Merge branch 'master' into staging

2024-11-16 06:45:16 +01:00 · 2020-05-22 09:13:23 +00:00 · 2020-05-22 09:13:23 +00:00 · 16d7f7edae
commit 16d7f7edae
parent eae4f22176 5de1e307f2
290 changed files with 7699 additions and 2328 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -11,18 +11,26 @@ insert_final_newline = true
 trim_trailing_whitespace = true
 charset = utf-8

+# Ignore diffs/patches
+[*.{diff,patch}]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+
 # see https://nixos.org/nixpkgs/manual/#chap-conventions

-# Match nix/ruby/docbook files, set indent to spaces with width of two
-[*.{nix,rb,xml}]
+# Match nix/perl/python/ruby/shell/docbook files, set indent to spaces
+[*.{nix,pl,py,rb,sh,xml}]
 indent_style = space
+
+# Match docbook files, set indent width of one
+[*.xml]
+indent_size = 1
+
+# Match nix/ruby files, set indent width of two
+[*.{nix,rb}]
 indent_size = 2

-# Match shell/python/perl scripts, set indent to spaces with width of four
-[*.{sh,py,pl}]
-indent_style = space
+# Match perl/python/shell scripts, set indent width of four
+[*.{pl,py,sh}]
 indent_size = 4
-
-# Match diffs, avoid to trim trailing whitespace
-[*.{diff,patch}]
-trim_trailing_whitespace = false
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@ -0,0 +1,22 @@
+name: actions
+
+on:
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  editorconfig:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - uses: technote-space/get-diff-action@v1.2.8
+    - name: editorconfig check
+      env:
+        VERSION: "2.0.4"
+        OS: "linux"
+        ARCH: "amd64"
+      run: |
+        curl -sSf -O -L -C - https://github.com/editorconfig-checker/editorconfig-checker/releases/download/$VERSION/ec-$OS-$ARCH.tar.gz && \
+        tar xzf ec-$OS-$ARCH.tar.gz && \
+        ./bin/ec-$OS-$ARCH -disable-indentation ${{ env.GIT_DIFF }}
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4168,6 +4168,12 @@
    githubId = 10544;
    name = "Giuluo Eulisse";
  };
+  kthielen = {
+    email = "kthielen@gmail.com";
+    github = "kthielen";
+    githubId = 1409287;
+    name = "Kalani Thielen";
+  };
  ktor = {
    email = "kruszewsky@gmail.com";
    github = "ktor";
@ -6640,6 +6646,12 @@
    githubId = 1942810;
    name = "Christian Ulrich";
  };
+  rpearce = {
+    email = "me@robertwpearce.com";
+    github = "rpearce";
+    githubId = 592876;
+    name = "Robert W. Pearce";
+  };
  rprospero = {
    email = "rprospero+nix@gmail.com";
    github = "rprospero";
@ -6700,6 +6712,12 @@
    githubId = 889991;
    name = "Ryan Artecona";
  };
+  ryanorendorff = {
+    email = "12442942+ryanorendorff@users.noreply.github.com";
+    github = "ryanorendorff";
+    githubId = 12442942;
+    name = "Ryan Orendorff";
+  };
  ryansydnor = {
    email = "ryan.t.sydnor@gmail.com";
    github = "ryansydnor";
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -26,6 +26,12 @@
   <listitem>
    <para>GNOME desktop environment was upgraded to 3.36, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release notes</link>.</para>
   </listitem>
+   <listitem>
+    <para>
+    <package>maxx</package> package removed along with <varname>services.xserver.desktopManager.maxx</varname> module.
+    Please migrate to <package>cdesktopenv</package> and <varname>services.xserver.desktopManager.cde</varname> module.
+    </para>
+   </listitem>
   <listitem>
    <para>
     We now distribute a GNOME ISO.
@ -122,8 +128,16 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
  <itemizedlist>
   <listitem>
    <para>
-     The go-modules builder now uses vendorSha256 instead of modSha256 to pin
-     fetched version data. This is currently a warning, but will be removed in the next release.
+     <literal>buildGoModule</literal> now internally creates a vendor directory
+     in the source tree for downloaded modules instead of using go's <link
+     xlink:href="https://golang.org/cmd/go/#hdr-Module_proxy_protocol">module
+     proxy protocol</link>. This storage format is simpler and therefore less
+     likekly to break with future versions of go. As a result
+     <literal>buildGoModule</literal> switched from
+     <literal>modSha256</literal> to the <literal>vendorSha256</literal>
+     attribute to pin fetched version data. <literal>buildGoModule</literal>
+     still accepts <literal>modSha256</literal> with a warning, but support will
+     be removed in the next release.
    </para>
   </listitem>
   <listitem>
@ -429,6 +443,11 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
     Additional Git documentation (HTML and text files) is now available via the <literal>git-doc</literal> package.
   </para>
   </listitem>
+   <listitem>
+   <para>
+     Default algorithm for ZRAM swap was changed to <literal>zstd</literal>.
+   </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@ -94,7 +94,7 @@ in
        after = [ "suspend.target" "hibernate.target" "hybrid-sleep.target" ];
        script =
          ''
-            ${config.systemd.package}/bin/systemctl try-restart post-resume.target
+            /run/current-system/systemd/bin/systemctl try-restart post-resume.target
            ${cfg.resumeCommands}
            ${cfg.powerUpCommands}
          '';
--- a/nixos/modules/config/resolvconf.nix
+++ b/nixos/modules/config/resolvconf.nix
@ -21,7 +21,7 @@ let
    '' + optionalString config.services.nscd.enable ''
      # Invalidate the nscd cache whenever resolv.conf is
      # regenerated.
-      libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
+      libc_restart='/run/current-system/systemd/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
    '' + optionalString (length resolvconfOptions > 0) ''
      # Options as described in resolv.conf(5)
      resolv_conf_options='${concatStringsSep " " resolvconfOptions}'
--- a/nixos/modules/config/zram.nix
+++ b/nixos/modules/config/zram.nix
@ -91,7 +91,7 @@ in
      };

      algorithm = mkOption {
-        default = "lzo";
+        default = "zstd";
        example = "lz4";
        type = with types; either (enum [ "lzo" "lz4" "zstd" ]) str;
        description = ''
--- a/nixos/modules/programs/zsh/zsh.nix
+++ b/nixos/modules/programs/zsh/zsh.nix
@ -135,6 +135,13 @@ in
        type = types.bool;
      };

+      enableBashCompletion = mkOption {
+        default = false;
+        description = ''
+          Enable compatibility with bash's programmable completion system.
+        '';
+        type = types.bool;
+      };

      enableGlobalCompInit = mkOption {
        default = cfg.enableCompletion;
@ -239,6 +246,11 @@ in
          autoload -U compinit && compinit
        ''}

+        ${optionalString cfg.enableBashCompletion ''
+          # Enable compatibility with bash's completion system.
+          autoload -U bashcompinit && bashcompinit
+        ''}
+
        # Setup custom interactive shell init stuff.
        ${cfge.interactiveShellInit}

--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@ -5,26 +5,85 @@ with lib;
 let
  cfg = config.services.logrotate;

-  configFile = pkgs.writeText "logrotate.conf"
-    cfg.config;
+  pathOptions = {
+    options = {
+      path = mkOption {
+        type = types.str;
+        description = "The path to log files to be rotated";
+      };
+      user = mkOption {
+        type = types.str;
+        description = "The user account to use for rotation";
+      };
+      group = mkOption {
+        type = types.str;
+        description = "The group to use for rotation";
+      };
+      frequency = mkOption {
+        type = types.enum [
+          "daily" "weekly" "monthly" "yearly"
+        ];
+        default = "daily";
+        description = "How often to rotate the logs";
+      };
+      keep = mkOption {
+        type = types.int;
+        default = 20;
+        description = "How many rotations to keep";
+      };
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Extra logrotate config options for this path";
+      };
+    };
+  };
+
+  pathConfig = options: ''
+    "${options.path}" {
+      su ${options.user} ${options.group}
+      ${options.frequency}
+      missingok
+      notifempty
+      rotate ${toString options.keep}
+      ${options.extraConfig}
+    }
+  '';
+
+  configFile = pkgs.writeText "logrotate.conf" (
+    (concatStringsSep "\n" ((map pathConfig cfg.paths) ++ [cfg.extraConfig]))
+  );

 in
 {
+  imports = [
+    (mkRenamedOptionModule [ "services" "logrotate" "config" ] [ "services" "logrotate" "extraConfig" ])
+  ];
+
  options = {
    services.logrotate = {
-      enable = mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Enable the logrotate cron job
-        '';
+      enable = mkEnableOption "the logrotate systemd service";
+
+      paths = mkOption {
+        type = types.listOf (types.submodule pathOptions);
+        default = [];
+        description = "List of attribute sets with paths to rotate";
+        example = {
+          "/var/log/myapp/*.log" = {
+            user = "myuser";
+            group = "mygroup";
+            rotate = "weekly";
+            keep = 5;
+          };
+        };
      };

-      config = mkOption {
+      extraConfig = mkOption {
        default = "";
        type = types.lines;
        description = ''
-          The contents of the logrotate config file
+          Extra contents to add to the logrotate config file.
+          See https://linux.die.net/man/8/logrotate
        '';
      };
    };
--- a/nixos/modules/services/misc/docker-registry.nix
+++ b/nixos/modules/services/misc/docker-registry.nix
@ -138,7 +138,7 @@ in {

      script = ''
        ${pkgs.docker-distribution}/bin/registry garbage-collect ${configFile}
-        ${pkgs.systemd}/bin/systemctl restart docker-registry.service
+        /run/current-system/systemd/bin/systemctl restart docker-registry.service
      '';

      startAt = optional cfg.enableGarbageCollect cfg.garbageCollectDates;
--- a/nixos/modules/services/misc/freeswitch.nix
+++ b/nixos/modules/services/misc/freeswitch.nix
@ -78,7 +78,7 @@ in {
      wantedBy = [ "multi-user.target" ];
      restartTriggers = [ configDirectory ];
      serviceConfig = {
-        ExecStart = "${pkgs.systemd}/bin/systemctl try-reload-or-restart freeswitch.service";
+        ExecStart = "/run/current-system/systemd/bin/systemctl try-reload-or-restart freeswitch.service";
        RemainAfterExit = true;
        Type = "oneshot";
      };
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@ -81,7 +81,7 @@ let
          # anything ever again ("couldn't resolve ..., giving up on
          # it"), so we silently lose time synchronisation. This also
          # applies to openntpd.
-          ${config.systemd.package}/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service || true
+          /run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service || true
      fi

      ${cfg.runHook}
@ -217,7 +217,7 @@ in
    powerManagement.resumeCommands = mkIf config.systemd.services.dhcpcd.enable
      ''
        # Tell dhcpcd to rebind its interfaces if it's running.
-        ${config.systemd.package}/bin/systemctl reload dhcpcd.service
+        /run/current-system/systemd/bin/systemctl reload dhcpcd.service
      '';

