From 006b4b1a4ad22c5b8ec496796f7043d4b2010bc4 Mon Sep 17 00:00:00 2001
From: Matteo Scarlata <matteo@hjkl.space>
Date: Thu, 12 Mar 2020 21:24:46 +0100
Subject: [PATCH 01/59] virtualbox: 6.0.14 -> 6.1.4

Update Virtualbox to its latest version. This allows compilation against
kernel >= 5.4 to succeed without further patches (see #74260, build
would fail for linux-5.5.5 to 5.5.9).

(cherry picked from commit 3132c237b181244f3c5d128e5195f538ddffb38e)
---
 .../virtualization/virtualbox/default.nix     | 25 +-------
 .../virtualbox/extra_symbols.patch            | 21 ++++++
 .../virtualbox/guest-additions/default.nix    | 64 +------------------
 .../virtualization/virtualbox/hardened.patch  | 52 +++++++--------
 4 files changed, 53 insertions(+), 109 deletions(-)
 create mode 100644 pkgs/applications/virtualization/virtualbox/extra_symbols.patch

diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 6c15b2ea2ced..5d3044bdbc71 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -21,8 +21,8 @@ let
   buildType = "release";
   # Remember to change the extpackRev and version in extpack.nix and
   # guest-additions/default.nix as well.
-  main = "036x2mvkk22lbg72cz6pik9z538j1ag6mmwjjmfikgrq1i7v24jy";
-  version = "6.0.14";
+  main = "59f8f5774473f593e3eb5940e2a337e0674bcd9854164b2578fd43f896260c99";
+  version = "6.1.4";
 
   iasl' = iasl.overrideAttrs (old: rec {
     inherit (old) pname;
@@ -89,6 +89,7 @@ in stdenv.mkDerivation {
 
   patches =
      optional enableHardening ./hardened.patch
+  ++ [ ./extra_symbols.patch ]
      # When hardening is enabled, we cannot use wrapQtApp to ensure that VirtualBoxVM sees
      # the correct environment variables needed for Qt to work, specifically QT_PLUGIN_PATH.
      # This is because VirtualBoxVM would detect that it is wrapped that and refuse to run,
@@ -102,26 +103,6 @@ in stdenv.mkDerivation {
     })
   ++ [
     ./qtx11extras.patch
-    # Kernel 5.4 fix, should be fixed with next upstream release
-    # https://www.virtualbox.org/ticket/18945
-    (fetchpatch {
-      name = "kernel-5.4-fix-1.patch";
-      url = "https://www.virtualbox.org/changeset/81586/vbox?format=diff";
-      sha256 = "0zbkc9v65pkdmjik53x29g39qyf7narkhpwpx5n1n1bfqnhf0k1r";
-      stripLen = 1;
-    })
-    (fetchpatch {
-      name = "kernel-5.4-fix-2.patch";
-      url = "https://www.virtualbox.org/changeset/81587/vbox?format=diff";
-      sha256 = "1j98cqxj8qlqwaqr4mvwwbkmchw8jmygjwgzz82gix7fj76j2y9c";
-      stripLen = 1;
-    })
-    (fetchpatch {
-      name = "kernel-5.4-fix-3.patch";
-      url = "https://www.virtualbox.org/changeset/81649/vbox?format=diff";
-      sha256 = "1d6p5k5dgzmjglqfkbcbvpn1x3wxila30q4gcbb7pxwfgclaw2hk";
-      stripLen = 1;
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/virtualbox/extra_symbols.patch b/pkgs/applications/virtualization/virtualbox/extra_symbols.patch
new file mode 100644
index 000000000000..174bb8d9e70c
--- /dev/null
+++ b/pkgs/applications/virtualization/virtualbox/extra_symbols.patch
@@ -0,0 +1,21 @@
+diff --git a/src/VBox/HostDrivers/linux/Makefile b/src/VBox/HostDrivers/linux/Makefile
+index 6e44129b..e68ce128 100644
+--- a/src/VBox/HostDrivers/linux/Makefile
++++ b/src/VBox/HostDrivers/linux/Makefile
+@@ -95,13 +95,13 @@ vboxpci: vboxdrv
+ install:
+ 	@$(MAKE) KBUILD_VERBOSE=$(KBUILD_VERBOSE) -C vboxdrv install
+ 	@if [ -d vboxnetflt ]; then \
+-	    $(MAKE) KBUILD_VERBOSE=$(KBUILD_VERBOSE) -C vboxnetflt install; \
++		$(MAKE) KBUILD_VERBOSE=$(KBUILD_VERBOSE) KBUILD_EXTRA_SYMBOLS=$(abspath vboxnetflt/Module.symvers) -C vboxnetflt install; \
+ 	fi
+ 	@if [ -d vboxnetadp ]; then \
+-	    $(MAKE) KBUILD_VERBOSE=$(KBUILD_VERBOSE) -C vboxnetadp install; \
++	    $(MAKE) KBUILD_VERBOSE=$(KBUILD_VERBOSE) KBUILD_EXTRA_SYMBOLS=$(abspath vboxnetadp/Module.symvers) -C vboxnetadp install; \
+ 	fi
+ 	@if [ -d vboxpci ]; then \
+-	    $(MAKE) KBUILD_VERBOSE=$(KBUILD_VERBOSE) -C vboxpci install; \
++	    $(MAKE) KBUILD_VERBOSE=$(KBUILD_VERBOSE) KBUILD_EXTRA_SYMBOLS=$(abspath vboxpci/Module.symvers) -C vboxpci install; \
+ 	fi
+ 
+ else
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index 690b72f3eeb0..fdb393a94ebe 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, lib, patchelf, cdrkit, kernel, which, makeWrapper
-, zlib, xorg, dbus, virtualbox, dos2unix, fetchpatch, findutils, patchutils }:
+, zlib, xorg, dbus, virtualbox}:
 
 let
   version = virtualbox.version;
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-    sha256 = "1c9ysx0fhxxginmp607b4fk74dvlr32n6w52gawm06prf4xg90nb";
+    sha256 = "e2846a7576cce1b92a7c0744f41eaac750248d6e31dfca5c45d5766648b394c7";
   };
 
   KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
@@ -43,67 +43,9 @@ in stdenv.mkDerivation rec {
   prePatch = ''
     substituteInPlace src/vboxguest-${version}/vboxvideo/vbox_ttm.c \
       --replace "<ttm/" "<drm/ttm/"
-    
-    echo ${lib.escapeShellArgs patches} | \
-      ${findutils}/bin/xargs -n1 ${patchutils}/bin/lsdiff --strip=1 --addprefix=src/vboxguest-${version}/ | \
-      ${findutils}/bin/xargs ${dos2unix}/bin/dos2unix
   '';
 
   patchFlags = [ "-p1" "-d" "src/vboxguest-${version}" ];
-  # Kernel 5.4 fix, should be fixed with next upstream release
-  # https://www.virtualbox.org/ticket/18945
-  patches = lib.concatLists (lib.mapAttrsToList (changeset: args:
-    map (arg:
-      fetchpatch ({
-        name = "kernel-5.4-fix-${changeset}.patch";
-        url = "https://www.virtualbox.org/changeset/${changeset}/vbox?format=diff";
-      } // arg)) args) {
-        "81586" = [{
-          sha256 = "126z67x6vy65w6jlqbh4z4f1cffxnycwb69vns0154bawbsbxsiw";
-          stripLen = 5;
-          extraPrefix = "vboxguest/";
-        }];
-        "81587" = [
-          {
-            sha256 = "0simzswnl0wvnc2i9gixz99rfc7lxk1nrnskksrlrrl9hqnh0lva";
-            stripLen = 5;
-            extraPrefix = "vboxsf/";
-            includes = [ "*/the-linux-kernel.h" ];
-          }
-          {
-            sha256 = "0a8r9h3x3lcjq2fykgqhdaykp00rnnkbxz8xnxg847zgvca15y02";
-            stripLen = 5;
-            extraPrefix = "vboxguest/";
-            includes = [ "*/the-linux-kernel.h" ];
-          }
-        ];
-        "81649" = [
-          {
-            sha256 = "1p1skxlvqigydxr4sk7w51lpk7nxg0d9lppq39sdnfmgi1z0h0sc";
-            stripLen = 2;
-            extraPrefix = "vboxguest/";
-            includes = [ "*/cdefs.h" ];
-          }
-          {
-            sha256 = "1j060ggdnndyjdhkfvs15306gl7g932sim9xjmx2mnx8gjdmg37f";
-            stripLen = 2;
-            extraPrefix = "vboxsf/";
-            includes = [ "*/cdefs.h" ];
-          }
-          {
-            sha256 = "060h3a5k2yklbvlg0hyg4x87xrg37cvv3rjb67xizlwvlyy6ykkg";
-            stripLen = 5;
-            extraPrefix = "vboxguest/";
-            includes = [ "*/thread2-r0drv-linux.c" ];
-          }
-          {
-            sha256 = "0cxlkf7cy751gl8dgzr7vkims1kmx5pgzsrxyk8w18zyp5nk9glw";
-            stripLen = 7;
-            extraPrefix = "vboxvideo/";
-            includes = [ "*/vbox_*.c" ];
-          }
-        ];
-      });
 
   unpackPhase = ''
     ${if stdenv.hostPlatform.system == "i686-linux" || stdenv.hostPlatform.system == "x86_64-linux" then ''
@@ -162,7 +104,7 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     # Install kernel modules.
     cd src/vboxguest-${version}
-    make install INSTALL_MOD_PATH=$out
+    make install INSTALL_MOD_PATH=$out KBUILD_EXTRA_SYMBOLS=$PWD/vboxsf/Module.symvers
     cd ../..
 
     # Install binaries
diff --git a/pkgs/applications/virtualization/virtualbox/hardened.patch b/pkgs/applications/virtualization/virtualbox/hardened.patch
index 398100f3f398..180ea88461ef 100644
--- a/pkgs/applications/virtualization/virtualbox/hardened.patch
+++ b/pkgs/applications/virtualization/virtualbox/hardened.patch
@@ -75,32 +75,6 @@ index ce0f288..6193108 100644
              return supR3HardenedSetError3(VERR_SUPLIB_WRITE_NON_SYS_GROUP, pErrInfo,
                                            "An unknown (and thus untrusted) group has write access to '", pszPath,
                                            "' and we therefore cannot trust the directory content or that of any subdirectory");
-diff --git a/src/VBox/Main/src-server/MachineImpl.cpp b/src/VBox/Main/src-server/MachineImpl.cpp
-index 320c569..9bfe41f 100644
---- a/src/VBox/Main/src-server/MachineImpl.cpp
-+++ b/src/VBox/Main/src-server/MachineImpl.cpp
-@@ -7543,7 +7543,7 @@ HRESULT Machine::i_launchVMProcess(IInternalSessionControl *aControl,
-
-     /* get the path to the executable */
-     char szPath[RTPATH_MAX];
--    RTPathAppPrivateArch(szPath, sizeof(szPath) - 1);
-+    RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers/bin");
-     size_t cchBufLeft = strlen(szPath);
-     szPath[cchBufLeft++] = RTPATH_DELIMITER;
-     szPath[cchBufLeft] = 0;
-diff --git a/src/VBox/Main/src-server/NetworkServiceRunner.cpp b/src/VBox/Main/src-server/NetworkServiceRunner.cpp
-index 1e38d99..5e43dda 100644
---- a/src/VBox/Main/src-server/NetworkServiceRunner.cpp
-+++ b/src/VBox/Main/src-server/NetworkServiceRunner.cpp
-@@ -85,7 +85,7 @@ int NetworkServiceRunner::start(bool aKillProcOnStop)
-
-     /* get the path to the executable */
-     char exePathBuf[RTPATH_MAX];
--    const char *exePath = RTProcGetExecutablePath(exePathBuf, RTPATH_MAX);
-+    const char *exePath = RTProcGetSuidPath(exePathBuf, RTPATH_MAX);
-     char *substrSl = strrchr(exePathBuf, '/');
-     char *substrBs = strrchr(exePathBuf, '\\');
-     char *suffix = substrSl ? substrSl : substrBs;
 diff --git a/src/VBox/Main/src-server/generic/NetIf-generic.cpp b/src/VBox/Main/src-server/generic/NetIf-generic.cpp
 index 98dc91a..43a819f 100644
 --- a/src/VBox/Main/src-server/generic/NetIf-generic.cpp
@@ -180,3 +154,29 @@ index 2aab645..9795f21 100644
 
  RTR3DECL(const char *) RTProcShortName(void)
  {
+diff --git a/src/VBox/Main/src-server/NetworkServiceRunner.cpp b/src/VBox/Main/src-server/NetworkServiceRunner.cpp
+index 2e57690..3272c84 100644
+--- a/src/VBox/Main/src-server/NetworkServiceRunner.cpp
++++ b/src/VBox/Main/src-server/NetworkServiceRunner.cpp
+@@ -188,7 +188,7 @@ int NetworkServiceRunner::start(bool aKillProcessOnStop)
+      * ASSUME it is relative to the directory that holds VBoxSVC.
+      */
+     char szExePath[RTPATH_MAX];
+-    AssertReturn(RTProcGetExecutablePath(szExePath, RTPATH_MAX), VERR_FILENAME_TOO_LONG);
++    AssertReturn(RTProcGetSuidPath(szExePath, RTPATH_MAX), VERR_FILENAME_TOO_LONG);
+     RTPathStripFilename(szExePath);
+     int vrc = RTPathAppend(szExePath, sizeof(szExePath), m->pszProcName);
+     AssertLogRelRCReturn(vrc, vrc);
+diff --git a/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp b/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp
+index 2991d3a7..d042a08b 100644
+--- a/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp
++++ b/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp
+@@ -90,7 +90,7 @@ int MachineLaunchVMCommonWorker(const Utf8Str &aNameOrId,
+ 
+     /* Get the path to the executable directory w/ trailing slash: */
+     char szPath[RTPATH_MAX];
+-    int vrc = RTPathAppPrivateArch(szPath, sizeof(szPath));
++    int vrc = RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers/bin");
+     AssertRCReturn(vrc, vrc);
+     size_t cbBufLeft = RTPathEnsureTrailingSeparator(szPath, sizeof(szPath));
+     AssertReturn(cbBufLeft > 0, VERR_FILENAME_TOO_LONG);

From c6be4c19578ecd8ac8211b753640f3693d00c8d9 Mon Sep 17 00:00:00 2001
From: Samuel Leathers <samuel.leathers@iohk.io>
Date: Wed, 15 Apr 2020 17:07:33 -0400
Subject: [PATCH 02/59] treewide: mark broken packages for 20.03

---
 pkgs/applications/misc/safeeyes/default.nix   |  1 +
 .../misc/syncthingtray/default.nix            |  1 +
 pkgs/applications/misc/topydo/default.nix     |  1 +
 .../salut-a-toi/default.nix                   |  1 +
 .../networking/p2p/stig/default.nix           |  1 +
 .../networking/super-productivity/default.nix |  1 +
 .../applications/office/paperwork/default.nix |  1 +
 .../science/misc/sasview/default.nix          |  1 +
 .../robotics/qgroundcontrol/default.nix       |  1 +
 pkgs/desktops/surf-display/default.nix        |  1 +
 .../haskell-modules/configuration-common.nix  | 27 ++++++++++++++++++-
 pkgs/development/libraries/nsss/default.nix   |  2 ++
 pkgs/development/libraries/soil/default.nix   |  1 +
 .../development/libraries/swiften/default.nix |  1 +
 pkgs/development/libraries/utmps/default.nix  |  1 +
 .../development/misc/qmk_firmware/default.nix |  1 +
 .../python-modules/intake/default.nix         |  1 +
 .../python-modules/jug/default.nix            |  1 +
 .../python-modules/junit-xml/default.nix      |  1 +
 .../python-modules/junos-eznc/default.nix     |  1 +
 .../python-modules/locustio/default.nix       |  1 +
 .../python-modules/ludios_wpull/default.nix   |  1 +
 .../python-modules/macropy/default.nix        |  1 +
 .../marionette-harness/mozfile.nix            |  1 +
 .../markdownsuperscript/default.nix           |  1 +
 .../python-modules/mecab-python3/default.nix  |  1 +
 .../python-modules/mock-open/default.nix      |  1 +
 .../python-modules/namedlist/default.nix      |  1 +
 .../python-modules/nipype/default.nix         |  1 +
 .../python-modules/nixpkgs/default.nix        |  1 +
 .../python-modules/pelican/default.nix        |  1 +
 .../python-modules/persim/default.nix         |  1 +
 .../python-modules/pg8000/default.nix         |  1 +
 .../python-modules/piep/default.nix           |  1 +
 .../python-modules/pymc3/default.nix          |  1 +
 .../python-modules/pymssql/default.nix        |  1 +
 .../python-modules/pyside/default.nix         |  1 +
 .../python-modules/pyside/shiboken.nix        |  1 +
 .../python-modules/pyside/tools.nix           |  1 +
 .../python-modules/pyside2-tools/default.nix  |  1 +
 .../python-modules/pyside2/default.nix        |  1 +
 .../python-modules/pysnooper/default.nix      |  1 +
 .../python-modules/pysonos/default.nix        |  1 +
 .../python-modules/pyspinel/default.nix       |  1 +
 .../python-modules/pysptk/default.nix         |  1 +
 .../python-modules/pystemd/default.nix        |  1 +
 .../python-modules/pytest-cram/default.nix    |  1 +
 .../python-modules/python-docx/default.nix    |  1 +
 .../python-jsonrpc-server/default.nix         |  1 +
 .../python-modules/python-toolbox/default.nix |  1 +
 .../python-modules/pywbem/default.nix         |  1 +
 .../python-modules/pyx/default.nix            |  1 +
 .../python-modules/rethinkdb/default.nix      |  1 +
 .../python-modules/ripser/default.nix         |  1 +
 .../robotframework-tools/default.nix          |  1 +
 .../python-modules/rpy2/default.nix           |  1 +
 .../python-modules/ruffus/default.nix         |  1 +
 .../python-modules/salmon-mail/default.nix    |  1 +
 .../python-modules/scikit-tda/default.nix     |  1 +
 .../python-modules/scrapy/default.nix         |  1 +
 .../python-modules/secp256k1/default.nix      |  1 +
 .../python-modules/shouldbe/default.nix       |  1 +
 .../slither-analyzer/default.nix              |  1 +
 .../snowflake-connector-python/default.nix    |  1 +
 .../snowflake-sqlalchemy/default.nix          |  1 +
 .../python-modules/soco/default.nix           |  1 +
 .../python-modules/sphinx-jinja/default.nix   |  1 +
 .../python-modules/spyder/default.nix         |  1 +
 .../python-modules/stem/default.nix           |  1 +
 .../python-modules/streamz/default.nix        |  1 +
 .../python-modules/svgwrite/default.nix       |  1 +
 .../python-modules/toggl-cli/default.nix      |  1 +
 .../python-modules/trackpy/default.nix        |  1 +
 .../python-modules/wordfreq/default.nix       |  1 +
 .../python-modules/yappi/default.nix          |  1 +
 .../python-modules/zconfig/default.nix        |  1 +
 .../python-modules/zdaemon/default.nix        |  1 +
 .../python-modules/zodb/default.nix           |  1 +
 .../zope_filerepresentation/default.nix       |  1 +
 .../zope_lifecycleevent/default.nix           |  1 +
 .../tools/analysis/retdec/default.nix         |  1 +
 .../tools/setupcfg2nix/default.nix            |  1 +
 pkgs/games/racer/default.nix                  |  1 +
 pkgs/games/trigger/default.nix                |  1 +
 pkgs/misc/rkdeveloptool/default.nix           |  1 +
 .../linux/roccat-tools/default.nix            |  1 +
 pkgs/servers/rippled/validator-keys-tool.nix  |  1 +
 pkgs/tools/X11/xprintidle-ng/default.nix      |  1 +
 pkgs/tools/misc/grub/trusted.nix              |  1 +
 pkgs/tools/misc/trac/default.nix              |  1 +
 pkgs/tools/security/sequoia/default.nix       |  2 +-
 91 files changed, 117 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/safeeyes/default.nix b/pkgs/applications/misc/safeeyes/default.nix
index 125170d36c27..b8ca67b9426c 100644
--- a/pkgs/applications/misc/safeeyes/default.nix
+++ b/pkgs/applications/misc/safeeyes/default.nix
@@ -66,5 +66,6 @@ in buildPythonApplication rec {
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ srghma ];
     platforms = lib.platforms.all;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 610409af7a7b..5b2ac5670b1a 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -54,5 +54,6 @@ mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/misc/topydo/default.nix b/pkgs/applications/misc/topydo/default.nix
index eb3894c7b47d..3264bf506974 100644
--- a/pkgs/applications/misc/topydo/default.nix
+++ b/pkgs/applications/misc/topydo/default.nix
@@ -30,5 +30,6 @@ buildPythonApplication rec {
     description = "A cli todo application compatible with the todo.txt format";
     homepage = "https://github.com/bram85/topydo";
     license = licenses.gpl3;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
index 13c7281aea7c..e6193287ee21 100644
--- a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
@@ -56,5 +56,6 @@ in
       platforms = platforms.linux;
       maintainers = [ maintainers.raskin ];
       license = licenses.gpl3Plus;
+      broken = true;
     };
   }
diff --git a/pkgs/applications/networking/p2p/stig/default.nix b/pkgs/applications/networking/p2p/stig/default.nix
index 80b8251f2a3f..47b15b712028 100644
--- a/pkgs/applications/networking/p2p/stig/default.nix
+++ b/pkgs/applications/networking/p2p/stig/default.nix
@@ -52,5 +52,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/rndusr/stig";
     license = licenses.gpl3;
     maintainers = with maintainers; [ doronbehar ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/super-productivity/default.nix b/pkgs/applications/networking/super-productivity/default.nix
index c5ff090a8076..f4019986ed4c 100644
--- a/pkgs/applications/networking/super-productivity/default.nix
+++ b/pkgs/applications/networking/super-productivity/default.nix
@@ -102,5 +102,6 @@ in stdenv.mkDerivation {
     license = licenses.mit;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ offline ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/office/paperwork/default.nix b/pkgs/applications/office/paperwork/default.nix
index 3506ea8b5515..2dde374e1541 100644
--- a/pkgs/applications/office/paperwork/default.nix
+++ b/pkgs/applications/office/paperwork/default.nix
@@ -77,5 +77,6 @@ python3Packages.buildPythonApplication rec {
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.aszlig ];
     platforms = lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/science/misc/sasview/default.nix b/pkgs/applications/science/misc/sasview/default.nix
index ed6fa3ae886b..c197c34b5b96 100644
--- a/pkgs/applications/science/misc/sasview/default.nix
+++ b/pkgs/applications/science/misc/sasview/default.nix
@@ -71,5 +71,6 @@ python.pkgs.buildPythonApplication rec {
     description = "Fitting and data analysis for small angle scattering data";
     maintainers = with maintainers; [ rprospero ];
     license = licenses.bsd3;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/science/robotics/qgroundcontrol/default.nix b/pkgs/applications/science/robotics/qgroundcontrol/default.nix
index cbf7f4db8c41..611f576dd855 100644
--- a/pkgs/applications/science/robotics/qgroundcontrol/default.nix
+++ b/pkgs/applications/science/robotics/qgroundcontrol/default.nix
@@ -69,5 +69,6 @@ mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ pxc ];
+    broken = true;
   };
 }
diff --git a/pkgs/desktops/surf-display/default.nix b/pkgs/desktops/surf-display/default.nix
index dd0644866478..e2c4f0920c5b 100644
--- a/pkgs/desktops/surf-display/default.nix
+++ b/pkgs/desktops/surf-display/default.nix
@@ -53,5 +53,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ etu ];
     license = licenses.gpl2;
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index d8996fcf692b..0d2785b07e50 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -906,7 +906,8 @@ self: super: {
   cryptohash-md5 = doJailbreak super.cryptohash-md5;
   text-short = doJailbreak super.text-short;
   gitHUD = dontCheck super.gitHUD;
-  githud = dontCheck super.githud;
+  # broken 20.03
+  githud = markBroken super.githud;
 
   # https://github.com/aisamanra/config-ini/issues/12
   config-ini = dontCheck super.config-ini;
@@ -1420,4 +1421,28 @@ self: super: {
     amqp = dontCheck super.amqp_0_19_1;
   };
 
+  # 20.03 broken packages
+
+  envy-extensible = markBroken super.envy-extensible;
+  exceptionfree-readfile = markBroken super.exceptionfree-readfile;
+  fcf-containers = markBroken super.fcf-containers;
+  first-class-instances = markBroken super.first-class-instances;
+  flp = markBroken super.flp;
+  hal = markBroken super.hal;
+  hcad = markBroken super.hcad;
+  hedis-envy = markBroken super.hedis-envy;
+  hhwloc = markBroken super.hhwloc;
+  layered-state = markBroken super.layered-state;
+  network-uri-static = markBroken super.network-uri-static;
+  pandoc-plot = markBroken super.pandoc-plot;
+  patch = markBroken super.patch;
+  prologue = markBroken super.prologue;
+  provenience = markBroken super.provenience;
+  refractor = markBroken super.refractor;
+  shwifty = markBroken super.shwifty;
+  smallcheck-kind-generics = markBroken super.smallcheck-kind-generics;
+  traversal-template = markBroken super.traversal-template;
+  vector-text = markBroken super.vector-text;
+  zbar = markBroken super.zbar;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
diff --git a/pkgs/development/libraries/nsss/default.nix b/pkgs/development/libraries/nsss/default.nix
index 5c8bf8dedc1e..a4b485b2e880 100644
--- a/pkgs/development/libraries/nsss/default.nix
+++ b/pkgs/development/libraries/nsss/default.nix
@@ -30,4 +30,6 @@ buildPackage {
     mv examples $doc/share/doc/nsss/examples
   '';
 
+  meta.broken = true;
+
 }
diff --git a/pkgs/development/libraries/soil/default.nix b/pkgs/development/libraries/soil/default.nix
index d9fcea767d5e..1217c593eb10 100644
--- a/pkgs/development/libraries/soil/default.nix
+++ b/pkgs/development/libraries/soil/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation {
     homepage  = https://www.lonesock.net/soil.html;
     license   = stdenv.lib.licenses.publicDomain;
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index c8c60c1f8ea6..08906ab3dc00 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl2Plus;
     platforms   = platforms.linux;
     maintainers = [ maintainers.twey ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/utmps/default.nix b/pkgs/development/libraries/utmps/default.nix
index 073674f8571f..e825721450fc 100644
--- a/pkgs/development/libraries/utmps/default.nix
+++ b/pkgs/development/libraries/utmps/default.nix
@@ -28,5 +28,6 @@ buildPackage {
     mv doc $doc/share/doc/utmps/html
     mv examples $doc/share/doc/utmps/examples
   '';
+  meta.broken = true;
 }
 
diff --git a/pkgs/development/misc/qmk_firmware/default.nix b/pkgs/development/misc/qmk_firmware/default.nix
index 38b1df3ca3b5..45fae5bd3051 100644
--- a/pkgs/development/misc/qmk_firmware/default.nix
+++ b/pkgs/development/misc/qmk_firmware/default.nix
@@ -36,4 +36,5 @@ in stdenv.mkDerivation {
     dfu-programmer
     dfu-util
   ];
+  meta.broken = true;
 }
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index 487ffc35b1a8..322b3e4c775e 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -66,5 +66,6 @@ buildPythonPackage rec {
     homepage = https://github.com/ContinuumIO/intake;
     license = licenses.bsd2;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/jug/default.nix b/pkgs/development/python-modules/jug/default.nix
index ad26b62931d8..e962cc0bf864 100644
--- a/pkgs/development/python-modules/jug/default.nix
+++ b/pkgs/development/python-modules/jug/default.nix
@@ -26,5 +26,6 @@ buildPythonPackage rec {
     license = licenses.mit;
     homepage = https://jug.readthedocs.io/;
     maintainers = with maintainers; [ luispedro ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/junit-xml/default.nix b/pkgs/development/python-modules/junit-xml/default.nix
index dcd26fabee7b..0a095b69aa05 100644
--- a/pkgs/development/python-modules/junit-xml/default.nix
+++ b/pkgs/development/python-modules/junit-xml/default.nix
@@ -28,5 +28,6 @@ buildPythonPackage rec {
     homepage = https://github.com/kyrus/python-junit-xml;
     maintainers = with maintainers; [ multun ];
     license = licenses.mit;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/junos-eznc/default.nix b/pkgs/development/python-modules/junos-eznc/default.nix
index 77b56e01b0c7..1da34a064915 100644
--- a/pkgs/development/python-modules/junos-eznc/default.nix
+++ b/pkgs/development/python-modules/junos-eznc/default.nix
@@ -38,5 +38,6 @@ buildPythonPackage rec {
     description = "Junos 'EZ' automation for non-programmers";
     license = licenses.asl20;
     maintainers = with maintainers; [ xnaveira ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/locustio/default.nix b/pkgs/development/python-modules/locustio/default.nix
index 2203fa4c6ad0..79e761a874a3 100644
--- a/pkgs/development/python-modules/locustio/default.nix
+++ b/pkgs/development/python-modules/locustio/default.nix
@@ -26,5 +26,6 @@ buildPythonPackage rec {
   meta = {
     homepage = https://locust.io/;
     description = "A load testing tool";
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/ludios_wpull/default.nix b/pkgs/development/python-modules/ludios_wpull/default.nix
index f0b3aa60f179..8ec06aa98d9b 100644
--- a/pkgs/development/python-modules/ludios_wpull/default.nix
+++ b/pkgs/development/python-modules/ludios_wpull/default.nix
@@ -35,5 +35,6 @@ buildPythonPackage rec {
     homepage = https://github.com/ludios/wpull;
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ ivan ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/macropy/default.nix b/pkgs/development/python-modules/macropy/default.nix
index 952740d78376..687e757ff93f 100644
--- a/pkgs/development/python-modules/macropy/default.nix
+++ b/pkgs/development/python-modules/macropy/default.nix
@@ -34,5 +34,6 @@ buildPythonPackage rec {
     description = "Macros in Python: quasiquotes, case classes, LINQ and more";
     license = licenses.mit;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/marionette-harness/mozfile.nix b/pkgs/development/python-modules/marionette-harness/mozfile.nix
index 9ca8ea0b7891..8adb9f7f797f 100644
--- a/pkgs/development/python-modules/marionette-harness/mozfile.nix
+++ b/pkgs/development/python-modules/marionette-harness/mozfile.nix
@@ -24,5 +24,6 @@ buildPythonPackage rec {
     homepage = https://wiki.mozilla.org/Auto-tools/Projects/Mozbase;
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ raskin ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/markdownsuperscript/default.nix b/pkgs/development/python-modules/markdownsuperscript/default.nix
index 1212651aec81..759cab56dd9f 100644
--- a/pkgs/development/python-modules/markdownsuperscript/default.nix
+++ b/pkgs/development/python-modules/markdownsuperscript/default.nix
@@ -26,5 +26,6 @@ buildPythonPackage rec {
     description = "An extension to the Python Markdown package enabling superscript text";
     homepage = https://github.com/jambonrose/markdown_superscript_extension;
     license = stdenv.lib.licenses.bsd2;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/mecab-python3/default.nix b/pkgs/development/python-modules/mecab-python3/default.nix
index 263a71254ed6..ebc6fe3b2ade 100644
--- a/pkgs/development/python-modules/mecab-python3/default.nix
+++ b/pkgs/development/python-modules/mecab-python3/default.nix
@@ -30,5 +30,6 @@ buildPythonPackage rec {
     homepage =  https://github.com/SamuraiT/mecab-python3;
     license = with licenses; [ gpl2 lgpl21 bsd3 ]; # any of the three
     maintainers = with maintainers; [ ixxie ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/mock-open/default.nix b/pkgs/development/python-modules/mock-open/default.nix
index edb3407270f2..482ecb0dcbb8 100644
--- a/pkgs/development/python-modules/mock-open/default.nix
+++ b/pkgs/development/python-modules/mock-open/default.nix
@@ -18,5 +18,6 @@ buildPythonPackage rec {
     homepage = https://github.com/nivbend/mock-open;
     description = "A better mock for file I/O";
     license = licenses.mit;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/namedlist/default.nix b/pkgs/development/python-modules/namedlist/default.nix
index ae07076bb057..0a96a9e5c8d9 100644
--- a/pkgs/development/python-modules/namedlist/default.nix
+++ b/pkgs/development/python-modules/namedlist/default.nix
@@ -29,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://bitbucket.org/ericvsmith/namedlist;
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ivan ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index ab81b2b190b5..bc5b0ecdcf38 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -109,5 +109,6 @@ buildPythonPackage rec {
     description = "Neuroimaging in Python: Pipelines and Interfaces";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ashgillman ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/nixpkgs/default.nix b/pkgs/development/python-modules/nixpkgs/default.nix
index 66e8bb2a735a..c413623c2a6d 100644
--- a/pkgs/development/python-modules/nixpkgs/default.nix
+++ b/pkgs/development/python-modules/nixpkgs/default.nix
@@ -17,6 +17,7 @@ buildPythonPackage rec {
   };
 
