From f6faec26e31d8ae468945500b958cb5f1cf41895 Mon Sep 17 00:00:00 2001
From: Daniel Frank <git@danielfrank.net>
Date: Sun, 14 Jun 2020 01:54:03 +0200
Subject: [PATCH 01/63] nextcloud: 18.0.4 -> 18.0.6

(cherry picked from commit 660973d8239797a63a7de91478c9126dee707ca1)
---
 pkgs/servers/nextcloud/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 541804702a52..c1a595b32024 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -31,7 +31,7 @@ in {
   };
 
   nextcloud18 = generic {
-    version = "18.0.4";
-    sha256 = "0aa3f4xbkzacfw0h9aic0ywk5mqlwka83qaszizj8lmk68kf3n7s";
+    version = "18.0.6";
+    sha256 = "1chmkg31jc1nr53y8r886mmd2jzb78094mrx7ggcfpjfkkv8b89s";
   };
 }

From 6cd67ec48f22a1c4fd58a6fe92da7d91d32911c7 Mon Sep 17 00:00:00 2001
From: Manuel Mendez <mmendez534@gmail.com>
Date: Wed, 13 May 2020 14:34:10 -0400
Subject: [PATCH 02/63] go: stop setting GOPATH

The compiler does not need it anymore, has not needed it for many years
iirc. This just goes in and pollutes the environment overriding the
users GOPATH and causing grief.

Go even warns about it itself, without vs with this commit:

```sh
~> go env GOPATH
/home/manny/go
~> nix-shell -p go
~> go env GOPATH
warning: GOPATH set to GOROOT (/nix/store/gvw1mfpdrk7i82884yhxf9lf5j3c12zm-go-1.14.1/share/go) has no effect
/nix/store/gvw1mfpdrk7i82884yhxf9lf5j3c12zm-go-1.14.1/share/go
~> exit
~> nix-shell -I nixpkgs=cloned/NixOS/nixpkgs -p go
~> go env GOPATH
/home/manny/go
~> exit
```

(cherry picked from commit a1e13f6140a568b73c1c36bb9ef79d7876ccaae3)
---
 pkgs/development/compilers/go/1.14.nix      | 2 --
 pkgs/development/compilers/go/1.4.nix       | 2 --
 pkgs/development/compilers/go/setup-hook.sh | 5 -----
 3 files changed, 9 deletions(-)
 delete mode 100644 pkgs/development/compilers/go/setup-hook.sh

diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index b11bb61c6379..07d2450eccea 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -230,8 +230,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  setupHook = ./setup-hook.sh;
-
   disallowedReferences = [ goBootstrap ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/compilers/go/1.4.nix b/pkgs/development/compilers/go/1.4.nix
index 0dd852a1ef16..7f0b2ba9ceb8 100644
--- a/pkgs/development/compilers/go/1.4.nix
+++ b/pkgs/development/compilers/go/1.4.nix
@@ -151,8 +151,6 @@ stdenv.mkDerivation rec {
     ./all.bash
   '';
 
-  setupHook = ./setup-hook.sh;
-
   meta = with stdenv.lib; {
     branch = "1.4";
     homepage = http://golang.org/;
diff --git a/pkgs/development/compilers/go/setup-hook.sh b/pkgs/development/compilers/go/setup-hook.sh
deleted file mode 100644
index 7dce15eeb102..000000000000
--- a/pkgs/development/compilers/go/setup-hook.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-addToGoPath() {
-    addToSearchPath GOPATH $1/share/go
-}
-
-addEnvHooks "$targetOffset" addToGoPath

From 296e584a00e9590b8d2c67c53921ab081374b2b5 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 16 May 2020 10:21:58 +1000
Subject: [PATCH 03/63] go_1_13: stop setting GOPATH

a1e13f6140a568b73c1c36bb9ef79d7876ccaae3

(cherry picked from commit 469f14ceecf94dd13527c9153c25984d674768a7)
---
 pkgs/development/compilers/go/1.13.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
index 58786a94efe5..a1052e387ef1 100644
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@@ -230,8 +230,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  setupHook = ./setup-hook.sh;
-
   disallowedReferences = [ goBootstrap ];
 
   meta = with stdenv.lib; {

From c9965e2df7cf17777581e25067fab75a83dd7529 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 13 Jun 2020 13:22:07 +1000
Subject: [PATCH 04/63] go_1_12: stop setting GOPATH

---
 pkgs/development/compilers/go/1.12.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.12.nix b/pkgs/development/compilers/go/1.12.nix
index a48c73363109..0caddc65c9b5 100644
--- a/pkgs/development/compilers/go/1.12.nix
+++ b/pkgs/development/compilers/go/1.12.nix
@@ -233,8 +233,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  setupHook = ./setup-hook.sh;
-
   disallowedReferences = [ goBootstrap ];
 
   meta = with stdenv.lib; {

From 382b2dbad796a3bc8371179a15f72857dd6de4e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 5 May 2020 17:58:20 +0100
Subject: [PATCH 05/63] go: 1.14.1 -> 1.14.2

(cherry picked from commit 416caeb6dbd59d5c53da542dcf3184f11141f354)
---
 pkgs/development/compilers/go/1.14.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 07d2450eccea..8a2ff280c0c1 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0xkna02clggcdgl5xxwani62krnf64x6p3hk9k5v9ldh2lhmglia";
+    sha256 = "0z3zxsnhmsxplnwfw1l9gr6jgglwp50sr3p5njknv9i6jzk89plq";
   };
 
   # perl is used for testing go vet

From 2a1c67cb2dbe535d0d8f08be620860a1f6b65213 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Fri, 15 May 2020 09:54:39 +1000
Subject: [PATCH 06/63] go: 1.14.2 -> 1.14.3

https://golang.org/doc/devel/release.html#go1.14.minor
(cherry picked from commit 8d41f9f281a8317faa45c4270e8d48bf657cc1a0)
---
 pkgs/development/compilers/go/1.14.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 8a2ff280c0c1..94e6cf98c81f 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0z3zxsnhmsxplnwfw1l9gr6jgglwp50sr3p5njknv9i6jzk89plq";
+    sha256 = "0mmgf74snprdiajgh99jjliwjl5im71qcgm5qrxpnyfisiw3f0lk";
   };
 
   # perl is used for testing go vet

From 203fcbada9d49d2bf4b5899dafa2473791c58cbf Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 16 May 2020 10:23:00 +1000
Subject: [PATCH 07/63] go_1_13: 1.13.8 -> 1.13.11

(cherry picked from commit d1e7b0049ca5bfb48a3fd597278acdc5b97b700f)
---
 pkgs/development/compilers/go/1.13.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
index a1052e387ef1..0731b5082a1e 100644
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.13.8";
+  version = "1.13.11";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0d7cxffk72568h46srzswrxd0bsdip7amgkf499wzn6l6d3g0fxi";
+    sha256 = "0y86q2k00lh8c7wj3lha43g804iwr61nap8j3i907l2sway1mvc9";
   };
 
   # perl is used for testing go vet

From b1cbd0870337da098feb6887a8891299727e9857 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 2 Jun 2020 09:29:55 +1000
Subject: [PATCH 08/63] go_1_13: 1.13.11 -> 1.13.12

https://golang.org/doc/devel/release.html#go1.13.minor
(cherry picked from commit 7da08afd273f13124ab708a2c969e426f70fa08e)
---
 pkgs/development/compilers/go/1.13.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.13.nix b/pkgs/development/compilers/go/1.13.nix
index 0731b5082a1e..1e1f53746c5d 100644
--- a/pkgs/development/compilers/go/1.13.nix
+++ b/pkgs/development/compilers/go/1.13.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.13.11";
+  version = "1.13.12";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0y86q2k00lh8c7wj3lha43g804iwr61nap8j3i907l2sway1mvc9";
+    sha256 = "0d5s5rqyzp6ykj4x1dz8infcsmj3gy8djnf63ji971ypwi6jrfhp";
   };
 
   # perl is used for testing go vet

From 16a461d1471df4f599dba6e7da6aca086af7ba71 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 2 Jun 2020 09:32:40 +1000
Subject: [PATCH 09/63] go: 1.14.3 -> 1.14.4

https://golang.org/doc/devel/release.html#go1.14.minor
(cherry picked from commit 9f978147f826c55d01db6d2aeeeff2a71f80b932)
---
 pkgs/development/compilers/go/1.14.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 94e6cf98c81f..1435b36fbc76 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.3";
+  version = "1.14.4";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0mmgf74snprdiajgh99jjliwjl5im71qcgm5qrxpnyfisiw3f0lk";
+    sha256 = "1105qk2l4kfy1ki9n9gh8j4gfqrfgfwapa1fp38hih9aphxsy4bh";
   };
 
   # perl is used for testing go vet

From 4094b363c394d346e696b856bfd5431e334dec7c Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Mon, 8 Jun 2020 20:35:08 +1000
Subject: [PATCH 10/63] go: fix TestDontCacheBrokenHTTP2Conn failure

(cherry picked from commit aae680cd5d508b4696252368b72490b96c101277)
---
 pkgs/development/compilers/go/1.14.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix
index 1435b36fbc76..f35c339ebd07 100644
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@@ -2,6 +2,7 @@
 , perl, which, pkgconfig, patch, procps, pcre, cacert, Security, Foundation
 , mailcap, runtimeShell
 , buildPackages, pkgsTargetTarget
+, fetchpatch
 }:
 
 let
@@ -138,6 +139,12 @@ stdenv.mkDerivation rec {
     ./go-1.9-skip-flaky-20072.patch
     ./skip-external-network-tests.patch
     ./skip-nohup-tests.patch
+
+    # fix rare TestDontCacheBrokenHTTP2Conn failure
+    (fetchpatch {
+      url = "https://github.com/golang/go/commit/ea1437a8cdf6bb3c2d2447833a5d06dbd75f7ae4.patch";
+      sha256 = "1lyzy4nf8c34a966vw45j3j7hzpvncq2gqspfxffzkyh17xd8sgy";
+    })
   ] ++ [
     # breaks under load: https://github.com/golang/go/issues/25628
     (if stdenv.isAarch32

From 9ae22e3409ab151ab0f0161d909608e49083b47a Mon Sep 17 00:00:00 2001
From: Benjamin Hipple <bhipple@protonmail.com>
Date: Wed, 11 Mar 2020 02:04:46 -0400
Subject: [PATCH 11/63] buildGoModule: passthru the modSha256 (#82027)

The builder does not technically need the modSha256 of the vendor dir, and even
though we pass it the entire vendor dir it makes sense not to risk having an
accidental dependency on that variable.

However, tools like [nixpkgs-update](https://github.com/ryantm/nixpkgs-update)
need to inspect the `modSha256` of a package in order to be able to update them,
and since this is a real part of the package (describes info about its
dependencies) let's add it to `passthru`.

Specifically, this allows us to run a cmd like `nix eval -f . tflint.modSha256`
to get the current value, which is how the bot finds it to replace with the new
version in the Rust ecosystem.

(cherry picked from commit 5f77ff63849396c2b0dd243c0bb9fdae13c0fab6)
---
 pkgs/development/go-modules/generic/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 1bffb71e8f9d..1bf13c18821e 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -210,7 +210,7 @@ let
 
     disallowedReferences = lib.optional (!allowGoReference) go;
 
-    passthru = passthru // { inherit go go-modules; };
+    passthru = passthru // { inherit go go-modules modSha256; };
 
     meta = {
       # Add default meta information

From 470d55587f4e6383341f3eeac823092690cf6776 Mon Sep 17 00:00:00 2001
From: Colin L Rice <colin@daedrum.net>
Date: Wed, 29 Apr 2020 23:08:21 -0400
Subject: [PATCH 12/63] go-modules: Augment builds w/ vendor src

This is done in response to complaints that the module format is not
human readable. The vendor source blob is flat files and should be
extremely readable.