  };
--- a/nixos/modules/services/networking/dnscrypt-proxy2.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix
@ -55,6 +55,7 @@ in
        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
        DynamicUser = true;
        ExecStart = "${pkgs.dnscrypt-proxy2}/bin/dnscrypt-proxy -config ${cfg.configFile}";
+        Restart = "always";
      };
    };
  };
--- a/nixos/modules/services/networking/nsd.nix
+++ b/nixos/modules/services/networking/nsd.nix
@ -252,7 +252,7 @@ let
          Use imports or pkgs.lib.readFile if you don't want this data in your config file.
        '';
      };
-      
+
      dnssec = mkEnableOption "DNSSEC";

      dnssecPolicy = {
@ -970,7 +970,7 @@ in
      script = signZones;

      postStop = ''
-        ${pkgs.systemd}/bin/systemctl kill -s SIGHUP nsd.service
+        /run/current-system/systemd/bin/systemctl kill -s SIGHUP nsd.service
      '';
    };

--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -253,12 +253,12 @@ in {
    };

    powerManagement.resumeCommands = ''
-      ${config.systemd.package}/bin/systemctl try-restart wpa_supplicant
+      /run/current-system/systemd/bin/systemctl try-restart wpa_supplicant
    '';

    # Restart wpa_supplicant when a wlan device appears or disappears.
    services.udev.extraRules = ''
-      ACTION=="add|remove", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", RUN+="${config.systemd.package}/bin/systemctl try-restart wpa_supplicant.service"
+      ACTION=="add|remove", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", RUN+="/run/current-system/systemd/bin/systemctl try-restart wpa_supplicant.service"
    '';
  };

--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@ -1,55 +1,17 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
+  keysPath = "/var/lib/yggdrasil/keys.json";
+
  cfg = config.services.yggdrasil;
-  configProvided = (cfg.config != {});
-  configAsFile = (if configProvided then
-                   toString (pkgs.writeTextFile {
-                     name = "yggdrasil-conf";
-                     text = builtins.toJSON cfg.config;
-                   })
-                   else null);
-  configFileProvided = (cfg.configFile != null);
-  generateConfig = (
-    if configProvided && configFileProvided then
-      "${pkgs.jq}/bin/jq -s add ${configAsFile} ${cfg.configFile}"
-    else if configProvided then
-      "cat ${configAsFile}"
-    else if configFileProvided then
-      "cat ${cfg.configFile}"
-    else
-      "${cfg.package}/bin/yggdrasil -genconf"
-  );
+  configProvided = cfg.config != { };
+  configFileProvided = cfg.configFile != null;

 in {
  options = with types; {
    services.yggdrasil = {
      enable = mkEnableOption "the yggdrasil system service";

-      configFile = mkOption {
-        type =  nullOr str;
-        default = null;
-        example = "/run/keys/yggdrasil.conf";
-        description = ''
-          A file which contains JSON configuration for yggdrasil.
-
-          You do not have to supply a complete configuration, as
-          yggdrasil will use default values for anything which is
-          omitted.  If the encryption and signing keys are omitted,
-          yggdrasil will generate new ones each time the service is
-          started, resulting in a random IPv6 address on the yggdrasil
-          network each time.
-
-          If both this option and <option>config</option> are
-          supplied, they will be combined, with values from
-          <option>config</option> taking precedence.
-
-          You can use the command <code>nix-shell -p yggdrasil --run
-          "yggdrasil -genconf -json"</code> to generate a default
-          JSON configuration.
-        '';
-      };
-
      config = mkOption {
        type = attrs;
        default = {};
@ -66,16 +28,21 @@ in {
          Configuration for yggdrasil, as a Nix attribute set.

          Warning: this is stored in the WORLD-READABLE Nix store!
-          Therefore, it is not appropriate for private keys.  If you
-          do not specify the keys, yggdrasil will generate a new set
-          each time the service is started, creating a random IPv6
-          address on the yggdrasil network each time.
+          Therefore, it is not appropriate for private keys. If you
+          wish to specify the keys, use <option>configFile</option>.

-          If you wish to specify the keys, use
-          <option>configFile</option>.  If both
-          <option>configFile</option> and <option>config</option> are
-          supplied, they will be combined, with values from
-          <option>config</option> taking precedence.
+          If the <option>persistentKeys</option> is enabled then the
+          keys that are generated during activation will override
+          those in <option>config</option> or
+          <option>configFile</option>.
+
+          If no keys are specified then ephemeral keys are generated
+          and the Yggdrasil interface will have a random IPv6 address
+          each time the service is started, this is the default.
+
+          If both <option>configFile</option> and <option>config</option>
+          are supplied, they will be combined, with values from
+          <option>configFile</option> taking precedence.

          You can use the command <code>nix-shell -p yggdrasil --run
          "yggdrasil -genconf"</code> to generate default
@ -83,12 +50,21 @@ in {
        '';
      };

+      configFile = mkOption {
+        type = nullOr path;
+        default = null;
+        example = "/run/keys/yggdrasil.conf";
+        description = ''
+          A file which contains JSON configuration for yggdrasil.
+          See the <option>config</option> option for more information.
+        '';
+      };
+
      group = mkOption {
        type = types.str;
        default = "root";
        example = "wheel";
-        description =
-          "Group to grant acces to the Yggdrasil control socket.";
+        description = "Group to grant acces to the Yggdrasil control socket.";
      };

      openMulticastPort = mkOption {
@ -126,37 +102,64 @@ in {
        defaultText = "pkgs.yggdrasil";
        description = "Yggdrasil package to use.";
      };
+
+      persistentKeys = mkEnableOption ''
+        If enabled then keys will be generated once and Yggdrasil
+        will retain the same IPv6 address when the service is
+        restarted. Keys are stored at ${keysPath}.
+      '';
+
    };
  };

-  config = mkIf cfg.enable {
-    assertions = [
-      { assertion = config.networking.enableIPv6;
-        message = "networking.enableIPv6 must be true for yggdrasil to work";
-      }
-    ];
+  config = mkIf cfg.enable (let binYggdrasil = cfg.package + "/bin/yggdrasil";
+  in {
+    assertions = [{
+      assertion = config.networking.enableIPv6;
+      message = "networking.enableIPv6 must be true for yggdrasil to work";
+    }];
+
+    system.activationScripts.yggdrasil = mkIf cfg.persistentKeys ''
+      if [ ! -e ${keysPath} ]
+      then
+        mkdir -p ${builtins.dirOf keysPath}
+        ${binYggdrasil} -genconf -json \
+          | ${pkgs.jq}/bin/jq \
+              'to_entries|map(select(.key|endswith("Key")))|from_entries' \
+          > ${keysPath}
+        chmod 600 ${keysPath}
+      fi
+    '';

    systemd.services.yggdrasil = {
      description = "Yggdrasil Network Service";
-      path = [ cfg.package ] ++ optional (configProvided && configFileProvided) pkgs.jq;
      bindsTo = [ "network-online.target" ];
      after = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];

-      preStart = ''
-        ${generateConfig} | yggdrasil -normaliseconf -useconf > /run/yggdrasil/yggdrasil.conf
-      '';
+      preStart =
+        (if configProvided || configFileProvided || cfg.persistentKeys then
+          "echo "
+
+          + (lib.optionalString configProvided
+            "'${builtins.toJSON cfg.config}'")
+          + (lib.optionalString configFileProvided "$(cat ${cfg.configFile})")
+          + (lib.optionalString cfg.persistentKeys "$(cat ${keysPath})")
+          + " | ${pkgs.jq}/bin/jq -s add | ${binYggdrasil} -normaliseconf -useconf"
+        else
+          "${binYggdrasil} -genconf") + " > /run/yggdrasil/yggdrasil.conf";

      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/yggdrasil -useconffile /run/yggdrasil/yggdrasil.conf";
+        ExecStart =
+          "${binYggdrasil} -useconffile /run/yggdrasil/yggdrasil.conf";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        Restart = "always";

        Group = cfg.group;
        RuntimeDirectory = "yggdrasil";
        RuntimeDirectoryMode = "0750";
-        BindReadOnlyPaths = mkIf configFileProvided
-          [ "${cfg.configFile}" ];
+        BindReadOnlyPaths = lib.optional configFileProvided cfg.configFile
+          ++ lib.optional cfg.persistentKeys keysPath;

        # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
        # to set up the network adapter when DynamicUser is set.  See
@ -191,6 +194,6 @@ in {

    # Make yggdrasilctl available on the command line.
    environment.systemPackages = [ cfg.package ];
-  };
-  meta.maintainers = with lib.maintainers; [ gazally ];
+  });
+  meta.maintainers = with lib.maintainers; [ gazally ehmry ];
 }
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -631,9 +631,12 @@ let
        serviceConfig = {
          User = "${cfg.user}";
          Group = "tt_rss";
-          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/update.php --daemon";
+          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/update.php --daemon --quiet";
          StandardOutput = "syslog";
          StandardError = "syslog";
+          Restart = "on-failure";
+          RestartSec = "60";
+          SyslogIdentifier = "tt-rss";
        };

        wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -756,9 +756,9 @@ in
      serviceConfig.Type = "oneshot";
      serviceConfig.TimeoutSec = 60;
      script = ''
-        if ${pkgs.systemd}/bin/systemctl -q is-active nginx.service ; then
+        if /run/current-system/systemd/bin/systemctl -q is-active nginx.service ; then
          ${execCommand} -t && \
-            ${pkgs.systemd}/bin/systemctl reload nginx.service
+            /run/current-system/systemd/bin/systemctl reload nginx.service
        fi
      '';
      serviceConfig.RemainAfterExit = true;
@ -772,7 +772,7 @@ in
            webroot = vhostConfig.acmeRoot;
            extraDomains = genAttrs vhostConfig.serverAliases (alias: null);
            postRun = ''
-              systemctl reload nginx
+              /run/current-system/systemd/bin/systemctl reload nginx
            '';
          }; }) acmeEnabledVhosts;
      in
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@ -19,7 +19,7 @@ in
  # E.g., if Plasma 5 is enabled, it supersedes xterm.
  imports = [
    ./none.nix ./xterm.nix ./xfce.nix ./plasma5.nix ./lumina.nix
-    ./lxqt.nix ./enlightenment.nix ./gnome3.nix ./kodi.nix ./maxx.nix
+    ./lxqt.nix ./enlightenment.nix ./gnome3.nix ./kodi.nix
    ./mate.nix ./pantheon.nix ./surf-display.nix ./cde.nix
  ];