   buildInputs = [ pbr ];
+  nativeBuidInputs = [ pythonix ];
   propagatedBuildInputs = [ pythonix ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/pelican/default.nix b/pkgs/development/python-modules/pelican/default.nix
index 7066ecd3a527..86fd4ef0ea6c 100644
--- a/pkgs/development/python-modules/pelican/default.nix
+++ b/pkgs/development/python-modules/pelican/default.nix
@@ -75,5 +75,6 @@ buildPythonPackage rec {
     homepage = http://getpelican.com/;
     license = licenses.agpl3;
     maintainers = with maintainers; [ offline prikhi ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/persim/default.nix b/pkgs/development/python-modules/persim/default.nix
index 471552cdcc91..336bb4b8b8c7 100644
--- a/pkgs/development/python-modules/persim/default.nix
+++ b/pkgs/development/python-modules/persim/default.nix
@@ -46,5 +46,6 @@ buildPythonPackage rec {
     homepage = https://persim.scikit-tda.org;
     license = licenses.mit;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pg8000/default.nix b/pkgs/development/python-modules/pg8000/default.nix
index 33790b97c4ed..50b0d10211f0 100644
--- a/pkgs/development/python-modules/pg8000/default.nix
+++ b/pkgs/development/python-modules/pg8000/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
     description = "PostgreSQL interface library, for asyncio";
     maintainers = with maintainers; [ domenkozar ];
     platforms = platforms.unix;
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/piep/default.nix b/pkgs/development/python-modules/piep/default.nix
index 0ef44f981757..48f393c562ad 100644
--- a/pkgs/development/python-modules/piep/default.nix
+++ b/pkgs/development/python-modules/piep/default.nix
@@ -22,6 +22,7 @@ buildPythonPackage rec {
     homepage = https://github.com/timbertson/piep;
     maintainers = with maintainers; [ timbertson ];
     license = licenses.gpl3;
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/pymc3/default.nix b/pkgs/development/python-modules/pymc3/default.nix
index 39472bb31776..e8527bc69f53 100644
--- a/pkgs/development/python-modules/pymc3/default.nix
+++ b/pkgs/development/python-modules/pymc3/default.nix
@@ -59,5 +59,6 @@ buildPythonPackage rec {
     homepage = https://github.com/pymc-devs/pymc3;
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ilya-kolpakov ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pymssql/default.nix b/pkgs/development/python-modules/pymssql/default.nix
index 954be3f40e2d..ffc2d19026d5 100644
--- a/pkgs/development/python-modules/pymssql/default.nix
+++ b/pkgs/development/python-modules/pymssql/default.nix
@@ -22,5 +22,6 @@ buildPythonPackage rec {
       SQL Server";
     license = licenses.lgpl21;
     maintainers = with maintainers; [ mredaelli ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pyside/default.nix b/pkgs/development/python-modules/pyside/default.nix
index df309c5c68af..6189c8649d9a 100644
--- a/pkgs/development/python-modules/pyside/default.nix
+++ b/pkgs/development/python-modules/pyside/default.nix
@@ -23,5 +23,6 @@ buildPythonPackage rec {
     description = "LGPL-licensed Python bindings for the Qt cross-platform application and UI framework";
     license = lib.licenses.lgpl21;
     homepage = http://www.pyside.org;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pyside/shiboken.nix b/pkgs/development/python-modules/pyside/shiboken.nix
index a968935dc060..6fe56558d394 100644
--- a/pkgs/development/python-modules/pyside/shiboken.nix
+++ b/pkgs/development/python-modules/pyside/shiboken.nix
@@ -35,5 +35,6 @@ buildPythonPackage rec {
     homepage = http://www.pyside.org/docs/shiboken/;
     maintainers = [ ];
     platforms = lib.platforms.all;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pyside/tools.nix b/pkgs/development/python-modules/pyside/tools.nix
index 6c2b357c5668..d20ae77ddc82 100644
--- a/pkgs/development/python-modules/pyside/tools.nix
+++ b/pkgs/development/python-modules/pyside/tools.nix
@@ -24,5 +24,6 @@ buildPythonPackage rec {
     homepage = https://wiki.qt.io/PySide;
     maintainers = [ ];
     platforms = platforms.all;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pyside2-tools/default.nix b/pkgs/development/python-modules/pyside2-tools/default.nix
index a96ea5d32ff8..53e3c9f7c572 100644
--- a/pkgs/development/python-modules/pyside2-tools/default.nix
+++ b/pkgs/development/python-modules/pyside2-tools/default.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation {
     license = licenses.gpl2;
     homepage = "https://wiki.qt.io/Qt_for_Python";
     maintainers = with maintainers; [ gebner ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pyside2/default.nix b/pkgs/development/python-modules/pyside2/default.nix
index afa48569e2ac..ad1a7967ac0d 100644
--- a/pkgs/development/python-modules/pyside2/default.nix
+++ b/pkgs/development/python-modules/pyside2/default.nix
@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21;
     homepage = "https://wiki.qt.io/Qt_for_Python";
     maintainers = with maintainers; [ gebner ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pysnooper/default.nix b/pkgs/development/python-modules/pysnooper/default.nix
index bb41a4d18556..5f24c797dbe2 100644
--- a/pkgs/development/python-modules/pysnooper/default.nix
+++ b/pkgs/development/python-modules/pysnooper/default.nix
@@ -29,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://github.com/cool-RR/PySnooper;
     license = licenses.mit;
     maintainers = with maintainers; [ seqizz ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pysonos/default.nix b/pkgs/development/python-modules/pysonos/default.nix
index ddab28471a8c..0f73947f677f 100644
--- a/pkgs/development/python-modules/pysonos/default.nix
+++ b/pkgs/development/python-modules/pysonos/default.nix
@@ -38,5 +38,6 @@ buildPythonPackage rec {
     description = "A SoCo fork with fixes for Home Assistant";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ juaningan ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pyspinel/default.nix b/pkgs/development/python-modules/pyspinel/default.nix
index 990e2b28bd89..6d7a39df3099 100644
--- a/pkgs/development/python-modules/pyspinel/default.nix
+++ b/pkgs/development/python-modules/pyspinel/default.nix
@@ -17,5 +17,6 @@ buildPythonPackage rec {
     description = "Interface to the OpenThread Network Co-Processor (NCP)";
     homepage = "https://github.com/openthread/pyspinel";
     maintainers = with lib.maintainers; [ gebner ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pysptk/default.nix b/pkgs/development/python-modules/pysptk/default.nix
index 46864632964a..33e3082fec27 100644
--- a/pkgs/development/python-modules/pysptk/default.nix
+++ b/pkgs/development/python-modules/pysptk/default.nix
@@ -33,5 +33,6 @@ buildPythonPackage rec {
     homepage = https://pysptk.readthedocs.io/en/latest/;
     license = licenses.mit;
     maintainers = with maintainers; [ hyphon81 ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pystemd/default.nix b/pkgs/development/python-modules/pystemd/default.nix
index 47d6ea7e26b8..5255e1dbc5f8 100644
--- a/pkgs/development/python-modules/pystemd/default.nix
+++ b/pkgs/development/python-modules/pystemd/default.nix
@@ -20,5 +20,6 @@ python.pkgs.buildPythonPackage rec {
     homepage = https://github.com/facebookincubator/pystemd/;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ flokli ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pytest-cram/default.nix b/pkgs/development/python-modules/pytest-cram/default.nix
index ff2a29384bc0..330f35746d88 100644
--- a/pkgs/development/python-modules/pytest-cram/default.nix
+++ b/pkgs/development/python-modules/pytest-cram/default.nix
@@ -30,5 +30,6 @@ buildPythonPackage rec {
     homepage = https://github.com/tbekolay/pytest-cram;
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jluttine ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/python-docx/default.nix b/pkgs/development/python-modules/python-docx/default.nix
index f86cdc665a1d..ac783b493b68 100644
--- a/pkgs/development/python-modules/python-docx/default.nix
+++ b/pkgs/development/python-modules/python-docx/default.nix
@@ -29,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://python-docx.readthedocs.io/en/latest/;
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.alexchapman ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/python-jsonrpc-server/default.nix b/pkgs/development/python-modules/python-jsonrpc-server/default.nix
index 29c6950070a5..0b1bd73469d5 100644
--- a/pkgs/development/python-modules/python-jsonrpc-server/default.nix
+++ b/pkgs/development/python-modules/python-jsonrpc-server/default.nix
@@ -34,5 +34,6 @@ buildPythonPackage rec {
     description = "A Python 2 and 3 asynchronous JSON RPC server";
     license = licenses.mit;
     maintainers = [ maintainers.mic92 ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/python-toolbox/default.nix b/pkgs/development/python-modules/python-toolbox/default.nix
index 5170c5a8a090..02d858d43f90 100644
--- a/pkgs/development/python-modules/python-toolbox/default.nix
+++ b/pkgs/development/python-modules/python-toolbox/default.nix
@@ -28,5 +28,6 @@ buildPythonPackage rec {
     homepage = https://github.com/cool-RR/python_toolbox;
     license = licenses.mit;
     maintainers = with maintainers; [ seqizz ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pywbem/default.nix b/pkgs/development/python-modules/pywbem/default.nix
index c5ffb79a5d68..b507f5f2efb7 100644
--- a/pkgs/development/python-modules/pywbem/default.nix
+++ b/pkgs/development/python-modules/pywbem/default.nix
@@ -53,5 +53,6 @@ buildPythonPackage rec {
     homepage = https://pywbem.github.io;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ peterhoeg ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/pyx/default.nix b/pkgs/development/python-modules/pyx/default.nix
index 63e6e6321007..f98acf570612 100644
--- a/pkgs/development/python-modules/pyx/default.nix
+++ b/pkgs/development/python-modules/pyx/default.nix
@@ -22,6 +22,7 @@ buildPythonPackage rec {
     description = "Python package for the generation of PostScript, PDF, and SVG files";
     homepage = http://pyx.sourceforge.net/;
     license = with licenses; [ gpl2 ];
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/rethinkdb/default.nix b/pkgs/development/python-modules/rethinkdb/default.nix
index 7eea5d2c39fc..3f0cea3b4fa8 100644
--- a/pkgs/development/python-modules/rethinkdb/default.nix
+++ b/pkgs/development/python-modules/rethinkdb/default.nix
@@ -18,6 +18,7 @@ buildPythonPackage rec {
     description = "Python driver library for the RethinkDB database server";
     homepage = "https://pypi.python.org/pypi/rethinkdb";
     license = licenses.agpl3;
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/ripser/default.nix b/pkgs/development/python-modules/ripser/default.nix
index 258ad7cece10..55d141c39db9 100644
--- a/pkgs/development/python-modules/ripser/default.nix
+++ b/pkgs/development/python-modules/ripser/default.nix
@@ -44,5 +44,6 @@ buildPythonPackage rec {
     homepage = https://ripser.scikit-tda.org;
     license = licenses.mit;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/robotframework-tools/default.nix b/pkgs/development/python-modules/robotframework-tools/default.nix
index 97bc9de0bf75..cc45c2c38c37 100644
--- a/pkgs/development/python-modules/robotframework-tools/default.nix
+++ b/pkgs/development/python-modules/robotframework-tools/default.nix
@@ -46,5 +46,6 @@ buildPythonPackage rec {
     homepage = https://bitbucket.org/userzimmermann/robotframework-tools;
     license = licenses.gpl3;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/rpy2/default.nix b/pkgs/development/python-modules/rpy2/default.nix
index 851a58584c66..62d75bde007f 100644
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@@ -94,5 +94,6 @@ buildPythonPackage rec {
       license = lib.licenses.gpl2Plus;
       platforms = lib.platforms.unix;
       maintainers = with lib.maintainers; [ joelmo ];
+      broken = true;
     };
   }
diff --git a/pkgs/development/python-modules/ruffus/default.nix b/pkgs/development/python-modules/ruffus/default.nix
index 37222964b047..43fd74e3cd3e 100644
--- a/pkgs/development/python-modules/ruffus/default.nix
+++ b/pkgs/development/python-modules/ruffus/default.nix
@@ -48,6 +48,7 @@ buildPythonPackage rec {
     homepage = http://www.ruffus.org.uk;
     license = licenses.mit;
     maintainers = [ maintainers.kiwi ];
+    broken = true;
   };
 }
 
diff --git a/pkgs/development/python-modules/salmon-mail/default.nix b/pkgs/development/python-modules/salmon-mail/default.nix
index afd915ed8407..f7a4be382aff 100644
--- a/pkgs/development/python-modules/salmon-mail/default.nix
+++ b/pkgs/development/python-modules/salmon-mail/default.nix
@@ -24,5 +24,6 @@ buildPythonPackage rec {
     description = "Pythonic mail application server";
     license = licenses.gpl3;
     maintainers = with maintainers; [ jluttine ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/scikit-tda/default.nix b/pkgs/development/python-modules/scikit-tda/default.nix
index 0c33f7a0dabd..064a366e0834 100644
--- a/pkgs/development/python-modules/scikit-tda/default.nix
+++ b/pkgs/development/python-modules/scikit-tda/default.nix
@@ -60,5 +60,6 @@ buildPythonPackage rec {
     homepage = https://github.com/scikit-tda/scikit-tda;
     license = licenses.mit;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 8fee4b6631ab..79ab5d0714d6 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -46,5 +46,6 @@ buildPythonPackage rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ drewkett marsam ];
     platforms = platforms.unix;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/secp256k1/default.nix b/pkgs/development/python-modules/secp256k1/default.nix
index 6b9f00783fd2..b47e973625db 100644
--- a/pkgs/development/python-modules/secp256k1/default.nix
+++ b/pkgs/development/python-modules/secp256k1/default.nix
@@ -44,5 +44,6 @@ buildPythonPackage rec {
     description = "Python FFI bindings for secp256k1";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ chris-martin ];
+    broken = true;
   };
 }
\ No newline at end of file
diff --git a/pkgs/development/python-modules/shouldbe/default.nix b/pkgs/development/python-modules/shouldbe/default.nix
index ccff9ff4b9f8..c16a4a5c691b 100644
--- a/pkgs/development/python-modules/shouldbe/default.nix
+++ b/pkgs/development/python-modules/shouldbe/default.nix
@@ -21,6 +21,7 @@ buildPythonPackage rec {
     description = "Python Assertion Helpers inspired by Shouldly";
     homepage =  https://pypi.python.org/pypi/shouldbe/;
     license = licenses.mit;
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/slither-analyzer/default.nix b/pkgs/development/python-modules/slither-analyzer/default.nix
index 0f12dbb8850c..f53dc00901fa 100644
--- a/pkgs/development/python-modules/slither-analyzer/default.nix
+++ b/pkgs/development/python-modules/slither-analyzer/default.nix
@@ -36,5 +36,6 @@ buildPythonPackage rec {
     homepage = https://github.com/trailofbits/slither;
     license = licenses.agpl3;
     maintainers = [ maintainers.asymmetric ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/snowflake-connector-python/default.nix b/pkgs/development/python-modules/snowflake-connector-python/default.nix
index eb8be17797f3..9af4bd0e553d 100644
--- a/pkgs/development/python-modules/snowflake-connector-python/default.nix
+++ b/pkgs/development/python-modules/snowflake-connector-python/default.nix
@@ -61,5 +61,6 @@ buildPythonPackage rec {
     description = "Snowflake Connector for Python";
     homepage = "https://www.snowflake.com/";
     license = licenses.asl20;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
index d8c557eddc73..8a0c39a3246d 100644
--- a/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/snowflake-sqlalchemy/default.nix
@@ -23,5 +23,6 @@ buildPythonPackage rec {
     description = "Snowflake SQLAlchemy Dialect";
     homepage = "https://www.snowflake.net/";
     license = licenses.asl20;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index 4a44b7d0b7aa..26257ffd4786 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -30,5 +30,6 @@ buildPythonPackage rec {
     homepage = http://python-soco.com/;
     description = "A CLI and library to control Sonos speakers";
     license = lib.licenses.mit;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/sphinx-jinja/default.nix b/pkgs/development/python-modules/sphinx-jinja/default.nix
index 375f59ec3f91..94b4102f42ef 100644
--- a/pkgs/development/python-modules/sphinx-jinja/default.nix
+++ b/pkgs/development/python-modules/sphinx-jinja/default.nix
@@ -23,5 +23,6 @@ buildPythonPackage rec {
     description = "Sphinx extension to include jinja templates in documentation";
     maintainers = with maintainers; [ nand0p ];
     license = licenses.mit;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index 47094fcb9933..e079bceb398f 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -66,5 +66,6 @@ buildPythonPackage rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ gebner ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/stem/default.nix b/pkgs/development/python-modules/stem/default.nix
index 69931a46007f..fbecbf58875e 100644
--- a/pkgs/development/python-modules/stem/default.nix
+++ b/pkgs/development/python-modules/stem/default.nix
@@ -26,5 +26,6 @@ buildPythonPackage rec {
     homepage = https://stem.torproject.org/;
     license = licenses.gpl3;
     maintainers = with maintainers; [ phreedom ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/streamz/default.nix b/pkgs/development/python-modules/streamz/default.nix
index 9bbc312b183b..4ce028c9d1c4 100644
--- a/pkgs/development/python-modules/streamz/default.nix
+++ b/pkgs/development/python-modules/streamz/default.nix
@@ -62,5 +62,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/python-streamz/streamz";
     license = licenses.bsd3;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/svgwrite/default.nix b/pkgs/development/python-modules/svgwrite/default.nix
index 186bf0a1ce2b..b0424100e6a5 100644
--- a/pkgs/development/python-modules/svgwrite/default.nix
+++ b/pkgs/development/python-modules/svgwrite/default.nix
@@ -33,6 +33,7 @@ buildPythonPackage rec {
     description = "A Python library to create SVG drawings";
     homepage = https://github.com/mozman/svgwrite;
     license = licenses.mit;
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/toggl-cli/default.nix b/pkgs/development/python-modules/toggl-cli/default.nix
index 6834876d8f81..dc412dedd6c1 100644
--- a/pkgs/development/python-modules/toggl-cli/default.nix
+++ b/pkgs/development/python-modules/toggl-cli/default.nix
@@ -55,6 +55,7 @@ buildPythonPackage rec {
     description = "Command line tool and set of Python wrapper classes for interacting with toggl's API";
     license = licenses.mit;
     maintainers = [ maintainers.mmahut ];
+    broken = true;
   };
 }
 
diff --git a/pkgs/development/python-modules/trackpy/default.nix b/pkgs/development/python-modules/trackpy/default.nix
index 32c8c64c68c7..08e07143243e 100644
--- a/pkgs/development/python-modules/trackpy/default.nix
+++ b/pkgs/development/python-modules/trackpy/default.nix
@@ -54,5 +54,6 @@ buildPythonPackage rec {
     homepage = https://github.com/soft-matter/trackpy;
     license = licenses.bsd3;
     maintainers = [ maintainers.costrouc ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/wordfreq/default.nix b/pkgs/development/python-modules/wordfreq/default.nix
index 97530989a382..15ba67a448b2 100644
--- a/pkgs/development/python-modules/wordfreq/default.nix
+++ b/pkgs/development/python-modules/wordfreq/default.nix
@@ -45,5 +45,6 @@ buildPythonPackage {
     homepage =  https://github.com/LuminosoInsight/wordfreq/;
     license = licenses.mit;
     maintainers = with maintainers; [ ixxie ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/yappi/default.nix b/pkgs/development/python-modules/yappi/default.nix
index f7a18bba903c..ad59deab9a97 100644
--- a/pkgs/development/python-modules/yappi/default.nix
+++ b/pkgs/development/python-modules/yappi/default.nix
@@ -18,5 +18,6 @@ buildPythonPackage rec {
     description = "Python profiler that supports multithreading and measuring CPU time";
     license = licenses.mit;
     maintainers = with maintainers; [ orivej ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/zconfig/default.nix b/pkgs/development/python-modules/zconfig/default.nix
index f68164284dad..abd5e060c217 100644
--- a/pkgs/development/python-modules/zconfig/default.nix
+++ b/pkgs/development/python-modules/zconfig/default.nix
@@ -25,5 +25,6 @@ buildPythonPackage rec {
     homepage = https://pypi.python.org/pypi/ZConfig;
     license = licenses.zpl20;
     maintainers = [ maintainers.goibhniu ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/zdaemon/default.nix b/pkgs/development/python-modules/zdaemon/default.nix
index c15e46e5d0d8..4e6436f1b76a 100644
--- a/pkgs/development/python-modules/zdaemon/default.nix
+++ b/pkgs/development/python-modules/zdaemon/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage rec {
     homepage = https://pypi.python.org/pypi/zdaemon;
     license = licenses.zpl20;
     maintainers = with maintainers; [ goibhniu ];
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/zodb/default.nix b/pkgs/development/python-modules/zodb/default.nix
index f15cefaa4757..aedd13d35427 100644
--- a/pkgs/development/python-modules/zodb/default.nix
+++ b/pkgs/development/python-modules/zodb/default.nix
@@ -62,5 +62,6 @@ buildPythonPackage rec {
       homepage = https://pypi.python.org/pypi/ZODB;
       license = licenses.zpl21;
       maintainers = with maintainers; [ goibhniu ];
+      broken = true;
     };
 }
diff --git a/pkgs/development/python-modules/zope_filerepresentation/default.nix b/pkgs/development/python-modules/zope_filerepresentation/default.nix
index e9104a1b9392..02a9d076ab08 100644
--- a/pkgs/development/python-modules/zope_filerepresentation/default.nix
+++ b/pkgs/development/python-modules/zope_filerepresentation/default.nix
@@ -20,6 +20,7 @@ buildPythonPackage rec {
     description = "File-system Representation Interfaces";
     license = licenses.zpl20;
     maintainers = with maintainers; [ goibhniu ];
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/python-modules/zope_lifecycleevent/default.nix b/pkgs/development/python-modules/zope_lifecycleevent/default.nix
index 738b30c489f5..450dde2c5d9e 100644
--- a/pkgs/development/python-modules/zope_lifecycleevent/default.nix
+++ b/pkgs/development/python-modules/zope_lifecycleevent/default.nix
@@ -21,6 +21,7 @@ buildPythonPackage rec {
     description = "Object life-cycle events";
     license = licenses.zpl20;
     maintainers = with maintainers; [ goibhniu ];
+    broken = true;
   };
 
 }
diff --git a/pkgs/development/tools/analysis/retdec/default.nix b/pkgs/development/tools/analysis/retdec/default.nix
index 848dfca5ce6d..ece70ce2d6fc 100644
--- a/pkgs/development/tools/analysis/retdec/default.nix
+++ b/pkgs/development/tools/analysis/retdec/default.nix
@@ -232,5 +232,6 @@ in stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ dtzWill timokau ];
     platforms = ["x86_64-linux" "i686-linux"];
+    broken = withPEPatterns;
   };
 }
diff --git a/pkgs/development/tools/setupcfg2nix/default.nix b/pkgs/development/tools/setupcfg2nix/default.nix
index 5d1f015e8052..e52050cdd12e 100644
--- a/pkgs/development/tools/setupcfg2nix/default.nix
+++ b/pkgs/development/tools/setupcfg2nix/default.nix
@@ -15,5 +15,6 @@ buildSetupcfg rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.shlevy ];
+    broken = true;
   };
 }
diff --git a/pkgs/games/racer/default.nix b/pkgs/games/racer/default.nix
index 1347f88cc2cb..94c8b8bac242 100644
--- a/pkgs/games/racer/default.nix
+++ b/pkgs/games/racer/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation {
     homepage = http://hippo.nipax.cz/download.en.php;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/games/trigger/default.nix b/pkgs/games/trigger/default.nix
index 34ae0762beaa..e986db61282d 100644
--- a/pkgs/games/trigger/default.nix
+++ b/pkgs/games/trigger/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
     maintainers = with stdenv.lib.maintainers; [viric];
     platforms = with stdenv.lib.platforms; linux;
+    broken = true;
   };
 }
diff --git a/pkgs/misc/rkdeveloptool/default.nix b/pkgs/misc/rkdeveloptool/default.nix
index e877629bcb03..38669f09e3d5 100644
--- a/pkgs/misc/rkdeveloptool/default.nix
+++ b/pkgs/misc/rkdeveloptool/default.nix
@@ -20,5 +20,6 @@ stdenv.mkDerivation {
     description = "A tool from Rockchip to communicate with Rockusb devices";
     license = licenses.gpl2;
     maintainers = [ maintainers.lopsided98 ];
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/linux/roccat-tools/default.nix b/pkgs/os-specific/linux/roccat-tools/default.nix
index 1f5b31d0deb6..c09b299a2c2a 100644
--- a/pkgs/os-specific/linux/roccat-tools/default.nix
+++ b/pkgs/os-specific/linux/roccat-tools/default.nix
@@ -37,5 +37,6 @@ stdenv.mkDerivation rec {
     homepage = http://roccat.sourceforge.net/;
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.gpl2Plus;
+    broken = true;
   };
 }
diff --git a/pkgs/servers/rippled/validator-keys-tool.nix b/pkgs/servers/rippled/validator-keys-tool.nix
index 684e070292c7..dcde5ea7654c 100644
--- a/pkgs/servers/rippled/validator-keys-tool.nix
+++ b/pkgs/servers/rippled/validator-keys-tool.nix
@@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ offline ];
     license = licenses.isc;
     platforms = [ "x86_64-linux" ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/X11/xprintidle-ng/default.nix b/pkgs/tools/X11/xprintidle-ng/default.nix
index 117a612381f6..89007426e8ee 100644
--- a/pkgs/tools/X11/xprintidle-ng/default.nix
+++ b/pkgs/tools/X11/xprintidle-ng/default.nix
@@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 1033a489c767..9a17c81b98c2 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -96,5 +96,6 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/Sirrix-AG/TrustedGRUB2;
     license = licenses.gpl3Plus;
     platforms = platforms.gnu ++ platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/misc/trac/default.nix b/pkgs/tools/misc/trac/default.nix
index f41087ca3fdc..866cbf852a40 100644
--- a/pkgs/tools/misc/trac/default.nix
+++ b/pkgs/tools/misc/trac/default.nix
@@ -52,5 +52,6 @@ buildPythonApplication rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ mmahut ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 75fc66647e8e..2f37058ec659 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -87,6 +87,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ minijackson doronbehar ];
     platforms = platforms.all;
-    broken = stdenv.targetPlatform.isDarwin;
+    broken = true;
   };
 }

From c51c677140897f41f4b920ce1141843cdb864ac2 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Wed, 15 Apr 2020 23:10:31 +0200
Subject: [PATCH 03/59] Revert "nixos/acme: Fix allowKeysForGroup not applying
 immediately"

This reverts commit 5532065d0690645f0a813fed6e68163b0f4774d4.

As far as I can tell setting RemainAfterExit=true here completely breaks
certificate renewal, which is really bad!

the sytemd timer will activate the service unit every OnCalendar=,
however with RemainAfterExit=true the service is already active! So the
timer doesn't rerun the service!

The commit also broke the actual tests, (As it broke activation too)
but this was fixed later in https://github.com/NixOS/nixpkgs/pull/76052
I wrongly assumed that PR fixed renewal too, which it didn't!

testing renewals is hard, as we need to sleep in tests.
---
 nixos/modules/security/acme.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 782a4f96782b..859e7944166e 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -297,12 +297,6 @@ in
                   wantedBy = mkIf (!config.boot.isContainer) [ "multi-user.target" ];
                   serviceConfig = {
                     Type = "oneshot";
-                    # With RemainAfterExit the service is considered active even
-                    # after the main process having exited, which means when it
-                    # gets changed, the activation phase restarts it, meaning
-                    # the permissions of the StateDirectory get adjusted
-                    # according to the specified group
-                    RemainAfterExit = true;
                     User = data.user;
                     Group = data.group;
                     PrivateTmp = true;

From c7153272cb196169f1dc67383f8bdddb17d7eaf6 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 16 Apr 2020 11:37:36 +0200
Subject: [PATCH 04/59] nixos/doc: fix database-setup example for
 matrix-synapse

Closes #85327

(cherry picked from commit 74d6e86ec2513aeb7624dd7a9fc731b635cd9d82)
---
 nixos/modules/services/misc/matrix-synapse.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/matrix-synapse.xml b/nixos/modules/services/misc/matrix-synapse.xml
index 053a3b2a563f..2f2ac27eeb9d 100644
--- a/nixos/modules/services/misc/matrix-synapse.xml
+++ b/nixos/modules/services/misc/matrix-synapse.xml
@@ -33,6 +33,7 @@
    <link xlink:href="https://github.com/matrix-org/synapse#synapse-installation">
    installation instructions of Synapse </link>.
 <programlisting>
+{ pkgs, ... }:
 let
   fqdn =
     let
@@ -46,7 +47,7 @@ in {
   <link linkend="opt-networking.firewall.allowedTCPPorts">networking.firewall.allowedTCPPorts</link> = [ 80 443 ];
 
   <link linkend="opt-services.postgresql.enable">services.postgresql.enable</link> = true;
-  <link linkend="opt-services.postgresql.initialScript">services.postgresql.initialScript</link> = ''
+  <link linkend="opt-services.postgresql.initialScript">services.postgresql.initialScript</link> = pkgs.writeText "synapse-init.sql" ''
     CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
     CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
       TEMPLATE template0

From 900b58e4eed25e27c909ee6f614f585f4156618d Mon Sep 17 00:00:00 2001
From: Pascal Bach <pascal.bach@nextrem.ch>
Date: Mon, 30 Mar 2020 14:15:58 +0200
Subject: [PATCH 05/59] unifiStable: 5.12.35 -> 5.12.66

(cherry picked from commit 05cc2b1f514da3e5337595c5bbaee7d6681f9585)
---
 pkgs/servers/unifi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index f86ae9d7cec4..d077d5a9cb26 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -49,7 +49,7 @@ in {
   };
 
   unifiStable = generic {
-    version = "5.12.35";
-    sha256 = "0ln8x7yisanbx1afclhffa0f3fk0sgh7dpj548xyhn5mgpwbj4i2";
+    version = "5.12.66";
+    sha256 = "119jdwk2ys3vzg9wa4h25rwgl6sjly6v52k1g1ycrq0bspzxdhm2";
   };
 }

From efdee67fca96fbdf00306f23c785590139f80597 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Thu, 16 Apr 2020 14:28:11 +0200
Subject: [PATCH 06/59] signal-desktop: 1.33.0 -> 1.33.1

(cherry picked from commit 56f7c93a2fcd325506a6bfa7bf8e9faa2a2c7530)
---
 .../networking/instant-messengers/signal-desktop/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 454d9b2884f6..7295f6c48ad6 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.33.0"; # Please backport all updates to the stable channel.
+  version = "1.33.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0s403243cm8x3daj4p7cpp5z0hwmsnk21cq42zcfls2q5d30p6wz";
+    sha256 = "0p9ak0cmk9b77dzbw4y2xmxqg211y62n7ckggwf7bcg48wzj0jy7";
   };
 
   nativeBuildInputs = [

From d73ea8dbde8bfafe5143dd1c8ff11291a607e124 Mon Sep 17 00:00:00 2001
From: Louis Blin <45168934+lbpdt@users.noreply.github.com>
Date: Fri, 27 Mar 2020 17:58:07 +0000
Subject: [PATCH 07/59] node-problem-detector: init at 0.8.1

Package is missing, built from Golang sources on GitHub.

(cherry picked from commit 511cb624b79e859cbf7f463e3e55112ad0bdcf24)
---
 maintainers/maintainer-list.nix               |  6 +++
 .../cluster/node-problem-detector/default.nix | 50 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 3 files changed, 58 insertions(+)
 create mode 100644 pkgs/applications/networking/cluster/node-problem-detector/default.nix

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2f2e15431a83..a71a06350e49 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3997,6 +3997,12 @@
     githubId = 32152;
     name = "Luka Blaskovic";
   };
+  lbpdt = {
+    email = "nix@pdtpartners.com";
+    github = "lbpdt";
+    githubId = 45168934;
+    name = "Louis Blin";
+  };
   ldelelis = {
     email = "ldelelis@est.frba.utn.edu.ar";
     github = "ldelelis";
diff --git a/pkgs/applications/networking/cluster/node-problem-detector/default.nix b/pkgs/applications/networking/cluster/node-problem-detector/default.nix
new file mode 100644
index 000000000000..a7a98de6d39b
--- /dev/null
+++ b/pkgs/applications/networking/cluster/node-problem-detector/default.nix
@@ -0,0 +1,50 @@
+{ stdenv, buildGoModule, fetchFromGitHub, systemd }:
+
+buildGoModule rec {
+  pname = "node-problem-detector";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "02avknglmkr9k933a64hkw0rjfxvyh4sc3x70p41b8q2g6vzv2gs";
+  };
+
+  # Project upstream recommends building through vendoring
+  overrideModAttrs = (_: {
+    buildCommand = ''
+      echo "Skipping go.mod, using vendoring instead." && touch $out
+    '';
+  });
+
+  modSha256 = "0ip26j2h11n1kgkz36rl4akv694yz65hr72q4kv4b3lxcbi65b3p";
+
+  # Optionally, a log counter binary can be created to parse journald logs.
+  # The binary is dynamically linked against systemd libraries, making it a
+  # Linux-only feature. See 'ENABLE_JOURNALD' upstream:
+  # https://github.com/kubernetes/node-problem-detector/blob/master/Makefile
+  subPackages = [ "cmd/nodeproblemdetector" ] ++
+    stdenv.lib.optionals stdenv.isLinux [ "cmd/logcounter" ];
+
+  preBuild = ''
+    export CGO_ENABLED=${if stdenv.isLinux then "1" else "0"}
+  '';
+
+  buildInputs = stdenv.lib.optionals stdenv.isLinux [ systemd ];
+
+  buildFlags = "-mod vendor" +
+    stdenv.lib.optionalString stdenv.isLinux " -tags journald";
+
+  buildFlagsArray = [
+    "-ldflags="
+    "-X k8s.io/${pname}/pkg/version.version=v${version}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Various problem detectors running on the Kubernetes nodes";
+    homepage = "https://github.com/kubernetes/node-problem-detector";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lbpdt ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0eb3bf9786bc..624c5c5c49ef 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20476,6 +20476,8 @@ in
     geoip = geoipWithDatabase;
   };
 
+  node-problem-detector = callPackage ../applications/networking/cluster/node-problem-detector { };
+
   notion = callPackage ../applications/window-managers/notion { };
 
   open-policy-agent = callPackage ../development/tools/open-policy-agent { };

From dd3652df6bedb1caab71a531addde672a09406a0 Mon Sep 17 00:00:00 2001
From: James Ottaway <james.ottaway@stacktracehq.com>
Date: Wed, 15 Apr 2020 16:03:52 +1000
Subject: [PATCH 08/59] git: 2.25.0 -> 2.25.3

v2.25.3 addresses CVE-2020-5260.  /cc roundup #75974.

See https://lore.kernel.org/lkml/xmqqy2qy7xn8.fsf@gitster.c.googlers.com/
---
 .../version-management/git-and-tools/git/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index d448f7b9c16a..c935ba2b8ff1 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -21,7 +21,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.25.0";
+  version = "2.25.3";
   svn = subversionClient.override { perlBindings = perlSupport; };
 
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "1l58v42aazj0x9276gk8r9mwyl9pgp9w99aakz4xfhzv7wd2jq60";
+    sha256 = "0yvr97cl0dvj3fwblq1mb0cp97v8hrn9l98p8b1jx8815mbsnz9h";
   };
 
   outputs = [ "out" ];

From f2d4179af38cd74ac1f985fd34b34435d1dcb662 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 11 Apr 2020 16:24:55 +0100
Subject: [PATCH 09/59] nixos/stage-1: check secret paths before copying

Fixes #84976.

(cherry picked from commit 91c6809946438a935714e85e510399b494994c6b)
---
 nixos/modules/system/boot/stage-1.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 26117cffeda2..84520438e06e 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -137,6 +137,8 @@ let
       ''}
 
       # Copy secrets if needed.
+      #
+      # TODO: move out to a separate script; see #85000.
       ${optionalString (!config.boot.loader.supportsInitrdSecrets)
           (concatStringsSep "\n" (mapAttrsToList (dest: source:
              let source' = if source == null then dest else source; in
@@ -565,6 +567,25 @@ in
         message = "boot.resumeDevice has to be an absolute path."
           + " Old \"x:y\" style is no longer supported.";
       }
+      # TODO: remove when #85000 is fixed
+      { assertion = !config.boot.loader.supportsInitrdSecrets ->
+          all (source:
+            builtins.isPath source ||
+            (builtins.isString source && hasPrefix source builtins.storeDir))
+          (attrValues config.boot.initrd.secrets);
+        message = ''
+          boot.loader.initrd.secrets values must be unquoted paths when
+          using a bootloader that doesn't natively support initrd
+          secrets, e.g.:
+
+            boot.initrd.secrets = {
+              "/etc/secret" = /path/to/secret;
+            };
+
+          Note that this will result in all secrets being stored
+          world-readable in the Nix store!
+        '';
+      }
     ];
 
     system.build =

From 5eb6f1ed4481ec03ce0b61b21c71ed30dfcbcfdc Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Fri, 10 Apr 2020 15:41:39 -0400
Subject: [PATCH 10/59] build-bazel-package: fix linkopt flags

These values were incorrect. We need to use NIX_LDFLAGS, not
NIX_LD_FLAGS. Also need to prefix all flags with -Wl, for GCC to
accept it.

(cherry picked from commit 184cd9f6ff4294881c51fa5958e7d093e3aa0a1b)
---
 pkgs/build-support/build-bazel-package/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
index 058f42aa8d5a..24beb30ccc55 100644
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@@ -171,9 +171,9 @@ in stdenv.mkDerivation (fBuildAttrs // {
     done
     linkopts=()
     host_linkopts=()
-    for flag in $NIX_LD_FLAGS; do
-      linkopts+=( "--linkopt=$flag" )
-      host_linkopts+=( "--host_linkopt=$flag" )
+    for flag in $NIX_LDFLAGS; do
+      linkopts+=( "--linkopt=-Wl,$flag" )
+      host_linkopts+=( "--host_linkopt=-Wl,$flag" )
     done
 
     BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \

From 23f337162de5da46107c0326cd2c5d183f4727a6 Mon Sep 17 00:00:00 2001
From: taku0 <mxxouy6x3m_github@tatapa.org>
Date: Wed, 15 Apr 2020 03:12:54 +0900
Subject: [PATCH 11/59] [20.03] flashplayer: 32.0.0.330 -> 32.0.0.363

(cherry picked from commit ac374d41c816f7365a3945e657d2beba3962587d)

Backported 32.0.0.363 to release 20.03 for important bug fixes.

