Merge remote-tracking branch 'upstream/release-18.09' into haskell-no-rec-18.09

doc/cross-compilation.xml

@@ -47,9 +47,13 @@
 
    <para>
     In Nixpkgs, these three platforms are defined as attribute sets under the
-    names <literal>buildPlatform</literal>, <literal>hostPlatform</literal>, and
-    <literal>targetPlatform</literal>. They are always defined as attributes in
-    the standard environment. That means one can access them like:
+    names <literal>buildPlatform</literal>, <literal>hostPlatform</literal>,
+    and <literal>targetPlatform</literal>. All three are always defined as
+    attributes in the standard environment, and at the top level. That means
+    one can get at them just like a dependency in a function that is imported
+    with <literal>callPackage</literal>:
+<programlisting>{ stdenv, buildPlatform, hostPlatform, fooDep, barDep, .. }: ...buildPlatform...</programlisting>
+    , or just off <varname>stdenv</varname>:
 <programlisting>{ stdenv, fooDep, barDep, .. }: ...stdenv.buildPlatform...</programlisting>
     .
    </para>

doc/functions.xml

@@ -628,6 +628,48 @@ merge:"diff3"
      <literal>pkgs.cacert</literal> to <varname>contents</varname>.
     </para>
    </note>
+
+   <example xml:id="example-pkgs-dockerTools-buildImage-creation-date">
+     <title>Impurely Defining a Docker Layer's Creation Date</title>
+     <para>
+       By default <function>buildImage</function> will use a static
+       date of one second past the UNIX Epoch. This allows
+       <function>buildImage</function> to produce binary reproducible
+       images. When listing images with <command>docker list
+       images</command>, the newly created images will be listed like
+       this:
+     </para>
+     <screen><![CDATA[
+$ docker image list
+REPOSITORY   TAG      IMAGE ID       CREATED        SIZE
+hello        latest   08c791c7846e   48 years ago   25.2MB
+]]></screen>
+     <para>
+       You can break binary reproducibility but have a sorted,
+       meaningful <literal>CREATED</literal> column by setting
+       <literal>created</literal> to <literal>now</literal>.
+     </para>
+     <programlisting><![CDATA[
+pkgs.dockerTools.buildImage {
+  name = "hello";
+  tag = "latest";
+  created = "now";
+  contents = pkgs.hello;
+
+  config.Cmd = [ "/bin/hello" ];
+}
+]]></programlisting>
+     <para>
+       and now the Docker CLI will display a reasonable date and
+       sort the images as expected:
+       <screen><![CDATA[
+$ docker image list
+REPOSITORY   TAG      IMAGE ID       CREATED              SIZE
+hello        latest   de2bf4786de6   About a minute ago   25.2MB
+]]></screen>
+       however, the produced images will not be binary reproducible.
+     </para>
+   </example>
   </section>
 
   <section xml:id="ssec-pkgs-dockerTools-fetchFromRegistry">

doc/languages-frameworks/rust.section.md

@@ -64,9 +64,6 @@ When the `Cargo.lock`, provided by upstream, is not in sync with the
 added in `cargoPatches` will also be prepended to the patches in `patches` at
 build-time.
 
-To install crates with nix there is also an experimental project called
-[nixcrates](https://github.com/fractalide/nixcrates).
-
 ## Compiling Rust crates using Nix instead of Cargo
 
 ### Simple operation

doc/languages-frameworks/vim.section.md

@@ -5,11 +5,16 @@ date: 2016-06-25
 ---
 # User's Guide to Vim Plugins/Addons/Bundles/Scripts in Nixpkgs
 
-You'll get a vim(-your-suffix) in PATH also loading the plugins you want.
+Both Neovim and Vim can be configured to include your favorite plugins
+and additional libraries.
+
 Loading can be deferred; see examples.
 
-Vim packages, VAM (=vim-addon-manager) and Pathogen are supported to load
-packages.
+At the moment we support three different methods for managing plugins:
+
+- Vim packages (*recommend*)
+- VAM (=vim-addon-manager)
+- Pathogen
 
 ## Custom configuration
 
@@ -25,7 +30,19 @@ vim_configurable.customize {
 }
 ```
 
-## Vim packages
+For Neovim the `configure` argument can be overridden to achieve the same:
+
+```
+neovim.override {
+  configure = {
+    customRC = ''
+      # here your custom configuration goes!
+    '';
+  };
+}
+```
+
+## Managing plugins with Vim packages
 
 To store you plugins in Vim packages the following example can be used:
 
@@ -38,13 +55,50 @@ vim_configurable.customize {
     opt = [ phpCompletion elm-vim ];
     # To automatically load a plugin when opening a filetype, add vimrc lines like:
     # autocmd FileType php :packadd phpCompletion
-  }
-};
+  };
+}
 ```
 
-## VAM
+For Neovim the syntax is
 
-### dependencies by Vim plugins
+```
+neovim.override {
+  configure = {
+    customRC = ''
+      # here your custom configuration goes!
+    '';
+    packages.myVimPackage = with pkgs.vimPlugins; {
+      # see examples below how to use custom packages
+      start = [ ];
+      opt = [ ];
+    };
+  };
+}
+```
+
+The resulting package can be added to `packageOverrides` in `~/.nixpkgs/config.nix` to make it installable:
+
+```
+{
+  packageOverrides = pkgs: with pkgs; {
+    myVim = vim_configurable.customize {
+      name = "vim-with-plugins";
+      # add here code from the example section
+    };
+    myNeovim = neovim.override {
+      configure = {
+      # add here code from the example section
+      };
+    };
+  };
+}
+```
+
+After that you can install your special grafted `myVim` or `myNeovim` packages.
+
+## Managing plugins with VAM
+
+### Handling dependencies of Vim plugins
 
 VAM introduced .json files supporting dependencies without versioning
 assuming that "using latest version" is ok most of the time.

doc/package-notes.xml

@@ -671,6 +671,8 @@ overrides = self: super: rec {
     plugins = with availablePlugins; [ python perl ];
   }
 }</programlisting>
+    If the <literal>configure</literal> function returns an attrset without the <literal>plugins</literal>
+    attribute, <literal>availablePlugins</literal> will be used automatically.
   </para>
 
   <para>
@@ -704,6 +706,55 @@ overrides = self: super: rec {
 }; }
 </programlisting>
   </para>
+  <para>
+    WeeChat allows to set defaults on startup using the <literal>--run-command</literal>.
+    The <literal>configure</literal> method can be used to pass commands to the program:
+<programlisting>weechat.override {
+  configure = { availablePlugins, ... }: {
+    init = ''
+      /set foo bar
+      /server add freenode chat.freenode.org
+    '';
+  };
+}</programlisting>
+    Further values can be added to the list of commands when running
+    <literal>weechat --run-command "your-commands"</literal>.
+  </para>
+  <para>
+    Additionally it's possible to specify scripts to be loaded when starting <literal>weechat</literal>.
+    These will be loaded before the commands from <literal>init</literal>:
+<programlisting>weechat.override {
+  configure = { availablePlugins, ... }: {
+    scripts = with pkgs.weechatScripts; [
+      weechat-xmpp weechat-matrix-bridge wee-slack
+    ];
+    init = ''
+      /set plugins.var.python.jabber.key "val"
+    '':
+  };
+}</programlisting>
+  </para>
+  <para>
+    In <literal>nixpkgs</literal> there's a subpackage which contains derivations for
+    WeeChat scripts. Such derivations expect a <literal>passthru.scripts</literal> attribute
+    which contains a list of all scripts inside the store path. Furthermore all scripts
+    have to live in <literal>$out/share</literal>. An exemplary derivation looks like this:
+<programlisting>{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  name = "exemplary-weechat-script";
+  src = fetchurl {
+    url = "https://scripts.tld/your-scripts.tar.gz";
+    sha256 = "...";
+  };
+  passthru.scripts = [ "foo.py" "bar.lua" ];
+  installPhase = ''
+    mkdir $out/share
+    cp foo.py $out/share
+    cp bar.lua $out/share
+  '';
+}</programlisting>
+  </para>
  </section>
  <section xml:id="sec-citrix">
   <title>Citrix Receiver</title>

lib/licenses.nix

@@ -355,6 +355,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Independent JPEG Group License";
   };
 
+  imagemagick = spdx {
+    fullName = "ImageMagick License";
+    spdxId = "imagemagick";
+  };
+
   inria-compcert = {
     fullName  = "INRIA Non-Commercial License Agreement for the CompCert verified compiler";
     url       = "http://compcert.inria.fr/doc/LICENSE";

lib/minver.nix

@@ -1,2 +1,2 @@
 # Expose the minimum required version for evaluating Nixpkgs
-"2.0"
+"1.11"

lib/trivial.nix

@@ -36,18 +36,18 @@ rec {
 
   /* bitwise “and” */
   bitAnd = builtins.bitAnd
-    or import ./zip-int-bits.nix
-      (a: b: if a==1 && b==1 then 1 else 0);
+    or (import ./zip-int-bits.nix
+        (a: b: if a==1 && b==1 then 1 else 0));
 
   /* bitwise “or” */
   bitOr = builtins.bitOr
-    or import ./zip-int-bits.nix
-      (a: b: if a==1 || b==1 then 1 else 0);
+    or (import ./zip-int-bits.nix
+        (a: b: if a==1 || b==1 then 1 else 0));
 
   /* bitwise “xor” */
   bitXor = builtins.bitXor
-    or import ./zip-int-bits.nix
-      (a: b: if a!=b then 1 else 0);
+    or (import ./zip-int-bits.nix
+        (a: b: if a!=b then 1 else 0));
 
   /* bitwise “not” */
   bitNot = builtins.sub (-1);

nixos/doc/manual/default.nix

@@ -90,7 +90,9 @@ let
     fi
     ${buildPackages.libxslt.bin}/bin/xsltproc \
       --stringparam revision '${revision}' \
-      -o $out ${./options-to-docbook.xsl} $optionsXML
+      -o intermediate.xml ${./options-to-docbook.xsl} $optionsXML
+    ${buildPackages.libxslt.bin}/bin/xsltproc \
+      -o "$out" ${./postprocess-option-descriptions.xsl} intermediate.xml
   '';
 
   sources = lib.sourceFilesBySuffices ./. [".xml"];

nixos/doc/manual/installation/upgrading.xml

@@ -52,10 +52,13 @@
    </listitem>
   </itemizedlist>
   To see what channels are available, go to
-  <link
-xlink:href="https://nixos.org/channels"/>. (Note that the URIs of the
+  <link xlink:href="https://nixos.org/channels"/>. (Note that the URIs of the
   various channels redirect to a directory that contains the channel’s latest
-  version and includes ISO images and VirtualBox appliances.)
+  version and includes ISO images and VirtualBox appliances.) Please note that
+  during the release process, channels that are not yet released will be
+  present here as well. See the Getting NixOS page
+  <link xlink:href="https://nixos.org/nixos/download.html"/> to find the newest
+  supported stable release.
  </para>
  <para>
   When you first install NixOS, you’re automatically subscribed to the NixOS

nixos/doc/manual/options-to-docbook.xsl

@@ -4,6 +4,7 @@
                 xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                 xmlns:str="http://exslt.org/strings"
                 xmlns:xlink="http://www.w3.org/1999/xlink"
+                xmlns:nixos="tag:nixos.org"
                 xmlns="http://docbook.org/ns/docbook"
                 extension-element-prefixes="str"
                 >
@@ -30,10 +31,12 @@
 
             <listitem>
 
-              <para>
-                <xsl:value-of disable-output-escaping="yes"
-                              select="attr[@name = 'description']/string/@value" />
-              </para>
+              <nixos:option-description>
+                <para>
+                  <xsl:value-of disable-output-escaping="yes"
+                                select="attr[@name = 'description']/string/@value" />
+                </para>
+              </nixos:option-description>
 
               <xsl:if test="attr[@name = 'type']">
                 <para>

nixos/doc/manual/postprocess-option-descriptions.xsl

@@ -0,0 +1,115 @@
+<?xml version="1.0"?>
+
+<xsl:stylesheet version="1.0"
+                xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+                xmlns:str="http://exslt.org/strings"
+                xmlns:exsl="http://exslt.org/common"
+                xmlns:db="http://docbook.org/ns/docbook"
+                xmlns:nixos="tag:nixos.org"
+                extension-element-prefixes="str exsl">
+  <xsl:output method='xml' encoding="UTF-8" />
+
+  <xsl:template match="@*|node()">
+    <xsl:copy>
+      <xsl:apply-templates select="@*|node()" />
+    </xsl:copy>
+  </xsl:template>
+
+  <xsl:template name="break-up-description">
+    <xsl:param name="input" />
+    <xsl:param name="buffer" />
+
+    <!-- Every time we have two newlines following each other, we want to
+         break it into </para><para>. -->
+    <xsl:variable name="parbreak" select="'&#xa;&#xa;'" />
+
+    <!-- Similar to "(head:tail) = input" in Haskell. -->
+    <xsl:variable name="head" select="$input[1]" />
+    <xsl:variable name="tail" select="$input[position() &gt; 1]" />
+
+    <xsl:choose>
+      <xsl:when test="$head/self::text() and contains($head, $parbreak)">
+        <!-- If the haystack provided to str:split() directly starts or
+             ends with $parbreak, it doesn't generate a <token/> for that,
+             so we are doing this here. -->
+        <xsl:variable name="splitted-raw">
+          <xsl:if test="starts-with($head, $parbreak)"><token /></xsl:if>
+          <xsl:for-each select="str:split($head, $parbreak)">
+            <token><xsl:value-of select="node()" /></token>
+          </xsl:for-each>
+          <!-- Something like ends-with($head, $parbreak), but there is
+               no ends-with() in XSLT, so we need to use substring(). -->
+          <xsl:if test="
+            substring($head, string-length($head) -
+                             string-length($parbreak) + 1) = $parbreak
+          "><token /></xsl:if>
+        </xsl:variable>
+        <xsl:variable name="splitted"
+                      select="exsl:node-set($splitted-raw)/token" />
+        <!-- The buffer we had so far didn't contain any text nodes that
+             contain a $parbreak, so we can put the buffer along with the
+             first token of $splitted into a para element. -->
+        <para xmlns="http://docbook.org/ns/docbook">
+          <xsl:apply-templates select="exsl:node-set($buffer)" />
+          <xsl:apply-templates select="$splitted[1]/node()" />
+        </para>
+        <!-- We have already emitted the first splitted result, so the
+             last result is going to be set as the new $buffer later
+             because its contents may not be directly followed up by a
+             $parbreak. -->
+        <xsl:for-each select="$splitted[position() &gt; 1
+                              and position() &lt; last()]">
+          <para xmlns="http://docbook.org/ns/docbook">
+            <xsl:apply-templates select="node()" />
+          </para>
+        </xsl:for-each>
+        <xsl:call-template name="break-up-description">
+          <xsl:with-param name="input" select="$tail" />
+          <xsl:with-param name="buffer" select="$splitted[last()]/node()" />
+        </xsl:call-template>
+      </xsl:when>
+      <!-- Either non-text node or one without $parbreak, which we just
+           want to buffer and continue recursing. -->
+      <xsl:when test="$input">
+        <xsl:call-template name="break-up-description">
+          <xsl:with-param name="input" select="$tail" />
+          <!-- This essentially appends $head to $buffer. -->
+          <xsl:with-param name="buffer">
+            <xsl:if test="$buffer">
+              <xsl:for-each select="exsl:node-set($buffer)">
+                <xsl:apply-templates select="." />
+              </xsl:for-each>
+            </xsl:if>
+            <xsl:apply-templates select="$head" />
+          </xsl:with-param>
+        </xsl:call-template>
+      </xsl:when>
+      <!-- No more $input, just put the remaining $buffer in a para. -->
+      <xsl:otherwise>
+        <para xmlns="http://docbook.org/ns/docbook">
+          <xsl:apply-templates select="exsl:node-set($buffer)" />
+        </para>
+      </xsl:otherwise>
+    </xsl:choose>
+  </xsl:template>
+
+  <xsl:template match="nixos:option-description">
+    <xsl:choose>
+      <!--
+        Only process nodes that are comprised of a single <para/> element,
+        because if that's not the case the description already contains
+        </para><para> in between and we need no further processing.
+      -->
+      <xsl:when test="count(db:para) > 1">
+        <xsl:apply-templates select="node()" />
+      </xsl:when>
+      <xsl:otherwise>
+        <xsl:call-template name="break-up-description">
+          <xsl:with-param name="input"
+                          select="exsl:node-set(db:para/node())" />
+        </xsl:call-template>
+      </xsl:otherwise>
+    </xsl:choose>
+  </xsl:template>
+
+</xsl:stylesheet>

nixos/modules/config/shells-environment.nix

@@ -163,15 +163,24 @@ in
         /bin/sh
       '';
 
+    # For resetting environment with `. /etc/set-environment` when needed
+    # and discoverability (see motivation of #30418).
+    environment.etc."set-environment".source = config.system.build.setEnvironment;
+
     system.build.setEnvironment = pkgs.writeText "set-environment"
-       ''
-         ${exportedEnvVars}
+      ''
+        # DO NOT EDIT -- this file has been generated automatically.
 