(cherry picked from commit 9761128d2da7bf4d878982918242e43ae28f9b94)
---
 .../go-modules/generic/default.nix            | 58 ++++++++++++-------
 1 file changed, 38 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 1bf13c18821e..3184937adaa6 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -13,12 +13,15 @@
 # path to go.mod and go.sum directory
 , modRoot ? "./"
 
-# modSha256 is the sha256 of the vendored dependencies
+# vendorSha256 is the sha256 of the vendored dependencies
 #
-# CAUTION: if `null` is used as a value, the derivation won't be a
-# fixed-output derivation but disable the build sandbox instead. Don't use
-# this in nixpkgs as Hydra won't build those packages.
-, modSha256
+# if vendorSha256 is null, then we won't fetch any dependencies and
+# rely on the vendor folder within the source.
+, vendorSha256 ? null
+# Whether to delete the vendor folder supplied with the source.
+, deleteVendor ? false
+
+, modSha256 ? null
 
 # We want parallel builds by default
 , enableParallelBuilding ? true
@@ -37,21 +40,26 @@
 with builtins;
 
 let
-  args = removeAttrs args' [ "overrideModAttrs" "modSha256" "disabled" ];
+  args = removeAttrs args' [ "overrideModAttrs" "vendorSha256" "disabled" ];
 
   removeReferences = [ ] ++ lib.optional (!allowGoReference) go;
 
   removeExpr = refs: ''remove-references-to ${lib.concatMapStrings (ref: " -t ${ref}") refs}'';
 
-  go-modules = go.stdenv.mkDerivation (let modArgs = {
+  deleteFlag = if deleteVendor then "true" else "false";
+
+  go-modules = if vendorSha256 != null then go.stdenv.mkDerivation (let modArgs = {
+
     name = "${name}-go-modules";
 
-    nativeBuildInputs = [ go git cacert ];
+    nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ go git cacert ];
 
     inherit (args) src;
     inherit (go) GOOS GOARCH;
 
     patches = args.patches or [];
+    preBuild = args.preBuild or "";
+    sourceRoot = args.sourceRoot or "";
 
     GO111MODULE = "on";
 
@@ -64,7 +72,6 @@ let
 
       export GOCACHE=$TMPDIR/go-cache
       export GOPATH="$TMPDIR/go"
-      mkdir -p "''${GOPATH}/pkg/mod/cache/download"
       cd "${modRoot}"
       runHook postConfigure
     '';
@@ -72,7 +79,16 @@ let
     buildPhase = args.modBuildPhase or ''
       runHook preBuild
 
-      go mod download
+      if [ ${deleteFlag} == "true" ]; then
+        rm -rf vendor
+      fi
+
+      if [ -e vendor ]; then
+        echo "vendor folder exists, please set 'vendorSha256=null;' or 'deleteVendor=true;' in your expression"
+        exit 10
+      fi
+      go mod vendor
+      mkdir -p vendor
 
       runHook postBuild
     '';
@@ -81,23 +97,19 @@ let
       runHook preInstall
 
       # remove cached lookup results and tiles
-      rm -rf "''${GOPATH}/pkg/mod/cache/download/sumdb"
-      cp -r "''${GOPATH}/pkg/mod/cache/download" $out
+      cp -r --reflink=auto vendor $out
 
       runHook postInstall
     '';
 
     dontFixup = true;
   }; in modArgs // (
-    if modSha256 == null then
-      { __noChroot = true; }
-    else
       {
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
-        outputHash = modSha256;
+        outputHash = vendorSha256;
       }
-  ) // overrideModAttrs modArgs);
+  ) // overrideModAttrs modArgs) else "";
 
   package = go.stdenv.mkDerivation (args // {
     nativeBuildInputs = [ removeReferencesTo go ] ++ nativeBuildInputs;
@@ -105,6 +117,7 @@ let
     inherit (go) GOOS GOARCH;
 
     GO111MODULE = "on";
+    GOFLAGS = "-mod=vendor";
 
     configurePhase = args.configurePhase or ''
       runHook preConfigure
@@ -112,9 +125,12 @@ let
       export GOCACHE=$TMPDIR/go-cache
       export GOPATH="$TMPDIR/go"
       export GOSUMDB=off
-      export GOPROXY=file://${go-modules}
-
+      export GOPROXY=off
       cd "$modRoot"
+      if [ -n "${go-modules}" ]; then 
+          rm -rf vendor
+          ln -s ${go-modules} vendor
+      fi
 
       runHook postConfigure
     '';
@@ -210,7 +226,7 @@ let
 
     disallowedReferences = lib.optional (!allowGoReference) go;
 
-    passthru = passthru // { inherit go go-modules modSha256; };
+    passthru = passthru // { inherit go go-modules vendorSha256 ; };
 
     meta = {
       # Add default meta information
@@ -223,5 +239,7 @@ let
   });
 in if disabled then
   throw "${package.name} not supported for go ${go.meta.branch}"
+else if modSha256 != null then
+  throw "${package.name} should use vendorSha256 not modSha256"
 else
   package

From 124d70cc9d146738f0342e5a3dbdefecc6902d0b Mon Sep 17 00:00:00 2001
From: Colin L Rice <colin@daedrum.net>
Date: Sat, 2 May 2020 02:22:14 -0400
Subject: [PATCH 13/63] go-modules: Add in old modsha256 w/ warning

(removed warning for 20.03)
(cherry picked from commit a0ddea1d6a9f07b0631e0dbcd3b7240d2eb82ef7)
---
 .../go-modules/generic/default.nix            |   2 +-
 pkgs/development/go-modules/generic/old.nix   | 229 ++++++++++++++++++
 2 files changed, 230 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/go-modules/generic/old.nix

diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 3184937adaa6..4f36b3fed32c 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -240,6 +240,6 @@ let
 in if disabled then
   throw "${package.name} not supported for go ${go.meta.branch}"
 else if modSha256 != null then
-  throw "${package.name} should use vendorSha256 not modSha256"
+  (import ./old.nix { inherit go cacert git lib removeReferencesTo stdenv; } args')
 else
   package
diff --git a/pkgs/development/go-modules/generic/old.nix b/pkgs/development/go-modules/generic/old.nix
new file mode 100644
index 000000000000..42b446b9fa86
--- /dev/null
+++ b/pkgs/development/go-modules/generic/old.nix
@@ -0,0 +1,229 @@
+{ go, cacert, git, lib, removeReferencesTo, stdenv }:
+
+{ name ? "${args'.pname}-${args'.version}"
+, src
+, buildInputs ? []
+, nativeBuildInputs ? []
+, passthru ? {}
+, patches ? []
+
+# A function to override the go-modules derivation
+, overrideModAttrs ? (_oldAttrs : {})
+
+# path to go.mod and go.sum directory
+, modRoot ? "./"
+
+# modSha256 is the sha256 of the vendored dependencies
+#
+# CAUTION: if `null` is used as a value, the derivation won't be a
+# fixed-output derivation but disable the build sandbox instead. Don't use
+# this in nixpkgs as Hydra won't build those packages.
+, modSha256
+
+# We want parallel builds by default
+, enableParallelBuilding ? true
+
+# Disabled flag
+, disabled ? false
+
+# Do not enable this without good reason
+# IE: programs coupled with the compiler
+, allowGoReference ? false
+
+, meta ? {}
+
+, ... }@args':
+
+with builtins;
+
+let
+  args = removeAttrs args' [ "overrideModAttrs" "modSha256" "disabled" ];
+
+  removeReferences = [ ] ++ lib.optional (!allowGoReference) go;
+
+  removeExpr = refs: ''remove-references-to ${lib.concatMapStrings (ref: " -t ${ref}") refs}'';
+
+  go-modules = go.stdenv.mkDerivation (let modArgs = {
+    name = "${name}-go-modules";
+
+    nativeBuildInputs = [ go git cacert ];
+
+    inherit (args) src;
+    inherit (go) GOOS GOARCH;
+
+    patches = args.patches or [];
+
+    GO111MODULE = "on";
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND" "SOCKS_SERVER"
+    ];
+
+    configurePhase = args.modConfigurePhase or ''
+      runHook preConfigure
+
+      export GOCACHE=$TMPDIR/go-cache
+      export GOPATH="$TMPDIR/go"
+      mkdir -p "''${GOPATH}/pkg/mod/cache/download"
+      cd "${modRoot}"
+      runHook postConfigure
+    '';
+
+    buildPhase = args.modBuildPhase or ''
+      runHook preBuild
+
+      go mod download
+
+      runHook postBuild
+    '';
+
+    installPhase = args.modInstallPhase or ''
+      runHook preInstall
+
+      # remove cached lookup results and tiles
+      rm -rf "''${GOPATH}/pkg/mod/cache/download/sumdb"
+      cp -r "''${GOPATH}/pkg/mod/cache/download" $out
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+  }; in modArgs // (
+    if modSha256 == null then
+      { __noChroot = true; }
+    else
+      {
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+        outputHash = modSha256;
+      }
+  ) // overrideModAttrs modArgs);
+
+  package = go.stdenv.mkDerivation (args // {
+    nativeBuildInputs = [ removeReferencesTo go ] ++ nativeBuildInputs;
+
+    inherit (go) GOOS GOARCH;
+
+    GO111MODULE = "on";
+
+    configurePhase = args.configurePhase or ''
+      runHook preConfigure
+
+      export GOCACHE=$TMPDIR/go-cache
+      export GOPATH="$TMPDIR/go"
+      export GOSUMDB=off
+      export GOPROXY=file://${go-modules}
+
+      cd "$modRoot"
+
+      runHook postConfigure
+    '';
+
+    buildPhase = args.buildPhase or ''
+      runHook preBuild
+
+      buildGoDir() {
+        local d; local cmd;
+        cmd="$1"
+        d="$2"
+        . $TMPDIR/buildFlagsArray
+        echo "$d" | grep -q "\(/_\|examples\|Godeps\|testdata\)" && return 0
+        [ -n "$excludedPackages" ] && echo "$d" | grep -q "$excludedPackages" && return 0
+        local OUT
+        if ! OUT="$(go $cmd $buildFlags "''${buildFlagsArray[@]}" -v -p $NIX_BUILD_CORES $d 2>&1)"; then
+          if ! echo "$OUT" | grep -qE '(no( buildable| non-test)?|build constraints exclude all) Go (source )?files'; then
+            echo "$OUT" >&2
+            return 1
+          fi
+        fi
+        if [ -n "$OUT" ]; then
+          echo "$OUT" >&2
+        fi
+        return 0
+      }
+
+      getGoDirs() {
+        local type;
+        type="$1"
+        if [ -n "$subPackages" ]; then
+          echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+        else
+          find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique
+        fi
+      }
+
+      if (( "''${NIX_DEBUG:-0}" >= 1 )); then
+        buildFlagsArray+=(-x)
+      fi
+
+      if [ ''${#buildFlagsArray[@]} -ne 0 ]; then
+        declare -p buildFlagsArray > $TMPDIR/buildFlagsArray
+      else
+        touch $TMPDIR/buildFlagsArray
+      fi
+      if [ -z "$enableParallelBuilding" ]; then
+          export NIX_BUILD_CORES=1
+      fi
+      for pkg in $(getGoDirs ""); do
+        echo "Building subPackage $pkg"
+        buildGoDir install "$pkg"
+      done
+    '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+      # normalize cross-compiled builds w.r.t. native builds
+      (
+        dir=$GOPATH/bin/${go.GOOS}_${go.GOARCH}
+        if [[ -n "$(shopt -s nullglob; echo $dir/*)" ]]; then
+          mv $dir/* $dir/..
+        fi
+        if [[ -d $dir ]]; then
+          rmdir $dir
+        fi
+      )
+    '' + ''
+      runHook postBuild
+    '';
+
+    doCheck = args.doCheck or false;
+    checkPhase = args.checkPhase or ''
+      runHook preCheck
+
+      for pkg in $(getGoDirs test); do
+        buildGoDir test "$pkg"
+      done
+
+      runHook postCheck
+    '';
+
+    installPhase = args.installPhase or ''
+      runHook preInstall
+
+      mkdir -p $out
+      dir="$GOPATH/bin"
+      [ -e "$dir" ] && cp -r $dir $out
+
+      runHook postInstall
+    '';
+
+    preFixup = (args.preFixup or "") + ''
+      find $out/bin -type f -exec ${removeExpr removeReferences} '{}' + || true
+    '';
+
+    strictDeps = true;
+
+    disallowedReferences = lib.optional (!allowGoReference) go;
+
+    passthru = passthru // { inherit go go-modules modSha256; };
+
+    meta = {
+      # Add default meta information
+      platforms = go.meta.platforms or lib.platforms.all;
+    } // meta // {
+      # add an extra maintainer to every package
+      maintainers = (meta.maintainers or []) ++
+                    [ lib.maintainers.kalbasit ];
+    };
+  });
+in if disabled then
+  throw "${package.name} not supported for go ${go.meta.branch}"
+else
+  package

From 4ac4a236eb69d60bde8355e3582216190e9041de Mon Sep 17 00:00:00 2001
From: Benjamin Andresen <b@lambda.icu>
Date: Fri, 22 May 2020 13:11:21 +0200
Subject: [PATCH 14/63] chromedriver: 81.0.4044.69 -> 83.0.4103.39

---
 pkgs/development/tools/selenium/chromedriver/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/selenium/chromedriver/default.nix b/pkgs/development/tools/selenium/chromedriver/default.nix
index 82ddf753e38d..995e33ee7cc6 100644
--- a/pkgs/development/tools/selenium/chromedriver/default.nix
+++ b/pkgs/development/tools/selenium/chromedriver/default.nix
@@ -6,12 +6,12 @@ let
   allSpecs = {
     x86_64-linux = {
       system = "linux64";
-      sha256 = "1mqsangjindfqgvjxgmpgfrcd8a2lqmwl587l0ip0p5wwz8yq5wi";
+      sha256 = "149p43zaz45malmff1274r2bwjcyjwsdickivk3pd0mvnjbfid2r";
     };
 
     x86_64-darwin = {
       system = "mac64";
-      sha256 = "18ydf2bk5aiin3yffb9z8215idz65nkhgxq0mmlvwb8gwsdvnwi1";
+      sha256 = "1xpyqxpsz3r653ls67s6alv4g2vr4lxf29gyxc162ikywyrx80nr";
     };
   };
 