Also needed because old upstream release is no longer available.
---
 .../networking/browsers/chromium/plugins.nix           |  4 ++--
 .../browsers/mozilla-plugins/flashplayer/default.nix   | 10 +++++-----
 .../mozilla-plugins/flashplayer/standalone.nix         |  6 +++---
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index e600d134e9c0..1dd9baa628ab 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.330";
+    version = "32.0.0.363";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "08gpx0fq0r1sz5smfdgv4fkfwq1hdijv4dw432d6jdz8lq09y1nk";
+      sha256 = "0znk8an892mykgbz56hyv3gz65vc9mhb3vn96c6bsvicwl1fn460";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index 3d711f92d1c9..17319f803503 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.330";
+  version = "32.0.0.363";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1k7h1p6g1vf96v31j1n8638jdxacap0729n0dnmh6l0h5q518k1b"
+          "06711k4vbn6mqfd8gvx2snsxyalhw15hn5b64sja8726z5rxvzy7"
         else
-          "0gabgllx79s6rhv0zivfj6z79rcsdrzrdm94xdr19c11dsbqxd6b"
+          "0v584aqhy4xk08afi3ypkq4mqjq57y136z82i5ixyim88dqbaf4f"
       else
         if arch == "x86_64" then
-          "1pf3k1x8c2kbkc9pf9y5n4jilp3g41v8v0q5ng77sbnl92s35zsj"
+          "1g1ijxypm8a8mfc1x58gksmaakqpp7xmf277wiir8zqjn3vd6c64"
         else
-          "1xibm6ffm09c553g100cgb6grnk21dfq8m81yy0jskph157vg962";
+          "13nbxmqmbxqvdhdwdqimim2f9fz3y2vrsx6b3pck6352m4i4wzh8";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index b003a1b3f5c0..40d63919dc40 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.330";
+  version = "32.0.0.363";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0wrkg2in4c0bnbifm06m4rdggzs8zbaxwrh6z3mpbf4p3bl6xg84"
+        "03zhza8lvc1nvz3racwfsajfd6rnbw3g56dp5wvr1qmaps8xaaqg"
       else
-        "08qxa3zanlgmn8sn7crz242adx10jqymd4gzf1m0zlczw20ar09c";
+        "0bhp7jv2l2agfzr8m564k749a5g75dw1390phlwvf49n1h8ldap2";
   };
 
   nativeBuildInputs = [ unzip ];

From 81dccfd358f280592c6821ff93d8dda4ee204d57 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Thu, 16 Apr 2020 13:31:59 +0200
Subject: [PATCH 12/59] google-chrome-{beta,dev}: Fix one substituteInPlace
 pattern

(cherry picked from commit 16477d764f375ef7b81acbfd13189299ff67f233)
---
 pkgs/applications/networking/browsers/google-chrome/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index 53255ec51835..1d33ca7f2d7d 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -108,7 +108,7 @@ in stdenv.mkDerivation {
       --replace /opt/google/$appname/google-$appname $exe
     substituteInPlace $out/share/menu/google-$appname.menu \
       --replace /opt $out/share \
-      --replace $out/share/google/chrome/google-$appname $exe
+      --replace $out/share/google/$appname/google-$appname $exe
 
     for icon_file in $out/share/google/chrome*/product_logo_*[0-9].png; do
       num_and_suffix="''${icon_file##*logo_}"

From 1775cb570172007588b6d88ccaeb401bd29fa2ff Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Thu, 16 Apr 2020 10:48:23 +0200
Subject: [PATCH 13/59] chromium: 81.0.4044.92 -> 81.0.4044.113

https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html

This update includes 1 security fix.

CVEs: CVE-2020-6457
(cherry picked from commit ef2c3ab20e315aeb05a9811ae395f5a04be714c2)
Backport of #85360.
---
 .../browsers/chromium/upstream-info.nix        | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index c5f9d60122dc..50e3abb5ec3f 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0i0szd749ihb08rxnsmsbxq75b6x952wpk94jwc0ncv6gb83zkx2";
-    sha256bin64 = "1y70kmfz9nv507b0zdda7zfk2ac9qh9m2gq00aphdmzd0al7skj8";
-    version = "81.0.4044.92";
+    sha256 = "0hsxxw7fm1p8g53msqb644v8vr4cpvjmpln444c2268rm43yik17";
+    sha256bin64 = "1iwn0yyhk0jn47pn7rx9kadli47xyvz3xilfl4faifmasin2fq8v";
+    version = "81.0.4044.113";
   };
   dev = {
-    sha256 = "1rydvjmv62zj95sf0fgsyipqz2hphbxm60y8q0813wq9ym35d4yy";
-    sha256bin64 = "1m6740lw7xjjp1lplwp9ii4d3l7dfa9jrv5bysm4ar5pb9kywrai";
-    version = "83.0.4100.3";
+    sha256 = "1s16wl101yabq0l7w0q50lxkr2gn090pcaj6l5sj6g5xvi9lhgbf";
+    sha256bin64 = "1hn2hjni5k370jhc0nikmx5ypwzcqnmr02h185a5ry697643abdd";
+    version = "83.0.4103.14";
   };
   stable = {
-    sha256 = "0i0szd749ihb08rxnsmsbxq75b6x952wpk94jwc0ncv6gb83zkx2";
-    sha256bin64 = "1ig899cpahw1xfhdff5xj6w4k8jja5smxvrcbw6b0jcjmawdrf72";
-    version = "81.0.4044.92";
+    sha256 = "0hsxxw7fm1p8g53msqb644v8vr4cpvjmpln444c2268rm43yik17";
+    sha256bin64 = "0ap7flrw3h885454fa2r7psa4sh8567ql7v7x96q11gh9gjrdvp3";
+    version = "81.0.4044.113";
   };
 }

From 68ab8cf78bce71a1890f28ace487230e3364ae58 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 16 Apr 2020 01:01:08 +0200
Subject: [PATCH 14/59] hydra-unstable: 2020-04-07 -> 2020-04-16

(cherry picked from commit 6f6c08af30ceafe36580205e829321b763e04af3)
---
 pkgs/development/tools/misc/hydra/default.nix | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index 9e14e16dbaaf..12b70c8a5aee 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -19,20 +19,13 @@
   # so when having an older version, `pkgs.hydra-migration` should be deployed first.
 
   hydra-unstable = callPackage ./common.nix {
-    version = "2020-04-07";
+    version = "2020-04-16";
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "hydra";
-      rev = "4cabb37ebdeade1435ad8ebf1913cdd603b9c452";
-      sha256 = "1ccy639x6yyrqqqqli7vlqm6pcvcq5dx1w3ckba77rl8pd5h31f7";
+      rev = "87837f1d82904bf48e11b5641258b6be2f663c3b";
+      sha256 = "1vs3lyfyafsl7wbpmycv7c3n9n2rkrswp65msb6q1iskgpvr96d5";
     };
-    patches = [
-      # https://github.com/NixOS/hydra/pull/732
-      (fetchpatch {
-        url = "https://github.com/NixOS/hydra/commit/2f9d422172235297759f2b224fe0636cad07b6fb.patch";
-        sha256 = "0152nsqqc5d85qdygmwrsk88i9y6nk1b639fj2n042pjvr0kpz6k";
-      })
-    ];
     nix = nixFlakes;
   };
 }

From e7fea4336afbc8490e58af1742a8e06217331480 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 15 Apr 2020 22:14:20 +0200
Subject: [PATCH 15/59] hydra*: add `passthru.tests` to reference VM-tests

(cherry picked from commit ef80b6324b9c387256027159796f4f5adbfffe6a)
---
 pkgs/development/tools/misc/hydra/common.nix  |  3 ++-
 pkgs/development/tools/misc/hydra/default.nix | 11 ++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/misc/hydra/common.nix b/pkgs/development/tools/misc/hydra/common.nix
index d895495cb8c9..6076212fd333 100644
--- a/pkgs/development/tools/misc/hydra/common.nix
+++ b/pkgs/development/tools/misc/hydra/common.nix
@@ -5,6 +5,7 @@
 , docbook_xsl, openssh, gnused, coreutils, findutils, gzip, lzma, gnutar
 , rpm, dpkg, cdrkit, pixz, lib, boost, autoreconfHook, src ? null, version ? null
 , migration ? false, patches ? []
+, tests ? {}
 }:
 
 with stdenv;
@@ -123,7 +124,7 @@ in stdenv.mkDerivation rec {
 
   dontStrip = true;
 
-  passthru = { inherit perlDeps migration; };
+  passthru = { inherit perlDeps migration tests; };
 
   meta = with stdenv.lib; {
     description = "Nix-based continuous build system";
diff --git a/pkgs/development/tools/misc/hydra/default.nix b/pkgs/development/tools/misc/hydra/default.nix
index 12b70c8a5aee..f9a50dd0ea0e 100644
--- a/pkgs/development/tools/misc/hydra/default.nix
+++ b/pkgs/development/tools/misc/hydra/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, nixStable, callPackage, nixFlakes, fetchpatch }:
+{ fetchFromGitHub, nixStable, callPackage, nixFlakes, fetchpatch, nixosTests }:
 
 {
   # Package for phase-1 of the db migration for Hydra.
@@ -13,6 +13,11 @@
     };
     nix = nixStable;
     migration = true;
+
+    tests = {
+      db-migration = nixosTests.hydra-db-migration.mig;
+      basic = nixosTests.hydra.hydra-migration;
+    };
   };
 
   # Hydra from latest master branch. Contains breaking changes,
@@ -27,5 +32,9 @@
       sha256 = "1vs3lyfyafsl7wbpmycv7c3n9n2rkrswp65msb6q1iskgpvr96d5";
     };
     nix = nixFlakes;
+    tests = {
+      db-migration = nixosTests.hydra-db-migration.mig;
+      basic = nixosTests.hydra.hydra-unstable;
+    };
   };
 }

From 077bbd67d96be6cb458cf3049fb4efd3888c54e1 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 16 Apr 2020 02:03:53 +0200
Subject: [PATCH 16/59] nixos/tests: fix inclusion of hydra test

(cherry picked from commit 5e124e5abd53108b3f21f9f7a1ec56db002fee4f)
---
 nixos/tests/hydra/db-migration.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/hydra/db-migration.nix b/nixos/tests/hydra/db-migration.nix
index aa1c81c9e775..cf74acfd67aa 100644
--- a/nixos/tests/hydra/db-migration.nix
+++ b/nixos/tests/hydra/db-migration.nix
@@ -1,8 +1,14 @@
-{ system ? builtins.currentSystem, ... }:
+{ system ? builtins.currentSystem
+, pkgs ? import ../../.. { inherit system; }
+, ...
+}:
 
 let inherit (import ./common.nix { inherit system; }) baseConfig; in
 
-{ mig = import ../make-test-python.nix ({ pkgs, lib, ... }: {
+with import ../../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+{ mig = makeTest {
     name = "hydra-db-migration";
     meta = with pkgs.stdenv.lib.maintainers; {
       maintainers = [ ma27 ];
@@ -82,5 +88,5 @@ let inherit (import ./common.nix { inherit system; }) baseConfig; in
 
       original.shutdown()
     '';
-  });
+  };
 }

From 34104aa360ecda47816c5f0a6729c194db1b6844 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 16 Apr 2020 19:24:51 +0200
Subject: [PATCH 17/59] grocy: 2.6.2 -> 2.7.0

(cherry picked from commit d4659dece27b9aa5096091b46a11b3280689c897)
---
 .../0001-Define-configs-with-env-vars.patch   |  2 +-
 ...-config-file-as-it-s-stored-in-etc-g.patch | 24 +++++++++++++++++++
 pkgs/servers/grocy/default.nix                |  9 ++++---
 3 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch

diff --git a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
index 654d96ae4e1a..ed315c854c82 100644
--- a/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
+++ b/pkgs/servers/grocy/0001-Define-configs-with-env-vars.patch
@@ -1,7 +1,7 @@
 From 931958d8f11cb55f2e88a178a3b828f3c537eba8 Mon Sep 17 00:00:00 2001
 From: Maximilian Bosch <maximilian@mbosch.me>
 Date: Fri, 6 Mar 2020 23:43:58 +0100
-Subject: [PATCH] Define configs with env vars
+Subject: [PATCH 1/2] Define configs with env vars
 
 ---
  app.php                      | 4 ++--
diff --git a/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
new file mode 100644
index 000000000000..e7f84a146fbf
--- /dev/null
+++ b/pkgs/servers/grocy/0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
@@ -0,0 +1,24 @@
+From 1556489f0b475ae56e5ed3afba19cc2abb696a76 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Thu, 16 Apr 2020 19:37:32 +0200
+Subject: [PATCH 2/2] Remove check for config-file as it's stored in /etc/grocy
+
+---
+ helpers/PrerequisiteChecker.php | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/helpers/PrerequisiteChecker.php b/helpers/PrerequisiteChecker.php
+index d4bf74c6..ca7686c9 100644
+--- a/helpers/PrerequisiteChecker.php
++++ b/helpers/PrerequisiteChecker.php
+@@ -8,7 +8,6 @@ class PrerequisiteChecker
+ {
+     public function checkRequirements()
+     {
+-        self::checkForConfigFile();
+         self::checkForConfigDistFile();
+         self::checkForComposer();
+         self::checkForYarn();
+-- 
+2.25.0
+
diff --git a/pkgs/servers/grocy/default.nix b/pkgs/servers/grocy/default.nix
index 2694765a948b..29eb2b22a636 100644
--- a/pkgs/servers/grocy/default.nix
+++ b/pkgs/servers/grocy/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grocy";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchurl {
     url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    sha256 = "1cjkyv50vwx24xb1mxgy51mr4qqsqgixjww06rql77d9czmmd94k";
+    sha256 = "10da7s8yc3adqzd8446ksgq61zyzxb4qbnwkzj11qh64y5hyj50q";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -14,7 +14,10 @@ stdenv.mkDerivation rec {
     unzip ${src} -d .
   '';
 
-  patches = [ ./0001-Define-configs-with-env-vars.patch ];
+  patches = [
+    ./0001-Define-configs-with-env-vars.patch
+    ./0002-Remove-check-for-config-file-as-it-s-stored-in-etc-g.patch
+  ];
   patchFlags = [ "--binary" "-p1" ];
 
   dontBuild = true;

From 962976d340f1f209022e20d49c44b8bdadca7651 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 17 Apr 2020 00:27:07 +0200
Subject: [PATCH 18/59] evcxr: 0.5.0 -> 0.5.1

https://github.com/google/evcxr/blob/582ce09f216d4812f7d152f6eedf0b034fc4dbbd/RELEASE_NOTES.md#version-051
(cherry picked from commit cd5bc89cca1b5fc0cc6064454b455af9518f549e)
---
 pkgs/development/interpreters/evcxr/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/interpreters/evcxr/default.nix b/pkgs/development/interpreters/evcxr/default.nix
index 168b012efcc1..58932d81abc1 100644
--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evcxr";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
-    rev = "239e431c58d04c641da22af791e4d3e1b894365e";
-    sha256 = "0vkcis06gwsqfwvrl8xcf74mfcs6j77b9fhcz5rrh77mwl7ixsdc";
+    rev = "582ce09f216d4812f7d152f6eedf0b034fc4dbbd";
+    sha256 = "12hlqgh74z8vmd7fkxh4vk3dqp8hlhzkxnbyywk6nphi562n6w5w";
   };
 
-  cargoSha256 = "04wffj2y9pqyk0x3y6ghp06pggmxnk2h245iabqq0mpwx36fd8b6";
+  cargoSha256 = "0xd8slrd19sy6z17x4x7mxqiwgyg89p7xnknp08bxkm8qxdn3c33";
 
   nativeBuildInputs = [ pkgconfig makeWrapper cmake ];
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;

From be4a41d06210e7f73fc91a1566a308d5152f0c26 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 17 Apr 2020 00:27:45 +0200
Subject: [PATCH 19/59] mautrix-whatsapp: 2020-04-02 -> 2020-04-12

(cherry picked from commit e61c924adba64110802dc22f2f4d8617aa98b1b3)
---
 pkgs/servers/mautrix-whatsapp/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index 0b4aff676fe8..a0b6ece55043 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule {
   pname = "mautrix-whatsapp-unstable";
-  version = "2020-04-02";
+  version = "2020-04-12";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = "mautrix-whatsapp";
-    rev = "064b5b8fedb6896d04509aa0e094a8d9f83426c2";
-    sha256 = "1xky31x5jk7yxh875nk20vvsn9givy6vxdqhqg5qwf4xjj2zqh2p";
+    rev = "44bb623e7a7486a0cdd13fd67b2aaca2ddba20ce";
+    sha256 = "1fwxn6511pq9fdc8d2jp4vgkm1zag55pig75qdxfn63hl3i2607k";
   };
 
-  modSha256 = "0qcxxhfp3fkx90r3lwhi0lkzg3digwrnxk8cack11k717szg7zrd";
+  modSha256 = "04pdap1q7zsa1wv2h0j9104fawn95g37yqslmp2mq7722hiqhp9x";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/tulir/mautrix-whatsapp;

From 48c5aaa2fcdec1f8537f2ed3e7db0e1bc11e1c28 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@protonmail.ch>
Date: Wed, 15 Apr 2020 17:10:23 -0400
Subject: [PATCH 20/59] treewide: mark broken wip

---
 pkgs/applications/audio/friture/default.nix            |  1 +
 pkgs/applications/audio/mopidy/mopify.nix              |  1 +
 pkgs/applications/audio/mopidy/musicbox-webclient.nix  |  1 +
 pkgs/applications/audio/mopidy/soundcloud.nix          |  1 +
 pkgs/applications/audio/mopidy/youtube.nix             |  1 +
 pkgs/applications/audio/muse/default.nix               |  1 +
 pkgs/applications/blockchains/ethabi.nix               |  1 +
 pkgs/applications/editors/nvi/default.nix              |  1 +
 pkgs/applications/graphics/k3d/default.nix             |  1 +
 pkgs/applications/kde/kdepim-addons.nix                |  1 +
 pkgs/applications/kde/kitinerary.nix                   |  1 +
 pkgs/applications/misc/ape/default.nix                 |  1 +
 pkgs/applications/misc/hovercraft/default.nix          |  1 +
 pkgs/applications/misc/navit/default.nix               |  1 +
 .../networking/cluster/kubeval/default.nix             |  1 +
 .../networking/cluster/marathon/default.nix            |  1 +
 pkgs/applications/networking/cluster/mesos/default.nix |  1 +
 .../networking/instant-messengers/amsn/default.nix     |  1 +
 pkgs/applications/networking/irc/communi/default.nix   |  1 +
 .../networking/mailreaders/notmuch-bower/default.nix   |  1 +
 .../networking/modem-manager-gui/default.nix           |  1 +
 pkgs/applications/networking/mumble/overlay.nix        |  1 +
 pkgs/applications/science/logic/avy/default.nix        |  1 +
 pkgs/applications/science/logic/leo2/default.nix       |  1 +
 pkgs/applications/science/misc/colmap/default.nix      |  1 +
 .../git-and-tools/git-annex-metadata-gui/default.nix   |  1 +
 pkgs/applications/video/openshot-qt/default.nix        |  1 +
 .../video/openshot-qt/libopenshot-audio.nix            |  1 +
 pkgs/applications/video/openshot-qt/libopenshot.nix    |  1 +
 pkgs/applications/window-managers/jwm/default.nix      |  3 ++-
 pkgs/development/compilers/avian/default.nix           |  1 +
 pkgs/development/compilers/mercury/default.nix         |  1 +
 .../interpreters/clojurescript/lumo/default.nix        |  9 +++++----
 pkgs/development/libraries/bwidget/default.nix         |  1 +
 pkgs/development/libraries/galario/default.nix         |  1 +
 pkgs/development/libraries/gcc/libstdc++/5.nix         |  1 +
 pkgs/development/libraries/libgaminggear/default.nix   |  1 +
 pkgs/development/libraries/qtutilities/default.nix     |  1 +
 pkgs/development/lua-modules/generated-packages.nix    |  1 +
 pkgs/development/misc/google-clasp/default.nix         |  1 +
 .../python-modules/alerta-server/default.nix           |  3 ++-
 .../python-modules/apache-airflow/default.nix          |  2 ++
 pkgs/development/python-modules/aria2p/default.nix     |  4 +++-
 pkgs/development/python-modules/asttokens/default.nix  |  3 ++-
 pkgs/development/python-modules/asynctest/default.nix  |  3 ++-
 pkgs/development/python-modules/behave/default.nix     |  3 ++-
 .../python-modules/browser-cookie3/default.nix         |  3 ++-
 pkgs/development/python-modules/canmatrix/default.nix  |  2 ++
 pkgs/development/python-modules/canopen/default.nix    |  5 ++++-
 pkgs/development/python-modules/cirq/default.nix       |  2 ++
 pkgs/development/python-modules/clifford/default.nix   |  2 ++
 .../python-modules/csvs-to-sqlite/default.nix          |  2 ++
 pkgs/development/python-modules/cufflinks/default.nix  |  2 ++
 .../python-modules/dask-jobqueue/default.nix           |  2 ++
 pkgs/development/python-modules/datashader/default.nix |  2 ++
 .../python-modules/dependency-injector/default.nix     |  3 ++-
 .../django-versatileimagefield/default.nix             |  2 ++
 pkgs/development/python-modules/fire/default.nix       |  3 ++-
 .../python-modules/fluidasserts/default.nix            |  1 +
 .../python-modules/fritzconnection/default.nix         |  3 ++-
 pkgs/development/python-modules/furl/default.nix       |  3 ++-
 .../python-modules/git-annex-adapter/default.nix       |  3 ++-
 .../python-modules/google-music-proto/default.nix      |  2 ++
 .../python-modules/google-music/default.nix            |  2 ++
 .../python-modules/google_cloud_automl/default.nix     |  2 ++
 .../python-modules/google_cloud_bigquery/default.nix   |  2 ++
 .../python-modules/google_cloud_container/default.nix  |  2 ++
 .../python-modules/google_cloud_datastore/default.nix  |  2 ++
 .../python-modules/google_cloud_dns/default.nix        |  2 ++
 .../google_cloud_error_reporting/default.nix           |  2 ++
 .../python-modules/google_cloud_logging/default.nix    |  2 ++
 .../google_cloud_resource_manager/default.nix          |  2 ++
 .../google_cloud_runtimeconfig/default.nix             |  2 ++
 .../python-modules/google_cloud_spanner/default.nix    |  2 ++
 .../python-modules/google_cloud_storage/default.nix    |  2 ++
 .../python-modules/google_cloud_translate/default.nix  |  2 ++
 pkgs/development/python-modules/gssapi/default.nix     |  2 ++
 pkgs/development/python-modules/gumath/default.nix     |  7 ++++++-
 pkgs/development/python-modules/howdoi/default.nix     |  2 ++
 pkgs/development/python-modules/hug/default.nix        |  2 ++
 .../python-modules/ibis-framework/default.nix          |  2 ++
 .../python-modules/imbalanced-learn/default.nix        |  2 ++
 pkgs/development/python-modules/imgaug/default.nix     |  4 +++-
 pkgs/development/python-modules/immutables/default.nix |  3 ++-
 pkgs/development/python-modules/intake/default.nix     |  1 +
 pkgs/development/python-modules/jug/default.nix        |  3 ++-
 pkgs/development/python-modules/junit-xml/default.nix  |  1 +
 pkgs/development/python-modules/junos-eznc/default.nix |  1 +
 .../development/tools/build-managers/conan/default.nix |  1 +
 pkgs/development/tools/database/litecli/default.nix    |  1 +
 pkgs/development/tools/misc/act/default.nix            |  1 +
 pkgs/development/tools/parinfer-rust/default.nix       |  1 +
 pkgs/development/tools/prospector/default.nix          |  1 +
 pkgs/games/atanks/default.nix                          |  1 +
 pkgs/games/freeorion/default.nix                       |  1 +
 pkgs/games/lincity/ng.nix                              |  1 +
 pkgs/games/onscripter-en/default.nix                   |  1 +
 pkgs/misc/emulators/atari800/default.nix               |  1 +
 pkgs/misc/emulators/hatari/default.nix                 |  1 +
 pkgs/os-specific/darwin/libtapi/default.nix            |  1 +
 pkgs/servers/monitoring/plugins/esxi.nix               |  1 +
 pkgs/servers/sql/percona/5.6.x.nix                     |  1 +
 pkgs/shells/dgsh/default.nix                           |  1 +
 pkgs/tools/X11/ncview/default.nix                      |  1 +
 pkgs/tools/audio/google-music-scripts/default.nix      |  1 +
 pkgs/tools/backup/partimage/default.nix                |  1 +
 pkgs/tools/compression/lbzip2/default.nix              |  1 +
 pkgs/tools/filesystems/lizardfs/default.nix            |  1 +
 pkgs/tools/filesystems/orangefs/default.nix            |  1 +
 pkgs/tools/misc/bmap-tools/default.nix                 |  1 +
 pkgs/tools/misc/ntfy/default.nix                       |  1 +
 pkgs/tools/networking/ip2unix/default.nix              |  1 +
 pkgs/tools/networking/mitmproxy/default.nix            |  1 +
 pkgs/tools/networking/packetdrill/default.nix          |  1 +
 pkgs/tools/networking/py-wmi-client/default.nix        |  1 +
 .../package-management/cargo-download/default.nix      |  8 ++++++--
 pkgs/tools/security/gencfsm/default.nix                |  1 +
 pkgs/top-level/all-packages.nix                        |  2 +-
 pkgs/top-level/dotnet-packages.nix                     |  2 ++
 pkgs/top-level/python-packages.nix                     | 10 +++++++---
 120 files changed, 189 insertions(+), 27 deletions(-)

diff --git a/pkgs/applications/audio/friture/default.nix b/pkgs/applications/audio/friture/default.nix
index eae4b6516858..1a6ab05853b5 100644
--- a/pkgs/applications/audio/friture/default.nix
+++ b/pkgs/applications/audio/friture/default.nix
@@ -41,5 +41,6 @@ in py.buildPythonApplication rec {
     license = licenses.gpl3;
     platforms = platforms.linux; # fails on Darwin
     maintainers = [ maintainers.laikq ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/audio/mopidy/mopify.nix b/pkgs/applications/audio/mopidy/mopify.nix
index b657f69e26ee..916a3780b64b 100644
--- a/pkgs/applications/audio/mopidy/mopify.nix
+++ b/pkgs/applications/audio/mopidy/mopify.nix
@@ -19,5 +19,6 @@ pythonPackages.buildPythonApplication rec {
     description = "A mopidy webclient based on the Spotify webbased interface";
     license = licenses.gpl3;
     maintainers = [ maintainers.Gonzih ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/audio/mopidy/musicbox-webclient.nix b/pkgs/applications/audio/mopidy/musicbox-webclient.nix
index b0abefd7a1fd..da29e4775ef1 100644
--- a/pkgs/applications/audio/mopidy/musicbox-webclient.nix
+++ b/pkgs/applications/audio/mopidy/musicbox-webclient.nix
@@ -19,5 +19,6 @@ pythonPackages.buildPythonApplication rec {
     description = "Mopidy extension for playing music from SoundCloud";
     license = licenses.mit;
     maintainers = [ maintainers.spwhitt ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/audio/mopidy/soundcloud.nix b/pkgs/applications/audio/mopidy/soundcloud.nix
index 8002feb0f901..efc32fb785e3 100644
--- a/pkgs/applications/audio/mopidy/soundcloud.nix
+++ b/pkgs/applications/audio/mopidy/soundcloud.nix
@@ -19,5 +19,6 @@ pythonPackages.buildPythonApplication rec {
     description = "Mopidy extension for playing music from SoundCloud";
     license = licenses.mit;
     maintainers = [ maintainers.spwhitt ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/audio/mopidy/youtube.nix b/pkgs/applications/audio/mopidy/youtube.nix
index b8e22a41cabf..1e4e8ab10399 100644
--- a/pkgs/applications/audio/mopidy/youtube.nix
+++ b/pkgs/applications/audio/mopidy/youtube.nix
@@ -19,5 +19,6 @@ pythonPackages.buildPythonApplication rec {
     description = "Mopidy extension for playing music from YouTube";
     license = licenses.asl20;
     maintainers = [ maintainers.spwhitt ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/audio/muse/default.nix b/pkgs/applications/audio/muse/default.nix
index f1fad05beced..7bff8bf2f6e8 100644
--- a/pkgs/applications/audio/muse/default.nix
+++ b/pkgs/applications/audio/muse/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation {
       it is published under the GNU General Public License.
     '';
     license = stdenv.lib.licenses.gpl2;
+    broken = true;
   };
 
   src =
diff --git a/pkgs/applications/blockchains/ethabi.nix b/pkgs/applications/blockchains/ethabi.nix
index 5bc81a6daf66..9fb465a52016 100644
--- a/pkgs/applications/blockchains/ethabi.nix
+++ b/pkgs/applications/blockchains/ethabi.nix
@@ -23,5 +23,6 @@ buildRustPackage rec {
     maintainers = [ maintainers.dbrock ];
     license = licenses.gpl3;
     inherit version;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/editors/nvi/default.nix b/pkgs/applications/editors/nvi/default.nix
index a7a6b35a24a0..4ee816a41da4 100644
--- a/pkgs/applications/editors/nvi/default.nix
+++ b/pkgs/applications/editors/nvi/default.nix
@@ -51,5 +51,6 @@ stdenv.mkDerivation {
     homepage = http://www.bostic.com/vi/;
     description = "The Berkeley Vi Editor";
     license = stdenv.lib.licenses.free;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/graphics/k3d/default.nix b/pkgs/applications/graphics/k3d/default.nix
index 31085cd8023d..1cc82feda2ee 100644
--- a/pkgs/applications/graphics/k3d/default.nix
+++ b/pkgs/applications/graphics/k3d/default.nix
@@ -47,5 +47,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = [ maintainers.raskin ];
     license = licenses.gpl2;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/kde/kdepim-addons.nix b/pkgs/applications/kde/kdepim-addons.nix
index e47aae89e603..7f36e6a2d623 100644
--- a/pkgs/applications/kde/kdepim-addons.nix
+++ b/pkgs/applications/kde/kdepim-addons.nix
@@ -13,6 +13,7 @@ mkDerivation {
   meta = {
     license = with lib.licenses; [ gpl2Plus lgpl21Plus ];
     maintainers = kdepimTeam;
+    broken = true;
   };
   nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
   buildInputs = [
diff --git a/pkgs/applications/kde/kitinerary.nix b/pkgs/applications/kde/kitinerary.nix
index ce66de251dca..3e29b22059e1 100644
--- a/pkgs/applications/kde/kitinerary.nix
+++ b/pkgs/applications/kde/kitinerary.nix
@@ -9,6 +9,7 @@ mkDerivation {
   meta = {
     license = with lib.licenses; [ lgpl21 ];
     maintainers = [ lib.maintainers.bkchr ];
+    broken = true;
   };
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
diff --git a/pkgs/applications/misc/ape/default.nix b/pkgs/applications/misc/ape/default.nix
index 0d8ebccb3d02..72d3989f5bea 100644
--- a/pkgs/applications/misc/ape/default.nix
+++ b/pkgs/applications/misc/ape/default.nix
@@ -41,5 +41,6 @@ stdenv.mkDerivation rec {
     license = license;
     platforms = platforms.unix;
     maintainers = with maintainers; [ yrashk ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/misc/hovercraft/default.nix b/pkgs/applications/misc/hovercraft/default.nix
index ba23078bba93..c60020ea0efb 100644
--- a/pkgs/applications/misc/hovercraft/default.nix
+++ b/pkgs/applications/misc/hovercraft/default.nix
@@ -31,5 +31,6 @@ buildPythonApplication rec {
     homepage = https://github.com/regebro/hovercraft;
     license = licenses.mit;
     maintainers = with maintainers; [ goibhniu makefu ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/misc/navit/default.nix b/pkgs/applications/misc/navit/default.nix
index 2263dfc1fbc0..27da7c84513d 100644
--- a/pkgs/applications/misc/navit/default.nix
+++ b/pkgs/applications/misc/navit/default.nix
@@ -86,5 +86,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.genesis ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/cluster/kubeval/default.nix b/pkgs/applications/networking/cluster/kubeval/default.nix
index 84e9b8899431..6de1a33b4100 100644
--- a/pkgs/applications/networking/cluster/kubeval/default.nix
+++ b/pkgs/applications/networking/cluster/kubeval/default.nix
@@ -44,5 +44,6 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ nicknovitski ];
     platforms = platforms.all;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/cluster/marathon/default.nix b/pkgs/applications/networking/cluster/marathon/default.nix
index 72bd82be6c16..eca2b8a540e0 100644
--- a/pkgs/applications/networking/cluster/marathon/default.nix
+++ b/pkgs/applications/networking/cluster/marathon/default.nix
@@ -26,5 +26,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ kamilchm kevincox pradeepchhetri ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/cluster/mesos/default.nix b/pkgs/applications/networking/cluster/mesos/default.nix
index 1ad30335b94d..dadbfacdd8bf 100644
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@@ -258,5 +258,6 @@ in stdenv.mkDerivation rec {
     description = "A cluster manager that provides efficient resource isolation and sharing across distributed applications, or frameworks";
     maintainers = with maintainers; [ cstrahan kevincox offline ];
     platforms   = platforms.unix;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/amsn/default.nix b/pkgs/applications/networking/instant-messengers/amsn/default.nix
index 6ff51445718b..7acea3cd3c67 100644
--- a/pkgs/applications/networking/instant-messengers/amsn/default.nix
+++ b/pkgs/applications/networking/instant-messengers/amsn/default.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation {
     homepage = http://amsn-project.net;
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.gpl2;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/irc/communi/default.nix b/pkgs/applications/networking/irc/communi/default.nix
index 8278f90d321c..b7c11b3feb07 100644
--- a/pkgs/applications/networking/irc/communi/default.nix
+++ b/pkgs/applications/networking/irc/communi/default.nix
@@ -44,5 +44,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ hrdinka ];
     platforms = platforms.all;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
index d9eae3c9c503..6233163129cd 100644
--- a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
@@ -32,5 +32,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ erictapen ];
     license = licenses.gpl3;
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/modem-manager-gui/default.nix b/pkgs/applications/networking/modem-manager-gui/default.nix
index bfd177cda7a1..ae4f71b89844 100644
--- a/pkgs/applications/networking/modem-manager-gui/default.nix
+++ b/pkgs/applications/networking/modem-manager-gui/default.nix
@@ -59,5 +59,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ ahuzik ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/mumble/overlay.nix b/pkgs/applications/networking/mumble/overlay.nix
index babb3812bb92..e651723788e8 100644
--- a/pkgs/applications/networking/mumble/overlay.nix
+++ b/pkgs/applications/networking/mumble/overlay.nix
@@ -24,5 +24,6 @@ in stdenv.mkDerivation {
 
   meta = {
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/science/logic/avy/default.nix b/pkgs/applications/science/logic/avy/default.nix
index b43e0c6fbf1a..a738502d8773 100644
--- a/pkgs/applications/science/logic/avy/default.nix
+++ b/pkgs/applications/science/logic/avy/default.nix
@@ -49,5 +49,6 @@ stdenv.mkDerivation {
     # See pkgs/applications/science/logic/glucose/default.nix
     # (The error is different due to glucose-fenv.patch, but the same)
     badPlatforms = [ "aarch64-linux" ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/science/logic/leo2/default.nix b/pkgs/applications/science/logic/leo2/default.nix
index b50848a18205..77d99b4df386 100644
--- a/pkgs/applications/science/logic/leo2/default.nix
+++ b/pkgs/applications/science/logic/leo2/default.nix
@@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.bsd3;
     homepage = http://www.leoprover.org/;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/science/misc/colmap/default.nix b/pkgs/applications/science/misc/colmap/default.nix
index da118f6bca57..87484f93a5b9 100644
--- a/pkgs/applications/science/misc/colmap/default.nix
+++ b/pkgs/applications/science/misc/colmap/default.nix
@@ -40,5 +40,6 @@ mkDerivation rec {
     license = licenses.bsd2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ lebastr ];
+    broken = true;
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-annex-metadata-gui/default.nix b/pkgs/applications/version-management/git-and-tools/git-annex-metadata-gui/default.nix
index 3118eaab19b4..c7ac0a6d3773 100644
--- a/pkgs/applications/version-management/git-and-tools/git-annex-metadata-gui/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-metadata-gui/default.nix
@@ -23,5 +23,6 @@ buildPythonApplication rec {
     maintainers = with maintainers; [ dotlambda ];
     license = licenses.gpl3Plus;
     platforms = with platforms; linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index 1c5359e5f0c6..dbf4e68a7066 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -57,5 +57,6 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     license = with licenses; gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/video/openshot-qt/libopenshot-audio.nix b/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
index 9bf211164553..e8e27fa3eb10 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot-audio.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     license = with licenses; gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/video/openshot-qt/libopenshot.nix b/pkgs/applications/video/openshot-qt/libopenshot.nix
index 2ed4b8ce3e3d..47e10e87b87b 100644
--- a/pkgs/applications/video/openshot-qt/libopenshot.nix
+++ b/pkgs/applications/video/openshot-qt/libopenshot.nix
@@ -47,5 +47,6 @@ stdenv.mkDerivation rec {
     license = with licenses; gpl3Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; linux;
+    broken = true;
   };
 }
diff --git a/pkgs/applications/window-managers/jwm/default.nix b/pkgs/applications/window-managers/jwm/default.nix
index 3668b344be50..c825ffa5ac17 100644
--- a/pkgs/applications/window-managers/jwm/default.nix
+++ b/pkgs/applications/window-managers/jwm/default.nix
@@ -6,7 +6,7 @@
 stdenv.mkDerivation rec {
   pname = "jwm";
   version = "1685";
-  
+
   src = fetchFromGitHub {
     owner = "joewing";
     repo = "jwm";
@@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
     platforms   = stdenv.lib.platforms.unix;
     maintainers = [ stdenv.lib.maintainers.romildo ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/compilers/avian/default.nix b/pkgs/development/compilers/avian/default.nix
index 34d1e64c484f..1c626de76795 100644
--- a/pkgs/development/compilers/avian/default.nix
+++ b/pkgs/development/compilers/avian/default.nix
@@ -39,5 +39,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.isc;
     platforms = stdenv.lib.platforms.all;
     maintainers = [ stdenv.lib.maintainers.earldouglas ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/compilers/mercury/default.nix b/pkgs/development/compilers/mercury/default.nix
index 0327e0dc2155..f4fbb4d82b0d 100644
--- a/pkgs/development/compilers/mercury/default.nix
+++ b/pkgs/development/compilers/mercury/default.nix
@@ -58,5 +58,6 @@ stdenv.mkDerivation rec {
     license     = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
     maintainers = [ ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/interpreters/clojurescript/lumo/default.nix b/pkgs/development/interpreters/clojurescript/lumo/default.nix
index 0e9d81d5e959..a6e9f1760cf6 100644
--- a/pkgs/development/interpreters/clojurescript/lumo/default.nix
+++ b/pkgs/development/interpreters/clojurescript/lumo/default.nix
@@ -122,7 +122,7 @@ let # packageJSON=./package.json;
     classp    = cljdeps.makeClasspaths {
                   extraClasspaths=["src/js" "src/cljs/bundled" "src/cljs/snapshot"];
                 };
-    
+
 
     getJarPath = jarName: (lib.findFirst (p: p.name == jarName) null cljdeps.packages).path.jar;
 
