildRustPackage rec {
  pname = "whitebox_tools";
-  version = "0.9.0";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "jblindsay";
    repo = "whitebox-tools";
-    rev = "6221cdf327be70f0ee4f2053b76bfa01c3f37caa";
-    sha256 = "1423ga964mz7qkl88vkcm8qfprsksx04aq4sz9v5ghnmdzzvl89x";
+    rev = "v${version}";
+    sha256 = "1vs4hf2x3qjnffs9kjx56rzl67kpcy8xvng6p0r9fp9mfnblxg6j";
  };

  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;

-  cargoSha256 = "11m13h9b75xz8dfisfcykar53qsl1crrp3l75s73gkkkvczlfd24";
+  cargoSha256 = "1y3vk8bzsaisx7wrncjxcqdh355f2wk4n59vq5qgj37fph2zpy7f";
+
+  # failures: structures::polyline::test::test_polyline_split
+  doCheck = false;

  meta = with stdenv.lib; {
    description = "An advanced geospatial data analysis platform";
--- a/pkgs/applications/graphics/giv/build.patch
+++ b/pkgs/applications/graphics/giv/build.patch
@@ -1,22 +0,0 @@
-Get the environment propagated to scons forked childs, and correct the dicom plugin about
-a typedef of size_t that failed at least on x86_64-linux.
-
-diff --git a/SConstruct b/SConstruct
-index 9e752d6..f93f27f 100644
--- a/SConstruct
-+++ b/SConstruct
-@@ -9,13 +9,7 @@ else:
- 
- commit_id = os.popen('git rev-parse HEAD').read().replace('\n','')
- 
-env = Environment(LIBPATH=[],
-                  CPPFLAGS = cppflags + ['-Wno-deprecated-declarations',
-                                         '-Wno-reorder',
-                                         '-Wno-unused-but-set-variable',
-                                         '-Wno-unused-function'],
-                  CXXFLAGS=['-std=c++1y']
-                  )
-+env = Environment(ENV = os.environ)
- 
- env['SBOX'] = False
- env['COMMITIDSHORT'] = commit_id[0:6]
--- a/pkgs/applications/graphics/giv/default.nix
+++ b/pkgs/applications/graphics/giv/default.nix
@@ -1,34 +0,0 @@
-{ stdenv, fetchFromGitHub, gdk-pixbuf, scons, pkgconfig, gtk2, glib
-, pcre, cfitsio, perl, gob2, vala, libtiff, json-glib }:
-
-stdenv.mkDerivation rec {
-  pname = "giv";
-  version = "0.9.26";
-
-  src = fetchFromGitHub {
-    owner = "dov";
-    repo = "giv";
-    rev = "v${version}";
-    sha256 = "1sfm8j3hvqij6z3h8xz724d7hjqqbzljl2a6pp4yjpnnrxksnic2";
-  };
-
-  hardeningDisable = [ "format" ];
-
-  prePatch = ''
-    sed -i s,/usr/bin/perl,${perl}/bin/perl, doc/eperl
-    sed -i s,/usr/local,$out, SConstruct
-  '';
-
-  patches = [ ./build.patch ];
-
-  nativeBuildInputs = [ scons pkgconfig vala perl gob2 ];
-  buildInputs = [ gdk-pixbuf gtk2 glib pcre cfitsio libtiff json-glib ];
-
-  meta = with stdenv.lib; {
-    description = "Cross platform image and hierarchical vector viewer based";
-    homepage = http://giv.sourceforge.net/giv/;
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
-    platforms = with platforms; linux;
-  };
-}
--- a/pkgs/applications/misc/ape/default.nix
+++ b/pkgs/applications/misc/ape/default.nix
@@ -1,33 +1,33 @@
 { stdenv, swiProlog, makeWrapper,
  fetchFromGitHub,
-  lexicon ? "lexicon/clex_lexicon.pl",
+  lexicon ? "prolog/lexicon/clex_lexicon.pl",
  pname ? "ape",
  description ? "Parser for Attempto Controlled English (ACE)",
  license ? with stdenv.lib; licenses.lgpl3
  }:

 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "6.7-131003";
+  inherit pname;
+  version = "2019-08-10";

  buildInputs = [ swiProlog makeWrapper ];

  src = fetchFromGitHub {
     owner = "Attempto";
     repo = "APE";
-     rev = version;
-     sha256 = "0cw47qjg4896kw3vps6rfs02asvscsqvcfdiwgfmqb3hvykb1sdx";
+     rev = "113b81621262d7a395779465cb09397183e6f74c";
+     sha256 = "0xyvna2fbr18hi5yvm0zwh77q02dfna1g4g53z9mn2rmlfn2mhjh";
  };

  patchPhase = ''
    # We move the file first to avoid "same file" error in the default case
    cp ${lexicon} new_lexicon.pl
-    rm lexicon/clex_lexicon.pl
-    cp new_lexicon.pl lexicon/clex_lexicon.pl
+    rm prolog/lexicon/clex_lexicon.pl
+    cp new_lexicon.pl prolog/lexicon/clex_lexicon.pl
  '';

  buildPhase = ''
-    make build
+    make SHELL=${stdenv.shell} build
  '';

  installPhase = ''
--- a/pkgs/applications/misc/cataract/build.nix
+++ b/pkgs/applications/misc/cataract/build.nix
@@ -22,17 +22,21 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ autoreconfHook pkgconfig ];
  buildInputs = [ glib libxml2 exiv2 imagemagick ];

+  prePatch = ''
+    sed -i 's|#include <exiv2/exif.hpp>|#include <exiv2/exiv2.hpp>|' src/jpeg-utils.cpp
+  '';
+
  installPhase = ''
    mkdir $out/{bin,share} -p
    cp src/cgg{,-dirgen} $out/bin/
  '';

-  meta = {
-    homepage = http://cgg.bzatek.net/;
-    description = "a simple static web photo gallery, designed to be clean and easily usable";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.matthiasbeyer ];
-    platforms = with stdenv.lib.platforms; linux ++ darwin;
+  meta = with stdenv.lib; {
+    homepage = "http://cgg.bzatek.net/";
+    description = "A simple static web photo gallery, designed to be clean and easily usable";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.matthiasbeyer ];
+    platforms = with platforms; linux ++ darwin;
  };
 }

--- a/pkgs/applications/misc/diff-pdf/default.nix
+++ b/pkgs/applications/misc/diff-pdf/default.nix
@@ -7,15 +7,15 @@ let
    else
      [ wxGTK ];
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "diff-pdf";
-  version = "2017-12-30";
+  version = "0.3";

  src = fetchFromGitHub {
    owner = "vslavik";
    repo = "diff-pdf";
-    rev = "c4d67226ec4c29b30a7399e75f80636ff8a6f9fc";
-    sha256 = "1c3ig7ckrg37p5vzvgjnsfdzdad328wwsx0r31lbs1d8pkjkgq3m";
+    rev = "v${version}";
+    sha256 = "0vzvyjpk6m89zs6j1dq85f93n2b1i6akn2g0z9qhagjd2pds920i";
  };

  nativeBuildInputs = [ autoconf automake pkgconfig ];
@@ -24,9 +24,10 @@ stdenv.mkDerivation {
  preConfigure = "./bootstrap";

  meta = with stdenv.lib; {
-    homepage = http://vslavik.github.io/diff-pdf;
+    homepage = "https://vslavik.github.io/diff-pdf/";
    description = "Simple tool for visually comparing two PDF files";
    license = licenses.gpl2;
+    platforms = platforms.all;
    maintainers = with maintainers; [ dtzWill ];
  };
 }
--- a/pkgs/applications/misc/nut/default.nix
+++ b/pkgs/applications/misc/nut/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, neon, libusb, openssl, udev, avahi, freeipmi
-, libtool, makeWrapper }:
+, libtool, makeWrapper, nss }:

 stdenv.mkDerivation rec {
  name = "nut-2.7.4";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
    sha256 = "19r5dm07sfz495ckcgbfy0pasx0zy3faa0q7bih69lsjij8q43lq";
  };

-  buildInputs = [ neon libusb openssl udev avahi freeipmi libtool ];
+  buildInputs = [ neon libusb openssl udev avahi freeipmi libtool nss ];

  nativeBuildInputs = [ pkgconfig makeWrapper ];

--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -1,4 +1,4 @@
-{ stdenv, mkChromiumDerivation, channel }:
+{ stdenv, mkChromiumDerivation, channel, enableWideVine }:

 with stdenv.lib;

@@ -18,11 +18,6 @@ mkChromiumDerivation (base: rec {
    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
    cp -v "$buildPath/chrome" "$libExecPath/$packageName"

-    if [ -e "$buildPath/libwidevinecdmadapter.so" ]; then
-      cp -v "$buildPath/libwidevinecdmadapter.so" \
-            "$libExecPath/libwidevinecdmadapter.so"
-    fi
-
    mkdir -p "$sandbox/bin"
    cp -v "$buildPath/chrome_sandbox" "$sandbox/bin/${sandboxExecutableName}"

@@ -67,7 +62,7 @@ mkChromiumDerivation (base: rec {
    description = "An open source web browser from Google";
    homepage = http://www.chromium.org/;
    maintainers = with maintainers; [ bendlas ivan ];
-    license = licenses.bsd3;
+    license = if enableWideVine then licenses.unfree else licenses.bsd3;
    platforms = platforms.linux;
    hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
    timeout = 172800; # 48 hours
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -24,7 +24,6 @@

 # package customization
 , enableNaCl ? false
-, enableWideVine ? false
 , useVaapi ? false
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false, libgnome-keyring3 ? null
@@ -133,11 +132,12 @@ let
      ++ optional pulseSupport libpulseaudio
      ++ optional (versionAtLeast version "72") jdk.jre;

-    patches = optional enableWideVine ./patches/widevine.patch ++ [
+    patches = [
      ./patches/nix_plugin_paths_68.patch
      ./patches/remove-webp-include-69.patch
      ./patches/jumbo-sorted.patch
      ./patches/no-build-timestamps.patch
+      ./patches/widevine.patch

      # Unfortunately, chromium regularly breaks on major updates and
      # then needs various patches backported in order to be compiled with GCC.
@@ -235,7 +235,7 @@ let
      use_gnome_keyring = gnomeKeyringSupport;
      use_gio = gnomeSupport;
      enable_nacl = enableNaCl;
-      enable_widevine = enableWideVine;
+      enable_widevine = true;
      use_cups = cupsSupport;

      treat_warnings_as_errors = false;
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -2,6 +2,8 @@
 , makeWrapper, ed
 , glib, gtk3, gnome3, gsettings-desktop-schemas
 , libva ? null
+, gcc, nspr, nss, patchelfUnstable, runCommand
+, lib

 # package customization
 , channel ? "stable"
@@ -34,23 +36,76 @@ in let
    mkChromiumDerivation = callPackage ./common.nix {
      inherit enableNaCl gnomeSupport gnome
              gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport
-              useVaapi
-              enableWideVine;
+              useVaapi;
    };

-    browser = callPackage ./browser.nix { inherit channel; };
+    browser = callPackage ./browser.nix { inherit channel enableWideVine; };

    plugins = callPackage ./plugins.nix {
-      inherit enablePepperFlash enableWideVine;
+      inherit enablePepperFlash;
    };
  };

+  mkrpath = p: "${lib.makeSearchPathOutput "lib" "lib64" p}:${lib.makeLibraryPath p}";
+  widevine = let upstream-info = chromium.upstream-info; in stdenv.mkDerivation {
+    name = "chromium-binary-plugin-widevine";
+
+    src = upstream-info.binary;
+
+    nativeBuildInputs = [ patchelfUnstable ];
+
+    phases = [ "unpackPhase" "patchPhase" "installPhase" "checkPhase" ];
+
+    unpackCmd = let
+      chan = if upstream-info.channel == "dev"    then "chrome-unstable"
+        else if upstream-info.channel == "stable" then "chrome"
+        else if upstream-info.channel == "beta" then "chrome-beta"
+        else throw "Unknown chromium channel.";
+    in ''
+      mkdir -p plugins
+      ar p "$src" data.tar.xz | tar xJ -C plugins --strip-components=4 \
+        ./opt/google/${chan}/libwidevinecdm.so
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    PATCH_RPATH = mkrpath [ gcc.cc glib nspr nss ];
+
+    patchPhase = ''
+      patchelf --set-rpath "$PATCH_RPATH" libwidevinecdm.so
+    '';
+
+    installPhase = ''
+      install -vD libwidevinecdm.so \
+        "$out/lib/libwidevinecdm.so"
+    '';
+
+    meta.platforms = lib.platforms.x86_64;
+  };
+
  suffix = if channel != "stable" then "-" + channel else "";

  sandboxExecutableName = chromium.browser.passthru.sandboxExecutableName;

  version = chromium.browser.version;

+  # This is here because we want to add the widevine shared object at the last
+  # minute in order to avoid a full rebuild of chromium. Additionally, this
+  # isn't in `browser.nix` so we can avoid having to re-expose attributes of
+  # the chromium derivation (see above: we introspect `sandboxExecutableName`).
+  chromiumWV = let browser = chromium.browser; in if enableWideVine then
+    runCommand (browser.name + "-wv") { version = browser.version; }
+      ''
+        mkdir -p $out
+        cp -R ${browser}/* $out/
+        chmod u+w $out/libexec/chromium*
+        cp ${widevine}/lib/libwidevinecdm.so $out/libexec/chromium/
+        # patchelf?
+      ''
+    else browser;
 in stdenv.mkDerivation {
  name = "chromium${suffix}-${version}";
  inherit version;
@@ -68,7 +123,7 @@ in stdenv.mkDerivation {
  outputs = ["out" "sandbox"];

  buildCommand = let
-    browserBinary = "${chromium.browser}/libexec/chromium/chromium";
+    browserBinary = "${chromiumWV}/libexec/chromium/chromium";
    getWrapperFlags = plugin: "$(< \"${plugin}/nix-support/wrapper-flags\")";
    libPath = stdenv.lib.makeLibraryPath ([]
      ++ stdenv.lib.optional useVaapi libva
@@ -113,13 +168,7 @@ in stdenv.mkDerivation {
  '';

  inherit (chromium.browser) packageName;
-  meta = chromium.browser.meta // {
-    broken = if enableWideVine then
-          builtins.trace "WARNING: WideVine is not functional, please only use for testing"
-             true
-        else false;
-  };
-
+  meta = chromium.browser.meta;
  passthru = {
    inherit (chromium) upstream-info browser;
    mkDerivation = chromium.mkChromiumDerivation;
--- a/pkgs/applications/networking/browsers/chromium/patches/widevine.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/widevine.patch
@@ -1,16 +1,24 @@
-Minimal WideVine patch from Gentoo:
+Description: enable widevine and set its version string to "undefined"
+Author: Michael Gilbert <mgilbert@debian.org>
+Author: Olivier Tilloy <olivier.tilloy@canonical.com>

-https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/chromium/files/chromium-widevine-r1.patch
-
-BTS: https://bugs.gentoo.org/show_bug.cgi?id=547630
-
--- a/third_party/widevine/cdm/stub/widevine_cdm_version.h
-+++ b/third_party/widevine/cdm/stub/widevine_cdm_version.h
-@@ -10,6 +10,7 @@
- 
- #include "third_party/widevine/cdm/widevine_cdm_common.h"
- 
-+#define WIDEVINE_CDM_VERSION_STRING "unknown"
- #define WIDEVINE_CDM_AVAILABLE
+--- a/third_party/widevine/cdm/widevine_cdm_version.h
+++ b/third_party/widevine/cdm/widevine_cdm_version.h
+@@ -11,5 +11,6 @@
+ // If the Widevine CDM is available define the following:
+ //  - WIDEVINE_CDM_VERSION_STRING (with the version of the CDM that's available
+ //    as a string, e.g., "1.0.123.456").
+#define WIDEVINE_CDM_VERSION_STRING "undefined"
 
 #endif  // WIDEVINE_CDM_VERSION_H_
+--- a/chrome/common/chrome_content_client.cc
+++ b/chrome/common/chrome_content_client.cc
+@@ -99,7 +99,7 @@
+ // Registers Widevine CDM if Widevine is enabled, the Widevine CDM is
+ // bundled and not a component. When the Widevine CDM is a component, it is
+ // registered in widevine_cdm_component_installer.cc.
+-#if BUILDFLAG(BUNDLE_WIDEVINE_CDM) && !BUILDFLAG(ENABLE_WIDEVINE_CDM_COMPONENT)
+#if !BUILDFLAG(ENABLE_WIDEVINE_CDM_COMPONENT)
+ #define REGISTER_BUNDLED_WIDEVINE_CDM
+ #include "third_party/widevine/cdm/widevine_cdm_common.h"  // nogncheck
+ // TODO(crbug.com/663554): Needed for WIDEVINE_CDM_VERSION_STRING. Support
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -6,7 +6,6 @@
 , fetchzip
 , patchelfUnstable
 , enablePepperFlash ? false
-, enableWideVine ? false

 , upstream-info
 }:
@@ -44,60 +43,6 @@ let
    echo ${toString quoted} > "''$${output}/nix-support/wrapper-flags"
  '';

-  widevine = stdenv.mkDerivation {
-    name = "chromium-binary-plugin-widevine";
-
-    src = upstream-info.binary;
-
-    nativeBuildInputs = [ patchelfUnstable ];
-
-    phases = [ "unpackPhase" "patchPhase" "installPhase" "checkPhase" ];
-
-    unpackCmd = let
-      chan = if upstream-info.channel == "dev"    then "chrome-unstable"
-        else if upstream-info.channel == "stable" then "chrome"
-        else "chrome-${upstream-info.channel}";
-    in ''
-      mkdir -p plugins
-      ar p "$src" data.tar.xz | tar xJ -C plugins --strip-components=4 \
-        ./opt/google/${chan}/libwidevinecdm.so \
-        ./opt/google/${chan}/libwidevinecdmadapter.so
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
-    '';
-
-    PATCH_RPATH = mkrpath [ gcc.cc glib nspr nss ];
-
-    patchPhase = ''
-      chmod +x libwidevinecdm.so libwidevinecdmadapter.so
-      patchelf --set-rpath "$PATCH_RPATH" libwidevinecdm.so
-      patchelf --set-rpath "$out/lib:$PATCH_RPATH" libwidevinecdmadapter.so
-    '';
-
-    installPhase = let
-      wvName = "Widevine Content Decryption Module";
-      wvDescription = "Playback of encrypted HTML audio/video content";
-      wvMimeTypes = "application/x-ppapi-widevine-cdm";
-      wvModule = "@out@/lib/libwidevinecdmadapter.so";
-      wvInfo = "#${wvName}#${wvDescription};${wvMimeTypes}";
-    in ''
-      install -vD libwidevinecdm.so \
-        "$out/lib/libwidevinecdm.so"
-      install -vD libwidevinecdmadapter.so \
-        "$out/lib/libwidevinecdmadapter.so"
-
-      ${mkPluginInfo {
-        flags = [ "--register-pepper-plugins=${wvModule}${wvInfo}" ];
-        envVars.NIX_CHROMIUM_PLUGIN_PATH_WIDEVINE = "@out@/lib";
-      }}
-    '';
-
-    meta.platforms = platforms.x86_64;
-  };
-
  flash = stdenv.mkDerivation rec {
    pname = "flashplayer-ppapi";
    version = "32.0.0.255";
@@ -140,6 +85,5 @@ let
  };

 in {
-  enabled = optional enableWideVine widevine
-         ++ optional enablePepperFlash flash;
+  enabled = optional enablePepperFlash flash;
 }
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,9 +1,9 @@
 # This file is autogenerated from update.sh in the same directory.
 {
  beta = {
-    sha256 = "0m7xdpi1f2a33csd7bsp91g5klz0hmr83ksfwsd2fki3iipvfs4w";
-    sha256bin64 = "1b4cyf4v55sy52mxxl8d70abg5ck5k45jaqdjsjw7dvh3s2x4bwp";
-    version = "77.0.3865.42";
+    sha256 = "12cp24h93b48pwfywf5b6qvjdlhxrhp87qdaqbfcn6g787r2z5gb";
+    sha256bin64 = "0d9w869qqwbmw3qjvxkfm37i7dvrgmrwm5y96sm1dg2jnxqj4bdz";
+    version = "77.0.3865.75";
  };
  dev = {
    sha256 = "0x5r6xqwiggwyzbinm252xc1n3f9r7cmmzj6assi4v1nsispdh2k";
@@ -11,8 +11,8 @@
    version = "78.0.3887.7";
  };
  stable = {
-    sha256 = "0hajwjf7swlgh1flpf8ljfrb2zhmcpzvrigvvxqd36g3nm04cknm";
-    sha256bin64 = "0hdsla8i3q0zbczia64ghqsf420alcc31xdishx1sv48x3rlrxkk";
-    version = "76.0.3809.132";
+    sha256 = "12cp24h93b48pwfywf5b6qvjdlhxrhp87qdaqbfcn6g787r2z5gb";
+    sha256bin64 = "1wp5g09czyslkkhw3nhbp39fxfcz0pprsgj8h0aggghpdbvzph3d";
+    version = "77.0.3865.75";
  };
 }
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -70,11 +70,11 @@ rec {

  firefox-esr-60 = common rec {
    pname = "firefox-esr";
-    ffversion = "60.8.0esr";
+    ffversion = "60.9.0esr";

    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0332b6049b97e488e55a3b9540baad3bd159e297084e9a625b8492497c73f86eb3e144219dabc5e9f2c2e4a27630d83d243c919cd4f86b7f59f47133ed3afc54";
+      sha512 = "4baea5c9c4eff257834bbaee6d7786f69f7e6bacd24ca13c2705226f4a0d88315ab38c650b2c5e9c76b698f2debc7cea1e5a99cb4dc24e03c48a24df5143a3cf";
    };

    patches = [
--- a/pkgs/applications/networking/ike/default.nix
+++ b/pkgs/applications/networking/ike/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, openssl, libedit, flex, bison, qt4, makeWrapper
+{ stdenv, fetchurl, fetchpatch, cmake, openssl, libedit, flex, bison, qt4, makeWrapper
 , gcc, nettools, iproute, linuxHeaders }:

 # NOTE: use $out/etc/iked.conf as sample configuration and also set: dhcp_file "/etc/iked.dhcp";
@@ -8,14 +8,25 @@
 # so I'm sticking with 3.4

 stdenv.mkDerivation rec {
-  name = "ike-2.2.1";
+  pname = "ike";
+  version = "2.2.1";

  src = fetchurl {
-    url = "https://www.shrew.net/download/ike/${name}-release.tgz";
+    url = "https://www.shrew.net/download/ike/${pname}-${version}-release.tgz";
    sha256 = "0fhyr2psd93b0zf7yfb72q3nqnh65mymgq5jpjcsj9jv5kfr6l8y";
  };

-  buildInputs = [ cmake openssl libedit flex bison qt4 makeWrapper nettools iproute ];
+  patches = [
+    # required for openssl 1.1.x compatibility
+    (fetchpatch {
+      name = "openssl-1.1.0.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/openssl-1.1.0.patch?h=ike&id=3a56735ddc26f750df4720f4baba0728bb4cb458";
+      sha256 = "1hw8q4xy858rivpjkq5288q3mc75d52bg4w3n30y99h05wik0h51";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake flex bison makeWrapper ];
+  buildInputs = [ openssl libedit qt4 nettools iproute ];