@@ -28,7 +28,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "chromedriver";
-  version = "81.0.4044.69";
+  version = "83.0.4103.39";
 
   src = fetchurl {
     url = "https://chromedriver.storage.googleapis.com/${version}/chromedriver_${spec.system}.zip";

From 788764b193f681a0d97c1b3e98cd687d131ef6b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 18 Jun 2020 16:39:47 +0200
Subject: [PATCH 15/63] transmission: patch CVE-2018-10756

nixpkgs master is not vulnerable to this.  We use Fedora patch,
as the upstream one does not apply to this version.
Fixes #91026 (roundup issue).
---
 .../networking/p2p/transmission/default.nix          | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/p2p/transmission/default.nix b/pkgs/applications/networking/p2p/transmission/default.nix
index 25996953e11a..bdecb4b47b6c 100644
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, intltool, file, wrapGAppsHook
+{ stdenv, fetchurl, fetchpatch, pkgconfig, intltool, file, wrapGAppsHook
 , openssl, curl, libevent, inotify-tools, systemd, zlib
 , enableGTK3 ? false, gtk3
 , enableSystemd ? stdenv.isLinux
@@ -24,6 +24,16 @@ stdenv.mkDerivation rec {
     ++ optionals enableSystemd [ systemd ]
     ++ optionals stdenv.isLinux [ inotify-tools ];
 
+  patches = [
+    (fetchpatch {
+      name = "cve-2018-10756.diff";
+      url = "https://src.fedoraproject.org/rpms/transmission/raw/ec98cd40/f/"
+          + "2123adf8e5e1c2b48791f9d22fc8c747e974180e.patch";
+      extraPrefix = "./"; # this way we don't need to add -p0 flag
+      sha256 = "1wq2sk81yyi8ida4115f9mpkna63dijkx8vphac72w2fhpz905k7";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace ./configure \
       --replace "libsystemd-daemon" "libsystemd" \

From 2b417708c282d84316366f4125b00b29c49df10f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 18 Jun 2020 17:40:42 +0200
Subject: [PATCH 16/63] Remove Google Talk Plugin

This plugin is no longer necessary anyway, but having it enabled can
cause Firefox and KDE to malfunction, e.g. by hanging for a few
seconds frequently. This is caused by the broken LD_PRELOAD library
that doesn't handle O_TMPFILE properly, so ~/.cache/ksycoca5_* is
created with 0000 permissions. As a result Firefox will constantly
regenerate the ksycoca database.
---
 .../networking/browsers/firefox/wrapper.nix   |   3 +-
 .../google-talk-plugin/default.nix            | 117 ------------------
 .../google-talk-plugin/preload.c              |  60 ---------
 pkgs/top-level/all-packages.nix               |   4 -
 4 files changed, 1 insertion(+), 183 deletions(-)
 delete mode 100644 pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
 delete mode 100644 pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/preload.c

diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 2b44263096b2..d5a0e9f9dffd 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -5,7 +5,7 @@
 , MPlayerPlugin, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2, libglvnd
 , jrePlugin, adoptopenjdk-icedtea-web
 , bluejeans, djview4, adobe-reader
-, google_talk_plugin, fribid, gnome3/*.gnome-shell*/
+, fribid, gnome3/*.gnome-shell*/
 , browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
 , tridactyl-native
 , udev
@@ -56,7 +56,6 @@ let
           ++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser)
           ++ lib.optional (supportsJDK && jre && jrePlugin ? mozillaPlugin) jrePlugin
           ++ lib.optional icedtea adoptopenjdk-icedtea-web
-          ++ lib.optional (cfg.enableGoogleTalkPlugin or false) google_talk_plugin
           ++ lib.optional (cfg.enableFriBIDPlugin or false) fribid
           ++ lib.optional (cfg.enableGnomeExtensions or false) gnome3.gnome-shell
           ++ lib.optional (cfg.enableBluejeans or false) bluejeans
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
deleted file mode 100644
index 93f2ab2adfa3..000000000000
--- a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
+++ /dev/null
@@ -1,117 +0,0 @@
-{ stdenv, fetchurl, libGL, xorg, cairo
-, libpng, gtk2, glib, gdk-pixbuf, fontconfig, freetype, curl
-, dbus-glib, alsaLib, libpulseaudio, systemd, pango
-}:
-
-with stdenv.lib;
-
-let
-
-  baseURL = "http://dl.google.com/linux/talkplugin/deb/pool/main/g/google-talkplugin";
-
-  rpathPlugin = makeLibraryPath
-    [ libGL
-      xorg.libXt
-      xorg.libX11
-      xorg.libXrender
-      cairo
-      libpng
-      gtk2
-      glib
-      fontconfig
-      freetype
-      curl
-    ];
-
-  rpathProgram = makeLibraryPath
-    [ gdk-pixbuf
-      glib
-      gtk2
-      xorg.libX11
-      xorg.libXcomposite
-      xorg.libXfixes
-      xorg.libXrender
-      xorg.libXrandr
-      xorg.libXext
-      stdenv.cc.cc
-      alsaLib
-      libpulseaudio
-      dbus-glib
-      systemd
-      curl
-      pango
-      cairo
-    ];
-
-in
-
-stdenv.mkDerivation rec {
-  pname = "google-talk-plugin";
-
-  # You can get the upstream version and SHA-256 hash from the following URLs:
-  # curl -s http://dl.google.com/linux/talkplugin/deb/dists/stable/main/binary-amd64/Packages | grep -E 'Version|SHA256'
-  # curl -s http://dl.google.com/linux/talkplugin/deb/dists/stable/main/binary-i386/Packages | grep -E 'Version|SHA256'
-  version = "5.41.3.0";
-
-  src =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl {
-        url = "${baseURL}/google-talkplugin_${version}-1_amd64.deb";
-        sha256 = "af7e23d2b6215afc547f96615b99f04e0561557cc58c0c9302364b5a3840d97d";
-      }
-    else if stdenv.hostPlatform.system == "i686-linux" then
-      fetchurl {
-        url = "${baseURL}/google-talkplugin_${version}-1_i386.deb";
-        sha256 = "4c46d2b7f2018640288cd7ac49adc47e309d0beadfd979eb03030e672016b4a7";
-      }
-    else throw "Google Talk does not support your platform.";
-
-  unpackPhase = ''
-    ar p "$src" data.tar.gz | tar xz
-  '';
-
-  installPhase =
-    ''
-      plugins=$out/lib/mozilla/plugins
-      mkdir -p $plugins
-      cp opt/google/talkplugin/*.so $plugins
-
-      for i in libnpgoogletalk.so libppgoogletalk.so libppo1d.so; do
-        patchelf --set-rpath "${makeLibraryPath [ stdenv.cc.cc xorg.libX11 ]}:${stdenv.cc.cc.lib}/lib64" $plugins/$i
-      done
-
-      for i in libgoogletalkremoting.so libnpo1d.so; do
-        patchelf --set-rpath "$out/libexec/google/talkplugin/lib:${rpathPlugin}:${stdenv.cc.cc.lib}/lib64" $plugins/$i
-      done
-
-      mkdir -p $out/libexec/google/talkplugin
-      cp -prd opt/google/talkplugin/{data,GoogleTalkPlugin,locale,remoting24x24.png,windowpicker.glade} $out/libexec/google/talkplugin/
-
-      patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${rpathProgram}:${stdenv.cc.cc.lib}/lib64" \
-        $out/libexec/google/talkplugin/GoogleTalkPlugin
-
-      # Generate an LD_PRELOAD wrapper to redirect execvp() calls to
-      # /opt/../GoogleTalkPlugin.
-      preload=$out/libexec/google/talkplugin/libpreload.so
-      mkdir -p $(dirname $preload)
-      gcc -shared ${./preload.c} -o $preload -ldl -DOUT=\"$out\" -fPIC
-      echo $preload > $plugins/extra-ld-preload
-
-      # Prevent a dependency on gcc.
-      strip -S $preload
-      patchELF $preload
-    '';
-
-  dontStrip = true;
-  dontPatchELF = true;
-
-  passthru.mozillaPlugin = "/lib/mozilla/plugins";
-
-  meta = {
-    homepage = http://www.google.com/chat/video/;
-    license = stdenv.lib.licenses.unfree;
-    maintainers = [ stdenv.lib.maintainers.eelco ];
-  };
-}
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/preload.c b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/preload.c
deleted file mode 100644
index 1e2c31d9527a..000000000000
--- a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/preload.c
+++ /dev/null
@@ -1,60 +0,0 @@
-/* Google Talk Plugin executes a helper program in /opt.  This
-   LD_PRELOAD library intercepts execvp() calls to redirect them to
-   the corresponding location in $out. */
-
-#define _GNU_SOURCE
-#include <stdio.h>
-#include <stdarg.h>
-#include <stdlib.h>
-#include <string.h>
-#include <dlfcn.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <limits.h>
-
-char origDir [] = "/opt/google/talkplugin";
-char realDir [] = OUT "/libexec/google/talkplugin";
-
-const char * rewrite(const char * path, char * buf)
-{
-    if (strncmp(path, origDir, sizeof(origDir) - 1) != 0) return path;
-    if (snprintf(buf, PATH_MAX, "%s%s", realDir, path + sizeof(origDir) - 1) >= PATH_MAX)
-        abort();
-    return buf;
-}
-
-int execvp(const char * path, char * const argv[])
-{
-    int (*_execvp) (const char *, char * const argv[]) = dlsym(RTLD_NEXT, "execvp");
-    char buf[PATH_MAX];
-    return _execvp(rewrite(path, buf), argv);
-}
-
-int open(const char *path, int flags, ...)
-{
-    char buf[PATH_MAX];
-    int (*_open) (const char *, int, mode_t) = dlsym(RTLD_NEXT, "open");
-    mode_t mode = 0;
-    if (flags & O_CREAT) {
-        va_list ap;
-        va_start(ap, flags);
-        mode = va_arg(ap, mode_t);
-        va_end(ap);
-    }
-    return _open(rewrite(path, buf), flags, mode);
-}
-
-int open64(const char *path, int flags, ...)
-{
-    char buf[PATH_MAX];
-    int (*_open64) (const char *, int, mode_t) = dlsym(RTLD_NEXT, "open64");
-    mode_t mode = 0;
-    if (flags & O_CREAT) {
-        va_list ap;
-        va_start(ap, flags);
-        mode = va_arg(ap, mode_t);
-        va_end(ap);
-    }
-    return _open64(rewrite(path, buf), flags, mode);
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8af372e35768..9b4df3bbc68c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19519,10 +19519,6 @@ in
     inherit (gnome2) GConf;
   };
 
-  google_talk_plugin = callPackage ../applications/networking/browsers/mozilla-plugins/google-talk-plugin {
-    libpng = libpng12;
-  };
-
   gosmore = callPackage ../applications/misc/gosmore { };
 
   gpsbabel = libsForQt5.callPackage ../applications/misc/gpsbabel {

From 7e37d805dd81f048baf1973d2cab4e009d90737c Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Thu, 18 Jun 2020 13:12:23 -0400
Subject: [PATCH 17/63] root5: fix CVE-2017-1000203

Fixes: https://nvd.nist.gov/vuln/detail/CVE-2017-1000203
---
 pkgs/applications/science/misc/root/5.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/applications/science/misc/root/5.nix b/pkgs/applications/science/misc/root/5.nix
index 8422eb8752b1..743fc1d4de98 100644
--- a/pkgs/applications/science/misc/root/5.nix
+++ b/pkgs/applications/science/misc/root/5.nix
@@ -32,6 +32,12 @@ stdenv.mkDerivation rec {
     # disable dictionary generation for stuff that includes libc headers
     # our glibc requires a modern compiler
     ./disable_libc_dicts_root5.patch
+
+    (fetchpatch {
+      name = "CVE-2017-1000203.patch";
+      url = "https://github.com/root-project/root/commit/a568e80022ae6ffbfa0a908d625c986ee857cc0f.diff";
+      sha256 = "0fxiwh36ry2w98a7sw74z9rnp686vrddxmd34wkvjnj9alry9i5f";
+    })
   ];
 
   preConfigure = ''

From fd8bbb8ba371d1ca09d81a0e47d2190d050369a8 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 19 Jun 2020 00:42:19 +0200
Subject: [PATCH 18/63] mutt: patch for CVE-2020-14093

---
 pkgs/applications/networking/mailreaders/mutt/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index b7bf5eb329ca..cf00c40684f7 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -34,7 +34,13 @@ stdenv.mkDerivation rec {
     sha256 = "0y3ks10mc7m8c7pd4c4j8pj7n5rqcvzrjs8mzldv7z7jnlb30hkq";
   };
 