@@ -147,7 +147,7 @@ in stdenv.mkDerivation {
     # configure clojure-cli
     mkdir ./.cpcache
     export CLJ_CONFIG=`pwd`
-    export CLJ_CACHE=`pwd`/.cpcache 
+    export CLJ_CACHE=`pwd`/.cpcache
 
     # require more namespaces for cljs-bundle
     sed -i "s!ns lumo.core! \
@@ -155,7 +155,7 @@ in stdenv.mkDerivation {
                (:require ${requireDeps}) \
                (:require-macros [clojure.template :as temp] \
                                 [cljs.test :as test])!g" \
-              ./src/cljs/snapshot/lumo/core.cljs          
+              ./src/cljs/snapshot/lumo/core.cljs
 
     # Step 1: compile clojurescript with :none and :simple
     ${clojure}/bin/clojure -Scp ${classp} -e "${compileClojurescript true}"
@@ -204,7 +204,7 @@ in stdenv.mkDerivation {
     # Step 3: generate munged cache jsons
     ${clojure}/bin/clojure -Scp ${classp} -e "${cacheToJsons}"
     rm  ./target/cljs/core\$macros\.cljc\.cache\.json
-    
+
 
     # Step 4: Bunde javascript
     NODE_ENV=production node scripts/bundle.js
@@ -251,6 +251,7 @@ in stdenv.mkDerivation {
     license = stdenv.lib.licenses.epl10;
     maintainers = [ stdenv.lib.maintainers.hlolli ];
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
 
diff --git a/pkgs/development/libraries/bwidget/default.nix b/pkgs/development/libraries/bwidget/default.nix
index 0279dc8f5efa..be67a8721779 100644
--- a/pkgs/development/libraries/bwidget/default.nix
+++ b/pkgs/development/libraries/bwidget/default.nix
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     description = "High-level widget set for Tcl/Tk";
     license = stdenv.lib.licenses.tcltk;
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/galario/default.nix b/pkgs/development/libraries/galario/default.nix
index 08450e569830..7c092e2c42be 100644
--- a/pkgs/development/libraries/galario/default.nix
+++ b/pkgs/development/libraries/galario/default.nix
@@ -74,5 +74,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl3;
     maintainers = [ maintainers.smaret ];
     platforms = platforms.all;
+    broken = pythonPackages.isPy38;
   };
 }
diff --git a/pkgs/development/libraries/gcc/libstdc++/5.nix b/pkgs/development/libraries/gcc/libstdc++/5.nix
index 2589b6cfa16b..d5b8b7c3ffc8 100644
--- a/pkgs/development/libraries/gcc/libstdc++/5.nix
+++ b/pkgs/development/libraries/gcc/libstdc++/5.nix
@@ -113,5 +113,6 @@ stdenv.mkDerivation rec {
     description = "GNU Compiler Collection, version ${version} -- C++ standard library";
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/libgaminggear/default.nix b/pkgs/development/libraries/libgaminggear/default.nix
index d83b43a782e9..c64d41b0ad9e 100644
--- a/pkgs/development/libraries/libgaminggear/default.nix
+++ b/pkgs/development/libraries/libgaminggear/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     homepage = https://sourceforge.net/projects/libgaminggear/;
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.gpl2Plus;
+    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index 3f0dc18f157b..3b997d265189 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -20,5 +20,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = with maintainers; [ doronbehar ];
     platforms   = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index d95ce128b737..07115f9f72c4 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -990,6 +990,7 @@ luaexpat = buildLuarocksPackage {
     license = {
       fullName = "MIT/X11";
     };
+    broken = true;
   };
 };
 luaffi = buildLuarocksPackage {
diff --git a/pkgs/development/misc/google-clasp/default.nix b/pkgs/development/misc/google-clasp/default.nix
index db6ade1c85a6..a64ecc8f2993 100644
--- a/pkgs/development/misc/google-clasp/default.nix
+++ b/pkgs/development/misc/google-clasp/default.nix
@@ -15,5 +15,6 @@ in
     license = stdenv.lib.licenses.asl20;
     maintainers = [ stdenv.lib.maintainers.michojel ];
     priority = 100;
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/alerta-server/default.nix b/pkgs/development/python-modules/alerta-server/default.nix
index 55674b660c04..9e132b89a1a8 100644
--- a/pkgs/development/python-modules/alerta-server/default.nix
+++ b/pkgs/development/python-modules/alerta-server/default.nix
@@ -1,5 +1,5 @@
 { stdenv, buildPythonPackage, fetchPypi, pythonOlder, pyyaml
-, python-dateutil, requests, pymongo, raven, bcrypt, flask, pyjwt, flask-cors, psycopg2, pytz, flask-compress, jinja2
+, python-dateutil, requests, pymongo, raven, bcrypt, flask, pyjwt, flask-cors, psycopg2, pytz, flask-compress, jinja2, isPy38
 }:
 
 buildPythonPackage rec {
@@ -25,5 +25,6 @@ buildPythonPackage rec {
     homepage = https://alerta.io;
     description = "Alerta Monitoring System server";
     license = licenses.asl20;
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix
index 049db8a648fb..7a5a0521be17 100644
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@@ -53,6 +53,7 @@
 , nose
 , python
 , isPy3k
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -187,5 +188,6 @@ buildPythonPackage rec {
     homepage = http://airflow.apache.org/;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc maintainers.ingenieroariel ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/aria2p/default.nix b/pkgs/development/python-modules/aria2p/default.nix
index 51b523c010aa..74dfdd681f76 100644
--- a/pkgs/development/python-modules/aria2p/default.nix
+++ b/pkgs/development/python-modules/aria2p/default.nix
@@ -1,6 +1,7 @@
 { stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
 , aria2, poetry, pytest, pytestcov, pytest_xdist, responses
 , asciimatics, loguru, requests, setuptools, websocket_client
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -15,7 +16,7 @@ buildPythonPackage rec {
     rev = "v${version}";
     sha256 = "1inak3y2win58zbzykfzy6xp00f276sqsz69h2nfsd93mpr74wf6";
   };
-  
+
   nativeBuildInputs = [ poetry ];
 
   preBuild = ''
@@ -39,5 +40,6 @@ buildPythonPackage rec {
     description = "Command-line tool and library to interact with an aria2c daemon process with JSON-RPC";
     license = licenses.isc;
     maintainers = with maintainers; [ koral ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/asttokens/default.nix b/pkgs/development/python-modules/asttokens/default.nix
index 8c8a1b76b1a0..06c3016762b4 100644
--- a/pkgs/development/python-modules/asttokens/default.nix
+++ b/pkgs/development/python-modules/asttokens/default.nix
@@ -1,5 +1,5 @@
 { lib, fetchPypi, buildPythonPackage, fetchpatch, astroid, six, coverage
-, lazy-object-proxy, nose, wrapt
+, lazy-object-proxy, nose, wrapt, isPy38
 }:
 
 buildPythonPackage rec {
@@ -29,5 +29,6 @@ buildPythonPackage rec {
     license = licenses.asl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ leenaars ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/asynctest/default.nix b/pkgs/development/python-modules/asynctest/default.nix
index a9c012ba8314..dc219ad3e39f 100644
--- a/pkgs/development/python-modules/asynctest/default.nix
+++ b/pkgs/development/python-modules/asynctest/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, python }:
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, python, isPy38 }:
 
 buildPythonPackage rec {
   pname = "asynctest";
@@ -26,5 +26,6 @@ buildPythonPackage rec {
     homepage = https://github.com/Martiusweb/asynctest;
     license = licenses.asl20;
     maintainers = with maintainers; [ dotlambda ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/behave/default.nix b/pkgs/development/python-modules/behave/default.nix
index 6d0364676f9a..aaffd6fa7488 100644
--- a/pkgs/development/python-modules/behave/default.nix
+++ b/pkgs/development/python-modules/behave/default.nix
@@ -2,7 +2,7 @@
 , buildPythonApplication, python, pythonOlder
 , mock, nose, pathpy, pyhamcrest, pytest_4
 , glibcLocales, parse, parse-type, six
-, traceback2
+, traceback2, isPy38
 }:
 
 buildPythonApplication rec {
@@ -48,5 +48,6 @@ buildPythonApplication rec {
     description = "behaviour-driven development, Python style";
     license = licenses.bsd2;
     maintainers = with maintainers; [ alunduil ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/browser-cookie3/default.nix b/pkgs/development/python-modules/browser-cookie3/default.nix
index 13eea3e21fd4..9404581f1029 100644
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchPypi, buildPythonPackage, isPy3k, keyring, pbkdf2, pyaes}:
+{ lib, fetchPypi, buildPythonPackage, isPy3k, keyring, pbkdf2, pyaes, isPy38 }:
 buildPythonPackage rec {
   pname = "browser-cookie3";
   version = "0.9.1";
@@ -20,5 +20,6 @@ buildPythonPackage rec {
     maintainers = with maintainers; [ borisbabic ];
     homepage = https://github.com/borisbabic/browser_cookie3;
     license = licenses.gpl3;
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/canmatrix/default.nix b/pkgs/development/python-modules/canmatrix/default.nix
index 004669d605b5..f3c3004ffe41 100644
--- a/pkgs/development/python-modules/canmatrix/default.nix
+++ b/pkgs/development/python-modules/canmatrix/default.nix
@@ -13,6 +13,7 @@
 , XlsxWriter
 , pyyaml
 , pytest
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -54,6 +55,7 @@ buildPythonPackage rec {
     description = "Support and convert several CAN (Controller Area Network) database formats .arxml .dbc .dbf .kcd .sym fibex xls(x)";
     license = licenses.bsd2;
     maintainers = with maintainers; [ sorki ];
+    broken = isPy38;
   };
 }
 
diff --git a/pkgs/development/python-modules/canopen/default.nix b/pkgs/development/python-modules/canopen/default.nix
index a76e05332f19..f52615951301 100644
--- a/pkgs/development/python-modules/canopen/default.nix
+++ b/pkgs/development/python-modules/canopen/default.nix
@@ -3,7 +3,9 @@
 , fetchFromGitHub
 , nose
 , can
-, canmatrix }:
+, canmatrix
+, isPy38
+}:
 
 buildPythonPackage {
   pname = "canopen";
@@ -40,5 +42,6 @@ buildPythonPackage {
     description = "CANopen stack implementation";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ sorki ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/cirq/default.nix b/pkgs/development/python-modules/cirq/default.nix
index d6109e8aabac..e32d4596a8a8 100644
--- a/pkgs/development/python-modules/cirq/default.nix
+++ b/pkgs/development/python-modules/cirq/default.nix
@@ -20,6 +20,7 @@
 , pydot
 , pyyaml
 , pygraphviz
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -82,5 +83,6 @@ buildPythonPackage rec {
     homepage = "http://github.com/quantumlib/cirq";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/clifford/default.nix b/pkgs/development/python-modules/clifford/default.nix
index 961f6b5bc1de..4c40c4782365 100644
--- a/pkgs/development/python-modules/clifford/default.nix
+++ b/pkgs/development/python-modules/clifford/default.nix
@@ -8,6 +8,7 @@
 , h5py
 , nose
 , isPy27
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -46,5 +47,6 @@ buildPythonPackage rec {
     homepage = https://clifford.readthedocs.io;
     license = licenses.bsd3;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/csvs-to-sqlite/default.nix b/pkgs/development/python-modules/csvs-to-sqlite/default.nix
index 0e5e902be2e3..86cdc928e4a9 100644
--- a/pkgs/development/python-modules/csvs-to-sqlite/default.nix
+++ b/pkgs/development/python-modules/csvs-to-sqlite/default.nix
@@ -9,6 +9,7 @@
 , py-lru-cache
 , six
 , pytest
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -44,6 +45,7 @@ buildPythonPackage rec {
     homepage = https://github.com/simonw/csvs-to-sqlite;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 
 }
diff --git a/pkgs/development/python-modules/cufflinks/default.nix b/pkgs/development/python-modules/cufflinks/default.nix
index ed25c2c73717..7dea73414067 100644
--- a/pkgs/development/python-modules/cufflinks/default.nix
+++ b/pkgs/development/python-modules/cufflinks/default.nix
@@ -8,6 +8,7 @@
 , pandas
 , six
 , statsmodels
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -55,5 +56,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/santosjorge/cufflinks";
     license = licenses.mit;
     maintainers = with maintainers; [ globin ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/dask-jobqueue/default.nix b/pkgs/development/python-modules/dask-jobqueue/default.nix
index f9af247bc802..080c6c969051 100644
--- a/pkgs/development/python-modules/dask-jobqueue/default.nix
+++ b/pkgs/development/python-modules/dask-jobqueue/default.nix
@@ -5,6 +5,7 @@
 , distributed
 , docrep
 , pytest
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -29,5 +30,6 @@ buildPythonPackage rec {
     description = "Deploy Dask on job schedulers like PBS, SLURM, and SGE";
     license = licenses.bsd3;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index 789e488e4615..2a520e514998 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -25,6 +25,7 @@
 , fastparquet
 , testpath
 , nbconvert
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -81,5 +82,6 @@ buildPythonPackage rec {
     homepage = https://datashader.org;
     license = licenses.bsd3;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/dependency-injector/default.nix b/pkgs/development/python-modules/dependency-injector/default.nix
index b5a3a869b697..e7a0ad2a4fff 100644
--- a/pkgs/development/python-modules/dependency-injector/default.nix
+++ b/pkgs/development/python-modules/dependency-injector/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy3k, six, unittest2 }:
+{ stdenv, buildPythonPackage, fetchPypi, isPy3k, six, unittest2, isPy38 }:
 
 let
   testPath =
@@ -28,5 +28,6 @@ buildPythonPackage rec {
     homepage = https://github.com/ets-labs/python-dependency-injector;
     license = licenses.bsd3;
     maintainers = with maintainers; [ gerschtli ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/django-versatileimagefield/default.nix b/pkgs/development/python-modules/django-versatileimagefield/default.nix
index 90993db4c5bf..131a3f4c8fff 100644
--- a/pkgs/development/python-modules/django-versatileimagefield/default.nix
+++ b/pkgs/development/python-modules/django-versatileimagefield/default.nix
@@ -4,6 +4,7 @@
 , django
 , python
 , pillow
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -26,6 +27,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/respondcreate/django-versatileimagefield/";
     license = licenses.mit;
     maintainers = with maintainers; [ mmai ];
+    broken = isPy38;
   };
 }
 
diff --git a/pkgs/development/python-modules/fire/default.nix b/pkgs/development/python-modules/fire/default.nix
index 7af8d29fce73..98f95e96687e 100644
--- a/pkgs/development/python-modules/fire/default.nix
+++ b/pkgs/development/python-modules/fire/default.nix
@@ -1,5 +1,5 @@
 { stdenv, buildPythonPackage, fetchFromGitHub, fetchpatch, six, hypothesis, mock
-, python-Levenshtein, pytest, termcolor, isPy27, enum34 }:
+, python-Levenshtein, pytest, termcolor, isPy27, enum34, isPy38 }:
 
 buildPythonPackage rec {
   pname = "fire";
@@ -42,5 +42,6 @@ buildPythonPackage rec {
     '';
     license = licenses.asl20;
     maintainers = with maintainers; [ leenaars ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/fluidasserts/default.nix b/pkgs/development/python-modules/fluidasserts/default.nix
index 78405ed8a660..c6e6881de41c 100644
--- a/pkgs/development/python-modules/fluidasserts/default.nix
+++ b/pkgs/development/python-modules/fluidasserts/default.nix
@@ -172,5 +172,6 @@ buildPythonPackage rec {
     maintainers = with maintainers; [
       kamadorueda
     ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/fritzconnection/default.nix b/pkgs/development/python-modules/fritzconnection/default.nix
index 32e9e9393ce6..f2a1a482689e 100644
--- a/pkgs/development/python-modules/fritzconnection/default.nix
+++ b/pkgs/development/python-modules/fritzconnection/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, lxml, requests, tkinter }:
+{ stdenv, buildPythonPackage, fetchPypi, lxml, requests, tkinter, isPy38 }:
 
 buildPythonPackage rec {
   pname = "fritzconnection";
@@ -21,5 +21,6 @@ buildPythonPackage rec {
     homepage = https://bitbucket.org/kbr/fritzconnection;
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/furl/default.nix b/pkgs/development/python-modules/furl/default.nix
index ecb455b51e4a..0f365d6497d7 100644
--- a/pkgs/development/python-modules/furl/default.nix
+++ b/pkgs/development/python-modules/furl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi, flake8, six, orderedmultidict }:
+{ stdenv, buildPythonPackage, fetchPypi, flake8, six, orderedmultidict, isPy38 }:
 
 buildPythonPackage rec {
   pname = "furl";
@@ -18,5 +18,6 @@ buildPythonPackage rec {
     homepage = https://github.com/gruns/furl;
     license = licenses.publicDomain;
     maintainers = with maintainers; [ vanzef ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/git-annex-adapter/default.nix b/pkgs/development/python-modules/git-annex-adapter/default.nix
index a7bac0fd7626..954ef88ffc9b 100644
--- a/pkgs/development/python-modules/git-annex-adapter/default.nix
+++ b/pkgs/development/python-modules/git-annex-adapter/default.nix
@@ -1,5 +1,5 @@
 { stdenv, buildPythonPackage, isPy3k, fetchFromGitHub, substituteAll
-, python, utillinux, pygit2, gitMinimal, git-annex
+, python, utillinux, pygit2, gitMinimal, git-annex, isPy38
 }:
 
 buildPythonPackage rec {
@@ -39,5 +39,6 @@ buildPythonPackage rec {
     description = "Call git-annex commands from Python";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ dotlambda ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google-music-proto/default.nix b/pkgs/development/python-modules/google-music-proto/default.nix
index d3f41880784d..aed493397362 100644
--- a/pkgs/development/python-modules/google-music-proto/default.nix
+++ b/pkgs/development/python-modules/google-music-proto/default.nix
@@ -4,6 +4,7 @@
 , marshmallow
 , pendulum
 , protobuf
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -33,5 +34,6 @@ buildPythonPackage rec {
     description = "Sans-I/O wrapper of Google Music API calls";
     license = licenses.mit;
     maintainers = with maintainers; [ jakewaksbaum ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google-music/default.nix b/pkgs/development/python-modules/google-music/default.nix
index 0a3f145f131d..138518a4f906 100644
--- a/pkgs/development/python-modules/google-music/default.nix
+++ b/pkgs/development/python-modules/google-music/default.nix
@@ -5,6 +5,7 @@
 , protobuf
 , requests_oauthlib
 , tenacity
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -40,5 +41,6 @@ buildPythonPackage rec {
     description = "A Google Music API wrapper";
     license = licenses.mit;
     maintainers = with maintainers; [ jakewaksbaum ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_automl/default.nix b/pkgs/development/python-modules/google_cloud_automl/default.nix
index 3fc0fc8598d5..c8b5531d0bcf 100644
--- a/pkgs/development/python-modules/google_cloud_automl/default.nix
+++ b/pkgs/development/python-modules/google_cloud_automl/default.nix
@@ -5,6 +5,7 @@
 , google_api_core
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -28,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_bigquery/default.nix b/pkgs/development/python-modules/google_cloud_bigquery/default.nix
index e361b4436ee8..915c594ac8d9 100644
--- a/pkgs/development/python-modules/google_cloud_bigquery/default.nix
+++ b/pkgs/development/python-modules/google_cloud_bigquery/default.nix
@@ -9,6 +9,7 @@
 , pytest
 , mock
 , ipython
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -32,5 +33,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_container/default.nix b/pkgs/development/python-modules/google_cloud_container/default.nix
index d0994ce5e0bf..72b7bac6d321 100644
--- a/pkgs/development/python-modules/google_cloud_container/default.nix
+++ b/pkgs/development/python-modules/google_cloud_container/default.nix
@@ -4,6 +4,7 @@
 , google_api_core
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -27,5 +28,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_datastore/default.nix b/pkgs/development/python-modules/google_cloud_datastore/default.nix
index 7f47725cde35..3baa3a0588fb 100644
--- a/pkgs/development/python-modules/google_cloud_datastore/default.nix
+++ b/pkgs/development/python-modules/google_cloud_datastore/default.nix
@@ -5,6 +5,7 @@
 , google_cloud_core
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -28,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_dns/default.nix b/pkgs/development/python-modules/google_cloud_dns/default.nix
index 3ed34303a727..08eb609e736d 100644
--- a/pkgs/development/python-modules/google_cloud_dns/default.nix
+++ b/pkgs/development/python-modules/google_cloud_dns/default.nix
@@ -5,6 +5,7 @@
 , google_cloud_core
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -28,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_error_reporting/default.nix b/pkgs/development/python-modules/google_cloud_error_reporting/default.nix
index ef07bf1a3cec..1527b9b65e91 100644
--- a/pkgs/development/python-modules/google_cloud_error_reporting/default.nix
+++ b/pkgs/development/python-modules/google_cloud_error_reporting/default.nix
@@ -4,6 +4,7 @@
 , google_cloud_logging
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -27,5 +28,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_logging/default.nix b/pkgs/development/python-modules/google_cloud_logging/default.nix
index c4d9a1cb8d55..e8c8e04bf9e0 100644
--- a/pkgs/development/python-modules/google_cloud_logging/default.nix
+++ b/pkgs/development/python-modules/google_cloud_logging/default.nix
@@ -8,6 +8,7 @@
 , webapp2
 , django
 , flask
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -31,5 +32,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
index 70dd5475c216..1cf673a26218 100644
--- a/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
+++ b/pkgs/development/python-modules/google_cloud_resource_manager/default.nix
@@ -5,6 +5,7 @@
 , google_api_core
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -28,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_runtimeconfig/default.nix b/pkgs/development/python-modules/google_cloud_runtimeconfig/default.nix
index a1628b991400..1b89f053f06b 100644
--- a/pkgs/development/python-modules/google_cloud_runtimeconfig/default.nix
+++ b/pkgs/development/python-modules/google_cloud_runtimeconfig/default.nix
@@ -5,6 +5,7 @@
 , google_cloud_core
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -28,5 +29,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_spanner/default.nix b/pkgs/development/python-modules/google_cloud_spanner/default.nix
index 80e88d53f1fc..60e5f25c35f5 100644
--- a/pkgs/development/python-modules/google_cloud_spanner/default.nix
+++ b/pkgs/development/python-modules/google_cloud_spanner/default.nix
@@ -7,6 +7,7 @@
 , google_cloud_core
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -30,5 +31,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_storage/default.nix b/pkgs/development/python-modules/google_cloud_storage/default.nix
index ff750602465b..4c222673f340 100644
--- a/pkgs/development/python-modules/google_cloud_storage/default.nix
+++ b/pkgs/development/python-modules/google_cloud_storage/default.nix
@@ -7,6 +7,7 @@
 , pytest
 , mock
 , setuptools
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -35,5 +36,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/google_cloud_translate/default.nix b/pkgs/development/python-modules/google_cloud_translate/default.nix
index 99494b6886cb..3bbbd381f84e 100644
--- a/pkgs/development/python-modules/google_cloud_translate/default.nix
+++ b/pkgs/development/python-modules/google_cloud_translate/default.nix
@@ -6,6 +6,7 @@
 , grpcio
 , pytest
 , mock
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -31,5 +32,6 @@ buildPythonPackage rec {
     homepage = https://github.com/GoogleCloudPlatform/google-cloud-python;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/gssapi/default.nix b/pkgs/development/python-modules/gssapi/default.nix
index 00c9b86c5eba..2ce2fe61cc67 100644
--- a/pkgs/development/python-modules/gssapi/default.nix
+++ b/pkgs/development/python-modules/gssapi/default.nix
@@ -14,6 +14,7 @@
 , cython
 , python
 , k5test
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -66,5 +67,6 @@ buildPythonPackage rec {
     homepage = https://pypi.python.org/pypi/gssapi;
     description = "Python GSSAPI Wrapper";
     license = licenses.mit;
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/gumath/default.nix b/pkgs/development/python-modules/gumath/default.nix
index 2937b876dec4..095a1b7b8d09 100644
--- a/pkgs/development/python-modules/gumath/default.nix
+++ b/pkgs/development/python-modules/gumath/default.nix
@@ -6,12 +6,13 @@
 , libxnd
 , libgumath
 , isPy27
+, isPy38
 }:
 
 buildPythonPackage {
   pname = "gumath";
   disabled = isPy27;
-  inherit (libgumath) src version meta;
+  inherit (libgumath) src version;
 
   checkInputs = [ numba ];
   propagatedBuildInputs = [ ndtypes xnd ];
@@ -25,4 +26,8 @@ buildPythonPackage {
       --replace 'add_runtime_library_dirs = ["$ORIGIN"]' \
                 'add_runtime_library_dirs = ["${libndtypes}/lib", "${libxnd}/lib", "${libgumath}/lib"]'
   '';
+
+  meta = libgumath.meta // {
+    broken = isPy38;
+  };
 }
diff --git a/pkgs/development/python-modules/howdoi/default.nix b/pkgs/development/python-modules/howdoi/default.nix
index 293ad51e302d..88ce50425ca7 100644
--- a/pkgs/development/python-modules/howdoi/default.nix
+++ b/pkgs/development/python-modules/howdoi/default.nix
@@ -5,6 +5,7 @@
 , requests-cache
 , pygments
 , pyquery
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -27,5 +28,6 @@ buildPythonPackage rec {
     homepage = https://pypi.python.org/pypi/howdoi;
     license = licenses.mit;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/hug/default.nix b/pkgs/development/python-modules/hug/default.nix
index bb38c7387607..042ad065595c 100644
--- a/pkgs/development/python-modules/hug/default.nix
+++ b/pkgs/development/python-modules/hug/default.nix
@@ -6,6 +6,7 @@
 , marshmallow
 , mock
 , numpy
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     description = "A Python framework that makes developing APIs as simple as possible, but no simpler";
     homepage = https://github.com/timothycrosley/hug;
     license = licenses.mit;
+    broken = isPy38;
   };
 
 }
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index 56aaf6ec71a5..018a5756b308 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -14,6 +14,7 @@
 , tables
 , pyarrow
 , graphviz
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -53,5 +54,6 @@ buildPythonPackage rec {
     homepage = https://github.com/ibis-project/ibis;
     license = licenses.asl20;
     maintainers = [ maintainers.costrouc ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/imbalanced-learn/default.nix b/pkgs/development/python-modules/imbalanced-learn/default.nix
index 568fc825ab6b..03b6348dc923 100644
--- a/pkgs/development/python-modules/imbalanced-learn/default.nix
+++ b/pkgs/development/python-modules/imbalanced-learn/default.nix
@@ -4,6 +4,7 @@
 , pytest
 , scikitlearn
 , tensorflow
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -32,5 +33,6 @@ buildPythonPackage rec {
     description = "Library offering a number of re-sampling techniques commonly used in datasets showing strong between-class imbalance";
     homepage = https://github.com/scikit-learn-contrib/imbalanced-learn;
     license = licenses.mit;
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/imgaug/default.nix b/pkgs/development/python-modules/imgaug/default.nix
index 48ea6004426c..ffa64153427b 100644
--- a/pkgs/development/python-modules/imgaug/default.nix
+++ b/pkgs/development/python-modules/imgaug/default.nix
@@ -9,6 +9,7 @@
 , shapely
 , six
 , stdenv
+, isPy38
 }:
 
 buildPythonPackage rec {
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     substituteInPlace requirements.txt \
       --replace "opencv-python-headless" ""
     substituteInPlace setup.py \
-      --replace "opencv-python-headless" "" 
+      --replace "opencv-python-headless" ""
     substituteInPlace pytest.ini \
       --replace "--xdoctest --xdoctest-global-exec=\"import imgaug as ia\nfrom imgaug import augmenters as iaa\"" ""
   '';
@@ -51,5 +52,6 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [ cmcdragonkai rakesh4g ];
     platforms = platforms.linux;
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/immutables/default.nix b/pkgs/development/python-modules/immutables/default.nix
index 8ca0fe6df9fb..4cce9351f298 100644
--- a/pkgs/development/python-modules/immutables/default.nix
+++ b/pkgs/development/python-modules/immutables/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder }:
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy38 }:
 
 buildPythonPackage rec {
   pname = "immutables";
@@ -15,5 +15,6 @@ buildPythonPackage rec {
     homepage = https://github.com/MagicStack/immutables;
     license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ catern ];
+    broken = isPy38;
   };
 }
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index 322b3e4c775e..104321a3255b 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -18,6 +18,7 @@
 , tornado
 , pytest
 , pythonOlder
+, isPy38
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/jug/default.nix b/pkgs/development/python-modules/jug/default.nix
index e962cc0bf864..095c929d68a8 100644
--- a/pkgs/development/python-modules/jug/default.nix
+++ b/pkgs/development/python-modules/jug/default.nix
@@ -1,7 +1,8 @@
 { stdenv, buildPythonPackage, fetchPypi, fetchpatch
 , nose, numpy
 , bottle, pyyaml, redis, six
-, zlib }:
+, zlib, isPy38
+}:
 
 buildPythonPackage rec {
   pname = "Jug";
diff --git a/pkgs/development/python-modules/junit-xml/default.nix b/pkgs/development/python-modules/junit-xml/default.nix
index 0a095b69aa05..41dba5493dc8 100644
--- a/pkgs/development/python-modules/junit-xml/default.nix
+++ b/pkgs/development/python-modules/junit-xml/default.nix
@@ -4,6 +4,7 @@
 , six
 , pytest
 , pytest-sugar
+, isPy38
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/python-modules/junos-eznc/default.nix b/pkgs/development/python-modules/junos-eznc/default.nix
index 1da34a064915..9ff6fb0c9bb2 100644
--- a/pkgs/development/python-modules/junos-eznc/default.nix
+++ b/pkgs/development/python-modules/junos-eznc/default.nix
@@ -11,6 +11,7 @@
 , jinja2
 , pyyaml
 , nose
+, isPy38
 }:
 
 buildPythonPackage rec {
diff --git a/pkgs/development/tools/build-managers/conan/default.nix b/pkgs/development/tools/build-managers/conan/default.nix
index 59b1b14ac5fa..8ddfd6b8e4ff 100644
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@@ -87,5 +87,6 @@ in newPython.pkgs.buildPythonApplication rec {
     license = licenses.mit;
     maintainers = with maintainers; [ HaoZeke ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/database/litecli/default.nix b/pkgs/development/tools/database/litecli/default.nix
index 8881bce1a388..429fa45d3b80 100644
--- a/pkgs/development/tools/database/litecli/default.nix
+++ b/pkgs/development/tools/database/litecli/default.nix
@@ -41,5 +41,6 @@ python3Packages.buildPythonApplication rec {
     homepage = https://litecli.com;
     license = licenses.bsd3;
     maintainers = with maintainers; [ Scriptkiddi ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
index bf1cae3edc72..c63c0868bec1 100644
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@@ -18,5 +18,6 @@ buildGoModule rec {
     homepage = "https://circleci.com/";
     license = licenses.mit;
     maintainers = with maintainers; [ filalex77 ];
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/parinfer-rust/default.nix b/pkgs/development/tools/parinfer-rust/default.nix
index 0d7c806d2f46..6ad9f2ca5675 100644
--- a/pkgs/development/tools/parinfer-rust/default.nix
+++ b/pkgs/development/tools/parinfer-rust/default.nix
@@ -32,5 +32,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.isc;
     maintainers = with maintainers; [ eraserhd ];
     platforms = platforms.all;
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/prospector/default.nix b/pkgs/development/tools/prospector/default.nix
index 38472ce86f01..2166c72c5a12 100644
--- a/pkgs/development/tools/prospector/default.nix
+++ b/pkgs/development/tools/prospector/default.nix
@@ -70,5 +70,6 @@ buildPythonApplication rec {
     maintainers = with maintainers; [
       kamadorueda
     ];
+    broken = true;
   };
 }
diff --git a/pkgs/games/atanks/default.nix b/pkgs/games/atanks/default.nix
index b11a177e0455..10ae0977fd6d 100644
--- a/pkgs/games/atanks/default.nix
+++ b/pkgs/games/atanks/default.nix
@@ -19,5 +19,6 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.raskin ];
     platforms = platforms.linux;
     license = licenses.gpl2;
+    broken = true;
   };
 }
diff --git a/pkgs/games/freeorion/default.nix b/pkgs/games/freeorion/default.nix
index dfad954f0f0c..320105430c0c 100644
--- a/pkgs/games/freeorion/default.nix
+++ b/pkgs/games/freeorion/default.nix
@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ gpl2 cc-by-sa-30 ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ tex ];
+    broken = true;
   };
 }
diff --git a/pkgs/games/lincity/ng.nix b/pkgs/games/lincity/ng.nix
index 67f15be1ed3e..cbcdbf8c1f61 100644
--- a/pkgs/games/lincity/ng.nix
+++ b/pkgs/games/lincity/ng.nix
@@ -51,5 +51,6 @@ stdenv.mkDerivation {
     license = licenses.gpl2;
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/games/onscripter-en/default.nix b/pkgs/games/onscripter-en/default.nix
index 2ad23a72368b..a4d7f99ad52a 100644
--- a/pkgs/games/onscripter-en/default.nix
+++ b/pkgs/games/onscripter-en/default.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation {
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ abbradar ];
+    broken = true;
   };
 }
diff --git a/pkgs/misc/emulators/atari800/default.nix b/pkgs/misc/emulators/atari800/default.nix
index 38dc54ea9d7b..bfe5afb50ac8 100644
--- a/pkgs/misc/emulators/atari800/default.nix
+++ b/pkgs/misc/emulators/atari800/default.nix
@@ -37,5 +37,6 @@ stdenv.mkDerivation rec{
     maintainers = [ maintainers.AndersonTorres ];
     license = licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/misc/emulators/hatari/default.nix b/pkgs/misc/emulators/hatari/default.nix
index 278d8d8dc5f3..dec3a5b26e49 100644
--- a/pkgs/misc/emulators/hatari/default.nix
+++ b/pkgs/misc/emulators/hatari/default.nix
@@ -19,5 +19,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [ ];
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/darwin/libtapi/default.nix b/pkgs/os-specific/darwin/libtapi/default.nix
index 182d1db3bfd5..f037fb756fca 100644
--- a/pkgs/os-specific/darwin/libtapi/default.nix
+++ b/pkgs/os-specific/darwin/libtapi/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     license = licenses.apsl20;
     maintainers = with maintainers; [ matthewbauer ];
+    broken = true;
   };
 