--- a/nixos/modules/services/x11/desktop-managers/maxx.nix
+++ b/nixos/modules/services/x11/desktop-managers/maxx.nix
@ -1,31 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  xcfg = config.services.xserver;
-  cfg = xcfg.desktopManager.maxx;
-in {
-  options.services.xserver.desktopManager.maxx = {
-    enable = mkEnableOption "MaXX desktop environment";
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.maxx ];
-
-    # there is hardcoded path in binaries
-    system.activationScripts.setup-maxx = ''
-      mkdir -p /opt
-      ln -sfn ${pkgs.maxx}/opt/MaXX /opt
-    '';
-
-    services.xserver.desktopManager.session = [
-    { name = "MaXX";
-      start = ''
-        exec ${pkgs.maxx}/opt/MaXX/etc/skel/Xsession.dt
-      '';
-    }];
-  };
-
-  meta.maintainers = [ maintainers.gnidorah ];
-}
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -39,7 +39,8 @@ let

      ${optionalString cfg.startDbusSession ''
        if test -z "$DBUS_SESSION_BUS_ADDRESS"; then
-          exec ${pkgs.dbus.dbus-launch} --exit-with-session "$0" "$@"
+          /run/current-system/systemd/bin/systemctl --user start dbus.socket
+          export `/run/current-system/systemd/bin/systemctl --user show-environment | grep '^DBUS_SESSION_BUS_ADDRESS'`
        fi
      ''}

@ -59,7 +60,7 @@ let
      #
      # Also tell systemd about the dbus session bus address.
      # This is required by user units using the session bus.
-      ${config.systemd.package}/bin/systemctl --user import-environment DISPLAY XAUTHORITY DBUS_SESSION_BUS_ADDRESS
+      /run/current-system/systemd/bin/systemctl --user import-environment DISPLAY XAUTHORITY DBUS_SESSION_BUS_ADDRESS

      # Load X defaults. This should probably be safe on wayland too.
      ${xorg.xrdb}/bin/xrdb -merge ${xresourcesXft}
@ -88,7 +89,7 @@ let
      fi

      # Start systemd user services for graphical sessions
-      ${config.systemd.package}/bin/systemctl --user start graphical-session.target
+      /run/current-system/systemd/bin/systemctl --user start graphical-session.target

      # Allow the user to setup a custom session type.
      if test -x ~/.xsession; then
@ -393,7 +394,7 @@ in

          test -n "$waitPID" && wait "$waitPID"

-          ${config.systemd.package}/bin/systemctl --user stop graphical-session.target
+          /run/current-system/systemd/bin/systemctl --user stop graphical-session.target

          exit 0
        '';
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -30,8 +30,8 @@ let

  cfgFile = pkgs.writeText "sddm.conf" ''
    [General]
-    HaltCommand=${pkgs.systemd}/bin/systemctl poweroff
-    RebootCommand=${pkgs.systemd}/bin/systemctl reboot
+    HaltCommand=/run/current-system/systemd/bin/systemctl poweroff
+    RebootCommand=/run/current-system/systemd/bin/systemctl reboot
    ${optionalString cfg.autoNumlock ''
    Numlock=on
    ''}
--- a/nixos/modules/services/x11/xautolock.nix
+++ b/nixos/modules/services/x11/xautolock.nix
@ -66,7 +66,7 @@ in

        killer = mkOption {
          default = null; # default according to `man xautolock` is none
-          example = "${pkgs.systemd}/bin/systemctl suspend";
+          example = "/run/current-system/systemd/bin/systemctl suspend";
          type = types.nullOr types.str;

          description = ''
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@ -327,7 +327,7 @@ let
                  # if `libvirtd.service` is not running, do not use `virsh` which would try activate it via 'libvirtd.socket' and thus start it out-of-order.
                  # `libvirtd.service` will set up bridge interfaces when it will start normally.
                  #
-                  if ${pkgs.systemd}/bin/systemctl --quiet is-active 'libvirtd.service'; then
+                  if /run/current-system/systemd/bin/systemctl --quiet is-active 'libvirtd.service'; then
                    for uri in qemu:///system lxc:///; do
                      for dom in $(${pkgs.libvirt}/bin/virsh -c $uri list --name); do
                        ${pkgs.libvirt}/bin/virsh -c $uri dumpxml "$dom" | \
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@ -48,7 +48,7 @@ let

  provisionedHook = pkgs.writeScript "provisioned-hook" ''
    #!${pkgs.runtimeShell}
-    ${config.systemd.package}/bin/systemctl start provisioned.target
+    /run/current-system/systemd/bin/systemctl start provisioned.target
  '';

 in
--- a/nixos/modules/virtualisation/hyperv-image.nix
+++ b/nixos/modules/virtualisation/hyperv-image.nix
@ -37,6 +37,7 @@ in {
      name = cfg.vmDerivationName;
      postVM = ''
        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=dynamic -O vhdx $diskImage $out/${cfg.vmFileName}
+        rm $diskImage
      '';
      format = "raw";
      diskSize = cfg.baseImageSize;
--- a/nixos/modules/virtualisation/vmware-image.nix
+++ b/nixos/modules/virtualisation/vmware-image.nix
@ -0,0 +1,90 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  boolToStr = value: if value then "on" else "off";
+  cfg = config.vmware;
+
+  subformats = [
+    "monolithicSparse"
+    "monolithicFlat"
+    "twoGbMaxExtentSparse"
+    "twoGbMaxExtentFlat"
+    "streamOptimized"
+  ];
+
+in {
+  options = {
+    vmware = {
+      baseImageSize = mkOption {
+        type = types.int;
+        default = 2048;
+        description = ''
+          The size of the VMWare base image in MiB.
+        '';
+      };
+      vmDerivationName = mkOption {
+        type = types.str;
+        default = "nixos-vmware-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
+        description = ''
+          The name of the derivation for the VMWare appliance.
+        '';
+      };
+      vmFileName = mkOption {
+        type = types.str;
+        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vmdk";
+        description = ''
+          The file name of the VMWare appliance.
+        '';
+      };
+      vmSubformat = mkOption {
+        type = types.enum subformats;
+        default = "monolithicSparse";
+        description = "Specifies which VMDK subformat to use.";
+      };
+      vmCompat6 = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = "Create a VMDK version 6 image (instead of version 4).";
+      };
+    };
+  };
+
+  config = {
+    system.build.vmwareImage = import ../../lib/make-disk-image.nix {
+      name = cfg.vmDerivationName;
+      postVM = ''
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o compat6=${boolToStr cfg.vmCompat6},subformat=${cfg.vmSubformat} -O vmdk $diskImage $out/${cfg.vmFileName}
+        rm $diskImage
+      '';
+      format = "raw";
+      diskSize = cfg.baseImageSize;
+      partitionTableType = "efi";
+      inherit config lib pkgs;
+    };
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      autoResize = true;
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-label/ESP";
+      fsType = "vfat";
+    };
+
+    boot.growPartition = true;
+
+    boot.loader.grub = {
+      version = 2;
+      device = "nodev";
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };
+
+    virtualisation.vmware.guest.enable = true;
+  };
+}
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@ -76,7 +76,7 @@ in {
        hass.succeed("test -f ${configDir}/ui-lovelace.yaml")
    with subtest("Check that Home Assistant's web interface and API can be reached"):
        hass.wait_for_open_port(8123)
-        hass.succeed("curl --fail http://localhost:8123/states")
+        hass.succeed("curl --fail http://localhost:8123/lovelace")
        assert "API running" in hass.succeed(
            "curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/"
        )
--- a/nixos/tests/podman.nix
+++ b/nixos/tests/podman.nix
@ -38,23 +38,45 @@ import ./make-test-python.nix (
      start_all()


-      with subtest("Run container as root"):
+      with subtest("Run container as root with runc"):
          podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
          podman.succeed(
-              "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
          )
          podman.succeed("podman ps | grep sleeping")
          podman.succeed("podman stop sleeping")
+          podman.succeed("podman rm sleeping")

-      with subtest("Run container rootless"):
+      with subtest("Run container as root with crun"):
+          podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
+          podman.succeed(
+              "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+          )
+          podman.succeed("podman ps | grep sleeping")
+          podman.succeed("podman stop sleeping")
+          podman.succeed("podman rm sleeping")
+
+      with subtest("Run container rootless with runc"):
          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
          podman.succeed(
              su_cmd(
-                  "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+                  "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
              )
          )
          podman.succeed(su_cmd("podman ps | grep sleeping"))
          podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
+
+      with subtest("Run container rootless with crun"):
+          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+          podman.succeed(
+              su_cmd(
+                  "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              )
+          )
+          podman.succeed(su_cmd("podman ps | grep sleeping"))
+          podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
    '';
  }
 )
--- a/nixos/tests/yggdrasil.nix
+++ b/nixos/tests/yggdrasil.nix
@ -85,6 +85,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
            MulticastInterfaces = [ "eth1" ];
            LinkLocalTCPPort = 43210;
          };
+          persistentKeys = true;
        };
      };
    };
--- a/pkgs/applications/audio/denemo/default.nix
+++ b/pkgs/applications/audio/denemo/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "denemo";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchurl {
    url = "https://ftp.gnu.org/gnu/denemo/denemo-${version}.tar.gz";
-    sha256 = "1blkcl3slbsq9jlhwcf2m9v9g38a0sjfhh9advgi2qr1gxri08by";
+    sha256 = "145kq0zfgdadykl3i6na221i4s5wzdrcqq48amzyfarnrqk2rmpd";
  };

  buildInputs = [
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "ft2-clone";
-  version = "1.23";
+  version = "1.24";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${version}";
-    sha256 = "03prdifc2nz7smmzdy19flp33m927vb7j5bhdc46gak753pikw7d";
+    sha256 = "0wb7xsc2m9f4q5zsf5ai6h6c0558lkziv30b5a8ic64wp0layr6k";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext, intltool, pkgconfig, python2
+{ stdenv, fetchurl, fetchpatch, faust, gettext, intltool, pkgconfig, python2
 , avahi, bluez, boost, eigen, fftw, glib, glib-networking
 , glibmm, gsettings-desktop-schemas, gtkmm2, libjack2
 , ladspaH, libav, libsndfile, lilv, lrdf, lv2, serd, sord, sratom
@ -19,7 +19,15 @@ stdenv.mkDerivation rec {
    sha256 = "1nn80m1qagfhvv69za60f0w6ck87vmk77qmqarj7fbr8avwg63s9";
  };

-  nativeBuildInputs = [ gettext intltool wrapGAppsHook pkgconfig python2 wafHook ];
+  patches = [
+    (fetchpatch {
+      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/guitarix-0.39.0-fix_faust_and_lv2_plugins.patch?id=8579b4dfe85e04303ad2d9771ed699f04ea7b7cf";
+      stripLen = 1;
+      sha256 = "0pgkhi4v4vrzjnig0ggmz207q4x5iyk2n6rjj8s5lv15fia7qzp4";
+    })
+  ];
+
+  nativeBuildInputs = [ faust gettext intltool wrapGAppsHook pkgconfig python2 wafHook ];

  buildInputs = [
    avahi bluez boost eigen fftw glib glibmm glib-networking.out
@ -28,11 +36,16 @@ stdenv.mkDerivation rec {
    zita-resampler curl
  ];