-  patches = optional smimeSupport (fetchpatch {
+  patches = [
+    # patch for CVE-2020-14093
+    (fetchpatch {
+      url = "https://github.com/muttmua/mutt/commit/3e88866dc60b5fa6aaba6fd7c1710c12c1c3cd01.patch";
+      sha256 = "1md4krh76kjbg6nkyvbpjn6iz17c7m7xvdj6gjvjr7akqjhfw48h";
+    })
+  ] ++ optional smimeSupport (fetchpatch {
     url = "https://salsa.debian.org/mutt-team/mutt/raw/debian/1.10.1-2/debian/patches/misc/smime.rc.patch";
     sha256 = "0b4i00chvx6zj9pcb06x2jysmrcb2znn831lcy32cgfds6gr3nsi";
   });

From 0a29dda8f884fc8e3e2c7ddbcf6c11a54a975273 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Thu, 18 Jun 2020 23:41:04 +0200
Subject: [PATCH 19/63] monero: 0.15.0.1 -> 0.16.0.0

(cherry picked from commit a31103196e6c572412524db7b4bbfec7ee025e9a)
---
 pkgs/applications/blockchains/monero/default.nix | 9 +++++----
 pkgs/top-level/all-packages.nix                  | 1 +
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/blockchains/monero/default.nix b/pkgs/applications/blockchains/monero/default.nix
index c942197006c4..c53344b33c97 100644
--- a/pkgs/applications/blockchains/monero/default.nix
+++ b/pkgs/applications/blockchains/monero/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub
 , cmake, pkgconfig
-, boost, miniupnpc, openssl, unbound, cppzmq
+, boost, miniupnpc, openssl, unbound
 , zeromq, pcsclite, readline, libsodium, hidapi
 , pythonProtobuf, randomx, rapidjson, libusb
 , CoreData, IOKit, PCSC
@@ -10,13 +10,13 @@ assert stdenv.isDarwin -> IOKit != null;
 
 stdenv.mkDerivation rec {
   pname = "monero";
-  version = "0.15.0.1";
+  version = "0.16.0.0";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    sha256 = "0sypa235lf2bbib4b71xpaw39h9304slgsvnsz8wmy9fq1zx009m";
+    sha256 = "0x74h5z0nxxxip97ibc854pqmrgd8r4d6w62m424f66i8gbzfskh";
     fetchSubmodules = true;
   };
 
@@ -24,13 +24,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     boost miniupnpc openssl unbound
-    cppzmq zeromq pcsclite readline
+    zeromq pcsclite readline
     libsodium hidapi randomx rapidjson
     pythonProtobuf libusb
   ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ];
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"
+    "-DUSE_DEVICE_TREZOR=ON"
     "-DBUILD_GUI_DEPS=ON"
     "-DReadline_ROOT_DIR=${readline.dev}"
   ] ++ stdenv.lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8af372e35768..adf93b725561 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22779,6 +22779,7 @@ in
 
   monero = callPackage ../applications/blockchains/monero {
     inherit (darwin.apple_sdk.frameworks) CoreData IOKit PCSC;
+    boost = boost17x;
     pythonProtobuf = python3Packages.protobuf.override { protobuf = protobuf3_10; };
   };
 

From 7587e079449ea04761c4a196c28b5e977a30942d Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Thu, 18 Jun 2020 23:41:46 +0200
Subject: [PATCH 20/63] monero-gui: 0.15.0.4 -> 0.16.0.0

(cherry picked from commit 7c041738c8c12cf1823682073e5cde8f14e8505c)
---
 .../blockchains/monero-gui/default.nix             | 14 +++++++++-----
 pkgs/top-level/all-packages.nix                    |  2 +-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix
index 980e20d04b75..58ac14fb1fa7 100644
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@@ -4,7 +4,7 @@
 , qtmultimedia, qtxmlpatterns
 , qtquickcontrols, qtquickcontrols2
 , monero, unbound, readline, boost, libunwind
-, libsodium, pcsclite, zeromq, cppzmq
+, libsodium, pcsclite, zeromq, libgcrypt, libgpgerror
 , hidapi, libusb, protobuf, randomx
 }:
 
@@ -12,13 +12,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.15.0.4";
+  version = "0.16.0.0";
 
   src = fetchFromGitHub {
     owner  = "monero-project";
     repo   = "monero-gui";
     rev    = "v${version}";
-    sha256 = "12m5fgnxkr11q2arx1m5ccpxqm5ljcvm6l547dwqn297zs5jim4z";
+    sha256 = "06vdrsj5y9k0zn32hspyxc7sw1kkyrvi3chzkdbnxk9jvyj8k4ld";
   };
 
   nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ];
@@ -27,9 +27,9 @@ stdenv.mkDerivation rec {
     qtbase qtdeclarative qtgraphicaleffects
     qtmultimedia qtquickcontrols qtquickcontrols2
     qtxmlpatterns
-    monero unbound readline
+    monero unbound readline libgcrypt libgpgerror
     boost libunwind libsodium pcsclite zeromq
-    cppzmq hidapi libusb protobuf randomx
+    hidapi libusb protobuf randomx
   ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=format-security" ];
@@ -52,6 +52,10 @@ stdenv.mkDerivation rec {
   preBuild = ''
     sed -i s#/opt/monero-wallet-gui##g Makefile
     make -C src/zxcvbn-c
+
+    # use nixpkgs monero sources
+    rmdir monero
+    ln -s "${monero.src}" monero
   '';
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index adf93b725561..b98376cf4f59 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22784,7 +22784,7 @@ in
   };
 
   monero-gui = libsForQt5.callPackage ../applications/blockchains/monero-gui {
-    boost = boost16x;
+    boost = boost17x;
     protobuf = protobuf3_10;
   };
 

From 199de0468881366154840753a946dd585677ea52 Mon Sep 17 00:00:00 2001
From: Phil Wetzel <phil@audido.com>
Date: Sat, 30 May 2020 22:42:49 -0400
Subject: [PATCH 21/63] mwprocapture: 1.2.4054 -> 1.2.4177

(cherry picked from commit 9a57b0bbd5f4ed5f2c89008745f155962814e63f)

Reason: mwprocapture build is broken on 20.03, 1.2.4054 does not
compile with Linux 5.4.
---
 pkgs/os-specific/linux/mwprocapture/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index 9490bc911819..c9cd2d6a2e68 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "mwprocapture-1.2.${version}-${kernel.version}";
-  version = "4054";
+  version = "4177";
 
   src = fetchurl {
     url = "http://www.magewell.com/files/drivers/ProCaptureForLinux_${version}.tar.gz";
-    sha256 = "0ylx75jcwlqds8w6lm11nxdlzxvy7xlz4rka2k5d6gmqa5fv19c2";
+    sha256 = "1nf51w9yixpvr767k49sfdb9n9rv5qc72f5yki1mkghbmabw7vys";
   };
 
   nativeBuildInputs = [ kernel.moduleBuildDependencies ];

From 48a6a8b97c3260cd122d3314725805b36742db48 Mon Sep 17 00:00:00 2001
From: Tony O <822863+bqv@users.noreply.github.com>
Date: Fri, 17 Apr 2020 19:03:26 +0100
Subject: [PATCH 22/63] sv-kalendar: fix meta

---
 pkgs/applications/editors/emacs-modes/sv-kalender/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/emacs-modes/sv-kalender/default.nix b/pkgs/applications/editors/emacs-modes/sv-kalender/default.nix
index bcd947983a34..211be0a90897 100644
--- a/pkgs/applications/editors/emacs-modes/sv-kalender/default.nix
+++ b/pkgs/applications/editors/emacs-modes/sv-kalender/default.nix
@@ -17,6 +17,6 @@ trivialBuild {
     homepage = "http://bigwalter.net/daniel/elisp/sv-kalender.el";
     platforms = platforms.all;
     license = licenses.gpl3Plus;
-    maintainers = [ maintainer.rycee ];
+    maintainers = [ maintainers.rycee ];
   };
 }

From 8b38149d616ca46cdd08d78316eea5eaa210043d Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Fri, 19 Jun 2020 21:32:59 +0200
Subject: [PATCH 23/63] jhead: 3.03 -> 3.04

(cherry picked from commit 7395b11cd4c2a16fa060e8b419113ca872d36c78)
---
 pkgs/tools/graphics/jhead/default.nix | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/pkgs/tools/graphics/jhead/default.nix b/pkgs/tools/graphics/jhead/default.nix
index 13df4ede8ecf..6f4381d163f3 100644
--- a/pkgs/tools/graphics/jhead/default.nix
+++ b/pkgs/tools/graphics/jhead/default.nix
@@ -2,34 +2,27 @@
 
 stdenv.mkDerivation rec {
   pname = "jhead";
-  version = "3.03";
+  version = "3.04";
 
   src = fetchurl {
     url = "http://www.sentex.net/~mwandel/jhead/${pname}-${version}.tar.gz";
-    sha256 = "1hn0yqcicq3qa20h1g313l1a671r8mccpb9gz0w1056r500lw6c2";
+    sha256 = "1j831bqw1qpkbchdriwcy3sgzvbagaj45wlc124fs9bc9z7vp2gg";
   };
 
   patches = [
     (fetchpatch {
-      name = "CVE-2019-1010301.patch";
-      url = "https://sources.debian.org/data/main/j/jhead/1:3.03-3/debian/patches/36_CVE-2019-1010301";
-      sha256 = "1vvrg50z5y7sjhfi973wh1q1v79sqp7hk5d4z0dlnx3fqgkjrx7q";
-    })
-    (fetchpatch {
-      name = "CVE-2019-1010302.patch";
-      url = "https://sources.debian.org/data/main/j/jhead/1:3.03-3/debian/patches/37_CVE-2019-1010302";
-      sha256 = "1h11mpsi7hpwbi8kpnkjwn6zpqf88f132h0rsg8sggcs3vva2x8y";
+      url = "https://sources.debian.org/data/main/j/jhead/1:3.04-2/debian/patches/01_gpsinfo.c";
+      sha256 = "0r8hdbfrdxip4dwz5wqsv47a29j33cx7w5zx4jdhp5l1ihg003lz";
     })
   ];
 
   buildInputs = [ libjpeg ];
 
-  patchPhase = ''
-    substituteInPlace makefile \
-      --replace /usr/local/bin $out/bin
+  makeFlags = [ "CPPFLAGS=" "CFLAGS=-O3" "LDFLAGS=" ];
 
+  patchPhase = ''
+    sed -i '/dpkg-buildflags/d' makefile
     substituteInPlace jhead.c \
-      --replace "\"   Compiled: \"__DATE__" "" \
       --replace "jpegtran -trim" "${libjpeg.bin}/bin/jpegtran -trim"
   '';
 

From 2a0c12944774ef68396cf9c470ac831e29cd5ab8 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 8 Jun 2020 16:59:31 +0300
Subject: [PATCH 24/63] neomutt: Make it not reference .dev outputs.

(cherry picked from commit 3b9a8f54260e20f8eb794aa70fb83d627450c666)
---
 pkgs/applications/networking/mailreaders/neomutt/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index eeb5f517b2cc..0989c48e74fe 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -60,6 +60,9 @@ stdenv.mkDerivation rec {
     "--sasl"
     "--with-homespool=mailbox"
     "--with-mailpath="
+    # To make it not reference .dev outputs. See:
+    # https://github.com/neomutt/neomutt/pull/2367
+    "--disable-include-path-in-cflags"
     # Look in $PATH at runtime, instead of hardcoding /usr/bin/sendmail
     "ac_cv_path_SENDMAIL=sendmail"
     "--zlib"

From 5ca29c7a9fffb4e2b26ea8d4ac12199add00e273 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 8 Jun 2020 17:01:42 +0300
Subject: [PATCH 25/63] neomutt: make manual.txt not empty

Without elinks / w3m / lynx in the nativeBuildInputs, there are these
errors in the build:

LC_ALL=C w3m -dump -O UTF8 docs/manual.html > docs/manual.txt || \
LC_ALL=C lynx -dump -nolist -with_backspaces \
        -display_charset=us-ascii docs/manual.html > docs/manual.txt || \
LC_ALL=C elinks -dump -no-numbering -no-references \
        docs/manual.html | sed -e 's,\\001, ,g' > docs/manual.txt
/nix/store/xfbmj7sl2ikicym9x3yq7cms5qx1w39k-bash-4.4-p23/bin/bash: w3m: command not found
/nix/store/xfbmj7sl2ikicym9x3yq7cms5qx1w39k-bash-4.4-p23/bin/bash: line 1: lynx: command not found
/nix/store/xfbmj7sl2ikicym9x3yq7cms5qx1w39k-bash-4.4-p23/bin/bash: line 3: elinks: command not found

(cherry picked from commit b8f65212ec43b7671447b3dd83d365d134224a81)
---
 pkgs/applications/networking/mailreaders/neomutt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 0989c48e74fe..a8cef259a597 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap, runtimeShell, sqlite, zlib
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, elinks, mailcap, runtimeShell, sqlite, zlib
 , glibcLocales
 }:
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    docbook_xsl docbook_xml_dtd_42 gettext libxml2 libxslt.bin makeWrapper tcl which zlib
+    docbook_xsl docbook_xml_dtd_42 gettext libxml2 libxslt.bin makeWrapper tcl which zlib elinks
   ];
 
   enableParallelBuilding = true;

From 657aa0bf0e59c1cc51ab482456169ef307c5b4c8 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 8 Jun 2020 17:46:28 +0300
Subject: [PATCH 26/63] neomutt: Remove old fixes for failing tests

Includes both rfc2047 tests workarounds and locale workarounds.
Fixes #86896. See https://github.com/neomutt/neomutt/pull/2314 .