 }
diff --git a/pkgs/servers/monitoring/plugins/esxi.nix b/pkgs/servers/monitoring/plugins/esxi.nix
index dfa13c805e59..d076a96cd9fe 100644
--- a/pkgs/servers/monitoring/plugins/esxi.nix
+++ b/pkgs/servers/monitoring/plugins/esxi.nix
@@ -33,5 +33,6 @@ in python2Packages.buildPythonApplication rec {
     homepage = https://www.claudiokuenzler.com/nagios-plugins/;
     license = licenses.gpl2;
     maintainers = with maintainers; [ peterhoeg ];
+    broken = true;
   };
 }
diff --git a/pkgs/servers/sql/percona/5.6.x.nix b/pkgs/servers/sql/percona/5.6.x.nix
index 860c1f8e94f7..756e96c54ed0 100644
--- a/pkgs/servers/sql/percona/5.6.x.nix
+++ b/pkgs/servers/sql/percona/5.6.x.nix
@@ -57,5 +57,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl2;
     maintainers = with maintainers; [ grahamc ];
+    broken = true;
   };
 }
diff --git a/pkgs/shells/dgsh/default.nix b/pkgs/shells/dgsh/default.nix
index e2fd845c286e..762afe0af20b 100644
--- a/pkgs/shells/dgsh/default.nix
+++ b/pkgs/shells/dgsh/default.nix
@@ -41,5 +41,6 @@ stdenv.mkDerivation {
     license = with licenses; asl20;
     maintainers = with maintainers; [ vrthra ];
     platforms = with platforms; all;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/X11/ncview/default.nix b/pkgs/tools/X11/ncview/default.nix
index 1f793aa6c4c9..eb084f24392e 100644
--- a/pkgs/tools/X11/ncview/default.nix
+++ b/pkgs/tools/X11/ncview/default.nix
@@ -21,5 +21,6 @@ in stdenv.mkDerivation {
     homepage    = "http://meteora.ucsd.edu/~pierce/ncview_home_page.html";
     license = licenses.gpl3;
     maintainers = with maintainers; [ jmettes ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/audio/google-music-scripts/default.nix b/pkgs/tools/audio/google-music-scripts/default.nix
index f7e96971ab19..1aed00517477 100644
--- a/pkgs/tools/audio/google-music-scripts/default.nix
+++ b/pkgs/tools/audio/google-music-scripts/default.nix
@@ -31,5 +31,6 @@ python3.pkgs.buildPythonApplication rec {
     description = "A CLI utility for interacting with Google Music";
     license = licenses.mit;
     maintainers = with maintainers; [ jakewaksbaum ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index 4a18deeb57c8..c6ee8125f9ff 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -39,5 +39,6 @@ stdenv.mkDerivation {
     license = stdenv.lib.licenses.gpl2;
     maintainers = [stdenv.lib.maintainers.marcweber];
     platforms = stdenv.lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/compression/lbzip2/default.nix b/pkgs/tools/compression/lbzip2/default.nix
index 7e9cc055abf5..baf429007150 100644
--- a/pkgs/tools/compression/lbzip2/default.nix
+++ b/pkgs/tools/compression/lbzip2/default.nix
@@ -14,5 +14,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ abbradar ];
     platforms = platforms.unix;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/filesystems/lizardfs/default.nix b/pkgs/tools/filesystems/lizardfs/default.nix
index 3ae898d4ba8a..05fa059a2d62 100644
--- a/pkgs/tools/filesystems/lizardfs/default.nix
+++ b/pkgs/tools/filesystems/lizardfs/default.nix
@@ -55,5 +55,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl3;
     maintainers = [ maintainers.rushmorem ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/filesystems/orangefs/default.nix b/pkgs/tools/filesystems/orangefs/default.nix
index 37f4026799b6..6eb0b7fab273 100644
--- a/pkgs/tools/filesystems/orangefs/default.nix
+++ b/pkgs/tools/filesystems/orangefs/default.nix
@@ -57,5 +57,6 @@ stdenv.mkDerivation rec {
     license = with licenses;  [ asl20 bsd3 gpl2 lgpl21 lgpl21Plus openldap ];
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ markuskowa ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/misc/bmap-tools/default.nix b/pkgs/tools/misc/bmap-tools/default.nix
index 6b7a51e08f51..44d111689530 100644
--- a/pkgs/tools/misc/bmap-tools/default.nix
+++ b/pkgs/tools/misc/bmap-tools/default.nix
@@ -17,5 +17,6 @@ python2Packages.buildPythonApplication rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.dezgeg ];
     platforms = platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/tools/misc/ntfy/default.nix b/pkgs/tools/misc/ntfy/default.nix
index 26517361ae2d..4ad633c9ae7d 100644
--- a/pkgs/tools/misc/ntfy/default.nix
+++ b/pkgs/tools/misc/ntfy/default.nix
@@ -33,5 +33,6 @@ pythonPackages.buildPythonApplication rec {
     homepage = http://ntfy.rtfd.org/;
     license = licenses.gpl3;
     maintainers = with maintainers; [ jfrankenau kamilchm ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/networking/ip2unix/default.nix b/pkgs/tools/networking/ip2unix/default.nix
index d2dbd235e11c..7fb80d8bc29f 100644
--- a/pkgs/tools/networking/ip2unix/default.nix
+++ b/pkgs/tools/networking/ip2unix/default.nix
@@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.lgpl3;
     maintainers = [ stdenv.lib.maintainers.aszlig ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 53369baa01c8..79f0058e9d6d 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -79,5 +79,6 @@ buildPythonPackage rec {
     homepage    = https://mitmproxy.org/;
     license     = licenses.mit;
     maintainers = with maintainers; [ fpletz kamilchm ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/networking/packetdrill/default.nix b/pkgs/tools/networking/packetdrill/default.nix
index 623645efc0ca..1e59d65d68b3 100644
--- a/pkgs/tools/networking/packetdrill/default.nix
+++ b/pkgs/tools/networking/packetdrill/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation {
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [ dmjio cleverca22 ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/networking/py-wmi-client/default.nix b/pkgs/tools/networking/py-wmi-client/default.nix
index 7a2774002891..e29670a38bfa 100644
--- a/pkgs/tools/networking/py-wmi-client/default.nix
+++ b/pkgs/tools/networking/py-wmi-client/default.nix
@@ -21,5 +21,6 @@ pythonPackages.buildPythonApplication rec {
     homepage = "https://github.com/dlundgren/py-wmi-client";
     license = licenses.mit;
     maintainers = with maintainers; [ peterhoeg ];
+    broken = true;
   };
 }
diff --git a/pkgs/tools/package-management/cargo-download/default.nix b/pkgs/tools/package-management/cargo-download/default.nix
index 1cb53a4b6c8d..b86201fcc9bf 100644
--- a/pkgs/tools/package-management/cargo-download/default.nix
+++ b/pkgs/tools/package-management/cargo-download/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchgit, darwin, buildPlatform
 , buildRustCrate, buildRustCrateHelpers, defaultCrateOverrides }:
 
-((import ./Cargo.nix {
+(((import ./Cargo.nix {
   inherit lib buildPlatform buildRustCrate buildRustCrateHelpers fetchgit;
   cratesIO = import ./crates-io.nix { inherit lib buildRustCrate buildRustCrateHelpers; };
 }).cargo_download {}).override {
@@ -11,4 +11,8 @@
         darwin.apple_sdk.frameworks.Security;
     };
   };
-}
+}).overrideAttrs ({ meta ? {}, ... }: {
+  meta = meta // {
+    broken = true;
+  };
+})
diff --git a/pkgs/tools/security/gencfsm/default.nix b/pkgs/tools/security/gencfsm/default.nix
index 63d1bab89d7f..ee11433af7d9 100644
--- a/pkgs/tools/security/gencfsm/default.nix
+++ b/pkgs/tools/security/gencfsm/default.nix
@@ -35,5 +35,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.spacefrogg ];
+    broken = true;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3952454069df..70185154ad0e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15574,7 +15574,7 @@ in
   mysql = mariadb; # TODO: move to aliases.nix
 
   mongodb = hiPrio mongodb-3_4;
-  
+
   mongodb-3_4 = callPackage ../servers/nosql/mongodb/v3_4.nix {
     sasl = cyrus_sasl;
     boost = boost160;
diff --git a/pkgs/top-level/dotnet-packages.nix b/pkgs/top-level/dotnet-packages.nix
index 35cbcebb2422..fae0909545e9 100644
--- a/pkgs/top-level/dotnet-packages.nix
+++ b/pkgs/top-level/dotnet-packages.nix
@@ -562,6 +562,7 @@ let self = dotnetPackages // overrides; dotnetPackages = with self; {
       license = stdenv.lib.licenses.asl20;
       maintainers = with stdenv.lib.maintainers; [ obadz ];
       platforms = with stdenv.lib.platforms; linux;
+      broken = true;
     };
   };
 
@@ -589,6 +590,7 @@ let self = dotnetPackages // overrides; dotnetPackages = with self; {
       license = stdenv.lib.licenses.asl20;
       maintainers = with stdenv.lib.maintainers; [ obadz ];
       platforms = with stdenv.lib.platforms; linux;
+      broken = true;
     };
   };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5199634c5bde..076cc1901371 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1681,7 +1681,7 @@ in {
 
   asn1ate = callPackage ../development/python-modules/asn1ate { };
 
-  atlassian-python-api = callPackage ../development/python-modules/atlassian-python-api { };  
+  atlassian-python-api = callPackage ../development/python-modules/atlassian-python-api { };
 
   atomiclong = callPackage ../development/python-modules/atomiclong { };
 
@@ -3605,9 +3605,13 @@ in {
 
   folium = callPackage ../development/python-modules/folium { };
 
-  fontforge = toPythonModule (pkgs.fontforge.override {
+  fontforge = (toPythonModule (pkgs.fontforge.override {
     withPython = true;
     inherit python;
+  })).overrideAttrs (old: {
+    meta = old.meta // {
+      broken = isPy38;
+    };
   });
 
   fonttools = callPackage ../development/python-modules/fonttools { };
@@ -4371,7 +4375,7 @@ in {
 
   nbconvert = callPackage ../development/python-modules/nbconvert { };
 
-  nbformat = if isPy3k then 
+  nbformat = if isPy3k then
     callPackage ../development/python-modules/nbformat { }
   else callPackage ../development/python-modules/nbformat/2.nix { };
 

From 4ed0ab5a8d2f837f41195179f0f25a1432b840d8 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Mon, 23 Mar 2020 02:28:37 +0000
Subject: [PATCH 21/59] libinstpatch: init at 1.1.4

cherry picked from commits:
f4c15495a663161a1a5a0085642d35dea2ce4a9c
577ab2b68bd28e1e81a5326d19e96aded0fe38b7
49e2a18dbdc51fcfd85460701407890cbf35b971
---
 .../libraries/audio/libinstpatch/default.nix  | 29 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 31 insertions(+)
 create mode 100644 pkgs/development/libraries/audio/libinstpatch/default.nix

diff --git a/pkgs/development/libraries/audio/libinstpatch/default.nix b/pkgs/development/libraries/audio/libinstpatch/default.nix
new file mode 100644
index 000000000000..e5f1080631e4
--- /dev/null
+++ b/pkgs/development/libraries/audio/libinstpatch/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, cmake, pkg-config, glib, libsndfile }:
+
+stdenv.mkDerivation rec {
+  pname = "libinstpatch";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "swami";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1v7mv43xxwrzi3agrc60agcw46jaidr8ql9kkm1w4jxkf4c6z6dz";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  propagatedBuildInputs = [ glib libsndfile ]; # Both are needed for includes.
+
+  cmakeFlags = [
+    "-DLIB_SUFFIX=" # Install in $out/lib.
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.swamiproject.org/";
+    description = "MIDI instrument patch files support library";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ orivej ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d5692e7238b4..be8d95726c26 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12803,6 +12803,8 @@ in
 
   libinput-gestures = callPackage ../tools/inputmethods/libinput-gestures {};
 
+  libinstpatch = callPackage ../development/libraries/audio/libinstpatch { };
+
   libisofs = callPackage ../development/libraries/libisofs { };
 
   libisoburn = callPackage ../development/libraries/libisoburn { };

From 47bf53ea4036b636976373aa00abd3bf97ab5806 Mon Sep 17 00:00:00 2001
From: Orivej Desh <orivej@gmx.fr>
Date: Sun, 22 Mar 2020 22:56:15 +0000
Subject: [PATCH 22/59] muse: 3.1pre1 -> 3.1.0

cherry picked from commits:
624c83f70a319b0be4e84a336c1ae91da44b7853
3c23cf90509caf29240049c0439b373559bbdd26
d5b27c6c749d533d5d8699e57a50803d29ad6f68
---
 pkgs/applications/audio/muse/default.nix      | 82 +++++++------------
 .../audio/muse/fix-parallel-building.patch    | 78 ++++++++++++++++++
 2 files changed, 107 insertions(+), 53 deletions(-)
 create mode 100644 pkgs/applications/audio/muse/fix-parallel-building.patch

diff --git a/pkgs/applications/audio/muse/default.nix b/pkgs/applications/audio/muse/default.nix
index 7bff8bf2f6e8..a01441698502 100644
--- a/pkgs/applications/audio/muse/default.nix
+++ b/pkgs/applications/audio/muse/default.nix
@@ -1,25 +1,33 @@
-{ stdenv
-, fetchFromGitHub
-, libjack2
-, wrapQtAppsHook
-, qtsvg
-, qttools
-, cmake
-, libsndfile
-, libsamplerate
-, ladspaH
-, fluidsynth
-, alsaLib
-, rtaudio
-, lash
-, dssi
-, liblo
-, pkgconfig
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, qttools, wrapQtAppsHook
+, alsaLib, dssi, fluidsynth, ladspaH, lash, libinstpatch, libjack2, liblo
+, libsamplerate, libsndfile, lilv, librdf, lv2, qtsvg, rtaudio, rubberband, sord
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "muse-sequencer";
-  version = "3.1pre1";
+  version = "3.1.0";
+
+  src = fetchFromGitHub {
+    owner = "muse-sequencer";
+    repo = "muse";
+    rev = "muse_${builtins.replaceStrings ["."] ["_"] version}";
+    sha256 = "08k25652w88xf2i79lw305x1phpk7idrww9jkqwcs8q6wzgmz8aq";
+  };
+
+  sourceRoot = "source/muse3";
+
+  prePatch = ''
+    chmod u+w $NIX_BUILD_TOP
+  '';
+
+  patches = [ ./fix-parallel-building.patch ];
+
+  nativeBuildInputs = [ cmake pkgconfig qttools wrapQtAppsHook ];
+
+  buildInputs = [
+    alsaLib dssi fluidsynth ladspaH lash libinstpatch libjack2 liblo
+    libsamplerate libsndfile lilv librdf lv2 qtsvg rtaudio rubberband sord
+  ];
 
   meta = with stdenv.lib; {
     homepage = "https://www.muse-sequencer.org/";
@@ -32,39 +40,7 @@ stdenv.mkDerivation {
       MusE aims to be a complete multitrack virtual studio for Linux,
       it is published under the GNU General Public License.
     '';
-    license = stdenv.lib.licenses.gpl2;
-    broken = true;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ orivej ];
   };
-
-  src =
-    fetchFromGitHub {
-      owner = "muse-sequencer";
-      repo = "muse";
-      rev = "2167ae053c16a633d8377acdb1debaac10932838";
-      sha256 = "0rsdx8lvcbz5bapnjvypw8h8bq587s9z8cf2znqrk6ah38s6fsrf";
-    };
-
-
-  nativeBuildInputs = [
-    pkgconfig
-    wrapQtAppsHook
-    qttools
-    cmake
-  ];
-
-  buildInputs = [
-    libjack2
-    qtsvg
-    libsndfile
-    libsamplerate
-    ladspaH
-    fluidsynth
-    alsaLib
-    rtaudio
-    lash
-    dssi
-    liblo
-  ];
-
-  sourceRoot = "source/muse3";
 }
diff --git a/pkgs/applications/audio/muse/fix-parallel-building.patch b/pkgs/applications/audio/muse/fix-parallel-building.patch
new file mode 100644
index 000000000000..abeec5d54cc0
--- /dev/null
+++ b/pkgs/applications/audio/muse/fix-parallel-building.patch
@@ -0,0 +1,78 @@
+To confirm these dependencies, run in a fresh build tree:
+
+
+ninja muse/components/CMakeFiles/components.dir/confmport.o
+
+In file included from ../muse/components/confmport.cpp:48:
+../muse/mplugins/midifilterimpl.h:28:10: fatal error:
+ui_midifilter.h: No such file or directory
+
+
+ninja muse/waveedit/CMakeFiles/waveedit.dir/wavecanvas.o
+
+In file included from ../muse/waveedit/wavecanvas.cpp:72:
+../muse/components/copy_on_write.h:26:10: fatal error:
+ui_copy_on_write_base.h: No such file or directory
+
+
+ninja muse/instruments/CMakeFiles/instruments.dir/editinstrument.o
+
+In file included from ../muse/instruments/editinstrument.cpp:58:
+../muse/components/editevent.h:26:10: fatal error:
+ui_editnotedialogbase.h: No such file or directory
+
+
+ninja muse/liste/CMakeFiles/liste.dir/listedit.o
+
+In file included from ../muse/liste/listedit.cpp:37:
+../muse/components/editevent.h:26:10: fatal error:
+ui_editnotedialogbase.h: No such file or directory
+
+
+ninja muse/mixer/CMakeFiles/mixer.dir/rack.o
+
+In file included from ../muse/mixer/rack.cpp:49:
+../muse/components/plugindialog.h:4:10: fatal error:
+ui_plugindialogbase.h: No such file or directory
+
+
+--- a/muse/components/CMakeLists.txt
++++ b/muse/components/CMakeLists.txt
+@@ -343,4 +343,5 @@ set_target_properties( components
+ target_link_libraries ( components
+       ${QT_LIBRARIES}
++      mplugins
+       widgets
+       xml_module
+--- a/muse/waveedit/CMakeLists.txt
++++ b/muse/waveedit/CMakeLists.txt
+@@ -79,4 +79,5 @@ set_target_properties( waveedit
+ target_link_libraries( waveedit
+       ${QT_LIBRARIES}
++      components
+       widgets
+       )
+--- a/muse/instruments/CMakeLists.txt
++++ b/muse/instruments/CMakeLists.txt
+@@ -78,4 +78,5 @@ set_target_properties( instruments
+ target_link_libraries ( instruments
+       ${QT_LIBRARIES}
++      components
+       icons
+       widgets
+--- a/muse/liste/CMakeLists.txt
++++ b/muse/liste/CMakeLists.txt
+@@ -65,4 +65,5 @@ set_target_properties( liste
+ target_link_libraries ( liste
+       ${QT_LIBRARIES}
++      components
+       awl
+       widgets
+--- a/muse/mixer/CMakeLists.txt
++++ b/muse/mixer/CMakeLists.txt
+@@ -87,4 +87,5 @@ set_target_properties ( mixer
+ target_link_libraries ( mixer
+       ${QT_LIBRARIES}
++      components
+       widgets
+       )

From a5f5386b5ce1f6c0f8f02a261798cd6d3530c453 Mon Sep 17 00:00:00 2001
From: Roman Kuznetsov <roman@kuznero.com>
Date: Tue, 14 Apr 2020 22:36:06 +0200
Subject: [PATCH 23/59] vscode: 1.44.0 -> 1.44.1

(cherry picked from commit 4a129e6a3205e9fd7ea9a2cd7c65a90d2b4f0f71)
---
 pkgs/applications/editors/vscode/vscode.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 765520ea9a4c..5496fdfcf426 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0q1fk5a4ymndnyxzps8960y1rl657q95i2rydbqyjl37y79wmllx";
-    x86_64-darwin = "02ybgp6v1ray4a867hihp2fvc872ilqla6z52qv90dfjx69g77ib";
+    x86_64-linux = "15jg39hmlnicq0zrz77yar1bmn5y6gp2670dya2qm5klhva9hd0f";
+    x86_64-darwin = "1ghqhn46jpbj3is8q5zcj0biyc7gwinhiz3qdpcnf88ga2blcsz8";
   }.${system};
 in
   callPackage ./generic.nix rec {
@@ -21,7 +21,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.44.0";
+    version = "1.44.1";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";

From 41ed7bf2ef28c8f1688a10232760361c19ad71f3 Mon Sep 17 00:00:00 2001
From: Roman Kuznetsov <roman@kuznero.com>
Date: Thu, 16 Apr 2020 22:31:00 +0200
Subject: [PATCH 24/59] vscodium: 1.44.0 -> 1.44.1

(cherry picked from commit 4fd1f49ea47148bb423c4de13f21e5b7ead9ecb4)
---
 pkgs/applications/editors/vscode/vscodium.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 23a320ccce93..5004a58782b3 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1prv4rzr5z905s6jnmkmd97zr5kz8nn4m9bil483bnx4wqr2k10g";
-    x86_64-darwin = "1p0a94i80s7fq6ars01bvr41qxiq35s0r6crfv857ma01g9ia7k3";
+    x86_64-linux = "16qwhnxpwarnwvlxwvy13g687g1cnfzysq16qkykkhqig0cnalmb";
+    x86_64-darwin = "1p9qkbj59bfc0kn9fzg99gqxbzwxq297qxivxcjflsapd712s4vm";
   }.${system};
 
   sourceRoot = {
@@ -27,7 +27,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.44.0";
+    version = "1.44.1";
     pname = "vscodium";
 
     executableName = "codium";

From 9094d3592533ec3708414193ae1ce63a246a648b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 17 Apr 2020 11:22:35 +0100
Subject: [PATCH 25/59] python38.pkgs.python-jsonrpc-server: disable for
 python38

(cherry picked from commit ee6f5a32bb090ddacee9f40056a5598b2f10480a)
---
 .../python-modules/python-jsonrpc-server/default.nix         | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-jsonrpc-server/default.nix b/pkgs/development/python-modules/python-jsonrpc-server/default.nix
index 0b1bd73469d5..320142acb835 100644
--- a/pkgs/development/python-modules/python-jsonrpc-server/default.nix
+++ b/pkgs/development/python-modules/python-jsonrpc-server/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
 , pytest, mock, pytestcov, coverage
-, future, futures
+, future, futures, isPy38
 }:
 
 buildPythonPackage rec {
@@ -26,6 +26,8 @@ buildPythonPackage rec {
     pytest
   '';
 
+  disabled = isPy38;
+
   propagatedBuildInputs = [ future ]
     ++ stdenv.lib.optional (pythonOlder "3.2") futures;
 
@@ -34,6 +36,5 @@ buildPythonPackage rec {
     description = "A Python 2 and 3 asynchronous JSON RPC server";
     license = licenses.mit;
     maintainers = [ maintainers.mic92 ];
-    broken = true;
   };
 }

From b27ac930540562d9b7f33d14ff9aa6a05d4d0009 Mon Sep 17 00:00:00 2001
From: Symphorien Gibol <symphorien+git@xlumurb.eu>
Date: Fri, 17 Apr 2020 12:00:00 +0000
Subject: [PATCH 26/59] paperwork: unmark as broken on x86

---
 pkgs/applications/office/paperwork/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/office/paperwork/default.nix b/pkgs/applications/office/paperwork/default.nix
index 2dde374e1541..9aeb40b6c147 100644
--- a/pkgs/applications/office/paperwork/default.nix
+++ b/pkgs/applications/office/paperwork/default.nix
@@ -2,6 +2,7 @@
 , aspellDicts, buildEnv
 , gnome3, librsvg
 , xvfb_run, dbus, libnotify
+, stdenv
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -77,6 +78,6 @@ python3Packages.buildPythonApplication rec {
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.aszlig ];
     platforms = lib.platforms.linux;
-    broken = true;
+    broken = stdenv.isAarch64;
   };
 }

From ca713d3f76e49490a25d3c63ffb2d1aaad0aff02 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Fri, 17 Apr 2020 08:29:21 -0400
Subject: [PATCH 27/59] linux: 4.19.115 -> 4.19.116

(cherry picked from commit d9258d33be5b46ff2661580707f8e46195b61bcc)
---
 pkgs/os-specific/linux/kernel/linux-4.19.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 142cf0aaf929..cdb19fd54ab7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.115";
+  version = "4.19.116";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1hh170z3mv181l6cc6qqc12wif5jsmxbh2qxbq6b9km5irydkchi";
+    sha256 = "0r3vdc3npl1bn06w9v6wsq7d5mm7bnhm9wsz36pb9ar3xhimvrlf";
   };
 } // (args.argsOverride or {}))

From edd58cf4a7b3bd58813a2fcda4e7c3ad31bd4654 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Fri, 17 Apr 2020 08:29:34 -0400
Subject: [PATCH 28/59] linux: 5.4.32 -> 5.4.33

(cherry picked from commit e341107367f77c6b961afd1e6b6de274d1b89dd5)
---
 pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index f4293b5bffc0..b2de6ea86899 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.32";
+  version = "5.4.33";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1czjjnln1cqrnjxw0md6mpw9haw9abdyvmxnjds56ym4nzx9jb8r";
+    sha256 = "0q9q48ij6vppfcrdf7fr24pvpwsd13pxjkdni6rnjq9a60hrcmxm";
   };
 } // (args.argsOverride or {}))

From a96fbaac8c131d35fe8e6cf3855c8ecd148664e0 Mon Sep 17 00:00:00 2001
From: nschoe <nschoe@protonmail.com>
Date: Fri, 17 Apr 2020 14:50:08 +0100
Subject: [PATCH 29/59] st: copy config file in 'prePatch' instead of
 'preBuild'

The patch phase runs after the build phase. Which means than when
using an override to override both 'conf' and 'patches' to provide
a custom config file and apply some patches, it doesn't work:
- first the patches applied (optionally changing config.def.h)
- then preBuild is run which overrides config.def.h with the user
supplied one (effectively cancelling previously applied patches)

By copying the config file in the prePatch phase instead, changes
are kept and applied in order.

(cherry picked from commit b584941ab9b5df164adc4584c3ab21da681a01db)
---
 pkgs/applications/misc/st/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/st/default.nix b/pkgs/applications/misc/st/default.nix
index 47d7279a47fa..332a5382fedc 100644
--- a/pkgs/applications/misc/st/default.nix
+++ b/pkgs/applications/misc/st/default.nix
@@ -13,8 +13,9 @@ stdenv.mkDerivation rec {
 
   inherit patches;
 
-  configFile = optionalString (conf!=null) (writeText "config.def.h" conf);
-  preBuild = optionalString (conf!=null) "cp ${configFile} config.def.h";
+  prePatch = optionalString (conf != null) ''
+    cp ${writeText "config.def.h" conf} config.def.h
+  '';
 
   nativeBuildInputs = [ pkgconfig ncurses ];
   buildInputs = [ libX11 libXft ] ++ extraLibs;

From 8e053b9b2a9c202e0c1f337863c9b0abf5293349 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dominik=20Xaver=20H=C3=B6rl?= <hoe.dom@gmx.de>
Date: Fri, 13 Mar 2020 20:15:12 +0100
Subject: [PATCH 30/59] neomutt: configure with zlib to enable imap compression

(cherry picked from commit 45cc3c986d0a8cc6523f6e1085536de1f6d02aca)
---
 pkgs/applications/networking/mailreaders/neomutt/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index f819760f042c..bcd35510dce3 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap, runtimeShell, sqlite
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap, runtimeShell, sqlite, zlib
 }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    docbook_xsl docbook_xml_dtd_42 gettext libxml2 libxslt.bin makeWrapper tcl which
+    docbook_xsl docbook_xml_dtd_42 gettext libxml2 libxslt.bin makeWrapper tcl which zlib
   ];
 
   enableParallelBuilding = true;
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
     "--with-mailpath="
     # Look in $PATH at runtime, instead of hardcoding /usr/bin/sendmail
     "ac_cv_path_SENDMAIL=sendmail"
+    "--zlib"
   ];
 
   # Fix missing libidn in mutt;

From e3354dfc8c35f13c6cb4cae79cd9b1ac33160c53 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 17 Apr 2020 18:02:46 +0200
Subject: [PATCH 31/59] neomutt: 20200320 -> 20200417

https://github.com/neomutt/neomutt/releases/tag/20200417

To fix the tests, I had to copy the recently created
`neomutt-test-files`[1] repository into the build-environment.

Also applied a patch from master[2] which ensures that the
`change-folder` macro actually switches to the specified folder.

[1] https://github.com/neomutt/neomutt-test-files
[2] https://github.com/neomutt/neomutt/commit/9e7537caddb9c6adc720bb3322a7512cf51ab025

(cherry picked from commit 192485f8fab8bd7dce972ff46aa5d8012d5adc09)
---
 .../mailreaders/neomutt/default.nix           | 27 +++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index bcd35510dce3..19c14858d6d4 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -1,19 +1,29 @@
 { stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
 , lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap, runtimeShell, sqlite, zlib
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200320";
+  version = "20200417";
   pname = "neomutt";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = version;
-    sha256 = "06xcl9pr8dna4kqjaqm7ss50gdy185425bwl31i0xs3l11cyjap4";
+    sha256 = "0s7943r2s14kavyjf7i70vca252l626539i09a9vk0i9sfi35vx5";
   };
 
+  patches = [
+    # Remove on next release. Fixes the `change-folder`
+    # macro (https://github.com/neomutt/neomutt/issues/2268)
+    (fetchpatch {
+      url = "https://github.com/neomutt/neomutt/commit/9e7537caddb9c6adc720bb3322a7512cf51ab025.patch";
+      sha256 = "1vmlvgnhx1ra3rnyjkpkv6lrqw8xfh2kkmqp43fqn9lnk3pkjxvv";
+    })
+  ];
+
   buildInputs = [
     cyrus_sasl gss gpgme kerberos libidn ncurses
     notmuch openssl perl lmdb
@@ -75,7 +85,20 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  preCheck = ''
+    cp -r ${fetchFromGitHub {
+      owner = "neomutt";
+      repo = "neomutt-test-files";
+      rev = "1ee274e9ae1330fb901eb7b8275b3079d7869222";
+      sha256 = "0dhilz4rr7616jh8jcvh50a3rr09in43nsv72mm6f3vfklcqincp";
+    }} $(pwd)/test-files
+    (cd test-files && ./setup.sh)
+
+    export NEOMUTT_TEST_DIR=$(pwd)/test-files
+  '';
+
   checkTarget = "test";
+  postCheck = "unset NEOMUTT_TEST_DIR";
 
   meta = with stdenv.lib; {
     description = "A small but very powerful text-based mail client";

From 668d0ded6bb3c628c764efba7eefca77bea740cb Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 17 Apr 2020 22:01:55 +0200
Subject: [PATCH 32/59] grocy: 2.7.0 -> 2.7.1

https://github.com/grocy/grocy/releases/tag/v2.7.1
(cherry picked from commit 135ae45d24e4dfe177c8511ce76815e21c6108cd)
---
 pkgs/servers/grocy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/grocy/default.nix b/pkgs/servers/grocy/default.nix
index 29eb2b22a636..bac6fb71dbc4 100644
--- a/pkgs/servers/grocy/default.nix
+++ b/pkgs/servers/grocy/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grocy";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchurl {
     url = "https://github.com/grocy/grocy/releases/download/v${version}/grocy_${version}.zip";
-    sha256 = "10da7s8yc3adqzd8446ksgq61zyzxb4qbnwkzj11qh64y5hyj50q";
+    sha256 = "0ab1yxj499vadakq2c1lils3ir6fm02wrdgrirrlar4s4z6c4p7r";
   };
 
   nativeBuildInputs = [ unzip ];

From 21c4a33ceef77dec2b821f7164e13971862d5575 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Thu, 16 Apr 2020 13:38:15 +0200
Subject: [PATCH 33/59] rl-2003: Update the release documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It currently says that everything will be backward compatible between lego and simp-le certificates, but it’s not.
---
 nixos/doc/manual/release-notes/rl-2003.xml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index 8f97de24ab12..2f12b0adc023 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -1145,9 +1145,11 @@ systemd.services.nginx.serviceConfig.User = lib.mkForce "root";
      As well as this, the options <literal>security.acme.acceptTerms</literal> and either
      <literal>security.acme.email</literal> or <literal>security.acme.certs.&lt;name&gt;.email</literal>
      must be set in order to use the ACME module.
-     Certificates will be regenerated anew on the next renewal date. The credentials for simp-le are
-     preserved and thus it is possible to roll back to previous versions without breaking certificate
-     generation.
+     Certificates will be regenerated on activation, no account or certificate will be migrated from simp-le.
+     In particular private keys will not be preserved. However, the credentials for simp-le are preserved and
+     thus it is possible to roll back to previous versions without breaking certificate generation.
+     Note also that in contrary to simp-le a new private key is recreated at each renewal by default, which can
+     have consequences if you embed your public key in apps.
     </para>
    </listitem>
    <listitem>

From 2e08e8cb2602b87b367320cdc26391be13e8c5d5 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 17 Apr 2020 23:01:38 +0200
Subject: [PATCH 34/59] mitmproxy: fix build

ZHF: #80379
---
 pkgs/tools/networking/mitmproxy/default.nix | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index 79f0058e9d6d..f252b51e18db 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
       # https://github.com/mitmproxy/mitmproxy/issues/3459
       # TODO: remove on next update
       name = "wsproto-0.13.patch";
-      url = https://github.com/mitmproxy/mitmproxy/commit/70777a1b6ed64af9cafcdef223a8a260ecc96864.patch;
+      url = "https://github.com/mitmproxy/mitmproxy/commit/70777a1b6ed64af9cafcdef223a8a260ecc96864.patch";
       sha256 = "1ddxdr7js510kzyq3gyks4k5k1n8zb1i9amxw7wzmi1dcg8kqw9a";
       # We strip these bounds anyway
       excludes = [ "setup.py" ];
@@ -37,11 +37,19 @@ buildPythonPackage rec {
       # https://github.com/mitmproxy/mitmproxy/issues/3403
       # TODO: remove on next update
       name = "dont-call-fixtures.patch";
-      url = https://github.com/mitmproxy/mitmproxy/commit/ce28721458c8cc71de86513a5110676e9763041b.patch;
+      url = "https://github.com/mitmproxy/mitmproxy/commit/ce28721458c8cc71de86513a5110676e9763041b.patch";
       sha256 = "05pljr28lx7l1xgswqr9sz8dnhvc7npzh8xg2p9hignf159kd54d";
       # Irrelevant in nixpkgs
       excludes = [ "setup.py" "setup.cfg" "release/docker/*" ];
     })
+    (fetchpatch {
+      # Fix for OpenSSL 1.1.1f
+      # https://github.com/mitmproxy/mitmproxy/pull/3692#issuecomment-608454530
+      # TODO: remove on next update
+      name = "temporarily-fix-key-logging.patch";
+      url = "https://github.com/mitmproxy/mitmproxy/commit/4bfb81c0089d0e0c1c24739f01fca41a3f055f3a.diff";
+      sha256 = "18yd6alalzq08biikc4aywhvfslz55fpxhixs9id1zzaf6c0vr45";
+    })
     ./pytest5.patch
   ];
 
@@ -79,6 +87,5 @@ buildPythonPackage rec {
     homepage    = https://mitmproxy.org/;
     license     = licenses.mit;
     maintainers = with maintainers; [ fpletz kamilchm ];
-    broken = true;
   };
 }

From ed20edf012bfda57d9cb70463b6ba8a422148b55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Thu, 16 Apr 2020 12:32:47 +0200
Subject: [PATCH 35/59] nixos/acme: Fix postRun in acme certificate being ran
 at every run

(cherry picked from commit 8e88b8dce2826d4b3a55c9ac182574a69caf26a2)
---
 nixos/modules/security/acme.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
index 782a4f96782b..4f860b08c6f6 100644
--- a/nixos/modules/security/acme.nix
+++ b/nixos/modules/security/acme.nix
@@ -325,7 +325,9 @@ in
 
                           # Test that existing cert is older than new cert
                           KEY=${spath}/certificates/${keyName}.key
+                          KEY_CHANGED=no
                           if [ -e $KEY -a $KEY -nt key.pem ]; then
+                            KEY_CHANGED=yes
                             cp -p ${spath}/certificates/${keyName}.key key.pem
                             cp -p ${spath}/certificates/${keyName}.crt fullchain.pem
                             cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
@@ -336,7 +338,10 @@ in
                           chmod ${fileMode} *.pem
                           chown '${data.user}:${data.group}' *.pem
 
-                          ${data.postRun}
+                          if [ "$KEY_CHANGED" = "yes" ]; then
+                            : # noop in case postRun is empty
+                            ${data.postRun}
+                          fi
                         '';
                       in
                         "+${script}";

From 7fcae3781ebf46c482874173df08fac10e1fe925 Mon Sep 17 00:00:00 2001
From: Markus Wamser <wamserma@users.noreply.github.com>
Date: Sat, 18 Apr 2020 03:14:15 +0200
Subject: [PATCH 36/59] maintainers: add wamserma

Signed-off-by: Markus S. Wamser <github-dev@mail2013.wamser.eu>
---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 772c132f4975..cbd0e64ad772 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7640,6 +7640,12 @@
     githubId = 3889405;
     name = "vyp";
   };
+  wamserma = {
+    name = "Markus S. Wamser";
+    email = "github-dev@mail2013.wamser.eu";
+    github = "wamserma";
+    githubId = 60148;
+  };
   waynr = {
     name = "Wayne Warren";
     email = "wayne.warren.s@gmail.com";

From 60ce81079a3d0ca62678a975acd19a5d4b4ecb3a Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2020 00:57:21 +0000
Subject: [PATCH 37/59] openvswitch: 2.12.0 -> 2.13.0

(cherry picked from commit c8523fe0038739ddee2aa653b1927e219830c78b)
---
 pkgs/os-specific/linux/openvswitch/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
index 53fc986d9f63..f0fb0a834ffe 100644
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -8,12 +8,12 @@ let
   _kernel = kernel;
   pythonEnv = python3.withPackages (ps: with ps; [ six ]);
 in stdenv.mkDerivation rec {
-  version = "2.12.0";
+  version = "2.13.0";
   pname = "openvswitch";
 
   src = fetchurl {
     url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "1y78ix5inhhcvicbvyy2ij38am1215nr55vydhab3d4065q45z8k";
+    sha256 = "0cd5vmfr6zwgcnkwys6rag6cmz68v0librpaplianv734xs74pyx";
   };
 
   kernel = optional (_kernel != null) _kernel.dev;
@@ -58,7 +58,7 @@ in stdenv.mkDerivation rec {
       support distribution across multiple physical servers similar
       to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
       '';
-    homepage = https://www.openvswitch.org/;
+    homepage = "https://www.openvswitch.org/";
     license = licenses.asl20;
     maintainers = with maintainers; [ netixx kmcopper ];
   };

From e1c41b8c568644484c7b79407f59ab7e45361c3b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Tue, 24 Mar 2020 05:21:39 +0000
Subject: [PATCH 38/59] pebble: v2.2.2 -> v2.3.0

Also add myself to maintainers and correct meta.homepage.