  configurePhase = ''
    mkdir -p $out/{bin,sbin,lib}
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
@@ -1,615 +1,615 @@
 {
-  version = "68.0";
+  version = "68.1.0";
  sources = [
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ar/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ar/thunderbird-68.1.0.tar.bz2";
      locale = "ar";
      arch = "linux-x86_64";
-      sha512 = "4fad3c7c4099f70253bfee450bcefe458bec61430720fcadde1fe8a1cbb2e62a18d9c55943f850c57f8d788c973774e24590823086cfacbbb2ccd8a99ce4faae";
+      sha512 = "b9bb22bdbe013358c03e804e3c51ad387dca503b9e0074db70494eb3f331d72bd8679db929972e75b39f2464d384753bcab9947d1a843a69167d7b3706952c35";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ast/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ast/thunderbird-68.1.0.tar.bz2";
      locale = "ast";
      arch = "linux-x86_64";
-      sha512 = "aac850773381d7fdb4d50fafe670449301f073f7388f92a1ca38d9b7256ffcd244b63e9fc0ff2f8ef5ccd853b97016b7e05eb751be1bdc8df9623481f15d55e6";
+      sha512 = "e00382241343bbd8a86e31dfcf5bbb060b46e5db6211cfa54c7192361353e2c4fe3d0ad3f4e0319ec1a0dc1f4590b7bc0271e5658bc468986d8e27a64d9924da";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/be/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/be/thunderbird-68.1.0.tar.bz2";
      locale = "be";
      arch = "linux-x86_64";
-      sha512 = "6521d818984bbfba195e847735c1228ff637d3079cff1f5a461ac20a079d325adfc1d7b2eca54f63e584a5cbd2007cef42a625597276a1810158931335f09cd9";
+      sha512 = "f043c8aa5dac0d5e2f9da628d6659f654cc39726677424e4b5e5005e97bf202575f569ebdee346d37cc8d4d59da188e6cfe1bd6bf7df1acafe26b489242b4a9f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/bg/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/bg/thunderbird-68.1.0.tar.bz2";
      locale = "bg";
      arch = "linux-x86_64";
-      sha512 = "a0a738b6877225a5b98691d53a8f4a4bf575472a0d5feb8b77a67cd1fc9951772f1ab507b7ba460c0b62b87ab476c5c94130cbe7275692e3a99e5d2ef0bd89bd";
+      sha512 = "61fcf864145fb4fd4a05bff47bd23a7be8444f9d067eec246399c3a7ce48db8744ba4a9cb42e28a215a5bb1b336a57c51d1a32e6564f42c8b9fd4dba5f629d9f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/br/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/br/thunderbird-68.1.0.tar.bz2";
      locale = "br";
      arch = "linux-x86_64";
-      sha512 = "58d21d9e55abed644eb16ba98a5fb3277e0a31b935d279b09745262952895c2c2aed31817e6157410137ff82fc5d242b64268f646c3b7b691c55c5f3ea36e0e6";
+      sha512 = "1cdc9b2a8ee82bb087a51ac013644ff3da5f1e161fca23fb24feae8076cef6c5aff5316f83a8ecfa4f08c3a8642501a333d3ef95b46b8f899ce78b79d027af4c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ca/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ca/thunderbird-68.1.0.tar.bz2";
      locale = "ca";
      arch = "linux-x86_64";
-      sha512 = "cd401259f2cc4ec71ff9d936a1f2f64a064afafed2e305bb359f79eddf1159cd6a7c84ce54cde6be94f6acd295dbedf54017d9f4592ee3637eea00496c7cfbf1";
+      sha512 = "1b73ca87f3067ec2a84990c7c58060b11286dd653f4b8b4c18a44f5540ea195d25f995539de39b6e1de6cbbe54c890bf30f6d88157e000e30c69f4d32a4ae8f0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/cak/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/cak/thunderbird-68.1.0.tar.bz2";
      locale = "cak";
      arch = "linux-x86_64";
-      sha512 = "45ea4af30ff93500d1671c6a0eeda993692b7204a7504a91ad30bfd5155add5af902205240fd62f80abe339224e686473f2d13f466ba96269347207ed3f628b5";
+      sha512 = "1b2ec85786a842c7554f52b1ff72c4e5611a76bca94c4b8e9a79604d6b85d7f2deba906bbeca355dfd0c5a6c241d9bd397f4e0dfebd802cdb0c35162a02fd879";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/cs/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/cs/thunderbird-68.1.0.tar.bz2";
      locale = "cs";
      arch = "linux-x86_64";
-      sha512 = "9f81f92a3b1710d006cda79f1b92923c1ea637a24654bd622af9be1f53a0024c5daa77619443514c9e607cb62f96403f5b7f426b3692227c0b56d1b14f51ca97";
+      sha512 = "69df6542c5037815d3a80be764eaa809dd351f75417e4362a258df5e17e36aef6d8f8653429f4218f196ff096252e0304c2cca1cccbf8693d119bc05f1072067";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/cy/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/cy/thunderbird-68.1.0.tar.bz2";
      locale = "cy";
      arch = "linux-x86_64";
-      sha512 = "c90467a78bc82667d974b1e94227b7d4185878654188967d97c11e419ec7a03e4e5e3636466a0b6d35beaa98b717a26341e3a652c3b21083ad8ad0b23f063ed1";
+      sha512 = "5dc63d2746475f0045f7749e45bbc3f755b187521b0ca877ffab9386bb1bbe9b4fd66f9cc6bdac516ba591e71d71f02a75b5c965a610a3efbee3b59815d8deda";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/da/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/da/thunderbird-68.1.0.tar.bz2";
      locale = "da";
      arch = "linux-x86_64";
-      sha512 = "f49bd5689d2a4dd311b22a23da9f26559685f1c4663eb1e482b45b79544ab4401a17701f33b6ad083e7a8983185fcb16fca4c8026138f24be495c6cbb6401488";
+      sha512 = "89427a2b66dbd71cdfbb299a14ce7ed61ab4836e473854ea8b2ec522de64870f8886f6ae86428c9b1c86733aaa4ac7c732a708fccdd70d3e112d2f651c0dc762";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/de/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/de/thunderbird-68.1.0.tar.bz2";
      locale = "de";
      arch = "linux-x86_64";
-      sha512 = "579d979cfa0bbe50fd0bbf0d15b38d90579bc065b488a2e9d4e3f18f505e71c50225d92185559578146097110760ed3807e1aefad4862d99e247447478d6bc42";
+      sha512 = "34130ec994f6ee6a407313ccc61d43b0375046f59f75d4fb619776d5c880993802c16a3b8ec28dc7053b4ae89f91f1c2046da7d884d150aa7c3b65edd1650b21";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/dsb/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/dsb/thunderbird-68.1.0.tar.bz2";
      locale = "dsb";
      arch = "linux-x86_64";
-      sha512 = "8d16bf47d368a670cadb6a2655933d5b49a796272f7dafd948cac95a2ae541561a38fa418cd4ed0c4aa79ef63a441ee769eeb2a071734abf2cc1ba243d4f3ba5";
+      sha512 = "0b9c02a1e31f8f3120fb9ed520c53505dc247440ba2e189cbc58569be5ce6e0c33de220ebda17754338aa680cf5c8aac3ad7f5da14e0cbefc29f32db2446618a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/el/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/el/thunderbird-68.1.0.tar.bz2";
      locale = "el";
      arch = "linux-x86_64";
-      sha512 = "579b9114af9fda86e79e6812946da858945e2034ed2f00e4244724ecdd680b7db5601a4d573b530dc15207caac9245f6883343684eb43f3ae2abb64853c0b54f";
+      sha512 = "1d8e2efc2c9a7375a2ce0f2137165756800a680209d18612420581963f13774fc7780ac0ccda24a485996531d1e82e027b42a671f1c8fce5e8ccf0887f72ac6f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/en-GB/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/en-GB/thunderbird-68.1.0.tar.bz2";
      locale = "en-GB";
      arch = "linux-x86_64";
-      sha512 = "f7caed8c3b49714e4449ef971ed1a21e40f28625c84e9342f63e5f73743689ee2c0e9ed4845f6667bd22732c62bd707db425f22a5c074dff8622cc4536ba9c29";
+      sha512 = "79684a833afe5d1025088d6f91e023c81832e9df83751926c5d9bc05fecb7f53d6efd096f55d65d45fa07309497cf5bed2e3b00cc4a80cc1e4ed2a0fe44d02a8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/en-US/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/en-US/thunderbird-68.1.0.tar.bz2";
      locale = "en-US";
      arch = "linux-x86_64";
-      sha512 = "257528761f0eca38528ded4b31329886093418f562aa2fac73b3a5bedda51fe80b34758c10afae1735cf37b37a86413dcf08642aecb1e8bea1fb6b0b94ade5c7";
+      sha512 = "7a29cf0a238e44a2051b53e5476bc8f622dffd088251b66d951ad6874fba5fba180f440c80c7d5ae154c688d3e29fcc6c889f0031d81a018b7fd1dfd53f112a5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/es-AR/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/es-AR/thunderbird-68.1.0.tar.bz2";
      locale = "es-AR";
      arch = "linux-x86_64";
-      sha512 = "70a10e329b1031a2fd2ffb2b60459f0238ff3f5e5d80533f4be6cb22ae77692ec079ca3e146bd9a59edd09c266cec92d922a18ba45f8626a4bd44e290d3c0927";
+      sha512 = "d9d62f94af40ba69240b792b3ef2d93efef20b01b4289e992f7d1192147029574f86fa21aed5ad54489d1e5ec1f3b80cd9601e71e2ba9c903582ccd7aed278a8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/es-ES/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/es-ES/thunderbird-68.1.0.tar.bz2";
      locale = "es-ES";
      arch = "linux-x86_64";
-      sha512 = "a03098ad7d83b86cd316c56b69589370fb8bad041b93f90f61514b04e3d0e78385f779ed715c6e22e45597d1bf03676046cbc1eae7896bb2a309af3683c8bd1e";
+      sha512 = "d720320494b2c8431004e0d1ac24ff8fef83bc0977f44653d0fdab99fbc9a1aee6d5aecd7cbf6002e3746d04156f47aeb57367f2b30f4690efba36c3297fbeb0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/et/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/et/thunderbird-68.1.0.tar.bz2";
      locale = "et";
      arch = "linux-x86_64";
-      sha512 = "44efeaf030580dd7b55770627678808e34d689e85191852c2e5fcb223a0fdd0e5386f21f03524d0983aeded7f8ed99382ff2c372c8c5a1fdfe218bd5b10ccd80";
+      sha512 = "8d9ba13604fab4eb9a3dec8894b04d52f9677d5f82695512680ff03740a66e96786f69476071741c8086a09070fd03786e8fae7f94bb3bec9075331fe4dc144b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/eu/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/eu/thunderbird-68.1.0.tar.bz2";
      locale = "eu";
      arch = "linux-x86_64";
-      sha512 = "c670be5932d7e8bea28cffda7c119cfdfd5823f76b2c97251ec23ec16e420a8b7feb5f2251d89750b956d3bf3baff5d17393c05d8c265d0a98cc3faea8f85735";
+      sha512 = "e40110a94b3d7fb42707287dc695ea09b082fa3262d05b39a0c09002c32722630711f1b0131441c919b23130ed133338239060726cfc9d6c0b49822558081313";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/fi/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/fi/thunderbird-68.1.0.tar.bz2";
      locale = "fi";
      arch = "linux-x86_64";
-      sha512 = "36aa0b47e9b5d91fbc812a3d63503924a8ca227d7b7084c1159419092b17da9c1b6e89fa046c636dbcff7776f9a1d8465e660b47f1753505f0d2eb85da9c3a7a";
+      sha512 = "d8778ddba26f544a4721b9118ce5726b04fdf09758272b35ca16c14aea61d0b8271888344e742feb4d4e758182e97b01758acd53ad622a66117e3eb0d4a6d336";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/fr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/fr/thunderbird-68.1.0.tar.bz2";
      locale = "fr";
      arch = "linux-x86_64";
-      sha512 = "b1e7d345d3dd38725227b5e09c4f3cfcf29ed3a98b0580fbf6ae1ecab4414d09e307423495b75769a8d2ee3ab4700cd6eba3d95ce05612e1d8290d3f5a3ba988";
+      sha512 = "2cd546d40bedf09b58703b0b11a5c9349d702540ae714942e0152a19cbecee51f37c7e217fadfc719ecfebf914f9ffad6b3070bb6471d395e8f5ff8ada754551";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/fy-NL/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/fy-NL/thunderbird-68.1.0.tar.bz2";
      locale = "fy-NL";
      arch = "linux-x86_64";
-      sha512 = "4065a083f49006dacf64f084c1bf26c4c1b8d53bca7eba7a56d66bb035eaae2c4528687c5c1e2213f92adbba17ff92eb54f897d3b0ef6d27b8effbee66ca555b";
+      sha512 = "03f52224f145917f64e8962b68bcf3810543b5bf0508dca7965c5a385c4f87bc7d236dac217594fdd2a10afe31da8aadc674eaf7b226e189b598011a8b9e223a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ga-IE/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ga-IE/thunderbird-68.1.0.tar.bz2";
      locale = "ga-IE";
      arch = "linux-x86_64";
-      sha512 = "2ae9a0860513e90d1742e5c17220b2367e61273eba04738cd29e9ab497b86f9a1d78b38b21da84b1f214f3368ee114d376b05eabe0aac9a1ec07ca6a4b399070";
+      sha512 = "931257466ce7134b9852c2627f34efebc031b3dfc9fb7b5e344665da7fa52ac1fcd12a8848fd9a264a900e98ee3383d3ee6c251de58c1432127a8ce8f1c100e1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/gd/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/gd/thunderbird-68.1.0.tar.bz2";
      locale = "gd";
      arch = "linux-x86_64";
-      sha512 = "d2315aca9d8e5bb35b21cab46a48e51f09200b056da2682201c32eb4fd3d0379a24a6926ebcf11e9c70d70fd20152fc24d5197a78cdb3c8ea3cc2399d784b463";
+      sha512 = "ee3573fe9af5fae39aa053061ef82207ae6669e6764637f6ddef5f8ee3cebf362dfecf5cf5e9e208392f3fe79a0c1a56aba28f372e2e279b33a1f1e3a58851f3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/gl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/gl/thunderbird-68.1.0.tar.bz2";
      locale = "gl";
      arch = "linux-x86_64";
-      sha512 = "52d9210e857c1b6cb665a2ffa71cfa5e67c3718b210e2b4b42839d8f25987170f1603fa55d324003a4be821ba74093ff92d632e688e44b87ebf51dafd02f69a2";
+      sha512 = "73ba3965d522aac8f9d5af87856a7e2f71cb7ed850f240be56eab9426f91e5356810a12da7cb91bc223cb14eeae3ecb89a2afeca48641ce4debefdaed05aeed6";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/he/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/he/thunderbird-68.1.0.tar.bz2";
      locale = "he";
      arch = "linux-x86_64";
-      sha512 = "e7b5a16950be233fe8a49152184270a901bdb4bcc14769401d4b5a21fd2a3ab9d395ed8f6b61081330386723725252fceff09bf9fdde3a71135a98d8ae45089b";
+      sha512 = "abd4f47d571037c4340dd3118a517f3421a3e3597efa1ad7ab14cf537d4b4e226144beb0a6c54a45ec272ab428ee8ed95083d31554ef2aa0022712dd832a1585";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/hr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/hr/thunderbird-68.1.0.tar.bz2";
      locale = "hr";
      arch = "linux-x86_64";
-      sha512 = "1ed224dc0864009edc6389f9b3b063f56b15be982c2e2915f1a2f773bfc78e6b81ec0ab02e03f7ade08f47260be597003f8119116576f4fe5dd490e85cd3d4ab";
+      sha512 = "32a18d8666fc2b7566807a010d94bf5503b375c5330687aa58efc2bc6464e4f910947ea513a6ebb6b7eadef0e552138a5349583e6894b3166ef6f8d53d5cf67b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/hsb/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/hsb/thunderbird-68.1.0.tar.bz2";
      locale = "hsb";
      arch = "linux-x86_64";
-      sha512 = "f4bcd8a199bafd544687b1e890694dac2b598d4fd79818ab19441ae9be579a9928fd8c7fbae43e322fced15ff39314fbc88be94ce2fe12b5d2ec2ba003a219a3";
+      sha512 = "58794aecdb5f3824e94f2bde4e4080d4922648bac632cfdffbc5304329af64f9e5ef01fc587c4e19e88f206004cc4254503513d7bfddecdb6778de89e4ca6bc5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/hu/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/hu/thunderbird-68.1.0.tar.bz2";
      locale = "hu";
      arch = "linux-x86_64";
-      sha512 = "28223aec237fce2f07b0c3b454a8339bbd2f195d6e263c5a5723e04bd5df1128d58a6bc6c7275cdbeefd5161a405a2d6340303faa79d9330abd0e70de9facbfb";
+      sha512 = "c7881770fc75a6b1eecc5c481e2de134a241b7a497e19ff2abf08aaecf65006f054090a53b028202becf7776d3939742fa71156e6761f981ff7a00ca0d1d7d3f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/hy-AM/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/hy-AM/thunderbird-68.1.0.tar.bz2";
      locale = "hy-AM";
      arch = "linux-x86_64";
-      sha512 = "d7dea23905f8bc8dfde92082f90278b76477eb3036c7fc4abe656e37af9d389d37f3b166492df210eeab03750d85cbcaf1340aaa26ab723ca1b70299b4a64ab6";
+      sha512 = "80f5fd19da8e07a6d40c19c645eb8fd6964f9904cd14df36374170c4d395146d168728953d1619965f04b3f2295df3d379650e97f8320587816ee088e2f17a9e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/id/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/id/thunderbird-68.1.0.tar.bz2";
      locale = "id";
      arch = "linux-x86_64";
-      sha512 = "f55ad81a1dc80838a9ab045899e0f16bb077d05d73119705f820f6fe8c8c7a550e05cc68cb7ca0aa8861cbd70bc9f061ba51a4749db6c37d90e7e7bda5dcccdf";
+      sha512 = "efffdd32086ca57e93b1ebcb40484a3c2243d6b088c70d7b20bcdb38925e7fb64be4446c98980a53738f54dadb54a2d17016adc69bd2a47a9719bb7bb982f729";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/is/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/is/thunderbird-68.1.0.tar.bz2";
      locale = "is";
      arch = "linux-x86_64";
-      sha512 = "503c236102a15428e41a21b458ecc29986abff4e434f4e26ec9741b2facf39a8fc2ae9dff5aeb32fe3c9ca0dcb6e914a2acf229ae9caecdc4f064380f126ecf7";
+      sha512 = "277d1137675c6304b28f43273c5a3fbcdf0d2188cbaa38911d784df98b3429eb6d2667b818a292e4c3bd4019b2b682463c2d01faa0a034cb4fc1dd49ba8aab33";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/it/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/it/thunderbird-68.1.0.tar.bz2";
      locale = "it";
      arch = "linux-x86_64";
-      sha512 = "51a736932baa5c810a29de46eba64b0fcd2703da38ba9449b6b06a9412562e80853367416c5b4d6c6834eb7a2186f434e426099ede56d9342860e4f3561455eb";
+      sha512 = "6932697d769f98dcd32f3dcda57dfa154314e29bfd2c1b11a2b9a8aeb8395f00fdb0d1c71b8e9d405d1540cde21547a910a55024b799e270759d8638a3d11512";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ja/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ja/thunderbird-68.1.0.tar.bz2";
      locale = "ja";
      arch = "linux-x86_64";
-      sha512 = "7a00080835155d301f65a35684d81f8e3a3be23d927d939da84a2a887057bca0b75d5b580a004b4f797af504a6812f71951bc3c75ccb24dad60b6cca770cc7a1";
+      sha512 = "034021e89c471429367807f04d79dbe877d0ebc94f584fa6c0bec3a29f279f1d6dfc85f709b26e9d11c8ebcc1f42adb9a458137c032a73ae2b69f7238d31ce76";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ka/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ka/thunderbird-68.1.0.tar.bz2";
      locale = "ka";
      arch = "linux-x86_64";
-      sha512 = "eaf67c64275495fcb08aca63953406cd7815ec356ee0a1edca8a5e8dacd924a9c11e35dbe4ad17a1617199a5f66489bb553a7a5177eb629223b49a9adccff803";
+      sha512 = "7af1caeda9babac2a4c9b456233e86be32bcd14b6dd81cc18a1874dafe86c5b80099d0ce388a70fe6e74bb7b0d00d3b7ce810ffcbae143eadf6d8c4367567c27";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/kab/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/kab/thunderbird-68.1.0.tar.bz2";
      locale = "kab";
      arch = "linux-x86_64";
-      sha512 = "9432bbba0965b6da04495b79ef4db3bdbe69476b20650b4d6407d921cf07d09950368f0c13211ea6743b621d486bf71dce0e60d8ceefd82b48a8f2581a3fd7ee";
+      sha512 = "d8e7e7d423f36d40ce05cf1378278c47049fca0ba415466028dd821b12970fb78fbadfbb7b7390ec446aede490f07f979b94ef890a43a710e3a1f66a0c68937a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/kk/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/kk/thunderbird-68.1.0.tar.bz2";
      locale = "kk";
      arch = "linux-x86_64";
-      sha512 = "9bfb99694bcf1227162607e2b674abb00343e4da3876999430d6014cbd4f4aa6c6e9ddca7c7f3b144d101c1a5a6d38772e3750f5feb41d1f304b89a8c1e6ec15";
+      sha512 = "339c8e86693a34c8a2da5e47924e545f0fa55d5314db73c6bb23df3eabed29dd6cf47662a8c4e43c381ede5098aba72887739993b4e71db75e41de3d1d777c3a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ko/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ko/thunderbird-68.1.0.tar.bz2";
      locale = "ko";
      arch = "linux-x86_64";
-      sha512 = "fd260740ccd74afae7af664775954acfd176b47176f48b5300f11bd77bc31205d0bbc2d06a701486e9742ffb38ad4aa2b253041b9d9518a4b9c7dbbe41aca264";
+      sha512 = "ba80df01778f8fa95dd32bf0af55afe7fa828a489c4682e6a8891636281031170b9fff77ae4f2e4bbaae9124946b0429e55bbed741973d80da868d94e29991e8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/lt/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/lt/thunderbird-68.1.0.tar.bz2";
      locale = "lt";
      arch = "linux-x86_64";
-      sha512 = "fb7a7b6d0c7d58d13b3ec20c8176ee793cac5c53bf849e3b3c4aaeff0f3e897cc35e61a9dfa4055c691fd56f280f7b31e04999922c29ecc89294ea6eeac16cd3";
+      sha512 = "32e93ec3203b70c2dced59a376bf7379879b5361f55a396d533e1f10727482b357344c9890864279eff9aa6d75feb1b36a67f2293c51d3a3222183f62c51e477";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ms/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ms/thunderbird-68.1.0.tar.bz2";
      locale = "ms";
      arch = "linux-x86_64";
-      sha512 = "7490a8169079569143c63f85e7da299d28ea423fb95265e2e86ec724ff0da641e24a2e9ea612d180d523973522f40c250bfd56e66ee39b28cb9acf57f6be6831";
+      sha512 = "29190352e1bbfe30b1e98d2a7fa20268488d82aefbdb4de1f8c2e197ed9f196be8256050f48d71ec6475b707d93d0570002fb175cd88fac89aca5e7140a7cbfe";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/nb-NO/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/nb-NO/thunderbird-68.1.0.tar.bz2";
      locale = "nb-NO";
      arch = "linux-x86_64";
-      sha512 = "7256820ea97851319e51616f6eb45617983e76e74b46ae62a02e22d13e2dd6abd590fd265aa6c88ac14b2f0276219580b6b9fbd956f1eaa38e6a93329b9c9621";
+      sha512 = "8e076d0967b0b79ac2cc9ade63e1bea4d27db1c050f792f1d1da01758a576fad884fdda32a02d58d45cf4c615f38c44bebc80c6e864ee076212f280398602892";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/nl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/nl/thunderbird-68.1.0.tar.bz2";
      locale = "nl";
      arch = "linux-x86_64";
-      sha512 = "00f32145c861abd8f151d7840d0f01eb9d4190df65e5a179f999f3149477f2de7f796782eb7ef912fcbec005d65c76974185d1c0105dea862cbc22c821bc906d";
+      sha512 = "7bee338542f949d86700d9b67d26c059232ba96cba991e491e6380f1ef914e7ee2747c9c73907e393bcc83c7f05ec6e656d869980c2c03ba0a548ae120793030";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/nn-NO/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/nn-NO/thunderbird-68.1.0.tar.bz2";
      locale = "nn-NO";
      arch = "linux-x86_64";
-      sha512 = "3ac255b5bb4b352833fd56d5aceaba6d0ada571630a993729970ae99d5067f05ba22e6ef50fa7dd099c0eb5874f11aeed32718c56a80538e28b401ee6b7900a2";
+      sha512 = "33b67ce4100a61461a238189e06b623a067e5f1b550fe5f20b5686f597408f3d7eaf45c92bbf5ffe58ff96c99fac9b9e282b024e40829d4d9d4422e54cb7293b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/pl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/pl/thunderbird-68.1.0.tar.bz2";
      locale = "pl";
      arch = "linux-x86_64";
-      sha512 = "19ab4bde9314dbed1bca7565698a7b1231767ef9cc792a49e7e9d679453ae8209e6f68c63ea0a24bd9e3a97328dceeedd109bfe28038108b52b9dad366f28787";
+      sha512 = "860c606fffb3ae85193b4c919783c94ea1a84c2579316cef98adc247d7d595b01dc6c2e84662641c7285dfc65097f710d7d2605efd960847739ab4acfc296836";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/pt-BR/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/pt-BR/thunderbird-68.1.0.tar.bz2";
      locale = "pt-BR";
      arch = "linux-x86_64";
-      sha512 = "68e28b657b885e7823dca0d091f2609556d560a50b5e6c285cdf467ae2b09743406baa2e544f17997519c219e0d4e8911115d30e7b0c35f09b956e28b311f8d8";
+      sha512 = "3093207072a79d9556c4e1ca2fa75d990a3952d583f0a4fe8c850a4911b1af19e3ac08a357d239d66b22c397f6722b8625fee03ca1f2b6a8f21dc61fca348541";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/pt-PT/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/pt-PT/thunderbird-68.1.0.tar.bz2";
      locale = "pt-PT";
      arch = "linux-x86_64";
-      sha512 = "41623568d2e78b821a89480836f8d8c739f6983b80ce26017d12fd9363016158fa6c629e030f63aba6e730e554b7717fd2ee58e0246aa82b46fe55d5d6be9933";
+      sha512 = "5d29ed9a8e8c768a3749801dc191b27aecf7994a4afa02e70de823ed1eabe4e936bd7686830359aa48321681396aff29ead762ab28c7bda6f8aec36117e8cadc";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/rm/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/rm/thunderbird-68.1.0.tar.bz2";
      locale = "rm";
      arch = "linux-x86_64";
-      sha512 = "a2cabac0ff5e3bb4a8dde4e884ba4647792e0935ef0a61b56470c67d3ba9c2310a07c2d2da51f7b4cb5fc3e841dd385a2c64ff29d263333a91e2044a4ad3190e";
+      sha512 = "cf342acfbb9ab92b7bf483ad3227730dc3923ee107ae42a0fb05c6070256e43a4d3c1647c1fa2c4dec7adbc8c018a185bd3d91e598d09eac43ec679d3c25063b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ro/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ro/thunderbird-68.1.0.tar.bz2";
      locale = "ro";
      arch = "linux-x86_64";
-      sha512 = "2e9da10d1f88352687175fa48fb70f8a73cf3ab1d84958a79c4a46526b3640e264d98611806bb234f579d616fe7d1dbb2d4c6ba55a389363034f85a97283bb64";
+      sha512 = "ae13fc229198a5c5327dd4d9d948f1a5eaf699877c48c1c961ca084e79075f479f4b270fed1c9ce22f420fecd4332a30594d4d2dc87bb114d1e3518e3a4a7071";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/ru/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/ru/thunderbird-68.1.0.tar.bz2";
      locale = "ru";
      arch = "linux-x86_64";
-      sha512 = "5f4bd3d3657479446ff070cfdb33e16a527c6f1615f37fb4c4e32c12b89c62d5649fa5c3d826723be47fa9795575bd33ccf37c2aebb555c218aba8f9d68ec3a9";
+      sha512 = "f51b1f99c16af5f24702f0bfd433c71c7ae899ded5f101aea2dcdc16f1cc9e1b7b18f26a4fd0ca9296c5e9007067e35bd9cc322bddfe07f58795147547fc0c56";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/si/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/si/thunderbird-68.1.0.tar.bz2";
      locale = "si";
      arch = "linux-x86_64";
-      sha512 = "b47d2aea81327089445c9f57a1508406c534907c7b574006886828846e6deaab04e35de2781d55d882f05c0a89f65fa7c386547d6581064af4fc3bf4e879e379";
+      sha512 = "26bc664b1623523d644ee231666a4489421ba31d1f0b52b5f4a4164343672333070c3781c577e370e7d97d42b61783077c74d1f38d37565776c752a2310c3a1c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/sk/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/sk/thunderbird-68.1.0.tar.bz2";
      locale = "sk";
      arch = "linux-x86_64";
-      sha512 = "4295204bb89789704da6830d33e92a77df165737c291c74a94fa532309c89505fb796151e0855b4e0bad8658fecaadc9978580ac72e2a2f24a4022909bb64aa2";
+      sha512 = "46470afe078d1ef2e48b3732fdc02ff3c9104a727b4d94cae1b9c54f6d2b4771e5784cfb3e6350ab8a205f8ba010a82a2b2fe92313eb351496a19a99df75179a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/sl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/sl/thunderbird-68.1.0.tar.bz2";
      locale = "sl";
      arch = "linux-x86_64";
-      sha512 = "598fe5bd04e04a73db04eb630e02dd7cc7af34d0381e6877626c8885bc4b879e1f35362afb8cfeb1bbafffc5b7ea14c8efe9b35b5e30056d04fa0126b8663679";
+      sha512 = "9bb5b0c979fede4dfdaf8f4965bfed1ad78d14168efb797fc216ac2527434047c3e6b65eb9dd1e607f55b22f6f28e49b0ff58c272c0708cf5ae1f9ce96b2c796";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/sq/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/sq/thunderbird-68.1.0.tar.bz2";
      locale = "sq";
      arch = "linux-x86_64";
-      sha512 = "0b657daedc98db51179cebf547d5f278d2d632bdb552878b4af29427ab8fad62f8d6c1ab2c3a38cbd8e67b670d6d613bdb1d4f535a0c69d0d1ca607d0b10bd43";
+      sha512 = "440870b75e47aa277c5453bd997709d2f9e59e0aa86e2fa7f5aa95ad39b139d8e9b7b8a7dd44765d8f8d5ec18c5ce6a284ab40d4aca01b251bcd9e2183be4976";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/sr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/sr/thunderbird-68.1.0.tar.bz2";
      locale = "sr";
      arch = "linux-x86_64";
-      sha512 = "10efa11b9c9ba56142c8a321a25a7e875f3d02fd17f73bd3061ffc71823aeb1269f9a864aae88a4fc434d1c4a01d227c0be605ffa7f4ef6421db98c0141c839e";
+      sha512 = "bced610dbc95e7cab982f40376fb7cce8e672f8533a66816f01667ba69d73dfcb00e95a80b42273c1ec7ada9cef8c14af1c426cda2f8425e3f77a3a0e393a611";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/sv-SE/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/sv-SE/thunderbird-68.1.0.tar.bz2";
      locale = "sv-SE";
      arch = "linux-x86_64";
-      sha512 = "c77d10b35edef7e59f4e6c48cd4352c4fb7d05b0140aba12be42b3e3a3df609ebc86f2f5a3993fa172ec0ac118726314bc9042335101241637481a2e1a4d1c00";
+      sha512 = "af139912f563710b05c274d1b89012e27a3997b582d379e3561011fed7c77994447c3054433e0fd4b5db8417d5b43b63e840d313cef1fc7a8aa7baf0655982e1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/tr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/tr/thunderbird-68.1.0.tar.bz2";
      locale = "tr";
      arch = "linux-x86_64";
-      sha512 = "3d52693efb05379802d62fb9e40c4b1856b45ee948032634d4c4bde7bbae67327f963e0f1096fd5d7a15d4341af1ecf3d9ee96eed45146859d8e8e5d403d660a";
+      sha512 = "50693e4638f8fea5a7f609924ef65c8d7ea4f4ffff79320651481e1a7f5cdf69edc2fd987137a0d655077959cbd8f32218d2f78fd55790084e2d46d3ecd70cf6";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/uk/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/uk/thunderbird-68.1.0.tar.bz2";
      locale = "uk";
      arch = "linux-x86_64";
-      sha512 = "c09734ab8e6428c6ed270887a0add934a7058d5e9c895864b1128e0fd39d57e13789bab38cafaf7cdbac1a71c8884407698c4bdfcf48aeec6604a457ed57c48d";
+      sha512 = "c24943567c110ce8cff6da066d0bd0081621d8c397e6569c57b63eef3098963a55215083aa655fa9c98adf9babfcedecfd72204c1a68604c851e1a5c1a1b0102";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/uz/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/uz/thunderbird-68.1.0.tar.bz2";
      locale = "uz";
      arch = "linux-x86_64";
-      sha512 = "083a83ae3c6083934fbe49f1e65ceadc5b5459f0f29ae0df9901b6d9b29d0a105cbde94357c1ee0a9677ec923fd1d419c618db0e843cdf320c087108990b89ec";
+      sha512 = "e02a86c848a013a84824246db3e29e889e1f5cc1b743a3a9b567b914a46100a808779fc13b897b04e8c698e14cf474fcea907e25e937e5c8b4ccb997f06d8e85";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/vi/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/vi/thunderbird-68.1.0.tar.bz2";
      locale = "vi";
      arch = "linux-x86_64";
-      sha512 = "6ba1573c9a170d1d827b6d17941c25e3852f7b66be2eaf7a3e9ab02278f19a38b801d7b9b0c266dc4f38f1190f9c83990eaa51f4734ddb38f43ea3e1bd23b72b";
+      sha512 = "de6d6794796f5b60cfffa9eee92906237fd692b21ffc3925c7866ea9660d26366f5fd3c847b2dfecc418b631c6241dad4e509e58e391c414a37587c6185c2655";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/zh-CN/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/zh-CN/thunderbird-68.1.0.tar.bz2";
      locale = "zh-CN";
      arch = "linux-x86_64";
-      sha512 = "74ee429901cb520d07361a4b621c9be06253cf93300f0f91e3633d3b375e4e9a6a58823d4bbfed60519734ca5705f2cd0da4bdc7db0f578ec300f1d705e9b7b1";
+      sha512 = "d5835538fe615544a07e93a2088b65eae6c3c36b75ca2b9f6605974d929a36dd226d848e2394611809538106f56c1703ebedb5c0776593e998935bd322a4e27d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-x86_64/zh-TW/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-x86_64/zh-TW/thunderbird-68.1.0.tar.bz2";
      locale = "zh-TW";
      arch = "linux-x86_64";
-      sha512 = "d720029e0720fa972d694712a85bdae94b1ff51213c4e56b84dff6d293a2a9831f5cd4efeb44070010eba1486b9358929f64546ce7ebb7cee29a7bcd4a1cd650";