+  postPatch = ''
+    # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
+    find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+      -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+  '';
+
  wafConfigureFlags = [
    "--shared-lib"
    "--no-desktop-update"
    "--enable-nls"
-    "--no-faust" # todo: find out why --faust doesn't work
    "--install-roboto-font"
    "--includeresampler"
    "--convolver-ffmpeg"
--- a/pkgs/applications/blockchains/parity/default.nix
+++ b/pkgs/applications/blockchains/parity/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "parity";
-  version = "2.7.2";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "parity-ethereum";
    rev = "v${version}";
-    sha256 = "09cvqk0h9c26famh3f1nc3g74cd0zk6klys977yr1f13bgqmzx0x";
+    sha256 = "124km8c2d7877yzd885wzlcl3gky15isx0z2l1qg1q3cqdsb5mjf";
  };

-  cargoSha256 = "1fdymy8hvn137i5y4flyhlxwjxkd2cd6gq81i1429gk7j3h085ig";
+  cargoSha256 = "0m4pms7agfyqk6gz6fwxdl8jmcyhphhzh3x4vykbi6186y7a8ihq";

  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
  nativeBuildInputs = [
--- a/pkgs/applications/graphics/gnome-photos/default.nix
+++ b/pkgs/applications/graphics/gnome-photos/default.nix
@ -35,13 +35,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-photos";
-  version = "3.34.1";
+  version = "3.34.2";

  outputs = [ "out" "installedTests" ];

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1ifm8hmxpf9nnxddfcpkbc5wc5f5hz43yj83nnakzqr6x1mq7gdp";
+    sha256 = "06ml5sf8xhpan410msqz085hmfc7082d368pb82yq646y9pcfn9w";
  };

  patches = [
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@ -0,0 +1,52 @@
+{ stdenv, fetchurl, unzip, makeWrapper, autoPatchelfHook
+, zlib, lttng-ust, curl, icu, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "ArchiSteamFarm";
+  version = "4.2.0.6";
+
+  src = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-x64.zip";
+      sha256 = "05hx6q1lkbjbqhwi9xxvm7ycnsnpl1cnqzyy2yn0q4x27im399cn";
+    };
+    armv7l-linux = fetchurl {
+      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm.zip";
+      sha256 = "0l8irqrpl5vbjj84k4makj2ph2z6kpny7qz51zrzbgwhrlw0w4vg";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm64.zip";
+      sha256 = "0hg2g4i8sj3fxqfy4imz1iarby1d9f8dh59j266lbbdf2vfz2cml";
+    };
+  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+
+  nativeBuildInputs = [ unzip makeWrapper autoPatchelfHook ];
+  buildInputs = [ stdenv.cc.cc zlib lttng-ust curl ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    dist=$out/opt/asf
+    mkdir -p $dist
+    cp -r * $dist
+    chmod +x $dist/ArchiSteamFarm
+    makeWrapper $dist/ArchiSteamFarm $out/bin/ArchiSteamFarm \
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ icu openssl ] }" \
+      --add-flags "--path ~/.config/asf" \
+      --run "mkdir -p ~/.config/asf" \
+      --run "cd ~/.config/asf" \
+      --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
+      --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
+      --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
+      --run "[ -d www ] || cp --no-preserve=mode -r $dist/www ." \
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Application with primary purpose of idling Steam cards from multiple accounts simultaneously";
+    homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" "armv7l-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ gnidorah ];
+    hydraPlatforms = [];
+  };
+}
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "dbeaver-ce";
-  version = "7.0.4";
+  version = "7.0.5";

  desktopItem = makeDesktopItem {
    name = "dbeaver";
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1d36d2rzsr8c048w0jyacvmgh46jamr9nzs22rmpm7xbzlnvdg4k";
+    sha256 = "082a0dszdlynpf7lrkwijwcs2x8xmbzrjr8rrwmrmkznhzj50gqf";
  };

  installPhase = ''
--- a/pkgs/applications/misc/geoipupdate/default.nix
+++ b/pkgs/applications/misc/geoipupdate/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "geoipupdate";
-  version = "4.2.2";
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "maxmind";
    repo = "geoipupdate";
    rev = "v${version}";
-    sha256 = "057f9kp8g3wixjh9dm58g0qvzfcmhwbk1d573ldly4g5404r9bvf";
+    sha256 = "08h14bf4z2gx9sy34jpi2pvxv3i8g9ypl222hzdjsp2ixhl0jia9";
  };

  vendorSha256 = "0q4byhvs1c1xm4qjvs2vyf98vdv121qn0z51arcf7k4ayrys5xcx";
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.70.0";
+  version = "0.71.0";

  buildInputs = [ libsass ];

@ -10,7 +10,7 @@ buildGoModule rec {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "14g1x95jh91z9xm3xkv2psw2jn7z6bv2009miyv727df4d58nh6m";
+    sha256 = "1cjf69y8wvjq7kpncvqzmhc03pmf21nfxqpdnh64v34d14gpa1aa";
  };

  golibsass = fetchFromGitHub {
@ -27,7 +27,7 @@ buildGoModule rec {
      '';
    });

-  vendorSha256 = "1wl9pg5wf1n5n7gq6lyz0l5ij4icjpfinl4myxwj93l2hqqyx2lf";
+  vendorSha256 = "1fz1wvw0jy3rj6pl1w6vpr0xr1v8pnpf76bwdalacqy6r85lxmkl";

  buildFlags = [ "-tags" "extended" ];

--- a/pkgs/applications/misc/img2pdf/default.nix
+++ b/pkgs/applications/misc/img2pdf/default.nix
@ -4,15 +4,13 @@ with python3Packages;

 buildPythonApplication rec {
  pname = "img2pdf";
-  version = "0.3.4";
+  version = "0.3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0jgfk191vvxn2r6bbdknvw5v510mx9g0xrgnmcghaxkv65zjnj0b";
+    sha256 = "1yx0ljbg7phpix507wq584qvspp2jgax7flpp1148pxpc2d51mcc";
  };

-  doCheck = false; # needs pdfrw
-
  propagatedBuildInputs = [
    pillow
  ];
--- a/pkgs/applications/misc/jgmenu/default.nix
+++ b/pkgs/applications/misc/jgmenu/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "jgmenu";
-  version = "4.2.0";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "johanmalm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1wcmx2yhm6n54w6nymgb8pgfjv411i3zj1vk79q9vr052y1622z0";
+    sha256 = "00q4v31x4q7nm61wda4v0gznv18bm3qs8mp04pcns60qacdv9lkk";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@ -1,13 +1,13 @@
 { stdenv, lib, fetchurl, buildDotnetPackage, substituteAll, makeWrapper, makeDesktopItem,
-  unzip, icoutils, gtk2, xorg, xdotool, xsel, plugins ? [] }:
+  unzip, icoutils, gtk2, xorg, xdotool, xsel, coreutils, unixtools, glib, plugins ? [] }:

 with builtins; buildDotnetPackage rec {
  baseName = "keepass";
-  version = "2.40";
+  version = "2.45";

  src = fetchurl {
    url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    sha256 = "1gldl74wz2lvsci6rn71d6q1zmnhr52z6fjib9nsragsazq5byz9";
+    sha256 = "07wyp3k2kiprr47mc4vxb7vmh7g5kshcqw0gq3qr87gi78c9i66m";
  };

  sourceRoot = ".";
@ -20,6 +20,9 @@ with builtins; buildDotnetPackage rec {
      xsel = "${xsel}/bin/xsel";
      xprop = "${xorg.xprop}/bin/xprop";
      xdotool = "${xdotool}/bin/xdotool";
+      uname = "${coreutils}/bin/uname";
+      whereis = "${unixtools.whereis}/bin/whereis";
+      gsettings = "${glib}/bin/gsettings";
    })
  ];

--- a/pkgs/applications/misc/keepass/fix-paths.patch
+++ b/pkgs/applications/misc/keepass/fix-paths.patch
@ -1,8 +1,23 @@
+From 830d0db80f2fce09e12c117f8338b8e4b05866ff Mon Sep 17 00:00:00 2001
+From: Pascal Winkelmann <pascal@wnklmnn.de>
+Date: Tue, 19 May 2020 10:28:31 +0200
+Subject: [PATCH] fixpaths
+
+---
+ KeePass/Native/NativeMethods.Unix.cs  |  2 +-
+ KeePass/UI/UISystemFonts.cs           |  2 +-
+ KeePass/Util/AppLocator.cs            |  2 +-
+ KeePass/Util/ClipboardUtil.Unix.cs    | 14 +++++++-------
+ KeePassLib/Native/ClipboardU.cs       |  2 +-
+ KeePassLib/Native/NativeLib.cs        |  2 +-
+ KeePassLib/Utility/MonoWorkarounds.cs |  4 ++--
+ 7 files changed, 14 insertions(+), 14 deletions(-)
+
 diff --git a/KeePass/Native/NativeMethods.Unix.cs b/KeePass/Native/NativeMethods.Unix.cs
-index 7495a1c..4ef4727 100644
+index 4c47258..79cfdb2 100644
 --- a/KeePass/Native/NativeMethods.Unix.cs
 +++ b/KeePass/Native/NativeMethods.Unix.cs
-@@ -128,7 +128,7 @@ namespace KeePass.Native
+@@ -130,7 +130,7 @@ namespace KeePass.Native
 			try
 			{
 				Application.DoEvents(); // E.g. for clipboard updates
@ -11,10 +26,54 @@ index 7495a1c..4ef4727 100644
 				Application.DoEvents(); // E.g. for clipboard updates
 				return (strOutput ?? string.Empty);
 			}
+diff --git a/KeePass/UI/UISystemFonts.cs b/KeePass/UI/UISystemFonts.cs
+index 08d6134..2bfa4a2 100644
+--- a/KeePass/UI/UISystemFonts.cs
+++ b/KeePass/UI/UISystemFonts.cs
+@@ -188,7 +188,7 @@ namespace KeePass.UI
+ 
+ 		private static void UbuntuLoadFonts()
+ 		{
+-			string strDef = NativeLib.RunConsoleApp("gsettings",
+			string strDef = NativeLib.RunConsoleApp("@gsettings@",
+ 				"get org.gnome.desktop.interface font-name");
+ 			if(strDef == null) return;
+ 
+diff --git a/KeePass/Util/AppLocator.cs b/KeePass/Util/AppLocator.cs
+index af02803..8a32c9d 100644
+--- a/KeePass/Util/AppLocator.cs
+++ b/KeePass/Util/AppLocator.cs
+@@ -429,7 +429,7 @@ namespace KeePass.Util
+ 			if(NativeLib.GetPlatformID() == PlatformID.MacOSX)
+ 				strArgPrefix = string.Empty; // FR 3535696
+ 
+-			string str = NativeLib.RunConsoleApp("whereis", strArgPrefix + strApp);
+			string str = NativeLib.RunConsoleApp("@whereis@", strArgPrefix + strApp);
+ 			if(str == null) return null;
+ 
+ 			str = str.Trim();
 diff --git a/KeePass/Util/ClipboardUtil.Unix.cs b/KeePass/Util/ClipboardUtil.Unix.cs
-index e93a22a..3fd9a2b 100644
+index ab49ee2..7f6c50f 100644
 --- a/KeePass/Util/ClipboardUtil.Unix.cs
 +++ b/KeePass/Util/ClipboardUtil.Unix.cs
+@@ -42,7 +42,7 @@ namespace KeePass.Util
+ 			// string strGtk = GtkGetString();
+ 			// if(strGtk != null) return strGtk;
+ 
+-			return (NativeLib.RunConsoleApp("pbpaste", "-pboard general") ??
+			return (NativeLib.RunConsoleApp("@pbpaste@", "-pboard general") ??
+ 				string.Empty);
+ 		}
+ 
+@@ -50,7 +50,7 @@ namespace KeePass.Util
+ 		{
+ 			// if(GtkSetString(str)) return;
+ 
+-			NativeLib.RunConsoleApp("pbcopy", "-pboard general", str);
+			NativeLib.RunConsoleApp("@pbcopy@", "-pboard general", str);
+ 		}
+ 
+ 		private static string GetStringU()
@@ -62,7 +62,7 @@ namespace KeePass.Util
 			//	"-out -selection clipboard");
 			// if(str != null) return str;
@ -51,20 +110,33 @@ index e93a22a..3fd9a2b 100644
 				return;
 			}
 diff --git a/KeePassLib/Native/ClipboardU.cs b/KeePassLib/Native/ClipboardU.cs
-index ddd8f57..150eb82 100644
+index 291c51d..3c76380 100644
 --- a/KeePassLib/Native/ClipboardU.cs
 +++ b/KeePassLib/Native/ClipboardU.cs
@@ -27,7 +27,7 @@ namespace KeePassLib.Native
 {
 	internal static class ClipboardU
 	{
-		private const string XSel = "xsel";
-+		private const string XSel = "@xsel@";
+-		internal const string XSel = "xsel";
+		internal const string XSel = "@xsel@";
 		private const string XSelV = "--version";
 		private const string XSelR = "--output --clipboard";
 		private const string XSelC = "--clear --clipboard";
+diff --git a/KeePassLib/Native/NativeLib.cs b/KeePassLib/Native/NativeLib.cs
+index 2d227a3..243f4ee 100644
+--- a/KeePassLib/Native/NativeLib.cs
+++ b/KeePassLib/Native/NativeLib.cs
+@@ -145,7 +145,7 @@ namespace KeePassLib.Native
+ 			// Mono returns PlatformID.Unix on Mac OS X, workaround this
+ 			if(m_platID.Value == PlatformID.Unix)
+ 			{
+-				if((RunConsoleApp("uname", null) ?? string.Empty).Trim().Equals(
+				if((RunConsoleApp("@uname@", null) ?? string.Empty).Trim().Equals(
+ 					"Darwin", StrUtil.CaseIgnoreCmp))
+ 					m_platID = PlatformID.MacOSX;
+ 			}
 diff --git a/KeePassLib/Utility/MonoWorkarounds.cs b/KeePassLib/Utility/MonoWorkarounds.cs
-index 0da7019..f6a1022 100644
+index e20bb3a..4fd875b 100644
 --- a/KeePassLib/Utility/MonoWorkarounds.cs
 +++ b/KeePassLib/Utility/MonoWorkarounds.cs
@@ -41,7 +41,7 @@ namespace KeePassLib.Utility
@ -76,7 +148,7 @@ index 0da7019..f6a1022 100644
 