(cherry picked from commit 6285d5eabda26d0e696a328bcc9b8bf33dea1b3a)
---
 pkgs/tools/admin/pebble/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/admin/pebble/default.nix b/pkgs/tools/admin/pebble/default.nix
index 5aa220fd89e6..efd9bfe05964 100644
--- a/pkgs/tools/admin/pebble/default.nix
+++ b/pkgs/tools/admin/pebble/default.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "v2.2.2";
+  version = "v2.3.0";
   pname = "pebble";
 in buildGoPackage {
   inherit pname version;
@@ -14,13 +14,13 @@ in buildGoPackage {
     owner = "letsencrypt";
     repo = pname;
     rev = version;
-    sha256 = "10g6ivdxxp3632wk0gvmp75v9x668kchhmlczbsq8qnsc8sb8pwf";
+    sha256 = "1piwzzfqsdx6s2niczzp4mf4r3qn9nfdgpn7882g52cmmm0vzks2";
   };
 
   meta = {
-    homepage = "https://github.com/letsencrypt/boulder";
+    homepage = "https://github.com/letsencrypt/pebble";
     description = "A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production CA";
     license = [ lib.licenses.mpl20 ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ emily ];
   };
 }

From b0d26e9d67a12e2a5a299683d7c672656ca2ec69 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Tue, 24 Mar 2020 05:13:24 +0000
Subject: [PATCH 39/59] nixos/tests/common/acme: enable Pebble strict mode

This lets us get early warning about any bugs or backwards-compatibility
hazards in lego.

Pebble will default to this in the future, but doesn't currently;
see https://github.com/letsencrypt/pebble/blob/v2.3.0/README.md#strict-mode.

(cherry picked from commit e6d5e83cf10f8d6d900c53f8b29399e3619434c7)
---
 nixos/tests/common/letsencrypt/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/common/letsencrypt/default.nix b/nixos/tests/common/letsencrypt/default.nix
index 110a2520971d..390f9259c1bd 100644
--- a/nixos/tests/common/letsencrypt/default.nix
+++ b/nixos/tests/common/letsencrypt/default.nix
@@ -76,6 +76,7 @@ let
     httpPort = 80;
     tlsPort = 443;
     ocspResponderURL = "http://0.0.0.0:4002";
+    strict = true;
   };
 
   pebbleConfFile = pkgs.writeText "pebble.conf" (builtins.toJSON pebbleConf);

From 8283094333af2d6f07fb6a781a95d8021173afbd Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Mon, 23 Mar 2020 22:12:15 +0000
Subject: [PATCH 40/59] nixos/tests/acme: don't restrict to x86_64

This was added in aade4e577bbb27f044217c51a006ab6ba544ebb5, but the
implementation of the ACME module has been entirely rewritten since
then, and the test seems to run fine on AArch64.

(cherry picked from commit 352e30df8a38b1b673c19de817fedca7d3d95d71)
---
 nixos/tests/all-tests.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6f15ba47c5cf..620814e242fc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -22,7 +22,7 @@ let
 in
 {
   _3proxy = handleTest ./3proxy.nix {};
-  acme = handleTestOn ["x86_64-linux"] ./acme.nix {};
+  acme = handleTest ./acme.nix {};
   atd = handleTest ./atd.nix {};
   automysqlbackup = handleTest ./automysqlbackup.nix {};
   avahi = handleTest ./avahi.nix {};

From 2b8100d702ef6fd083c181b7fb7109f471de145f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Mon, 23 Mar 2020 20:35:16 +0000
Subject: [PATCH 41/59] nixos/tests/acme: use *.test domains

Shimming out the Let's Encrypt domain name to reuse client configuration
doesn't work properly (Pebble uses different endpoint URL formats), is
recommended against by upstream,[1] and is unnecessary now that the ACME
module supports specifying an ACME server. This commit changes the tests
to use the domain name acme.test instead, and renames the letsencrypt
node to acme to reflect that it has nothing to do with the ACME server
that Let's Encrypt runs. The imports are renamed for clarity:

* nixos/tests/common/{letsencrypt => acme}/{common.nix => client}
* nixos/tests/common/{letsencrypt => acme}/{default.nix => server}

The test's other domain names are also adjusted to use *.test for
consistency (and to avoid misuse of non-reserved domain names such
as standalone.com).

[1] https://github.com/letsencrypt/pebble/issues/283#issuecomment-545123242

Co-authored-by: Yegor Timoshenko <yegortimoshenko@riseup.net>
(cherry picked from commit d0f04c1623ae74f256ff5ced77ac78c7fe3b6abc)
---
 nixos/tests/acme.nix                          |  99 ++++---
 nixos/tests/common/acme/client/default.nix    |  19 ++
 .../{letsencrypt => acme/server}/default.nix  |  28 +-
 .../{letsencrypt => acme/server}/mkcerts.nix  |   5 +-
 .../{letsencrypt => acme/server}/mkcerts.sh   |   0
 .../common/acme/server/snakeoil-certs.nix     | 171 ++++++++++++
 nixos/tests/common/letsencrypt/common.nix     |  12 -
 .../common/letsencrypt/snakeoil-certs.nix     | 254 ------------------
 nixos/tests/common/resolver.nix               |   2 +-
 9 files changed, 254 insertions(+), 336 deletions(-)
 create mode 100644 nixos/tests/common/acme/client/default.nix
 rename nixos/tests/common/{letsencrypt => acme/server}/default.nix (83%)
 rename nixos/tests/common/{letsencrypt => acme/server}/mkcerts.nix (94%)
 rename nixos/tests/common/{letsencrypt => acme/server}/mkcerts.sh (100%)
 create mode 100644 nixos/tests/common/acme/server/snakeoil-certs.nix
 delete mode 100644 nixos/tests/common/letsencrypt/common.nix
 delete mode 100644 nixos/tests/common/letsencrypt/snakeoil-certs.nix

diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index e045f3415fa0..855642e41922 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -1,5 +1,5 @@
 let
-  commonConfig = ./common/letsencrypt/common.nix;
+  commonConfig = ./common/acme/client;
 
   dnsScript = {writeScript, dnsAddress, bash, curl}: writeScript "dns-hook.sh" ''
     #!${bash}/bin/bash
@@ -16,8 +16,8 @@ in import ./make-test-python.nix {
   name = "acme";
 
   nodes = rec {
-    letsencrypt = { nodes, lib, ... }: {
-      imports = [ ./common/letsencrypt ];
+    acme = { nodes, lib, ... }: {
+      imports = [ ./common/acme/server ];
       networking.nameservers = lib.mkForce [
         nodes.dnsserver.config.networking.primaryIPAddress
       ];
@@ -45,19 +45,16 @@ in import ./make-test-python.nix {
         nodes.dnsserver.config.networking.primaryIPAddress
       ];
       networking.firewall.allowedTCPPorts = [ 80 ];
-      security.acme = {
-        server = "https://acme-v02.api.letsencrypt.org/dir";
-        certs."standalone.com" = {
-            webroot = "/var/lib/acme/acme-challenges";
-        };
+      security.acme.certs."standalone.test" = {
+        webroot = "/var/lib/acme/acme-challenges";
       };
-      systemd.targets."acme-finished-standalone.com" = {};
-      systemd.services."acme-standalone.com" = {
-        wants = [ "acme-finished-standalone.com.target" ];
-        before = [ "acme-finished-standalone.com.target" ];
+      systemd.targets."acme-finished-standalone.test" = {};
+      systemd.services."acme-standalone.test" = {
+        wants = [ "acme-finished-standalone.test.target" ];
+        before = [ "acme-finished-standalone.test.target" ];
       };
       services.nginx.enable = true;
-      services.nginx.virtualHosts."standalone.com" = {
+      services.nginx.virtualHosts."standalone.test" = {
         locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenges";
       };
     };
@@ -71,16 +68,16 @@ in import ./make-test-python.nix {
 
       # A target remains active. Use this to probe the fact that
       # a service fired eventhough it is not RemainAfterExit
-      systemd.targets."acme-finished-a.example.com" = {};
-      systemd.services."acme-a.example.com" = {
-        wants = [ "acme-finished-a.example.com.target" ];
-        before = [ "acme-finished-a.example.com.target" ];
+      systemd.targets."acme-finished-a.example.test" = {};
+      systemd.services."acme-a.example.test" = {
+        wants = [ "acme-finished-a.example.test.target" ];
+        before = [ "acme-finished-a.example.test.target" ];
         after = [ "nginx.service" ];
       };
 
       services.nginx.enable = true;
 
-      services.nginx.virtualHosts."a.example.com" = {
+      services.nginx.virtualHosts."a.example.test" = {
         enableACME = true;
         forceSSL = true;
         locations."/".root = pkgs.runCommand "docroot" {} ''
@@ -89,17 +86,17 @@ in import ./make-test-python.nix {
         '';
       };
 
-      security.acme.server = "https://acme-v02.api.letsencrypt.org/dir";
+      security.acme.server = "https://acme.test/dir";
 
       nesting.clone = [
         ({pkgs, ...}: {
-          systemd.targets."acme-finished-b.example.com" = {};
-          systemd.services."acme-b.example.com" = {
-            wants = [ "acme-finished-b.example.com.target" ];
-            before = [ "acme-finished-b.example.com.target" ];
+          systemd.targets."acme-finished-b.example.test" = {};
+          systemd.services."acme-b.example.test" = {
+            wants = [ "acme-finished-b.example.test.target" ];
+            before = [ "acme-finished-b.example.test.target" ];
             after = [ "nginx.service" ];
           };
-          services.nginx.virtualHosts."b.example.com" = {
+          services.nginx.virtualHosts."b.example.test" = {
             enableACME = true;
             forceSSL = true;
             locations."/".root = pkgs.runCommand "docroot" {} ''
@@ -109,8 +106,8 @@ in import ./make-test-python.nix {
           };
         })
         ({pkgs, config, nodes, lib, ...}: {
-          security.acme.certs."example.com" = {
-            domain = "*.example.com";
+          security.acme.certs."example.test" = {
+            domain = "*.example.test";
             dnsProvider = "exec";
             dnsPropagationCheck = false;
             credentialsFile = with pkgs; writeText "wildcard.env" ''
@@ -119,17 +116,17 @@ in import ./make-test-python.nix {
             user = config.services.nginx.user;
             group = config.services.nginx.group;
           };
-          systemd.targets."acme-finished-example.com" = {};
-          systemd.services."acme-example.com" = {
-            wants = [ "acme-finished-example.com.target" ];
-            before = [ "acme-finished-example.com.target" "nginx.service" ];
+          systemd.targets."acme-finished-example.test" = {};
+          systemd.services."acme-example.test" = {
+            wants = [ "acme-finished-example.test.target" ];
+            before = [ "acme-finished-example.test.target" "nginx.service" ];
             wantedBy = [ "nginx.service" ];
           };
-          services.nginx.virtualHosts."c.example.com" = {
+          services.nginx.virtualHosts."c.example.test" = {
             forceSSL = true;
-            sslCertificate = config.security.acme.certs."example.com".directory + "/cert.pem";
-            sslTrustedCertificate = config.security.acme.certs."example.com".directory + "/full.pem";
-            sslCertificateKey = config.security.acme.certs."example.com".directory + "/key.pem";
+            sslCertificate = config.security.acme.certs."example.test".directory + "/cert.pem";
+            sslTrustedCertificate = config.security.acme.certs."example.test".directory + "/full.pem";
+            sslCertificateKey = config.security.acme.certs."example.test".directory + "/key.pem";
             locations."/".root = pkgs.runCommand "docroot" {} ''
               mkdir -p "$out"
               echo hello world > "$out/index.html"
@@ -161,46 +158,44 @@ in import ./make-test-python.nix {
       client.start()
       dnsserver.start()
 
-      letsencrypt.wait_for_unit("default.target")
+      acme.wait_for_unit("default.target")
       dnsserver.wait_for_unit("pebble-challtestsrv.service")
       client.succeed(
-          'curl --data \'{"host": "acme-v02.api.letsencrypt.org", "addresses": ["${nodes.letsencrypt.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
+          'curl --data \'{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
       )
       client.succeed(
-          'curl --data \'{"host": "standalone.com", "addresses": ["${nodes.acmeStandalone.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
+          'curl --data \'{"host": "standalone.test", "addresses": ["${nodes.acmeStandalone.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'
       )
 
-      letsencrypt.start()
+      acme.start()
       acmeStandalone.start()
 
-      letsencrypt.wait_for_unit("default.target")
-      letsencrypt.wait_for_unit("pebble.service")
+      acme.wait_for_unit("default.target")
+      acme.wait_for_unit("pebble.service")
 
       with subtest("can request certificate with HTTPS-01 challenge"):
           acmeStandalone.wait_for_unit("default.target")
-          acmeStandalone.succeed("systemctl start acme-standalone.com.service")
-          acmeStandalone.wait_for_unit("acme-finished-standalone.com.target")
+          acmeStandalone.succeed("systemctl start acme-standalone.test.service")
+          acmeStandalone.wait_for_unit("acme-finished-standalone.test.target")
 
       client.wait_for_unit("default.target")
 
-      client.succeed("curl https://acme-v02.api.letsencrypt.org:15000/roots/0 > /tmp/ca.crt")
-      client.succeed(
-          "curl https://acme-v02.api.letsencrypt.org:15000/intermediate-keys/0 >> /tmp/ca.crt"
-      )
+      client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt")
+      client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt")
 
       with subtest("Can request certificate for nginx service"):
-          webserver.wait_for_unit("acme-finished-a.example.com.target")
+          webserver.wait_for_unit("acme-finished-a.example.test.target")
           client.succeed(
-              "curl --cacert /tmp/ca.crt https://a.example.com/ | grep -qF 'hello world'"
+              "curl --cacert /tmp/ca.crt https://a.example.test/ | grep -qF 'hello world'"
           )
 
       with subtest("Can add another certificate for nginx service"):
           webserver.succeed(
               "/run/current-system/fine-tune/child-1/bin/switch-to-configuration test"
           )
-          webserver.wait_for_unit("acme-finished-b.example.com.target")
+          webserver.wait_for_unit("acme-finished-b.example.test.target")
           client.succeed(
-              "curl --cacert /tmp/ca.crt https://b.example.com/ | grep -qF 'hello world'"
+              "curl --cacert /tmp/ca.crt https://b.example.test/ | grep -qF 'hello world'"
           )
 
       with subtest("Can request wildcard certificates using DNS-01 challenge"):
@@ -210,9 +205,9 @@ in import ./make-test-python.nix {
           webserver.succeed(
               "/run/current-system/fine-tune/child-2/bin/switch-to-configuration test"
           )
-          webserver.wait_for_unit("acme-finished-example.com.target")
+          webserver.wait_for_unit("acme-finished-example.test.target")
           client.succeed(
-              "curl --cacert /tmp/ca.crt https://c.example.com/ | grep -qF 'hello world'"
+              "curl --cacert /tmp/ca.crt https://c.example.test/ | grep -qF 'hello world'"
           )
     '';
 }
diff --git a/nixos/tests/common/acme/client/default.nix b/nixos/tests/common/acme/client/default.nix
new file mode 100644
index 000000000000..22ba6f4df194
--- /dev/null
+++ b/nixos/tests/common/acme/client/default.nix
@@ -0,0 +1,19 @@
+{ lib, nodes, pkgs, ... }:
+
+let
+  acme-ca = nodes.acme.config.test-support.acme.caCert;
+in
+
+{
+  networking.nameservers = [
+    nodes.acme.config.networking.primaryIPAddress
+  ];
+
+  security.acme = {
+    server = "https://acme.test/dir";
+    email = "hostmaster@example.test";
+    acceptTerms = true;
+  };
+
+  security.pki.certificateFiles = [ acme-ca ];
+}
diff --git a/nixos/tests/common/letsencrypt/default.nix b/nixos/tests/common/acme/server/default.nix
similarity index 83%
rename from nixos/tests/common/letsencrypt/default.nix
rename to nixos/tests/common/acme/server/default.nix
index 390f9259c1bd..9d9c2b3621a6 100644
--- a/nixos/tests/common/letsencrypt/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@@ -1,27 +1,27 @@
 # The certificate for the ACME service is exported as:
 #
-#   config.test-support.letsencrypt.caCert
+#   config.test-support.acme.caCert
 #
 # This value can be used inside the configuration of other test nodes to inject
 # the snakeoil certificate into security.pki.certificateFiles or into package
 # overlays.
 #
 # Another value that's needed if you don't use a custom resolver (see below for
-# notes on that) is to add the letsencrypt node as a nameserver to every node
+# notes on that) is to add the acme node as a nameserver to every node
 # that needs to acquire certificates using ACME, because otherwise the API host
-# for letsencrypt.org can't be resolved.
+# for acme.test can't be resolved.
 #
 # A configuration example of a full node setup using this would be this:
 #
 # {
-#   letsencrypt = import ./common/letsencrypt;
+#   acme = import ./common/acme/server;
 #
 #   example = { nodes, ... }: {
 #     networking.nameservers = [
-#       nodes.letsencrypt.config.networking.primaryIPAddress
+#       nodes.acme.config.networking.primaryIPAddress
 #     ];
 #     security.pki.certificateFiles = [
-#       nodes.letsencrypt.config.test-support.letsencrypt.caCert
+#       nodes.acme.config.test-support.acme.caCert
 #     ];
 #   };
 # }
@@ -33,8 +33,8 @@
 # override networking.nameservers like this:
 #
 # {
-#   letsencrypt = { nodes, ... }: {
-#     imports = [ ./common/letsencrypt ];
+#   acme = { nodes, ... }: {
+#     imports = [ ./common/acme/server ];
 #     networking.nameservers = [
 #       nodes.myresolver.config.networking.primaryIPAddress
 #     ];
@@ -55,16 +55,16 @@
 let
   snakeOilCerts = import ./snakeoil-certs.nix;
 
-  wfeDomain = "acme-v02.api.letsencrypt.org";
+  wfeDomain = "acme.test";
   wfeCertFile = snakeOilCerts.${wfeDomain}.cert;
   wfeKeyFile = snakeOilCerts.${wfeDomain}.key;
 
-  siteDomain = "letsencrypt.org";
+  siteDomain = "acme.test";
   siteCertFile = snakeOilCerts.${siteDomain}.cert;
   siteKeyFile = snakeOilCerts.${siteDomain}.key;
   pebble = pkgs.pebble;
   resolver = let
-    message = "You need to define a resolver for the letsencrypt test module.";
+    message = "You need to define a resolver for the acme test module.";
     firstNS = lib.head config.networking.nameservers;
   in if config.networking.nameservers == [] then throw message else firstNS;
 
@@ -83,9 +83,9 @@ let
   pebbleDataDir = "/root/pebble";
 
 in {
-  imports = [ ../resolver.nix ];
+  imports = [ ../../resolver.nix ];
 
-  options.test-support.letsencrypt.caCert = lib.mkOption {
+  options.test-support.acme.caCert = lib.mkOption {
     type = lib.types.path;
     description = ''
       A certificate file to use with the <literal>nodes</literal> attribute to
@@ -99,7 +99,7 @@ in {
       resolver.enable = let
         isLocalResolver = config.networking.nameservers == [ "127.0.0.1" ];
       in lib.mkOverride 900 isLocalResolver;
-      letsencrypt.caCert = snakeOilCerts.ca.cert;
+      acme.caCert = snakeOilCerts.ca.cert;
     };
 
     # This has priority 140, because modules/testing/test-instrumentation.nix
diff --git a/nixos/tests/common/letsencrypt/mkcerts.nix b/nixos/tests/common/acme/server/mkcerts.nix
similarity index 94%
rename from nixos/tests/common/letsencrypt/mkcerts.nix
rename to nixos/tests/common/acme/server/mkcerts.nix
index e7ac2bae46bd..2474019cbac3 100644
--- a/nixos/tests/common/letsencrypt/mkcerts.nix
+++ b/nixos/tests/common/acme/server/mkcerts.nix
@@ -1,10 +1,9 @@
 { pkgs ? import <nixpkgs> {}
 , lib ? pkgs.lib
-
-, domains ? [ "acme-v02.api.letsencrypt.org" "letsencrypt.org" ]
+, domains ? [ "acme.test" ]
 }:
 