-         ${cfg.extraInit}
+        # Prevent this file from being sourced by child shells.
+        export __NIXOS_SET_ENVIRONMENT_DONE=1
 
-         # ~/bin if it exists overrides other bin directories.
-         export PATH="$HOME/bin:$PATH"
-       '';
+        ${exportedEnvVars}
+
+        ${cfg.extraInit}
+
+        # ~/bin if it exists overrides other bin directories.
+        export PATH="$HOME/bin:$PATH"
+      '';
 
     system.activationScripts.binsh = stringAfter [ "stdio" ]
       ''

nixos/modules/config/xdg/mime.nix

@@ -23,7 +23,7 @@ with lib;
     ];
 
     environment.extraSetup = ''
-      if [ -w $out/share/mime ]; then
+      if [ -w $out/share/mime ] && [ -d $out/share/mime/packages ]; then
         XDG_DATA_DIRS=$out/share ${pkgs.shared-mime-info}/bin/update-mime-database -V $out/share/mime > /dev/null
       fi
 

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -233,7 +233,7 @@ let
             "
     # Make our own efi program, we can't rely on "grub-install" since it seems to
     # probe for devices, even with --skip-fs-probe.
-    ${pkgs.grub2_efi}/bin/grub-mkimage -o $out/EFI/boot/${if targetArch == "x64" then "bootx64" else "bootx32"}.efi -p /EFI/boot -O ${if targetArch == "x64" then "x86_64" else "i386"}-efi \
+    ${pkgs.grub2_efi}/bin/grub-mkimage -o $out/EFI/boot/${if targetArch == "x64" then "bootx64" else "bootia32"}.efi -p /EFI/boot -O ${if targetArch == "x64" then "x86_64" else "i386"}-efi \
       $MODULES
     cp ${pkgs.grub2_efi}/share/grub/unicode.pf2 $out/EFI/boot/
 

nixos/modules/installer/tools/nix-fallback-paths.nix

@@ -1,6 +1,6 @@
 {
-  x86_64-linux = "/nix/store/0d60i73mcv8z1m8d2m74yfn84980gfsa-nix-2.0.4";
-  i686-linux = "/nix/store/6ssafj2s5a2g9x28yld7b70vwd6vw6lb-nix-2.0.4";
-  aarch64-linux = "/nix/store/3wwch7bp7n7xsl8apgy2a4b16yzyij1z-nix-2.0.4";
-  x86_64-darwin = "/nix/store/771l8i0mz4c8kry8cz3sz8rr3alalckg-nix-2.0.4";
+  x86_64-linux = "/nix/store/h180y3n5k1ypxgm1pcvj243qix5j45zz-nix-2.1.1";
+  i686-linux = "/nix/store/v2y4k4v9ml07jmfq739wyflapg3b7b5k-nix-2.1.1";
+  aarch64-linux = "/nix/store/v485craglq7xm5996ci8qy5dyc17dab0-nix-2.1.1";
+  x86_64-darwin = "/nix/store/lc3ymlix73kaad5srjdgaxp9ngr1sg6g-nix-2.1.1";
 }

nixos/modules/misc/version.nix

@@ -68,7 +68,7 @@ in
     defaultChannel = mkOption {
       internal = true;
       type = types.str;
-      default = https://nixos.org/channels/nixos-unstable;
+      default = https://nixos.org/channels/nixos-18.09;
       description = "Default NixOS channel to which the root user is subscribed.";
     };
 

nixos/modules/module-list.nix

@@ -406,6 +406,7 @@
   ./services/misc/taskserver
   ./services/misc/tzupdate.nix
   ./services/misc/uhub.nix
+  ./services/misc/weechat.nix
   ./services/misc/xmr-stak.nix
   ./services/misc/zookeeper.nix
   ./services/monitoring/apcupsd.nix

nixos/modules/profiles/graphical.nix

@@ -11,5 +11,5 @@
     libinput.enable = true; # for touchpad support on many laptops
   };
 
-  environment.systemPackages = [ pkgs.glxinfo ];
+  environment.systemPackages = [ pkgs.glxinfo pkgs.firefox ];
 }

nixos/modules/programs/bash/bash.nix

@@ -126,7 +126,9 @@ in
     programs.bash = {
 
       shellInit = ''
-        ${config.system.build.setEnvironment.text}
+        if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
+            . ${config.system.build.setEnvironment}
+        fi
 
         ${cfge.shellInit}
       '';
@@ -166,11 +168,11 @@ in
 
         # Read system-wide modifications.
         if test -f /etc/profile.local; then
-          . /etc/profile.local
+            . /etc/profile.local
         fi
 
         if [ -n "''${BASH_VERSION:-}" ]; then
-          . /etc/bashrc
+            . /etc/bashrc
         fi
       '';
 
@@ -191,12 +193,12 @@ in
 
         # We are not always an interactive shell.
         if [ -n "$PS1" ]; then
-          ${cfg.interactiveShellInit}
+            ${cfg.interactiveShellInit}
         fi
 
         # Read system-wide modifications.
         if test -f /etc/bashrc.local; then
-          . /etc/bashrc.local
+            . /etc/bashrc.local
         fi
       '';
 

nixos/modules/programs/fish.nix

@@ -27,7 +27,7 @@ in
         '';
         type = types.bool;
       };
-      
+
       vendor.config.enable = mkOption {
         type = types.bool;
         default = true;
@@ -43,7 +43,7 @@ in
           Whether fish should use completion files provided by other packages.
         '';
       };
-      
+
       vendor.functions.enable = mkOption {
         type = types.bool;
         default = true;
@@ -107,9 +107,11 @@ in
       # This happens before $__fish_datadir/config.fish sets fish_function_path, so it is currently
       # unset. We set it and then completely erase it, leaving its configuration to $__fish_datadir/config.fish
       set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $__fish_datadir/functions
-      
+
       # source the NixOS environment config
-      fenv source ${config.system.build.setEnvironment}
+      if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]
+          fenv source ${config.system.build.setEnvironment}
+      end
 
       # clear fish_function_path so that it will be correctly set when we return to $__fish_datadir/config.fish
       set -e fish_function_path
@@ -123,7 +125,7 @@ in
         set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path
         fenv source /etc/fish/foreign-env/shellInit > /dev/null
         set -e fish_function_path[1]
-        
+
         ${cfg.shellInit}
 
         # and leave a note so we don't source this config section again from
@@ -137,7 +139,7 @@ in
         set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path
         fenv source /etc/fish/foreign-env/loginShellInit > /dev/null
         set -e fish_function_path[1]
-        
+
         ${cfg.loginShellInit}
 
         # and leave a note so we don't source this config section again from
@@ -149,12 +151,11 @@ in
       status --is-interactive; and not set -q __fish_nixos_interactive_config_sourced
       and begin
         ${fishAliases}
-        
 
         set fish_function_path ${pkgs.fish-foreign-env}/share/fish-foreign-env/functions $fish_function_path
         fenv source /etc/fish/foreign-env/interactiveShellInit > /dev/null
         set -e fish_function_path[1]
-        
+
         ${cfg.promptInit}
         ${cfg.interactiveShellInit}
 
@@ -170,7 +171,7 @@ in
       ++ optional cfg.vendor.config.enable "/share/fish/vendor_conf.d"
       ++ optional cfg.vendor.completions.enable "/share/fish/vendor_completions.d"
       ++ optional cfg.vendor.functions.enable "/share/fish/vendor_functions.d";
-    
+
     environment.systemPackages = [ pkgs.fish ];
 
     environment.shells = [

nixos/modules/programs/yabar.nix

@@ -44,10 +44,23 @@ in
       enable = mkEnableOption "yabar";
 
       package = mkOption {
-        default = pkgs.yabar;
-        example = literalExample "pkgs.yabar-unstable";
+        default = pkgs.yabar-unstable;
+        example = literalExample "pkgs.yabar";
         type = types.package;
 
+        # `yabar-stable` segfaults under certain conditions.
+        apply = x: if x == pkgs.yabar-unstable then x else flip warn x ''
+          It's not recommended to use `yabar' with `programs.yabar', the (old) stable release
+          tends to segfault under certain circumstances:
+
+          * https://github.com/geommer/yabar/issues/86
+          * https://github.com/geommer/yabar/issues/68
+          * https://github.com/geommer/yabar/issues/143
+
+          Most of them don't occur on master anymore, until a new release is published, it's recommended
+          to use `yabar-unstable'.
+        '';
+
         description = ''
           The package which contains the `yabar` binary.
 

nixos/modules/programs/zsh/zsh.nix

@@ -70,7 +70,7 @@ in
       promptInit = mkOption {
         default = ''
           if [ "$TERM" != dumb ]; then
-            autoload -U promptinit && promptinit && prompt walters
+              autoload -U promptinit && promptinit && prompt walters
           fi
         '';
         description = ''
@@ -116,7 +116,9 @@ in
         if [ -n "$__ETC_ZSHENV_SOURCED" ]; then return; fi
         export __ETC_ZSHENV_SOURCED=1
 
-        ${config.system.build.setEnvironment.text}
+        if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
+            . ${config.system.build.setEnvironment}
+        fi
 
         ${cfge.shellInit}
 
@@ -124,7 +126,7 @@ in
 
         # Read system-wide modifications.
         if test -f /etc/zshenv.local; then
-          . /etc/zshenv.local
+            . /etc/zshenv.local
         fi
       '';
 
@@ -143,7 +145,7 @@ in
 
         # Read system-wide modifications.
         if test -f /etc/zprofile.local; then
-          . /etc/zprofile.local
+            . /etc/zprofile.local
         fi
       '';
 
@@ -169,7 +171,7 @@ in
 
         # Tell zsh how to find installed completions
         for p in ''${(z)NIX_PROFILES}; do
-          fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
+            fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
         done
 
         ${optionalString cfg.enableGlobalCompInit "autoload -U compinit && compinit"}
@@ -184,7 +186,7 @@ in
 
         # Read system-wide modifications.
         if test -f /etc/zshrc.local; then
-          . /etc/zshrc.local
+            . /etc/zshrc.local
         fi
       '';
 

nixos/modules/security/acme.nix

@@ -302,15 +302,15 @@ in
                       workdir="$(mktemp -d)"
 
                       # Create CA
-                      openssl genrsa -des3 -passout pass:x -out $workdir/ca.pass.key 2048
-                      openssl rsa -passin pass:x -in $workdir/ca.pass.key -out $workdir/ca.key
+                      openssl genrsa -des3 -passout pass:xxxx -out $workdir/ca.pass.key 2048
+                      openssl rsa -passin pass:xxxx -in $workdir/ca.pass.key -out $workdir/ca.key
                       openssl req -new -key $workdir/ca.key -out $workdir/ca.csr \
                         -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=Security Department/CN=example.com"
                       openssl x509 -req -days 1 -in $workdir/ca.csr -signkey $workdir/ca.key -out $workdir/ca.crt
 
                       # Create key
-                      openssl genrsa -des3 -passout pass:x -out $workdir/server.pass.key 2048
-                      openssl rsa -passin pass:x -in $workdir/server.pass.key -out $workdir/server.key
+                      openssl genrsa -des3 -passout pass:xxxx -out $workdir/server.pass.key 2048
+                      openssl rsa -passin pass:xxxx -in $workdir/server.pass.key -out $workdir/server.key
                       openssl req -new -key $workdir/server.key -out $workdir/server.csr \
                         -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"
                       openssl x509 -req -days 1 -in $workdir/server.csr -CA $workdir/ca.crt \

nixos/modules/services/mail/exim.nix

@@ -2,7 +2,7 @@
 
 let
   inherit (lib) mkIf mkOption singleton types;
-  inherit (pkgs) coreutils exim;
+  inherit (pkgs) coreutils;
   cfg = config.services.exim;
 in
 
@@ -57,6 +57,16 @@ in
         '';
       };
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.exim;
+        defaultText = "pkgs.exim";
+        description = ''
+          The Exim derivation to use.
+          This can be used to enable features such as LDAP or PAM support.
+        '';
+      };
+
     };
 
   };
@@ -74,7 +84,7 @@ in
         spool_directory = ${cfg.spoolDir}
         ${cfg.config}
       '';
-      systemPackages = [ exim ];
+      systemPackages = [ cfg.package ];
     };
 
     users.users = singleton {
@@ -89,14 +99,14 @@ in
       gid = config.ids.gids.exim;
     };
 
-    security.wrappers.exim.source = "${exim}/bin/exim";
+    security.wrappers.exim.source = "${cfg.package}/bin/exim";
 
     systemd.services.exim = {
       description = "Exim Mail Daemon";
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."exim.conf".source ];
       serviceConfig = {
-        ExecStart   = "${exim}/bin/exim -bdf -q30m";
+        ExecStart   = "${cfg.package}/bin/exim -bdf -q30m";
         ExecReload  = "${coreutils}/bin/kill -HUP $MAINPID";
       };
       preStart = ''

nixos/modules/services/mail/rmilter.nix

@@ -89,7 +89,7 @@ in
 
       bindSocket.path = mkOption {
        type = types.str;
-       default = "/run/rmilter/rmilter.sock";
+       default = "/run/rmilter.sock";
        description = ''
           Path to Unix domain socket to listen on.
         '';
@@ -193,6 +193,9 @@ in
   config = mkMerge [
 