 		private static Dictionary<uint, bool> g_dForceReq = new Dictionary<uint, bool>();
 		private static Thread g_thFixClip = null;
-@@ -303,7 +303,7 @@ namespace KeePassLib.Utility
+@@ -335,7 +335,7 @@ namespace KeePassLib.Utility
 				// }
 				// else { Debug.Assert(false); }
 
@ -85,3 +157,6 @@ index 0da7019..f6a1022 100644
 					"-id " + strHandle + " WM_CLASS") ?? string.Empty);
 
 				if(strWmClass.IndexOf("\"" + PwDefs.ResClass + "\"",
+-- 
+2.25.4
+
--- a/pkgs/applications/misc/keepass/keepass-plugins.patch
+++ b/pkgs/applications/misc/keepass/keepass-plugins.patch
@ -1,13 +1,25 @@
+From 4cb0b18f5326a07927453897180289a4b254ac4f Mon Sep 17 00:00:00 2001
+From: Pascal Winkelmann <pascal@wnklmnn.de>
+Date: Tue, 19 May 2020 10:43:49 +0200
+Subject: [PATCH] loadplugin
+
+---
+ KeePass/Forms/MainForm.cs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 diff --git a/KeePass/Forms/MainForm.cs b/KeePass/Forms/MainForm.cs
-index 3d5fca0..4c3f3d4 100644
+index 347eaf5..b92e1e2 100644
 --- a/KeePass/Forms/MainForm.cs
 +++ b/KeePass/Forms/MainForm.cs
-@@ -406,7 +406,$OUTPUT_LC$ @@ namespace KeePass.Forms
- 			m_pluginManager.Initialize(m_pluginDefaultHost);
+@@ -440,7 +440,7 @@ namespace KeePass.Forms
+ 				ToolStripItemCollection tsicT = m_ctxTray.Items;
+ 				ToolStripItem tsiPrevT = m_ctxTrayOptions;
 
- 			m_pluginManager.UnloadAllPlugins();
-			if(AppPolicy.Current.Plugins) m_pluginManager.LoadAllPlugins();
+-				m_pluginManager.LoadAllPlugins();
 $DO_LOADS$+
 
- 			// Delete old files *after* loading plugins (when timestamps
- 			// of loaded plugins have been updated already)
+ 				m_pluginManager.AddMenuItems(PluginMenuType.Main, tsicM, tsiPrevM);
+ 				m_pluginManager.AddMenuItems(PluginMenuType.Group, tsicGM, tsiPrevGM);
+-- 
+2.25.4
+
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "klayout";
-  version = "0.26.4";
+  version = "0.26.5";

  src = fetchFromGitHub {
    owner = "KLayout";
    repo = "klayout";
    rev = "v${version}";
-    sha256 = "0hqc11vz24b6nfpfzsjwwmaq0sznwwqpzmd48q5wpdl0kz1309gj";
+    sha256 = "1zv8yazhdyxm33vdn0m5cciw7zzg45nwdg4rdcsydnrwg7d667r6";
  };

  postPatch = ''
--- a/pkgs/applications/misc/pdfarranger/default.nix
+++ b/pkgs/applications/misc/pdfarranger/default.nix
@ -5,13 +5,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pdfarranger";
-  version = "1.5.1";
+  version = "1.5.3";

  src = fetchFromGitHub {
    owner = "jeromerobert";
    repo = pname;
    rev = version;
-    sha256 = "0n4jw0dsqw929a34ff077kz8w89vkjkqf8dy4c356zh6gf23cdxr";
+    sha256 = "0a9ap7p8iw57sn5nmhim7gp5as8gj6ir6l3p0bpmg4iqjsr4169h";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/sequeler/default.nix
+++ b/pkgs/applications/misc/sequeler/default.nix
@ -11,13 +11,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "sequeler";
-  version = "0.7.9";
+  version = "0.7.91";

  src = fetchFromGitHub {
    owner = "Alecaddd";
    repo = pname;
    rev = "v${version}";
-    sha256 = "117gcc41rd24y5hpm3drqxfcfz52smpcr8w76xnykx8wb1ac50jf";
+    sha256 = "071vfx7bdf7hfa4784xz97vrj9x5aipgjbp30r00kg2zhg8wa2ls";
  };

  nativeBuildInputs = [ meson ninja pkgconfig vala gettext wrapGAppsHook python3 desktop-file-utils ];
--- a/pkgs/applications/misc/timewarrior/default.nix
+++ b/pkgs/applications/misc/timewarrior/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "timewarrior";
-  version = "1.2.0";
+  version = "1.3.0";

  enableParallelBuilding = true;

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "GothenburgBitFactory";
    repo = "timewarrior";
    rev = "v${version}";
-    sha256 = "0ci8kb7gdp1dsv6xj30nbz8lidrmn50pbriw26wv8mdhs17rfk7w";
+    sha256 = "1aijh1ad7gpa61cn7b57w24vy7fyjj0zx5k9z8d6m1ldzbw589cl";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -7,6 +7,7 @@
 , udevSupport  ? true,  udev
 , swaySupport  ? true,  sway
 , mpdSupport   ? true,  mpd_clientlib
+, withMediaPlayer ? false, glib, gobject-introspection, python3, python38Packages, playerctl
 }:
  stdenv.mkDerivation rec {
    pname = "waybar";
@ -21,7 +22,14 @@

    nativeBuildInputs = [
      meson ninja pkgconfig scdoc wrapGAppsHook cmake
+    ] ++ stdenv.lib.optional withMediaPlayer gobject-introspection;
+
+    propagatedBuildInputs = stdenv.lib.optionals withMediaPlayer [
+      glib
+      playerctl
+      python38Packages.pygobject3
    ];
+    strictDeps = false;

    buildInputs = with stdenv.lib;
      [ wayland wlroots gtkmm3 libinput libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
@ -46,6 +54,13 @@
      "-Dsystemd=disabled"
    ];

+    preFixup = stdenv.lib.optional withMediaPlayer ''
+      cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py
+
+      wrapProgram $out/bin/waybar-mediaplayer.py \
+        --prefix PYTHONPATH : "$PYTHONPATH:$out/${python3.sitePackages}"
+    '';
+
    meta = with stdenv.lib; {
      description = "Highly customizable Wayland bar for Sway and Wlroots based compositors";
      license = licenses.mit;
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -18,6 +18,7 @@
 , gtk3
 , libpulseaudio
 , libuuid
+, libdrm
 , libX11
 , libXcomposite
 , libXcursor
@ -29,6 +30,7 @@
 , libXrender
 , libXScrnSaver
 , libXtst
+, mesa
 , nspr
 , nss
 , pango
@ -56,6 +58,7 @@ rpath = lib.makeLibraryPath [
  glib
  gnome2.GConf
  gtk3
+  libdrm
  libpulseaudio
  libX11
  libXScrnSaver
@ -69,6 +72,7 @@ rpath = lib.makeLibraryPath [
  libXrender
  libXtst
  libuuid
+  mesa
  nspr
  nss
  pango
@ -82,11 +86,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.7.92";
+  version = "1.8.95";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "1f262xh88c83m6ixqxc69z8kvkl3qbjc6jnv2g8n0flw8s70hs7z";
+    sha256 = "1mlffg2v31b42gj354w5yv0yzlqc2f4f3cmdnddzkplw10jgw6f1";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -154,13 +154,10 @@ let
      #
      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi) ([ # Fixes for the VA-API build:
+    ] ++ optionals (useVaapi) [ # Improvements for the VA-API build:
      ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
      ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
-    ] ++ optionals (versionRange "81" "82") [
-      (githubPatch "5b2ff215473e0526b5b24aeff4ad90d369b21c75" "0n00vh8wfpn2ay5fqsxcsx0zadnv7mihm72bcvnrfzh75nzbg902")
-      (githubPatch "98e343ab369e4262511b5fce547728e3e5eefba8" "00wwp653jk0k0yvix00vr7ymgck9dj7fxjwx4nc67ynn84dh6064")
-    ]);
+    ];