(cherry picked from commit b58227a4c07e6e39dd8e191b8a8cd6c8ef28ff49)
---
 .../networking/mailreaders/neomutt/default.nix            | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index a8cef259a597..952d7f2b0c83 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -42,12 +42,6 @@ stdenv.mkDerivation rec {
     # and use a far more comprehensive list than the one shipped with neomutt
     substituteInPlace sendlib.c \
       --replace /etc/mime.types ${mailcap}/etc/mime.types
-
-    # The string conversion tests all fail with the first version of neomutt
-    # that has tests (20180223) as well as 20180716 so we disable them for now.
-    # I don't know if that is related to the tests or our build environment.
-    # Try again with a later release.
-    sed -i '/rfc2047/d' test/Makefile.autosetup test/main.c
   '';
 
   configureFlags = [
@@ -89,10 +83,8 @@ stdenv.mkDerivation rec {
     (cd test-files && ./setup.sh)
 
     export NEOMUTT_TEST_DIR=$(pwd)/test-files
-    export LC_ALL="en_US.UTF-8"
   '';
 
-  checkInputs = [ glibcLocales ];
   checkTarget = "test";
   postCheck = "unset NEOMUTT_TEST_DIR";
 

From c9ad46815a35ae248a30a77cab3038d61e816c35 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 19 Jun 2020 19:19:08 +0200
Subject: [PATCH 27/63] neomutt: 20200501 -> 20200619

https://github.com/neomutt/neomutt/releases/tag/20200619
(cherry picked from commit 499d18849f334ba5ded1ccffc9345c7d3d0a3c40)
---
 .../networking/mailreaders/neomutt/default.nix      | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 952d7f2b0c83..3fc88ee80758 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200501";
+  version = "20200619";
   pname = "neomutt";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = version;
-    sha256 = "1xrs2bagrcg489zp7g39l3rrpgz8n1ji9cbr21wrnasfbhqcsmnx";
+    sha256 = "0dhdpd0wdk5bam0q7cvjy4f451ai0mapmyrar7r7m5dnn6lcwvfv";
   };
 
   buildInputs = [
@@ -44,6 +44,10 @@ stdenv.mkDerivation rec {
       --replace /etc/mime.types ${mailcap}/etc/mime.types
   '';
 
+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
   configureFlags = [
     "--enable-autocrypt"
     "--gpgme"
@@ -77,9 +81,10 @@ stdenv.mkDerivation rec {
     cp -r ${fetchFromGitHub {
       owner = "neomutt";
       repo = "neomutt-test-files";
-      rev = "1ee274e9ae1330fb901eb7b8275b3079d7869222";
-      sha256 = "0dhilz4rr7616jh8jcvh50a3rr09in43nsv72mm6f3vfklcqincp";
+      rev = "8629adab700a75c54e8e28bf05ad092503a98f75";
+      sha256 = "1ci04nqkab9mh60zzm66sd6mhsr6lya8wp92njpbvafc86vvwdlr";
     }} $(pwd)/test-files
+    chmod -R +w test-files
     (cd test-files && ./setup.sh)
 
     export NEOMUTT_TEST_DIR=$(pwd)/test-files

From 694939b0fc532b2b63c410542700d55990fbbdd9 Mon Sep 17 00:00:00 2001
From: taku0 <mxxouy6x3m_github@tatapa.org>
Date: Tue, 12 May 2020 18:31:02 +0900
Subject: [PATCH 28/63] flashplayer: 32.0.0.363 -> 32.0.0.371

(cherry picked from commit d8fa222ca2e4a6322233da8013290a29b6e5f971)
---
 .../networking/browsers/chromium/plugins.nix           |  4 ++--
 .../browsers/mozilla-plugins/flashplayer/default.nix   | 10 +++++-----
 .../mozilla-plugins/flashplayer/standalone.nix         |  6 +++---
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index 1dd9baa628ab..d45a3c9f864a 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.363";
+    version = "32.0.0.371";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0znk8an892mykgbz56hyv3gz65vc9mhb3vn96c6bsvicwl1fn460";
+      sha256 = "1nks2wx74b21hv0l7bnrzkxn7c6p6r8zgwbqvy3cqpi8famyr5v9";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index 17319f803503..a072b7d9bab8 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.363";
+  version = "32.0.0.371";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "06711k4vbn6mqfd8gvx2snsxyalhw15hn5b64sja8726z5rxvzy7"
+          "1zrl7cxcl9hkafji15br8wp5vf9a5lb88xcpz6vi9q73j45mhzjd"
         else
-          "0v584aqhy4xk08afi3ypkq4mqjq57y136z82i5ixyim88dqbaf4f"
+          "0cgnsn9zanadbacb660mj4k103cdyb2cak7ixnp1varqklss83n6"
       else
         if arch == "x86_64" then
-          "1g1ijxypm8a8mfc1x58gksmaakqpp7xmf277wiir8zqjn3vd6c64"
+          "1zc90gjixfhjng7pbx8vci1l69wf5m40149178zwzs6kz4ma5hb2"
         else
-          "13nbxmqmbxqvdhdwdqimim2f9fz3y2vrsx6b3pck6352m4i4wzh8";
+          "0fqgas1g52a0zir2cxz3anizk3lkmwl68nbcn5rihgvjfqykbhn8";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 40d63919dc40..157581d89796 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.363";
+  version = "32.0.0.371";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "03zhza8lvc1nvz3racwfsajfd6rnbw3g56dp5wvr1qmaps8xaaqg"
+        "0n3bk2y1djaqrdygnr81n8lsnj2k60kaziffl41zpdvzi1jc7wgn"
       else
-        "0bhp7jv2l2agfzr8m564k749a5g75dw1390phlwvf49n1h8ldap2";
+        "18ll9rnfhbnz54q4d7q9fb13lix4i62zr6z6n574qvwngrvbrr8a";
   };
 
   nativeBuildInputs = [ unzip ];

From a4a203e995ad85b1ac662d6926bbb6b40422a899 Mon Sep 17 00:00:00 2001
From: taku0 <mxxouy6x3m_github@tatapa.org>
Date: Tue, 9 Jun 2020 21:13:06 +0900
Subject: [PATCH 29/63] flashplayer: 32.0.0.371 -> 32.0.0.387

(cherry picked from commit 0a146054bdf6f70f66de4426f84c9358521be31e)
---
 .../networking/browsers/chromium/plugins.nix           |  4 ++--
 .../browsers/mozilla-plugins/flashplayer/default.nix   | 10 +++++-----
 .../mozilla-plugins/flashplayer/standalone.nix         |  6 +++---
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index d45a3c9f864a..707bf2056f0e 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.371";
+    version = "32.0.0.387";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1nks2wx74b21hv0l7bnrzkxn7c6p6r8zgwbqvy3cqpi8famyr5v9";
+      sha256 = "1igs8nh3zpfcps97ahzh7kknx3rddh6yliig8lxf6jskbpf0qgzf";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index a072b7d9bab8..d5fbedbbfa03 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.371";
+  version = "32.0.0.387";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1zrl7cxcl9hkafji15br8wp5vf9a5lb88xcpz6vi9q73j45mhzjd"
+          "1wmk60lnlrj9f8dvk4b6j7pqyl00w00qbzbdw4awzx91wmgfc4x0"
         else
-          "0cgnsn9zanadbacb660mj4k103cdyb2cak7ixnp1varqklss83n6"
+          "1afjxhi5jzn8zbkva940i9fayzxj1r3n6rqsiny02fpnv0waypfy"
       else
         if arch == "x86_64" then
-          "1zc90gjixfhjng7pbx8vci1l69wf5m40149178zwzs6kz4ma5hb2"
+          "0si8rx955kyfsprk5465hfzafxvrdm7g686q7p5xykmh88nck6k2"
         else
-          "0fqgas1g52a0zir2cxz3anizk3lkmwl68nbcn5rihgvjfqykbhn8";
+          "02pw2knvgdkahyp7lmy7fmynmplaz5wswdz48h3sdj6ibr066h97";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 157581d89796..3a2af5cfa6e7 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.371";
+  version = "32.0.0.387";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0n3bk2y1djaqrdygnr81n8lsnj2k60kaziffl41zpdvzi1jc7wgn"
+        "1yxdwmm2gz162rmc9hwlccqgq613gnrihjicnzgan4vk7hjlga5y"
       else
-        "18ll9rnfhbnz54q4d7q9fb13lix4i62zr6z6n574qvwngrvbrr8a";
+        "0hm5is3giz45a4v9m77q0i1dgyhpqqkagpjndbnynsnl9a61r0ly";
   };
 
   nativeBuildInputs = [ unzip ];

From cdd1ecea80de3dc813fc86c6827af2c9a6bb50e7 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 3 Jun 2020 17:17:04 +0200
Subject: [PATCH 30/63] nextcloud19: init at 19.0.0

https://nextcloud.com/blog/nextcloud-hub-brings-productivity-to-home-office/
(cherry picked from commit a2a5aa26349667be58dbf73520d2e78c9ea15a55)
---
 nixos/modules/services/web-apps/nextcloud.nix | 2 +-
 pkgs/servers/nextcloud/default.nix            | 5 +++++
 pkgs/top-level/all-packages.nix               | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 319de600ade9..e7ef9f3633b7 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -69,7 +69,7 @@ in {
     package = mkOption {
       type = types.package;
       description = "Which package to use for the Nextcloud instance.";
-      relatedPackages = [ "nextcloud17" "nextcloud18" ];
+      relatedPackages = [ "nextcloud17" "nextcloud18" "nextcloud19" ];
     };
 
     maxUploadSize = mkOption {
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index c1a595b32024..8bec65757d7f 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -34,4 +34,9 @@ in {
     version = "18.0.6";
     sha256 = "1chmkg31jc1nr53y8r886mmd2jzb78094mrx7ggcfpjfkkv8b89s";
   };
+
+  nextcloud19 = generic {
+    version = "19.0.0";
+    sha256 = "1bhazqj5f02sclh5pmifzqfahhhfqypixbvkgrnlgqy5ayb44gfj";
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 484aea325865..4063e9772ab5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5282,7 +5282,7 @@ in
   grocy = callPackage ../servers/grocy { };
 
   inherit (callPackage ../servers/nextcloud {})
-    nextcloud17 nextcloud18;
+    nextcloud17 nextcloud18 nextcloud19;
 
   nextcloud-client = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
 

From 6a99d5d6485bf29f948bef0127b1a2904e1d7589 Mon Sep 17 00:00:00 2001
From: Antoine Eiche <lewo@abesis.fr>
Date: Sat, 20 Jun 2020 09:55:02 +0200
Subject: [PATCH 31/63] nixos/nextcloud: add occ internal option

This option exposes the prefconfigured nextcloud-occ
program. nextcloud-occ can then be used in other systemd services or
added in environment.systemPackages.

The nextcloud test shows how it can be add in
environment.systemPackages.