     (mkIf cfg.enable {
+      warnings = [
+        ''`config.services.rmilter' is deprecated, `rmilter' deprecated and unsupported by upstream, and will be removed from next releases. Use built-in rspamd milter instead.''
+      ];
 
       users.users = singleton {
         name = cfg.user;

nixos/modules/services/misc/nix-daemon.nix

@@ -345,7 +345,6 @@ in
         type = types.listOf types.str;
         default =
           [
-            "$HOME/.nix-defexpr/channels"
             "nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos"
             "nixos-config=/etc/nixos/configuration.nix"
             "/nix/var/nix/profiles/per-user/root/channels"
@@ -436,7 +435,7 @@ in
 
     # Set up the environment variables for running Nix.
     environment.sessionVariables = cfg.envVars //
-      { NIX_PATH = concatStringsSep ":" cfg.nixPath;
+      { NIX_PATH = cfg.nixPath;
       };
 
     environment.extraInit = optionalString (!isNix20)
@@ -446,6 +445,8 @@ in
         if [ "$USER" != root -o ! -w /nix/var/nix/db ]; then
             export NIX_REMOTE=daemon
         fi
+      '' + ''
+        export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}"
       '';
 
     nix.nrBuildUsers = mkDefault (lib.max 32 cfg.maxJobs);

nixos/modules/services/misc/weechat.nix

@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.weechat;
+in
+
+{
+  options.services.weechat = {
+    enable = mkEnableOption "weechat";
+    root = mkOption {
+      description = "Weechat state directory.";
+      type = types.str;
+      default = "/var/lib/weechat";
+    };
+    sessionName = mkOption {
+      description = "Name of the `screen' session for weechat.";
+      default = "weechat-screen";
+      type = types.str;
+    };
+    binary = mkOption {
+      description = "Binary to execute (by default \${weechat}/bin/weechat).";
+      example = literalExample ''
+        ''${pkgs.weechat}/bin/weechat-headless
+      '';
+      default = "${pkgs.weechat}/bin/weechat";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users = {
+      groups.weechat = {};
+      users.weechat = {
+        createHome = true;
+        group = "weechat";
+        home = cfg.root;
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.weechat = {
+      environment.WEECHAT_HOME = cfg.root;
+      serviceConfig = {
+        User = "weechat";
+        Group = "weechat";
+        RemainAfterExit = "yes";
+      };
+      script = "exec ${pkgs.screen}/bin/screen -Dm -S ${cfg.sessionName} ${cfg.binary}";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+    };
+  };
+
+  meta.doc = ./weechat.xml;
+}

nixos/modules/services/misc/weechat.xml

@@ -0,0 +1,61 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-services-weechat">
+
+<title>WeeChat</title>
+<para><link xlink:href="https://weechat.org/">WeeChat</link> is a fast and extensible IRC client.</para>
+
+<section><title>Basic Usage</title>
+<para>
+By default, the module creates a
+<literal><link xlink:href="https://www.freedesktop.org/wiki/Software/systemd/">systemd</link></literal> unit
+which runs the chat client in a detached
+<literal><link xlink:href="https://www.gnu.org/software/screen/">screen</link></literal> session.
+
+</para>
+
+<para>
+This can be done by enabling the <literal>weechat</literal> service:
+
+<programlisting>
+{ ... }:
+
+{
+  <link linkend="opt-services.weechat.enable">services.weechat.enable</link> = true;
+}
+</programlisting>
+</para>
+<para>
+The service is managed by a dedicated user
+named <literal>weechat</literal> in the state directory
+<literal>/var/lib/weechat</literal>.
+</para>
+</section>
+<section><title>Re-attaching to WeeChat</title>
+<para>
+WeeChat runs in a screen session owned by a dedicated user. To explicitly
+allow your another user to attach to this session, the <literal>screenrc</literal> needs to be tweaked
+by adding <link xlink:href="https://www.gnu.org/software/screen/manual/html_node/Multiuser.html#Multiuser">multiuser</link> support:
+
+<programlisting>
+{
+  <link linkend="opt-programs.screen.screenrc">programs.screen.screenrc</link> = ''
+    multiuser on
+    acladd normal_user
+  '';
+}
+</programlisting>
+
+Now, the session can be re-attached like this:
+
+<programlisting>
+screen -r weechat-screen
+</programlisting>
+</para>
+<para>
+<emphasis>The session name can be changed using <link linkend="opt-services.weechat.sessionName">services.weechat.sessionName.</link></emphasis>
+</para>
+</section>
+</chapter>

nixos/modules/services/monitoring/datadog-agent.nix

@@ -8,7 +8,6 @@ let
   ddConf = {
     dd_url              = "https://app.datadoghq.com";
     skip_ssl_validation = "no";
-    api_key             = "";
     confd_path          = "/etc/datadog-agent/conf.d";
     additional_checksd  = "/etc/datadog-agent/checks.d";
     use_dogstatsd       = true;
@@ -16,6 +15,7 @@ let
   // optionalAttrs (cfg.logLevel != null) { log_level = cfg.logLevel; }
   // optionalAttrs (cfg.hostname != null) { inherit (cfg) hostname; }
   // optionalAttrs (cfg.tags != null ) { tags = concatStringsSep ", " cfg.tags; }
+  // optionalAttrs (cfg.enableLiveProcessCollection) { process_config = { enabled = "true"; }; }
   // cfg.extraConfig;
 
   # Generate Datadog configuration files for each configured checks.
@@ -125,6 +125,13 @@ in {
       '';
      };
 
+    enableLiveProcessCollection = mkOption {
+      description = ''
+        Whether to enable the live process collection agent.
+      '';
+      default = false;
+      type = types.bool;
+    };
     checks = mkOption {
       description = ''
         Configuration for all Datadog checks. Keys of this attribute
@@ -206,7 +213,6 @@ in {
           Group = "datadog";
           Restart = "always";
           RestartSec = 2;
-          PrivateTmp = true;
         };
         restartTriggers = [ datadogPkg ] ++ map (etc: etc.source) etcfiles;
       } attrs;
@@ -229,6 +235,15 @@ in {
         path = [ datadogPkg pkgs.python pkgs.sysstat pkgs.procps pkgs.jdk ];
         serviceConfig.ExecStart = "${datadogPkg}/bin/dd-jmxfetch";
       });
+
+      datadog-process-agent = lib.mkIf cfg.enableLiveProcessCollection (makeService {
+        description = "Datadog Live Process Agent";
+        path = [ ];
+        script = ''
+          export DD_API_KEY=$(head -n 1 ${cfg.apiKeyFile})
+          ${pkgs.datadog-process-agent}/bin/agent --config /etc/datadog-agent/datadog.yaml
+        '';
+      });
     };
 
     environment.etc = etcfiles;

nixos/modules/services/monitoring/grafana.nix

@@ -235,7 +235,7 @@ in {
         but without GF_ prefix
       '';
       default = {};
-      type = types.attrsOf types.str;
+      type = with types; attrsOf (either str path);
     };
   };
 

nixos/modules/services/networking/chrony.nix

@@ -3,12 +3,10 @@
 with lib;
 
 let
+  cfg = config.services.chrony;
 
   stateDir = "/var/lib/chrony";
-
-  keyFile = "/etc/chrony.keys";
-
-  cfg = config.services.chrony;
+  keyFile = "${stateDir}/chrony.keys";
 
   configFile = pkgs.writeText "chrony.conf" ''
     ${concatMapStringsSep "\n" (server: "server " + server) cfg.servers}
@@ -19,7 +17,6 @@ let
     }
 
     driftfile ${stateDir}/chrony.drift
-
     keyfile ${keyFile}
 
     ${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
@@ -27,18 +24,11 @@ let
     ${cfg.extraConfig}
   '';
 
-  chronyFlags = "-n -m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
-
+  chronyFlags = "-m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
 in
-
 {
-
-  ###### interface
-
   options = {
-
     services.chrony = {
-
       enable = mkOption {
         default = false;
         description = ''
@@ -83,15 +73,9 @@ in
         description = "Extra flags passed to the chronyd command.";
       };
     };
-
   };
 
-
-  ###### implementation
-
   config = mkIf cfg.enable {
-
-    # Make chronyc available in the system path
     environment.systemPackages = [ pkgs.chrony ];
 
     users.groups = singleton
@@ -113,26 +97,30 @@ in
       { description = "chrony NTP daemon";
 
         wantedBy = [ "multi-user.target" ];
-        wants = [ "time-sync.target" ];
-        before = [ "time-sync.target" ];
-        after = [ "network.target" ];
+        wants    = [ "time-sync.target" ];
+        before   = [ "time-sync.target" ];
+        after    = [ "network.target" ];
         conflicts = [ "ntpd.service" "systemd-timesyncd.service" ];
 
         path = [ pkgs.chrony ];
 
-        preStart =
-          ''
-            mkdir -m 0755 -p ${stateDir}
-            touch ${keyFile}
-            chmod 0640 ${keyFile}
-            chown chrony:chrony ${stateDir} ${keyFile}
-          '';
+        preStart = ''
+          mkdir -m 0755 -p ${stateDir}
+          touch ${keyFile}
+          chmod 0640 ${keyFile}
+          chown chrony:chrony ${stateDir} ${keyFile}
+        '';
 
         serviceConfig =
-          { ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
+          { Type = "forking";
+            ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
+
+            ProtectHome = "yes";
+            ProtectSystem = "full";
+            PrivateTmp = "yes";
+
+            ConditionCapability = "CAP_SYS_TIME";
           };
       };
-
   };
-
 }

nixos/modules/services/networking/networkmanager.nix

@@ -406,25 +406,25 @@ in {
       { source = configFile;
         target = "NetworkManager/NetworkManager.conf";
       }
-      { source = "${networkmanager-openvpn}/etc/NetworkManager/VPN/nm-openvpn-service.name";
+      { source = "${networkmanager-openvpn}/lib/NetworkManager/VPN/nm-openvpn-service.name";
         target = "NetworkManager/VPN/nm-openvpn-service.name";
       }
-      { source = "${networkmanager-vpnc}/etc/NetworkManager/VPN/nm-vpnc-service.name";
+      { source = "${networkmanager-vpnc}/lib/NetworkManager/VPN/nm-vpnc-service.name";
         target = "NetworkManager/VPN/nm-vpnc-service.name";
       }
-      { source = "${networkmanager-openconnect}/etc/NetworkManager/VPN/nm-openconnect-service.name";
+      { source = "${networkmanager-openconnect}/lib/NetworkManager/VPN/nm-openconnect-service.name";
         target = "NetworkManager/VPN/nm-openconnect-service.name";
       }
-      { source = "${networkmanager-fortisslvpn}/etc/NetworkManager/VPN/nm-fortisslvpn-service.name";
+      { source = "${networkmanager-fortisslvpn}/lib/NetworkManager/VPN/nm-fortisslvpn-service.name";
         target = "NetworkManager/VPN/nm-fortisslvpn-service.name";
       }
-      { source = "${networkmanager-l2tp}/etc/NetworkManager/VPN/nm-l2tp-service.name";
+      { source = "${networkmanager-l2tp}/lib/NetworkManager/VPN/nm-l2tp-service.name";
         target = "NetworkManager/VPN/nm-l2tp-service.name";
       }
-      { source = "${networkmanager_strongswan}/etc/NetworkManager/VPN/nm-strongswan-service.name";
+      { source = "${networkmanager_strongswan}/lib/NetworkManager/VPN/nm-strongswan-service.name";
         target = "NetworkManager/VPN/nm-strongswan-service.name";
       }
-      { source = "${networkmanager-iodine}/etc/NetworkManager/VPN/nm-iodine-service.name";
+      { source = "${networkmanager-iodine}/lib/NetworkManager/VPN/nm-iodine-service.name";
         target = "NetworkManager/VPN/nm-iodine-service.name";
       }
     ] ++ optional (cfg.appendNameservers == [] || cfg.insertNameservers == [])

nixos/modules/services/networking/zeronet.nix

@@ -12,6 +12,8 @@ let
       log_dir = ${cfg.logDir}
     '' + lib.optionalString (cfg.port != null) ''
       ui_port = ${toString cfg.port}
+    '' + lib.optionalString (cfg.torAlways) ''
+      tor = always
     '' + cfg.extraConfig;
   };
 in with lib; {
@@ -35,11 +37,17 @@ in with lib; {
     port = mkOption {
       type = types.nullOr types.int;
       default = null;
-      example = 15441;
-      description = "Optional zeronet port.";
+      example = 43110;
+      description = "Optional zeronet web UI port.";
     };
 
     tor = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Use TOR for zeronet traffic where possible.";
+    };
+
+    torAlways = mkOption {
       type = types.bool;
       default = false;
       description = "Use TOR for all zeronet traffic.";
@@ -60,9 +68,13 @@ in with lib; {
     services.tor = mkIf cfg.tor {
       enable = true;
       controlPort = 9051;
-      extraConfig = "CookieAuthentication 1";
+      extraConfig = ''
+        CacheDirectoryGroupReadable 1
+        CookieAuthentication 1
+        CookieAuthFileGroupReadable 1
+      '';
     };
-    
+
     systemd.services.zeronet = {
       description = "zeronet";
       after = [ "network.target" (optionalString cfg.tor "tor.service") ];

nixos/modules/services/security/tor.nix

@@ -208,7 +208,7 @@ in
           enable = mkOption {
             type = types.bool;
             default = false;
-            description = "Whether to enable tor transaprent proxy";
+            description = "Whether to enable tor transparent proxy";
           };
 
           listenAddress = mkOption {

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -81,6 +81,7 @@ in
           kconfig
           kconfigwidgets
           kcoreaddons
+          kdoctools
           kdbusaddons
           kdeclarative
           kded

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -197,7 +197,7 @@ in
       # lightdm relaunches itself via just `lightdm`, so needs to be on the PATH
       execCmd = ''
         export PATH=${lightdm}/sbin:$PATH
-        exec ${lightdm}/sbin/lightdm --log-dir=/var/log --run-dir=/run
+        exec ${lightdm}/sbin/lightdm
       '';
     };
 
@@ -246,12 +246,19 @@ in
     '';
 
     users.users.lightdm = {
-      createHome = true;
-      home = "/var/lib/lightdm-data";
+      home = "/var/lib/lightdm";
       group = "lightdm";
       uid = config.ids.uids.lightdm;
     };
 
+    systemd.tmpfiles.rules = [
+      "d /run/lightdm 0711 lightdm lightdm 0"
+      "d /var/cache/lightdm 0711 root lightdm -"
+      "d /var/lib/lightdm 1770 lightdm lightdm -"
+      "d /var/lib/lightdm-data 1775 lightdm lightdm -"
+      "d /var/log/lightdm 0711 root lightdm -"
+    ];
+
     users.groups.lightdm.gid = config.ids.gids.lightdm;
     services.xserver.tty     = null; # We might start multiple X servers so let the tty increment themselves..
     services.xserver.display = null; # We specify our own display (and logfile) in xserver-wrapper up there

nixos/modules/system/activation/switch-to-configuration.pl

@@ -419,7 +419,7 @@ while (my $f = <$listActiveUsers>) {
     my ($uid, $name) = ($+{uid}, $+{user});
     print STDERR "reloading user units for $name...\n";
 