+      sha512 = "9dfaa7dc83725fa795cf1b2e45e7af760dc6c38999b05a0968e46d4b5676a4b9f705ebb63ff400ec6600d83a6be26eb4c2638671a539b59b6ea37002ea9b97ac";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ar/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ar/thunderbird-68.1.0.tar.bz2";
      locale = "ar";
      arch = "linux-i686";
-      sha512 = "823b3cf50f8d23d1d0ba8583d2b10146e2eb0ff4a9401527557fae8e8db997ecc66d0bf5a091323bbd37dd6222bacb73fb9818de8740963b929a8893e4ec9391";
+      sha512 = "17733249e5c2c33899fde89a5b2dea2592fe0414419c235f4d853917990a05664d52a05f1f1a290ece4bdb3646008b0aa0af1e495e5b8af0c08f5b9962bed5aa";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ast/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ast/thunderbird-68.1.0.tar.bz2";
      locale = "ast";
      arch = "linux-i686";
-      sha512 = "f0087ab3189e8fd194d2ef6d5d2f9c3e14d592d5217a8fea19ba5189e806f9d484332f9d342a15549651a75bcfa673f21cd7666265fc185ec58c814814902ec4";
+      sha512 = "95b40d08b988146db7175232c9d9be92175cc3fdd73ba5e205e6543dbdb9e6e33579edeec73b6961a7ace574d3466c162d0665ffbd3705de15b7ea4cf6d7b77d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/be/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/be/thunderbird-68.1.0.tar.bz2";
      locale = "be";
      arch = "linux-i686";
-      sha512 = "edb358214e93142d73c92ab3dcf6240cd08614c2d0e9ea506492023be46d7b7f6273dc767ae034762c052db3b0a093dd027187afb272b2a55fc3126b06ffb78a";
+      sha512 = "d2f4ad38d81306c1637ae8612221bb462409373b3cfa70a08d0f2872aceccd8087835eccc014f4009680e9e36b6cfecc9bcb95328dcb8f6c9ef11c432e2d3c6f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/bg/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/bg/thunderbird-68.1.0.tar.bz2";
      locale = "bg";
      arch = "linux-i686";
-      sha512 = "f3268fced7a81b5046332f975906ac79b8ab5ac888dc1c81085dd7cd1b1a414988208d426bd305f67cbd913c58de857c844809ae6e6ab5a2a520d7d6b149b731";
+      sha512 = "f2c74a0609eff929202d13719fce167577b2ae0e1a0c98b75b359bfcddcb531907a466e184ece24d904bd592ab41654f2dcc2500defece0aede3be3826dcc8eb";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/br/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/br/thunderbird-68.1.0.tar.bz2";
      locale = "br";
      arch = "linux-i686";
-      sha512 = "c1be2ec4d4e64a2a9b32b974eecd182ad9d1fa23b775769e8535e742479ed6be2a222272d7c5b141393f0c752d4af704758912bbac1c17f445b3bf277c12eb9a";
+      sha512 = "1f1ff89743c398443a18230ec0eadeb51a8d57633bb7c242f7003e472b0ea206dde50a9d20880ddfbc9ee36a3ca28135662ed21d6e8cb779627120c70f0aedea";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ca/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ca/thunderbird-68.1.0.tar.bz2";
      locale = "ca";
      arch = "linux-i686";
-      sha512 = "ac0c2508b89812ba63d0bb770adc2292127243fe31bf140a4ab88c953750fc2f699c5ed2afb9a400cec48dc14d927b08dc96d5b110e2f2d90e81d1532ba9d916";
+      sha512 = "608232b5bc7a93cd786d84662e59e3b186bb1de51cbe0f720cf4e80e65a93e09a24f06abfba63785c0cdba997a6fa871497998f1953f57a98ea6b9e224235ffe";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/cak/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/cak/thunderbird-68.1.0.tar.bz2";
      locale = "cak";
      arch = "linux-i686";
-      sha512 = "4d73beb37469131b7e7747c85a73027e1eaf008100eee21e27d36b4736ffdb4cc3ca3606726e36033de64504f058ec9d4193797a09c2a591675636a5c00fc890";
+      sha512 = "5e77fc07093e5b2cbb345f21b48415a5c7d987ab0a82540f398ef33c7051f1917fb448fe23401ec3683c87379aeecb287be5ffcf6a124df9a464401f242d1e3c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/cs/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/cs/thunderbird-68.1.0.tar.bz2";
      locale = "cs";
      arch = "linux-i686";
-      sha512 = "635ec13ec9fd688ccb9c690ccb4d64228f1f47755ce24c4806f5f47655af1279b9ee758fe15c0fcbd43c830edf66383bfa3d84d35137209a4af41aa59565f554";
+      sha512 = "036304985db3ecccbe50a9b3d8c19dcc269f7c6987c1101c9443ea5fb2d14e71390ccdf6f0000c972af631863398a02cba1c05566c6be4ab3e79396c049e0e16";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/cy/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/cy/thunderbird-68.1.0.tar.bz2";
      locale = "cy";
      arch = "linux-i686";
-      sha512 = "afb546562f92c93639a407598d9c6654b64776cb68db7ddb07c0d17f83d122d9e7bb974238ee5cdb90876bca3ea30356cc5eef28b11ccf082ef72c0343dc42d0";
+      sha512 = "4de3a065234e921f9ae7250409ba24bc54230af61b4993c3686a77e1e165874995f7c60b45ab136c6b3f3047461e86c19207952b870019df06dd164054b65dc2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/da/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/da/thunderbird-68.1.0.tar.bz2";
      locale = "da";
      arch = "linux-i686";
-      sha512 = "f7b7d183312d11d02200890afe4e81c793b658729119d9f81ac2ca58714244ece9d64d1b9d9f34c79f1d00b574e24192ce066debf873c4b740c35208cfaec16e";
+      sha512 = "69e190f9263438c88b445821b56b93c052613fd67a1f1918b135c719e4358bea46d3a79bc135d50b254fa686d8cba013daf89d40ccc5212062cb177bdab4d667";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/de/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/de/thunderbird-68.1.0.tar.bz2";
      locale = "de";
      arch = "linux-i686";
-      sha512 = "e6b3ba227c8e84273e6dadcb59d6691187512666efcb63244740a56273c5b765c65d21607e4f07a508e5e63ed0812162ad767fcb1140b89b2c155da945586179";
+      sha512 = "ce4cf8c1e11f4813ce173bd08ceed9ef26b2117771ca87ef16c001e1a49f5385a6a3ecf4bf7561d48aa6c7e63d307c2fbde77ef8a51fa0aa9b66f4f98386bff3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/dsb/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/dsb/thunderbird-68.1.0.tar.bz2";
      locale = "dsb";
      arch = "linux-i686";
-      sha512 = "84d39965568de9c87c280beb43330aec4ba6cdebf59a9c4f566b6bc01fbe15cc3987e87d9c24a9e746283cc54ec1ebaaff99952de7ff0aa9b6f05f36b1295d09";
+      sha512 = "9007c92825220ff9685c599b1c6e39fe3e96888621ce5dd15f5ef9d812c09a29ef72a6eb2f68cd8eab78b5519b6c26cc957ed04f3c9798ea0305fa4f5c8bb962";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/el/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/el/thunderbird-68.1.0.tar.bz2";
      locale = "el";
      arch = "linux-i686";
-      sha512 = "0942b5c8c7ee792d264824c6837d5857679feae9073fd2451b92dc0f31290360a24f7cd708e550955e798d2decb9f0c3a21dc8ba7bb5f226ba8ba9f502ef870f";
+      sha512 = "e619576813260ec68a26226a83a540c58aea7e87d3b0ca35f6ae7bd9e0dcaaf54ab12f57cebf669060191e3affc42df1585a3ce4aa18f82f6afe469b85de495c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/en-GB/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/en-GB/thunderbird-68.1.0.tar.bz2";
      locale = "en-GB";
      arch = "linux-i686";
-      sha512 = "12fb5086fd012d85f35a41125b7e5ebf37ec34e9215db9b2a4c67f924d3bfa738698ba15bfa2e51f8cbe0d81cdfe5de4bfecd54b0fe6cc7163c753444e56bb9e";
+      sha512 = "0810f25326d8a08628aa55d5c15e6144f833454019087fa20f2c128bbaa4380f9f2a07714b0d8ac0f3fabb5b6065e7b2efe6e80975e5e47e81749da9f4e6be94";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/en-US/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/en-US/thunderbird-68.1.0.tar.bz2";
      locale = "en-US";
      arch = "linux-i686";
-      sha512 = "6004186b0b27165a4d54191a9c2daef34b580c2d97b1e0472e8d8d863e3df51ed56ef17abb7c6944f4da214772780b5c69785b9ad22ca26ba1a8f0390beedc19";
+      sha512 = "adc1dddf36116435b3948810cd9d647febfc97d62443032100b0f2d722913aa051d44244f057c29cb8c6cf494fc67b3044b83ebfd5eacbc36b6cd9c88361078e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/es-AR/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/es-AR/thunderbird-68.1.0.tar.bz2";
      locale = "es-AR";
      arch = "linux-i686";
-      sha512 = "6a547a1d0450de1089df18baae81100d3fb9934c963459ec83ae81504e7a1ec7abf595766c84fe8d321f901150a68b7e172888028f3b992b4b6b74ba98ca4efe";
+      sha512 = "a9433a5de45477f432c6906b640909880650443e5e3a65a839e9c055d887befedc8c22c76675700886dc128ad190fa0ecdbbf2c5f18e650219b33a78105eac63";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/es-ES/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/es-ES/thunderbird-68.1.0.tar.bz2";
      locale = "es-ES";
      arch = "linux-i686";
-      sha512 = "e1256da3c8938776b11444790f20a68f056f7407f444f0884dfa1c52260309d4adfc64fe95168dd8263e4aea650362ab9fa08930559c7f0e97b3489c172c81fd";
+      sha512 = "a128e46d7d2cce449a261f857a221232d2d89a7d999bc074ad5d1aec741f766516f3882cc2603d6284458208c2ed36dcb81e214039222c9c15450e96e73d0283";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/et/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/et/thunderbird-68.1.0.tar.bz2";
      locale = "et";
      arch = "linux-i686";
-      sha512 = "a5d7cd5e3171d44dbf91f067231301940e8a622a6729333512b49bc037022bc2058fa548c044a40b7ebea5d3199402276a34eeec5cb21b2070d7cfd96737def1";
+      sha512 = "521d004b432fd27ed6b167263253b3a3c89aa22ee5e06a4a434da6948a8c2af4fe27e17a1ef962e7caedf7d15ab27b98384545069abfaaf41871cd5878fdbf72";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/eu/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/eu/thunderbird-68.1.0.tar.bz2";
      locale = "eu";
      arch = "linux-i686";
-      sha512 = "08047c83e28397d265712dbd5a533799b2bba97d90f83b93be8377a544226ea0dff22f5b5e2cd5314c24608825048f3e59c6fc348959d63e1acb81d10d687f46";
+      sha512 = "df8afc11cddf0c06d05bee455833bc5d786789a709baeade7b64e8f815c42f399fca1442a8b64271fea7e45fed4408ee923293cec953e0406b093f0b94120861";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/fi/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/fi/thunderbird-68.1.0.tar.bz2";
      locale = "fi";
      arch = "linux-i686";
-      sha512 = "ae407ee0dde2be8a8f89979b5dcacebd13fcfa42fddce48773e8f26ffbb503acc6b17a90170a0d72d550400397c17a725f9bf6f65d842f0f281fc58eaf9dbc53";
+      sha512 = "51e05f21e01dfa0fc3c5d0463d80e87a38e50dff612a7632f9a5cd440f037a438a555e3640cdddd794ebe04eb2cc15c549db7ac829c91ac488b73b66808496a9";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/fr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/fr/thunderbird-68.1.0.tar.bz2";
      locale = "fr";
      arch = "linux-i686";
-      sha512 = "a776215a9ba91de0500cc7fda245afa19a49b51b60089c55444aa452c5aca06cf3b95e66448147cdbc3df063348c28bbde3f3c2a6e19deed26e1b33dec565b25";
+      sha512 = "9448860f48fd93383a24fead6af1102af855270749e817f720e2afac152949e47fcc9ce6fd0d2c60d3dd958c855af47a54a38e85975acf05496a7f67d2af72fa";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/fy-NL/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/fy-NL/thunderbird-68.1.0.tar.bz2";
      locale = "fy-NL";
      arch = "linux-i686";
-      sha512 = "5302a5709fc4485eff607fd0b5e75f15bb600a14d20661cc4f7280b0bf5c156a40a51045182ff0d31c89d4009c5a516015843ec9fef1fb1134cfa80c511c05ad";
+      sha512 = "e9a27da8b86e2ec3593056a19001dd656b8bde07edc918ec18f266de377c697eb0ea3a10fedb223e58db53ae5970d2b9753b46fa87db938e5568283ba136bd2b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ga-IE/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ga-IE/thunderbird-68.1.0.tar.bz2";
      locale = "ga-IE";
      arch = "linux-i686";
-      sha512 = "4b9cfa317f8ae5accb2c96731bd7fcbaf2eebaaee76bc7383d247cac9db6708b7c4c03d2faf3a6e7e6620b3eb696e9bb3fd18c3dfd1f3ce12e4bc65bb86955ed";
+      sha512 = "b346fe3863ab7944ac33a8204eea7a458a0131c879eae26be66928bed930aa29ba74a5b0e39aa939f0320fb8e5fb0a5e31599235daed526f920b92240763633f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/gd/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/gd/thunderbird-68.1.0.tar.bz2";
      locale = "gd";
      arch = "linux-i686";
-      sha512 = "8738b93fd18972456158c28d4146ec8548e97339d7b4ff044ace814213d27940b02f9b889b5809525d5bba46a5b3ff4a570c14b3b9a5fe276b4aec515b62055b";
+      sha512 = "e921a3c2720aad333febe7e1d69579eeda4f641fe32c1b6235fb6c01480ab7c87bcb47020b0dc2e4225746b277d8c6b288aaec86125ad48da9fbe3452f30e01a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/gl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/gl/thunderbird-68.1.0.tar.bz2";
      locale = "gl";
      arch = "linux-i686";
-      sha512 = "c556343f99d39f6ff41f0b05af606ada89e6b95938886f8d0b1ccd7b77f336ae40a8debb003d2bfc865548c5e9e055859d6d353e169a4f2ee7ada7cb8687cc47";
+      sha512 = "dd581aab660e96d7b0283bacab74d5635610301fbf40e95bc85edb5e177492f2a9c786a4fa722024fd57e2f2158fa339c161fba605ae428b5c03fa983b70d176";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/he/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/he/thunderbird-68.1.0.tar.bz2";
      locale = "he";
      arch = "linux-i686";
-      sha512 = "b6eed03bdebfc334c8852a15989c024883b99f600b9aa58f8344976b63f1f9590aa9b78a2a27b081a1e5256443801f01c1f638f1e4f8c0c2a78e695a5e2f590a";
+      sha512 = "2ab68acb57eadab585bedaef3f79369cd7a0c08030d24bc3361a0e08ff796f28f345cae15fbd78bd1fe2c275f8d4fb7058194ef44dcddd3e8f92b69f92482321";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/hr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/hr/thunderbird-68.1.0.tar.bz2";
      locale = "hr";
      arch = "linux-i686";
-      sha512 = "aa4527614db13978d03cf07444109dbc63b7788a2cff924b5566c98d9316031f1c0fb74839b5be78030959f85147c1c1e50edca5605b5cbe2ad3bbbb257c24ad";
+      sha512 = "975be725774e200f39b77cbb16ad364fb5d901ef46a85da9f297b61140e5be61cbf48de9f2ea0236d4580a27be97e87c195b92d9286133ac5aac2a35b1b7e5f7";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/hsb/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/hsb/thunderbird-68.1.0.tar.bz2";
      locale = "hsb";
      arch = "linux-i686";
-      sha512 = "92b1e17c825a60da17bc9942b689337246f301843637fe420284fe89aad4ab2f30101201330d5319a7e6a2bd87567bf7aa7b35bfbc13b1399ed54973afacf4ec";
+      sha512 = "5d501e9b7a39a518da0a82c1a89f398adaa449753b4dadc6ff8fa610bfc152016e6f70c1a944cc85e72fcaea5aba21a04d5abea2f2e045ca1c9212a37d31c461";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/hu/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/hu/thunderbird-68.1.0.tar.bz2";
      locale = "hu";
      arch = "linux-i686";
-      sha512 = "5e0c03de66a9098e290fb93545cb46be41d7e91c865cb3fcff9dee7d141fa113cf7bfc14cbbf1e8f9e3979e6602116081958c22a83ea043015cc5adfb738e5ea";
+      sha512 = "4cf2c82e4d965c3ff51e40823f876811834cf7602d9cca30011346c2bdb6e222b7d37f28db79b6507350cd833db312aaf30c13ae245c93a6b1118d9abb132571";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/hy-AM/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/hy-AM/thunderbird-68.1.0.tar.bz2";
      locale = "hy-AM";
      arch = "linux-i686";
-      sha512 = "3df1da5c3d18ee3705e5d5013a752920863fdcee8a1c021bfde28603862a7c56e60a65b46b98af5d66fc5066c1580ab5484d86dd278d64d5d800b3840361b812";
+      sha512 = "d13d91b889903bdbbae1e12b96f07bfc6f5a6cb734a45fb87402ac44df9fcca703e067b1d1554a41c9b7e2e31703021eeeedd3ecd8b27536b548a3b2d89a1f27";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/id/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/id/thunderbird-68.1.0.tar.bz2";
      locale = "id";
      arch = "linux-i686";
-      sha512 = "786a5839f311df656fd4a0687819a47589f5a6ebac6f76e1f643136286d43b2f27744dfcc116341a8905b5e1da4ec0ad1f1eb4998e188d2e87ea487c6826fb32";
+      sha512 = "7c199788cead727742dfebbcdf6ddfe4491be31a3f4dcc7ae05d25413101036cad7fae399f6b390002f55f60214ea66399d5bfdc515557351b309d174b83fa55";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/is/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/is/thunderbird-68.1.0.tar.bz2";
      locale = "is";
      arch = "linux-i686";
-      sha512 = "53e4f76d41e1f8af240ecec249bd3ef3c787c6ff69320694bc682a876a76be22ed59abf0bc83691c7ea96d1e16f5a4c859e2b62528c99261f562012dbd035a9f";
+      sha512 = "33ac7dae65efc4792f92fed4eb0062302ef601f6bceef4d1eaa6b4a7fd75427607e8ebd7f6df70073bcbcc89f057b0689e365cea960428b5e57f9f1e810d6e48";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/it/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/it/thunderbird-68.1.0.tar.bz2";
      locale = "it";
      arch = "linux-i686";
-      sha512 = "8ecb5594e5252be84f97a55b37f5089220a3e5c1565686fe02f00d94a1418a9460e4c1f25724243c82b3c9442eb8cfbff3c3c9470971921469f2fd71aec66860";
+      sha512 = "231acc8648e2e377a8ca6d22c273957506fd1c21f226ddd681fd3a91940cb151df4f0eb05885ec0325629bb0cfdd3ed500af6047970b43b898a37586e4612502";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ja/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ja/thunderbird-68.1.0.tar.bz2";
      locale = "ja";
      arch = "linux-i686";
-      sha512 = "7f9ed4fbdc0549c6ab704f80676218980a4b2609086437f57e22e9750e5a34d7506c1ee43ec48031a28322cdf4dcde6bd14c05fd032244acf33310fb6aa8e9a2";
+      sha512 = "90b8ca0d72fef8fbeae34027c95e3391452d72b53b40ecd59b1d2d2b07c6ef2e4d787bb2e927bf3d4b7837ea4cf2f10a0d3ccb0a6c98992e6fd857717c8ab04a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ka/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ka/thunderbird-68.1.0.tar.bz2";
      locale = "ka";
      arch = "linux-i686";
-      sha512 = "bab15aa28fc92850d374f76ae9898c9408176db9b9e19cbdb49f7b586172c20eed0cb358f3cd4b5fcc2a4740188c0f041cf617a63743a42648c7e33dd0fb79e8";
+      sha512 = "271415dafa136d326b89ea3a58b852e2526c86f45d63f383fa250ace14f71b1b915dac3810a04507d9ca4437c640065520f9f3d9d032cb7eb84aad1f7b3517ba";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/kab/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/kab/thunderbird-68.1.0.tar.bz2";
      locale = "kab";
      arch = "linux-i686";
-      sha512 = "26b1055333e508666dd24706da824c5cf9d5f87d1d1cb1c4d42894b836412205a7cc7ff73f764d8f2a1852138923bb02a6b2a2c3c92d1fe9307529533b6360e9";
+      sha512 = "c0b4fe65e9937bf897e7512ff6f267993c324c772232317e1314ce035a282f313b8385eee8c13e7b131eb0fabaa1b62345fbcd6289a5172d78aa3abf7f716bb2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/kk/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/kk/thunderbird-68.1.0.tar.bz2";
      locale = "kk";
      arch = "linux-i686";
-      sha512 = "d946c82a8c35d82147812ef16e4573ae559dbfe65f4a6e5fc7dd107fb57fc6ba2a47f8a3655344e9e6172628692ad7815045830ee27bb10aab0d71483936d6ac";
+      sha512 = "b8c7ddd098540ef8354eda1f2a3a06987d11cb7e0c4af4e170d507ec540e743a7d2527188c18e045df99576ed44990a800e7f7ce212042eb03b02339be9f86af";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ko/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ko/thunderbird-68.1.0.tar.bz2";
      locale = "ko";
      arch = "linux-i686";
-      sha512 = "3b9d9e70c097a1b7958c6854bc2da121f44921962d873e7f90fee85ce2214725223482aebcd503205e32501648c774199eced7ff34effb428dbc738f1ba4b963";
+      sha512 = "a33dbf6ef3aef69644261ea1c1cf3986fcda5c9d0b28996c46e3d8e53d3d7f8e9e6b62f1b03f2816267b483a84295ad99e888cf76c5c192e9a9dbadd78ce7d8b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/lt/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/lt/thunderbird-68.1.0.tar.bz2";
      locale = "lt";
      arch = "linux-i686";
-      sha512 = "0cf99a6aec58d2f56f6a52fc5fee17b9e1d5abd0ece53073cc392c71452e1415c94ad0af003dd0a97fc5c6744a1a2243aef69dc44b831be51108b769e5bff87d";
+      sha512 = "3bf1cd599707a2728fbf46beadb7d8d1832c0c271e98647ac7d2de1be78b8c1b5d0af4ac246af01eaf4b2a57154f6068065fbbb2019346b663cafeb40edd5b71";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ms/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ms/thunderbird-68.1.0.tar.bz2";
      locale = "ms";
      arch = "linux-i686";
-      sha512 = "8b4697a312aafdd88a5ecdf898a796bddb91e80b4c8c9c342fce765ee0f4dd494114324a51d6379468756a44bc71cb6f46b8fabc7ca733d9d85d08069f18526d";
+      sha512 = "563c413b21e2fda6f412a1826b1191097d4df1ade8d12e031522e122bedea6ae23a2d3b047e870030c9b4901a5869c9439107d8a7ebc6380c758bd741e0b4128";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/nb-NO/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/nb-NO/thunderbird-68.1.0.tar.bz2";
      locale = "nb-NO";
      arch = "linux-i686";
-      sha512 = "ad6275f8343dd36ed039524875b41ab9c8bafd2a1e54291b98c16b0ab35f9bea1bfee3fce86070317fad2f25d46d0aa9ef0824e4ad88e0879a33ae753c61ab2d";
+      sha512 = "c9062949faf5cbfe8bde2b0f330f76b438e1606360364a90f0e35026fd52952d6aff7c6925fd1ce569b24f41409d0b63540dbeb0ae82260604d5faaee723bc2e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/nl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/nl/thunderbird-68.1.0.tar.bz2";
      locale = "nl";
      arch = "linux-i686";
-      sha512 = "49f586a62969e6ea5638eb95f812e7d4a891ef55f381633792ed0820ad098cc527dc9490c3a1ce52246526f0a8cf00eb16666c6a7f932a68c6d440e151b452cd";
+      sha512 = "b8b385db8fd2385a88d12c1ba23bf812592beca14e44d9c33456ebad16a40db8e7d886779565a4d617fc56f7a6d651dc8da171b1c727481895d05777bc0eb3c1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/nn-NO/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/nn-NO/thunderbird-68.1.0.tar.bz2";
      locale = "nn-NO";
      arch = "linux-i686";
-      sha512 = "1f04f2bf7a60472eff1b546608cfb26e41f31a273d1037e0d73530029a757dfcd95e2c1b85a6990b6f7eec28138835fe096266a00dd094b4db74007cd59ef00d";
+      sha512 = "3c88ea8dffc71524402416d9222c859dafc5bd5799651a948bb318a7d2f91ca2c00fa4158e6019949f9a1d72a2d85a0c9d2a3c9a8caf052e8743fcb5dd0dccb6";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/pl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/pl/thunderbird-68.1.0.tar.bz2";
      locale = "pl";
      arch = "linux-i686";
-      sha512 = "f232e4b6cfcea81ed70e56e9812b8e0783205f49b846d29338ad09457db9a18e4fbb35738bf5e9abce42855c13c1839605aa343cb7d33d0110b68d634183e697";
+      sha512 = "c6ba1f98ebc44af63d8cd8052fd306d3a8920c33eb5b3be563c0fe203d5d07806bc5db7ff88847c3ee2d82c62d0811a086fa91e8253eec3a3977091569f40a20";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/pt-BR/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/pt-BR/thunderbird-68.1.0.tar.bz2";
      locale = "pt-BR";
      arch = "linux-i686";
-      sha512 = "2527ec08fc23d01712574e3c8419273ac82111c5f2b4b6040cd8f3292aeadb36021029b01bc319d8ca52177db39f1a446acd5537a6e8f42800eb22c3e2d7cb30";
+      sha512 = "cbd4c0f1b14cb04b98ef6f2e4ce53d655b58ae9a11047eeb1959ac1c4ef4370507194dd1149372fd1dad4ceedf91c39f3bde4fdf07b5d925f27dc8eb5041be67";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/pt-PT/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/pt-PT/thunderbird-68.1.0.tar.bz2";
      locale = "pt-PT";
      arch = "linux-i686";
-      sha512 = "c91d9d0becade1508a3212693f5fcdeb917fe5df5d63b54de125b76786dc3787a7f5f220eb48add1dd1eee95f7eb120b1c1dc85dc0bd91688c883be9219f3d7d";
+      sha512 = "ec08c628708a7bbcb00df2122e5fc463e1b0e1c031e9130369ddfee12db3cfe9219f7939756fc47abab8514c6cea642bb653ee420818ad625a33caada7005993";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/rm/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/rm/thunderbird-68.1.0.tar.bz2";
      locale = "rm";
      arch = "linux-i686";
-      sha512 = "45a4f608eb5e64f24ee385328a3a568aa2ad3284169019423c8b414790779cd079c2d73b290716f18227210ab5eff50625bd6688498bc027228b8fff51fda5b6";
+      sha512 = "4520dfb1529220e40cf2e1aca44cbc2af750fcceee3639d7ef334e9488034b18bc6e73b5b7a37204346da53a44da099f4f7f65d5b3dbdeac6d6934918c02cca3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ro/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ro/thunderbird-68.1.0.tar.bz2";
      locale = "ro";
      arch = "linux-i686";
-      sha512 = "e344d838e2f79dd8ff79cf2e7ff2a1d8f6c7e64f29cf870d8a6fad9b3dee31de6c0a80d3007dd498dffb816c00dc8429150bc6b49a5b6eb10b633a4e942ca725";
+      sha512 = "49e54dd1cca8038ab6c34e9980b6b36117aa157b6555ba440f0d7c8c4d909253989b9a50d25c7c18529136fa26d0ff94474d17e43156afba171948c9c05e16a6";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/ru/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/ru/thunderbird-68.1.0.tar.bz2";
      locale = "ru";
      arch = "linux-i686";
-      sha512 = "8dbfd4f8969703623388a55e790b722933f2c1faf702ff5c7fdfe3cdab8f62fc4ea69f9303edf94a41a71be1b8c5a2ddfa5509d4c8abe260c91b7075349afe64";
+      sha512 = "6d297592bcf0c9b97c40f1053a95385e6c2510aa0ddfafd25085bc6a954fb5460f59f18f65477d8c93af829cd2a053b389b5dcec35a7ac7766d72c29064e5687";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/si/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/si/thunderbird-68.1.0.tar.bz2";
      locale = "si";
      arch = "linux-i686";
-      sha512 = "f1808e9648caa00afab0609dac1cb564dbf6e5bef75446071997cc9913da8470e54cb254282fc6e8b839e88b003ef18426609a97cd1affb93659fcb519913a5c";
+      sha512 = "f602557748517324943b5ff276f4efdeca1c5083662bc9f0b0bdba8c10510cee834b3883870a98d51d406f58e338a09d0589b3bc0891bfbd88b895cca02fd360";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/sk/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/sk/thunderbird-68.1.0.tar.bz2";
      locale = "sk";
      arch = "linux-i686";
-      sha512 = "7d5b480a44dae0d2f5348261ecad04348ebb7943a757fe83c0fb154da251b423ba21840c5d1fbf8d7979dd30c2d5e7b18e90d0ad033a1e96d6f6587407a24cc9";
+      sha512 = "7b6980d2b5131bd9a43a29efa2f1e97c60e15410a63224d839548d777fd8b4c4d65ccfc7756227cf900f7420b12231c3d48f062133cb6f21bbdcdcdb179f2e47";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/sl/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/sl/thunderbird-68.1.0.tar.bz2";
      locale = "sl";
      arch = "linux-i686";
-      sha512 = "f76e1f01b8da8a2ba344dd3bedfa4301df03fabf9848fa189d522995cd48d81f8d00f11e01722868acb1993d4e79977122e04e3d208629b2e398c715777194e1";
+      sha512 = "ecc38fb4fde66b7b213b1cfeb8ab170b3e685d0a28c7e071e19a85509ec74e79fb6eb61104c47f0eef1a77e1e1a52b292469a364747eeccc701c522452c58351";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/sq/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/sq/thunderbird-68.1.0.tar.bz2";
      locale = "sq";
      arch = "linux-i686";
-      sha512 = "cff32ee84324724dea5612e5b48b22adc63d8b9428c5937f84c94da83bcf5f2aadda6ab81c5f9bced6d693689bc38bf15c764d4ab4809cacec3bb54cd82745f7";
+      sha512 = "3ff668c6ed28bdb2f3d388ab8ecb1bf3b2b38bb29046b8559f7b9f9c6fa32db226c4620f472ba5a982b473e3e3f4aee04aa3746e57738b512dcb37fdfd5ecfc5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/sr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/sr/thunderbird-68.1.0.tar.bz2";
      locale = "sr";
      arch = "linux-i686";
-      sha512 = "96d25f7d952e204751cd601932713418cd495d11364430a37ecfa36333113a6132209b8e8f0ec337799ed02b71b388f43e22a53fa168f17e4d15e7594170299a";
+      sha512 = "4c71511375333802f903cb632963933054a969c02a3fb23f4416e0cb3c21e18147bbffb28572f8ac90aa5bc3c4138b25590c42610c20a14b5e8eddb1edf28c28";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/sv-SE/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/sv-SE/thunderbird-68.1.0.tar.bz2";
      locale = "sv-SE";
      arch = "linux-i686";
-      sha512 = "8bc790d7951469e2dfa2499622464cf55427a6bc93dec50b18f014ac079ec0579b91a11680e4104f7d6a38f60d467e9fb3c9ee7ab83b64f8dae2c1e979150bd3";
+      sha512 = "5d7d569f4eb9ed738f54139a90e9a01e9e771a553af193357d45765bd54815a096ddc31ac69620d6f14516e8f41f1c0fb8f16a848e13273d0c18b9c047d85fb4";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/tr/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/tr/thunderbird-68.1.0.tar.bz2";
      locale = "tr";
      arch = "linux-i686";
-      sha512 = "2c40fa3e6ecfb68507897e669bed229ed98e1b4a3998b55b59523d3cec1fc5553cfacbd9be3d55f7a32b612ee662dfda7c8a21a4c26c750d48b87d31368a9942";
+      sha512 = "fc8892f85032d9fcce76c3fa971531f4039b8bb9e1812776bb3e7c5b68474543b5db4007f79e81abc1685c74f0574201236aab8a2df05ac10fcaade7c57ca3c2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/uk/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/uk/thunderbird-68.1.0.tar.bz2";
      locale = "uk";
      arch = "linux-i686";
-      sha512 = "5eee26a500c1d4bf71222987523cc3e5f144aca02c17c88a01d4b68f9ac5e1298407460c69504d0a7b1e5727755cb32e2ae523cd97766419848c1b6dc0a30bf0";
+      sha512 = "80335f326bde31f4b1e269cd756b4b41ff3a632023f09447abf6d1964381f8f9657a4f47ed6af63a3eb0cd4e84e5bced595eec07cc0a9e30ad8d3cf3d08026df";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/uz/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/uz/thunderbird-68.1.0.tar.bz2";
      locale = "uz";
      arch = "linux-i686";
-      sha512 = "51a0fc8dc30cc82f7d3b222167aaa8ea0225b4136ebacee38687cdc1235c0720da14cd2a3e1875a4c4bfa3bb8fd9045541ca6df736115312ac49a2db2ef83639";
+      sha512 = "2434a8a063b0d1019220579bc83160217d5c269b24ad83a9ed0969425a1fc9d9ed8b190c291d87c34379928aa6c2329d3b5ad287b44177dd61f680081cd7caf9";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/vi/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/vi/thunderbird-68.1.0.tar.bz2";
      locale = "vi";
      arch = "linux-i686";
-      sha512 = "bb02dd69a8c8d514666fedb9d7de520f6ea89740956ddcd9d7f90175bca6f7bcf79b573c6e5ecd6fdfcdd15aa2a35881e8877074fbb795019eccff52cb943a91";
+      sha512 = "0e33f1a2f8cd67bdb523180af0b8afa5fbbb3628b0b9407f2a4ae609c7155b33fd85a1f23d9b74097fefb045fd0b437f58971cc4c4d5f391398d6ea7429b921e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/zh-CN/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/zh-CN/thunderbird-68.1.0.tar.bz2";
      locale = "zh-CN";
      arch = "linux-i686";
-      sha512 = "408599229da40b2ce1a23ec1e5b12c7f4a24fb63524d792d50764cdfbcc6774dd7f651ba2dce46bccd94937e24b4b08d8bf37b6fb839c61540dfbf36f6d3e6b2";
+      sha512 = "27d1d9b3c30ab1dd863362139f91b79ffb7e36e87ff1f7f07162ea3e86a58962136e43cca3212e4263908f63dfe3a3c53bb3db3085e5b4bf07e0ff88408822d8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.0/linux-i686/zh-TW/thunderbird-68.0.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/68.1.0/linux-i686/zh-TW/thunderbird-68.1.0.tar.bz2";
      locale = "zh-TW";
      arch = "linux-i686";
-      sha512 = "d75c9bfc6234fa0ddc56b7c1dace76b789e29c0cb03ff17395eeba020a82431e457271e95117731963f2666295b94746d0370bf0e85f9c3646836830684bca45";
+      sha512 = "2141f0ad5d11daf3a94f3a737801ec0234a7f2d869320d4859d771ab92a6e59bf13139b4048a7239640635051a9228e6cbf55746402ed35cb398d93a3d129439";
    }
    ];
 }
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -25,11 +25,11 @@ let
  gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
 in stdenv.mkDerivation rec {
  pname = "thunderbird";
-  version = "68.0";
+  version = "68.1.0";