(cherry picked from commit 7d994ad445e4a0dac23c651ddcabbece51e76619)
---
 nixos/modules/services/web-apps/nextcloud.nix | 8 ++++++++
 nixos/tests/nextcloud/basic.nix               | 8 +++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index e7ef9f3633b7..fc84889b0217 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -303,6 +303,14 @@ in {
         '';
       };
     };
+    occ = mkOption {
+      type = types.package;
+      default = occ;
+      internal = true;
+      description = ''
+        The nextcloud-occ program preconfigured to target this Nextcloud instance.
+      '';
+    };
   };
 
   config = mkIf cfg.enable (mkMerge [
diff --git a/nixos/tests/nextcloud/basic.nix b/nixos/tests/nextcloud/basic.nix
index 75862feb202d..255eda683f84 100644
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@@ -11,7 +11,9 @@ in {
     # The only thing the client needs to do is download a file.
     client = { ... }: {};
 
-    nextcloud = { config, pkgs, ... }: {
+    nextcloud = { config, pkgs, ... }: let
+      cfg = config;
+    in {
       networking.firewall.allowedTCPPorts = [ 80 ];
 
       services.nextcloud = {
@@ -27,6 +29,8 @@ in {
           startAt = "20:00";
         };
       };
+
+      environment.systemPackages = [ cfg.services.nextcloud.occ ];
     };
   };
 
@@ -52,6 +56,8 @@ in {
   in ''
     start_all()
     nextcloud.wait_for_unit("multi-user.target")
+    # This is just to ensure the nextcloud-occ program is working
+    nextcloud.succeed("nextcloud-occ status")
     nextcloud.succeed("curl -sSf http://nextcloud/login")
     nextcloud.succeed(
         "${withRcloneEnv} ${copySharedFile}"

From 5bc40483e58282baafddc77497c4f2edfc8f3d7b Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 13 Feb 2020 07:41:14 -0500
Subject: [PATCH 32/63] linux: 5.5-rc7 -> 5.6-rc1

(cherry picked from commit 25f706b26ca0d7932cb9fb66260f2ff9ae72b5f9)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 00dcb6f0f488..6e3abb792bd9 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5-rc7";
-  extraMeta.branch = "5.5";
+  version = "5.6-rc1";
+  extraMeta.branch = "5.6";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "10fjk4bw73x5xpb4q83ngni7slw489wdxhdwmyrkfqqy5chgm290";
+    sha256 = "1ir7mdzxrin7k6a7ldfmpl9bbapkr99l3pd07dv8589vcrd43zlh";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 87a110ff23d48f521f7cb9a9ac74ebba484097d7 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 18 Feb 2020 16:53:46 -0500
Subject: [PATCH 33/63] linux: 5.6-rc1 -> 5.6-rc2

(cherry picked from commit 3f448f08aa082b5698e0697dd2224c0d2b4db509)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 6e3abb792bd9..81e39ad647cd 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6-rc1";
+  version = "5.6-rc2";
   extraMeta.branch = "5.6";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1ir7mdzxrin7k6a7ldfmpl9bbapkr99l3pd07dv8589vcrd43zlh";
+    sha256 = "1b3ds8dv5rc9f4c3czj689dxbl8lyrmnfk6ywa51h9vx3lsd5jrp";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 7dabe08aa5cd4841486c9940205c590d8e8d737d Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sun, 1 Mar 2020 10:40:36 -0500
Subject: [PATCH 34/63] linux: 5.6-rc2 -> 5.6-rc3

(cherry picked from commit 1e41aa803044f77802c6764bd8b77c92d1540914)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 81e39ad647cd..77a4327e89f9 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6-rc2";
+  version = "5.6-rc3";
   extraMeta.branch = "5.6";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1b3ds8dv5rc9f4c3czj689dxbl8lyrmnfk6ywa51h9vx3lsd5jrp";
+    sha256 = "1w265k9rspg9rkmay6cy6r1rxy4javpj1f6ify4jc3zpwqmp4ymk";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 3328c69d359a91fd5e33af87ce1a6f0689bd8b00 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 12 Mar 2020 05:56:43 -0400
Subject: [PATCH 35/63] linux: 5.6-rc3 -> 5.6-rc5

(cherry picked from commit cd167a02b809ec2ab6710106121465bc89a2cd80)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 77a4327e89f9..4098c30c744e 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6-rc3";
+  version = "5.6-rc5";
   extraMeta.branch = "5.6";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1w265k9rspg9rkmay6cy6r1rxy4javpj1f6ify4jc3zpwqmp4ymk";
+    sha256 = "0ys4wdv1rf9vshras1n6syy2pgg8kv50f27nprfzhrllni044whr";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 61e1b66b9a5c0e6ffa81b3917f60c596d53adb94 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Sun, 29 Mar 2020 16:50:02 -0400
Subject: [PATCH 36/63] linux: 5.6-rc5 -> 5.6-rc7

(cherry picked from commit c76bad0ec06eed1fc387e9e610f037313a4cdde9)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 4098c30c744e..e63fe96be6b9 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6-rc5";
+  version = "5.6-rc7";
   extraMeta.branch = "5.6";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0ys4wdv1rf9vshras1n6syy2pgg8kv50f27nprfzhrllni044whr";
+    sha256 = "0wv3ipfm970y2pyadwn5g7hd9bj117qk8jl8sdhrasbsy1p8936i";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 48c7203ebe5c06b4fcee5a6daddbfd934058069e Mon Sep 17 00:00:00 2001
From: Austin Seipp <aseipp@pobox.com>
Date: Fri, 24 Apr 2020 10:57:17 -0500
Subject: [PATCH 37/63] linux_testing: 5.6-rc7 -> 5.7-rc2

Signed-off-by: Austin Seipp <aseipp@pobox.com>
(cherry picked from commit d40391145108d3db0f06ddfc806e5de25547c032)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index e63fe96be6b9..9e2ccaeae2b2 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6-rc7";
-  extraMeta.branch = "5.6";
+  version = "5.7-rc2";
+  extraMeta.branch = "5.7";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0wv3ipfm970y2pyadwn5g7hd9bj117qk8jl8sdhrasbsy1p8936i";
+    sha256 = "06h7lrif84gyzblrdgg4cirsr2v69sdbymwkk89nr3gc87hnjlvs";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 760436a0225264a88091a588aebbe45878cbd79c Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Fri, 1 May 2020 11:43:22 -0400
Subject: [PATCH 38/63] linux: 5.7-rc2 -> 5.7-rc3

(cherry picked from commit 61b97c17d659b345f4c45fb12376b348dd531d8b)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 9e2ccaeae2b2..05617f869174 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc2";
+  version = "5.7-rc3";
   extraMeta.branch = "5.7";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "06h7lrif84gyzblrdgg4cirsr2v69sdbymwkk89nr3gc87hnjlvs";
+    sha256 = "0gq4bdzz2px85l3fa9dq3jh3lp4c9kgph4njq6yxf9g3h0ifq7c6";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 392f8e128249787a87c46fc6e4965acdc7bff10e Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Mon, 4 May 2020 08:41:50 -0400
Subject: [PATCH 39/63] linux: 5.7-rc3 -> 5.7-rc4

(cherry picked from commit b6456e528e60dcd5f30d127ee4e043a991c7d49a)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 05617f869174..8b5f1e58d142 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc3";
+  version = "5.7-rc4";
   extraMeta.branch = "5.7";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0gq4bdzz2px85l3fa9dq3jh3lp4c9kgph4njq6yxf9g3h0ifq7c6";
+    sha256 = "1mnknjiax24iaj9n5k0s55vp6fvmb40s931qxj24v5p1lc5fznvb";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 62c2df452f71f40b0ac0adf0f7159db2ded9dd33 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 19 May 2020 10:10:59 -0400
Subject: [PATCH 40/63] linux: 5.7-rc4 -> 5.7-rc6

(cherry picked from commit 8b5a3127b36234133e5c6ca6ea20ddb945b6d07c)
---
 pkgs/os-specific/linux/kernel/linux-testing.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 8b5f1e58d142..f2f0fac3b7dd 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc4";
+  version = "5.7-rc6";
   extraMeta.branch = "5.7";
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1mnknjiax24iaj9n5k0s55vp6fvmb40s931qxj24v5p1lc5fznvb";
+    sha256 = "0g04zwdxks7pa5q6shl5xl2rml1w95rxq7sqkkadj11mpk2k89w4";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 86a9689852f6e867d364e62f98b2ce0c50621c39 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Mon, 8 Jun 2020 17:01:58 +0200
Subject: [PATCH 41/63] linux_5_7: init at 5.7.1

Changes:
- Copied linux-5.7.nix from linux-5.6.nix
- Add linux_5_7 and linuxPackages_5_7
- Update linux_latest to 5.7

Note:
The kernel patch 'kernelPatches.export_kernel_fpu_functions."5.3"' is
still applied as I copied the list from linux_5_7 (vs. linux_testing).
This patch is probably still required for the ZFS performance.

(cherry picked from commit 19b2efbc3921c967d8260bf246391a93aed30874)
---
 pkgs/os-specific/linux/kernel/linux-5.7.nix | 18 ++++++++++++++++++
 pkgs/top-level/all-packages.nix             | 11 ++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/os-specific/linux/kernel/linux-5.7.nix

diff --git a/pkgs/os-specific/linux/kernel/linux-5.7.nix b/pkgs/os-specific/linux/kernel/linux-5.7.nix
new file mode 100644
index 000000000000..81f4d4b3553d
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-5.7.nix
@@ -0,0 +1,18 @@
+{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
+
+with stdenv.lib;
+
+buildLinux (args // rec {
+  version = "5.7.1";
+
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = versions.majorMinor version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
+    sha256 = "1vcxrrb2i4366iciw0mfahwbdrzmhrrsr7gi4vdkzznfv2niils0";
+  };
+} // (args.argsOverride or {}))
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 484aea325865..2ad5ed2a4faf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16540,6 +16540,14 @@ in
     ];
   };
 
+  linux_5_7 = callPackage ../os-specific/linux/kernel/linux-5.7.nix {
+    kernelPatches = [
+      kernelPatches.bridge_stp_helper
+      kernelPatches.request_key_helper
+      kernelPatches.export_kernel_fpu_functions."5.3"
+    ];
+  };
+
   linux_testing = callPackage ../os-specific/linux/kernel/linux-testing.nix {
     kernelPatches = [
       kernelPatches.bridge_stp_helper
@@ -16747,7 +16755,7 @@ in
   linux = linuxPackages.kernel;
 
   # Update this when adding the newest kernel major version!
-  linuxPackages_latest = linuxPackages_5_6;
+  linuxPackages_latest = linuxPackages_5_7;
   linux_latest = linuxPackages_latest.kernel;
 
   # Build the kernel modules for the some of the kernels.
@@ -16762,6 +16770,7 @@ in
   linuxPackages_4_19 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_19);
   linuxPackages_5_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_4);
   linuxPackages_5_6 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_6);
+  linuxPackages_5_7 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_7);
 
   # Kernels removed on release-20.03
   linuxPackages_5_5 = throw ''

From e268676f5892b489e4afdf1efd069d19dc7e624b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 10 Jun 2020 14:07:15 +0200
Subject: [PATCH 42/63] linux: fix kernel config options for 5.7

(cherry picked from commit bbe71613b6e656e707acdf9c279736c900bf4e87)
---
 pkgs/os-specific/linux/kernel/common-config.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 524bd3d9682f..db2980ee2123 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -259,7 +259,7 @@ let
       SND_SOC_SOF_ELKHARTLAKE_SUPPORT   = yes;
       SND_SOC_SOF_GEMINILAKE_SUPPORT    = yes;
       SND_SOC_SOF_HDA_AUDIO_CODEC       = yes;
-      SND_SOC_SOF_HDA_COMMON_HDMI_CODEC = yes;
+      SND_SOC_SOF_HDA_COMMON_HDMI_CODEC = whenOlder "5.7" yes;
       SND_SOC_SOF_HDA_LINK              = yes;
       SND_SOC_SOF_ICELAKE_SUPPORT       = yes;
       SND_SOC_SOF_INTEL_TOPLEVEL        = yes;

From 1bc943ec83040c99b6e597b775fbed5603399cf8 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 11 Jun 2020 16:40:29 -0400
Subject: [PATCH 43/63] linux: 5.7.1 -> 5.7.2

(cherry picked from commit fa736e19a6f4e5376339dfdf34fb8c570ae43de4)
---
 pkgs/os-specific/linux/kernel/linux-5.7.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.7.nix b/pkgs/os-specific/linux/kernel/linux-5.7.nix
index 81f4d4b3553d..c7f1389f1128 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.7.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.7.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7.1";
+  version = "5.7.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1vcxrrb2i4366iciw0mfahwbdrzmhrrsr7gi4vdkzznfv2niils0";
+    sha256 = "02brxm78n0kg4mh48acvjsr7mpvaqd279ycyaixaflid1s1awrb0";
   };
 } // (args.argsOverride or {}))

From 18253518e11e3703baec465a5550dbe7575ace68 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Mon, 15 Jun 2020 11:10:00 -0400
Subject: [PATCH 44/63] linux: 5.7-rc6 -> 5.8-rc1

(cherry picked from commit 5953625fa5235f3b947cc4d884b138f0ca4c475b)
---
 pkgs/os-specific/linux/kernel/common-config.nix | 4 ++--
 pkgs/os-specific/linux/kernel/linux-testing.nix | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index db2980ee2123..4788c5f7b018 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -193,8 +193,8 @@ let
       B43_PHY_HT            = option yes;
       BCMA_HOST_PCI         = option yes;
       RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = whenAtLeast "5.2" yes;
-      RTW88_8822CE          = whenAtLeast "5.2" yes;
+      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index f2f0fac3b7dd..2a7a1fa93425 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7-rc6";
-  extraMeta.branch = "5.7";
+  version = "5.8-rc1";
+  extraMeta.branch = "5.1";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0g04zwdxks7pa5q6shl5xl2rml1w95rxq7sqkkadj11mpk2k89w4";
+    sha256 = "1gb7g2vrgg0zz281lv1ir1r0535spc40j65p0azmdxlk24fkfxfc";
   };
 
   # Should the testing kernels ever be built on Hydra?

From 979b757b2aa937721d8ccec988a8584c90e3ef10 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 18 Jun 2020 07:50:12 -0400
Subject: [PATCH 45/63] linux: 5.7.2 -> 5.7.3