-    system("su", "-l", $name, "-c", "XDG_RUNTIME_DIR=/run/user/$uid @systemd@/bin/systemctl --user daemon-reload");
+    system("su", "-s", "@shell@", "-l", $name, "-c", "XDG_RUNTIME_DIR=/run/user/$uid @systemd@/bin/systemctl --user daemon-reload");
 }
 
 close $listActiveUsers;

nixos/modules/system/activation/top-level.nix

@@ -115,6 +115,7 @@ let
 
       inherit (pkgs) utillinux coreutils;
       systemd = config.systemd.package;
+      shell = "${pkgs.bash}/bin/sh";
 
       inherit children;
       kernelParams = config.boot.kernelParams;

nixos/modules/tasks/network-interfaces.nix

@@ -341,7 +341,7 @@ in
         You should try to make this ID unique among your machines. You can
         generate a random 32-bit ID using the following commands:
 
-        <literal>cksum /etc/machine-id | while read c rest; do printf "%x" $c; done</literal>
+        <literal>head -c 8 /etc/machine-id</literal>
 
         (this derives it from the machine-id that systemd generates) or
 

nixos/modules/virtualisation/qemu-vm.nix

@@ -32,15 +32,21 @@ let
   # expressions and shell script stuff.
   mkDiskIfaceDriveFlag = idx: driveArgs: let
     inherit (cfg.qemu) diskInterface;
+    isSCSI = diskInterface == "scsi";
     # The drive identifier created by incrementing the index by one using the
     # shell.
     drvId = "drive$((${idx} + 1))";
+    dvcId = "${diskInterface}$((${idx} + 1))";
     # NOTE: DO NOT shell escape, because this may contain shell variables.
-    commonArgs = "index=${idx},id=${drvId},${driveArgs}";
-    isSCSI = diskInterface == "scsi";
-    devArgs = "${diskInterface}-hd,drive=${drvId}";
-    args = "-drive ${commonArgs},if=none -device lsi53c895a -device ${devArgs}";
-  in if isSCSI then args else "-drive ${commonArgs},if=${diskInterface}";
+    commonDriveArgs = "media=disk,id=${drvId},${driveArgs}";
+    commonInterfaceArgs = "drive=${drvId},id=${dvcId},bootindex=${idx}";
+  in lib.concatStrings [
+    "-drive ${commonDriveArgs},if=none "
+    ''${if isSCSI then
+        "-device lsi53c895a -device ${diskInterface}-hd,${commonInterfaceArgs}"
+      else
+        "-device virtio-blk-pci,scsi=off,${commonInterfaceArgs}"} ''
+  ];
 
   # Shell script to start the VM.
   startVM =
@@ -97,15 +103,15 @@ let
           -virtfs local,path=/nix/store,security_model=none,mount_tag=store \
           -virtfs local,path=$TMPDIR/xchg,security_model=none,mount_tag=xchg \
           -virtfs local,path=''${SHARED_DIR:-$TMPDIR/xchg},security_model=none,mount_tag=shared \
+          ${mkDiskIfaceDriveFlag "1" "file=$NIX_DISK_IMAGE,media=disk,cache=writeback,werror=report"} \
           ${if cfg.useBootLoader then ''
-            ${mkDiskIfaceDriveFlag "0" "file=$NIX_DISK_IMAGE,cache=writeback,werror=report"} \
-            ${mkDiskIfaceDriveFlag "1" "file=$TMPDIR/disk.img,media=disk"} \
+            -boot menu=on \
+            ${mkDiskIfaceDriveFlag "0" "file=$TMPDIR/disk.img,media=disk"} \
             ${if cfg.useEFIBoot then ''
               -pflash $TMPDIR/bios.bin \
             '' else ''
-            ''}
-          '' else ''
-            ${mkDiskIfaceDriveFlag "0" "file=$NIX_DISK_IMAGE,cache=writeback,werror=report"} \
+            \''}
+          '' else '' \
             -kernel ${config.system.build.toplevel}/kernel \
             -initrd ${config.system.build.toplevel}/initrd \
             -append "$(cat ${config.system.build.toplevel}/kernel-params) init=${config.system.build.toplevel}/init regInfo=${regInfo}/registration ${consoles} $QEMU_KERNEL_PARAMS" \
@@ -141,8 +147,9 @@ let
             '';
           buildInputs = [ pkgs.utillinux ];
           QEMU_OPTS = if cfg.useEFIBoot
-                      then "-pflash $out/bios.bin -nographic -serial pty"
-                      else "-nographic -serial pty";
+                      then "-pflash $out/bios.bin -nographic"
+                      else "-nographic";
+          diskInterface = cfg.qemu.diskInterface;
         }
         ''
           # Create a /boot EFI partition with 40M and arbitrary but fixed GUIDs for reproducibility
@@ -155,10 +162,10 @@ let
             --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC \
             --partition-guid=2:970C694F-AFD0-4B99-B750-CDB7A329AB6F \
             --hybrid 2 \
-            --recompute-chs /dev/vda
-          ${pkgs.dosfstools}/bin/mkfs.fat -F16 /dev/vda2
+            --recompute-chs ${config.virtualisation.bootDevice}
+          ${pkgs.dosfstools}/bin/mkfs.fat -F16 ${config.virtualisation.bootDevice}2
           export MTOOLS_SKIP_CHECK=1
-          ${pkgs.mtools}/bin/mlabel -i /dev/vda2 ::boot
+          ${pkgs.mtools}/bin/mlabel -i ${config.virtualisation.bootDevice}2 ::boot
 
           # Mount /boot; load necessary modules first.
           ${pkgs.kmod}/bin/insmod ${pkgs.linux}/lib/modules/*/kernel/fs/nls/nls_cp437.ko.xz || true
@@ -167,11 +174,11 @@ let
           ${pkgs.kmod}/bin/insmod ${pkgs.linux}/lib/modules/*/kernel/fs/fat/vfat.ko.xz || true
           ${pkgs.kmod}/bin/insmod ${pkgs.linux}/lib/modules/*/kernel/fs/efivarfs/efivarfs.ko.xz || true
           mkdir /boot
-          mount /dev/vda2 /boot
+          mount ${config.virtualisation.bootDevice}2 /boot
 
           # This is needed for GRUB 0.97, which doesn't know about virtio devices.
           mkdir /boot/grub
-          echo '(hd0) /dev/vda' > /boot/grub/device.map
+          echo '(hd0) ${config.virtualisation.bootDevice}' > /boot/grub/device.map
 
           # Install GRUB and generate the GRUB boot menu.
           touch /etc/NIXOS
@@ -464,7 +471,8 @@ in
 
     boot.initrd.availableKernelModules =
       optional cfg.writableStore "overlay"
-      ++ optional (cfg.qemu.diskInterface == "scsi") "sym53c8xx";
+      ++ optional (cfg.qemu.diskInterface == "scsi") "sym53c8xx"
+      ++ optional (cfg.qemu.diskInterface == "scsi") "virtio_scsi";
 
     virtualisation.bootDevice =
       mkDefault (if cfg.qemu.diskInterface == "scsi" then "/dev/sda" else "/dev/vda");

nixos/release.nix

@@ -10,7 +10,7 @@ let
 
   version = fileContents ../.version;
   versionSuffix =
-    (if stableBranch then "." else "pre") + "${toString nixpkgs.revCount}.${nixpkgs.shortRev}";
+    (if stableBranch then "." else "beta") + "${toString (nixpkgs.revCount - 151577)}.${nixpkgs.shortRev}";
 
   importTest = fn: args: system: import fn ({
     inherit system;
@@ -284,7 +284,8 @@ in rec {
   tests.ecryptfs = callTest tests/ecryptfs.nix {};
   tests.etcd = callTestOnMatchingSystems ["x86_64-linux"] tests/etcd.nix {};
   tests.ec2-nixops = (callSubTestsOnMatchingSystems ["x86_64-linux"] tests/ec2.nix {}).boot-ec2-nixops or {};
-  tests.ec2-config = (callSubTestsOnMatchingSystems ["x86_64-linux"] tests/ec2.nix {}).boot-ec2-config or {};
+  # ec2-config doesn't work in a sandbox as the simulated ec2 instance needs network access
+  #tests.ec2-config = (callSubTestsOnMatchingSystems ["x86_64-linux"] tests/ec2.nix {}).boot-ec2-config or {};
   tests.elk = callSubTestsOnMatchingSystems ["x86_64-linux"] tests/elk.nix {};
   tests.env = callTest tests/env.nix {};
   tests.ferm = callTest tests/ferm.nix {};
@@ -327,7 +328,6 @@ in rec {
   tests.keymap = callSubTests tests/keymap.nix {};
   tests.initrdNetwork = callTest tests/initrd-network.nix {};
   tests.kafka = callSubTests tests/kafka.nix {};
-  tests.kernel-copperhead = callTest tests/kernel-copperhead.nix {};
   tests.kernel-latest = callTest tests/kernel-latest.nix {};
   tests.kernel-lts = callTest tests/kernel-lts.nix {};
   tests.kubernetes.dns = callSubTestsOnMatchingSystems ["x86_64-linux"] tests/kubernetes/dns.nix {};
@@ -400,7 +400,7 @@ in rec {
   tests.slurm = callTest tests/slurm.nix {};
   tests.smokeping = callTest tests/smokeping.nix {};
   tests.snapper = callTest tests/snapper.nix {};
-  tests.statsd = callTest tests/statsd.nix {};
+  #tests.statsd = callTest tests/statsd.nix {}; # statsd is broken: #45946
   tests.strongswan-swanctl = callTest tests/strongswan-swanctl.nix {};
   tests.sudo = callTest tests/sudo.nix {};
   tests.systemd = callTest tests/systemd.nix {};

nixos/tests/acme.nix

@@ -1,32 +1,5 @@
 let
-  commonConfig = { lib, nodes, ... }: {
-    networking.nameservers = [
-      nodes.letsencrypt.config.networking.primaryIPAddress
-    ];
-
-    nixpkgs.overlays = lib.singleton (self: super: {
-      cacert = super.cacert.overrideDerivation (drv: {
-        installPhase = (drv.installPhase or "") + ''
-          cat "${nodes.letsencrypt.config.test-support.letsencrypt.caCert}" \
-            >> "$out/etc/ssl/certs/ca-bundle.crt"
-        '';
-      });
-
-      # Override certifi so that it accepts fake certificate for Let's Encrypt
-      # Need to override the attribute used by simp_le, which is python3Packages
-      python3Packages = (super.python3.override {
-        packageOverrides = lib.const (pysuper: {
-          certifi = pysuper.certifi.overridePythonAttrs (attrs: {
-            postPatch = (attrs.postPatch or "") + ''
-              cat "${self.cacert}/etc/ssl/certs/ca-bundle.crt" \
-                > certifi/cacert.pem
-            '';
-          });
-        });
-      }).pkgs;
-    });
-  };
-
+  commonConfig = ./common/letsencrypt/common.nix;
 in import ./make-test.nix {
   name = "acme";
 

nixos/tests/atd.nix

@@ -16,6 +16,7 @@ import ./make-test.nix ({ pkgs, ... }:
   testScript = ''
     startAll;
 
+    $machine->waitForUnit('atd.service'); # wait for atd to start
     $machine->fail("test -f ~root/at-1");
     $machine->fail("test -f ~alice/at-1");
 

nixos/tests/common/letsencrypt/common.nix

@@ -0,0 +1,27 @@
+{ lib, nodes, ... }: {
+  networking.nameservers = [
+    nodes.letsencrypt.config.networking.primaryIPAddress
+  ];
+
+  nixpkgs.overlays = lib.singleton (self: super: {
+    cacert = super.cacert.overrideDerivation (drv: {
+      installPhase = (drv.installPhase or "") + ''
+        cat "${nodes.letsencrypt.config.test-support.letsencrypt.caCert}" \
+          >> "$out/etc/ssl/certs/ca-bundle.crt"
+      '';
+    });
+
+    # Override certifi so that it accepts fake certificate for Let's Encrypt
+    # Need to override the attribute used by simp_le, which is python3Packages
+    python3Packages = (super.python3.override {
+      packageOverrides = lib.const (pysuper: {
+        certifi = pysuper.certifi.overridePythonAttrs (attrs: {
+          postPatch = (attrs.postPatch or "") + ''
+            cat "${self.cacert}/etc/ssl/certs/ca-bundle.crt" \
+              > certifi/cacert.pem
+          '';
+        });
+      });
+    }).pkgs;
+  });
+}

nixos/tests/containers-imperative.nix

@@ -13,6 +13,7 @@ import ./make-test.nix ({ pkgs, ...} : {
       # XXX: Sandbox setup fails while trying to hardlink files from the host's
       #      store file system into the prepared chroot directory.
       nix.useSandbox = false;
+      nix.binaryCaches = []; # don't try to access cache.nixos.org
 
       virtualisation.writableStore = true;
       virtualisation.memorySize = 1024;
@@ -27,9 +28,10 @@ import ./make-test.nix ({ pkgs, ...} : {
             };
           };
         };
-      in [
-        pkgs.stdenv pkgs.stdenvNoCC emptyContainer.config.containers.foo.path
-        pkgs.libxslt
+      in with pkgs; [
+        stdenv stdenvNoCC emptyContainer.config.containers.foo.path
+        libxslt desktop-file-utils texinfo docbook5 libxml2
+        docbook_xsl_ns xorg.lndir documentation-highlighter
       ];
     };
 

nixos/tests/docker-tools.nix

@@ -20,7 +20,10 @@ import ./make-test.nix ({ pkgs, ... }: {
     ''
       $docker->waitForUnit("sockets.target");
 
+      # Ensure Docker images use a stable date by default
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
+      $docker->succeed("[ '1970-01-01T00:00:01Z' = \"\$(docker inspect ${pkgs.dockerTools.examples.bash.imageName} | ${pkgs.jq}/bin/jq -r .[].Created)\" ]");
+
       $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version");
       $docker->succeed("docker rmi ${pkgs.dockerTools.examples.bash.imageName}");
 
@@ -51,5 +54,9 @@ import ./make-test.nix ({ pkgs, ... }: {
       $docker->succeed("docker run --rm runasrootextracommands cat extraCommands");
       $docker->succeed("docker run --rm runasrootextracommands cat runAsRoot");
       $docker->succeed("docker rmi '${pkgs.dockerTools.examples.runAsRootExtraCommands.imageName}'");
+
+      # Ensure Docker images can use an unstable date
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
+      $docker->succeed("[ '1970-01-01T00:00:01Z' != \"\$(docker inspect ${pkgs.dockerTools.examples.unstableDate.imageName} | ${pkgs.jq}/bin/jq -r .[].Created)\" ]");
     '';
 })

nixos/tests/ferm.nix

@@ -11,6 +11,7 @@ import ./make-test.nix ({ pkgs, ...} : {
         with pkgs.lib;
         {
           networking = {
+            dhcpcd.enable = false;
             interfaces.eth1.ipv6.addresses = mkOverride 0 [ { address = "fd00::2"; prefixLength = 64; } ];
             interfaces.eth1.ipv4.addresses = mkOverride 0 [ { address = "192.168.1.2"; prefixLength = 24; } ];
           };
@@ -20,6 +21,7 @@ import ./make-test.nix ({ pkgs, ...} : {
         with pkgs.lib;
         {
           networking = {
+            dhcpcd.enable = false;
             interfaces.eth1.ipv6.addresses = mkOverride 0 [ { address = "fd00::1"; prefixLength = 64; } ];
             interfaces.eth1.ipv4.addresses = mkOverride 0 [ { address = "192.168.1.1"; prefixLength = 24; } ];
           };
@@ -51,7 +53,7 @@ import ./make-test.nix ({ pkgs, ...} : {
     ''
       startAll;
 