    postPatch = ''
      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -22,9 +22,7 @@
 }:

 let
-  llvmPackages = if channel != "stable"
-    then llvmPackages_10
-    else llvmPackages_9;
+  llvmPackages = llvmPackages_10;
  stdenv = llvmPackages.stdenv;

  callPackage = newScope chromium;
@ -36,8 +34,6 @@ let

    mkChromiumDerivation = callPackage ./common.nix ({
      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useOzone;
-      gnChromium = gn;
-    } // lib.optionalAttrs (channel != "stable") {
      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-03-23";
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
  beta = {
-    sha256 = "0z9p4v5mkinf7hbdagh4bz6ymqjxg3df3wjpvm201ilzzngmjqz1";
-    sha256bin64 = "1srvlirhnynh0q2a17p8z13p7r54z0cchh1d1h07hqljnwmsf8qj";
-    version = "83.0.4103.34";
+    sha256 = "1g052h8g458qx04wbkz93j7hciw12b2b3w93x2849ag69q6g4qa9";
+    sha256bin64 = "0lkjl09vnj2bd1jry3awbg4z34vjnzd88p73a6x7pyrfq079l6vb";
+    version = "83.0.4103.61";
  };
  dev = {
-    sha256 = "178fc112bsbrgj2hss78y8rhnz8hl85fr33gawk9fz88zk5qz7xd";
-    sha256bin64 = "06qra245l2bbgxc3k04aabkgq1qnzybnrjhrjb25vriv31ji36b1";
-    version = "84.0.4128.3";
+    sha256 = "0f7m57acv79yzq3yg2xkchqqwisdgjv8h5xngp2i2v2md9jkfkbq";
+    sha256bin64 = "0b0w0nwa64gf99d617idjjgrjym3qc6p9h41kn5r9j2x46lxzply";
+    version = "84.0.4143.2";
  };
  stable = {
-    sha256 = "19kpzmqmld0m0nflx13w9flxfal19msnxhzl3lip1jqih65z4y7l";
-    sha256bin64 = "0sl4wv7npc3rhi7jgn679hi7j5ykzwpx5dahy78h87yfg4fx84wx";
-    version = "81.0.4044.138";
+    sha256 = "1g052h8g458qx04wbkz93j7hciw12b2b3w93x2849ag69q6g4qa9";
+    sha256bin64 = "1wji1ak6gi2a7lynxwvgpqsaz7zma9h2b9qbb5x3gzbv2dj37fmd";
+    version = "83.0.4103.61";
  };
 }
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -18,11 +18,11 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "2.11.1811.52-1";
+  version = "3.0.1874.38-1";

  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "0bq9ggk75xzka2nbrnc7vghq8s7jjy9nbfmyrf51kf0nni1zg1fp";
+    sha256 = "03667f8rlk8shxq6ghjg4q9hqhsaw4gwpqnjpyili49qczd5423w";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:

 buildGoModule rec {
  pname = "cni-plugins";
@ -36,6 +36,8 @@ buildGoModule rec {
    "plugins/meta/tuning"
  ];

+  passthru.tests.podman = nixosTests.podman;
+
  meta = with lib; {
    description = "Some standard networking plugins, maintained by the CNI team";
    homepage = "https://github.com/containernetworking/plugins";
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "helm";
-  version = "3.2.0";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "1x05xnc3czk7vpn9qnfdavdjy5agv800nh7jyqczpiw125l9jfyd";
+    sha256 = "1453qkd9s4z4r0xzmv8ym7qfg33szf6gizfkb5zxj590fcbsgnd7";
  };
  vendorSha256 = "0j25m56cwzjd9b75v7xlb26q81bsmln77k23h9n8v2f2gqwwpkrl";

@ -28,4 +28,4 @@ buildGoModule rec {
    license = licenses.asl20;
    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert Frostman ];
  };
-}
+}
--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "kube3d";
-  version = "1.6.0";
+  version = "1.7.0";
  k3sVersion = "1.17.3-k3s1";

  goPackagePath = "github.com/rancher/k3d";
@ -11,7 +11,7 @@ buildGoModule rec {
    owner  = "rancher";
    repo   = "k3d";
    rev    = "v${version}";
-    sha256 = "0qjwqqynvgzainq66fpzczgynwk3hv7wzgfy5271fc6mj2k0zz5x";
+    sha256 = "0aij2l7zmg4cxbw7pwf7ddc64di25hpjvbmp1madhz9q28rwfa9w";
  };

  buildFlagsArray = ''
--- a/pkgs/applications/networking/cluster/kubeseal/default.nix
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@ -2,19 +2,21 @@

 buildGoModule rec {
  pname = "kubeseal";
-  version = "0.12.0";
+  version = "0.12.3";

  src = fetchFromGitHub {
    owner = "bitnami-labs";
    repo = "sealed-secrets";
    rev = "v${version}";
-    sha256 = "0z51iwdc4m0y8wyyx3mcvbzxlrgws7n5wkcd0g7nr73irnsld4lh";
+    sha256 = "1h8n2219xh0gl42kz3rkv3aj3wfwivvs9skwbbrvmrkwwrpxkgdj";
  };

  vendorSha256 = null;

  subPackages = [ "cmd/kubeseal" ];

+  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+
  meta = with lib; {
    description = "A Kubernetes controller and tool for one-way encrypted Secrets";
    homepage = "https://github.com/bitnami-labs/sealed-secrets";
--- a/pkgs/applications/networking/instant-messengers/rambox/pro.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/pro.nix
@ -16,22 +16,31 @@ stdenv.mkDerivation rec {
  };

  installPhase = ''
-    mkdir -p $out/bin $out/opt/RamboxPro $out/share/applications
-    asar e resources/app.asar $out/opt/RamboxPro/resources/app.asar.unpacked   
-    ln -s ${desktopItem}/share/applications/* $out/share/applications
+    mkdir -p $out/{bin,resources/dist/renderer/assets/images/app,share/applications,share/icons/hicolor/256x256/apps}
+
+    asar e resources/app.asar $out/resources
+
+    substituteInPlace "$out/resources/dist/electron/main.js" \
+      --replace ",isHidden:" ",path:\"$out/bin/ramboxpro\",isHidden:"
+
+    cp $desktopItem/share/applications/* $out/share/applications
+    cp $out/resources/dist/electron/imgs/256x256.png $out/share/icons/hicolor/256x256/apps/ramboxpro.png
+    cp $out/resources/dist/electron/imgs/256x256.png $out/resources/dist/renderer/assets/images/app/icon.png
  '';

  postFixup = ''
    makeWrapper ${electron}/bin/electron $out/bin/ramboxpro \
-      --add-flags "$out/opt/RamboxPro/resources/app.asar.unpacked --without-update" \
+      --add-flags "$out/resources --without-update" \
      --prefix PATH : ${xdg_utils}/bin
  '';

  desktopItem = makeDesktopItem {
    name = "rambox-pro";
    exec = "ramboxpro";
+    icon = "ramboxpro";
    type = "Application";
    desktopName = "Rambox Pro";
+    categories = "Network;";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@ -1,15 +1,111 @@
 {
-  "name": "riot-web",
+  "name": "riot-desktop",
  "productName": "Riot",
  "main": "src/electron-main.js",
-  "version": "1.6.0",
+  "version": "1.6.1",
  "description": "A feature-rich client for Matrix.org",
  "author": "New Vector Ltd.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vector-im/riot-desktop"
+  },
+  "license": "Apache-2.0",
+  "files": [],
+  "scripts": {
+    "mkdirs": "mkdirp packages deploys",
+    "fetch": "yarn run mkdirs && node scripts/fetch-package.js",
+    "start": "electron .",
+    "lint": "eslint src/ scripts/ hak/",
+    "build:native": "yarn run hak",
+    "build32": "electron-builder --ia32",
+    "build64": "electron-builder --x64",
+    "build": "electron-builder",
+    "docker:setup": "docker build -t riot-desktop-dockerbuild dockerbuild",
+    "docker:build:native": "scripts/in-docker.sh yarn run hak",
+    "docker:build": "scripts/in-docker.sh yarn run build",
+    "docker:install": "scripts/in-docker.sh yarn install",
+    "debrepo": "scripts/mkrepo.sh",
+    "clean": "rimraf webapp.asar dist packages deploys",
+    "hak": "node scripts/hak/index.js"
+  },
  "dependencies": {
    "auto-launch": "^5.0.1",
    "electron-store": "^2.0.0",
    "electron-window-state": "^4.1.0",
-    "minimist": "^1.2.0",
+    "minimist": "^1.2.3",
    "png-to-ico": "^1.0.2"
+  },
+  "devDependencies": {
+    "asar": "^2.0.1",
+    "electron-builder": "^22.3.2",
+    "electron-builder-squirrel-windows": "^22.3.2",
+    "electron-devtools-installer": "^2.2.4",
+    "electron-notarize": "^0.2.0",
+    "eslint": "^5.8.0",
+    "eslint-config-google": "^0.7.1",
+    "eslint-plugin-babel": "^4.1.2",
+    "find-npm-prefix": "^1.0.2",
+    "fs-extra": "^8.1.0",
+    "glob": "^7.1.6",
+    "matrix-js-sdk": "6.1.0",
+    "mkdirp": "^1.0.3",
+    "needle": "^2.3.2",
+    "node-pre-gyp": "^0.14.0",
+    "npm": "^6.13.7",
+    "rimraf": "^3.0.2",
+    "semver": "^7.1.3",
+    "tar": "^6.0.1"
+  },
+  "hakDependencies": {
+    "matrix-seshat": "^1.3.3"
+  },
+  "build": {
+    "appId": "im.riot.app",
+    "electronVersion": "8.0.3",
+    "files": [
+      "package.json",
+      {
+        "from": ".hak/hakModules",
+        "to": "node_modules"
+      },
+      "src/**"
+    ],
+    "extraResources": [
+      {
+        "from": "res/img",
+        "to": "img"
+      },
+      "webapp.asar"
+    ],
+    "linux": {
+      "target": "deb",
+      "category": "Network;InstantMessaging;Chat",
+      "maintainer": "support@riot.im",
+      "desktop": {
+        "StartupWMClass": "riot"
+      }
+    },
+    "mac": {
+      "category": "public.app-category.social-networking",
+      "darkModeSupport": true
+    },
+    "win": {
+      "target": {
+        "target": "squirrel"
+      },
+      "sign": "scripts/electron_winSign"
+    },
+    "directories": {
+      "output": "dist"
+    },
+    "afterSign": "scripts/electron_afterSign",
+    "protocols": [
+      {
+        "name": "riot",
+        "schemes": [
+          "riot"
+        ]
+      }
+    ]
  }
 }
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-yarndeps.nix
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@ -8,20 +8,18 @@

 let
  executableName = "riot-desktop";
-  version = "1.6.0";
-  riot-web-src = fetchFromGitHub {
+  version = "1.6.1";
+  src = fetchFromGitHub {
    owner = "vector-im";
-    repo = "riot-web";
+    repo = "riot-desktop";
    rev = "v${version}";
-    sha256 = "16zm6l4c7vkfdlxh6gdw531k5r4v3mb0h66q41h94dvmj79dz2bj";
+    sha256 = "05mhapcgr1802c27428m8wkmw8qis1akv4m7z3m0l89wgv4kh6za";
  };
  electron = electron_7;

 in mkYarnPackage rec {
  name = "riot-desktop-${version}";
-  inherit version;
-
-  src = "${riot-web-src}/electron_app";
+  inherit version src;

  packageJSON = ./riot-desktop-package.json;
  yarnNix = ./riot-desktop-yarndeps.nix;
@ -32,8 +30,8 @@ in mkYarnPackage rec {
    # resources
    mkdir -p "$out/share/riot"
    ln -s '${riot-web}' "$out/share/riot/webapp"
-    cp -r './deps/riot-web' "$out/share/riot/electron"
-    cp -r './deps/riot-web/img' "$out/share/riot"
+    cp -r './deps/riot-desktop' "$out/share/riot/electron"
+    cp -r './deps/riot-desktop/res/img' "$out/share/riot"
    rm "$out/share/riot/electron/node_modules"
    cp -r './node_modules' "$out/share/riot/electron"