  src = fetchurl {
    url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "2cz583rwfpj4z5cwg2vfy4ha0pz4xs9g7li078rmk6x19haiv8s9fwijd82xgxax0afn8wk80bq5kd8yz38l9432f6bar8xnwb21y4i";
+    sha512 = "06036nawpm987q33567nhz55qybbcl55h5rdhjbhck5qmyj1qi383xqac5niwyk7c0gaq4ygwc5a24pysf85crjdway2zmqyjxp2apb";
  };

  # from firefox, but without sound libraries
--- a/pkgs/applications/networking/p2p/twister/default.nix
+++ b/pkgs/applications/networking/p2p/twister/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, autoconf, automake, libtool, pkgconfig, python2
+{ stdenv, fetchFromGitHub, fetchpatch, autoconf, automake, libtool, pkgconfig, python2
 , boost, db, openssl, geoip, libiconv, miniupnpc
 , srcOnly, fetchgit
 }:
@@ -17,12 +17,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "twister";
-  version = "0.9.34";
+  version = "2019-08-19";

-  src = fetchurl {
-    url = "https://github.com/miguelfreitas/twister-core/"
-        + "archive/v${version}.tar.gz";
-    sha256 = "1bi8libivd9y2bn9fc7vbc5q0jnal0pykpzgri6anqaww22y58jq";
+  src = fetchFromGitHub {
+    owner = "miguelfreitas";
+    repo = "twister-core";
+    rev = "31faf3f63e461ea0a9b23081567a4a552cf06873";
+    sha256 = "0xh1lgnl9nd86jr0mp7m8bkd7r5j4d6chd0y73h2xv4aq5sld0sp";
  };

  configureFlags = [
@@ -40,12 +41,6 @@ in stdenv.mkDerivation rec {
    boostPython db openssl geoip miniupnpc libiconv
  ];

-  patches = stdenv.lib.singleton (fetchpatch {
-    url = "https://github.com/miguelfreitas/twister-core/commit/"
-        + "dd4f5a176958ea6ed855dc3fcef79680c1c0c92c.patch";
-    sha256 = "06fgmqnjyl83civ3ixiq673k8zjgm8n2w4w46nsh810nprqim8s6";
-  });
-
  postPatch = ''
    sed -i -e '/-htmldir/s|(default: [^)]*)|(default: ${twisterHTML})|' \
      src/init.cpp
--- a/pkgs/applications/networking/remote/citrix-receiver/default.nix
+++ b/pkgs/applications/networking/remote/citrix-receiver/default.nix
@@ -1,215 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, requireFile
-, makeWrapper
-, libredirect
-, busybox
-, file
-, makeDesktopItem
-, tzdata
-, cacert
-, glib
-, gtk2
-, atk
-, gdk-pixbuf
-, cairo
-, pango
-, gnome3
-, xorg
-, libpng12
-, freetype
-, fontconfig
-, gtk_engines
-, alsaLib
-, libidn
-, zlib
-, version ? "13.10.0"
-}:
-
-let
-  # In 56e1bdc7f9c (libidn: 1.34 -> 1.35), libidn.so.11 became libidn.so.12.
-  # Citrix looks for the former so we build version 1.34 to please the binary
-  libidn_134 = libidn.overrideDerivation (_: rec {
-    name = "libidn-1.34";
-    src = fetchurl {
-      url = "mirror://gnu/libidn/${name}.tar.gz";
-      sha256 = "0g3fzypp0xjcgr90c5cyj57apx1cmy0c6y9lvw2qdcigbyby469p";
-    };
-  });
-
-  versionInfo = let
-    supportedVersions = {
-      "13.10.0" = {
-        major     = "13";
-        minor     = "10";
-        patch     = "0";
-        x64hash   = "7025688C7891374CDA11C92FC0BA2FA8151AEB4C4D31589AD18747FAE943F6EA";
-        x86hash   = "2DCA3C8EDED11C5D824D579BC3A6B7D531EAEDDCBFB16E91B5702C72CAE9DEE4";
-        x64suffix = "20";
-        x86suffix = "20";
-        homepage  = https://www.citrix.com/downloads/citrix-receiver/linux/receiver-for-linux-latest.html;
-      };
-    };
-
-    # break an evaluation for old Citrix versions rather than exiting with
-    # an "attribute name not found" error to avoid confusion.
-    deprecatedVersions = let
-      versions = [ "13.8.0" "13.9.0" "13.9.1" ];
-    in
-      lib.listToAttrs
-        (lib.forEach versions
-          (v: lib.nameValuePair v (throw "Unsupported citrix_receiver version: ${v}")));
-  in
-    deprecatedVersions // supportedVersions;
-
-  citrixReceiverForVersion = { major, minor, patch, x86hash, x64hash, x86suffix, x64suffix, homepage }:
-    stdenv.mkDerivation rec {
-      pname = "citrix-receiver";
-      version  = "${major}.${minor}.${patch}";
-      inherit homepage;
-
-      prefixWithBitness = if stdenv.is64bit then "linuxx64" else "linuxx86";
-
-      src = requireFile rec {
-        name    = if stdenv.is64bit then "${prefixWithBitness}-${version}.${x64suffix}.tar.gz" else "${prefixWithBitness}-${version}.${x86suffix}.tar.gz";
-        sha256  = if stdenv.is64bit then x64hash else x86hash;
-        message = ''
-          In order to use Citrix Receiver, you need to comply with the Citrix EULA and download
-          the ${if stdenv.is64bit then "64-bit" else "32-bit"} binaries, .tar.gz from:
-
-          ${homepage}
-
-          (if you do not find version ${version} there, try at
-          https://www.citrix.com/downloads/citrix-receiver/legacy-receiver-for-linux/
-          or at https://www.citrix.com/downloads/citrix-receiver/ under "Earlier Versions of Receiver for Linux")
-
-          Once you have downloaded the file, please use the following command and re-run the
-          installation:
-
-          nix-prefetch-url file://\$PWD/${name}
-        '';
-      };
-
-      dontBuild = true;
-
-      sourceRoot = ".";
-
-      buildInputs = [
-        makeWrapper
-        busybox
-        file
-        gtk2
-        gdk-pixbuf
-      ];
-
-      libPath = stdenv.lib.makeLibraryPath [
-        glib
-        gtk2
-        atk
-        gdk-pixbuf
-        cairo
-        pango
-        gnome3.dconf
-        xorg.libX11
-        xorg.libXext
-        xorg.libXrender
-        xorg.libXinerama
-        xorg.libXfixes
-        libpng12
-        libidn_134
-        zlib
-        gtk_engines
-        freetype
-        fontconfig
-        alsaLib
-        stdenv.cc.cc # Fixes: Can not load [..]/opt/citrix-icaclient/lib/ctxh264_fb.so:(null)
-      ];
-
-      desktopItem = makeDesktopItem {
-        name        = "wfica";
-        desktopName = "Citrix Receiver";
-        genericName = "Citrix Receiver";
-        exec        = "wfica";
-        icon        = "wfica";
-        comment     = "Connect to remote Citrix server";
-        categories  = "GTK;GNOME;X-GNOME-NetworkSettings;Network;";
-        mimeType    = "application/x-ica";
-      };
-
-      installPhase = ''
-        runHook preInstall
-
-        export ICAInstDir="$out/opt/citrix-icaclient"
-
-        sed -i \
-          -e 's,^main_install_menu$,install_ICA_client,g' \
-          -e 's,^integrate_ICA_client(),alias integrate_ICA_client=true\nintegrate_ICA_client_old(),g' \
-          -e 's,^ANSWER=""$,ANSWER="$INSTALLER_YES",' \
-          -e 's,/bin/true,true,g' \
-          ./${prefixWithBitness}/hinst
-
-        # Run the installer...
-        bash ./${prefixWithBitness}/hinst CDROM "`pwd`"
-
-        echo "Deleting broken links..."
-        for link in `find $ICAInstDir -type l `
-        do
-          [ -f "$link" ] || rm -v "$link"
-        done
-
-        echo "Expanding certificates..."
-        # As explained in https://wiki.archlinux.org/index.php/Citrix#Security_Certificates
-        pushd "$ICAInstDir/keystore/cacerts"
-        awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "cert." c ".pem"}' < ${cacert}/etc/ssl/certs/ca-bundle.crt
-        popd
-
-        echo "Patching executables..."
-        find $ICAInstDir -type f -exec file {} \; |
-          grep 'ELF.*executable' |
-          cut -f 1 -d : |
-          grep -vi '\(.dll\|.so\)$' | # added as a workaround to https://github.com/NixOS/nixpkgs/issues/41729
-          while read f
-          do
-            echo "Patching ELF intrepreter and rpath for $f"
-            chmod u+w "$f"
-            patchelf \
-              --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-              --set-rpath "$ICAInstDir:$libPath" "$f"
-          done
-
-        echo "Wrapping wfica..."
-        mkdir "$out/bin"
-
-        makeWrapper "$ICAInstDir/wfica" "$out/bin/wfica" \
-          --add-flags "-icaroot $ICAInstDir" \
-          --set ICAROOT "$ICAInstDir" \
-          --set GTK_PATH "${gtk2.out}/lib/gtk-2.0:${gnome3.gnome-themes-extra}/lib/gtk-2.0" \
-          --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-          --set LD_PRELOAD "${libredirect}/lib/libredirect.so" \
-          --set LD_LIBRARY_PATH "$libPath" \
-          --set NIX_REDIRECTS "/usr/share/zoneinfo=${tzdata}/share/zoneinfo:/etc/zoneinfo=${tzdata}/share/zoneinfo:/etc/timezone=$ICAInstDir/timezone"
-
-        echo "We arbitrarily set the timezone to UTC. No known consequences at this point."
-        echo UTC > "$ICAInstDir/timezone"
-
-        echo "Installing desktop item..."
-        mkdir -p $out/share/applications
-        cp ${desktopItem}/share/applications/* $out/share/applications
-
-        # We introduce a dependency on the source file so that it need not be redownloaded everytime
-        echo $src >> "$out/share/nix_dependencies.pin"
-
-        runHook postInstall
-      '';
-
-      meta = with stdenv.lib; {
-        license     = stdenv.lib.licenses.unfree;
-        inherit homepage;
-        description = "Citrix Receiver";
-        maintainers = with maintainers; [ obadz a1russell ma27 ];
-        platforms   = platforms.linux;
-      };
-    };
-
-in citrixReceiverForVersion (lib.getAttr version versionInfo)
--- a/pkgs/applications/networking/remote/citrix-receiver/wrapper.nix
+++ b/pkgs/applications/networking/remote/citrix-receiver/wrapper.nix
@@ -1,19 +0,0 @@
-{ citrix_receiver, extraCerts ? [], symlinkJoin }:
-
-let
-
-  mkCertCopy = certPath:
-    "cp ${certPath} $out/opt/citrix-icaclient/keystore/cacerts/";
-
-in
-
-if builtins.length extraCerts == 0 then citrix_receiver else symlinkJoin {
-  name = "citrix-with-extra-certs-${citrix_receiver.version}";
-  paths = [ citrix_receiver ];
-
-  postBuild = ''
-    ${builtins.concatStringsSep "\n" (map mkCertCopy extraCerts)}
-
-    sed -i -E "s,-icaroot (.+citrix-icaclient),-icaroot $out/opt/citrix-icaclient," $out/bin/wfica
-  '';
-}
--- a/pkgs/applications/office/paperless/default.nix
+++ b/pkgs/applications/office/paperless/default.nix
@@ -57,6 +57,12 @@ let
      cp -r --no-preserve=mode $src/src/* $src/LICENSE $srcDir
    '';

+    postPatch = ''
+      # django-cors-headers 3.x requires a scheme for allowed hosts
+      substituteInPlace $out/share/paperless/paperless/settings.py \
+        --replace "localhost:8080" "http://localhost:8080"
+    '';
+
    buildPhase = let
      # Paperless has explicit runtime checks that expect these binaries to be in PATH
      extraBin = lib.makeBinPath [ imagemagick7 ghostscript optipng tesseract unpaper ];
--- a/pkgs/applications/office/paperless/python-modules/django-crispy-forms.nix
+++ b/pkgs/applications/office/paperless/python-modules/django-crispy-forms.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub
-, pytest, pytest-django, django }:
+, pytest_4, pytest-django, django }:

 buildPythonPackage {
  pname = "django-crispy-forms";
@@ -19,7 +19,7 @@ buildPythonPackage {
    export sourceRoot=source-
  '';