-      $client->waitForUnit("network.target");
+      $client->waitForUnit("network-online.target");
       $server->waitForUnit("ferm.service");
       $server->waitForUnit("nginx.service");
       $server->waitUntilSucceeds("ss -ntl | grep -q 80");

nixos/tests/gdk-pixbuf.nix

@@ -10,10 +10,12 @@ import ./make-test.nix ({ pkgs, ... }: {
     environment.systemPackages = with pkgs; [ gnome-desktop-testing ];
     environment.variables.XDG_DATA_DIRS = [ "${pkgs.gdk_pixbuf.installedTests}/share" ];
 
-    virtualisation.memorySize = 4096; # Tests allocate a lot of memory trying to exploit a CVE
+    # Tests allocate a lot of memory trying to exploit a CVE
+    # but qemu-system-i386 has a 2047M memory limit
+    virtualisation.memorySize = if pkgs.stdenv.isi686 then 2047 else 4096;
   };
 
   testScript = ''
-    $machine->succeed("gnome-desktop-testing-runner");
+    $machine->succeed("gnome-desktop-testing-runner -t 1800"); # increase timeout to 1800s
   '';
 })

nixos/tests/hibernate.nix

@@ -35,8 +35,8 @@ import ./make-test.nix (pkgs: {
       $machine->waitForOpenPort(4444);
       $machine->succeed("systemctl hibernate &");
       $machine->waitForShutdown;
+      $probe->waitForUnit("multi-user.target");
       $machine->start;
-      $probe->waitForUnit("network.target");
       $probe->waitUntilSucceeds("echo test | nc machine 4444 -N");
     '';
 

nixos/tests/hound.nix

@@ -52,7 +52,7 @@ import ./make-test.nix ({ pkgs, ... } : {
        $machine->waitForUnit("network.target");
        $machine->waitForUnit("hound.service");
        $machine->waitForOpenPort(6080);
-       $machine->succeed('curl http://127.0.0.1:6080/api/v1/search\?stats\=fosho\&repos\=\*\&rng=%3A20\&q\=hi\&files\=\&i=nope | grep "Filename" | grep "hello"');
+       $machine->waitUntilSucceeds('curl http://127.0.0.1:6080/api/v1/search\?stats\=fosho\&repos\=\*\&rng=%3A20\&q\=hi\&files\=\&i=nope | grep "Filename" | grep "hello"');
 
     '';
 })

nixos/tests/installer.nix

@@ -282,9 +282,9 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda mklabel msdos",
-              "parted --script /dev/vda -- mkpart primary linux-swap 1M 1024M",
-              "parted --script /dev/vda -- mkpart primary ext2 1024M -1s",
+              "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+              . " mkpart primary linux-swap 1M 1024M"
+              . " mkpart primary ext2 1024M -1s",
               "udevadm settle",
               "mkswap /dev/vda1 -L swap",
               "swapon -L swap",
@@ -299,11 +299,11 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda mklabel gpt",
-              "parted --script /dev/vda -- mkpart ESP fat32 1M 50MiB", # /boot
-              "parted --script /dev/vda -- set 1 boot on",
-              "parted --script /dev/vda -- mkpart primary linux-swap 50MiB 1024MiB",
-              "parted --script /dev/vda -- mkpart primary ext2 1024MiB -1MiB", # /
+              "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
+              . " mkpart ESP fat32 1M 50MiB" # /boot
+              . " set 1 boot on"
+              . " mkpart primary linux-swap 50MiB 1024MiB"
+              . " mkpart primary ext2 1024MiB -1MiB", # /
               "udevadm settle",
               "mkswap /dev/vda2 -L swap",
               "swapon -L swap",
@@ -321,11 +321,11 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda mklabel gpt",
-              "parted --script /dev/vda -- mkpart ESP fat32 1M 50MiB", # /boot
-              "parted --script /dev/vda -- set 1 boot on",
-              "parted --script /dev/vda -- mkpart primary linux-swap 50MiB 1024MiB",
-              "parted --script /dev/vda -- mkpart primary ext2 1024MiB -1MiB", # /
+              "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
+              . " mkpart ESP fat32 1M 50MiB" # /boot
+              . " set 1 boot on"
+              . " mkpart primary linux-swap 50MiB 1024MiB"
+              . " mkpart primary ext2 1024MiB -1MiB", # /
               "udevadm settle",
               "mkswap /dev/vda2 -L swap",
               "swapon -L swap",
@@ -345,10 +345,10 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda mklabel msdos",
-              "parted --script /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
-              "parted --script /dev/vda -- mkpart primary linux-swap 50MB 1024M",
-              "parted --script /dev/vda -- mkpart primary ext2 1024M -1s", # /
+              "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+              . " mkpart primary ext2 1M 50MB" # /boot
+              . " mkpart primary linux-swap 50MB 1024M"
+              . " mkpart primary ext2 1024M -1s", # /
               "udevadm settle",
               "mkswap /dev/vda2 -L swap",
               "swapon -L swap",
@@ -366,10 +366,10 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda mklabel msdos",
-              "parted --script /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
-              "parted --script /dev/vda -- mkpart primary linux-swap 50MB 1024M",
-              "parted --script /dev/vda -- mkpart primary ext2 1024M -1s", # /
+              "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+              . " mkpart primary ext2 1M 50MB" # /boot
+              . " mkpart primary linux-swap 50MB 1024M"
+              . " mkpart primary ext2 1024M -1s", # /
               "udevadm settle",
               "mkswap /dev/vda2 -L swap",
               "swapon -L swap",
@@ -402,9 +402,9 @@ in {
       createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda mklabel msdos",
-              "parted --script /dev/vda -- mkpart primary linux-swap 1M 1024M",
-              "parted --script /dev/vda -- mkpart primary 1024M -1s",
+              "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+              . " mkpart primary linux-swap 1M 1024M"
+              . " mkpart primary 1024M -1s",
               "udevadm settle",
 
               "mkswap /dev/vda1 -L swap",
@@ -425,11 +425,11 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda mklabel msdos",
-              "parted --script /dev/vda -- mkpart primary 1M 2048M", # PV1
-              "parted --script /dev/vda -- set 1 lvm on",
-              "parted --script /dev/vda -- mkpart primary 2048M -1s", # PV2
-              "parted --script /dev/vda -- set 2 lvm on",
+              "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+              . " mkpart primary 1M 2048M" # PV1
+              . " set 1 lvm on"
+              . " mkpart primary 2048M -1s" # PV2
+              . " set 2 lvm on",
               "udevadm settle",
               "pvcreate /dev/vda1 /dev/vda2",
               "vgcreate MyVolGroup /dev/vda1 /dev/vda2",
@@ -447,10 +447,10 @@ in {
   luksroot = makeInstallerTest "luksroot"
     { createPartitions = ''
         $machine->succeed(
-          "parted --script /dev/vda mklabel msdos",
-          "parted --script /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
-          "parted --script /dev/vda -- mkpart primary linux-swap 50M 1024M",
-          "parted --script /dev/vda -- mkpart primary 1024M -1s", # LUKS
+          "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+          . " mkpart primary ext2 1M 50MB" # /boot
+          . " mkpart primary linux-swap 50M 1024M"
+          . " mkpart primary 1024M -1s", # LUKS
           "udevadm settle",
           "mkswap /dev/vda2 -L swap",
           "swapon -L swap",
@@ -481,11 +481,11 @@ in {
   filesystemEncryptedWithKeyfile = makeInstallerTest "filesystemEncryptedWithKeyfile"
     { createPartitions = ''
        $machine->succeed(
-          "parted --script /dev/vda mklabel msdos",
-          "parted --script /dev/vda -- mkpart primary ext2 1M 50MB", # /boot
-          "parted --script /dev/vda -- mkpart primary linux-swap 50M 1024M",
-          "parted --script /dev/vda -- mkpart primary 1024M 1280M", # LUKS with keyfile
-          "parted --script /dev/vda -- mkpart primary 1280M -1s",
+          "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+          . " mkpart primary ext2 1M 50MB" # /boot
+          . " mkpart primary linux-swap 50M 1024M"
+          . " mkpart primary 1024M 1280M" # LUKS with keyfile
+          . " mkpart primary 1280M -1s",
           "udevadm settle",
           "mkswap /dev/vda2 -L swap",
           "swapon -L swap",
@@ -520,7 +520,7 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/vda --"
+              "flock /dev/vda parted --script /dev/vda --"
               . " mklabel msdos"
               . " mkpart primary ext2 1M 100MB" # /boot
               . " mkpart extended 100M -1s"
@@ -531,8 +531,10 @@ in {
               "udevadm settle",
               "ls -l /dev/vda* >&2",
               "cat /proc/partitions >&2",
+              "udevadm control --stop-exec-queue",
               "mdadm --create --force /dev/md0 --metadata 1.2 --level=raid1 --raid-devices=2 /dev/vda5 /dev/vda6",
               "mdadm --create --force /dev/md1 --metadata 1.2 --level=raid1 --raid-devices=2 /dev/vda7 /dev/vda8",
+              "udevadm control --start-exec-queue",
               "udevadm settle",
               "mkswap -f /dev/md1 -L swap",
               "swapon -L swap",
@@ -555,14 +557,15 @@ in {
     { createPartitions =
         ''
           $machine->succeed(
-              "parted --script /dev/sda mklabel msdos",
-              "parted --script /dev/sda -- mkpart primary linux-swap 1M 1024M",
-              "parted --script /dev/sda -- mkpart primary ext2 1024M -1s",
+              "flock /dev/sda parted --script /dev/sda -- mklabel msdos"
+              . " mkpart primary linux-swap 1M 1024M"
+              . " mkpart primary ext2 1024M -1s",
               "udevadm settle",
               "mkswap /dev/sda1 -L swap",
               "swapon -L swap",
               "mkfs.ext3 -L nixos /dev/sda2",
               "mount LABEL=nixos /mnt",
+              "mkdir -p /mnt/tmp",
           );
         '';
       grubVersion = 1;

nixos/tests/kernel-copperhead.nix

@@ -1,19 +0,0 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "kernel-copperhead";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ nequissimus ];
-  };
-
-  machine = { pkgs, ... }:
-    {
-      boot.kernelPackages = pkgs.linuxPackages_copperhead_lts;
-    };
-
-  testScript =
-    ''
-      $machine->succeed("uname -a");
-      $machine->succeed("uname -s | grep 'Linux'");
-      $machine->succeed("uname -a | grep '${pkgs.linuxPackages_copperhead_lts.kernel.modDirVersion}'");
-      $machine->succeed("uname -a | grep 'hardened'");
-    '';
-})

nixos/tests/networking.nix

@@ -467,7 +467,7 @@ let
 
         # Wait for networking to come up
         $machine->start;
-        $machine->waitForUnit("network.target");
+        $machine->waitForUnit("network-online.target");
 
         # Test interfaces set up
         my $list = $machine->succeed("ip tuntap list | sort");
@@ -479,7 +479,9 @@ let
 
         # Test interfaces clean up
         $machine->succeed("systemctl stop network-addresses-tap0");
+        $machine->sleep(10);
         $machine->succeed("systemctl stop network-addresses-tun0");
+        $machine->sleep(10);
         my $residue = $machine->succeed("ip tuntap list");
         $residue eq "" or die(
           "Some virtual interface has not been properly cleaned:\n",

nixos/tests/novacomd.nix

@@ -9,12 +9,16 @@ import ./make-test.nix ({ pkgs, ...} : {
   };
 
   testScript = ''
-    startAll;
+    $machine->waitForUnit("multi-user.target");
 
+    # multi-user.target wants novacomd.service, but let's make sure
     $machine->waitForUnit("novacomd.service");
 
     # Check status and try connecting with novacom
     $machine->succeed("systemctl status novacomd.service >&2");
+    # to prevent non-deterministic failure,
+    # make sure the daemon is really listening
+    $machine->waitForOpenPort(6968);
     $machine->succeed("novacom -l");
 
     # Stop the daemon, double-check novacom fails if daemon isn't working
@@ -23,6 +27,8 @@ import ./make-test.nix ({ pkgs, ...} : {
 
     # And back again for good measure
     $machine->startJob("novacomd");
+    # make sure the daemon is really listening
+    $machine->waitForOpenPort(6968);
     $machine->succeed("novacom -l");
   '';
 })

nixos/tests/opensmtpd.nix

@@ -102,11 +102,17 @@ import ./make-test.nix {
   testScript = ''
     startAll;
 
-    $client->waitForUnit("network.target");
+    $client->waitForUnit("network-online.target");
     $smtp1->waitForUnit('opensmtpd');
     $smtp2->waitForUnit('opensmtpd');
     $smtp2->waitForUnit('dovecot2');
 
+    # To prevent sporadic failures during daemon startup, make sure
+    # services are listening on their ports before sending requests
+    $smtp1->waitForOpenPort(25);
+    $smtp2->waitForOpenPort(25);
+    $smtp2->waitForOpenPort(143);
+
     $client->succeed('send-a-test-mail');
     $smtp1->waitUntilFails('smtpctl show queue | egrep .');
     $smtp2->waitUntilFails('smtpctl show queue | egrep .');

nixos/tests/prosody.nix

@@ -6,6 +6,9 @@ import ./make-test.nix {
       enable = true;
       # TODO: use a self-signed certificate
       c2sRequireEncryption = false;
+      extraConfig = ''
+        storage = "sql"
+      '';
     };
     environment.systemPackages = let
       sendMessage = pkgs.writeScriptBin "send-message" ''

nixos/tests/yabar.nix

@@ -8,18 +8,26 @@ with lib;
     maintainers = [ ma27 ];
   };
 
-  nodes.yabar = {
+  machine = {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
 
     services.xserver.displayManager.auto.user = "bob";
 
     programs.yabar.enable = true;
+    programs.yabar.bars = {
+      top.indicators.date.exec = "YABAR_DATE";
+    };
   };
 
   testScript = ''
-    $yabar->start;
-    $yabar->waitForX;
+    $machine->start;
+    $machine->waitForX;
 
-    $yabar->waitForUnit("yabar.service", "bob");
+    # confirm proper startup
+    $machine->waitForUnit("yabar.service", "bob");
+    $machine->sleep(10);
+    $machine->waitForUnit("yabar.service", "bob");
+
+    $machine->screenshot("top_bar");
   '';
 })

pkgs/applications/altcoins/bitcoin-abc.nix

@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
     homepage = https://bitcoinabc.org/;
     maintainers = with maintainers; [ lassulus ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/bitcoin-classic.nix

@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
     homepage = https://bitcoinclassic.com/;
     maintainers = with maintainers; [ jefdaj ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/bitcoin-unlimited.nix

@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
     homepage = https://www.bitcoinunlimited.info/;
     maintainers = with maintainers; [ DmitryTsygankov ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/bitcoin-xt.nix