@ -80,7 +78,7 @@ in mkYarnPackage rec {
    description = "A feature-rich client for Matrix.org";
    homepage = "https://about.riot.im/";
    license = licenses.asl20;
-    maintainers = with maintainers; [ pacien worldofpeace ];
+    maintainers = with maintainers; [ pacien worldofpeace ma27 ];
    inherit (electron.meta) platforms;
  };
 }
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -12,11 +12,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "riot-web";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1mm4xk69ya1k3gz6jjhc4njx7b3rp157jmrqsxr5i382zs035ff7";
+    sha256 = "0mqb9y38vnngwz38qgdn24mspmk6zh4v1j778ppban034ga0almv";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/riot/update-riot-desktop.sh
+++ b/pkgs/applications/networking/instant-messengers/riot/update-riot-desktop.sh
@ -9,9 +9,9 @@ if [ "$#" -ne 1 ] || [[ "$1" == -* ]]; then
 	exit 1
 fi

-RIOT_WEB_SRC="https://raw.githubusercontent.com/vector-im/riot-web/$1"
+RIOT_WEB_SRC="https://raw.githubusercontent.com/vector-im/riot-desktop/$1"

-wget "$RIOT_WEB_SRC/electron_app/package.json" -O riot-desktop-package.json
-wget "$RIOT_WEB_SRC/electron_app/yarn.lock" -O riot-desktop-yarndeps.lock
+wget "$RIOT_WEB_SRC/package.json" -O riot-desktop-package.json
+wget "$RIOT_WEB_SRC/yarn.lock" -O riot-desktop-yarndeps.lock
 yarn2nix --lockfile=riot-desktop-yarndeps.lock > riot-desktop-yarndeps.nix
 rm riot-desktop-yarndeps.lock
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.59.0.77";
+  version = "8.60.0.76";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -65,7 +65,7 @@ let
          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "1cnlwlp84942ywji3x60zvhijavazdxfym3rfzq3ysky28b6mn6i";
+        sha256 = "1y919ki0c17vip90fln17impwky08qgprw0j1dgz239qqpwakn7a";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
+++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix
@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper, makeDesktopItem, zlib, glib, libpng, freetype, openssl
-, xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, xkeyboard_config, alsaLib
-, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin
+, xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, qtwebsockets, xkeyboard_config
+, alsaLib, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin
 }:

 let
@ -13,7 +13,7 @@ let
    [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender openssl
      xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama
      xorg.libxcb fontconfig xorg.libXext xorg.libX11 alsaLib qtbase qtwebengine qtwebchannel qtsvg
-      libpulseaudio quazip llvmPackages.libcxx llvmPackages.libcxxabi
+      qtwebsockets libpulseaudio quazip llvmPackages.libcxx llvmPackages.libcxxabi
    ];

  desktopItem = makeDesktopItem {
@ -33,13 +33,13 @@ in
 stdenv.mkDerivation rec {
  pname = "teamspeak-client";

-  version = "3.3.2";
+  version = "3.5.3";

  src = fetchurl {
    url = "https://files.teamspeak-services.com/releases/client/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run";
    sha256 = if stdenv.is64bit
-                then "1n916ds67dxj5bfgc5zm9nz2xh2914k85pzzspzvfyr7njcw7hpi"
-                else "0csl5xklcb4v8bzwvby5m2n38zjrnaw8dcvha7qvfbjllxr75yn2";
+                then "0fp9v2rkxf0zgvf3wcx8nsmf93bzdc22xlqxk3r8cb0415adp76a"
+                else "0ni7hijprc8xygyz41568f1m9wwhl8lk5c3q28bm9m5r6qym39l6";
  };

  # grab the plugin sdk for the desktop icon
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -15,11 +15,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "5.0.403652.0509";
+  version = "5.0.408598.0517";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "00bprrfc7mmf3yg6jddqm2qr73m2zycr8hy19dxqpzld9gbvyzik";
+      sha256 = "1irpnrxl91pc9naz0d9m252scnbfdbdi7yh19hd3arvk3fppjk7w";
    };
  };

--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@ -41,11 +41,11 @@ in

 stdenv.mkDerivation rec {
  pname = "mullvad-vpn";
-  version = "2020.3";
+  version = "2020.4";

  src = fetchurl {
    url = "https://www.mullvad.net/media/app/MullvadVPN-${version}_amd64.deb";
-    sha256 = "fac3896db78cc2ddac81abec8bc0aa324e66b453126ed35a501e422ce64b1362";
+    sha256 = "17xi8g2k89vi4d0j7pr33bx9zjapa2qh4pymbrqvxwli3yhq6zwr";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@ -5,7 +5,7 @@

 let
  sha256 = {
-    x86_64-linux = "09ajpsmgrgjhw7b91id76w84kwk2d678n0b81zzpwq7sgjcm0sb0";
+    x86_64-linux = "1vpfyffg1g7f1m4mxmqghswihml9rm1cipm7krmr5wvxdmcphxnk";
    i386-linux   = "0vjxbg5hwkqkh600rr75xviwy848r1xw9mxwf6bb6l8b0isvlsgg";
  }.${stdenv.hostPlatform.system} or (throw "system ${stdenv.hostPlatform.system} not supported");

@ -28,7 +28,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "anydesk";
-  version = "5.5.5";
+  version = "5.5.6";

  src = fetchurl {
    urls = [
--- a/pkgs/applications/networking/sniffers/etherape/default.nix
+++ b/pkgs/applications/networking/sniffers/etherape/default.nix
@ -2,10 +2,10 @@
 popt, itstool, libxml2 }:

 stdenv.mkDerivation rec {
-  name = "etherape-0.9.18";
+  name = "etherape-0.9.19";
  src = fetchurl {
    url = "mirror://sourceforge/etherape/${name}.tar.gz";
-    sha256 = "0y9cfc5iv5zy82j165i9agf45n1ixka064ykdvpdhb07sr3lzhmv";
+    sha256 = "0w63vg2q6if3wvy2md66in8b6cdw9q40hny5xy6yrxky58l4kmg7";
  };

  nativeBuildInputs = [ itstool pkgconfig (stdenv.lib.getBin libxml2) ];
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -10,7 +10,7 @@ assert withQt  -> qt5  != null;
 with stdenv.lib;

 let
-  version = "3.2.3";
+  version = "3.2.4";
  variant = if withQt then "qt" else "cli";

 in stdenv.mkDerivation {
@ -20,7 +20,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "1fpsfjrap7j84sy728yhcr2gad9nq3n5gq03mwrmxnc6ijwf81zh";
+    sha256 = "1amqgn94g6h6cfnsccm2zb4c73pfv1qmzi1i6h1hnbcyhhg4czfi";
  };