-pkgs.runCommand "letsencrypt-snakeoil-ca" {
+pkgs.runCommand "acme-snakeoil-ca" {
   nativeBuildInputs = [ pkgs.openssl ];
 } ''
   addpem() {
diff --git a/nixos/tests/common/letsencrypt/mkcerts.sh b/nixos/tests/common/acme/server/mkcerts.sh
similarity index 100%
rename from nixos/tests/common/letsencrypt/mkcerts.sh
rename to nixos/tests/common/acme/server/mkcerts.sh
diff --git a/nixos/tests/common/acme/server/snakeoil-certs.nix b/nixos/tests/common/acme/server/snakeoil-certs.nix
new file mode 100644
index 000000000000..fd537c3260f1
--- /dev/null
+++ b/nixos/tests/common/acme/server/snakeoil-certs.nix
@@ -0,0 +1,171 @@
+# Generated via mkcert.sh in the same directory.
+{
+  ca.key = builtins.toFile "ca.key" ''
+    -----BEGIN PRIVATE KEY-----
+    MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDCnVZGEn68ezXl
+    DWE5gjsCPqutR4nxw/wvIbAxB2Vk2WeQ6HGvt2Jdrz5qer2IXd76YtpQeqd+ffet
+    aLtMeFTr+Xy9yqEpx2AfvmEEcLnuiWbsUGZzsHwW7/4kPgAFBy9TwJn/k892lR6u
+    QYa0QS39CX85kLMZ/LZXUyClIBa+IxT1OovmGqMOr4nGASRQP6d/nnyn41Knat/d
+    tpyaa5zgfYwA6YW6UxcywvBSpMOXM0/82BFZGyALt3nQ+ffmrtKcvMjsNLBFaslV
+    +zYO1PMbLbTCW8SmJTjhzuapXtBHruvoe24133XWlvcP1ylaTx0alwiQWJr1XEOU
+    WLEFTgOTeRyiVDxDunpz+7oGcwzcdOG8nCgd6w0aYaECz1zvS3FYTQz+MiqmEkx6
+    s4bj1U90I0kwUJbeWjjrGO7Y9Qq4i19GafDg7cAMn9eHCiNbNrPj6t/gfaVbCrbk
+    m3ZVjkvLTQ2mb2lv7+tVii45227iNPuNS6lx2FVlr/DXiRrOVfghPvoOxUfXzogJ
+    hZLV4Zki+ycbGQa5w8YMDYCv4c08dKA7AatVhNS60c1zgQNjuWF3BvocSySyGUon
+    VT6h1DYlJ9YAqgqNpedgNR9kpp034SMhB7dj9leB6LRMA+c1fG/T+1lDbkA+vope
+    pt4+30oDcCTYfEifl1HwqNw/bXDm1wIDAQABAoICABPbd/UYaAQVUk93yQbUKe81
+    s9CvbvzTMYUhm9e02Hyszitz/D2gqZHDksvMkFA8u8aylXIGwdZfRglUmV/ZG1kk
+    kLzQ0xbvN/ilNUL9uYsETBMqtPly9YZloHnUNa5NqF+UVGJGk7GWz5WaLANybx3V
+    fTzDbfLl3TkVy0vt9UQbUkUfXyzwZNjXwmgIr8rcY9vasP90a3eXqRX3Tw1Wk6A4
+    TzO8oB994O0WBO150Fc6Lhwvc72yzddENlLDXq8UAXtqq9mmGqJKnhZ+1mo3AkMw
+    q7P1JyCIxcAMm26GtRvLVljXV0x5640kxDrCin6jeeW/qWkJEW6dpmuZjR5scmLI
+    /9n8H+fGzdZH8bOPPotMy12doj3vJqvew3p0eIkmVctYMJKD0j/CWjvKJNE3Yx4O
+    Ls47X/dEypX6anR1HQUXcpd6JfRWdIJANo2Duaz+HYbyA88bHcJL9shFYcjLs3sX
+    R/TvnnKHvw/ud7XBgvLGwGAf/cDEuLI2tv+V7tkMGrMUv+gUJNZaJaCpdt+1iUwO
+    QFq8APyBNn6FFw54TwXWfSjfSNh3geIMLHuErYVu9MIXvB7Yhh+ZvLcfLbmckhAX
+    wb39RRHnCWvnw5Bm9hnsDhqfDsIoP+2wvUkViyHOmrKi8nSJhSk19C8AuQtSVcJg
+    5op+epEmjt70GHt52nuBAoIBAQD2a4Ftp4QxWE2d6oAFI6WPrX7nAwI5/ezCbO/h
+    yoYAn6ucTVnn5/5ITJ8V4WTWZ4lkoZP3YSJiCyBhs8fN63J+RaJ/bFRblHDns1HA
+    2nlMVdNLg6uOfjgUJ8Y6xVM0J2dcFtwIFyK5pfZ7loxMZfvuovg74vDOi2vnO3dO
+    16DP3zUx6B/yIt57CYn8NWTq+MO2bzKUnczUQRx0yEzPOfOmVbcqGP8f7WEdDWXm
+    7scjjN53OPyKzLOVEhOMsUhIMBMO25I9ZpcVkyj3/nj+fFLf/XjOTM00M/S/KnOj
+    RwaWffx6mSYS66qNc5JSsojhIiYyiGVEWIznBpNWDU35y/uXAoIBAQDKLj0dyig2
+    kj1r3HvdgK4sRULqBQFMqE9ylxDmpJxAj6/A8hJ0RCBR57vnIIZMzK4+6K0l3VBJ
+    ukzXJHJLPkZ0Uuo2zLuRLkyjBECH6KYznyTkUVRn50Oq6IoP6WTCfd3Eg+7AKYY1
+    VFo2iR8sxeSQQ+AylFy6QcQ1xPIW30Jj1/LFjrRdRggapPEekpJec0pEqhasT8rR
+    UFhRL2NdZnL5b7ZlsJc7gZKEJgNfxgzaCzloqLcjCgGpOhLKx0fFsNOqHcbIGMwG
+    6wQCOyNghQJ6AZtRD5TYCJow92FchWjoTIaMJ8RjMKQmxpiwM6wQG4J78Hd3mbhf
+    q0hiQhPHaNbBAoIBAFeIeMFq8BpXM7sUwcURlI4lIx8Mgo33FVM7PzsFpfQyw9MR
+    5w3p6vnjvd8X4aoHvVZxzw3hA0WwjiAmrKMJL/KK6d45rP2bDUBBAplvAgeLtTLt
+    4tMLIwCF4HSgA55TIPQlaqO1FDC+M4BTSiMZVxS970/WnZPBEuNgzFDFZ+pvb4X6
+    3t40ZLNwAAQHM4IEPAFiHqWMKGZ9eo5BWIeEHnjHmfjqSDYfLJAVYk1WJIcMUzom
+    lA76CBC8CxW/I94AtcRhWuFUv/Z5/+OYEYLUxtuqPm+J+JrCmf4OJmWppT1wI2+p
+    V00BSeRVWXTm1piieM8ahF5y1hp6y3uV3k0NmKECggEBAMC42Ms3s6NpPSE+99eJ
+    3P0YPJOkl7uByNGbTKH+kW89SDRsy8iGVCSe9892gm5cwU/4LWyljO3qp2qBNG2i
+    /DfP/bCk8bqPXsAZwoWK8DrO3bTCDepJWYhlx40pVkHLBwVXGdOVAXh+YswPY2cj
+    cB9QhDrSj52AKU9z36yLvtY7uBA3Wph6tCjpx2n0H4/m6AmR9LDmEpf5tWYV/OrA
+    SKKaqUw/y7kOZyKOtbKqr/98qYmpIYFF/ZVZZSZkVXcNeoZzgdOlR37ksVqLEsrj
+    nxu7wli/uItBj/FTLjyqcvjUUYDyO1KtwBuyPUPgzYhBIN2Rt9+K6WRQelwnToFL
+    30ECggEBALzozykZj2sr3z8tQQRZuXLGotUFGsQCB8ikeqoeB8FbNNkC+qgflQGv
+    zLRB2KWOvnboc94wVgBJH43xG0HBibZnBhUO8/HBI/WlmyEj9KQ/ZskUK4GVZkB6
+    r/81ASLwH+P/rqrLEjcp1SIPPevjzCWD9VYR5m/qPHLNxStwGSrPjtPzgaFxhq84
+    Jl+YVmNqVlrOKYYfIPh8exPLiTti3wfM61pVYFv56PI2gd5ysMWYnuN+vK0sbmZh
+    cIWwykcKlODIngI7IzYqt8NuIJI0jrYyHgtUw4jaJzdF4mEOplGONxdz15jAGHtg
+    JUsBXFNz132nP4iIr3UKrPedQZijSi4=
+    -----END PRIVATE KEY-----
+  '';
+  ca.cert = builtins.toFile "ca.cert" ''
+    -----BEGIN CERTIFICATE-----
+    MIIFDzCCAvegAwIBAgIUTRDYSWJvmlhwIR3pzVrIQfnboLEwDQYJKoZIhvcNAQEL
+    BQAwFjEUMBIGA1UEAwwLU25ha2VvaWwgQ0EwIBcNMjAwMzIyMjI1NjE3WhgPMjEy
+    MDAyMjcyMjU2MTdaMBYxFDASBgNVBAMMC1NuYWtlb2lsIENBMIICIjANBgkqhkiG
+    9w0BAQEFAAOCAg8AMIICCgKCAgEAwp1WRhJ+vHs15Q1hOYI7Aj6rrUeJ8cP8LyGw
+    MQdlZNlnkOhxr7diXa8+anq9iF3e+mLaUHqnfn33rWi7THhU6/l8vcqhKcdgH75h
+    BHC57olm7FBmc7B8Fu/+JD4ABQcvU8CZ/5PPdpUerkGGtEEt/Ql/OZCzGfy2V1Mg
+    pSAWviMU9TqL5hqjDq+JxgEkUD+nf558p+NSp2rf3bacmmuc4H2MAOmFulMXMsLw
+    UqTDlzNP/NgRWRsgC7d50Pn35q7SnLzI7DSwRWrJVfs2DtTzGy20wlvEpiU44c7m
+    qV7QR67r6HtuNd911pb3D9cpWk8dGpcIkFia9VxDlFixBU4Dk3kcolQ8Q7p6c/u6
+    BnMM3HThvJwoHesNGmGhAs9c70txWE0M/jIqphJMerOG49VPdCNJMFCW3lo46xju
+    2PUKuItfRmnw4O3ADJ/XhwojWzaz4+rf4H2lWwq25Jt2VY5Ly00Npm9pb+/rVYou
+    Odtu4jT7jUupcdhVZa/w14kazlX4IT76DsVH186ICYWS1eGZIvsnGxkGucPGDA2A
+    r+HNPHSgOwGrVYTUutHNc4EDY7lhdwb6HEskshlKJ1U+odQ2JSfWAKoKjaXnYDUf
+    ZKadN+EjIQe3Y/ZXgei0TAPnNXxv0/tZQ25APr6KXqbePt9KA3Ak2HxIn5dR8Kjc
+    P21w5tcCAwEAAaNTMFEwHQYDVR0OBBYEFCIoeYSYjtMiPrmxfHmcrsZkyTpvMB8G
+    A1UdIwQYMBaAFCIoeYSYjtMiPrmxfHmcrsZkyTpvMA8GA1UdEwEB/wQFMAMBAf8w
+    DQYJKoZIhvcNAQELBQADggIBAHPdwOgAxyhIhbqFObNftW8K3sptorB/Fj6jwYCm
+    mHleFueqQnjTHMWsflOjREvQp1M307FWooGj+KQkjwvAyDc/Hmy7WgJxBg9p3vc+
+    /Xf/e7ZfBl8rv7vH8VXW/BC1vVsILdFncrgTrP8/4psV50/cl1F4+nPBiekvvxwZ
+    k+R7SgeSvcWT7YlOG8tm1M3al4F4mWzSRkYjkrXmwRCKAiya9xcGSt0Bob+LoM/O
+    mpDGV/PMC1WAoDc1mMuXN2hSc0n68xMcuFs+dj/nQYn8uL5pzOxpX9560ynKyLDv
+    yOzQlM2VuZ7H2hSIeYOFgrtHJJwhDtzjmUNDQpQdp9Fx+LONQTS1VLCTXND2i/3F
+    10X6PkdnLEn09RiPt5qy20pQkICxoEydmlwpFs32musYfJPdBPkZqZWrwINBv2Wb
+    HfOmEB4xUvXufZ5Ju5icgggBkyNA3PCLo0GZFRrMtvA7i9IXOcXNR+njhKa9246V
+    QQfeWiz05RmIvgShJYVsnZWtael8ni366d+UXypBYncohimyNlAD1n+Bh3z0PvBB
+    +FK4JgOSeouM4SuBHdwmlZ/H0mvfUG81Y8Jbrw0yuRHtuCtX5HpN5GKpZPHDE7aQ
+    fEShVB/GElC3n3DvgK9OJBeVVhYQgUEfJi4rsSxt3cdEI0NrdckUoZbApWVJ3CBc
+    F8Y7
+    -----END CERTIFICATE-----
+  '';
+  "acme.test".key = builtins.toFile "acme.test.key" ''
+    -----BEGIN RSA PRIVATE KEY-----
+    MIIJKAIBAAKCAgEAlgQTZjKfs3aHw0J993k7jFAs+hVRPf//zHMAiUkPKUYPTSl1
+    TxS/bPbhWzSoom00j4SLhGGGhbd+lnvTg0uvKbxskgATfw5clbm1ZN+gx4DuxwjL
+    V3xIxpeSY+PKzs5z8w/k+AJh+zOPyXwH3ut3C+ogp1S/5IhmzV3a/yU/6k0zpGxj
+    N6ZPRTXFrz93I1pPeCkJz90l7tj+2uFc9xtM20NQX52f0Y2oShcG8fKdNZVzuHHk
+    ZXkrZIhou55/nRy2jKgFeD3GQQfa9rwPWrVybQ6tKMMkoazB/Unky9xcTI2LJarf
+    xgHDO9v9yFBvmR4UM8B3kM82NHoENtHaZ2mmiMGZzTEQlf8xwYyHFrqBFIVRWEUr
+    7rr/O5Qr9gIN0T4u367HCexVYAKzbO2P9h75czzjMMoGkbXze9SMQ/ikrxEmwAHg
+    r1Xxh6iQYmgPNk8AR3d9+o2I7WJZMUYZARLnuhVr9BNXv510iqZTqX8lcyL5fEj3
+    ST4Ab+H7rfevZt6NU26iJLBYAjrA2mSvH+wvkboxrgSS8xYPkOW8NLNEbbodzofI
+    pB+SaK53OIk0bj9c1YAgrSNER/TDTgDXrWUNrlfVZ/M7+AEdeU06wi7sVhVif6OB
+    D3OpgKSNjeE6TuJH80Pi5MWugSFBr792Xb6uhVoPiVOFN+qiGB6UkwBgSKkCAwEA
+    AQKCAgAmN7OZfZwh5DiCDhZ5TXFWNba/n16rJOTN+R5R20L5iNetGLrCAs8hu2N+
+    ENRFTPzu8x14BEB5IF4niDRCZq2hPFeMemh9HfOIUV9c63vSV459NkhXaVpA/axV
+    tlqchQwVCB+U70Z28JPZCLgYmnQhnOvktTqNxhIqj5aTGbJGxpQ5d0Nvkfbv8tsB
+    4nE/mGpWel39jqFzT+Tdbjx414Ok+GkpcsacZDJTbbpfOSfD1uc8PgepskzTt8y2
+    v5JTPFVlUAjUsSgouQ+XfCGNQlx8XBjRIaXbal+hX4niRald91FTr0yC7UAHp+vn
+    dFZ586fB526OfbuZctxP+vZhEhFSseQKxHQ0tB8me81xH44daVNr9PPUM69FDT3j
+    ygJaUJjNEG3vVzePCDzhmxTmz2/rAClp77WTWziBWDoA6YWDDzhgNPrXWzLIbZIx
+    ue9ZbGEOh/u5ZzrEXxKCz9FjDe9wQu3TeYUe0M+ejzwWgn7zdWDvjjmtLUUuun2Y
+    wW7WANpu32qvB/V+qssw4O63tbRiwneRCnb8AF2ixgyWr6xyZwch4kacv1KMiixf
+    gO/5GTj7ba5GcdGoktJb29cUEgz13yPd106RsHK4vcggFxfMbOVauNRIo6ddLwyS
+    8UMxLf2i2cToOLkHZrIb8FgimmzRoBd3yYzwVJBydiVcsrHQAQKCAQEAxlzFYCiQ
+    hjEtblGnrkOC7Hx6HvqMelViOkGN8Y9VczG4GhwntmSE2nbpaAKhFBGdLfuSI3tJ
+    Lf24f0IGgAhzPmpo2TjbxPO3YSKFTH71fznVBhtQ1iSxwZ1InXktnuhot6VSDx6A
+    sbHSy1hMFy3nj+Zj5+fQ89tclzBzG9bCShaauO39KrPMwKi6CYoYdGhXBC3+OpHY
+    zBNvmDTxG2kW8L42rlf14EH4pAlgKs4eeZbpcbZ6fXURP2hToHJ8swyKw/1p12WA
+    cc19BKFJXL8nNP4uCf/fI0mVYpytz5KwUzG+z+umDqk+RRCH4mNB28xvEEuEyp/e
+    /C5Is+WrlDAA6QKCAQEAwZsK4AJ/w4Xf4Q/SsnZJO9bfP1ejJjzKElt8rG28JXeb
+    +FjykZZ6vw2gt2Boest2n9N4fBwaRkaHVtVS4iAmaDXozTlcvCLs2rVjPSguuQtW
+    80CKg6+dux+6gFN8IGzDCiX3pWUnhhiXvCcRYEcvgpH6GA5vuCNrXrjH0JFC0kef
+    aaDMGMTbzhc2IIRztmWU4v8YJSSy5KOkIQLWO+7u9aGx9IqT5/z3gx3XrItyl0Bk
+    aQmZEh7JOSyhmGhhf5LdeTLu2YgRw3/tzS+lPMX3+UPw99k9MdTOFn2pww5AdRmg
+    aBIzV+/LBYG0pPRl0D8/6yzGVBPuUDQpmK9Z3gsxwQKCAQEAnNkMZN2Ocd1+6+V7
+    LmtJog9HTSmWXMEZG7FsOJ661Yxx44txx2IyPsCaDNlPXxwSaiKrSo0Yr1oZQd8G
+    XsTPw4HGiETSWijQTulJ99PH8SLck6iTwdBgEhV5LrN75FQnQVdizHu1DUzrvkiC
+    Wi29FWb6howiCEDjNNVln5SwKn83NpVQgyyK8ag4+oQMlDdQ3wgzJ0Ld53hS3Eq4
+    f5EYR6JQgIki7YGcxrB3L0GujTxMONMuhfdEfRvUTGFawwVe0FyYDW7AIrx2Z2vV
+    I5YuvVNjOhrt6OwtSD1VnnWCITaLh8LwmlUu3NOWbudHUzKSe5MLXGEPo95BNKad
+    hl5yyQKCAQBNo0gMJtRnawMpdLfwewDJL1SdSR6S0ePS0r8/Qk4l1D5GrByyB183
+    yFY/0zhyra7nTt1NH9PlhJj3WFqBdZURSzUNP0iR5YuH9R9Twg5ihEqdB6/EOSOO
+    i521okTvl83q/ui9ecAMxUXr3NrZ+hHyUWmyRe/FLub6uCzg1a+vNauWpzXRZPgk
+    QCijh5oDdd7r3JIpKvtWNs01s7aHmDxZYjtDrmK7sDTtboUzm0QbpWXevUuV+aSF
+    +gDfZlRa3WFVHfisYSWGeYG6O7YOlfDoE7fJHGOu3QC8Ai6Wmtt8Wgd6VHokdHO8
+    xJPVZnCBvyt5up3Zz5hMr25S3VazdVfBAoIBAHVteqTGqWpKFxekGwR0RqE30wmN
+    iIEwFhgOZ8sQ+6ViZJZUR4Nn2fchn2jVwF8V8J1GrJbTknqzAwdXtO3FbgfmmyF2
+    9VbS/GgomXhA9vJkM4KK3Iwo/y/nE9hRhtzuVE0QPudz2fyfaDgnWjcNM59064tH
+    88361LVJm3ixyWSBD41UZ7NgWWJX1y2f073vErsfcPpavF5lhn1oSkQnOlgMJsnl
+    24qeuzAgTWu/2rFpIA2EK30Bgvsl3pjJxHwyNDAgklV7C783LIoAHi7VO7tzZ6iF
+    dmD5XLfcUZc3eaB7XehNQKBXDGLJeI5AFmjsHka5GUoitkU2PFrg/3+nJmg=
+    -----END RSA PRIVATE KEY-----
+  '';
+  "acme.test".cert = builtins.toFile "acme.test.cert" ''
+    -----BEGIN CERTIFICATE-----
+    MIIEoTCCAokCAgKaMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC1NuYWtlb2ls
+    IENBMCAXDTIwMDMyMjIyNTYxOFoYDzIxMjAwMjI3MjI1NjE4WjAUMRIwEAYDVQQD
+    DAlhY21lLnRlc3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCWBBNm
+    Mp+zdofDQn33eTuMUCz6FVE9///McwCJSQ8pRg9NKXVPFL9s9uFbNKiibTSPhIuE
+    YYaFt36We9ODS68pvGySABN/DlyVubVk36DHgO7HCMtXfEjGl5Jj48rOznPzD+T4
+    AmH7M4/JfAfe63cL6iCnVL/kiGbNXdr/JT/qTTOkbGM3pk9FNcWvP3cjWk94KQnP
+    3SXu2P7a4Vz3G0zbQ1BfnZ/RjahKFwbx8p01lXO4ceRleStkiGi7nn+dHLaMqAV4
+    PcZBB9r2vA9atXJtDq0owyShrMH9SeTL3FxMjYslqt/GAcM72/3IUG+ZHhQzwHeQ
+    zzY0egQ20dpnaaaIwZnNMRCV/zHBjIcWuoEUhVFYRSvuuv87lCv2Ag3RPi7frscJ
+    7FVgArNs7Y/2HvlzPOMwygaRtfN71IxD+KSvESbAAeCvVfGHqJBiaA82TwBHd336
+    jYjtYlkxRhkBEue6FWv0E1e/nXSKplOpfyVzIvl8SPdJPgBv4fut969m3o1TbqIk
+    sFgCOsDaZK8f7C+RujGuBJLzFg+Q5bw0s0Rtuh3Oh8ikH5Jornc4iTRuP1zVgCCt
+    I0RH9MNOANetZQ2uV9Vn8zv4AR15TTrCLuxWFWJ/o4EPc6mApI2N4TpO4kfzQ+Lk
+    xa6BIUGvv3Zdvq6FWg+JU4U36qIYHpSTAGBIqQIDAQABMA0GCSqGSIb3DQEBCwUA
+    A4ICAQBCDs0V4z00Ze6Ask3qDOLAPo4k85QCfItlRZmwl2XbPZq7kbe13MqF2wxx
+    yiLalm6veK+ehU9MYN104hJZnuce5iEcZurk+8A+Pwn1Ifz+oWKVbUtUP3uV8Sm3
+    chktJ2H1bebXtNJE5TwvdHiUkXU9ywQt2FkxiTSl6+eac7JKEQ8lVN/o6uYxF5ds
+    +oIZplb7bv2XxsRCzq55F2tJX7fIzqXrSa+lQTnfLGmDVMAQX4TRB/lx0Gqd1a9y
+    qGfFnZ7xVyW97f6PiL8MoxPfd2I2JzrzGyP/igNbFOW0ho1OwfxVmvZeS7fQSc5e
+    +qu+nwnFfl0S4cHRif3G3zmz8Ryx9LM5TYkH41qePIHxoEO2sV0DgWJvbSjysV2S
+    EU2a31dJ0aZ+z6YtZVpHlujKMVzxVTrqj74trS4LvU5h/9hv7e1gjYdox1TO0HMK
+    mtDfgBevB21Tvxpz67Ijf31HvfTmCerKJEOjGnbYmyYpMeMNSONRDcToWk8sUwvi
+    OWa5jlUFRAxgXNM09vCTPi9aRUhcFqACqfAd6I1NqGVlfplLWrc7SWaSa+PsLfBf
+    4EOZfk8iEKBVeYXNjg+CcD8j8yk/oEs816/jpihIk8haCDRWYWGKyyGnwn6OQb8d
+    MdRO2b7Oi/AAmEF3jMlICqv286GIYK5qTKk2/CKHlOLPnsWEuA==
+    -----END CERTIFICATE-----
+  '';
+}
diff --git a/nixos/tests/common/letsencrypt/common.nix b/nixos/tests/common/letsencrypt/common.nix
deleted file mode 100644
index bd559c8dacc5..000000000000
--- a/nixos/tests/common/letsencrypt/common.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{ lib, nodes, pkgs, ... }: let
-  letsencrypt-ca = nodes.letsencrypt.config.test-support.letsencrypt.caCert;
-in {
-  networking.nameservers = [
-    nodes.letsencrypt.config.networking.primaryIPAddress
-  ];
-
-  security.acme.acceptTerms = true;
-  security.acme.email = "webmaster@example.com";
-
-  security.pki.certificateFiles = [ letsencrypt-ca ];
-}
diff --git a/nixos/tests/common/letsencrypt/snakeoil-certs.nix b/nixos/tests/common/letsencrypt/snakeoil-certs.nix
deleted file mode 100644
index ca4f71ae688a..000000000000
--- a/nixos/tests/common/letsencrypt/snakeoil-certs.nix
+++ /dev/null
@@ -1,254 +0,0 @@
-# Generated via mkcert.sh in the same directory.
-{
-  ca.key = builtins.toFile "ca.key" ''
-    -----BEGIN PRIVATE KEY-----
-    MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDQ0b23I1srJZwR
-    2MMdvSJK5pcwLfrXU+4gEZEnWNyT8yeVweya+8vmNNOlvK3zxf+ZiY/7aQ0RZJMO
-    h2+VdlgHmr2QKhQTf1HwfZA/06FolD3/DcS+DMJMSTVr179/XLndeVVZUqU7tjvB
-    AWKSIS8H2hSF1UOPi9gBDR8MwCP6Qgj8WYhbkt9q47/lO96qAmm6U1F+Q7RYM9ZQ
-    IWI81N0Ms5wJocg7n6S19iV66ePh7APapZFYup61gFGWfahmA217ELIZd56n8yjO
-    F0epb9sC0XpYCDRrYKBWLqPiv+6wvdZtZvALItyIv08ZwXlBkFg3LbAAhPnf0Vxz
-    pYysQmyyyzkgy252n+Sie0kx+B4qm6fOkpfgYlPSVTb2dXx/be/SE08u0a9FO0fZ
-    pkByWEZJUUwngsJgLUa7MorQf3avxozfC25XqvzbieZfSXlA7mOUclZbC/WUFpyj
-    MlyJU2eCQ8wSwsPXl91oxcYlOkuVLgd41gr9pGXQSuKIkrgbfkftjg2tDC+7g7O8
-    qrdF42FjbZjIx/74AasmsGh4GTQtiSkvEnTstioC6aCV44DlJWbBIMvkyawubjUl
-    Ppij0H66Y9Q4tEc/ktc7oGQfqqluyLb43TeobTPHALsNeAYb39rMtBo5DDCUc81s
-    fuDMhMr/oYXKrFstUsg5AY6mJaRG0QIDAQABAoICAF5ZVfmoPOoKzTB3GvmV2iez
-    dj4rmDmwT1gn98iqasdiRtFwVGJWQHNcDQDGdmY9YNZThD2Y4nGoWpVm9jC2zuFo
-    thusF3QTw8cARKvCCBzDVhumce1YwHVNYpi+W2TFValOyBRathN7rBXxdUMHQUOv
-    8jPh/uudyNP4xL2zFs5dBchW/7g4bT/TdYGyglGYU4L/YEPHfXWYvk1oOAW6O8Ig
-    aPElKt5drEMW2yplATSzua4RvtEzSMBDIRn43pxxEgdXrNC67nF9+ULc2+Efi/oD
-    Ad9CncSiXO9zlVK/W655p6e4qd6uOqyCm8/MTegkuub7eplRe8D3zGjoNN4kCQ4S
-    rckVvIDDb6vZk7PKx9F7GWIqaG/YvFFFKO1MrAZg7SguFA6PtGOYAFocT03P6KXT
-    l2SnZQWKyxUAlh4tOBGlRFgGCx/krRIKbgNYn/qk/ezcRl8c7GpOPh+b7Icoq7u3
-    l4tIVBBHqS8uGgtyi+YwuJeht2MV1aEcSkykKLh2ipp8tb6spORJUkhjawDjvxeQ
-    GztN30Xh2riTXYZ0HExVTtJa8jyvFyp/97ptPIJXaVt2A2KIS3sBFHKnpY+/OrQg
-    uUauYgi13WFHsKOxZL9GYGk7Ujd8bw4CEcJFxKY7bhpGVI6Du7NRkUDWN0+0yusI
-    2szCJ7+ZqJkrc1+GrI/RAoIBAQDseAEggOLYZkpU2Pht15ZbxjM9ayT2ANq1+RTu
-    LjJx4gv2/o/XJCfMZCL0b9TJqtYeH+N6G9oDRJ99VIhUPedhWSYdj9Qj+rPd++TS
-    bp+MoSjmfUfxLTDrmFHL7ppquAE65aDy3B5c+OCb0I4X6CILUf0LynBzgl4kdrzN
-    U6BG3Mt0RiGPojlPV82B9ZUF/09YAz7BIz9X3KMhze1Gps5OeGuUnc9O2IAJYkrj
-    ur9H2YlNS4w+IjRLAXSXUqC8bqPZp6WTo1G/rlyAkIRXCGN90uk5JQvXoj9immFO
-    WaylbdcNG3YcGutreYeZL/UIWF6zCdc6pYG0cCBJS6S/RN7FAoIBAQDiERrLuUbV
-    3fx/a8uMeZop6hXtQpF7jlFxqUmza7QSvBuwks4QVJF+qMSiSvKDkCKqZD4qVf4N
-    TMxEj5vNR0PbnmDshyKJNGVjEauKJSb65CFDUcL1eR/A/oJvxiIdN1Z4cPrpnRux
-    /zIfPuYfYHpdz52buxxmlD7bfwYmVKVpnzjB9z0I1CasZ5uqB0Z8H0OLyUu8S4ju
-    RfkKBDMgVl2q96i8ZvX4C1b7XuimIUqv4WHq5+ejcYirgrYtUbBIaDU3/LORcJdy
-    /K76L1/up70RTDUYYm/HKaRy+vMTpUsZJ7Qbh0hrvQkUvNQ1HXjprW2AePIYi33N
-    h3mb1ulqw4idAoIBAQCsn0YjVjNDShkFK4bfmLv4rw2Ezoyi0SjYIsb2wN6uaBfX
-    7SlQIuKywH8L9f9eYMoCH8FNyLs0G4paUbVb2fzpAc1jUzXINiHL8TCvtXXfkV5s
-    NBSqqRTHR+CegMZVFZJATpVZ9PptYHmHBY5VQW5o2SdizhudFxRmhg95zIx6boBP
-    l0q0sfYoR66MKpzpTeG8HFJZZ8O7/iNQcCXAp9B/VEUkrrdBlaaSMyD8cb1lVBZ5
-    SKdOTGXkQ2G7feQ86n/OSiYDSvxIc56vc9BIQKVwmuEKiFLGzXh8ILrcGXaBJVgS
-    B3QHPFeTk5o7Z9j2iJxJEuv9sginkhrfpsrTnhEJAoIBACkrUkTtjd/e2F/gIqaH
-    crLVZX7a06G7rktTuA9LuvR6e1Rxt8Mzk3eMhprDqVyaQCXlsYiGNoj3hm+p84az
-    xsDVG/OXPIveFeSv0ByNXYbtSr12w1lu4ICGGP0ACTBm5oFymc83hFarEdas3r2y
-    FTbGW36D2c04jCXvARCz85fDnlN8kgnskMpu5+NUBdsO2n83fmphGyPBbHQNhb4K
-    3G4JQhplab/tWL7YbufqQi67jdh4uS+Duo75c/HW4ZKeH6r9gzomVf5j0/3N6NuO
-    gpkG1tiE/LQ5ejBSUTgvrvh6yYsF3QN53pB/PuoZXu63Xay62ePsa1GlrVjbD5EY
-    4OUCggEAJFr7F7AQLMJTAxHFLCsZZ0ZZ+tXYclBC4eHPkZ6sD5jvL3KIpW3Q7jXk
-    oIoD/XEX4B+Qe5M3jQJ/Y5ZJETHcgfcHZbDpCKN2WHQgldQbAJiFd4GY1OegdVsr
-    7TC8jh3Q2eYjzL8u4z7LSNI6aQSv1eWE7S1Q5j/sX/YYDR4W3CBMeIUpqoDWpn87
-    czbIRyA/4L0Y/HLpg/ZCbvtJZbsQwYXhyqfbjlm4BRQ6JiC5uEBKvuDRUXToBJta
-    JU8XMm+Ae5Ogrw7P6hg68dWpagfjb7UZ7Zxv+VDsbrU6KsDcyGCAwrrRZou/6KUG
-    Eq4OVTSu/s8gmY94tgbjeOaLUPEPmg==
-    -----END PRIVATE KEY-----
-  '';
-  ca.cert = builtins.toFile "ca.cert" ''
-    -----BEGIN CERTIFICATE-----
-    MIIFDzCCAvegAwIBAgIUU9rbCLTuvaI6gjSsFsJJjfLWIX8wDQYJKoZIhvcNAQEL
-    BQAwFjEUMBIGA1UEAwwLU25ha2VvaWwgQ0EwIBcNMTkxMDE4MDc1NDEyWhgPMjEx
-    OTA5MjQwNzU0MTJaMBYxFDASBgNVBAMMC1NuYWtlb2lsIENBMIICIjANBgkqhkiG
-    9w0BAQEFAAOCAg8AMIICCgKCAgEA0NG9tyNbKyWcEdjDHb0iSuaXMC3611PuIBGR
-    J1jck/MnlcHsmvvL5jTTpbyt88X/mYmP+2kNEWSTDodvlXZYB5q9kCoUE39R8H2Q
-    P9OhaJQ9/w3EvgzCTEk1a9e/f1y53XlVWVKlO7Y7wQFikiEvB9oUhdVDj4vYAQ0f
-    DMAj+kII/FmIW5LfauO/5TveqgJpulNRfkO0WDPWUCFiPNTdDLOcCaHIO5+ktfYl
-    eunj4ewD2qWRWLqetYBRln2oZgNtexCyGXeep/MozhdHqW/bAtF6WAg0a2CgVi6j
-    4r/usL3WbWbwCyLciL9PGcF5QZBYNy2wAIT539Fcc6WMrEJssss5IMtudp/kontJ
-    MfgeKpunzpKX4GJT0lU29nV8f23v0hNPLtGvRTtH2aZAclhGSVFMJ4LCYC1GuzKK
-    0H92r8aM3wtuV6r824nmX0l5QO5jlHJWWwv1lBacozJciVNngkPMEsLD15fdaMXG
-    JTpLlS4HeNYK/aRl0EriiJK4G35H7Y4NrQwvu4OzvKq3ReNhY22YyMf++AGrJrBo
-    eBk0LYkpLxJ07LYqAumgleOA5SVmwSDL5MmsLm41JT6Yo9B+umPUOLRHP5LXO6Bk
-    H6qpbsi2+N03qG0zxwC7DXgGG9/azLQaOQwwlHPNbH7gzITK/6GFyqxbLVLIOQGO
-    piWkRtECAwEAAaNTMFEwHQYDVR0OBBYEFAZcEiVphGxBT4OWXbM6lKu96dvbMB8G
-    A1UdIwQYMBaAFAZcEiVphGxBT4OWXbM6lKu96dvbMA8GA1UdEwEB/wQFMAMBAf8w
-    DQYJKoZIhvcNAQELBQADggIBAGJ5Jnxq1IQ++IRYxCE7r7BqzzF+HTx0EWKkSOmt
-    eSPqeOdhC26hJlclgGZXAF/Xosmn8vkSQMHhj/jr4HI0VF9IyvDUJm8AKsnOgu/7
-    DUey3lEUdOtJpTG9NyTOcrzxToMJ+hWlFLZKxx2dk4FLIvTLjmo1VHM97Bat7XYW
-    IrL9RRIZ25V+eCYtlR7XYjceGFQ0rCdp8SFIQwC6C/AH2tV3b1AJFsND9PcoLu7c
-    //fH+WUQCcD/N0grdC/QCX7AFWzd4rKQ8gjfND4TSYFTSDwW10Mud4kAVhY2P1sY
-    Y3ZpnxWrCHbIZMbszlbMyD+cjsCBnNvOtYGm7pDut/371rllVcB/uOWYWMCtKPoj
-    0elPrwNMrK+P+wceNBCRQO+9gwzB589F2morFTtsob/qtpAygW8Sfl8M+iLWXeYS
-    c3LBLnj0TpgXKRWg7wgIWKSZx9v6pgy70U0qvkjNS1XseUCPf7hfAbxT3xF+37Dw
-    zZRwF4WAWqdnJoOey21mgc+a2DQzqtykA6KfHgCqNFfDbQXPXvNy25DDThbk+paX
-    G2M2EWtr+Nv9s/zm7Xv/pOXlgMFavaj+ikqZ4wfJf6c/sMOdZJtMA4TsYtAJgbc8
-    ts+0eymTq4v5S8/fW51Lbjw6hc1Kcm8k7NbHSi9sEjBfxFLTZNQ5eb4NGr9Od3sU
-    kgwJ
-    -----END CERTIFICATE-----
-  '';
-  "acme-v02.api.letsencrypt.org".key = builtins.toFile "acme-v02.api.letsencrypt.org.key" ''
-    -----BEGIN RSA PRIVATE KEY-----
-    MIIJKQIBAAKCAgEApny0WhfDwEXe6WDTCw8qBuMAPDr88pj6kbhQWfzAW2c0TggJ
-    Etjs9dktENeTpSl14nnLVMiSYIJPYY3KbOIFQH1qDaOuQ7NaOhj9CdMTm5r9bl+C
-    YAyqLIMQ9AAZDhUcQjOy3moiL7ClFHlkFYuEzZBO9DF7hJpfUFIs0Idg50mNoZh/
-    K/fb4P2skNjfCjjomTRUmZHxT6G00ImSTtSaYbN/WHut1xXwJvOoT1nlEA/PghKm
-    JJ9ZuRMSddUJmjL+sT09L8LVkK8CKeHi4r58DHM0D0u8owIFV9qsXd5UvZHaNgvQ
-    4OAWGukMX+TxRuqkUZkaj84vnNL+ttEMl4jedw0ImzNtCOYehDyTPRkfng5PLWMS
-    vWbwyP8jDd2578mSbx5BF7ypYX366+vknjIFyZ5WezcC1pscIHxLoEwuhuf+knN+
-    kFkLOHeYbqQrU6mxSnu9q0hnNvGUkTP0a/1aLOGRfQ5C/pxpE/Rebi8qfM/OJFd4
-    mSxGL93JUTXWAItiIeBnQpIne65/Ska9dWynOEfIb0okdet3kfmNHz3zc17dZ5g4
-    AdOSCgHAlQgFt/Qd8W6xXUe4C5Mfv2ctxRrfQhDwtB6rMByPwzImnciC2h3vCwD3
-    vS/vjUyWICyhZyi2LZDUQz+sCKBXCYYcYh8ThFO40j5x1OnYMq7XQvyl8QkCAwEA
-    AQKCAgBSAfdssWwRF9m3p6QNPIj9H3AMOxpB/azffqTFzsSJwYp4LWkayZPfffy+
-    4RGvN38D8e6ActP3ifjEGu3tOGBR5fUJhujeHEiDea+a2Ug9S9kuNwmnelWQ23bM
-    Wgf9cdSbn4+qEymHyEFolmsAWdsuzri1fHJVXR06GWBNz4GiLA8B3HY4GD1M1Gfe
-    aZVkGagpXyeVBdiR2xuP5VQWVI8/NQWzdiipW/sRlNABVkyI3uDeN4VzYLL3gTeE
-    p021kQz4DSxIjHZacHpmWwhBnIbKMy0fo7TlrqcnIWXqTwv63Q9Zs/RN8NOyqb0Y
-    t1NKFWafcwUsdOnrG9uv/cVwF1FNE8puydaOi8rL1zAeK89JH8NRQ02wohR9w8qy
-    b2tB6DyGMtuqBt8Il6GA16ZoEuaXeayvlsvDEmG1cS9ZwBvfgrVPAmlm2AYdIf5B
-    RHIJu4BJC6Nn2ehVLqxx1QDhog3SOnAsCmcfg5g/fCwxcVMLIhODFoiKYGeMitDG
-    Q4e5JKcOg+RR8PT/n4eY4rUDBGtsR+Nw8S2DWgXmSufyfDtKCjZB4IuLWPS29tNh
-    zF6iYfoiTWzrSs/yqPSKIFpv+PWZwkKSvjdxia6lSBYYEON4W2QICEtiEs+SvcG4
-    0eIqWM+rRmPnJyMfGqX6GCs3rHDQB2VNJPBCYPQalJ/KwZumAQKCAQEA0ezM6qPJ
-    1JM/fddgeQ50h0T9TRXVUTCISxXza+l4NuFt1NdqUOdHsGtbL1JR4GaQUG8qD1/P
-    R39YgnQEQimxpmYLCZkobkwPxTZm9oiMXpcJrlN4PB5evaWShRSv3mgigpt3Wzml
-    Td+2R9RoA/hvF/wEyIvaWznYOyugBC7GXs20dNnZDULhUapeQu7r6JvgmxBOby7S
-    0FbhGplBiSDETzZURqzH/GMJKaJtNgyyVf3Hbg4mZAQDWoBRr+8HxsNbDkxP6e91
-    QrPHy2VZFiaTmJfoxRhyMTn7/JZaLJaUHDOniOsdMj/V7vMCgpfBqh5vR8bKzuPy
-    ZINggpcFPp1IYQKCAQEAywc7AQoktMBCru/3vzBqUveXbR3RKzNyZCTH5CMm3UNH
-    zmblFgqF2nxzNil21GqAXzSwZk5FyHbkeD3yvEZm+bXzsZTDNokAwoiTgyrr2tf8
-    GLMlCHHl5euIh1xHuyg/oKajVGOoXUXK8piqiDpQKd3Zwc6u2oyQlh+gYTPKh+7i
-    ilipkYawoE6teb6JUGpvU+d27INgNhB2oDEXY3pG2PbV+wv229ykSZxh1sJUdDwT
-    a8eTg+3pCGXtOZiJoQTFwKUlD2WYTGqS4Gx6dIJco5k+ZikGNST1JGE64Jl4MZdI
-    rtyvpcYblh5Q14sJGvp4kWYS9tjEM8pA+4Z9th3JqQKCAQEAkidH0+UM1A9gmQCm
-    jiHeR39ky5Jz3f7oJT63J15479yrVxBTWNhtNQrJhXzOvGkr+JQsuF+ANMsYmFql
-    zFqy8KMC9D/JwmD6adeif+o5sHF/r/s1LsYGOAtao4TvnOzrefs7ciwERt+GTSQ4
-    9uq0jgJMYkPcVr9DKI8K7V6ThdW52dECKRVzQiRXVEp7vIsqKUuFECuNYrfaKWai
-    FhLWGkA9FKee5L0e1/naB1N3ph72Bk2btO6GVzAXr2HADEZe0umWiczJ2xLH+3go
-    Oh/JiufYi8ClYFh6dDVJutlrbOcZsV3gCegfzikqijmWABcIavSgpsJVNF2zh7gV
-    Uq62gQKCAQAdO2FHeQpn6/at8WceY/4rC/MFhvGC4tlpidIuCtGhsfo4wZ/iWImF
-    N73u4nF1jBAHpTJwyHxLrLKgjWrRqOFSutvniZ/BzmAJolh63kcvL0Hg3IpMePm8
-    7PivZJ3/WIAwxU1m7SJkq5PY8ho7mwnHvWWI/hU26l42/z68QBS9FawQd0uS5G2x
-    5yIbEU/8ABcfYYhB7XiA0EYEMo1HiWeB/ag5iTN13ILbBmUf4sL+KVgygH3A1RRk
-    XSiWzluij2lZn22ClgIjnoSfQ38uH0bvVzUgyG9YX4XcQxOTGwWvPjT82FGB8NAw
-    ARVqs14QQFfzt1qrp/I38rsAfBDFk+xhAoIBAQCEKNk/oJcy9t/jMIbLcn6z3aCc
-    Fn8GBPSXtFj0t6weN5lHof+cggw4owMFWQQyAXxo/K6NnKNydMPZ5qjtLsHNpbpQ
-    aT1Or0/1YR1bJ8Lo82B4QM++7F761GWQPvE/tyrfPkfkWl92ITIpmnlw4wycRlkq
-    9anI2fnj1nIZwixzE2peb6PcsZU2HOs9uZ5RRd9wia696I7IpNibs4O4J2WTm4va
-    +NeYif3V2g9qwgT0Va0c9/Jlg3b58R0vA8j/VCU5I0TyXpkB3Xapx+pvEdZ3viUL
-    mXZaVotmWjgBXGDtd2VQg2ZiAMXHn3RzXSgV4Z+A/XacRs75h9bNw0ZJYrz1
-    -----END RSA PRIVATE KEY-----
-  '';
-  "acme-v02.api.letsencrypt.org".cert = builtins.toFile "acme-v02.api.letsencrypt.org.cert" ''
-    -----BEGIN CERTIFICATE-----
-    MIIEtDCCApwCAgKaMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC1NuYWtlb2ls
-    IENBMCAXDTE5MTAxODA3NTQxM1oYDzIxMTkwOTI0MDc1NDEzWjAnMSUwIwYDVQQD
-    DBxhY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnMIICIjANBgkqhkiG9w0BAQEF
-    AAOCAg8AMIICCgKCAgEApny0WhfDwEXe6WDTCw8qBuMAPDr88pj6kbhQWfzAW2c0
-    TggJEtjs9dktENeTpSl14nnLVMiSYIJPYY3KbOIFQH1qDaOuQ7NaOhj9CdMTm5r9
-    bl+CYAyqLIMQ9AAZDhUcQjOy3moiL7ClFHlkFYuEzZBO9DF7hJpfUFIs0Idg50mN
-    oZh/K/fb4P2skNjfCjjomTRUmZHxT6G00ImSTtSaYbN/WHut1xXwJvOoT1nlEA/P
-    ghKmJJ9ZuRMSddUJmjL+sT09L8LVkK8CKeHi4r58DHM0D0u8owIFV9qsXd5UvZHa
-    NgvQ4OAWGukMX+TxRuqkUZkaj84vnNL+ttEMl4jedw0ImzNtCOYehDyTPRkfng5P
-    LWMSvWbwyP8jDd2578mSbx5BF7ypYX366+vknjIFyZ5WezcC1pscIHxLoEwuhuf+
-    knN+kFkLOHeYbqQrU6mxSnu9q0hnNvGUkTP0a/1aLOGRfQ5C/pxpE/Rebi8qfM/O
-    JFd4mSxGL93JUTXWAItiIeBnQpIne65/Ska9dWynOEfIb0okdet3kfmNHz3zc17d
-    Z5g4AdOSCgHAlQgFt/Qd8W6xXUe4C5Mfv2ctxRrfQhDwtB6rMByPwzImnciC2h3v
-    CwD3vS/vjUyWICyhZyi2LZDUQz+sCKBXCYYcYh8ThFO40j5x1OnYMq7XQvyl8QkC
-    AwEAATANBgkqhkiG9w0BAQsFAAOCAgEAkx0GLPuCvKSLTHxVLh5tP4jxSGG/zN37
-    PeZLu3QJTdRdRc8bgeOGXAVEVFbqOLTNTsuY1mvpiv2V6wxR6nns+PIHeLY/UOdc
-    mOreKPtMU2dWPp3ybec2Jwii6PhAXZJ26AKintmug1psMw7662crR3SCnn85/CvW
-    192vhr5gM1PqLBIlbsX0tAqxAwBe1YkxBb9vCq8NVghJlKme49xnwGULMTGs15MW
-    hIPx6sW93zwrGiTsDImH49ILGF+NcX1AgAq90nG0j/l5zhDgXGJglX+K1xP99X1R
-    de3I4uoufPa5q+Pjmhy7muL+o4Qt0D0Vm86RqqjTkNPsr7gAJtt66A7TJrYiIoKn
-    GTIBsgM6egeFLLYQsT0ap/59HJismO2Pjx4Jk/jHOkC8TJsXQNRq1Km76VMBnuc0
-    2CMoD9pb38GjUUH94D4hJK4Ls/gJMF3ftKUyR8Sr/LjE6qU6Yj+ZpeEQP4kW9ANq
-    Lv9KSNDQQpRTL4LwGLTGomksLTQEekge7/q4J2TQRZNYJ/mxnrBKRcv9EAMgBMXq
-    Q+7GHtKDv9tJVlMfG/MRD3CMuuSRiT3OVbvMMkFzsPkqxYAP1CqE/JGvh67TzKI+
-    MUfXKehA6TKuxrTVqCtoFIfGaqA9IWyoRTtugYq/xssB9ESeEYGeaM1A9Yueqz+h
-    KkBZO00jHSE=
-    -----END CERTIFICATE-----
-  '';
-  "letsencrypt.org".key = builtins.toFile "letsencrypt.org.key" ''
-    -----BEGIN RSA PRIVATE KEY-----
-    MIIJKgIBAAKCAgEA9dpdPEyzD3/BBds7tA/51s+WmLFyWuFrq4yMd2R+vi5gvK7n
-    lLNVKhYgiTmK2Um+UEpGucJqZHcTSZA1Bz4S/8ND/AI9I6EmwvBinY5/PubxEALk
-    9YiDA+IzH8ZGFM8wXg7fMbbJAsyv+SHAtr2jmCsggrpuD5fgzs2p+F2q0+oVoeFw
-    MAOUdAf2jNtNLEj2Q6MiR5Xq+wFOcRtXlNlXWIX3NrmubO/xOpDNpsyjyYC5Ld+W
-    06MS5bTHSdv56AkUg2PugMChj15TOddEJIK8zPXFTlMYye9SKwjhNUZovfe4xXCa
-    Tj2nmzrcuMKLz+S3sKQeTWjiRcY3w4zTlAbhtGXDjXjhMObrHoWM8e3cTL4NJMvt
-    tNStXficxbeTbIiYu+7dtF0q+iWaZqexc6PdAaIpFZ0XSw+i5iLdQZmBwzY7NLlH
-    pQupfh6ze0qDUVZAMDubo4JKUTBzH6QTuhHx+uUm7Lc8YdNArn7o/vMZDQym1Eia
-    xKxZuCGaqFvq8ZK4nBVsHfcXbhF/XD2HMid3t7ImbREVu9qnc+En+acU/SJaaL3r
-    jMW6HLVMr6+vQrCzYkvLzKYpoUm9D1Kcn6d8Ofxl2iCaY9CkMr5/6J1p1wcTdcN7
-    IVQ/DFBeTDauyWbyZkO/lPoZoakWyXOx9S9tgClzhFmNgRkZv9wN+QguNDcCAwEA
-    AQKCAgEA0ndlacGfaJ1NeN39dmBW2XZMzdrassJXkjx34528gsLhPaXdyobbWXQn
-    1lHUc7+VlNaBRXUR73+gm1FAlDqnuRxIjuy7ukyzCh8PzSG3/PlnVPWlXCzJPAHh
-    EkqCpD3agirpF34LBsKDwxsKB2bBLft9kWxX3DGA2olmAKDvJQs4CaUcjX4DEHHg
-    tyTmJAsyByUYq3/D8a1koZ9ukpadF8NXpxm+ILQoJqLf6vM1I8N2w7atP/BStSLV
-    mH0gq2tajEB4ZPCDXmC5jsKiKz9gsXWUu0CX8AdYqE6pvRnRgQ8Ytq1265QMb+8s
-    FV82oXqDZkyZRFuNmX3fLyDX39kkTcVS37S56Gzk4EzDWE/u2RXCAPeWla2zUFYI
-    hg8X4ZAwbZRODtK2cZTuCZEILM/iKmtSgHC+aQhp18EUAefa7WGrRD4AvbTxH4VF
-    ek60bwISBk5Mhf39MwqIiQxGOFmfLsQReZvzH4jI5zfDXf/0yZ/1SdGeu6+Walt0
-    V81Ua/DB6zshHpeSP74HMuJHZ4DOQfcV/ndyzvoP84pAjenSx6O034OwQTkpoMI/
-    f/2rK8kdzYSL4f//kFMuRLqmAwOmAFYB2oMo0/YaIoQ4vgTHDKTSxj5mbno56GdT
-    huMAVMKskaCSVbyMB/xyQG7senLItVv+HafVk6ChMUbkIjv9zgECggEBAP+ux1RG
-    cETGjK2U3CRoHGxR7FwaX6hkSokG+aFdVLer+WUrZmR8Ccvh2ALpm8K1G6TTk/5X
-    ZeVX4+1VFYDeTHMN8g20usS5mw3v2GF3fGxGLe4q56l4/4kKMZOrSBuWH4niiIKD
-    0QogdzWkpQJ93nMbZxZ5lk+lRZVf3qSm6nzyP468ndrfI57Ov5OUIWZ7KhTUH9IK
-    8/urUk+lEvyzQmNTlt5ZZXRz7cR01K8chx1zevVAyynzSuGjTysaBN7LTT0v3yVu
-    96yKNsxJvuIz2+4qSjhbnN4jH+feN0VsdF3+Qkru0lBmLVgJl4X67XFaAKMDU9yv
-    3alS53Pkol+Dy1cCggEBAPYodofHC1ydoOmCvUAq4oJNtyI4iIOY/ch3sxVhkNyi
-    KBscQqbay/DiXFiNl+NsemzB1PrHzvCaqKcBKw537XzeKqUgYuVLkFGubf9bDhXi
-    wSRcYbU/oNTgiTgXPW8wH60uIoLaiNi1/YjO2zh4GEY/kFqSuD54Y91iFmcC75bv
-    OjCNugnRdpRjOFhaeNx75tdverR37w3APVZuBSv3bJlMPCtaf+fEAKxJxeqCs3Oq
-    rtsw2TQ4TqfE8/w9qPCVv3bQbMbO48SwjxAz47qH2h3qGu3Ov8badeARe+Ou7nuI
-    U13gPuPOhPXIQP/MYOyamPJdFyng1b8vyNsfjOcWMiECggEAEkMgl6NkV3U7DRbp
-    1mvdQ9tiH33+wR9Qt5LY966b43aUHKbJ7Hlzla1u6V5YMsMO02oNUwhZDdWGQShn
-    ncnC+iDP3iy/flenfIpaETQgnfcxRqan31H2Joqk2eBNCTNi001r5K6XmrqQ6TL2
-    WkQ1RFF7vn42vz+VxcKQO4B0lTIUWhSczcpMWAZ6ZocZD6HScqRoFW+U16/39Bpd
-    TdFb944742vNNFEndXXGzy8hc3gRGz1ihX+MJKuuduyn1mX9AVbPAHR5mkhQ+6x0
-    xuFfXxaEMJxSiwdFOyGDHyFM+n2zrHh8ayOxL22X9gjjNspv6zTMo6GoGnUCdSOq
-    eVoHhwKCAQEAot5O3rOB/vuEljwcv7IgQJrvCsNg/8FgWR1p7kGpuXHJG3btWrz1
-    pyH+e9DjqGQD9KWjJ3LAp02NPUJ2nJIZHj9Y8/yjspb2nDTPLt+uSCjKJibBt0ys
-    O219HRGzYjfzHYCi8PVrCggQAk7rmUdMuF4iQutE4ICDgtz9eZbls3YBiFKdvxVK
-    Yg/sHflucmPAbtah13prPyvs6ZzN6zNANYXNYdn1OwHieBwvyWRFG8jY/MorTHPd
-    BwA3drPNbbGHBzQMZNZKub8gSVYr3SU52gUlYCclmIq+50xqLlF2FWIz1q8irVPd
-    gUnIR/eQQbxgaivRwbGze1ZAjUsozVVQQQKCAQEA9uAKU3O06bEUGj+L0G+7R7r/
-    bi2DNi2kLJ7jyq+n0OqcHEQ1zFK4LAPaXY0yMYXieUzhivMGLSNDiubGO2/KxkFF
-    REXUFgYWZYMwrKsUuscybB64cQDwzD0oXrhvEa2PHecdG6AZ63iLcHaaDzyCPID/
-    wtljekLO2jbJ5esXZd016lykFfUd/K4KP1DGyI2Dkq6q0gTc/Y36gDAcPhIWtzna
-    UujYCe3a8DWCElH4geKXaB5ABbV1eJ8Lch599lXJ9Hszem6QNosFsPaHDCcqLS9H
-    yy2WA6CY2LVU7kONN+O0kxs2fVbxIkI+d/LZyX/yIGlkXcAzL07llIlrTAYebQ==
-    -----END RSA PRIVATE KEY-----
-  '';
-  "letsencrypt.org".cert = builtins.toFile "letsencrypt.org.cert" ''
-    -----BEGIN CERTIFICATE-----
-    MIIEpzCCAo8CAgKaMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC1NuYWtlb2ls
-    IENBMCAXDTE5MTAxODA3NTQxNVoYDzIxMTkwOTI0MDc1NDE1WjAaMRgwFgYDVQQD
-    DA9sZXRzZW5jcnlwdC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
-    AQD12l08TLMPf8EF2zu0D/nWz5aYsXJa4WurjIx3ZH6+LmC8rueUs1UqFiCJOYrZ
-    Sb5QSka5wmpkdxNJkDUHPhL/w0P8Aj0joSbC8GKdjn8+5vEQAuT1iIMD4jMfxkYU
-    zzBeDt8xtskCzK/5IcC2vaOYKyCCum4Pl+DOzan4XarT6hWh4XAwA5R0B/aM200s
-    SPZDoyJHler7AU5xG1eU2VdYhfc2ua5s7/E6kM2mzKPJgLkt35bToxLltMdJ2/no
-    CRSDY+6AwKGPXlM510QkgrzM9cVOUxjJ71IrCOE1Rmi997jFcJpOPaebOty4wovP
-    5LewpB5NaOJFxjfDjNOUBuG0ZcONeOEw5usehYzx7dxMvg0ky+201K1d+JzFt5Ns
-    iJi77t20XSr6JZpmp7Fzo90BoikVnRdLD6LmIt1BmYHDNjs0uUelC6l+HrN7SoNR
-    VkAwO5ujgkpRMHMfpBO6EfH65Sbstzxh00Cufuj+8xkNDKbUSJrErFm4IZqoW+rx
-    kricFWwd9xduEX9cPYcyJ3e3siZtERW72qdz4Sf5pxT9IlpoveuMxboctUyvr69C
-    sLNiS8vMpimhSb0PUpyfp3w5/GXaIJpj0KQyvn/onWnXBxN1w3shVD8MUF5MNq7J
-    ZvJmQ7+U+hmhqRbJc7H1L22AKXOEWY2BGRm/3A35CC40NwIDAQABMA0GCSqGSIb3
-    DQEBCwUAA4ICAQBbJwE+qc0j6JGHWe0TGjv1viJU3WuyJkMRi+ejx0p/k7Ntp5An
-    2wLC7b/lVP/Nh+PKY/iXWn/BErv2MUo4POc1g8svgxsmMMh5KGGieIfGs7xT+JMH
-    dzZZM+pUpIB5fEO5JfjiOEOKDdAvRSs0mTAVYZEokGkXSNWyylvEaA16mHtMgPjo
-    Lm75d0O66RfJDdd/hTl8umGpF7kEGW1qYk2QmuPr7AqOa8na7olL5fMPh6Q7yRqx
-    GIS9JKQ0fWl8Ngk09WfwUN/kEMcp9Jl5iunNRkbpUJIM/lHFkSA7yOFFL+dVWzd4
-    2r+ddJXTFzW8Rwt65l8SV2MEhijEamKva3mqKLIRWxDsfFVT1T04LWFtnzMW4Z29
-    UHF9Pi7XSyKz0Y/Lz31mNTkjJYbOvbnwok8lc3wFWHc+lummZk8IkCq8xfqzwmwX
-    Ow6EV+Q6VaQpOHumQZ12pBBLtL8DyDhWaRUgVy2vYpwYsMYa5BFMcKCynjlSewo9
-    G2hNoW45cQZP1qHltRR9Xad7SaP7iTETDCiR7AWOqSpDipSh9eMfVW97ZbSfz+vl
-    xl8PZEZMTRIIRVXsPP+E8gtDUhUQp2+Vcz8r6q71qslXM09xl/501uaNjCc3hH2R
-    iw2N77Lho1F3FrBbHdML3RYHZI55eC9iQw6R4S+R4b+iWLJoHzHrW61itg==
-    -----END CERTIFICATE-----
-  '';
-}
diff --git a/nixos/tests/common/resolver.nix b/nixos/tests/common/resolver.nix
index 6be8d1d18e62..09a74de20faa 100644
--- a/nixos/tests/common/resolver.nix
+++ b/nixos/tests/common/resolver.nix
@@ -18,7 +18,7 @@
       defining this option needs to be explicitly imported.
 