@@ -43,6 +43,7 @@ stdenv.mkDerivation rec{
     homepage = https://bitcoinxt.software/;
     maintainers = with maintainers; [ jefdaj ];
     license = licenses.mit;
+    broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };
 }

pkgs/applications/altcoins/bitcoin.nix

@@ -5,13 +5,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec{
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.16.2";
+  version = "0.16.3";
 
   src = fetchurl {
     urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
              "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
            ];
-    sha256 = "1n07qykx5hc0ph8fwn7hfrbsrjv19fdzvs5h0nysq4wfgn5wa40r";
+    sha256 = "060223dzzk2izfzhxwlzzd0fhbgglvbgps2nyc4zz767vybysvl3";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];

pkgs/applications/altcoins/btc1.nix

@@ -1,6 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost
-, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
-, withGui }:
+{ stdenv, fetchurl, pkgconfig, autoreconfHook, hexdump, openssl, db48
+, boost, zlib, miniupnpc, qt4, utillinux, protobuf, qrencode, libevent
+, AppKit
+, withGui ? !stdenv.isDarwin
+}:
 
 with stdenv.lib;
 stdenv.mkDerivation rec{
@@ -12,11 +14,10 @@ stdenv.mkDerivation rec{
     sha256 = "0v0g2wb4nsnhddxzb63vj2bc1mgyj05vqm5imicjfz8prvgc0si8";
   };
 
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
-  buildInputs = [ openssl db48 boost zlib
-                  miniupnpc protobuf libevent]
-                  ++ optionals stdenv.isLinux [ utillinux ]
-                  ++ optionals withGui [ qt4 qrencode ];
+  nativeBuildInputs = [ pkgconfig autoreconfHook hexdump ];
+  buildInputs = [ openssl db48 boost zlib miniupnpc protobuf libevent ]
+    ++ optionals withGui [ qt4 qrencode ]
+    ++ optional stdenv.isDarwin AppKit;
 
   configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
                      ++ optionals withGui [ "--with-gui=qt4" ];

pkgs/applications/altcoins/dapp.nix

@@ -1,33 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper
-, seth, git, solc, shellcheck, nodejs, hevm }:
-
-stdenv.mkDerivation rec {
-  name = "dapp-${version}";
-  version = "0.5.7";
-
-  src = fetchFromGitHub {
-    owner = "dapphub";
-    repo = "dapp";
-    rev = "v${version}";
-    sha256 = "128f35hczarihb263as391wr9zbyc1q1p49qbxh30via23r1brb0";
-  };
-
-  nativeBuildInputs = [makeWrapper shellcheck];
-  buildPhase = "true";
-  doCheck = true;
-  checkPhase = "make test";
-  makeFlags = ["prefix=$(out)"];
-  postInstall = let path = lib.makeBinPath [
-    nodejs solc git seth hevm
-  ]; in ''
-    wrapProgram "$out/bin/dapp" --prefix PATH : "${path}"
-  '';
-
-  meta = {
-    description = "Simple tool for creating Ethereum-based dapps";
-    homepage = https://github.com/dapphub/dapp/;
-    maintainers = [stdenv.lib.maintainers.dbrock];
-    license = lib.licenses.gpl3;
-    inherit version;
-  };
-}

pkgs/applications/altcoins/default.nix

@@ -32,8 +32,11 @@ rec {
     boost = boost165; withGui = false;
   };
 
-  btc1 = callPackage ./btc1.nix { boost = boost165; withGui = true; };
-  btc1d = callPackage ./btc1.nix { boost = boost165; withGui = false; };
+  btc1 = callPackage ./btc1.nix {
+    inherit (darwin.apple_sdk.frameworks) AppKit;
+    boost = boost165;
+  };
+  btc1d = btc1.override { withGui = false; };
 
   cryptop = python3.pkgs.callPackage ./cryptop { };
 
@@ -47,7 +50,6 @@ rec {
   dogecoin  = callPackage ./dogecoin.nix { boost = boost165; withGui = true; };
   dogecoind = callPackage ./dogecoin.nix { boost = boost165; withGui = false; };
 
-  ethsign = callPackage ./ethsign { };
 
   freicoin = callPackage ./freicoin.nix { boost = boost155; };
   go-ethereum = callPackage ./go-ethereum.nix {
@@ -59,8 +61,10 @@ rec {
     buildGoPackage = buildGo110Package;
   };
 
-  litecoin  = callPackage ./litecoin.nix { withGui = true; };
-  litecoind = callPackage ./litecoin.nix { withGui = false; };
+  litecoin  = callPackage ./litecoin.nix {
+    inherit (darwin.apple_sdk.frameworks) AppKit;
+  };
+  litecoind = litecoin.override { withGui = false; };
 
   masari = callPackage ./masari.nix { };
 
@@ -73,11 +77,6 @@ rec {
   namecoind = callPackage ./namecoin.nix { withGui = false; };
 
   ethabi = callPackage ./ethabi.nix { };
-  ethrun = callPackage ./ethrun.nix { };
-  seth = callPackage ./seth.nix { };
-  dapp = callPackage ./dapp.nix { };
-
-  hevm = (haskellPackages.callPackage ./hevm.nix {});
 
   stellar-core = callPackage ./stellar-core.nix { };
 

pkgs/applications/altcoins/ethrun.nix

@@ -1,26 +0,0 @@
-{ stdenv, fetchFromGitHub, rustPlatform }:
-
-with rustPlatform;
-
-buildRustPackage rec {
-  name = "ethrun-${version}";
-  version = "0.1.0";
-
-  src = fetchFromGitHub {
-    owner = "dapphub";
-    repo = "ethrun";
-    rev = "v${version}";
-    sha256 = "1w651g4p2mc4ljp20l8lwvfx3l3fzyp6gf2izr85vyb1wjbaccqn";
-  };
-
-  cargoSha256 = "14x8pbjgkz0g724lnvd9mi2alqd6fipjljw6xsraf9gqwijn1kn0";
-
-  meta = with stdenv.lib; {
-    description = "Directly run Ethereum bytecode";
-    homepage = https://github.com/dapphub/ethrun/;
-    maintainers = [ maintainers.dbrock ];
-    license = licenses.gpl3;
-    broken = true; # mark temporary as broken
-    inherit version;
-  };
-}

pkgs/applications/altcoins/ethsign/default.nix

@@ -1,59 +0,0 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, fetchgit }:
-
-buildGoPackage rec {
-  name = "ethsign-${version}";
-  version = "0.8.2";
-
-  goPackagePath = "github.com/dapphub/ethsign";
-  hardeningDisable = ["fortify"];
-
-  src = fetchFromGitHub {
-    owner = "dapphub";
-    repo = "ethsign";
-    rev = "v${version}";
-    sha256 = "1gd0bq5x49sjm83r2wivjf03dxvhdli6cvwb9b853wwcvy4inmmh";
-  };
-
-  extraSrcs = [
-    {
-      goPackagePath = "github.com/ethereum/go-ethereum";
-      src = fetchFromGitHub {
-        owner = "ethereum";
-        repo = "go-ethereum";
-        rev = "v1.7.3";
-        sha256 = "1w6rbq2qpjyf2v9mr18yiv2af1h2sgyvgrdk4bd8ixgl3qcd5b11";
-      };
-    }
-    {
-      goPackagePath = "gopkg.in/urfave/cli.v1";
-      src = fetchFromGitHub {
-        owner = "urfave";
-        repo = "cli";
-        rev = "v1.19.1";
-        sha256 = "1ny63c7bfwfrsp7vfkvb4i0xhq4v7yxqnwxa52y4xlfxs4r6v6fg";
-      };
-    }
-    {
-      goPackagePath = "golang.org/x/crypto";
-      src = fetchgit {
-        url = "https://go.googlesource.com/crypto";
-        rev = "94eea52f7b742c7cbe0b03b22f0c4c8631ece122";
-        sha256 = "095zyvjb0m2pz382500miqadhk7w3nis8z3j941z8cq4rdafijvi";
-      };
-    }
-    {
-      goPackagePath = "golang.org/x/sys";
-      src = fetchgit {
-        url = "https://go.googlesource.com/sys";
-        rev = "53aa286056ef226755cd898109dbcdaba8ac0b81";
-        sha256 = "1yd17ccklby099cpdcsgx6lf0lj968hsnppp16mwh9009ldf72r1";
-      };
-    }
-  ];
-
-  meta = with stdenv.lib; {
-    homepage = https://github.com/dapphub/ethsign;
-    description = "Make raw signed Ethereum transactions";
-    license = [licenses.gpl3];
-  };
-}

pkgs/applications/altcoins/hevm.nix

@@ -1,62 +0,0 @@
-{ mkDerivation, abstract-par, aeson, ansi-wl-pprint, async, base
-, base16-bytestring, base64-bytestring, binary, brick, bytestring
-, cereal, containers, cryptonite, data-dword, deepseq, directory
-, filepath, ghci-pretty, here, HUnit, lens
-, lens-aeson, memory, monad-par, mtl, optparse-generic, process
-, QuickCheck, quickcheck-text, readline, rosezipper, scientific
-, stdenv, tasty, tasty-hunit, tasty-quickcheck, temporary, text
-, text-format, unordered-containers, vector, vty
-
-, restless-git
-
-, fetchFromGitHub, lib, makeWrapper
-, zlib, bzip2, solc, coreutils
-, bash
-}:
-
-lib.overrideDerivation (mkDerivation rec {
-  pname = "hevm";
-  version = "0.8.5";
-
-  src = fetchFromGitHub {
-    owner = "dapphub";
-    repo = "hevm";
-    rev = "v${version}";
-    sha256 = "1a27bh0azf2hdg5hp6s9azv2rhzy7vrlq1kmg688g9nfwwwhgkp0";
-  };
-
-  isLibrary = false;
-  isExecutable = true;
-  enableSharedExecutables = false;
-
-  postInstall = ''
-    wrapProgram $out/bin/hevm \
-       --add-flags '+RTS -N$((`${coreutils}/bin/nproc` - 1)) -RTS' \
-       --suffix PATH : "${lib.makeBinPath [bash coreutils]}"
-  '';
-
-  extraLibraries = [
-    abstract-par aeson ansi-wl-pprint base base16-bytestring
-    base64-bytestring binary brick bytestring cereal containers
-    cryptonite data-dword deepseq directory filepath ghci-pretty lens
-    lens-aeson memory monad-par mtl optparse-generic process QuickCheck
-    quickcheck-text readline rosezipper scientific temporary text text-format
-    unordered-containers vector vty restless-git
-  ];
-  executableHaskellDepends = [
-    async readline zlib bzip2
-  ];
-  testHaskellDepends = [
-    base binary bytestring ghci-pretty here HUnit lens mtl QuickCheck
-    tasty tasty-hunit tasty-quickcheck text vector
-  ];
-
-  homepage = https://github.com/dapphub/hevm;
-  description = "Ethereum virtual machine evaluator";
-  license = stdenv.lib.licenses.agpl3;
-  maintainers = [stdenv.lib.maintainers.dbrock];
-  broken = true; # 2018-04-10
-}) (attrs: {
-  buildInputs = attrs.buildInputs ++ [solc];
-  nativeBuildInputs = attrs.nativeBuildInputs ++ [makeWrapper];
-})

pkgs/applications/altcoins/litecoin.nix

@@ -2,9 +2,12 @@
 , pkgconfig, autoreconfHook
 , openssl, db48, boost, zlib, miniupnpc
 , glib, protobuf, utillinux, qt4, qrencode
-, withGui, libevent }:
+, AppKit
+, withGui ? true, libevent
+}:
 
 with stdenv.lib;
+
 stdenv.mkDerivation rec {
 
   name = "litecoin" + (toString (optional (!withGui) "d")) + "-" + version;
@@ -20,6 +23,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ openssl db48 boost zlib
                   miniupnpc glib protobuf utillinux libevent ]
+                  ++ optionals stdenv.isDarwin [ AppKit ]
                   ++ optionals withGui [ qt4 qrencode ];
 
   configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
@@ -39,6 +43,7 @@ stdenv.mkDerivation rec {
     homepage = https://litecoin.org/;
     platforms = platforms.unix;
     license = licenses.mit;
-    maintainers = with maintainers; [ offline AndersonTorres ];  
+    broken = stdenv.isDarwin;
+    maintainers = with maintainers; [ offline AndersonTorres ];
   };
 }

pkgs/applications/altcoins/seth.nix

@@ -1,33 +0,0 @@
-{ stdenv, makeWrapper, lib, fetchFromGitHub
-, bc, coreutils, curl, ethabi, git, gnused, jshon, perl, solc, which
-, nodejs, ethsign
-}:
-
-stdenv.mkDerivation rec {
-  name = "seth-${version}";
-  version = "0.6.3";
-
-  src = fetchFromGitHub {
-    owner = "dapphub";
-    repo = "seth";
-    rev = "v${version}";
-    sha256 = "0la2nfqsscpbq6zwa6hsd73nimdnrhilrmgyy77yr3jca2wjhsjk";
-  };
-
-  nativeBuildInputs = [makeWrapper];
-  buildPhase = "true";
-  makeFlags = ["prefix=$(out)"];
-  postInstall = let path = lib.makeBinPath [
-    bc coreutils curl ethabi git gnused jshon perl solc which nodejs ethsign
-  ]; in ''
-    wrapProgram "$out/bin/seth" --prefix PATH : "${path}"
-  '';
-
-  meta = {
-    description = "Command-line client for talking to Ethereum nodes";
-    homepage = https://github.com/dapphub/seth/;
-    maintainers = [stdenv.lib.maintainers.dbrock];
-    license = lib.licenses.gpl3;
-    inherit version;
-  };
-}

pkgs/applications/audio/banshee/default.nix

@@ -1,57 +0,0 @@
-{ stdenv, lib, fetchurl, intltool, pkgconfig, gstreamer, gst-plugins-base
-, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-ffmpeg, glib
-, mono, mono-addins, dbus-sharp-1_0, dbus-sharp-glib-1_0, notify-sharp, gtk-sharp-2_0
-, boo, gdata-sharp, taglib-sharp, sqlite, gnome-sharp, gconf, gtk-sharp-beans, gio-sharp
-, libmtp, libgpod, mono-zeroconf }:
-
-stdenv.mkDerivation rec {
-  name = "banshee-${version}";
-  version = "2.6.2";
-
-  src = fetchurl {
-    url = "https://ftp.gnome.org/pub/GNOME/sources/banshee/2.6/banshee-${version}.tar.xz";
-    sha256 = "1y30p8wxx5li39i5gpq2wib0ympy8llz0gyi6ri9bp730ndhhz7p";
-  };
-
-  dontStrip = true;
-
-  nativeBuildInputs = [ pkgconfig intltool ];
-  buildInputs = [
-    gtk-sharp-2_0.gtk gstreamer gst-plugins-base gst-plugins-good
-    gst-plugins-bad gst-plugins-ugly gst-ffmpeg
-    mono dbus-sharp-1_0 dbus-sharp-glib-1_0 mono-addins notify-sharp
-    gtk-sharp-2_0 boo gdata-sharp taglib-sharp sqlite gnome-sharp gconf gtk-sharp-beans
-    gio-sharp libmtp libgpod mono-zeroconf
-  ];
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  postPatch = ''
-    patchShebangs data/desktop-files/update-desktop-file.sh
-    patchShebangs build/private-icon-theme-installer
-    sed -i "s,DOCDIR=.*,DOCDIR=$out/lib/monodoc," configure
-  '';
-
-  postInstall = let
-    ldLibraryPath = lib.makeLibraryPath [ gtk-sharp-2_0.gtk gtk-sharp-2_0 sqlite gconf glib gstreamer ];
-
-    monoGACPrefix = lib.concatStringsSep ":" [
-      mono dbus-sharp-1_0 dbus-sharp-glib-1_0 mono-addins notify-sharp gtk-sharp-2_0
-      boo gdata-sharp taglib-sharp sqlite gnome-sharp gconf gtk-sharp-beans
-      gio-sharp libmtp libgpod mono-zeroconf
-    ];
-  in ''
-    sed -e '2a export MONO_GAC_PREFIX=${monoGACPrefix}' \
-        -e 's|LD_LIBRARY_PATH=|LD_LIBRARY_PATH=${ldLibraryPath}:|' \
-        -e "s|GST_PLUGIN_PATH=|GST_PLUGIN_PATH=$GST_PLUGIN_SYSTEM_PATH:|" \
-        -e 's| mono | ${mono}/bin/mono |' \
-        -i $out/bin/banshee
-  '';
-  meta = with lib; {
-    homepage = "http://banshee.fm/";
-    description = "A music player written in C# using GNOME technologies";
-    platforms = platforms.linux;
-    maintainers = [ maintainers.zohl ];
-    license = licenses.mit;
-  };
-}