(cherry picked from commit 4f7e011f874e121a7e1a2059b38f9143cca9fce7)
---
 pkgs/os-specific/linux/kernel/linux-5.7.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.7.nix b/pkgs/os-specific/linux/kernel/linux-5.7.nix
index c7f1389f1128..0f04abfec8fd 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.7.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.7.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7.2";
+  version = "5.7.3";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "02brxm78n0kg4mh48acvjsr7mpvaqd279ycyaixaflid1s1awrb0";
+    sha256 = "1sgwdcyn9105lfgg25q41yj30sy9cqfdm8m4dmka8gzllxxyq407";
   };
 } // (args.argsOverride or {}))

From 58f3e7b88fffae060162f6b27b453d7a996b7e9b Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Fri, 19 Jun 2020 08:06:54 -0400
Subject: [PATCH 46/63] linux: 5.7.3 -> 5.7.4

(cherry picked from commit 41bd44e05ddd8ff9fac48fd23875645b94da8904)
---
 pkgs/os-specific/linux/kernel/linux-5.7.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.7.nix b/pkgs/os-specific/linux/kernel/linux-5.7.nix
index 0f04abfec8fd..c299cc098722 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.7.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.7.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.7.3";
+  version = "5.7.4";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1sgwdcyn9105lfgg25q41yj30sy9cqfdm8m4dmka8gzllxxyq407";
+    sha256 = "06mm0bmjw54aypfhhbm9aaz5bmgymvygfak587iwv901635gb95w";
   };
 } // (args.argsOverride or {}))

From 210d7a173a276db1ac8077a9732572366ce64cfb Mon Sep 17 00:00:00 2001
From: Artemis Tosini <me@artem.ist>
Date: Thu, 18 Jun 2020 12:37:44 +0000
Subject: [PATCH 47/63] =?UTF-8?q?lepton:=201.2.1=20=E2=86=92=202019-08-20?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit b48a4514ca63538dc4192fdbd265992d3b2c7b71)
---
 pkgs/tools/graphics/lepton/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/graphics/lepton/default.nix b/pkgs/tools/graphics/lepton/default.nix
index 2a4f8a310ada..a65e57d9a731 100644
--- a/pkgs/tools/graphics/lepton/default.nix
+++ b/pkgs/tools/graphics/lepton/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, git, glibc }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.1";
-  pname = "lepton";
+  version = "2019-08-20";
+  pname = "lepton-unstable";
 
   src = fetchFromGitHub {
     repo = "lepton";
     owner = "dropbox";
-    rev = version;
-    sha256 = "1f2vyp0crj4yw27bs53vykf2fqk4w57gv3lh9dp89dh3y7wwh1ba";
+    rev = "3d1bc19da9f13a6e817938afd0f61a81110be4da";
+    sha256 = "0aqs6nvcbq8cbfv8699fa634bsz7csmk0169n069yvv17d1c07fd";
   };
 
   nativeBuildInputs = [ cmake git ];

From 13c15f26d44cf7f54197891a6f0c78ce8149b037 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Mon, 22 Jun 2020 10:16:35 +1000
Subject: [PATCH 48/63] buildGoModule: remove strictDeps

---
 pkgs/development/go-modules/generic/old.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/go-modules/generic/old.nix b/pkgs/development/go-modules/generic/old.nix
index 42b446b9fa86..1bf13c18821e 100644
--- a/pkgs/development/go-modules/generic/old.nix
+++ b/pkgs/development/go-modules/generic/old.nix
@@ -208,8 +208,6 @@ let
       find $out/bin -type f -exec ${removeExpr removeReferences} '{}' + || true
     '';
 
-    strictDeps = true;
-
     disallowedReferences = lib.optional (!allowGoReference) go;
 
     passthru = passthru // { inherit go go-modules modSha256; };

From 9c42eb70cfdb2e59c001a4cdae0b2c9875dd44c3 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 22 Jun 2020 11:44:54 +0200
Subject: [PATCH 49/63] gitea: 1.11.6 -> 1.11.8

Rationale for update: on `master`, `gitea` has been updated to `1.12.0`
in #91069 which contains a few breaking changes. The latest
1.11-releases contain a few bugfixes backported from 1.12.

https://github.com/go-gitea/gitea/releases/tag/v1.11.7
https://github.com/go-gitea/gitea/releases/tag/v1.11.8
---
 pkgs/applications/version-management/gitea/default.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index a17495ae7c7e..6d9f3dec983e 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -9,11 +9,11 @@ with stdenv.lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.11.6";
+  version = "1.11.8";
 
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "11nyq5faq0hy1pi3yhmc6y8is7jyiyfrb162fq9l33pkyw6qihqs";
+    sha256 = "1f5sj49zjcsi0bcryr41xzsvmy3zn3m4khlkcq5k5abxiyynbygl";
   };
 
   unpackPhase = ''
@@ -25,10 +25,6 @@ buildGoPackage rec {
 
   patches = [
     ./static-root-path.patch
-    (fetchpatch {
-      url = "https://github.com/go-gitea/gitea/commit/1830d0ed5f4a67e3360ecbb55933b5540b6affce.patch";
-      sha256 = "163531pcki28qfs56l64vv4xxaavxgksf038da1sn21j5l2jm81i";
-    })
   ];
 
   postPatch = ''

From 86810c468df687f5ada980115bfeda3926506191 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 19 Jun 2020 18:27:39 +0200
Subject: [PATCH 50/63] ansible: v2.9.9 -> v2.9.10

(cherry picked from commit 11e5ca3caac59de44674056e90f6c5d7dbdcb795)
---
 pkgs/development/python-modules/ansible/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index e0bf4162de62..de2c152314d4 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "ansible";
-  version = "2.9.9";
+  version = "2.9.10";
 
   src = fetchFromGitHub {
     owner = "ansible";
     repo = "ansible";
     rev = "v${version}";
-    sha256 = "06a9iq7w2cm0hsxaw5irsja8w44gffiw09ly27jxklpa8gv57rml";
+    sha256 = "1979522k57gafvq9vx3lbc3zah7jq3kiy98ji9x5bmxyddmgr9ch";
   };
 
   prePatch = ''

From 7d1c0e70596df0294ee80980ebb02d49ce645d42 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2020 01:40:20 +0200
Subject: [PATCH 51/63] ansible: add myself as maintainer

(cherry picked from commit 9f98f41854c1e8acb9365058cdd7db404cc475e0)
---
 pkgs/development/python-modules/ansible/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix
index de2c152314d4..acc474f93ed0 100644
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@@ -51,7 +51,7 @@ buildPythonPackage rec {
     homepage = http://www.ansible.com;
     description = "Radically simple IT automation";
     license = [ licenses.gpl3 ] ;
-    maintainers = with maintainers; [ joamaki costrouc ];
+    maintainers = with maintainers; [ joamaki costrouc hexa ];
     platforms = platforms.linux ++ platforms.darwin;
   };
 }

From 348503b6345947082ff8be933dda7ebeddbb2762 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 22 Jun 2020 11:54:54 +0200
Subject: [PATCH 52/63] Update nixUnstable and nixFlakes

(cherry picked from commit b505bf202b0c23e3bd22d2555d79d6fbb2fa498c)
---
 pkgs/tools/package-management/nix/default.nix | 33 +++++--------------
 1 file changed, 9 insertions(+), 24 deletions(-)

diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index c2fe719875bb..fc8ee8c73400 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -13,7 +13,7 @@ common =
   , bash, coreutils, gzip, gnutar
   , pkgconfig, boehmgc, perlPackages, libsodium, brotli, boost, editline, nlohmann_json
   , autoreconfHook, autoconf-archive, bison, flex, libxml2, libxslt, docbook5, docbook_xsl_ns
-  , jq, libarchive, rustc, cargo
+  , jq, libarchive
   # Used by tests
   , gmock
   , busybox-sandbox-shell
@@ -23,7 +23,7 @@ common =
   , withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp
   , withAWS ? stdenv.isLinux || stdenv.isDarwin, aws-sdk-cpp
 
-  , name, suffix ? "", src, crates ? null
+  , name, suffix ? "", src
 
   }:
   let
@@ -49,7 +49,7 @@ common =
           brotli boost editline
         ]
         ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-        ++ lib.optionals is24 [ libarchive rustc cargo ]
+        ++ lib.optionals is24 [ libarchive ]
         ++ lib.optional withLibseccomp libseccomp
         ++ lib.optional withAWS
             ((aws-sdk-cpp.override {
@@ -79,11 +79,6 @@ common =
             patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
           ''}
         '' +
-        # Unpack the Rust crates.
-        lib.optionalString is24 ''
-          tar xvf ${crates} -C nix-rust/
-          mv nix-rust/nix-vendored-crates* nix-rust/vendor
-        '' +
         # For Nix-2.3, patch around an issue where the Nix configure step pulls in the
         # build system's bash and other utilities when cross-compiling
         lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform && isExactly23) ''
@@ -191,18 +186,13 @@ in rec {
 
   nixUnstable = lib.lowPrio (callPackage common rec {
     name = "nix-2.4${suffix}";
-    suffix = "pre7534_b92f58f6";
+    suffix = "pre7805_984e5213";
 
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "b92f58f6d9e44f97002d1722bd77bad939824c1c";
-      sha256 = "1p791961y5v04kpz37g6hm98f1ig7i34inxl9dcj3pbqhf5kicxg";
-    };
-
-    crates = fetchurl {
-      url = "https://hydra.nixos.org/build/118797694/download/1/nix-vendored-crates-2.4pre7534_b92f58f6.tar.xz";
-      sha256 = "a4c2612bbd81732bbb899bc0c230e07b16f6b6150ffbb19c4907dedbbc2bf9fc";
+      rev = "984e521392b3f41f7cdab203e5c00f3e00e27a28";
+      sha256 = "1dch48018dwzx9cysnfxrdpszav87s0d635zqw810mgmqpm25fw8";
     };
 
     inherit storeDir stateDir confDir boehmgc;
@@ -210,18 +200,13 @@ in rec {
 
   nixFlakes = lib.lowPrio (callPackage common rec {
     name = "nix-2.4${suffix}";
-    suffix = "pre20200521_00b562c";
+    suffix = "pre20200622_334e26b";
 
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
-      rev = "00b562c87ec4c3bbe514f5dc1f4d1c41f66f66bf";
-      hash = "sha256-GqTFh4wBfkKapixKyd3gA9C1tF0PSzZDD5LN+5nQEWk=";
-    };
-
-    crates = fetchurl {
-      url = "https://hydra.nixos.org/build/118093786/download/1/nix-vendored-crates-2.4pre20200501_941f952.tar.xz";
-      sha256 = "060f4n5srdbb8vsj0m14aqch7im79a4h5g3nrs41p1xc602vhcdl";
+      rev = "334e26bfc2ce82912602e8a0f9f9c7e0fb5c3221";
+      sha256 = "14a2yyn1ygymlci6hl5d308fs3p3m0mgcfs5dc8dn0s3lg5qvbmp";
     };
 
     inherit storeDir stateDir confDir boehmgc;

From df3bafff200916912123e0aab7606bd991821d3e Mon Sep 17 00:00:00 2001
From: "Markus S. Wamser" <github-dev@mail2013.wamser.eu>
Date: Mon, 11 May 2020 23:11:37 +0200
Subject: [PATCH 53/63] lxqt.pcmanfm-qt: fix default wallpaper

(cherry picked from commit f805871a51c6b9ef50d2860c8c08b57d293f0740)
---
 pkgs/desktops/lxqt/pcmanfm-qt/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
index 168b7f35ad27..2d62790348fb 100644
--- a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
@@ -28,9 +28,13 @@ mkDerivation rec {
     lxmenu-data
   ];
 
+  postPatch = ''
+    substituteInPlace config/pcmanfm-qt/lxqt/settings.conf.in --replace @LXQT_SHARE_DIR@ /run/current-system/sw/share/lxqt
+  '';
+
   meta = with lib; {
     description = "File manager and desktop icon manager (Qt port of PCManFM and libfm)";
-    homepage = https://github.com/lxqt/pcmanfm-qt;
+    homepage = "https://github.com/lxqt/pcmanfm-qt";
     license = licenses.gpl2;
     platforms = with platforms; unix;
     maintainers = with maintainers; [ romildo ];

From c078dab38e3477ea01c1ccb86341585ea9a84acd Mon Sep 17 00:00:00 2001
From: Austin Butler <austinabutler@gmail.com>
Date: Fri, 19 Jun 2020 15:38:40 -0700
Subject: [PATCH 54/63] nomachine-client: 6.10.12 -> 6.11.2