       The reason this option exists is for the
-      <filename>nixos/tests/common/letsencrypt</filename> module, which
+      <filename>nixos/tests/common/acme/server</filename> module, which
       needs that option to disable the resolver once the user has set its own
       resolver.
     '';

From 60e6ba663056eb84c50f3acb0443ab55b932be18 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Mon, 23 Mar 2020 17:58:36 +0000
Subject: [PATCH 42/59] nixos/tests/acme: use CAP_NET_BIND_SERVICE

(cherry picked from commit 695fd78ac45763b02ae4c68abda28974bb72c96b)
---
 nixos/tests/acme.nix                       | 3 +--
 nixos/tests/common/acme/server/default.nix | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index 855642e41922..7cb81f024118 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -33,8 +33,7 @@ in import ./make-test-python.nix {
         serviceConfig = {
           ExecStart = "${pkgs.pebble}/bin/pebble-challtestsrv -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.webserver.config.networking.primaryIPAddress}'";
           # Required to bind on privileged ports.
-          User = "root";
-          Group = "root";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         };
       };
     };
diff --git a/nixos/tests/common/acme/server/default.nix b/nixos/tests/common/acme/server/default.nix
index 9d9c2b3621a6..36c1a477392c 100644
--- a/nixos/tests/common/acme/server/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@@ -127,8 +127,7 @@ in {
         '';
         serviceConfig = {
           # Required to bind on privileged ports.
-          User = "root";
-          Group = "root";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         };
       };
     };

From f035e2638fc416bf7ad5039ef269ff98b7c6d5f2 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Mon, 23 Mar 2020 16:23:53 +0000
Subject: [PATCH 43/59] nixos/tests/common/acme: don't set nameservers for
 client

The resolver is mainly useful for the ACME server, and acme.nix uses its
own DNS server to test DNS-01 challenges.

(cherry picked from commit 21f183a3fe4eddbbb418cc1ee37a9f86526f675a)
---
 nixos/tests/common/acme/client/default.nix | 4 ----
 nixos/tests/common/acme/server/default.nix | 4 ++--
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/nixos/tests/common/acme/client/default.nix b/nixos/tests/common/acme/client/default.nix
index 22ba6f4df194..80893da02524 100644
--- a/nixos/tests/common/acme/client/default.nix
+++ b/nixos/tests/common/acme/client/default.nix
@@ -5,10 +5,6 @@ let
 in
 
 {
-  networking.nameservers = [
-    nodes.acme.config.networking.primaryIPAddress
-  ];
-
   security.acme = {
     server = "https://acme.test/dir";
     email = "hostmaster@example.test";
diff --git a/nixos/tests/common/acme/server/default.nix b/nixos/tests/common/acme/server/default.nix
index 36c1a477392c..1a0ee882572c 100644
--- a/nixos/tests/common/acme/server/default.nix
+++ b/nixos/tests/common/acme/server/default.nix
@@ -33,9 +33,9 @@
 # override networking.nameservers like this:
 #
 # {
-#   acme = { nodes, ... }: {
+#   acme = { nodes, lib, ... }: {
 #     imports = [ ./common/acme/server ];
-#     networking.nameservers = [
+#     networking.nameservers = lib.mkForce [
 #       nodes.myresolver.config.networking.primaryIPAddress
 #     ];
 #   };

From 2a7ea902370ca6f0f1d0511ccf17c7c6ff2d3b6a Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@protonmail.ch>
Date: Mon, 13 Apr 2020 19:20:08 -0400
Subject: [PATCH 44/59] README.md: 20.03 release

(cherry picked from commit 51fcafe7797c9140da3c66ed8f7e76661ea60303)
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f5090e023289..dfad6c4759c1 100644
--- a/README.md
+++ b/README.md
@@ -44,9 +44,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 19.09 release](https://hydra.nixos.org/jobset/nixos/release-19.09)
+* [Continuous package builds for the NixOS 20.03 release](https://hydra.nixos.org/jobset/nixos/release-20.03)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 19.09 release](https://hydra.nixos.org/job/nixos/release-19.09/tested#tabs-constituents)
+* [Tests for the NixOS 20.03 release](https://hydra.nixos.org/job/nixos/release-20.03/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are

From c6696bd6c70e0857603caff593f09b6200924e1b Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@protonmail.ch>
Date: Tue, 14 Apr 2020 09:55:55 -0400
Subject: [PATCH 45/59] CONTRIBUTING.md: 20.03

(cherry picked from commit a045b050dcc321bc21b0475b9dfc44cea1a1a350)
---
 .github/CONTRIBUTING.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index a50a8a507de3..ae4f68dddc19 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -53,9 +53,9 @@ For package version upgrades and such a one-line commit message is usually suffi
 To [backport a change into a release branch](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches):
 
 1. Take note of the commit in which the change was introduced into `master`.
-2. Check out the target _release branch_, e.g. `release-19.09`. Do not use a _channel branch_ like `nixos-19.09` or `nixpkgs-19.09`.
+2. Check out the target _release branch_, e.g. `release-20.03`. Do not use a _channel branch_ like `nixos-20.03` or `nixpkgs-20.03`.
 3. Use `git cherry-pick -x <original commit>`.
-4. Open your backport PR. Make sure to select the release branch (e.g. `release-19.09`) as the target branch of the PR, and link to the PR in which the original change was made to `master`.
+4. Open your backport PR. Make sure to select the release branch (e.g. `release-20.03`) as the target branch of the PR, and link to the PR in which the original change was made to `master`.
 
 ## Reviewing contributions
 

From b5fc240b3ba978835b71a780bcac9d8a07a563b3 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@protonmail.ch>
Date: Fri, 17 Apr 2020 12:41:24 -0400
Subject: [PATCH 46/59] nixos/manual: 19.09 -> 20.03

(cherry picked from commit 40f3faedbdeecc21ddc784019433e20e0dd82453)
---
 nixos/doc/manual/installation/upgrading.xml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/nixos/doc/manual/installation/upgrading.xml b/nixos/doc/manual/installation/upgrading.xml
index 92864cf2557a..e5e02aa07526 100644
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@@ -14,7 +14,7 @@
     <para>
      <emphasis>Stable channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-19.09">nixos-19.09</literal>.
+    xlink:href="https://nixos.org/channels/nixos-20.03">nixos-20.03</literal>.
      These only get conservative bug fixes and package upgrades. For instance,
      a channel update may cause the Linux kernel on your system to be upgraded
      from 4.19.34 to 4.19.38 (a minor bug fix), but not from
@@ -38,7 +38,7 @@
     <para>
      <emphasis>Small channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-19.09-small">nixos-19.09-small</literal>
+    xlink:href="https://nixos.org/channels/nixos-20.03-small">nixos-20.03-small</literal>
      or
      <literal
     xlink:href="https://nixos.org/channels/nixos-unstable-small">nixos-unstable-small</literal>.
@@ -63,8 +63,8 @@
  <para>
   When you first install NixOS, you’re automatically subscribed to the NixOS
   channel that corresponds to your installation source. For instance, if you
-  installed from a 19.09 ISO, you will be subscribed to the
-  <literal>nixos-19.09</literal> channel. To see which NixOS channel you’re
+  installed from a 20.03 ISO, you will be subscribed to the
+  <literal>nixos-20.03</literal> channel. To see which NixOS channel you’re
   subscribed to, run the following as root:
 <screen>
 # nix-channel --list | grep nixos
@@ -75,13 +75,13 @@ nixos https://nixos.org/channels/nixos-unstable
 # nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
 </screen>
   (Be sure to include the <literal>nixos</literal> parameter at the end.) For
-  instance, to use the NixOS 19.09 stable channel:
+  instance, to use the NixOS 20.03 stable channel:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-19.09 nixos
+# nix-channel --add https://nixos.org/channels/nixos-20.03 nixos
 </screen>
   If you have a server, you may want to use the “small” channel instead:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-19.09-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-20.03-small nixos
 </screen>
   And if you want to live on the bleeding edge:
 <screen>
@@ -132,7 +132,7 @@ nixos https://nixos.org/channels/nixos-unstable
    kernel, initrd or kernel modules.
    You can also specify a channel explicitly, e.g.
 <programlisting>
-<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-19.09;
+<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-20.03;
 </programlisting>
   </para>
  </section>

From 5272327b81ed355bbed5659b8d303cf2979b6953 Mon Sep 17 00:00:00 2001
From: worldofpeace <worldofpeace@protonmail.ch>
Date: Mon, 20 Apr 2020 11:52:57 -0400
Subject: [PATCH 47/59] rl-2003: release date

(cherry picked from commit 6380be302a5da1f5200968cd358e93fa64cdc996)
---
 nixos/doc/manual/release-notes/rl-2003.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index 2f12b0adc023..62251e0b25b9 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -3,7 +3,7 @@
          xmlns:xi="http://www.w3.org/2001/XInclude"
          version="5.0"
          xml:id="sec-release-20.03">
- <title>Release 20.03 (“Markhor”, 2020.03/??)</title>
+ <title>Release 20.03 (“Markhor”, 2020.04/20)</title>
 
  <section xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"

From 1866b4b9b0ac05cb7e1f5736cc58ea0058295a40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <mil@nyantec.com>
Date: Tue, 21 Apr 2020 02:07:53 +0200
Subject: [PATCH 48/59] nixos/tools: adapt for renamed console options

---
 nixos/modules/installer/tools/tools.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 655d77db157d..111286214248 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -111,10 +111,10 @@ in
         # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
 
         # Select internationalisation properties.
-        # i18n = {
-        #   consoleFont = "Lat2-Terminus16";
-        #   consoleKeyMap = "us";
-        #   defaultLocale = "en_US.UTF-8";
+        # i18n.defaultLocale = "en_US.UTF-8";
+        # console = {
+        #   font = "Lat2-Terminus16";
+        #   keyMap = "us";
         # };
 
         # Set your time zone.

From 1e90c46c2d98f9391df79954a74d14f263cad729 Mon Sep 17 00:00:00 2001
From: Benjamin Hipple <bhipple@protonmail.com>
Date: Fri, 17 Apr 2020 11:35:16 -0400
Subject: [PATCH 49/59] mesa-glu: use HTTPS instead of FTP

FTP is often blocked by firewalls and is generally slower and less secure than HTTPS.

No change to `src` hash.

(cherry picked from commit ba8c11651963c0182658d5ad9cfd70b24c4f64d2)
---
 pkgs/development/libraries/mesa-glu/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/mesa-glu/default.nix b/pkgs/development/libraries/mesa-glu/default.nix
index dd2091c8a796..bc0832d17ea9 100644
--- a/pkgs/development/libraries/mesa-glu/default.nix
+++ b/pkgs/development/libraries/mesa-glu/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "9.0.1";
 
   src = fetchurl {
-    url = "ftp://ftp.freedesktop.org/pub/mesa/${pname}/${pname}-${version}.tar.xz";
+    url = "https://mesa.freedesktop.org/archive/${pname}/${pname}-${version}.tar.xz";
     sha256 = "1g2m634p73mixkzv1qz1d0flwm390ydi41bwmchiqvdssqnlqnpv";
   };
 

From 85895aaca2b92e52d40f76e9bc4d69a5e78c56a9 Mon Sep 17 00:00:00 2001
From: Drew Risinger <drewrisinger@users.noreply.github.com>
Date: Thu, 16 Apr 2020 19:18:12 -0400
Subject: [PATCH 50/59] python3Packages.cirq: fix test failures (ZHF)

Also build on aarch64 by disabling a few failing tests.

(cherry picked from commit 02a5282c4f544dcc6c32cfeb1c4acd4a07615786)
---
 pkgs/development/python-modules/cirq/default.nix | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cirq/default.nix b/pkgs/development/python-modules/cirq/default.nix
index e32d4596a8a8..f8e88e207c95 100644
--- a/pkgs/development/python-modules/cirq/default.nix
+++ b/pkgs/development/python-modules/cirq/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
@@ -38,13 +39,16 @@ buildPythonPackage rec {
 
   # Cirq 0.6 requires networkx==2.3 only for optional qiskit dependency/test, disable this to avoid networkx version conflicts. https://github.com/quantumlib/Cirq/issues/2368
   # Cirq locks protobuf==3.8.0, but tested working with default pythonPackages.protobuf (3.7). This avoids overrides/pythonPackages.protobuf conflicts
-  prePatch = ''
+  postPatch = ''
     substituteInPlace requirements.txt --replace "networkx==2.3" "networkx" \
       --replace "protobuf==3.8.0" "protobuf"
 
     # Fix sympy 1.5 test failures. Should be fixed in v0.7
     substituteInPlace cirq/optimizers/eject_phased_paulis_test.py --replace "phase_exponent=0.125 + x / 8" "phase_exponent=0.125 + x * 0.125"
     substituteInPlace cirq/contrib/quirk/cells/parse_test.py --replace "parse_formula('5t') == 5 * t" "parse_formula('5t') == 5.0 * t"
+
+    # Fix pandas >= 1.0 error, #2886
+    substituteInPlace cirq/experiments/t1_decay_experiment.py --replace "del tab.columns.name" 'tab.rename_axis(None, axis="columns", inplace=True)'
   '';
 
   propagatedBuildInputs = [
@@ -77,6 +81,13 @@ buildPythonPackage rec {
     "--ignore=dev_tools"  # Only needed when developing new code, which is out-of-scope
     "--ignore=cirq/google/op_serializer_test.py"  # investigating in https://github.com/quantumlib/Cirq/issues/2727
   ];
+  disabledTests = [
+    "test_convert_to_ion_gates" # fails due to rounding error, 0.75 != 0.750...2
+  ] ++ lib.optionals stdenv.isAarch64 [
+    # Seem to fail due to math issues on aarch64?
+    "expectation_from_wavefunction"
+    "test_single_qubit_op_to_framed_phase_form_output_on_example_case"
+  ];
 
   meta = with lib; {
     description = "A framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits.";

From e79d1e83f91b6c7a92f899b0a356ea6d770fb426 Mon Sep 17 00:00:00 2001
From: Drew Risinger <drewrisinger@users.noreply.github.com>
Date: Mon, 20 Apr 2020 14:42:49 -0400
Subject: [PATCH 51/59] python3Packages.cirq: enable on python 3.8

---
 pkgs/development/python-modules/cirq/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/python-modules/cirq/default.nix b/pkgs/development/python-modules/cirq/default.nix
index f8e88e207c95..fb3bf3a91204 100644
--- a/pkgs/development/python-modules/cirq/default.nix
+++ b/pkgs/development/python-modules/cirq/default.nix
@@ -94,6 +94,5 @@ buildPythonPackage rec {
     homepage = "http://github.com/quantumlib/cirq";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
-    broken = isPy38;
   };
 }

From e1c5a0a82a12d1f74670761f5231683dff6c5340 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabian=20M=C3=B6ller?= <fabianm88@gmail.com>
Date: Tue, 17 Mar 2020 11:23:06 +0100
Subject: [PATCH 52/59] virtualboxExtpack: synchronize version with virtualbox

(cherry picked from commit b3323dbd07ab86a64bf4d32a13323ff564dde8f7)
---
 pkgs/applications/virtualization/virtualbox/extpack.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/virtualization/virtualbox/extpack.nix b/pkgs/applications/virtualization/virtualbox/extpack.nix
index c935a40c5400..ba8407e4a736 100644
--- a/pkgs/applications/virtualization/virtualbox/extpack.nix
+++ b/pkgs/applications/virtualization/virtualbox/extpack.nix
@@ -1,8 +1,9 @@
-{fetchurl, lib}:
+{fetchurl, lib, virtualbox}:
 
 with lib;
 
-let version = "6.0.14";
+let
+  inherit (virtualbox) version;
 in
 fetchurl rec {
   name = "Oracle_VM_VirtualBox_Extension_Pack-${version}.vbox-extpack";
@@ -11,7 +12,7 @@ fetchurl rec {
     # Manually sha256sum the extensionPack file, must be hex!
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
-    let value = "c8a5cc980c9c94cdac3d94e23cf159c2433aae76b416dbfb5b1a918758f21e63";
+    let value = "3b73798d776ff223ea8025b1a45001762f8d4e5bcd1ea61449773c1249935800";
     in assert (builtins.stringLength value) == 64; value;
 
   meta = {

From 00d5d64dc694b5ff4bdfab6dfd24775ff61e3a69 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 21 Apr 2020 17:31:27 +0200
Subject: [PATCH 53/59] mautrix-whatsapp: 2020-04-12 -> 2020-04-21

(cherry picked from commit c844633cc70309d74dbf13850b8af56bbdbc694c)
---
 pkgs/servers/mautrix-whatsapp/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index a0b6ece55043..dbe80d204eed 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule {
   pname = "mautrix-whatsapp-unstable";
-  version = "2020-04-12";
+  version = "2020-04-21";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = "mautrix-whatsapp";
-    rev = "44bb623e7a7486a0cdd13fd67b2aaca2ddba20ce";
-    sha256 = "1fwxn6511pq9fdc8d2jp4vgkm1zag55pig75qdxfn63hl3i2607k";
+    rev = "53fe1b18184fc0967658805abc8560641f8d2cb0";
+    sha256 = "0rahj9v7cgvk4w3m41jbs8vnya37dhq5wxyhyg74kwrv8a2nqxra";
   };
 
-  modSha256 = "04pdap1q7zsa1wv2h0j9104fawn95g37yqslmp2mq7722hiqhp9x";
+  modSha256 = "0jn88a4hagwfkw9bv8cg12ywsg35znmfkmhi1v7k2qpj5qzi81w6";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/tulir/mautrix-whatsapp;

From b76b6c6d8decce61b265439e4588b0e6195559c0 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 21 Apr 2020 17:34:13 +0200
Subject: [PATCH 54/59] mongodb_3_4: fix license

As noted in #83433, the 3.4 branch of `mongodb` is still licensed under
AGPL[1].

[1] https://github.com/mongodb/mongo/blob/r3.4.24/README

(cherry picked from commit 25b9bca759f3fa914c51bcf01de552446c507822)
---
 pkgs/servers/nosql/mongodb/mongodb.nix | 6 ++++--
 pkgs/servers/nosql/mongodb/v3_4.nix    | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index b4b6334c13f5..55cbd0c71374 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -6,7 +6,9 @@
 
 with stdenv.lib;
 
-{ version, sha256, patches ? [] }@args:
+{ version, sha256, patches ? []
+, license ? stdenv.lib.licenses.sspl
+}@args:
 
 let
   python = python27.withPackages (ps: with ps; [ pyyaml typing cheetah ]);
@@ -109,7 +111,7 @@ in stdenv.mkDerivation rec {
   meta = {
     description = "A scalable, high-performance, open source NoSQL database";
     homepage = "http://www.mongodb.org";
-    license = licenses.sspl;
+    inherit license;
 
     maintainers = with maintainers; [ bluescreen303 offline cstrahan ];
     platforms = subtractLists systems.doubles.i686 systems.doubles.unix;
diff --git a/pkgs/servers/nosql/mongodb/v3_4.nix b/pkgs/servers/nosql/mongodb/v3_4.nix
index 2f02ae7f72ad..e1c71bc13f7a 100644
--- a/pkgs/servers/nosql/mongodb/v3_4.nix
+++ b/pkgs/servers/nosql/mongodb/v3_4.nix
@@ -12,4 +12,5 @@ in buildMongoDB {
   version = "3.4.24";
   sha256 = "0j6mvgv0jnsnvgkl8505bl88kbxkba66qijlpi1la0dd5pd1imfr";
   patches = [ ./forget-build-dependencies-3-4.patch ];
+  license = stdenv.lib.licenses.agpl3;
 }

From 083662c4a157466e276964ca42006996a07b6322 Mon Sep 17 00:00:00 2001
From: obadz <obadz-git@obadz.com>
Date: Mon, 20 Apr 2020 10:36:37 +0100
Subject: [PATCH 55/59] citrix_workspace: add 2004

(cherry picked from commit b06164281c9fba70163d55e2f931ed7851f3f552)
---
 .../remote/citrix-workspace/default.nix           | 15 +++++++++++++--
 pkgs/top-level/all-packages.nix                   |  1 +
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/remote/citrix-workspace/default.nix b/pkgs/applications/networking/remote/citrix-workspace/default.nix
index f6ec85f3c2cf..8c53ac35d41e 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/default.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/default.nix
@@ -24,7 +24,7 @@
 , gtk_engines
 , alsaLib
 , zlib
-, version ? "19.12.0"
+, version ? "20.04.0"
 }:
 
 let
@@ -71,7 +71,18 @@ let
         x86hash   = "07rfp90ksnvr8zv7ix7f0z6a59n48s7bd4kqbzilfwxgs4ddqmcy";
         x64suffix = "19";
         x86suffix = "19";
-        homepage  = https://www.citrix.com/de-de/downloads/workspace-app/linux/workspace-app-for-linux-latest.html;
+        homepage  = "https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-1912.html";
+      };
+
+      "20.04.0" = {
+        major     = "20";
+        minor     = "04";
+        patch     = "0";
+        x64hash   = "E923592216F9541173846F932784E6C062CB09C9E8858219C7489607BF82A0FB";
+        x86hash   = "A2E2E1882723DA6796E68916B3BB2B44DD575A83DEB03CA90A262F6C81B1A53F";
+        x64suffix = "21";
+        x86suffix = "21";
+        homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
       };
     };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index be8d95726c26..d4e517bbd7d6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2411,6 +2411,7 @@ in
   circus = callPackage ../tools/networking/circus { };
 
   citrix_workspace_unwrapped = callPackage ../applications/networking/remote/citrix-workspace { };
+  citrix_workspace_unwrapped_20_04_0 = citrix_workspace_unwrapped.override { version = "20.04.0"; };
   citrix_workspace_unwrapped_19_12_0 = citrix_workspace_unwrapped.override { version = "19.12.0"; };
   citrix_workspace_unwrapped_19_10_0 = citrix_workspace_unwrapped.override { version = "19.10.0"; };
   citrix_workspace_unwrapped_19_8_0 = citrix_workspace_unwrapped.override { version = "19.8.0"; };

From cbb2d6214f294a91b29f5c42c05237d75130418c Mon Sep 17 00:00:00 2001
From: Thomas Churchman <thomas@kepow.org>
Date: Tue, 21 Apr 2020 20:59:52 +0200
Subject: [PATCH 56/59] nixos/phpfpm: fix erroneous pools example

(cherry picked from commit 8880957042a6ce60184c7692b0e8384f7e44223d)
---
 nixos/modules/services/web-servers/phpfpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-servers/phpfpm/default.nix b/nixos/modules/services/web-servers/phpfpm/default.nix
index 3db19c781d03..d090885a8ca5 100644
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@@ -209,14 +209,14 @@ in {
              user = "php";
              group = "php";
              phpPackage = pkgs.php;
-             settings = '''
+             settings = {
                "pm" = "dynamic";
                "pm.max_children" = 75;
                "pm.start_servers" = 10;
                "pm.min_spare_servers" = 5;
                "pm.max_spare_servers" = 20;
                "pm.max_requests" = 500;
-             ''';
+             };
            }
          }'';
         description = ''

From 9ee1172f6dca3e8a2f04b62becb4e710e24e2b16 Mon Sep 17 00:00:00 2001
From: Nicolas Schneider <nioncode+git@gmail.com>
Date: Tue, 21 Apr 2020 22:48:47 +0200
Subject: [PATCH 57/59] android-studio: add ps to closure

When killing processes, android-studio uses `ps` to figure out which
subprocesses to kill. Without `ps` in the closure, this fails and the
process is never killed.

(cherry picked from commit c296bf71693b37dec84dea947acd09a89cdd0fc7)
Reason: Fixes a bug, see #85719.
---
 pkgs/applications/editors/android-studio/common.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/editors/android-studio/common.nix b/pkgs/applications/editors/android-studio/common.nix
index 4274b567ffd6..159a5081fb37 100644
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@@ -39,6 +39,7 @@
 , nss
 , pciutils
 , pkgsi686Linux
+, ps
 , setxkbmap
 , stdenv
 , systemd
@@ -89,6 +90,7 @@ let
 
           # Runtime stuff
           git
+          ps
         ]}" \
         --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [
 

From dc73011436344db4f175457581bf51c48901857b Mon Sep 17 00:00:00 2001
From: davidak <davidak@users.noreply.github.com>
Date: Wed, 22 Apr 2020 00:16:22 +0200
Subject: [PATCH 58/59] Update link in /etc/os-release (#85723)

(cherry picked from commit 6a7e0562de61e30c7f3e495fe9c9a7dd9d522e80)
---
 nixos/modules/misc/version.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index b626226f4540..dad7b612a18e 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -109,8 +109,8 @@ in
         PRETTY_NAME="NixOS ${cfg.release} (${cfg.codeName})"
         LOGO="nix-snowflake"
         HOME_URL="https://nixos.org/"
-        DOCUMENTATION_URL="https://nixos.org/nixos/manual/index.html"
-        SUPPORT_URL="https://nixos.org/nixos/support.html"
+        DOCUMENTATION_URL="https://nixos.org/learn.html"
+        SUPPORT_URL="https://nixos.org/community.html"
         BUG_REPORT_URL="https://github.com/NixOS/nixpkgs/issues"
       '';
 

From 91d4e9aa97ab19a1364159a7617336aeb6a864f8 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Tue, 21 Apr 2020 18:16:52 -0700
Subject: [PATCH 59/59] ninja: fix 404'ing patch

Kyndig on IRC noticed that building `ninja` from source would fail due
to a patch 404'ing (because the repo appears to no longer exist). Fetch
from upstream instead.
---
 pkgs/development/tools/build-managers/ninja/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/ninja/default.nix b/pkgs/development/tools/build-managers/ninja/default.nix
index 7001510d52d6..b9d865c72124 100644
--- a/pkgs/development/tools/build-managers/ninja/default.nix
+++ b/pkgs/development/tools/build-managers/ninja/default.nix
@@ -21,10 +21,9 @@ stdenv.mkDerivation rec {
       sha256 = "0zsg46jflsh644jccrcgyfalr7fkzrv041kyi8644nyk923gcrl9";
     })
     # https://github.com/ninja-build/ninja/issues/1510 - fix w/musl, possibly BSDs?
-    #
     (fetchpatch {
       name = "fix-issue-1510.patch";
-      url = https://github.com/makepost/ninja/commit/567815df38a2ff54ad7478a90bd75c91e434236a.patch;
+      url = "https://github.com/ninja-build/ninja/commit/567815df38a2ff54ad7478a90bd75c91e434236a.patch";
       sha256 = "0zd0xyi7h2066nw1dsk76c7yf71b0f7v4p5nljda7jxi01vpdh69";
     })
   ];