pkgs/applications/audio/sayonara/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchurl, cmake, qt5, zlib, taglib, pkgconfig, pcre, gst_all_1 }:
 
 let
-  version = "1.0.0-git5-20180115";
+  version = "1.1.1-git1-20180828";
 in
 stdenv.mkDerivation {
   name = "sayonara-player-${version}";
 
   src = fetchurl {
     url = "https://sayonara-player.com/sw/sayonara-player-${version}.tar.gz";
-    sha256 = "1fl7zplnrrvbv1xm4g348bpd46jj39jvbm808hyjjq92i64wqg37";
+    sha256 = "0rvy47qvavrp03zjdrw025dmq9fq5aaii3q1qq8b94byarl0c5kn";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     { description = "Sayonara music player";
       homepage = https://sayonara-player.com/;
       license = licenses.gpl3;
-      platforms = qt5.qtbase.meta.platforms;
+      platforms = platforms.linux;
       maintainers = [ maintainers.deepfire ];
     };
 }

pkgs/applications/audio/sound-juicer/default.nix

@@ -22,6 +22,8 @@ in stdenv.mkDerivation rec{
     gst_all_1.gst-libav
   ];
 
+  NIX_CFLAGS_COMPILE="-Wno-error=format-nonliteral";
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;

pkgs/applications/audio/spotify/default.nix

@@ -5,14 +5,14 @@
 let
   # TO UPDATE: just execute the ./update.sh script (won't do anything if there is no update)
   # "rev" decides what is actually being downloaded
-  version = "1.0.88.353.g15c26ea1-14";
+  version = "1.0.83.316.ge96b6e67-5";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
-  # More exapmles of api usage:
+  # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "19";
+  rev = "17";
 
 
   deps = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation {
   # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "3a068cbe3c1fca84ae67e28830216f993aa459947517956897c3b3f63063005c9db646960e85185b149747ffc302060c208a7f9968ea69d50a3496067089f3db";
+    sha512 = "19bbr4142shsl4qrikf48vq7kyrd4k4jbsada13qxicxps46a9bx51vjm2hkijqv739c1gdkgzwx7llyk95z26lhrz53shm2n5ij8xi";
   };
 
   buildInputs = [ squashfsTools makeWrapper ];

pkgs/applications/backup/deja-dup/default.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
 
   propagatedUserEnvPkgs = [ duplicity ];
 
-  PKG_CONFIG_LIBNAUTILUS_EXTENSION_EXTENSIONDIR = "${placeholder "out"}/lib/nautilus/extensions-3.0";
+  PKG_CONFIG_LIBNAUTILUS_EXTENSION_EXTENSIONDIR = "lib/nautilus/extensions-3.0";
 
   postInstall = ''
     glib-compile-schemas $out/share/glib-2.0/schemas

pkgs/applications/editors/emacs-modes/melpa-packages.nix

@@ -146,6 +146,12 @@ self:
           (attrs.nativeBuildInputs or []) ++ [ external.git ];
       });
 
+      magit-todos = super.magit-todos.overrideAttrs (attrs: {
+        # searches for Git at build time
+        nativeBuildInputs =
+          (attrs.nativeBuildInputs or []) ++ [ external.git ];
+      });
+
       # missing OCaml
       merlin = markBroken super.merlin;
 

pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix

@@ -151,6 +151,12 @@ self:
             (attrs.nativeBuildInputs or []) ++ [ external.git ];
         });
 
+      magit-todos = super.magit-todos.overrideAttrs (attrs: {
+        # searches for Git at build time
+        nativeBuildInputs =
+          (attrs.nativeBuildInputs or []) ++ [ external.git ];
+      });
+
       # missing OCaml
       merlin = markBroken super.merlin;
 

pkgs/applications/editors/leo-editor/default.nix

@@ -1,29 +1,20 @@
-{ stdenv, python3, libsForQt56, fetchFromGitHub, makeWrapper, makeDesktopItem }:
+{ stdenv, python3, fetchFromGitHub, makeWrapper, makeDesktopItem }:
 
-let
-  packageOverrides = self: super: {
-    pyqt56 = libsForQt56.callPackage ../../../development/python-modules/pyqt/5.x.nix {
-      pythonPackages = self;
-    };
-  };
-
-  pythonPackages = (python3.override { inherit packageOverrides; }).pkgs;
-in
 stdenv.mkDerivation rec {
   name = "leo-editor-${version}";
-  version = "5.6";
+  version = "5.7.3";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "1k6q3gvaf05bi0mzkmmb1p6wrgxwri7ivn38p6f0m0wfd3f70x2j";
+    sha256 = "0ri6l6cxwva450l05af5vs1lsgrz6ciwd02njdgphs9pm1vwxbl9";
   };
 
   dontBuild = true;
 
   nativeBuildInputs = [ makeWrapper python3 ];
-  propagatedBuildInputs = with pythonPackages; [ pyqt56 docutils ];
+  propagatedBuildInputs = with python3.pkgs; [ pyqt5 docutils ];
 
   desktopItem = makeDesktopItem rec {
     name = "leo-editor";

pkgs/applications/editors/nano/default.nix

@@ -14,17 +14,17 @@ let
   nixSyntaxHighlight = fetchFromGitHub {
     owner = "seitz";
     repo = "nanonix";
-    rev = "7483fd8b79f1f3f2179dbbd46aa400df4320ba10";
-    sha256 = "10pv75kfrgnziz8sr83hdbb0c3klm2fmsdw3i5cpqqf5va1fzb8h";
+    rev = "bf8d898efaa10dce3f7972ff765b58c353b4b4ab";
+    sha256 = "0773s5iz8aw9npgyasb0r2ybp6gvy2s9sq51az8w7h52bzn5blnn";
   };
 
 in stdenv.mkDerivation rec {
   name = "nano-${version}";
-  version = "2.9.8";
+  version = "3.0";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${name}.tar.xz";
-    sha256 = "122lm0z97wk3mgnbn8m4d769d4j9rxyc9z7s89xd4gsdp8qsrpn2";
+    sha256 = "1868hg9s584fwjrh0fzdrixmxc2qhw520z4q5iv68kjiajivr9g0";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;

pkgs/applications/graphics/PythonMagick/default.nix

@@ -1,6 +1,6 @@
 # This expression provides Python bindings to ImageMagick. Python libraries are supposed to be called via `python-packages.nix`.
 
-{stdenv, fetchurl, python, boost, pkgconfig, imagemagick}:
+{ stdenv, fetchurl, python, pkgconfig, imagemagick, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   name = "pythonmagick-${version}";
@@ -11,10 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "137278mfb5079lns2mmw73x8dhpzgwha53dyl00mmhj2z25varpn";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [python boost imagemagick];
+  postPatch = ''
+    rm configure
+  '';
 
-  meta = {
+  configureFlags = [ "--with-boost=${python.pkgs.boost}" ];
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ python python.pkgs.boost imagemagick ];
+
+  meta = with stdenv.lib; {
     homepage = http://www.imagemagick.org/script/api.php;
+    license = licenses.imagemagick;
+    description = "PythonMagick provides object oriented bindings for the ImageMagick Library.";
   };
 }

pkgs/applications/graphics/antimony/default.nix

@@ -1,29 +1,34 @@
-{ stdenv, fetchFromGitHub, libpng, python3, boost, libGLU_combined, qtbase, ncurses, cmake, flex, lemon }:
+{ stdenv, fetchFromGitHub, libpng, python3
+, libGLU_combined, qtbase, ncurses
+, cmake, flex, lemon
+}:
 
 let
-  gitRev    = "020910c25614a3752383511ede5a1f5551a8bd39";
-  gitBranch = "master";
+  gitRev    = "60a58688e552f12501980c4bdab034ab0f2ba059";
+  gitBranch = "develop";
   gitTag    = "0.9.3";
 in
   stdenv.mkDerivation rec {
     name    = "antimony-${version}";
-    version = gitTag;
+    version = "2018-07-17";
 
     src = fetchFromGitHub {
-      owner = "mkeeter";
-      repo = "antimony";
-      rev = gitTag;
-      sha256 = "1vm5h5py8l3b8h4pbmm8s3wlxvlw492xfwnlwx0nvl0cjs8ba6r4";
+      owner  = "mkeeter";
+      repo   = "antimony";
+      rev    = gitRev;
+      sha256 = "0pgf6kr23xw012xsil56j5gq78mlirmrlqdm09m5wlgcf4vr6xnl";
     };
 
     patches = [ ./paths-fix.patch ];
 
     postPatch = ''
-       sed -i "s,/usr/local,$out,g" app/CMakeLists.txt app/app/app.cpp app/app/main.cpp
+       sed -i "s,/usr/local,$out,g" \
+       app/CMakeLists.txt app/app/app.cpp app/app/main.cpp
+       sed -i "s,python-py35,python36," CMakeLists.txt
     '';
 
     buildInputs = [
-      libpng python3 (boost.override { python = python3; })
+      libpng python3 python3.pkgs.boost
       libGLU_combined qtbase ncurses
     ];
 
@@ -41,6 +46,7 @@ in
       description = "A computer-aided design (CAD) tool from a parallel universe";
       homepage    = "https://github.com/mkeeter/antimony";
       license     = licenses.mit;
+      maintainers = with maintainers; [ rnhmjoj ];
       platforms   = platforms.linux;
     };
   }

pkgs/applications/graphics/imgcat/default.nix

@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "imgcat-${version}";
   version = "2.3.0";
 
-  buildTools = [ autoconf automake libtool ncurses ];
+  buildInputs = [ autoconf automake libtool ncurses ];
 
   preConfigure = ''
     ${autoconf}/bin/autoconf

pkgs/applications/graphics/photoflow/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, gettext, glib, libxml2, pkgconfig, swig, automake, gobjectIntrospection, cmake, ninja, libtiff, libjpeg, fftw, exiv2, lensfun, gtkmm2, libraw, lcms2, libexif, vips, expat, pcre, pugixml }:
 
 stdenv.mkDerivation {
-  name = "photoflow-unstable-2018-03-06";
+  name = "photoflow-unstable-2018-08-28";
 
   src = fetchFromGitHub {
     owner = "aferrero2707";
     repo = "PhotoFlow";
-    rev = "f9bbea183fa02412d1d17075955d2284eeaf8174";
-    sha256 = "1fsk7kdmlkd64wcswbxrl87aqwmzqak6p3s38ggxzx2h51fa7lmf";
+    rev = "df03f2538ddd232e693c307db4ab63eb5bdfea38";
+    sha256 = "08ybhv08h24y4li8wb4m89xgrz1szlwpksf6vjharp8cznn4y4x9";
   };
 
   nativeBuildInputs = [
@@ -50,6 +50,7 @@ stdenv.mkDerivation {
     homepage = https://aferrero2707.github.io/PhotoFlow/;
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.MtP ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
+    broken = stdenv.isAarch64;
   };
 }

pkgs/applications/misc/dbeaver/default.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   name = "dbeaver-ce-${version}";
-  version = "5.1.6";
+  version = "5.2.0";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1zypadnyhinm6mfv91s7zs2s55bhzgkqhl6ai6x3yqwhvayc02nn";
+    sha256 = "13j2qc4g24d2gmkxj9zpqrcbai9aq8rassrq3c9mp9ir6sf4q0jf";
   };
 
   installPhase = ''

pkgs/applications/misc/electrum/default.nix

@@ -1,12 +1,24 @@
 { stdenv, fetchurl, python3, python3Packages, zbar }:
 
+let
+  qdarkstyle = python3Packages.buildPythonPackage rec {
+    pname = "QDarkStyle";
+    version = "2.5.4";
+    src = python3Packages.fetchPypi {
+      inherit pname version;
+      sha256 = "1w715m1i5pycfqcpkrggpn0rs9cakx6cm5v8rggcxnf4p0i0kdiy";
+    };
+    doCheck = false; # no tests
+  };
+in
+
 python3Packages.buildPythonApplication rec {
   name = "electrum-${version}";
-  version = "3.1.3";
+  version = "3.2.3";
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "05m28yd3zr9awjhaqikf4rg08j5i4ygm750ip1z27wl446sysniy";
+    sha256 = "022iw4cq0c009wvqn7wd815jc0nv8198lq3cawn8h6c28hw2mhs1";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -17,12 +29,14 @@ python3Packages.buildPythonApplication rec {
     pbkdf2
     protobuf
     pyaes
-    pycrypto
+    pycryptodomex
     pyqt5
     pysocks
+    qdarkstyle
     qrcode
     requests
     tlslite
+    typing
 
     # plugins
     keepkey
@@ -35,10 +49,10 @@ python3Packages.buildPythonApplication rec {
 
   preBuild = ''
     sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
-    pyrcc5 icons.qrc -o gui/qt/icons_rc.py
+    pyrcc5 icons.qrc -o electrum/gui/qt/icons_rc.py
     # Recording the creation timestamps introduces indeterminism to the build
-    sed -i '/Created: .*/d' gui/qt/icons_rc.py
-    sed -i "s|name = 'libzbar.*'|name='${zbar}/lib/libzbar.so'|" lib/qrscanner.py
+    sed -i '/Created: .*/d' electrum/gui/qt/icons_rc.py
+    sed -i "s|name = 'libzbar.*'|name='${zbar}/lib/libzbar.so'|" electrum/qrscanner.py
   '';
 
   postInstall = ''

pkgs/applications/misc/khal/default.nix

@@ -46,6 +46,10 @@ in with python.pkgs; buildPythonApplication rec {
   nativeBuildInputs = [ setuptools_scm pkgs.glibcLocales ];
   checkInputs = [ pytest ];
 