(cherry picked from commit d0cdf0c5287fdc66b66eae77019518518759ef13)
---
 pkgs/tools/admin/nomachine-client/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/admin/nomachine-client/default.nix b/pkgs/tools/admin/nomachine-client/default.nix
index fe52ddde63ad..192817bd9b7d 100644
--- a/pkgs/tools/admin/nomachine-client/default.nix
+++ b/pkgs/tools/admin/nomachine-client/default.nix
@@ -1,8 +1,8 @@
 { stdenv, file, fetchurl, makeWrapper,
   autoPatchelfHook, jsoncpp, libpulseaudio }:
 let
-  versionMajor = "6.10";
-  versionMinor = "12";
+  versionMajor = "6.11";
+  versionMinor = "2";
   versionBuild_x86_64 = "1";
   versionBuild_i686 = "1";
 in
@@ -17,7 +17,7 @@ in
             "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz"
             "https://web.archive.org/web/https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz"
           ];
-          sha256 = "17yb377ry7i7cmkb72xmhyqkfggv1ygqlz55ymvmrs7psbh7ql01";
+          sha256 = "1b6r9bwkr8mhaljma19ikxpkmlx8iy5r1vf5hlv27bja2zz1r8xr";
         }
       else if stdenv.hostPlatform.system == "i686-linux" then
         fetchurl {
@@ -25,7 +25,7 @@ in
             "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz"
             "https://web.archive.org/web/https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz"
           ];
-          sha256 = "0k6dspmwdkm0zf0c2zqlqy0jya8qgsg90wwv9wa12fn4chp66gqg";
+          sha256 = "0dl138ry9n1qh651zh0zvp88qhgxrs2kvvnq329jw0py5v70b9pm";
         }
       else
         throw "NoMachine client is not supported on ${stdenv.hostPlatform.system}";

From 1fb5b2ccdd3eb8eedecf5c55d1e0e8df1ddbb2b1 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 23 Jun 2020 17:09:28 +0200
Subject: [PATCH 55/63] riot-web: 1.6.5 -> 1.6.6

https://github.com/vector-im/riot-web/releases/tag/v1.6.6
(cherry picked from commit c1e8f5c825e71baca034ed28c9bf9bcd3cbcfb64)
---
 .../networking/instant-messengers/riot/riot-web.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
index 67f02761513f..a0f5ac64de81 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "riot-web";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "0mx7ql76cbivc0d9gzix51bc1rdp9yg9vjx05mbf5r9sxrwmihz5";
+    sha256 = "0j88wcha5rr6qaxik4m90v9mgfcj3r9nb4gpd2dzi7m1zf7kivkw";
   };
 
   installPhase = ''

From 39da4240609ee0d8ea533f142ae4c7e25df95980 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 23 Jun 2020 17:09:52 +0200
Subject: [PATCH 56/63] riot-desktop: 1.6.5 -> 1.6.6

https://github.com/vector-im/riot-desktop/releases/tag/v1.6.6
(cherry picked from commit ea13f90b5fd4de6a4e7b72c9c7f8970e7373613f)
---
 .../riot/riot-desktop-package.json            | 11 ++---
 .../riot/riot-desktop-yarndeps.nix            | 40 +++++++++++++------
 .../instant-messengers/riot/riot-desktop.nix  |  4 +-
 3 files changed, 36 insertions(+), 19 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
index f9a5ebdbebe3..6280bfdf4c71 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@@ -2,7 +2,7 @@
   "name": "riot-desktop",
   "productName": "Riot",
   "main": "src/electron-main.js",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
   "repository": {
@@ -48,17 +48,18 @@
     "find-npm-prefix": "^1.0.2",
     "fs-extra": "^8.1.0",
     "glob": "^7.1.6",
-    "matrix-js-sdk": "6.2.2",
+    "matrix-js-sdk": "7.0.0",
     "mkdirp": "^1.0.3",
-    "needle": "^2.3.2",
-    "node-pre-gyp": "^0.14.0",
+    "needle": "^2.5.0",
+    "node-pre-gyp": "^0.15.0",
     "npm": "^6.13.7",
     "rimraf": "^3.0.2",
     "semver": "^7.1.3",
     "tar": "^6.0.1"
   },
   "hakDependencies": {
-    "matrix-seshat": "^1.3.3"
+    "matrix-seshat": "^1.3.3",
+    "keytar": "^5.6.0"
   },
   "build": {
     "appId": "im.riot.app",
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
index 30e1c9464755..2fa0303ae05b 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
@@ -3154,11 +3154,11 @@
       };
     }
     {
-      name = "matrix_js_sdk___matrix_js_sdk_6.2.2.tgz";
+      name = "matrix_js_sdk___matrix_js_sdk_7.0.0.tgz";
       path = fetchurl {
-        name = "matrix_js_sdk___matrix_js_sdk_6.2.2.tgz";
-        url  = "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-6.2.2.tgz";
-        sha1 = "103d951f61945217b110962f55ae43996756f615";
+        name = "matrix_js_sdk___matrix_js_sdk_7.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/matrix-js-sdk/-/matrix-js-sdk-7.0.0.tgz";
+        sha1 = "da2b24e57574379c3d8f7065eb68ea6c479d9806";
       };
     }
     {
@@ -3273,6 +3273,14 @@
         sha1 = "3db5c0765545ab8637be71f333a104a965a9ca3f";
       };
     }
+    {
+      name = "minimist___minimist_1.2.5.tgz";
+      path = fetchurl {
+        name = "minimist___minimist_1.2.5.tgz";
+        url  = "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz";
+        sha1 = "67d66014b66a6a8aaa0c083c5fd58df4e4e97602";
+      };
+    }
     {
       name = "minipass___minipass_2.9.0.tgz";
       path = fetchurl {
@@ -3321,6 +3329,14 @@
         sha1 = "30057438eac6cf7f8c4767f38648d6697d75c903";
       };
     }
+    {
+      name = "mkdirp___mkdirp_0.5.5.tgz";
+      path = fetchurl {
+        name = "mkdirp___mkdirp_0.5.5.tgz";
+        url  = "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.5.5.tgz";
+        sha1 = "d91cefd62d1436ca0f41620e251288d420099def";
+      };
+    }
     {
       name = "mkdirp___mkdirp_1.0.3.tgz";
       path = fetchurl {
@@ -3378,11 +3394,11 @@
       };
     }
     {
-      name = "needle___needle_2.3.2.tgz";
+      name = "needle___needle_2.5.0.tgz";
       path = fetchurl {
-        name = "needle___needle_2.3.2.tgz";
-        url  = "https://registry.yarnpkg.com/needle/-/needle-2.3.2.tgz";
-        sha1 = "3342dea100b7160960a450dc8c22160ac712a528";
+        name = "needle___needle_2.5.0.tgz";
+        url  = "https://registry.yarnpkg.com/needle/-/needle-2.5.0.tgz";
+        sha1 = "e6fc4b3cc6c25caed7554bd613a5cf0bac8c31c0";
       };
     }
     {
@@ -3410,11 +3426,11 @@
       };
     }
     {
-      name = "node_pre_gyp___node_pre_gyp_0.14.0.tgz";
+      name = "node_pre_gyp___node_pre_gyp_0.15.0.tgz";
       path = fetchurl {
-        name = "node_pre_gyp___node_pre_gyp_0.14.0.tgz";
-        url  = "https://registry.yarnpkg.com/node-pre-gyp/-/node-pre-gyp-0.14.0.tgz";
-        sha1 = "9a0596533b877289bcad4e143982ca3d904ddc83";
+        name = "node_pre_gyp___node_pre_gyp_0.15.0.tgz";
+        url  = "https://registry.yarnpkg.com/node-pre-gyp/-/node-pre-gyp-0.15.0.tgz";
+        sha1 = "c2fc383276b74c7ffa842925241553e8b40f1087";
       };
     }
     {
diff --git a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
index d1415f1c3f44..567d1eec8bb9 100644
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@@ -8,12 +8,12 @@
 
 let
   executableName = "riot-desktop";
-  version = "1.6.5";
+  version = "1.6.6";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "riot-desktop";
     rev = "v${version}";
-    sha256 = "1snmfn98z63a8ahh5c7y7h00i8qsdq6wsnidmjjrkzcz3mchfq60";
+    sha256 = "0yrybi6cv3lj0fq4ab4rzjm9l4flfw97hkwzlp7zzixb3z9h09h8";
   };
   electron = electron_7;
 

From 4a38da509205ab29095c3529ac325e694ac5ae9e Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Thu, 18 Jun 2020 07:49:48 -0400
Subject: [PATCH 57/63] linux: 5.4.46 -> 5.4.47

(cherry picked from commit 5af8ad3e6d2e0e2e63534d1a95eb44669e64b3a5)
---
 pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 1c5bfad41681..a2fbbbe37349 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.46";
+  version = "5.4.47";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "13hvnfdcbcb9a21zizq8d90mc8maxz03zmzsj6iqsjd2y7r4y1rh";
+    sha256 = "0v4d86yci4lq82nb1fgf0g3j0348v6q6m77czpm4b3cs7lwrs2wp";
   };
 } // (args.argsOverride or {}))

From abd7eb853698adce21bc3b3d7125ca88ca97ae58 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 23 Jun 2020 11:17:55 -0400
Subject: [PATCH 58/63] linux: 4.14.184 -> 4.14.185

---
 pkgs/os-specific/linux/kernel/linux-4.14.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 7ee05ed47ded..62dac23d72e7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.184";
+  version = "4.14.185";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0h6r06c1d7amkfglsr66ic89p0zxpmk7jkq1ylcbknmkiwkixx9g";
+    sha256 = "1iixxwidp53s2i2br58wbx5s69f2jcllb116z73pv7fmd06b2czk";
   };
 } // (args.argsOverride or {}))

From 779f70185d035a321b4f5344bd7c0c74a7fb29f4 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 23 Jun 2020 11:18:07 -0400
Subject: [PATCH 59/63] linux: 4.19.128 -> 4.19.129

---
 pkgs/os-specific/linux/kernel/linux-4.19.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 92281ffdd3e6..d33038fe5670 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.128";
+  version = "4.19.129";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0g31ad3wziy4xqna0yvwjcnza3jhd93syjpfvmwh0b4pkj2adar9";
+    sha256 = "0p0apfviv699mda5zmqphymfybcm932s5yffhvrpqvy2fpas0yx8";
   };
 } // (args.argsOverride or {}))

From de5c1423f94fbd1f16441c220f9ba5361e454142 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 23 Jun 2020 11:18:16 -0400
Subject: [PATCH 60/63] linux: 4.4.227 -> 4.4.228

---
 pkgs/os-specific/linux/kernel/linux-4.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index fe0406233169..59c86a5e1415 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.227";
+  version = "4.4.228";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "196x57w740firg8zchypq4vq6a83ymmwn9amqrscym9zr0pcgm40";
+    sha256 = "0y1xc5lk8j3p5maarksmh18wy921rgcngzsih7q1a82rah1fsjxr";
   };
 } // (args.argsOverride or {}))

From 907e1ae756c11cef22b43a43713ed12df2b06f7c Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 23 Jun 2020 11:18:28 -0400
Subject: [PATCH 61/63] linux: 4.9.227 -> 4.9.228

---
 pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 5be2d7ac9bd9..9afd8686c193 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.227";
+  version = "4.9.228";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0pqc0wld4s4zjas95xm54mrkk00l9zkc59b6i9gq4km126s8bi1q";
+    sha256 = "0d7w2zzs79ywxzfrh4bmk5lw318qbkcb8mcsyyh3cc25qqlz9gwg";
   };
 } // (args.argsOverride or {}))

From b3dcc2bfead55b74faf2007cce5c901677a1b42a Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Tue, 23 Jun 2020 11:18:38 -0400
Subject: [PATCH 62/63] linux: 5.4.47 -> 5.4.48

---
 pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index a2fbbbe37349..006f469aa988 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.47";
+  version = "5.4.48";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0v4d86yci4lq82nb1fgf0g3j0348v6q6m77czpm4b3cs7lwrs2wp";
+    sha256 = "0lqxryxn0bfly337ddhl7m7qdwblxg8i1fsl8v9i9h84rnpxs85z";
   };
 } // (args.argsOverride or {}))

From 390742eb138b519a97f8b238d1f097d3bdb0357d Mon Sep 17 00:00:00 2001
From: Lancelot SIX <lsix@lancelotsix.com>
Date: Mon, 22 Jun 2020 13:47:53 +0100
Subject: [PATCH 63/63] qgis: 3.10.4 -> 3.10.7

(cherry picked from commit 3bdefc8802755057c473fa2a64e6d352b1e64bab)
---
 pkgs/applications/gis/qgis/unwrapped.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 80115ab8243e..b1b9fe318698 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -10,7 +10,7 @@ let
     [ qscintilla-qt5 gdal jinja2 numpy psycopg2
       chardet dateutil pyyaml pytz requests urllib3 pygments pyqt5 sip owslib six ];
 in mkDerivation rec {
-  version = "3.10.4";
+  version = "3.10.7";
   pname = "qgis";
   name = "${pname}-unwrapped-${version}";
 
@@ -18,7 +18,7 @@ in mkDerivation rec {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0d1rsgjgnnq6jgms5bgppz8lkh4518nf90fk0qvxajdfi9j4jn12";
+    sha256 = "0z593n5g3zwhlzhs0z7nlpblz6z2rl3y7y3j1wf1rdx76i8p3qgf";
   };
 
   passthru = {