-  checkInputs = [ pytest pytest-django django ];
+  checkInputs = [ pytest_4 pytest-django django ];

  checkPhase = ''
    PYTHONPATH="$(pwd):$PYTHONPATH" \
--- a/pkgs/applications/office/scribus/unstable.nix
+++ b/pkgs/applications/office/scribus/unstable.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, mkDerivation, pkgconfig, cmake, qtbase, cairo, pixman,
 boost, cups, fontconfig, freetype, hunspell, libjpeg, libtiff, libxml2, lcms2,
-podofo, poppler, poppler_data, python2, harfbuzz, qtimageformats, qttools }:
+podofo, poppler, poppler_data, python2, harfbuzz, qtimageformats, qttools, harfbuzzFull }:

 let
  pythonEnv = python2.withPackages(ps: [ps.tkinter ps.pillow]);
@@ -20,7 +20,7 @@ mkDerivation rec {
  buildInputs = [
    qtbase cairo pixman boost cups fontconfig
    freetype hunspell libjpeg libtiff libxml2 lcms2 podofo poppler
-    poppler_data pythonEnv harfbuzz qtimageformats qttools
+    poppler_data pythonEnv harfbuzz qtimageformats qttools harfbuzzFull
  ];

  meta = {
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@@ -1,9 +1,8 @@
-{ stdenv, fetchFromGitHub, fetchpatch, cmake, makeWrapper, itk, vtk }:
+{ stdenv, fetchFromGitHub, fetchpatch, cmake, makeWrapper, itk4, vtk }:

 stdenv.mkDerivation rec {
-  _name    = "ANTs";
-  _version = "2.2.0";
-  name  = "${_name}-${_version}";
+  pname    = "ANTs";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner  = "ANTsX";
@@ -21,7 +20,7 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = [ itk vtk ];
+  buildInputs = [ itk4 vtk ];

  cmakeFlags = [ "-DANTS_SUPERBUILD=FALSE" "-DUSE_VTK=TRUE" ];

@@ -34,7 +33,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    homepage = https://github.com/ANTxS/ANTs;
+    homepage = https://github.com/ANTsX/ANTs;
    description = "Advanced normalization toolkit for medical image registration and other processing";
    maintainers = with maintainers; [ bcdarwin ];
    platforms = platforms.unix;
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -17,7 +17,7 @@

 buildGoPackage rec {
  project = "cri-o";
-  version = "1.15.1";
+  version = "1.15.2";
  name = "${project}-${version}${flavor}";

  goPackagePath = "github.com/${project}/${project}";
@@ -26,7 +26,7 @@ buildGoPackage rec {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    sha256 = "0yjj03qwwb6g05pzavimgj14p6805m3w8qqpl4fp4fpmbrsx4sb0";
+    sha256 = "0fiizxwxdq87h943421ivgw49jndk23yjz3saf1rzmn7g3xh2pn4";
  };

  outputs = [ "bin" "out" ];
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -35,6 +35,11 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ patchelf makeWrapper ];
  buildInputs = [ cdrkit ] ++ kernel.moduleBuildDependencies;

+  postPatch = ''
+    substituteInPlace src/vboxguest-${version}/vboxvideo/vbox_ttm.c \
+      --replace "<ttm/" "<drm/ttm/"
+  '';
+
  unpackPhase = ''
    ${if stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux" then ''
        isoinfo -J -i $src -x /VBoxLinuxAdditions.run > ./VBoxLinuxAdditions.run
--- a/pkgs/applications/virtualization/xen/4.10.nix
+++ b/pkgs/applications/virtualization/xen/4.10.nix
@@ -38,11 +38,11 @@ let
 in

 callPackage (import ./generic.nix (rec {
-  version = "4.10.0";
+  version = "4.10.4";

  src = fetchurl {
    url = "https://downloads.xenproject.org/release/xen/${version}/xen-${version}.tar.gz";
-    sha256 = "0i38ap5b5m1kix6xb0vn9ya1yab35adyc98bzfnbq4lb7w1afqh2";
+    sha256 = "0ipkr7b3v3y183n6nfmz7q3gnzxa20011df4jpvxi6pmr8cpnkwh";
  };

  # Sources needed to build tools and firmwares.
@@ -52,12 +52,9 @@ callPackage (import ./generic.nix (rec {
        url = https://xenbits.xen.org/git-http/qemu-xen.git;
        # rev = "refs/tags/qemu-xen-${version}";
        # use revision hash - reproducible but must be updated with each new version
-        rev = "b79708a8ed1b3d18bee67baeaf33b3fa529493e2";
-        sha256 = "1yxxad6nvlfmrbgyc8ix19qmrsn1rx4zpyiqnfi4x4kg94acwa5w";
+        rev = "qemu-xen-${version}";
+        sha256 = "0laxvhdjz1njxjvq3jzw2yqvdr9gdn188kqjf2gcrfzgih7xv2ym";
      };
-      patches = [
-        qemuMemfdBuildFix
-      ];
      buildInputs = qemuDeps;
      postPatch = ''
        # needed in build but /usr/bin/env is not available in sandbox
@@ -151,17 +148,16 @@ callPackage (import ./generic.nix (rec {
    ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
    ++ optional (withInternalOVMF) "--enable-ovmf";

-  patches = with xsa; flatten [
-    XSA_252
-    XSA_253
-    XSA_255_1
-    XSA_255_2
-    XSA_256
+  NIX_CFLAGS_COMPILE = [
+    # Fix build on Glibc 2.24.
+    "-Wno-error=deprecated-declarations"
+    # Fix build with GCC 8
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=format-truncation"
+    "-Wno-error=array-bounds"
  ];

-  # Fix build on Glibc 2.24.
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
  postPatch = ''
    # Avoid a glibc >= 2.25 deprecation warnings that get fatal via -Werror.
    sed 1i'#include <sys/sysmacros.h>' \
--- a/pkgs/applications/virtualization/xen/4.8.nix
+++ b/pkgs/applications/virtualization/xen/4.8.nix
@@ -167,8 +167,15 @@ callPackage (import ./generic.nix (rec {
    xenpmdpatch
  ];

-  # Fix build on Glibc 2.24.
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
+  NIX_CFLAGS_COMPILE = [
+    # Fix build on Glibc 2.24
+    "-Wno-error=deprecated-declarations"
+    # Fix build with GCC8
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=stringop-truncation"
+    "-Wno-error=format-truncation"
+    "-Wno-error=array-bounds"
+  ];

  postPatch = ''
    # Avoid a glibc >= 2.25 deprecation warnings that get fatal via -Werror.
--- a/pkgs/applications/virtualization/xen/xsa-patches.nix
+++ b/pkgs/applications/virtualization/xen/xsa-patches.nix
@@ -66,30 +66,12 @@ in {
    sha256 = "0nnznkrvfbbc8z64dr9wvbdijd4qbpc0wz2j5vpmx6b32sm7932f";
  });

-  # 4.8
-  XSA_202 = (xsaPatch {
-    name = "202";
-    sha256 = "0j1d5akcjgx8w2c6w6p9znv77fkmps0880m2xgpbgs1ra9grshm1";
-  });
-
-  # 4.8
-  XSA_203 = (xsaPatch {
-    name = "203";
-    sha256 = "1s1q7xskvpg87ivwfaiqr0cj3ajdkhkhpmpikfkvq127h8hhmd8j";
-  });
-
  # 4.5
  XSA_204_45 = (xsaPatch {
    name = "204-4.5";
    sha256 = "083z9pbdz3f532fnzg7n2d5wzv6rmqc0f4mvc3mnmkd0rzqw8vcp";
  });

-  # 4.8
-  XSA_204 = (xsaPatch {
-    name = "204-4.8";
-    sha256 = "0rs498s4w2alz3h6jhlr2y0ni630vhggmxbrd1p1p3gcv8p6zzrr";
-  });
-
  # 4.5
  XSA_206_45 = [
    (xsaPatch {
@@ -190,86 +172,12 @@ in {
    })
  ];

-  # 4.8
-  XSA_206 = [
-    (xsaPatch {
-      name = "206-4.8/0001-xenstored-apply-a-write-transaction-rate-limit";
-      sha256 = "1c81d93i3qx7l38f9af0sd84w5x51zvn262mzl25ilcklql4kzl6";
-    })
-    (xsaPatch {
-      name = "206-4.8/0002-xenstored-Log-when-the-write-transaction-rate-limit-";
-      sha256 = "0b8iw409wi1x6p0swpnr51lcdlla1lgxjv5f910sj4wl96bca84q";
-    })
-    (xsaPatch {
-      name = "206-4.8/0003-oxenstored-comments-explaining-some-variables";
-      sha256 = "1d3n0y9syya4kaavrvqn01d3wsn85gmw7qrbylkclznqgkwdsr2p";
-    })
-    (xsaPatch {
-      name = "206-4.8/0004-oxenstored-handling-of-domain-conflict-credit";
-      sha256 = "020rw7hgc0dmhr4admz91kd99b4z1bdpji47nsy1255bjgvwc01k";
-    })
-    (xsaPatch {
-      name = "206-4.8/0005-oxenstored-ignore-domains-with-no-conflict-credit";
-      sha256 = "1ilhcgyn803bxvfbqv0ihfrh9jfpp0lidkv7i4613f9v9vjm8q0h";
-    })
-    (xsaPatch {
-      name = "206-4.8/0006-oxenstored-add-transaction-info-relevant-to-history-";
-      sha256 = "1dbd9pzda6hn9wj9pck44dlgz9nxvch3bzgrpaivanww8llxdfzz";
-    })
-    (xsaPatch {
-      name = "206-4.8/0007-oxenstored-support-commit-history-tracking";
-      sha256 = "1jfr56c22fqkhj6fnv1ha7zsid86zm9l0nihpb8m932xgc4a6h9h";
-    })
-    (xsaPatch {
-      name = "206-4.8/0008-oxenstored-only-record-operations-with-side-effects-";
-      sha256 = "1y845hj8krjdrirbd2jx4jqgnylwjv7bxnk7474lkld5kdnlbjyf";
-    })
-    (xsaPatch {
-      name = "206-4.8/0009-oxenstored-discard-old-commit-history-on-txn-end";
-      sha256 = "1lcr9gz2b77x74sr1flfymyyz4xzs04iv88rc1633ibyqxmvk0lx";
-    })
-    (xsaPatch {
-      name = "206-4.8/0010-oxenstored-track-commit-history";
-      sha256 = "1qwnivak4y038mpby75aaz0y70r0l3yc3hsz6wl5x0b74q6yy0ja";
-    })
-    (xsaPatch {
-      name = "206-4.8/0011-oxenstored-blame-the-connection-that-caused-a-transa";
-      sha256 = "0p2w5ddyhc6d95dnlxzc5k77j063p02d53ab7m7ijfm7m6gknq8y";
-    })
-    (xsaPatch {
-      name = "206-4.8/0012-oxenstored-allow-self-conflicts";
-      sha256 = "1571l81m30cbmqm4pk33q33p3dy58sfy2lnkl2wbgl2b3mkk657l";
-    })
-    (xsaPatch {
-      name = "206-4.8/0013-oxenstored-do-not-commit-read-only-transactions";
-      sha256 = "15985wl635w22dddjyx5l97b5p6m55mzv5ygk7xr0jx7mi192f9x";
-    })
-    (xsaPatch {
-      name = "206-4.8/0014-oxenstored-don-t-wake-to-issue-no-conflict-credit";
-      sha256 = "08672w4gaf2n3r8xy09h874gh5lg2vnrkjzq6xzvzdhdl092mipw";
-    })
-    (xsaPatch {
-      name = "206-4.8/0015-oxenstored-transaction-conflicts-improve-logging";
-      sha256 = "0ck98ms0py8wjsc38pbx6222x7n6l90zckfa7m7nnszsyc0sxxad";
-    })
-    (xsaPatch {
-      name = "206-4.8/0016-oxenstored-trim-history-in-the-frequent_ops-function";
-      sha256 = "014zs6i4gzrimn814k5i7gz66vbb0adkzr2qyai7i4fxc9h9r7w8";
-    })
-  ];
-
  # 4.5 - 4.8
  XSA_207 = (xsaPatch {
    name = "207";
    sha256 = "0wdlhijmw9mdj6a82pyw1rwwiz605dwzjc392zr3fpb2jklrvibc";
  });

-  # 4.8
-  XSA_210 = (xsaPatch {
-    name = "210";
-    sha256 = "02mykxqxnsrd0sr4ij022j8y7618wzi2a6j6j761vx8qgmh11xai";
-  });
-
  # 4.5 - 4.8
  XSA_212 = (xsaPatch {
    name = "212";
@@ -282,12 +190,6 @@ in {
    sha256 = "1vnqf89ydacr5bq3d6z2r33xb2sn5vsd934rncyc28ybc9rvj6wm";
  });

-  # 4.8
-  XSA_213 = (xsaPatch {
-    name = "213-4.8";
-    sha256 = "0ia3zr6r3bqy2h48fdy7p0iz423lniy3i0qkdvzgv5a8m80darr2";
-  });
-
  # 4.5 - 4.8
  XSA_214 = (xsaPatch {
    name = "214";
@@ -306,12 +208,6 @@ in {
    sha256 = "067pgsfrb9py2dhm1pk9g8f6fs40vyfrcxhj8c12vzamb6svzmn4";
  });

-  # 4.6 - 4.8
-  XSA_217 = (xsaPatch {
-    name = "217";
-    sha256 = "1khs5ilif14dzcm7lmikjzkwsrfzlmir1rgrgzkc411gf18ylzmj";
-  });
-
  # 4.5
  XSA_218_45 = [
    (xsaPatch {
@@ -332,46 +228,18 @@ in {
    })
  ];

-  # 4.8
-  XSA_218 = [
-    (xsaPatch {
-      name = "218-4.8/0001-gnttab-fix-unmap-pin-accounting-race";
-      sha256 = "0r363frai239r2wmwxi48kcr50gbk5l64nja0h9lppi3z2y3dkdd";
-    })
-    (xsaPatch {
-      name = "218-4.8/0002-gnttab-Avoid-potential-double-put-of-maptrack-entry";
-      sha256 = "07wm06i7frv7bsaykakx3g9h0hfqv96zcadvwf6wv194dggq1plc";
-    })
-    (xsaPatch {
-      name = "218-4.8/0003-gnttab-correct-maptrack-table-accesses";
-      sha256 = "0ad0irc3p4dmla8sp3frxbh2qciji1dipkslh0xqvy2hyf9p80y9";
-    })
-  ];
-
  # 4.5
  XSA_219_45 = (xsaPatch {
    name = "219-4.5";
    sha256 = "003msr5vhsc66scmdpgn0lp3p01g4zfw5vj86y5lw9ajkbaywdsm";
  });

-  # 4.8
-  XSA_219 = (xsaPatch {
-    name = "219-4.8";
-    sha256 = "16q7kiamy86x8qdvls74wmq5j72kgzgdilryig4q1b21mp0ij1jq";
-  });
-
  # 4.5
  XSA_220_45 = (xsaPatch {
    name = "220-4.5";
    sha256 = "1dj9nn6lzxlipjb3nb7b9m4337fl6yn2bd7ap1lqrjn8h9zkk1pp";
  });

-  # 4.8
-  XSA_220 = (xsaPatch {
-    name = "220-4.8";
-    sha256 = "0214qyqx7qap5y1pdi9fm0vz4y2fbyg71gaq36fisknj35dv2mh5";
-  });
-
  # 4.5 - 4.8
  XSA_221 = (xsaPatch {
    name = "221";
@@ -390,18 +258,6 @@ in {
    })
  ];

-  # 4.8
-  XSA_222 = [
-    (xsaPatch {
-      name = "222-1";
-      sha256 = "0x02x4kqwfw255638fh2zcxwig1dy6kadlmqim1jgnjgmrvvqas2";
-    })
-    (xsaPatch {
-      name = "222-2-4.8";
-      sha256 = "1xhyp6q3c5l8djh965g1i8201m2wvhms8k886h4sn30hks38giin";
-    })
-  ];
-
  # 4.5 - 4.8
  XSA_223 = (xsaPatch {
    name = "223";
@@ -428,32 +284,6 @@ in {
    })
  ];

-  # 4.8
-  XSA_224 = [
-    (xsaPatch {
-      name = "224-4.8/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap";
-      sha256 = "1k326yan5811qzyvpdfkv801a19nyd09nsqayi8gyh58xx9c21m4";
-    })
-    (xsaPatch {
-      name = "224-4.8/0002-gnttab-never-create-host-mapping-unless-asked-to";
-      sha256 = "06nj1x59bbx9hrj26xmvbw8z805lfqhld9hm0ld0fs6dmcpqzcck";
-    })
-    (xsaPatch {
-      name = "224-4.8/0003-gnttab-correct-logic-to-get-page-references-during-m";
-      sha256 = "0kmag6fdsskgplcvzqp341yfi6pgc14wvjj58bp7ydb9hdk53qx2";
-    })
-    (xsaPatch {
-      name = "224-4.8/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth";
-      sha256 = "1ww80pi7jr4gjpymkcw8qxmr5as18b2asdqv35527nqprylsff9f";
-    })
-  ];
-
-  # 4.6 - 4.8
-  XSA_225 = (xsaPatch {
-    name = "225";
-    sha256 = "0lcp2bs0r849xnvhrdf8s821v36cqdbzk8lwz6chrjhjalk6ha2g";
-  });
-
  # 4.5
  XSA_226_45 = [
    (xsaPatch {
@@ -466,42 +296,12 @@ in {
    })
  ];

-  # 4.8 - 4.9
-  XSA_226 = [
-    (xsaPatch {
-      name = "226-4.9/0001-gnttab-dont-use-possibly-unbounded-tail-calls";
-      sha256 = "1hx47ppv5q33cw4dwp82lgvv4fp28gx7rxijw0iaczsv8bvb8vcg";
-    })
-    (xsaPatch {
-      name = "226-4.9/0002-gnttab-fix-transitive-grant-handling";
-      sha256 = "1gzp8m2zfihwlk71c3lqyd0ajh9h11pvkhzhw0mawckxy0qksvlc";
-    })
-  ];
-
  # 4.5
  XSA_227_45 = (xsaPatch {
    name = "227-4.5";
    sha256 = "1qfjfisgqm4x98qw54x2qrvgjnvvzizx9p1pjhcnsps9q6g1y3x8";
  });

-  # 4.8 - 4.9
-  XSA_227 = (xsaPatch {
-    name = "227";
-    sha256 = "0zdcm43i5n08rh7rrnb0fcssvd4fgawwmizsa16w2ak7pzvgmg94";
-  });
-
-  # 4.8
-  XSA_228_48 = (xsaPatch {
-    name = "228-4.8";
-    sha256 = "085pnzwyv0rdb51hv5vhbhwfyxl0wg8sxcm912gjq8z7da5cv10n";
-  });
-
-  # 4.9
-  XSA_228 = (xsaPatch {
-    name = "228";
-    sha256 = "0c9nvfpnr5ira7ha3fszhvvh71nsxrvmzrab56xwjhl2dbw2yy23";
-  });
-
  # 4.5 - 4.9
  XSA_230 = (xsaPatch {
    name = "230";
@@ -514,12 +314,6 @@ in {
    sha256 = "06gwx2f1lg51dfk2b4zxp7wv9c4pxdi87pg2asvmxqc78ir7l5s6";
  });

-  # 4.8 - 4.9
-  XSA_231 = (xsaPatch {
-    name = "231-4.9";
-    sha256 = "09r8xxq2fd52wrk6i0y0sk3nbidfg6pzzrkx327hfmdjj76iyz3b";
-  });
-
  # 4.5 - 4.9
  XSA_232 = (xsaPatch {
    name = "232";
@@ -538,42 +332,18 @@ in {
    sha256 = "1ji6hbgybb4gbgz5l5fis9midnvjbddzam8d63377rkzdyb3yz9f";
  });

-  # 4.8
-  XSA_234_48 = (xsaPatch {
-    name = "234-4.8";
-    sha256 = "08n1pf7z5y67dmay1ap39bi81clgkx82fpmfn7jsh8k4aw94jrsa";
-  });
-
-  # 4.9
-  XSA_234 = (xsaPatch {
-    name = "234-4.9";
-    sha256 = "1znmxg432is0virw8321gax8zqq2zcmi2pc5p2j31sixylixsvzx";
-  });
-
  # 4.5
  XSA_235_45 = (xsaPatch {
    name = "235-4.5";
    sha256 = "0hhgnql2gji111020z4wiyzg23wqs6ymanb67rg11p4qad1fp3ff";
  });

-  # 4.8 - 4.9
-  XSA_235 = (xsaPatch {
-    name = "235-4.9";
-    sha256 = "1rj4jkmh79wm30jq9f8x65qv3al8l91zc3m5s23q0x6abn3pfb9z";
-  });
-
  # 4.5
  XSA_236_45 = (xsaPatch {
    name = "236-4.5";
    sha256 = "0hcla86x81wykssd2967gblp7fzx61290p4ls4v0hcyxdg2bs2yz";
  });

-  # 4.8 - 4.9
-  XSA_236 = (xsaPatch {
-    name = "236-4.9";
-    sha256 = "0vqxy7mgflga05l33j3488fwxmdw3p9yxj4ylhk9n3nw8id72ghq";
-  });
-
  # 4.5
  XSA_237_45 = [
    (xsaPatch {
@@ -598,78 +368,18 @@ in {
    })
  ];

-  # 4.8
-  XSA_237_48 = [
-    (xsaPatch {
-      name = "237-4.8/0001-x86-dont-allow-MSI-pIRQ-mapping-on-unowned-device";
-      sha256 = "0qjisp37lwi2611mp7fbbm1s7m0bx726rrg79dnxs2mj0skw59iv";
-    })
-    (xsaPatch {
-      name = "237-4.8/0002-x86-enforce-proper-privilege-when-mapping-pIRQ-s";
-      sha256 = "05q1dny13jrqhjfwak7r635mqp9chpibjvn8b7d90japc1nzpq62";
-    })
-    (xsaPatch {
-      name = "237-4.8/0003-x86-MSI-disallow-redundant-enabling";
-      sha256 = "1907lv8nb2zhpb6k6jlw4m0hm0n0lyd69vfr3wpzbc56dn0w7jqd";
-    })
-    (xsaPatch {
-      name = "237-4.8/0004-x86-IRQ-conditionally-preserve-irq-pirq-mapping-on-error";
-      sha256 = "06nrq0bx3p9ipab2r1why6qm4g32dj0x5q24hfkwc6ih0l9xwf8h";
-    })
-    (xsaPatch {
-      name = "237-4.8/0005-x86-FLASK-fix-unmap-domain-IRQ-XSM-hook";
-      sha256 = "1nbg7bjw2hv55gnkhf6chkh35va6brs08acq1d5jxncl6kv0amc1";
-    })
-  ];
-
-  # 4.9
-  XSA_237 = [
-    (xsaPatch {
-      name = "237-4.9/0001-x86-dont-allow-MSI-pIRQ-mapping-on-unowned-device";
-      sha256 = "1cbl24mqxa62h0wgsnrpcs6y6vs53znzj7g8dfsbmf74xwrd4px6";
-    })
-    (xsaPatch {
-      name = "237-4.9/0002-x86-enforce-proper-privilege-when-mapping-pIRQ-s";
-      sha256 = "0p60148j18b78pxz0dx5ymh1gyrhg2cgmxq0jxmbk090bc4jql35";
-    })
-    (xsaPatch {
-      name = "237-4.9/0003-x86-MSI-disallow-redundant-enabling";
-      sha256 = "1907lv8nb2zhpb6k6jlw4m0hm0n0lyd69vfr3wpzbc56dn0w7jqd";
-    })
-    (xsaPatch {
-      name = "237-4.9/0004-x86-IRQ-conditionally-preserve-irq-pirq-mapping-on-error";
-      sha256 = "0q95z5641amni53agimnzbspva53p0hz5wl16zaz2yhnjasj5pzr";
-    })
-    (xsaPatch {
-      name = "237-4.9/0005-x86-FLASK-fix-unmap-domain-IRQ-XSM-hook";
-      sha256 = "0bnqx9w7ppgx8wxj2zw09z0rkv1jzn3r0bd76cz0r22wz29fsdp2";
-    })
-  ];
-
  # 4.5
  XSA_238_45 = (xsaPatch {
    name = "238-4.5";
    sha256 = "1x2fg5vfv5jc084h5gjm6fq0nxjpzvi96px3sqzz4pvsvy4y4i1z";
  });

-  # 4.8 - 4.9
-  XSA_238 = (xsaPatch {
-    name = "238";
-    sha256 = "1cbmg1bi5ajh7qbwsl92ynaxw2c3p7i24p3wds81r4n93r0y5dxk";
-  });
-
  # 4.5
  XSA_239_45 = (xsaPatch {
    name = "239-4.5";
    sha256 = "06bi8q3973yajxsdj7pcqarvb56q2gisxdiy0cpbyffbmpkfv3h6";
  });

-  # 4.8 - 4.9
-  XSA_239 = (xsaPatch {
-    name = "239";
-    sha256 = "1a9r8j7167s43ds5i7v7mm4y970vjnbhhkrjzpmzlcx8kcz96vh3";
-  });
-
  # 4.5
  XSA_240_45 = [
    (xsaPatch {
@@ -682,42 +392,12 @@ in {
    })
  ];

-  # 4.8
-  XSA_240_48 = [
-    (xsaPatch {
-      name = "240-4.8/0001-x86-limit-linear-page-table-use-to-a-single-level";
-      sha256 = "0m44qhhqk2pdwqg8g28pypqrylq6iw00k9qrzf6qd0iza2y42kgj";
-    })
-    (xsaPatch {
-      name = "240-4.8/0002-x86-mm-Disable-PV-linear-pagetables-by-default";
-      sha256 = "1jd720wvngj9wq3fprdhakxvqlff0jd8zcx2pd3vsn2qvjbvr2gf";
-    })
-  ];
-
-  # 4.9
-  XSA_240 = [
-    (xsaPatch {
-      name = "240-4.9/0001-x86-limit-linear-page-table-use-to-a-single-level";
-      sha256 = "1759ni80aifakm44g4cc6pnmbcn1xjic8j66fvj0vibm0wqk6xck";
-    })
-    (xsaPatch {
-      name = "240-4.9/0002-x86-mm-Disable-PV-linear-pagetables-by-default";
-      sha256 = "0g6dpi006p5cjxw5d8h33p0429fdmdm6nqzj0m63ralpqvns3ib5";
-    })
-  ];
-
  # 4.5 - 4.8
  XSA_241 = (xsaPatch {
    name = "241-4.8";
    sha256 = "16zb75kzs98f4mdxhbyczk5mbh9dvn6j3yhfafki34x1dfdnq4pj";
  });

-  # 4.9
-  XSA_241_49 = (xsaPatch {
-    name = "241-4.9";
-    sha256 = "0xlhin7wkhmlnbp9mqcbq3q4drdwb5la482ja9nwkhi8i867p6wc";
-  });
-
  # 4.5 - 4.9
  XSA_242 = (xsaPatch {
    name = "242-4.9";
@@ -736,30 +416,12 @@ in {
    })
  ];