+  postInstall = ''
+    install -D misc/__khal $out/share/zsh/site-functions/__khal
+  '';
+
   checkPhase = ''
     py.test
   '';

pkgs/applications/misc/qmapshack/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchurl, cmake, qtscript, qtwebkit, gdal, proj, routino, quazip }:
+{ stdenv, fetchurl, cmake, qtscript, qtwebengine, gdal, proj, routino, quazip }:
 
 stdenv.mkDerivation rec {
   name = "qmapshack-${version}";
-  version = "1.11.1";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "https://bitbucket.org/maproom/qmapshack/downloads/${name}.tar.gz";
-    sha256 = "0yqilfldmfw8m18jbkffv4ar1px6kjs0zlgb216bnhahcr1y8r9y";
+    sha256 = "0d5p60kq9pa2hfql4nr8p42n88lr42jrsryrsllvaj45b8b6kvih";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ qtscript qtwebkit gdal proj routino quazip ];
+  buildInputs = [ qtscript qtwebengine gdal proj routino quazip ];
 
   cmakeFlags = [
     "-DROUTINO_XML_PATH=${routino}/share/routino"

pkgs/applications/misc/qpdfview/default.nix

@@ -21,16 +21,11 @@ stdenv.mkDerivation {
   src = fetchurl {
     inherit (s) url sha256;
   };
-  qmakeFlags = [
-    "*.pro"
-    "TARGET_INSTALL_PATH=${placeholder "out"}/bin"
-    "PLUGIN_INSTALL_PATH=${placeholder "out"}/lib/qpdfview"
-    "DATA_INSTALL_PATH=${placeholder "out"}/share/qpdfview"
-    "MANUAL_INSTALL_PATH=${placeholder "out"}/share/man/man1"
-    "ICON_INSTALL_PATH=${placeholder "out"}/share/icons/hicolor/scalable/apps"
-    "LAUNCHER_INSTALL_PATH=${placeholder "out"}/share/applications"
-    "APPDATA_INSTALL_PATH=${placeholder "out"}/share/appdata"
-  ];
+
+  # TODO: revert this once placeholder is supported
+  preConfigure = ''
+    qmakeFlags="$qmakeFlags *.pro TARGET_INSTALL_PATH=$out/bin PLUGIN_INSTALL_PATH=$out/lib/qpdfview DATA_INSTALL_PATH=$out/share/qpdfview MANUAL_INSTALL_PATH=$out/share/man/man1 ICON_INSTALL_PATH=$out/share/icons/hicolor/scalable/apps LAUNCHER_INSTALL_PATH=$out/share/applications APPDATA_INSTALL_PATH=$out/share/appdata"
+  '';
 
   meta = {
     inherit (s) version;

pkgs/applications/misc/solaar/default.nix

@@ -1,5 +1,5 @@
-{fetchFromGitHub, stdenv, gtk3, python34Packages, gobjectIntrospection}:
-python34Packages.buildPythonApplication rec {
+{fetchFromGitHub, stdenv, gtk3, pythonPackages, gobjectIntrospection}:
+pythonPackages.buildPythonApplication rec {
   name = "solaar-unstable-${version}";
   version = "2018-02-02";
   namePrefix = "";
@@ -10,7 +10,7 @@ python34Packages.buildPythonApplication rec {
     sha256 = "0zy5vmjzdybnjf0mpp8rny11sc43gmm8172svsm9s51h7x0v83y3";
   };
 
-  propagatedBuildInputs = [python34Packages.pygobject3 python34Packages.pyudev gobjectIntrospection gtk3];
+  propagatedBuildInputs = [pythonPackages.pygobject3 pythonPackages.pyudev gobjectIntrospection gtk3];
   postInstall = ''
     wrapProgram "$out/bin/solaar" \
       --prefix PYTHONPATH : "$PYTHONPATH" \

pkgs/applications/misc/zathura/core/default.nix

@@ -11,11 +11,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "zathura-core-${version}";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchurl {
     url = "https://pwmt.org/projects/zathura/download/zathura-${version}.tar.xz";
-    sha256 = "1j0yah09adv3bsjhhbqra5lambal32svk8fxmf89wwmcqrcr4qma";
+    sha256 = "1znr3psqda06xklzj8mn452w908llapcg1rj468jwpg0wzv6pxfn";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/chromium/common.nix

@@ -1,4 +1,4 @@
-{ stdenv, ninja, which, nodejs, fetchurl, fetchpatch, gnutar
+{ stdenv, gn, ninja, which, nodejs, fetchurl, fetchpatch, gnutar
 
 # default dependencies
 , bzip2, flac, speex, libopus
@@ -139,11 +139,6 @@ let
     # (gentooPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000")
       ./patches/fix-freetype.patch
       ./patches/nix_plugin_paths_68.patch
-    ]  ++ optionals (versionRange "68" "69") [
-      ./patches/remove-webp-include-68.patch
-      (githubPatch "4d10424f9e2a06978cdd6cdf5403fcaef18e49fc" "11la1jycmr5b5rw89mzcdwznmd2qh28sghvz9klr1qhmsmw1vzjc")
-      (githubPatch "56cb5f7da1025f6db869e840ed34d3b98b9ab899" "04mp5r1yvdvdx6m12g3lw3z51bzh7m3gr73mhblkn4wxdbvi3dcs")
-    ]  ++ optionals (versionAtLeast version "69") [
       ./patches/remove-webp-include-69.patch
     ] ++ optional enableWideVine ./patches/widevine.patch;
 
@@ -243,15 +238,11 @@ let
     configurePhase = ''
       runHook preConfigure
 
-      # Build gn
-      python tools/gn/bootstrap/bootstrap.py -v -s --no-clean
-      PATH="$PWD/out/Release:$PATH"
-
       # This is to ensure expansion of $out.
       libExecPath="${libExecPath}"
       python build/linux/unbundle/replace_gn_files.py \
         --system-libraries ${toString gnSystemLibraries}
-      gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
+      ${gn}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
 
       # Fail if `gn gen` contains a WARNING.
       grep -o WARNING gn-gen-outputs.txt && echo "Found gn WARNING, exiting nix build" && exit 1

pkgs/applications/networking/browsers/chromium/patches/remove-webp-include-68.patch

@@ -1,12 +0,0 @@
---- a/third_party/blink/renderer/platform/image-encoders/image_encoder.h
-+++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.h
-@@ -8,7 +8,7 @@
- #include "third_party/blink/renderer/platform/platform_export.h"
- #include "third_party/blink/renderer/platform/wtf/vector.h"
- #include "third_party/libjpeg/jpeglib.h"          // for JPEG_MAX_DIMENSION
--#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
-+#define WEBP_MAX_DIMENSION 16383
- #include "third_party/skia/include/core/SkStream.h"
- #include "third_party/skia/include/encode/SkJpegEncoder.h"
- #include "third_party/skia/include/encode/SkPngEncoder.h"
-

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -98,11 +98,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     name = "flashplayer-ppapi-${version}";
-    version = "30.0.0.154";
+    version = "31.0.0.108";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0bi9b6syx7x2avixgjwanrvynzanf89xm2g3nxazw9qgxxc1cp48";
+      sha256 = "0dcwyx0fp7wbsx0cyi7xpwq0nnvcvkzfgi6zyy75487820ssc4h1";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0w5k1446j45796vj8p6kv5cdrkrxyr7rh8d8vavplfldbvg36bdw";
-    sha256bin64 = "0a7gmbcps3b85rhwgrvg41m9db2n3igwr4hncm7kcqnq5hr60v8s";
-    version = "69.0.3497.32";
+    sha256 = "0i3iz6c05ykqxbq58sx954nky0gd0schl7ik2r56p3jqsk8cfnhn";
+    sha256bin64 = "03k5y1nyzx26mxwxmdijkl2kj49vm5vhbxhakfxxjg3r1v0rsqrs";
+    version = "69.0.3497.81";
   };
   dev = {
-    sha256 = "15gk2jbjv3iy4hg4xm1f66x5jqfqh9f98wfzrcsd5ix3ki3f9g3c";
-    sha256bin64 = "1lir6q31dnjsbrz99bfx74r5j6f0c1a443ky1k0idbx6ysvr8nnm";
-    version = "70.0.3521.2";
+    sha256 = "1lx6dfd6w675b4kyrci8ikc8rfmjc1aqmm7bimxp3h4p97j5wml1";
+    sha256bin64 = "0fsxj9h25glp3akw0x2rc488w5zr5v5yvl6ry7fy8w70fqgynffj";
+    version = "70.0.3538.9";
   };
   stable = {
-    sha256 = "1676y2axl5ihvv8jid2i9wp4i4awxzij5nwvd5zx98506l3088bh";
-    sha256bin64 = "0d352maw1630g0hns3c0g0n95bp5iqh7nzs8bnv48kxz87snmpdj";
-    version = "68.0.3440.106";
+    sha256 = "0i3iz6c05ykqxbq58sx954nky0gd0schl7ik2r56p3jqsk8cfnhn";
+    sha256bin64 = "1f3shb85jynxq37vjxxkkxrjayqgvpss1zws5i28x6i9nygfzay7";
+    version = "69.0.3497.81";
   };
 }

pkgs/applications/networking/browsers/eolie/default.nix

@@ -1,45 +1,53 @@
-{ stdenv, fetchgit, meson, ninja, pkgconfig, wrapGAppsHook
-, desktop-file-utils, gobjectIntrospection, python36Packages
-, gnome3, gst_all_1, gtkspell3, hunspell }:
+{ stdenv, fetchgit, meson, ninja, pkgconfig
+, python3, gtk3, libsecret, gst_all_1, webkitgtk
+, glib-networking, gtkspell3, hunspell, desktop-file-utils
+, gobjectIntrospection, wrapGAppsHook }:
 
-stdenv.mkDerivation rec {
+python3.pkgs.buildPythonApplication rec {
   name = "eolie-${version}";
-  version = "0.9.35";
+  version = "0.9.36";
+
+  format = "other";
+  doCheck = false;
 
   src = fetchgit {
     url = "https://gitlab.gnome.org/World/eolie";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    sha256 = "0x3p1fgx1fhrnr7vkkpnl34401r6k6xg2mrjff7ncb1k57q522k7";
+    sha256 = "1pqs6lddkj7nvxdwf0yncwdcr7683mpvx3912vn7b1f2q2zkp1fv";
   };
 
-  nativeBuildInputs = with python36Packages; [
+  nativeBuildInputs = [
     desktop-file-utils
     gobjectIntrospection
     meson
     ninja
     pkgconfig
     wrapGAppsHook
-    wrapPython
   ];
 
-  buildInputs = [ gtkspell3 hunspell python36Packages.pygobject3 ] ++ (with gnome3; [
-    glib glib-networking gsettings-desktop-schemas gtk3 webkitgtk libsecret
-  ]) ++ (with gst_all_1; [
-    gst-libav gst-plugins-base gst-plugins-ugly gstreamer
-  ]);
+  buildInputs = with gst_all_1; [
+    glib-networking
+    gst-libav
+    gst-plugins-base
+    gst-plugins-ugly
+    gstreamer
+    gtk3
+    gtkspell3
+    hunspell
+    libsecret
+    webkitgtk
+  ];
 
-  pythonPath = with python36Packages; [
+  pythonPath = with python3.pkgs; [
     beautifulsoup4
     pycairo
     pygobject3
     python-dateutil
   ];
 
-  postFixup = "wrapPythonPrograms";
-
   postPatch = ''
-    chmod +x meson_post_install.py # patchShebangs requires executable file
+    chmod +x meson_post_install.py
     patchShebangs meson_post_install.py
   '';
 

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -20,10 +20,10 @@ rec {
 
   firefox = common rec {
     pname = "firefox";
-    version = "61.0.2";
+    version = "62.0.2";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "3zzcxqjpsn2m5z4l66rxrq7yf58aii370jj8pcl50smcd55sfsyknnc20agbppsw4k4pnwycfn57im33swwkjzg0hk0h2ng4rvi42x2";
+      sha512 = "0j5q1aa7jhq4pydaywp8ymibc319wv3gw2q15qp14i069qk3fpn33zb5z86lhb6z864f88ikx3zxv6phqs96qvzj25yqbh7nxmzwhvv";
     };
 
     patches = nixpkgsPatches ++ [
@@ -69,10 +69,10 @@ rec {
 
   firefox-esr-60 = common rec {
     pname = "firefox-esr";
-    version = "60.1.0esr";
+    version = "60.2.1esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "2bg7zvkpy1x2ryiazvk4nn5m94v0addbhrcrlcf9djnqjf14rp5q50lbiymhxxz0988vgpicsvizifb8gb3hi7b8g17rdw6438ddhh6";
+      sha512 = "2mklws09haki91w3js2i5pv8g3z5ck4blnzxvdbk5qllqlv465hn7rvns78hbcbids55mqx50fsn0161la73v25zs04bf8xdhbkcpsm";
     };
 
     patches = nixpkgsPatches ++ [

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -73,25 +73,25 @@ let
 in
 stdenv.mkDerivation rec {
   name = "flashplayer-${version}";
-  version = "30.0.0.154";
+  version = "31.0.0.108";
 
   src = fetchurl {
     url =
       if debug then
-        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/30/flash_player_npapi_linux_debug.${arch}.tar.gz"
+        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/31/flash_player_npapi_linux_debug.${arch}.tar.gz"
       else
         "https://fpdownload.adobe.com/get/flashplayer/pdc/${version}/flash_player_npapi_linux.${arch}.tar.gz";
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "04hfh0vn1n70gdpfydq0sj94d6rkbk80h4pmy3rsfvhg0x540wx8"
+          "1mn29ahxjf6pdy2zp2na14cz46jrl88f54kp3bs3cz75syyizyb6"
         else
-          "073327sszbvkglh5b18axmwv40sy2vyacdhcd1fx82qskv44sfda"
+          "0inpj6bcsn5lh8gdv1wxpgipzrmpc553nhr68a55b2wff9fkv1ci"
       else
         if arch == "x86_64" then
-          "03ypgzy88ck5rn1q971v0km9yw3p10ly1zkxh239v6nx0hs35w84"
+          "1dfgsl5jf8ja9f7wwkzj5bfz1v5rdsyf4qhg1shqqldadmyyha7p"
         else
-          "0rld7i659ccp4gvcvdkqkc1lajvlss5d4qndzf9aqiksvdknv62x";
+          "0yiqwwqs3z9zzkfgqzjwqqdr2vaj1ia5xychs9fgxix3y4j934da";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -49,19 +49,19 @@
 
 stdenv.mkDerivation rec {
   name = "flashplayer-standalone-${version}";
-  version = "30.0.0.154";
+  version = "31.0.0.108";
 
   src = fetchurl {
     url =
       if debug then
-        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/30/flash_player_sa_linux_debug.x86_64.tar.gz"
+        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/31/flash_player_sa_linux_debug.x86_64.tar.gz"
       else
-        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/30/flash_player_sa_linux.x86_64.tar.gz";
+        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/31/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "133zhgc5fh6s0xr93lv70xcrgvaj7lhjxk5w7xz79h3mp185p3g4"
+        "0i047fvj3x9lx7x8bf7jl1ybf9xpmr6g77q0h7n2s8qvscsw0pmm"
       else
-        "1xz1l5q0zahalh0l4mkrwhmfrmcli3sckg3rcfnllizq9rbfzcmr";
+        "19wfs452ix57yfi4cy2din6mi5jky9hjzbdjny1bl8w32fy8xmm3";
   };
 
   nativeBuildInputs = [ unzip ];