-  # 4.8
-  XSA_243_48 = (xsaPatch {
-    name = "243-4.8";
-    sha256 = "1q60zn55l9wpq45nrxh0av59sjz0jg8pkjm1gkyywkdsgg4fg5z4";
-  });
-
-  # 4.9
-  XSA_243 = (xsaPatch {
-    name = "243";
-    sha256 = "06fnbnh9zlsbkqih9ipnb7a8gly54m7lp17d854j1r370ad3c4yg";
-  });
-
  # 4.5
  XSA_244_45 = (xsaPatch {
    name = "244-4.5";
    sha256 = "05ci3vdl1ywfjpzcvsy1k52whxjk8pxzj7dh3r94yqasr56i5v2l";
  });

-  # 4.8 - 4.9
-  XSA_244 = (xsaPatch {
-    name = "244";
-    sha256 = "10308xsgmhb0vg6fk0ql8v94zifv6dcv6vkaicryfp405yj2rzkm";
-  });
-
  # 4.5 - 4.9
  XSA_245 = [
    (xsaPatch {
@@ -780,26 +442,6 @@ in {
    })
  ];

-  # 4.8 - 4.9
-  XSA_246 = [
-    (xsaPatch {
-      name = "246-4.9";
-      sha256 = "0z68vm0z5zvv9gm06pxs9kxq2q9fdbl0l0cm71ggzdplg1vw0snz";
-    })
-  ];
-
-  # 4.8
-  XSA_247_48 = [
-    (xsaPatch {
-      name = "247-4.8/0001-p2m-Always-check-to-see-if-removing-a-p2m-entry-actu";
-      sha256 = "0kvjrk90n69s721c2qj2df5raml3pjk6bg80aig353p620w6s3xh";
-    })
-    (xsaPatch {
-      name = "247-4.8/0002-p2m-Check-return-value-of-p2m_set_entry-when-decreas";
-      sha256 = "1s9kv6h6dd8psi5qf5l5gpk9qhq8blckwhl76cjbldcgi6imb3nr";
-    })
-  ];
-
  # 4.5
  XSA_247_45 = [
    (xsaPatch {
@@ -820,14 +462,6 @@ in {
    })
  ];

-  # 4.8
-  XSA_248_48 = [
-    (xsaPatch {
-      name = "248-4.8";
-      sha256 = "1ycw29q22ymxg18kxpr5p7vhpmp8klssbp5gq77hspxzz2mb96q1";
-    })
-  ];
-
  # 4.5 .. 4.9
  XSA_249 = [
   (xsaPatch {
@@ -835,6 +469,7 @@ in {
      sha256 = "0v6ngzqhkz7yv4n83xlpxfbkr2qyg5b1cds7ikkinm86hiqy6agl";
    })
  ];
+
  # 4.5
  XSA_250_45 = [
   (xsaPatch {
@@ -842,13 +477,7 @@ in {
      sha256 = "0pqldl6qnl834gvfp90z247q9xcjh3835s2iffnajz7jhjb2145d";
    })
  ];
-  # 4.8 ...
-  XSA_250 = [
-   (xsaPatch {
-      name = "250";
-      sha256 = "1wpigg8kmha57sspqqln3ih9nbczsw6rx3v72mc62lh62qvwd7x8";
-    })
-  ];
+
  # 4.5
  XSA_251_45 = [
   (xsaPatch {
@@ -856,81 +485,4 @@ in {
      sha256 = "0lc94cx271z09r0mhxaypyd9d4740051p28idf5calx5228dqjgm";
    })
  ];
-  # 4.8
-  XSA_251_48 = [
-   (xsaPatch {
-      name = "251-4.8";
-      sha256 = "079wi0j6iydid2zj7k584w2c393kgh588w7sjz2nn4039qn8k9mq";
-    })
-  ];
-  # 4.8
-  XSA_252_49 = [
-   (xsaPatch {
-      name = "252-4.9";
-      sha256 = "03sbn90nlkk5ba1n168rxjkc7x3mqj7rfqvspbwblmwikfbnms2n";
-    })
-  ];
-  # 4.8
-  XSA_255_49_1= [
-   (xsaPatch {
-      name = "255-4.9-1";
-      sha256 = "0gbin7yxbkq40lvm3gvj1vffavvbng3zpd2m8l1kqyz0rv4vm9zc";
-    })
-  ];
-  # 4.8
-  XSA_255_49_2= [
-   (xsaPatch {
-      name = "255-4.9-2";
-      sha256 = "0fyg5nnyfpfr80qq83pr64zjp5w1nx94bdblzsjap8gaqcahyr12";
-    })
-  ];
-  # 4.8
-  XSA_256_48= [
-   (xsaPatch {
-      name = "256-4.8";
-      sha256 = "1w84f717kxwx0h3rw18r4f8pl0l1h5xlj5fy80sr0ws4xkp1qdn4";
-    })
-  ];
-
-
-  # 4.10
-  XSA_252 = [
-   (xsaPatch {
-      name = "252";
-      sha256 = "0v4sg20dnvnwrjh3x69gk81v2kmcql7g2s044vg3wcxhzvij1rrn";
-    })
-  ];
-
-  # 4.10
-  XSA_253 = [
-   (xsaPatch {
-      name = "253";
-      sha256 = "0445vzlzy3gd499xraqh5r4qjar6qr0y3813h22jy1n84nhxz27i";
-    })
-  ];
-
-  # 4.10
-  XSA_255_1 = [
-   (xsaPatch {
-      name = "255-1";
-      sha256 = "05g2f3ji1rrjlw3yw4nrns50pnmsib8ybrf64scr1817mj0q9myr";
-    })
-  ];
-
-  # 4.10
-  XSA_255_2 = [
-   (xsaPatch {
-      name = "255-2";
-      sha256 = "08wbngw5z0f9g8di59hww3hhi7j9z49bpc4xlwn5akfcwbgf0961";
-    })
-  ];
-
-  # 4.10
-  XSA_256 = [
-   (xsaPatch {
-      name = "256";
-      sha256 = "1hicwhbwj6k25px55f4ncx1c5xiihi8pfvsb3kv57k7kaicb7pza";
-    })
-  ];
-
 }
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -38,7 +38,9 @@ let
    };
    deepin-turbo = callPackage ./deepin-turbo { };
    deepin-wallpapers = callPackage ./deepin-wallpapers { };
-    deepin-wm = callPackage ./deepin-wm { };
+    deepin-wm = callPackage ./deepin-wm {
+      vala = pkgs.vala_0_42;
+    };
    dpa-ext-gnomekeyring = callPackage ./dpa-ext-gnomekeyring { };
    dtkcore = callPackage ./dtkcore { };
    dtkwidget = callPackage ./dtkwidget { };
--- a/pkgs/desktops/gnome-3/core/mutter/0001-Revert-ClutterActor-Preserve-valid-paint-volumes-til.patch
+++ b/pkgs/desktops/gnome-3/core/mutter/0001-Revert-ClutterActor-Preserve-valid-paint-volumes-til.patch
@@ -0,0 +1,147 @@
+From 76477def5c103f10d62e604305802d7f5506afd4 Mon Sep 17 00:00:00 2001
+From: worldofpeace <worldofpeace@protonmail.ch>
+Date: Sun, 15 Sep 2019 20:14:16 -0400
+Subject: [PATCH] Revert "ClutterActor: Preserve valid paint volumes till the
+ next relayout/repaint"
+
+This causes issues for users of mutter like in gala[0].
+
+Upstream report: https://gitlab.gnome.org/GNOME/mutter/issues/536
+[0]: https://github.com/elementary/gala/issues/605
+---
+ clutter/clutter/clutter-actor.c | 35 +++++----------------------------
+ 1 file changed, 5 insertions(+), 30 deletions(-)
+
+diff --git a/clutter/clutter/clutter-actor.c b/clutter/clutter/clutter-actor.c
+index e70892308..8cb60fa07 100644
+--- a/clutter/clutter/clutter-actor.c
+++ b/clutter/clutter/clutter-actor.c
+@@ -24,7 +24,7 @@
+ 
+ /**
+  * SECTION:clutter-actor
+- * @short_description: The basic element of the scene graph 
+ * @short_description: The basic element of the scene graph
+  *
+  * The ClutterActor class is the basic element of the scene graph in Clutter,
+  * and it encapsulates the position, size, and transformations of a node in
+@@ -840,7 +840,6 @@ struct _ClutterActorPrivate
+   guint needs_compute_expand        : 1;
+   guint needs_x_expand              : 1;
+   guint needs_y_expand              : 1;
+-  guint needs_paint_volume_update   : 1;
+   guint had_effects_on_last_paint_volume_update : 1;
+ };
+ 
+@@ -1511,8 +1510,6 @@ clutter_actor_real_map (ClutterActor *self)
+ 
+   CLUTTER_ACTOR_SET_FLAGS (self, CLUTTER_ACTOR_MAPPED);
+ 
+-  self->priv->needs_paint_volume_update = TRUE;
+-
+   stage = _clutter_actor_get_stage_internal (self);
+   priv->pick_id = _clutter_stage_acquire_pick_id (CLUTTER_STAGE (stage), self);
+ 
+@@ -2746,7 +2743,6 @@ clutter_actor_real_queue_relayout (ClutterActor *self)
+   priv->needs_width_request  = TRUE;
+   priv->needs_height_request = TRUE;
+   priv->needs_allocation     = TRUE;
+-  priv->needs_paint_volume_update = TRUE;
+ 
+   /* reset the cached size requests */
+   memset (priv->width_requests, 0,
+@@ -4742,7 +4738,7 @@ clutter_actor_set_rotation_center_internal (ClutterActor        *self,
+                                             ClutterRotateAxis    axis,
+                                             const ClutterVertex *center)
+ {
+-  ClutterVertex v = CLUTTER_VERTEX_INIT_ZERO; 
+  ClutterVertex v = CLUTTER_VERTEX_INIT_ZERO;
+   GObject *obj = G_OBJECT (self);
+   ClutterTransformInfo *info;
+ 
+@@ -8531,7 +8527,6 @@ clutter_actor_init (ClutterActor *self)
+   priv->needs_width_request = TRUE;
+   priv->needs_height_request = TRUE;
+   priv->needs_allocation = TRUE;
+-  priv->needs_paint_volume_update = TRUE;
+ 
+   priv->cached_width_age = 1;
+   priv->cached_height_age = 1;
+@@ -10098,9 +10093,6 @@ clutter_actor_allocate (ClutterActor           *self,
+       return;
+     }
+ 
+-  if (CLUTTER_ACTOR_IS_MAPPED (self))
+-    self->priv->needs_paint_volume_update = TRUE;
+-
+   if (!stage_allocation_changed)
+     {
+       /* If the actor didn't move but needs_allocation is set, we just
+@@ -12992,9 +12984,6 @@ clutter_actor_add_child_internal (ClutterActor              *self,
+       child->priv->needs_height_request = TRUE;
+       child->priv->needs_allocation = TRUE;
+ 
+-      if (CLUTTER_ACTOR_IS_MAPPED (child))
+-        child->priv->needs_paint_volume_update = TRUE;
+-
+       /* we only queue a relayout here, because any possible
+        * redraw has already been queued either by show() or
+        * by our call to queue_redraw() above
+@@ -14130,7 +14119,7 @@ clutter_actor_get_anchor_point_gravity (ClutterActor *self)
+  *
+  * Since: 0.6
+  *
+- * Deprecated: 1.12: Use #ClutterActor:pivot-point and 
+ * Deprecated: 1.12: Use #ClutterActor:pivot-point and
+  * clutter_actor_set_translation() instead.
+  */
+ void
+@@ -14178,7 +14167,7 @@ clutter_actor_move_anchor_point (ClutterActor *self,
+  *
+  * Since: 0.6
+  *
+- * Deprecated: 1.12: Use #ClutterActor:pivot-point and 
+ * Deprecated: 1.12: Use #ClutterActor:pivot-point and
+  * clutter_actor_set_translation() instead.
+  */
+ void
+@@ -14230,7 +14219,7 @@ clutter_actor_move_anchor_point_from_gravity (ClutterActor   *self,
+  *
+  * Since: 0.6
+  *
+- * Deprecated: 1.12: Use #ClutterActor:pivot-point and 
+ * Deprecated: 1.12: Use #ClutterActor:pivot-point and
+  * clutter_actor_set_translation() instead. E.g. For %CLUTTER_GRAVITY_CENTER set
+  * pivot_point to (0.5,0.5) and the translation to (width/2,height/2).
+  */
+@@ -17567,19 +17556,6 @@ _clutter_actor_get_paint_volume_mutable (ClutterActor *self)
+ 
+   if (priv->paint_volume_valid)
+     {
+-      /* If effects are applied, the actor paint volume
+-       * needs to be recomputed on each paint, since those
+-       * paint volumes could change over the duration of the
+-       * effect.
+-       *
+-       * We also need to update the paint volume if we went
+-       * from having effects to not having effects on the last
+-       * paint volume update. */
+-      if (!priv->needs_paint_volume_update &&
+-          priv->current_effect == NULL &&
+-          !has_paint_volume_override_effects &&
+-          !priv->had_effects_on_last_paint_volume_update)
+-        return &priv->paint_volume;
+       clutter_paint_volume_free (&priv->paint_volume);
+     }
+ 
+@@ -17588,7 +17564,6 @@ _clutter_actor_get_paint_volume_mutable (ClutterActor *self)
+   if (_clutter_actor_get_paint_volume_real (self, &priv->paint_volume))
+     {
+       priv->paint_volume_valid = TRUE;
+-      priv->needs_paint_volume_update = FALSE;
+       return &priv->paint_volume;
+     }
+   else
+-- 
+2.22.1
+
--- a/pkgs/desktops/gnome-3/core/mutter/3.28.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/3.28.nix
@@ -54,6 +54,8 @@ stdenv.mkDerivation rec {
      url = "https://github.com/elementary/os-patches/commit/d636a44885c5be662997f8e19f7dcd26670b3219.patch";
      sha256 = "12pbxk6f39a09jxjam5a5hxl4whp3cifzpck2m7fpp0n98nc63qh";
    })
+    # See patch commit message
+    ./0001-Revert-ClutterActor-Preserve-valid-paint-volumes-til.patch
  ];

  configureFlags = [
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -1,5 +1,5 @@
-{ stdenv, lib, fetchurl, bash, cpio, pkgconfig, file, which, unzip, zip, cups, freetype
-, alsaLib, cacert, perl, liberation_ttf, fontconfig, zlib
+{ stdenv, lib, fetchurl, pkgconfig, lndir, bash, cpio, file, which, unzip, zip
+, cups, freetype, alsaLib, cacert, perl, liberation_ttf, fontconfig, zlib
 , libX11, libICE, libXrender, libXext, libXt, libXtst, libXi, libXinerama, libXcursor, libXrandr
 , libjpeg, giflib
 , openjdk8-bootstrap
@@ -85,7 +85,7 @@ let

    outputs = [ "out" "jre" ];

-    nativeBuildInputs = [ pkgconfig ];
+    nativeBuildInputs = [ pkgconfig lndir ];
    buildInputs = [
      cpio file which unzip zip perl openjdk8-bootstrap zlib cups freetype alsaLib
      libjpeg giflib libX11 libICE libXext libXrender libXtst libXt libXtst
@@ -190,7 +190,8 @@ let
      # Move the JRE to a separate output
      mkdir -p $jre/lib/openjdk
      mv $out/lib/openjdk/jre $jre/lib/openjdk/jre
-      ln -s $jre/lib/openjdk/jre $out/lib/openjdk/jre
+      mkdir $out/lib/openjdk/jre
+      lndir $jre/lib/openjdk/jre $out/lib/openjdk/jre

      # Setup fallback fonts
      ${lib.optionalString (!headless) ''
--- a/pkgs/development/interpreters/spidermonkey/1.8.5.nix
+++ b/pkgs/development/interpreters/spidermonkey/1.8.5.nix
@@ -37,6 +37,12 @@ stdenv.mkDerivation {

  patchFlags = "-p3";

+  # fixes build on gcc8
+  postPatch = ''
+    substituteInPlace ./methodjit/MethodJIT.cpp \
+      --replace 'asm volatile' 'asm'
+  '';
+
  # On the Sheevaplug, ARM, its nanojit thing segfaults in japi-tests in
  # "make check". Disabling tracejit makes it work, but then it needs the
  # patch findvanilla.patch do disable a checker about allocator safety. In case
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -238,11 +238,11 @@ assert opensslExtlib -> gnutls == null && openssl != null && nonfreeLicensing;

 stdenv.mkDerivation rec {
  pname = "ffmpeg-full";
-  version = "4.2";
+  version = "4.2.1";

  src = fetchurl {
    url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "1mgcxm7sqkajx35px05szsmn9mawwm03cfpmk3br7bcp3a1i0gq2";
+    sha256 = "1m5nkc61ihgcf0b2wabm0zyqa8sj3c0w8fi6kr879lb0kdzciiyf";
  };

  patches = [ ./prefer-libdav1d-over-libaom.patch ];
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -5,8 +5,8 @@
 }@args:

 callPackage ./generic.nix (args // rec {
-  version = branch;
+  version = "4.2.1";
  branch = "4.2";
-  sha256 = "1f3glany3p2j832a9wia5vj8ds9xpm0xxlyia91y17hy85gxwsrh";
+  sha256 = "090naa6rj46pzkgh03bf51hbqdz356qqckr2pw6pykc6ysiryak8";
  darwinFrameworks = [ Cocoa CoreMedia VideoToolbox ];
 })
--- a/pkgs/development/libraries/getdns/default.nix
+++ b/pkgs/development/libraries/getdns/default.nix
@@ -3,11 +3,12 @@

 stdenv.mkDerivation rec {
  pname = "getdns";
-  version = "1.5.1";
+  version = "1.5.2";
+  versionRewrite = builtins.splitVersion version;

  src = fetchurl {
-    url = "https://getdnsapi.net/releases/${pname}-1-5-1/${pname}-${version}.tar.gz";
-    sha256 = "5686e61100599c309ce03535f9899a5a3d94a82cc08d10718e2cd73ad3dc28af";
+    url = "https://getdnsapi.net/releases/${pname}-${builtins.concatStringsSep "-" versionRewrite}/${pname}-${version}.tar.gz";
+    sha256 = "1h4l0sbkpiahpx2pd5lby10yi22mdxgx5xf1y80r77pa46iac9hq";
  };

  nativeBuildInputs = [ libtool m4 autoreconfHook automake file ];
--- a/pkgs/development/libraries/itk/4.x.nix
+++ b/pkgs/development/libraries/itk/4.x.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, cmake, libX11, libuuid, xz, vtk }:
+
+stdenv.mkDerivation rec {
+  name = "itk-4.13.1";
+
+  src = fetchurl {
+    url = mirror://sourceforge/itk/InsightToolkit-4.13.1.tar.xz;
+    sha256 = "0p4cspgbnjsnkjz8nfg092yaxz8qkqi2nkxjdv421d0zrmi0i2al";
+  };
+
+  cmakeFlags = [
+    "-DBUILD_TESTING=OFF"
+    "-DBUILD_EXAMPLES=OFF"
+    "-DBUILD_SHARED_LIBS=ON"
+    "-DModule_ITKMINC=ON"
+    "-DModule_ITKIOMINC=ON"
+    "-DModule_ITKIOTransformMINC=ON"
+    "-DModule_ITKVtkGlue=ON"
+    "-DModule_ITKReview=ON"
+  ];
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ cmake xz ];
+  buildInputs = [ libX11 libuuid vtk ];
+
+  meta = {
+    description = "Insight Segmentation and Registration Toolkit";
+    homepage = http://www.itk.org/;
+    license = stdenv.lib.licenses.asl20;
+    maintainers = with stdenv.lib.maintainers; [viric];
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
+  };
+}
--- a/pkgs/development/libraries/microsoft_gsl/default.nix
+++ b/pkgs/development/libraries/microsoft_gsl/default.nix
@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ catch cmake ];
  buildPhase = if nativeBuild then "make" else "true";

+  # https://github.com/microsoft/GSL/issues/806
+  cmakeFlags = [ "-DCMAKE_CXX_FLAGS=-Wno-catch-value" ];
+
  installPhase = ''
    mkdir -p $out/include
    mv ../include/ $out/
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -80,9 +80,9 @@ wrapQtAppsHook() {
    do
        [ -d "$targetDir" ] || continue

-        find "$targetDir" -executable -print0 | while IFS= read -r -d '' file
+        find "$targetDir" -type f -executable -print0 | while IFS= read -r -d '' file
        do
-            isELFExec "$file" || continue
+            patchelf --print-interpreter "$file" >/dev/null 2>&1 || continue

            if [ -f "$file" ]
            then
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -103,24 +103,27 @@ EOF
      --replace 'libs = [ "sandbox" ]' 'libs = [ "/usr/lib/libsandbox.1.dylib" ]'
    '');

-  NIX_CFLAGS_COMPILE =
-  # it fails when compiled with -march=sandybridge https://github.com/NixOS/nixpkgs/pull/59148#discussion_r276696940
-  # TODO: investigate and fix properly
-    lib.optionals (stdenv.hostPlatform.platform.gcc.arch or "" == "sandybridge") [ "-march=westmere" ] ++
-    lib.optionals stdenv.isDarwin [
-      "-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_10"
-      "-DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_10"
+  NIX_CFLAGS_COMPILE = [
+    # with gcc8, -Wclass-memaccess became part of -Wall and this exceeds the logging limit
+    "-Wno-class-memaccess"
+  ] ++ lib.optionals (stdenv.hostPlatform.platform.gcc.arch or "" == "sandybridge") [
+    # it fails when compiled with -march=sandybridge https://github.com/NixOS/nixpkgs/pull/59148#discussion_r276696940
+    # TODO: investigate and fix properly
+    "-march=westmere"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DMAC_OS_X_VERSION_MAX_ALLOWED=MAC_OS_X_VERSION_10_10"
+    "-DMAC_OS_X_VERSION_MIN_REQUIRED=MAC_OS_X_VERSION_10_10"

-      #
-      # Prevent errors like
-      # /nix/store/xxx-apple-framework-CoreData/Library/Frameworks/CoreData.framework/Headers/NSEntityDescription.h:51:7:
-      # error: pointer to non-const type 'id' with no explicit ownership
-      #     id** _kvcPropertyAccessors;
-      #
-      # TODO remove when new Apple SDK is in
-      #
-      "-fno-objc-arc"
-    ];
+    #
+    # Prevent errors like
+    # /nix/store/xxx-apple-framework-CoreData/Library/Frameworks/CoreData.framework/Headers/NSEntityDescription.h:51:7:
+    # error: pointer to non-const type 'id' with no explicit ownership
+    #     id** _kvcPropertyAccessors;
+    #
+    # TODO remove when new Apple SDK is in
+    #
+    "-fno-objc-arc"
+  ];

  preConfigure = ''
    export NINJAFLAGS=-j$NIX_BUILD_CORES
--- a/pkgs/development/python-modules/azure-common/default.nix
+++ b/pkgs/development/python-modules/azure-common/default.nix
@@ -1,8 +1,9 @@
-{ pkgs
+{ lib
 , buildPythonPackage
 , fetchPypi
 , azure-nspkg
 , isPyPy
+, setuptools
 , python
 , isPy3k
 }:
@@ -20,7 +21,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    azure-nspkg
-  ];
+  ] ++ lib.optionals (!isPy3k) [ setuptools ]; # need for namespace lookup

  postInstall = if isPy3k then "" else ''
    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/lib/${python.libPrefix}"/site-packages/azure/__init__.py
@@ -28,7 +29,7 @@ buildPythonPackage rec {

  doCheck = false;

-  meta = with pkgs.lib; {
+  meta = with lib; {
    description = "This is the Microsoft Azure common code";
    homepage = https://github.com/Azure/azure-sdk-for-python/tree/master/azure-common;
    license = licenses.mit;
--- a/pkgs/development/python-modules/azure-mgmt-common/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-common/default.nix
@@ -28,6 +28,7 @@ buildPythonPackage rec {

  postInstall = if isPy3k then "" else ''
    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/lib/${python.libPrefix}"/site-packages/azure/mgmt/__init__.py
+    echo "__import__('pkg_resources').declare_namespace(__name__)" >> "$out/lib/${python.libPrefix}"/site-packages/azure/__init__.py
  '';

  doCheck = false;
--- a/pkgs/development/python-modules/azure-servicebus/default.nix
+++ b/pkgs/development/python-modules/azure-servicebus/default.nix
@@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "azure-servicebus";
-  version = "0.50.0";
+  version = "0.50.1";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "c5864cfc69402e3e2897e61b3bd224ade28d9e33dad849e4bd6afad26a3d2786";
+    sha256 = "0i8ls5h2ny12h9gnqwyq13ysvxgdq7b1kxirj4n58dfy94a182gv";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , openssl
 , cryptography_vectors
 , darwin
@@ -49,10 +50,18 @@ buildPythonPackage rec {
    pytz
  ];

+  # remove when https://github.com/pyca/cryptography/issues/4998 is fixed
  checkPhase = ''
-    py.test --disable-pytest-warnings tests
+    py.test --disable-pytest-warnings tests -k 'not load_ecdsa_no_named_curve'
  '';

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/pyca/cryptography/commit/e575e3d482f976c4a1f3203d63ea0f5007a49a2a.patch";
+      sha256 = "0vg9prqsizd6gzh5j7lscsfxzxlhz7pacvzhgqmj1vhdhjwbblcp";
+    })
+  ];
+
  # IOKit's dependencies are inconsistent between OSX versions, so this is the best we
  # can do until nix 1.11's release
  __impureHostDeps = [ "/usr/lib" ];
--- a/pkgs/development/python-modules/demjson/default.nix
+++ b/pkgs/development/python-modules/demjson/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy36 }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k }:

 buildPythonPackage rec {
  pname = "demjson";
  version = "2.2.4";
-  disabled = isPy36;
+  disabled = isPy3k;

  src = fetchPypi {
    inherit pname version;
--- a/pkgs/development/python-modules/dlib/default.nix
+++ b/pkgs/development/python-modules/dlib/default.nix
@@ -21,4 +21,7 @@ buildPythonPackage {
  '';

  checkInputs = [ pytest more-itertools ];
+
+  enableParallelBuilding = true;
+  dontUseCmakeConfigure = true;
 }
--- a/pkgs/development/python-modules/face_recognition_models/default.nix
+++ b/pkgs/development/python-modules/face_recognition_models/default.nix
@@ -1,4 +1,4 @@
-{ buildPythonPackage, stdenv, fetchPypi }:
+{ buildPythonPackage, stdenv, fetchPypi, setuptools }:

 buildPythonPackage rec {
  pname = "face_recognition_models";
@@ -12,6 +12,8 @@ buildPythonPackage rec {
  # no module named `tests` as no tests are available
  doCheck = false;

+  propagatedBuildInputs = [ setuptools ];
+
  meta = with stdenv.lib; {
    homepage = https://github.com/ageitgey/face_recognition_models;
    license = licenses.cc0;
--- a/pkgs/development/python-modules/flaky/default.nix
+++ b/pkgs/development/python-modules/flaky/default.nix
@@ -2,22 +2,29 @@
 , buildPythonPackage
 , fetchPypi
 , mock
+, nose
 , pytest
 }:

 buildPythonPackage rec {
  pname = "flaky";
-  version = "3.5.3";
+  version = "3.6.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "12bd5e41f372b2190e8d754b6e5829c2f11dbc764e10b30f57e59f829c9ca1da";
+    sha256 = "8cd5455bb00c677f787da424eaf8c4a58a922d0e97126d3085db5b279a98b698";
  };

-  buildInputs = [ mock pytest ];
+  checkInputs = [ mock nose pytest ];

-  # waiting for feedback https://github.com/box/flaky/issues/97
-  doCheck = false;
+  checkPhase = ''
+    # based on tox.ini
+    pytest -k 'example and not options' --doctest-modules test/test_pytest/
+    pytest -k 'example and not options' test/test_pytest/
+    pytest -p no:flaky test/test_pytest/test_flaky_pytest_plugin.py
+    nosetests --with-flaky --force-flaky --max-runs 2 test/test_nose/test_nose_options_example.py
+    pytest --force-flaky --max-runs 2  test/test_pytest/test_pytest_options_example.py
+  '';

  meta = with stdenv.lib; {
    homepage = https://github.com/box/flaky;
--- a/pkgs/development/python-modules/h11/default.nix
+++ b/pkgs/development/python-modules/h11/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pytest }:
+{ lib, buildPythonPackage, fetchPypi, pytest, fetchpatch }:

 buildPythonPackage rec {
  pname = "h11";
@@ -9,6 +9,14 @@ buildPythonPackage rec {
    sha256 = "1qfad70h59hya21vrzz8dqyyaiqhac0anl2dx3s3k80gpskvrm1k";
  };

+  patches = [
+    # pytest5 compatability
+    (fetchpatch {
+      url = https://github.com/python-hyper/h11/commit/241e220493a511a5f5a5d472cb88d72661a92ab1.patch;
+      sha256 = "1s3ipf9s41m1lksws3xv3j133q7jnjdqvmgk4sfnm8q7li2dww39";
+    })
+  ];
+
  checkInputs = [ pytest ];

  checkPhase = ''
--- a/pkgs/development/python-modules/hug/default.nix
+++ b/pkgs/development/python-modules/hug/default.nix
@@ -1,27 +1,26 @@
-{ stdenv
-, buildPythonPackage
-, fetchPypi
-, isPy27
+{ lib , buildPythonPackage, fetchPypi, isPy27
 , falcon
+, pytestrunner
 , requests
 }:

 buildPythonPackage rec {
  pname = "hug";
-  version = "2.4.8";
+  version = "2.6.0";
  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "2b33904660d07df3a6a998a52d1a36e2855e56dc9ffc4eddb2158e32d1ce7621";
+    sha256 = "0iamrzjy8z1xibynkgfl6cn2sbm66awxbp75b26pi32fc41d0k50";
  };

+  nativeBuildInputs = [ pytestrunner ];
  propagatedBuildInputs = [ falcon requests ];

  # tests are not shipped in the tarball
  doCheck = false;

-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "A Python framework that makes developing APIs as simple as possible, but no simpler";
    homepage = https://github.com/timothycrosley/hug;
    license = licenses.mit;
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -25,6 +25,8 @@ buildPythonPackage rec {
    "-DCMAKE_POLICY_DEFAULT_CMP0025=NEW"
  ];

+  dontUseCmakeConfigure = true;
+
  preBuild = ''
    export PYARROW_PARALLEL=$NIX_BUILD_CORES
  '';
--- a/pkgs/development/python-modules/pylint/1.9.nix
+++ b/pkgs/development/python-modules/pylint/1.9.nix
@@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "pylint";
-  version = "1.9.4";
+  version = "1.9.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "ee1e85575587c5b58ddafa25e1c1b01691ef172e139fc25585e5d3f02451da93";
+    sha256 = "004kfapkqxqy2s85pmddqv0fabxdxywxrlbi549p0v237pr2v94p";
  };

  checkInputs = [ pytest pytestrunner pyenchant ];
@@ -24,6 +24,8 @@ buildPythonPackage rec {
    pytest pylint/test -k "not ${lib.concatStringsSep " and not " (
      [ # Broken test
        "test_good_comprehension_checks"
+        # requires setuptools
+        "test_pkginfo"
        # See PyCQA/pylint#2535
        "test_libmodule" ] ++
      # Disable broken darwin tests
--- a/pkgs/development/python-modules/pytest/4.nix
+++ b/pkgs/development/python-modules/pytest/4.nix
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -6,6 +6,8 @@ buildPythonPackage rec {
  version = "5.1.0";
  pname = "pytest";

+  disabled = !isPy3k;
+
  preCheck = ''
    # don't test bash builtins
    rm testing/test_argcomplete.py
@@ -19,7 +21,6 @@ buildPythonPackage rec {
  checkInputs = [ hypothesis mock ];
  nativeBuildInputs = [ setuptools_scm ];
  propagatedBuildInputs = [ attrs py setuptools six pluggy more-itertools atomicwrites wcwidth packaging ]
-    ++ stdenv.lib.optionals (!isPy3k) [ funcsigs ]
    ++ stdenv.lib.optionals (pythonOlder "3.6") [ pathlib2 ];

  doCheck = !isPyPy; # https://github.com/pytest-dev/pytest/issues/3460
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -11,6 +11,7 @@
 , attrs
 , pyopenssl
 , service-identity
+, setuptools
 , idna
 }:
 buildPythonPackage rec {
@@ -23,7 +24,7 @@ buildPythonPackage rec {
    sha256 = "294be2c6bf84ae776df2fc98e7af7d6537e1c5e60a46d33c3ce2a197677da395";
  };

-  propagatedBuildInputs = [ zope_interface incremental automat constantly hyperlink pyhamcrest attrs ];
+  propagatedBuildInputs = [ zope_interface incremental automat constantly hyperlink pyhamcrest attrs setuptools ];

  passthru.extras.tls = [ pyopenssl service-identity idna ];

--- a/pkgs/development/python-modules/uamqp/default.nix
+++ b/pkgs/development/python-modules/uamqp/default.nix
@@ -1,24 +1,21 @@
-{ CFNetwork
-, Security
-, buildPythonPackage
+{ lib, buildPythonPackage, fetchPypi, isPy3k
 , certifi
+, CFNetwork
 , cmake
 , enum34
-, fetchPypi
-, isPy3k
-, lib
 , openssl
-, stdenv
+, Security
 , six
+, stdenv
 }:

 buildPythonPackage rec {
  pname = "uamqp";
-  version = "1.1.0";
+  version = "1.2.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "d3d4ff94bf290adb82fe8c19af709a21294bac9b27c821b9110165a34b922015";
+    sha256 = "0wmyw2l2pha5s6khih96lkfa90zyfy2mqsg8cx6vplmrmpx2s52i";
  };

  buildInputs = [
@@ -31,6 +28,8 @@ buildPythonPackage rec {
    CFNetwork Security
  ];

+  dontUseCmakeConfigure = true;
+
  nativeBuildInputs = [
    cmake
  ];
--- a/pkgs/development/python-modules/zeep/default.nix
+++ b/pkgs/development/python-modules/zeep/default.nix
@@ -1,5 +1,6 @@
 { fetchPypi
 , lib
+, fetchpatch
 , buildPythonPackage
 , isPy3k
 , appdirs
@@ -33,6 +34,13 @@ buildPythonPackage rec {
    sha256 = "0e98669cfeb60756231ae185498f9ae21b30b2681786b8de58ed34c3b93e41dd";
  };

+  patches = [
+    ( fetchpatch {
+        url = "https://github.com/mvantellingen/python-zeep/pull/1006/commits/ba7edd6bf2b31023b31e8f17c161e1d6d5af3d29.patch";
+        sha256 = "1j0jd5hmh457im9sbawaqf6pnfy36fhr9wqdim8wk5da9ixr0ajs";
+     })
+  ];
+
  propagatedBuildInputs = [
    appdirs
    attrs
--- a/pkgs/development/ruby-modules/bundler-app/default.nix
+++ b/pkgs/development/ruby-modules/bundler-app/default.nix
@@ -36,7 +36,7 @@
 let
  basicEnv = (callPackage ../bundled-common {}) args;

-  cmdArgs = removeAttrs args [ "pname" "postBuild" "gemConfig" "passthru" "gemset" ] // {
+  cmdArgs = removeAttrs args [ "pname" "postBuild" "gemConfig" "passthru" "gemset" "gemdir" ] // {
    inherit preferLocalBuild allowSubstitutes; # pass the defaults

    buildInputs = buildInputs ++ lib.optional (scripts != []) makeWrapper;
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -19,7 +19,7 @@

 { lib, fetchurl, writeScript, ruby, kerberos, libxml2, libxslt, python, stdenv, which
 , libiconv, postgresql, v8_3_16_14, clang, sqlite, zlib, imagemagick
-, pkgconfig , ncurses, xapian, gpgme, utillinux, fetchpatch, tzdata, icu, libffi
+, pkgconfig , ncurses, xapian, gpgme, utillinux, tzdata, icu, libffi
 , cmake, libssh2, openssl, mysql, darwin, git, perl, pcre, gecode_3, curl
 , msgpack, qt59, libsodium, snappy, libossp_uuid, lxc, libpcap, xorg, gtk2, buildRubyGem
 , cairo, re2, rake, gobject-introspection, gdk-pixbuf, zeromq, czmq, graphicsmagick, libcxx
@@ -613,5 +613,11 @@ in

  zookeeper = attrs: {
    buildInputs = stdenv.lib.optionals stdenv.isDarwin [ darwin.cctools ];
+    dontBuild = false;
+    postPatch = ''
+      sed -i ext/extconf.rb -e "4a \
+        FileUtils.cp '${./zookeeper-ftbfs-with-gcc-8.patch}', 'patches/zkc-3.4.5-gcc-8.patch'
+      "
+    '';
  };
 }
--- a/pkgs/development/ruby-modules/gem-config/zookeeper-ftbfs-with-gcc-8.patch
+++ b/pkgs/development/ruby-modules/gem-config/zookeeper-ftbfs-with-gcc-8.patch
@@ -0,0 +1,11 @@
+--- zkc-3.4.5/c/src/zookeeper.c 2019-09-13 12:05:20.647034862 +0200
+++ zkc-3.4.5/c/src/zookeeper.c 2019-09-13 12:05:49.125360269 +0200
+@@ -3418,7 +3418,7 @@
+ 
+ static const char* format_endpoint_info(const struct sockaddr_storage* ep)
+ {
+-    static char buf[128];
+    static char buf[128 + 6]; // include space for the port :xxxxxx
+     char addrstr[128];
+     void *inaddr;
+ #ifdef WIN32
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, nix, perlPackages, buildEnv, releaseTools, fetchFromGitHub
+{ stdenv, nix, perlPackages, buildEnv, fetchFromGitHub
 , makeWrapper, autoconf, automake, libtool, unzip, pkgconfig, sqlite, libpqxx
 , gitAndTools, mercurial, darcs, subversion, bazaar, openssl, bzip2, libxslt
 , guile, perl, postgresql, nukeReferences, git, boehmgc, nlohmann_json
 , docbook_xsl, openssh, gnused, coreutils, findutils, gzip, lzma, gnutar
-, rpm, dpkg, cdrkit, pixz, lib, fetchpatch, boost, autoreconfHook
+, rpm, dpkg, cdrkit, pixz, lib, boost, autoreconfHook
 }:

 with stdenv;
@@ -67,17 +67,17 @@ let
        boehmgc
      ];
  };
-in releaseTools.nixBuild rec {
+in stdenv.mkDerivation rec {
  pname = "hydra";
-  version = "2019-05-06";
+  version = "2019-08-30";

  inherit stdenv;

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = pname;
-    rev = "ff64583d07f046e378a6be596ec0ce7a9e2b7472";
-    sha256 = "0w88q0saz7si22z3ryim6vdrv9qkwn6l25xfmiapvh5qrnrrdcb9";
+    rev = "242b8b7a314759ed33f69205d26a1b7c337511e0";
+    sha256 = "167ijcf9qdm10kjvqax3hcvs5mpa4mx2y2i9idwwc6xfvn8fhs84";
  };

  buildInputs =
@@ -97,13 +97,6 @@ in releaseTools.nixBuild rec {

  nativeBuildInputs = [ autoreconfHook pkgconfig ];

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/NixOS/hydra/pull/648/commits/4171ab4c4fd576c516dc03ba64d1c7945f769af0.patch";
-      sha256 = "1fxa2459kdws6qc419dv4084c1ssmys7kqg4ic7n643kybamsgrx";
-    })
-  ];
-
  configureFlags = [ "--with-docbook-xsl=${docbook_xsl}/xml/xsl/docbook" ];

  NIX_CFLAGS_COMPILE = [ "-pthread" ];
--- a/pkgs/development/tools/misc/sccache/default.nix
+++ b/pkgs/development/tools/misc/sccache/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cargo, rustc, rustPlatform, pkgconfig, glib, openssl, darwin }:

 rustPlatform.buildRustPackage rec {
-  version = "0.2.10";
+  version = "0.2.11";
  pname = "sccache";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "sccache";
    rev = version;
-    sha256 = "13fiifv3bi9shzp30wd7k2nd2j43vzdhk6z5rnfn5a9hmijqpg9n";
+    sha256 = "0084ddvzjgdpkwqc38kvzaz8n6av9ml3qqlkjma70hsis8w8gqjz";
  };
  cargoSha256 = "1bkglgrasyjyzjj9mwm32d3g3mg5yv74jj3zl7jf20dlq3rg3fh6";

--- a/pkgs/games/tome4/default.nix
+++ b/pkgs/games/tome4/default.nix
@@ -25,6 +25,11 @@ in stdenv.mkDerivation rec {
    sha256 = "0mc5dgh2x9nbili7gy6srjhb23ckalf08wqq2amyjr5rq392jvd7";
  };

+  prePatch = ''
+    # http://forums.te4.org/viewtopic.php?f=42&t=49478&view=next#p234354
+    sed -i 's|#include <GL/glext.h>||' src/tgl.h
+  '';
+
  nativeBuildInputs = [ makeWrapper unzip premake4 ];

  # tome4 vendors quite a few libraries so someone might want to look
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,11 +1,11 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
-    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/tags/";
+    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";

    # Update this if linux_latest-libre fails to build.
-    # $ curl https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/tags/ | grep -Eo 'Revision [0-9]+'
-    rev = "16604";
-    sha256 = "0d2dh52zv073zr74ilspy0fy3ivys5pq32j7fljs4fwi2bcljf51";
+    # $ curl https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/ | grep -Eo 'Revision [0-9]+'
+    rev = "16791";
+    sha256 = "1lpaka4hs7yrpnrzfybd6radjylwvw2p4aly68pypykqs2srvm7j";
  }
 , ...
 }:
@@ -25,7 +25,7 @@ in linux.override {
      name = "${linux.name}-libre-src";
      src = linux.src;
      buildPhase = ''
-        ${scripts}/${majorMinor}-gnu/deblob-${majorMinor} \
+        ${scripts}/${majorMinor}/deblob-${majorMinor} \
            ${major} ${minor} ${patch}
      '';
      checkPhase = ''
--- a/pkgs/servers/documize-community/default.nix
+++ b/pkgs/servers/documize-community/default.nix
@@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "documize-community";
-  version = "3.2.0";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = "documize";
    repo = "community";
    rev = "v${version}";
-    sha256 = "13r0x1mbprhk19a1cikq8cl553xdrxin9arw90am69iv6rcps3w3";
+    sha256 = "1qkc82bvpmgcil88630pnp1irc2w8rzlh702vl0v67vfmawpxpjq";
  };

  goPackagePath = "github.com/documize/community";
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -124,7 +124,7 @@ in with py.pkgs; buildPythonApplication rec {
    # From setup.py
    aiohttp astral async-timeout attrs bcrypt certifi importlib-metadata jinja2
    pyjwt cryptography pip python-slugify pytz pyyaml requests ruamel_yaml
-    voluptuous voluptuous-serialize
+    setuptools voluptuous voluptuous-serialize
    # From http, frontend and recorder components and auth.mfa_modules.totp
    sqlalchemy aiohttp-cors hass-frontend pyotp pyqrcode
  ] ++ componentBuildInputs ++ extraBuildInputs;
--- a/pkgs/servers/mail/mailman/settings.py
+++ b/pkgs/servers/mail/mailman/settings.py
@@ -0,0 +1,512 @@
+# -*- coding: utf-8 -*-
+# Copyright (C) 1998-2019 by the Free Software Foundation, Inc.
+#
+# This file is part of Postorius.
+#
+# Postorius is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option)
+# any later version.
+#
+# Postorius is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+# more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# Postorius.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Django settings for postorius project.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/1.9/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/1.9/ref/settings/
+"""
+
+# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
+import os
+
+# Compatibility with Bootstrap 3
+from django.contrib.messages import constants as messages
+
+
+BASE_DIR = os.path.dirname(os.path.abspath(__file__))
+
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/1.9/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = '$!-7^wl#wiifjbh)5@f7ji%x!vp7s1vzbvwt26hxv$idixq0u0'
+
+# SECURITY WARNING: don't run with debug turned on in production!
+DEBUG = False
+
+ADMINS = (
+    #('Admin', 'webmaster@example.com'),
+)
+
+SITE_ID = 1
+
+# Hosts/domain names that are valid for this site; required if DEBUG is False
+# See https://docs.djangoproject.com/en/1.8/ref/settings/#allowed-hosts
+ALLOWED_HOSTS = [
+    "localhost",  # Archiving API from Mailman, keep it.
+    "127.0.0.1",
+    # Add here all production URLs you may have.
+    @ALLOWED_HOSTS@
+]
+
+# Mailman API credentials
+MAILMAN_REST_API_URL = 'http://localhost:8001'
+MAILMAN_REST_API_USER = 'restadmin'
+MAILMAN_REST_API_PASS = 'restpass'
+MAILMAN_ARCHIVER_KEY = "@ARCHIVER_KEY@"
+MAILMAN_ARCHIVER_FROM = ('127.0.0.1', '::1')
+
+# Application definition
+
+INSTALLED_APPS = (
+    'hyperkitty',
+    'postorius',
+    'django_mailman3',
+    # Uncomment the next line to enable the admin:
+    'django.contrib.admin',
+    # Uncomment the next line to enable admin documentation:
+    # 'django.contrib.admindocs',
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'django.contrib.sessions',
+    'django.contrib.sites',
+    'django.contrib.messages',
+    'django.contrib.staticfiles',
+    'rest_framework',
+    'django_gravatar',
+    'compressor',
+    'haystack',
+    'django_extensions',
+    'django_q',
+    'allauth',
+    'allauth.account',
+    'allauth.socialaccount',
+    'django_mailman3.lib.auth.fedora',
+    'allauth.socialaccount.providers.openid',
+    'allauth.socialaccount.providers.github',
+    'allauth.socialaccount.providers.gitlab',
+    'allauth.socialaccount.providers.google',
+   #'allauth.socialaccount.providers.facebook',
+   #'allauth.socialaccount.providers.twitter',
+    'allauth.socialaccount.providers.stackexchange',
+)
+
+
+MIDDLEWARE = (
+    'django.middleware.security.SecurityMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+    'django_mailman3.middleware.TimezoneMiddleware',
+)
+
+ROOT_URLCONF = 'urls'
+
+
+TEMPLATES = [
+    {
+        'BACKEND': 'django.template.backends.django.DjangoTemplates',
+        'DIRS': [],
+        'APP_DIRS': True,
+        'OPTIONS': {
+            'context_processors': [
+                'django.template.context_processors.debug',
+                'django.template.context_processors.i18n',
+                'django.template.context_processors.media',
+                'django.template.context_processors.static',
+                'django.template.context_processors.tz',
+                'django.template.context_processors.csrf',
+                'django.template.context_processors.request',
+                'django.contrib.auth.context_processors.auth',
+                'django.contrib.messages.context_processors.messages',
+                'django_mailman3.context_processors.common',
+                'hyperkitty.context_processors.common',
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = 'wsgi.application'
+
+
+# Database
+# https://docs.djangoproject.com/en/1.9/ref/settings/#databases
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': '/var/lib/mailman-web/mailman-web.db'
+    }
+}
+
+# Password validation
+# https://docs.djangoproject.com/en/1.9/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
+    },
+]
+
+
+# If you're behind a proxy, use the X-Forwarded-Host header
+# See https://docs.djangoproject.com/en/1.8/ref/settings/#use-x-forwarded-host
+# USE_X_FORWARDED_HOST = True
+
+# And if your proxy does your SSL encoding for you, set SECURE_PROXY_SSL_HEADER
+# https://docs.djangoproject.com/en/1.8/ref/settings/#secure-proxy-ssl-header
+# SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+# SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_SCHEME', 'https')
+
+# Other security settings
+# SECURE_SSL_REDIRECT = True
+# If you set SECURE_SSL_REDIRECT to True, make sure the SECURE_REDIRECT_EXEMPT
+# contains at least this line:
+# SECURE_REDIRECT_EXEMPT = [
+#     "archives/api/mailman/.*",  # Request from Mailman.
+#     ]
+# SESSION_COOKIE_SECURE = True
+# SECURE_CONTENT_TYPE_NOSNIFF = True
+# SECURE_BROWSER_XSS_FILTER = True
+# CSRF_COOKIE_SECURE = True
+# CSRF_COOKIE_HTTPONLY = True
+# X_FRAME_OPTIONS = 'DENY'
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/1.9/topics/i18n/
+
+LANGUAGE_CODE = 'en-us'
+
+TIME_ZONE = 'UTC'
+
+USE_I18N = True
+
+USE_L10N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/1.9/howto/static-files/
+
+
+# Absolute path to the directory static files should be collected to.
+# Don't put anything in this directory yourself; store your static files
+# in apps' "static/" subdirectories and in STATICFILES_DIRS.
+# Example: "/var/www/example.com/static/"
+STATIC_ROOT = 'static'
+
+# URL prefix for static files.
+# Example: "http://example.com/static/", "http://static.example.com/"
+STATIC_URL = '/static/'
+
+# Additional locations of static files
+STATICFILES_DIRS = (
+    # Put strings here, like "/home/html/static" or "C:/www/django/static".
+    # Always use forward slashes, even on Windows.
+    # Don't forget to use absolute paths, not relative paths.
+    # BASE_DIR + '/static/',
+)
+
+# List of finder classes that know how to find static files in
+# various locations.
+STATICFILES_FINDERS = (
+    'django.contrib.staticfiles.finders.FileSystemFinder',
+    'django.contrib.staticfiles.finders.AppDirectoriesFinder',
+    # 'django.contrib.staticfiles.finders.DefaultStorageFinder',
+    'compressor.finders.CompressorFinder',
+)
+
+# Django 1.6+ defaults to a JSON serializer, but it won't work with
+# django-openid, see
+# https://bugs.launchpad.net/django-openid-auth/+bug/1252826
+SESSION_SERIALIZER = 'django.contrib.sessions.serializers.PickleSerializer'
+
+
+LOGIN_URL = 'account_login'
+LOGIN_REDIRECT_URL = 'hk_root'
+LOGOUT_URL = 'account_logout'
+
+
+# If you enable internal authentication, this is the address that the emails
+# will appear to be coming from. Make sure you set a valid domain name,
+# otherwise the emails may get rejected.
+# https://docs.djangoproject.com/en/1.8/ref/settings/#default-from-email
+DEFAULT_FROM_EMAIL = "@SERVER_EMAIL@"
+
+# If you enable email reporting for error messages, this is where those emails
+# will appear to be coming from. Make sure you set a valid domain name,
+# otherwise the emails may get rejected.
+# https://docs.djangoproject.com/en/1.8/ref/settings/#std:setting-SERVER_EMAIL
+SERVER_EMAIL = "@SERVER_EMAIL@"
+
+
+MESSAGE_TAGS = {
+    messages.ERROR: 'danger'
+}
+
+
+#
+# Social auth
+#
+AUTHENTICATION_BACKENDS = (
+    'django.contrib.auth.backends.ModelBackend',
+    'allauth.account.auth_backends.AuthenticationBackend',
+)
+
+# Django Allauth
+ACCOUNT_AUTHENTICATION_METHOD = "username_email"
+ACCOUNT_EMAIL_REQUIRED = True
+ACCOUNT_EMAIL_VERIFICATION = "mandatory"
+ACCOUNT_DEFAULT_HTTP_PROTOCOL = "https"
+ACCOUNT_UNIQUE_EMAIL  = True
+
+SOCIALACCOUNT_PROVIDERS = {
+    'openid': {
+        'SERVERS': [
+            dict(id='yahoo',
+                 name='Yahoo',
+                 openid_url='http://me.yahoo.com'),
+        ],
+    },
+    'google': {
+        'SCOPE': ['profile', 'email'],
+        'AUTH_PARAMS': {'access_type': 'online'},
+    },
+    'facebook': {
+       'METHOD': 'oauth2',
+       'SCOPE': ['email'],
+       'FIELDS': [
+           'email',
+           'name',
+           'first_name',
+           'last_name',
+           'locale',
+           'timezone',
+           ],
+       'VERSION': 'v2.4',
+    },
+    'gitlab': {
+        'GITLAB_URL': 'https://gitlab.com',
+        'SCOPE': ['read_user'],
+    },
+}
+
+
+#
+# Gravatar
+# https://github.com/twaddington/django-gravatar
+#
+# Gravatar base url.
+# GRAVATAR_URL = 'http://cdn.libravatar.org/'
+# Gravatar base secure https url.
+# GRAVATAR_SECURE_URL = 'https://seccdn.libravatar.org/'
+# Gravatar size in pixels.
+# GRAVATAR_DEFAULT_SIZE = '80'
+# An image url or one of the following: 'mm', 'identicon', 'monsterid',
+# 'wavatar', 'retro'.
+# GRAVATAR_DEFAULT_IMAGE = 'mm'
+# One of the following: 'g', 'pg', 'r', 'x'.
+# GRAVATAR_DEFAULT_RATING = 'g'
+# True to use https by default, False for plain http.
+# GRAVATAR_DEFAULT_SECURE = True
+
+# These can be set to override the defaults but are not mandatory:
+# EMAIL_CONFIRMATION_TEMPLATE = 'postorius/address_confirmation_message.txt'
+# EMAIL_CONFIRMATION_SUBJECT = 'Confirmation needed'
+
+#
+# django-compressor
+# https://pypi.python.org/pypi/django_compressor
+#
+COMPRESS_PRECOMPILERS = (
+   ('text/x-scss', '/run/current-system/sw/bin/sassc -t compressed {infile} {outfile}'),
+   ('text/x-sass', '/run/current-system/sw/bin/sassc -t compressed {infile} {outfile}'),
+)
+# On a production setup, setting COMPRESS_OFFLINE to True will bring a
+# significant performance improvement, as CSS files will not need to be
+# recompiled on each requests. It means running an additional "compress"
+# management command after each code upgrade.
+# http://django-compressor.readthedocs.io/en/latest/usage/#offline-compression
+COMPRESS_ENABLED = True
+COMPRESS_OFFLINE = True
+
+# Needed for debug mode
+# INTERNAL_IPS = ('127.0.0.1',)
+
+
+#
+# Full-text search engine
+#
+HAYSTACK_CONNECTIONS = {
+    'default': {
+        'ENGINE': 'haystack.backends.whoosh_backend.WhooshEngine',
+        'PATH': "/var/lib/mailman-web/fulltext_index",
+        # You can also use the Xapian engine, it's faster and more accurate,
+        # but requires another library.
+        # http://django-haystack.readthedocs.io/en/v2.4.1/installing_search_engines.html#xapian
+        # Example configuration for Xapian:
+        #'ENGINE': 'xapian_backend.XapianEngine'
+    },
+}
+
+
+#
+# REST framework
+#
+REST_FRAMEWORK = {
+    'PAGE_SIZE': 10,
+    'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.LimitOffsetPagination',
+    'DEFAULT_FILTER_BACKENDS': (
+        'rest_framework.filters.OrderingFilter',
+    ),
+}
+
+
+#
+# Asynchronous tasks
+#
+Q_CLUSTER = {
+    'timeout': 300,
+    'save_limit': 100,
+    'orm': 'default',
+}
+
+
+# A sample logging configuration. The only tangible logging
+# performed by this configuration is to send an email to
+# the site admins on every HTTP 500 error when DEBUG=False.
+# See http://docs.djangoproject.com/en/dev/topics/logging for
+# more details on how to customize your logging configuration.
+LOGGING = {
+    'version': 1,
+    'disable_existing_loggers': False,
+    'filters': {
+        'require_debug_false': {
+            '()': 'django.utils.log.RequireDebugFalse'
+        }
+    },
+    'handlers': {
+        'console': {
+            'class': 'logging.StreamHandler',
+            'formatter': 'simple',
+        },
+        'mail_admins': {
+            'level': 'ERROR',
+            'filters': ['require_debug_false'],
+            'class': 'django.utils.log.AdminEmailHandler'
+        },
+        'file':{
+            'level': 'INFO',
+            #'class': 'logging.handlers.RotatingFileHandler',
+            'class': 'logging.handlers.WatchedFileHandler',
+            'filename': 'mailman-web.log',
+            'formatter': 'verbose',
+        },
+    },
+    'loggers': {
+        'django': {
+            'handlers': ['console', 'file'],
+            'level': 'INFO',
+        },
+        'django.request': {
+            'handlers': ['console', 'mail_admins', 'file'],
+            'level': 'ERROR',
+            'propagate': True,
+        },
+        'postorius': {
+            'handlers': ['console', 'file'],
+            'level': 'INFO',
+        },
+        'django': {
+            'handlers': ['file'],
+            'level': 'ERROR',
+            'propagate': True,
+        },
+        'hyperkitty': {
+            'handlers': ['file'],
+            'level': 'DEBUG',
+            'propagate': True,
+        },
+    },
+    'formatters': {
+        'simple': {
+            'format': '%(levelname)s: %(message)s'
+        },
+        'verbose': {
+            'format': '%(levelname)s %(asctime)s %(process)d %(name)s %(message)s'
+        },
+        'simple': {
+            'format': '%(levelname)s %(message)s'
+        },
+    },
+    #'root': {
+    #    'handlers': ['file'],
+    #    'level': 'INFO',
+    #},
+}
+
+
+POSTORIUS_TEMPLATE_BASE_URL = "http://localhost:8000"
+
+
+# Using the cache infrastructure can significantly improve performance on a
+# production setup. This is an example with a local Memcached server.
+#CACHES = {
+#    'default': {
+#        'BACKEND': 'django.core.cache.backends.memcached.PyLibMCCache',
+#        'LOCATION': '127.0.0.1:11211',
+#    }
+#}
+
+
+# When DEBUG is True, don't actually send emails to the SMTP server, just store
+# them in a directory. This way you won't accidentally spam your mailing-lists
+# while you're fiddling with the code.
+if DEBUG == True:
+    EMAIL_BACKEND = 'django.core.mail.backends.filebased.EmailBackend'
+    EMAIL_FILE_PATH = '/tmp/hyperkitty-emails'
+
+
+#
+# HyperKitty-specific
+#
+# Only display mailing-lists from the same virtual host as the webserver
+FILTER_VHOST = False
+# Disable singleton locking for Django-Q tasks.
+HYPERKITTY_DISABLE_SINGLETON_TASKS = False
+# Maximum time between two task runs with same function and arguments.
+# This setting is mostly meant for Mailman Developers and should be used
+# with caution.
+# Default set to 10mins.
+HYPERKITTY_TASK_LOCK_TIMEOUT = 10 * 60
+
+
+try:
+    from settings_local import *
+except ImportError:
+    pass
--- a/pkgs/servers/mail/mailman/urls.py
+++ b/pkgs/servers/mail/mailman/urls.py
@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+# Copyright (C) 1998-2019 by the Free Software Foundation, Inc.
+#
+# This file is part of Postorius.
+#
+# Postorius is free software: you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option)
+# any later version.
+#
+# Postorius is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+# more details.
+#
+# You should have received a copy of the GNU General Public License along with
+# Postorius.  If not, see <http://www.gnu.org/licenses/>.
+
+
+from django.conf.urls import include, url
+from django.contrib import admin
+from django.urls import reverse_lazy
+from django.views.generic import RedirectView
+
+
+urlpatterns = [
+    url(r'^$', RedirectView.as_view(url=reverse_lazy('hk_root'))),
+    url(r'^hyperkitty/', include('hyperkitty.urls')),
+    url(r'^postorius/', include('postorius.urls')),
+    url(r'', include('django_mailman3.urls')),
+    url(r'^accounts/', include('allauth.urls')),
+    # Django admin
+    url(r'^admin/', admin.site.urls),
+]
--- a/pkgs/servers/mail/mailman/web.nix
+++ b/pkgs/servers/mail/mailman/web.nix
@@ -0,0 +1,37 @@
+{ stdenv, python, hyperkitty, postorius, buildPythonPackage
+, serverEMail ? "postmaster@example.org"
+, archiverKey ? "SecretArchiverAPIKey"
+, allowedHosts ? []
+}:
+
+let
+
+  allowedHostsString = stdenv.lib.concatMapStringsSep ", " (x: "\""+x+"\"") allowedHosts;
+
+in
+
+# We turn those Djando configuration files into a make-shift Python library so
+# that Nix users can use this package as a part of their buildInputs to import
+# the code. Also, this package implicitly provides an environment in which the
+# Django app can be run.
+
+buildPythonPackage {
+  name = "mailman-web-0";
+
+  propagatedBuildInputs = [ hyperkitty postorius ];
+
+  unpackPhase = ":";
+  buildPhase = ":";
+  setuptoolsCheckPhase = ":";
+
+  installPhase = ''
+    d=$out/${python.sitePackages}
+    install -D -m 444 ${./urls.py} $d/urls.py
+    install -D -m 444 ${./wsgi.py} $d/wsgi.py
+    substitute ${./settings.py} $d/settings.py \
+      --subst-var-by SERVER_EMAIL '${serverEMail}' \
+      --subst-var-by ARCHIVER_KEY '${archiverKey}' \
+      --subst-var-by ALLOWED_HOSTS '${allowedHostsString}'
+    chmod 444 $d/settings.py
+  '';
+}
--- a/pkgs/servers/mail/mailman/wsgi.py
+++ b/pkgs/servers/mail/mailman/wsgi.py
@@ -0,0 +1,17 @@
+"""
+WSGI config for meh project.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/1.9/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "settings")
+
+application = get_wsgi_application()
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -1,10 +1,11 @@
 { stdenv, lib, fetchFromGitHub, cmake, perl
 , file, glib, libevent, luajit, openssl, pcre, pkgconfig, sqlite, ragel, icu
-, hyperscan, libfann, gd, jemalloc, openblas
+, hyperscan, libfann, gd, jemalloc, openblas, lua
 , withFann ? true
 , withGd ? false
 , withBlas ? true
 , withHyperscan ? stdenv.isx86_64
+, withLuaJIT ? stdenv.isx86_64
 }:

 assert withHyperscan -> stdenv.isx86_64;
@@ -24,11 +25,12 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ cmake pkgconfig perl ];
-  buildInputs = [ glib libevent libmagic luajit openssl pcre sqlite ragel icu jemalloc ]
+  buildInputs = [ glib libevent libmagic openssl pcre sqlite ragel icu jemalloc ]
    ++ lib.optional withFann libfann
    ++ lib.optional withGd gd
    ++ lib.optional withHyperscan hyperscan
-    ++ lib.optional withBlas openblas;
+    ++ lib.optional withBlas openblas
+    ++ lib.optional withLuaJIT luajit ++ lib.optional (!withLuaJIT) lua;

  cmakeFlags = [
    "-DDEBIAN_BUILD=ON"
@@ -39,10 +41,11 @@ stdenv.mkDerivation rec {
    "-DENABLE_JEMALLOC=ON"
  ] ++ lib.optional withFann "-DENABLE_FANN=ON"
    ++ lib.optional withHyperscan "-DENABLE_HYPERSCAN=ON"
-    ++ lib.optional withGd "-DENABLE_GD=ON";
+    ++ lib.optional withGd "-DENABLE_GD=ON"
+    ++ lib.optional (!withLuaJIT) "-DENABLE_TORCH=OFF";

  meta = with stdenv.lib; {
-    homepage = https://rspamd.com;
+    homepage = "https://rspamd.com";
    license = licenses.asl20;
    description = "Advanced spam filtering system";
    maintainers = with maintainers; [ avnik fpletz globin ];
--- a/pkgs/servers/radicale/default.nix
+++ b/pkgs/servers/radicale/default.nix
@@ -22,6 +22,7 @@ python3.pkgs.buildPythonApplication rec {
    vobject
    python-dateutil
    passlib
+    setuptools
  ];

  checkInputs = with python3.pkgs; [
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -3,7 +3,7 @@
 , docbook_xml_dtd_42, readline
 , popt, iniparser, libbsd, libarchive, libiconv, gettext
 , krb5Full, zlib, openldap, cups, pam, avahi, acl, libaio, fam, libceph, glusterfs
-, gnutls, ncurses, libunwind, systemd, jansson, lmdb, gpgme
+, gnutls, ncurses, libunwind, systemd, jansson, lmdb, gpgme, libuuid

 , enableLDAP ? false
 , enablePrinting ? false
@@ -20,37 +20,36 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "samba";
-  version = "4.10.6";
+  version = "4.10.8";

  src = fetchurl {
    url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "0hpgdqlyczj98pkh2ldglvvnkrb1q541r3qikdvxq0qjvd9fpywy";
+    sha256 = "1x0hlhb674fndfkmimjicnzs543n3i8465a5ifcmjwvzavxha7y4";
  };

  outputs = [ "out" "dev" "man" ];

-  patches =
-    [ ./4.x-no-persistent-install.patch
-      ./patch-source3__libads__kerberos_keytab.c.patch
-      ./4.x-no-persistent-install-dynconfig.patch
-      ./4.x-fix-makeflags-parsing.patch
-    ];
+  patches = [
+    ./4.x-no-persistent-install.patch
+    ./patch-source3__libads__kerberos_keytab.c.patch
+    ./4.x-no-persistent-install-dynconfig.patch
+    ./4.x-fix-makeflags-parsing.patch
+  ];

  nativeBuildInputs = optionals stdenv.isDarwin [ rpcgen fixDarwinDylibNames ];

-  buildInputs =
-    [ python pkgconfig perl libxslt docbook_xsl docbook_xml_dtd_42 /*
-      docbook_xml_dtd_45 */ readline popt iniparser jansson
-      libbsd libarchive zlib fam libiconv gettext libunwind krb5Full
-    ]
-    ++ optionals stdenv.isLinux [ libaio systemd ]
+  buildInputs = [
+    python pkgconfig perl libxslt docbook_xsl docbook_xml_dtd_42 /*
+    docbook_xml_dtd_45 */ readline popt iniparser jansson
+    libbsd libarchive zlib fam libiconv gettext libunwind krb5Full
+  ] ++ optionals stdenv.isLinux [ libaio systemd ]
    ++ optional enableLDAP openldap
    ++ optional (enablePrinting && stdenv.isLinux) cups
    ++ optional enableMDNS avahi
    ++ optionals enableDomainController [ gnutls gpgme lmdb ]
    ++ optional enableRegedit ncurses
    ++ optional (enableCephFS && stdenv.isLinux) libceph
-    ++ optional (enableGlusterFS && stdenv.isLinux) glusterfs
+    ++ optionals (enableGlusterFS && stdenv.isLinux) [ glusterfs libuuid ]
    ++ optional enableAcl acl
    ++ optional enablePam pam;

@@ -67,25 +66,24 @@ stdenv.mkDerivation rec {
       --replace "bld.SAMBA_BINARY('resolvconftest'" "True or bld.SAMBA_BINARY('resolvconftest'"
  '';

-  configureFlags =
-    [ "--with-static-modules=NONE"
-      "--with-shared-modules=ALL"
-      "--with-system-mitkrb5"
-      "--with-system-mitkdc" krb5Full
-      "--enable-fhs"
-      "--sysconfdir=/etc"
-      "--localstatedir=/var"
-      "--disable-rpath"
-    ]
-    ++ [(if enableDomainController
+  configureFlags = [
+    "--with-static-modules=NONE"
+    "--with-shared-modules=ALL"
+    "--with-system-mitkrb5"
+    "--with-system-mitkdc" krb5Full
+    "--enable-fhs"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--disable-rpath"
+  ] ++ singleton (if enableDomainController
         then "--with-experimental-mit-ad-dc"
-         else "--without-ad-dc")]
+         else "--without-ad-dc")
    ++ optionals (!enableLDAP) [ "--without-ldap" "--without-ads" ]
    ++ optional (!enableAcl) "--without-acl-support"
    ++ optional (!enablePam) "--without-pam";

  preBuild = ''
-      export MAKEFLAGS="-j $NIX_BUILD_CORES"
+    export MAKEFLAGS="-j $NIX_BUILD_CORES"
  '';

  # Some libraries don't have /lib/samba in RPATH but need it.
@@ -105,7 +103,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with stdenv.lib; {
-    homepage = https://www.samba.org/;
+    homepage = "https://www.samba.org";
    description = "The standard Windows interoperability suite of programs for Linux and Unix";
    license = licenses.gpl3;
    platforms = platforms.unix;
--- a/pkgs/servers/samba/master.nix
+++ b/pkgs/servers/samba/master.nix
@@ -1,29 +0,0 @@
-{ fetchFromGitHub
-, samba4
-, nettle
-} :
-
-  (samba4.overrideAttrs(oldAttrs: rec {
-    name = "samba-unstable-${version}";
-    version = "2018-03-09";
-
-    src = fetchFromGitHub {
-      owner = "samba-team";
-      repo = "samba";
-      rev = "9e954bcbf43d67a18ee55f84cda0b09028f96b92";
-      sha256 = "07j1pwm4kax6pq21gq9gpmp7dhj5afdyvkhgyl3yz334mb41q11g";
-    };
-
-    # Remove unnecessary install flags, same as <4.8 patch
-    postPatch = oldAttrs.postPatch + ''
-      sed -i '423,433d' dynconfig/wscript
-    '';
-
-    patches = [ ./4.x-no-persistent-install.patch ];
-    buildInputs = [ nettle ] ++ oldAttrs.buildInputs;
-    meta.branch = "master";
-  })).override {
-    # samba4.8+ removed the ability to disable LDAP.
-    # Enable for base derivation here:
-    enableLDAP = true;
-  }
--- a/pkgs/servers/sql/mariadb/cmake-fix-crypt-libs.patch
+++ b/pkgs/servers/sql/mariadb/cmake-fix-crypt-libs.patch
@@ -1,12 +0,0 @@
-diff --git a/libmariadb/plugins/auth/CMakeLists.txt b/libmariadb/plugins/auth/CMakeLists.txt
-index aa599418..7a51f73b 100644
--- a/libmariadb/plugins/auth/CMakeLists.txt
-+++ b/libmariadb/plugins/auth/CMakeLists.txt
-@@ -50,6 +50,7 @@ IF(WITH_SSL)
-                         ${REF10_SOURCES}
-                         ${CRYPT_SOURCE}
-                 INCLUDES ${REF10_DIR}
-+                LIBRARIES ${ED25519_LIBS}
-                 COMPILE_OPTIONS -DMYSQL_CLIENT=1)
-   IF(MSVC)
-      # Silence conversion (integer truncantion) warnings from reference code
--- a/pkgs/servers/sql/mariadb/cmake-without-plugin-auth-pam.patch
+++ b/pkgs/servers/sql/mariadb/cmake-without-plugin-auth-pam.patch
@@ -0,0 +1,12 @@
+diff --git a/cmake/build_configurations/mysql_release.cmake b/cmake/build_configurations/mysql_release.cmake
+index f7790748..995621e0 100644
+--- a/cmake/build_configurations/mysql_release.cmake
+++ b/cmake/build_configurations/mysql_release.cmake
+@@ -121,7 +121,6 @@ ENDIF()
+ 
+ IF(UNIX)
+   SET(WITH_EXTRA_CHARSETS all CACHE STRING "")
+-  SET(PLUGIN_AUTH_PAM YES)
+ 
+   IF(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+     IF(NOT IGNORE_AIO_CHECK)
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, fetchFromGitHub, cmake, pkgconfig, makeWrapper, ncurses, zlib, xz, lzo, lz4, bzip2, snappy
-, libiconv, openssl, pcre, boost, judy, bison, libxml2, libkrb5
+, libiconv, openssl, pcre, boost, judy, bison, libxml2, libkrb5, linux-pam, curl
 , libaio, libevent, jemalloc, cracklib, systemd, numactl, perl
 , fixDarwinDylibNames, cctools, CoreServices
 , asio, buildEnv, check, scons
@@ -28,21 +28,21 @@ galeraLibs = buildEnv {
 };

 common = rec { # attributes common to both builds
-  version = "10.3.17";
+  version = "10.3.18";

  src = fetchurl {
    urls = [
      "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz"
      "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz"
    ];
-    sha256 = "15vh15az16932q42y9dxpzwxldmh0x4hvzrar3f8kblsqm7ym890";
+    sha256 = "1p6yvmahnkmsz50zjzp20ak7jzbqysly5bdl51nnrngrbfl6qib9";
    name   = "mariadb-${version}.tar.gz";
  };

  nativeBuildInputs = [ cmake pkgconfig ];

  buildInputs = [
-    ncurses openssl zlib pcre jemalloc libiconv
+    ncurses openssl zlib pcre jemalloc libiconv curl
  ] ++ optionals stdenv.isLinux [ libaio systemd libkrb5 ]
    ++ optionals stdenv.isDarwin [ perl fixDarwinDylibNames cctools CoreServices ];

@@ -53,7 +53,6 @@ common = rec { # attributes common to both builds
  patches = [
    ./cmake-includedir.patch
    ./cmake-libmariadb-includedir.patch
-    ./cmake-fix-crypt-libs.patch
  ];

  cmakeFlags = [
@@ -68,7 +67,7 @@ common = rec { # attributes common to both builds
    "-DINSTALL_DOCDIR=share/doc/mysql"
    "-DINSTALL_DOCREADMEDIR=share/doc/mysql"
    "-DINSTALL_INCLUDEDIR=include/mysql"
-    "-DINSTALL_LIBDIR=lib/mysql"
+    "-DINSTALL_LIBDIR=lib"
    "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
    "-DINSTALL_INFODIR=share/mysql/docs"
    "-DINSTALL_MANDIR=share/man"
@@ -97,7 +96,7 @@ common = rec { # attributes common to both builds
  postInstall = ''
    rm "$out"/lib/mysql/plugin/daemon_example.ini
    mkdir -p "$dev"/bin && mv "$out"/bin/{mariadb_config,mysql_config} "$dev"/bin
-    mkdir -p "$dev"/lib/mysql && mv "$out"/lib/mysql/{libmariadbclient.a,libmysqlclient.a,libmysqlclient_r.a,libmysqlservices.a} "$dev"/lib/mysql
+    mkdir -p "$dev"/lib/ && mv "$out"/lib/{libmariadbclient.a,libmysqlclient.a,libmysqlclient_r.a,libmysqlservices.a} "$dev"/lib
    mkdir -p "$dev"/lib/mysql/plugin && mv "$out"/lib/mysql/plugin/{caching_sha2_password.so,dialog.so,mysql_clear_password.so,sha256_password.so} "$dev"/lib/mysql/plugin
  '';

@@ -123,6 +122,7 @@ client = stdenv.mkDerivation (common // {

  patches = common.patches ++ [
    ./cmake-plugin-includedir.patch
+    ./cmake-without-plugin-auth-pam.patch
  ];

  cmakeFlags = common.cmakeFlags ++ [
@@ -136,14 +136,13 @@ client = stdenv.mkDerivation (common // {
      -DCMAKE_INSTALL_PREFIX_DEV=$dev"
  '';

-  postInstall =  common.postInstall + ''
+  postInstall = common.postInstall + ''
    rm -r "$out"/share/doc
    rm "$out"/bin/{mysqltest,mytop,wsrep_sst_rsync_wan}
-    libmysqlclient_path=$(readlink -f $out/lib/mysql/libmysqlclient${libExt})
-    rm "$out"/lib/mysql/{libmariadb${libExt},libmysqlclient${libExt},libmysqlclient_r${libExt}}
-    mv "$libmysqlclient_path" "$out"/lib/mysql/libmysqlclient${libExt}
-    ln -sv libmysqlclient${libExt} "$out"/lib/mysql/libmysqlclient_r${libExt}
-
+    libmysqlclient_path=$(readlink -f $out/lib/libmysqlclient${libExt})
+    rm "$out"/lib/{libmariadb${libExt},libmysqlclient${libExt},libmysqlclient_r${libExt}}
+    mv "$libmysqlclient_path" "$out"/lib/libmysqlclient${libExt}
+    ln -sv libmysqlclient${libExt} "$out"/lib/libmysqlclient_r${libExt}
  '';
 });

@@ -158,6 +157,7 @@ server = stdenv.mkDerivation (common // {
    xz lzo lz4 bzip2 snappy
    libxml2 boost judy libevent cracklib
  ] ++ optional (stdenv.isLinux && !stdenv.isAarch32) numactl
+    ++ optional stdenv.isLinux linux-pam
    ++ optional (!stdenv.isDarwin) mytopEnv;

  patches = common.patches ++ [
@@ -166,7 +166,6 @@ server = stdenv.mkDerivation (common // {

  cmakeFlags = common.cmakeFlags ++ [
    "-DMYSQL_DATADIR=/var/lib/mysql"
-    "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
    "-DENABLED_LOCAL_INFILE=OFF"
    "-DWITH_READLINE=ON"
    "-DWITH_EXTRA_CHARSETS=all"
@@ -196,7 +195,7 @@ server = stdenv.mkDerivation (common // {
    chmod +x "$out"/bin/wsrep_sst_common
    rm "$out"/bin/mysql_client_test
    rm -r "$out"/data # Don't need testing data
-    rm "$out"/lib/mysql/{libmysqlclient${libExt},libmysqlclient_r${libExt}}
+    rm "$out"/lib/{libmysqlclient${libExt},libmysqlclient_r${libExt}}
    mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
  '' + optionalString withoutClient ''
    ${ # We don't build with GSSAPI on Darwin
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -25,6 +25,8 @@ in stdenv.mkDerivation {

  enableParallelBuilding = true;

+  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+
  # disable dvbscan, as having it enabled causes a network download which
  # cannot happen during build.
  configureFlags = [
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@@ -174,6 +174,7 @@ in stdenv.mkDerivation rec {
      perlFlags="$perlFlags -I$i"
    done

+    mkdir -p $out/libexec
    for f in $out/bin/*.pl ; do
      mv $f $out/libexec/
      makeWrapper ${perlBin} $f \
@@ -186,7 +187,7 @@ in stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "Video surveillance software system";
-    homepage = https://zoneminder.com;
+    homepage = "https://zoneminder.com";
    license = licenses.gpl3;
    maintainers = with maintainers; [ peterhoeg ];
    platforms = platforms.unix;
--- a/pkgs/tools/backup/bareos/default.nix
+++ b/pkgs/tools/backup/bareos/default.nix
@@ -77,5 +77,6 @@ stdenv.mkDerivation rec {
    description = "A fork of the bacula project";
    license = licenses.agpl3;
    platforms = platforms.unix;
+    broken = true;
  };
 }
--- a/pkgs/tools/filesystems/netatalk/default.nix
+++ b/pkgs/tools/filesystems/netatalk/default.nix
@@ -1,6 +1,6 @@
 { fetchurl, stdenv, autoreconfHook, pkgconfig, perl, python
 , db, libgcrypt, avahi, libiconv, pam, openssl, acl
-, ed, glibc
+, ed, glibc, libevent
 }:

 stdenv.mkDerivation rec{
@@ -18,12 +18,13 @@ stdenv.mkDerivation rec{

  nativeBuildInputs = [ autoreconfHook pkgconfig perl python python.pkgs.wrapPython ];

-  buildInputs = [ db libgcrypt avahi libiconv pam openssl acl ];
+  buildInputs = [ db libgcrypt avahi libiconv pam openssl acl libevent ];

  configureFlags = [
    "--with-bdb=${db.dev}"
    "--with-ssl-dir=${openssl.dev}"
    "--with-lockfile=/run/lock/netatalk"
+    "--with-libevent=${libevent.dev}"
    "--localstatedir=/var/lib"
  ];

--- a/pkgs/tools/graphics/appleseed/default.nix
+++ b/pkgs/tools/graphics/appleseed/default.nix
@@ -24,7 +24,16 @@ in stdenv.mkDerivation rec {
    osl seexpr makeWrapper
  ];

-  NIX_CFLAGS_COMPILE = "-I${openexr.dev}/include/OpenEXR -I${ilmbase.dev}/include/OpenEXR -I${openimageio.dev}/include/OpenImageIO -Wno-unused-but-set-variable";
+  NIX_CFLAGS_COMPILE = [
+    "-I${openexr.dev}/include/OpenEXR"
+    "-I${ilmbase.dev}/include/OpenEXR"
+    "-I${openimageio.dev}/include/OpenImageIO"
+
+    "-Wno-unused-but-set-variable"
+    "-Wno-error=class-memaccess"
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=catch-value"
+  ];

  cmakeFlags = [
      "-DUSE_EXTERNAL_XERCES=ON" "-DUSE_EXTERNAL_OCIO=ON" "-DUSE_EXTERNAL_OIIO=ON"
--- a/Show More
+++ b/Show More