  cmakeFlags = [
--- a/pkgs/applications/networking/termius/default.nix
+++ b/pkgs/applications/networking/termius/default.nix
@ -0,0 +1,68 @@
+{ atomEnv
+, autoPatchelfHook
+, dpkg
+, fetchurl
+, makeDesktopItem
+, makeWrapper
+, stdenv
+, udev
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "termius";
+  version = "5.10.1";
+
+  src = fetchurl {
+    url = "https://deb.termius.com/pool/main/t/termius-app/termius-app_${version}_amd64.deb";
+    sha256 = "04zh0zzyp906lf6mz3xzxybn2a55rv3vvrj0m12gnrb8kjb3pk5s";
+  };
+
+  desktopItem = makeDesktopItem {
+    categories = "Network;";
+    comment = "The SSH client that works on Desktop and Mobile";
+    desktopName = "Termius";
+    exec = "termius-app";
+    genericName = "Cross-platform SSH client";
+    icon = "termius-app";
+    name = "termius-app";
+  };
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontPatchELF = true;
+  dontWrapGApps = true;
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper wrapGAppsHook ];
+
+  buildInputs = atomEnv.packages;
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    cp -R "opt" "$out"
+    cp -R "usr/share" "$out/share"
+    chmod -R g-w "$out"
+
+    # Desktop file
+    mkdir -p "$out/share/applications"
+    cp "${desktopItem}/share/applications/"* "$out/share/applications"
+  '';
+
+  runtimeDependencies = [ udev.lib ];
+
+  postFixup = ''
+    makeWrapper $out/opt/Termius/termius-app $out/bin/termius-app \
+      "''${gappsWrapperArgs[@]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A cross-platform SSH client with cloud data sync and more";
+    homepage = "https://termius.com/";
+    downloadPage = "https://termius.com/linux/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "picard-tools";
-  version = "2.22.4";
+  version = "2.22.7";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0gzna5df8nk42l7mc0qbp9h73gwr1030jnw10fawjp6ql6213kdd";
+    sha256 = "09q66lhjnprkw8azavwzwv9dlhr9b4x0dbz6fym0i2wbhylqp4w6";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@ -3,49 +3,49 @@
 {
  "kicad" = {
    kicadVersion = {
-      version =			"5.1.5";
+      version =			"5.1.6";
      src = {
-        rev =			"52549c5d09cbfb0e807fcbcb07819bc9f7861544";
-        sha256 =		"15h3rwisjss3fdc9bam9n2wq94slhacc3fbg14bnzf4n5agsnv5b";
+        rev =			"c6e7f7de7df655fd59b57823499efc443009de6b";
+        sha256 =		"1pa3z0h0679jmgxlzc833h6q85b5paxdp69kf2h93vkaryj58622";
      };
    };
    libVersion = {
-      version =			"5.1.5";
+      version =			"5.1.6";
      libSources = {
-        i18n.rev =		"5122cbec6563fb7c8d6f960a639ac470353af91b";
-        i18n.sha256 =		"1rfpifl8vky1gba2angizlb2n7mwmsiai3r6ip6qma60wdj8sbd3";
-        symbols.rev =		"dd122ec170b49e032179511c9d263126f52f4020";
-        symbols.sha256 =	"048b07ffsaav1ssrchw2p870lvb4rsyb5vnniy670k7q9p16qq6h";
-        templates.rev =		"94761f10d06582b33cd55ea2149d72f269f65580";
-        templates.sha256 =	"0cs3bm3zb5ngw5ldn0lzw5bvqm4kvcidyrn76438alffwiz2b15g";
-        footprints.rev =	"e076f8f271f8db96d5fec45616b7554caebb7ef7";
-        footprints.sha256 =	"1c4whgn14qhz4yqkl46w13p6rpv1k0hsc9s9h9368fxfcz9knb2j";
-        packages3d.rev =	"8d233cdcb109aa1c3b8ba4c934ee31f6a3b6e1f4";
-        packages3d.sha256 =	"0cff2ms1bsw530kqb1fr1m2pjixyxzwa81mxgac3qpbcf8fnpvaz";
+        i18n.rev =		"5ad171ce5c8d90f4740517c2adecb310d8be51bd";
+        i18n.sha256 =		"0qryi8xjm23ka363zfl7bbga0v5c31fr3d4nyxp3m168vkv9zhha";
+        symbols.rev =		"5150eaa2a7d15cfc6bb1459c527c4ebaa66d7708";
+        symbols.sha256 =	"12w3rdy085drlikkpb27n9ni7cyg9l0pqy7hnr86cxjcw3l5wcx6";
+        templates.rev =		"9213d439f757e6049b7e54f3ea08272a0d0f44a9";
+        templates.sha256 =	"1hppcsrkn4dk6ggby6ckh0q65qxkywrbyxa4lwpaf7pxjyv498xg";
+        footprints.rev =	"a61b4e49762fb355f654e65a1c7db1aaf7bb2332";
+        footprints.sha256 =	"1kmf91a5mmvj9izrv40mkaw1w36yjgn8daczd9rq2wlmd0rdp1zx";
+        packages3d.rev =	"150ff1caf0b01dc04c84f4f966f4f88fedfa8f8c";
+        packages3d.sha256 =	"0b9jglf77fy0n0r8xs4yqkv6zvipyfvp0z5dnqlzp32csy5aqpi1";
      };
    };
  };
  "kicad-unstable" = {
    kicadVersion = {
-      version =			"2020-05-06";
+      version =			"2020-05-14";
      src = {
-        rev =			"c92181621e2e51dc8aae1bd9f4483bb3301ffaa5";
-        sha256 =		"0s50xn5gbjy7yxnp9yiynxvxi2mkcrp6yghgdzclpm40rnfyi0v5";
+        rev =			"3b8465359135e9f6dea4b0a5fcb62377753fe890";
+        sha256 =		"18xsg2s0pxx176rnblygq1f8xpmryw59lcjzm897gifz0sj0nhvx";
      };
    };
    libVersion = {
-      version =			"2020-05-06";
+      version =			"2020-05-14";
      libSources = {
-        i18n.rev =		"f29cab831eb823165fa2c5efab5d9c9b443e62e2";
-        i18n.sha256 =		"0cc0zvpml75yxphay3281f762ls08fzvv538cd5hmkr8xqlj3vbi";
-        symbols.rev =		"d4245ae8cf633095a0994ab01492bd56cd124112";
-        symbols.sha256 =	"11pynjgji3skw42q5mryz98f8z418k43jy6s2k90w6jv638z3cb0";
+        i18n.rev =		"c4460d0d8e1075691d43dc928ffc332fa1282592";
+        i18n.sha256 =		"1gkrbfyfzsr5q7sahhlyhgfpfwm6b83lzf0q1v854gwxdfabvi0y";
+        symbols.rev =		"614b5f6256fbae82c2bba399086506bbe435bd94";
+        symbols.sha256 =	"10ix3wdcl832r4ha5q8phpx8j97gzngb41nczdli1qkhjmiw9y8r";
        templates.rev =		"7db8d4d0ea0711f1961d117853547fb3edbc3857";
        templates.sha256 =	"1hppcsrkn4dk6ggby6ckh0q65qxkywrbyxa4lwpaf7pxjyv498xg";
-        footprints.rev =	"3bff23ee339bc48490bb39deba5d8b2f1f42733e";
-        footprints.sha256 =	"0430r8k49ib6w1sjr8fx42szbz960yhlzg4w80jl5bwasq67nqwd";
-        packages3d.rev =	"889a3dd550233ec51baed4a04a01d4cc64a8d747";
-        packages3d.sha256 =	"152zv4j51v8skqlvrabblpcqpbn5yf3grisjj8vnwf7kdd41chb2";
+        footprints.rev =	"240804c6c89b66af808379e1fc94ea6011433cbe";
+        footprints.sha256 =	"1jh71004lrn7bl384zfmbqqdbs28gjb6diwn6hyb587jpivdnl3g";
+        packages3d.rev =	"9b560cf94a35b692ca516d37bdaf392ce10e549d";
+        packages3d.sha256 =	"0b9jglf77fy0n0r8xs4yqkv6zvipyfvp0z5dnqlzp32csy5aqpi1";
      };
    };
  };
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -34,6 +34,7 @@ let
   "8.10.2" = "0znxmpy71bfw0p6x47i82jf5k7v41zbz9bdpn901ysn3ir8l3wrz";
   "8.11.0" = "1rfdic6mp7acx2zfwz7ziqk12g95bl9nyj68z4n20a5bcjv2pxpn";
   "8.11.1" = "0qriy9dy36dajsv5qmli8gd6v55mah02ya334nw49ky19v7518m0";
+   "8.11.2" = "0f77ccyxdgbf1nrj5fa8qvrk1cyfy06fv8gj9kzfvlcgn0cf48sa";
  }.${version};
  coq-version = stdenv.lib.versions.majorMinor version;
  versionAtLeast = stdenv.lib.versionAtLeast coq-version;
--- a/pkgs/applications/science/logic/elan/default.nix
+++ b/pkgs/applications/science/logic/elan/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "elan";
-  version = "0.10.0";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "kha";
    repo = "elan";
    rev = "v${version}";
-    sha256 = "0aw538shvpfbk481y0gw3z97nsazdnk8qh8fwsb6ji62p2r51v6f";
+    sha256 = "0ycw1r364g5gwh8796dpv1israpg7zqwx8mcvnacv2lqj5iijmby";
  };

-  cargoSha256 = "0zg3q31z516049v9fhli4yxldx9fg31k2qfx4ag8rmyvpgy9xh6c";
+  cargoSha256 = "0hcaiy046d2gnkp6sfpnkkprb3nd94i9q8dgqxxpwrc1j157x6z9";

  nativeBuildInputs = [ pkgconfig ];

--- a/pkgs/applications/science/math/nauty/default.nix
+++ b/pkgs/applications/science/math/nauty/default.nix
@ -4,10 +4,10 @@
 }:
 stdenv.mkDerivation rec {
  pname = "nauty";
-  version = "26r12";
+  version = "27r1";
  src = fetchurl {
    url = "http://pallini.di.uniroma1.it/nauty${version}.tar.gz";
-    sha256 = "1p4mxf8q5wm47nxyskxbqwa5p1vvkycv1zgswvnk9nsn6vff0al6";
+    sha256 = "1nym0p2djws8ylkpr0kgpxfa6fxdlh46cmvz0gn5vd02jzgs0aww";
  };
  outputs = [ "out" "dev" ];
  configureFlags = {
@ -37,6 +37,10 @@ stdenv.mkDerivation rec {
    license = licenses.asl20;
    maintainers = with maintainers; [ raskin timokau ];
    platforms = platforms.unix;
+    # I'm not sure if the filename will remain the same for future changelog or
+    # if it will track changes to minor releases. Lets see. Better than nothing
+    # in any case.
+    changelog = "http://pallini.di.uniroma1.it/changes24-27.txt";
    homepage = "http://pallini.di.uniroma1.it/";
  };
 }
--- a/pkgs/applications/science/math/palp/default.nix
+++ b/pkgs/applications/science/math/palp/default.nix
@ -9,16 +9,15 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "palp";
-  version = "2.1";
+  version = "2.11";

  src = fetchurl {
    url = "http://hep.itp.tuwien.ac.at/~kreuzer/CY/palp/palp-${version}.tar.gz";
-    sha256 = "1s7s2lc5f0ig1yy7ygsh3sddm3sbq4mxwybqsj8lp9wjdxs7qfrs";
+    sha256 = "0pv3rmgk8xc8z98w173f1jxc1cd67cdl8mjjgmgp3mcvifcfsrjl";
  };

  hardeningDisable = [
    "format"
-    "strictoverflow" # causes runtime failure (tested in checkPhase)
  ];

  patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
@ -78,6 +77,9 @@ stdenv.mkDerivation rec {
      facet enumeration compares well with existing packages.
    '';
    homepage = "http://hep.itp.tuwien.ac.at/~kreuzer/CY/CYpalp.html";
+    # Not really a changelog, but a one-line summary of each update that should
+    # be reviewed on update.
+    changelog = "http://hep.itp.tuwien.ac.at/~kreuzer/CY/CYpalp.html";
    # Just a link on the website pointing to gpl -- now gplv3. When the last
    # version was released that pointed to gplv2 however, so thats probably
    # the right license.
--- a/pkgs/applications/science/misc/cytoscape/default.nix
+++ b/pkgs/applications/science/misc/cytoscape/default.nix
@ -1,14 +1,23 @@
-{ stdenv, fetchurl, jre, makeWrapper }:
+{ stdenv, fetchurl, jre, makeWrapper, substituteAll, coreutils }:

 stdenv.mkDerivation rec {
  pname = "cytoscape";
-  version = "3.7.2";
+  version = "3.8.0";

  src = fetchurl {
-    url = "https://github.com/cytoscape/cytoscape/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "125vgr8vqbmy2nsm1yl0h0q8p49lxxqfw5cmxzbx1caklcn4rryc";
+    url = "https://github.com/cytoscape/cytoscape/releases/download/${version}/${pname}-unix-${version}.tar.gz";
+    sha256 = "0kksx12m83cjprdygmcc286990byf25yqfx5s7c07cizc21aavyg";
  };

+  patches = [
+    # By default, gen_vmoptions.sh tries to store custom options in $out/share
+    # at run time. This patch makes sure $HOME is used instead.
+    (substituteAll {
+      src = ./gen_vmoptions_to_homedir.patch;
+      inherit coreutils;
+    })
+  ];
+
  buildInputs = [jre makeWrapper];

  installPhase = ''
--- a/pkgs/applications/science/misc/cytoscape/gen_vmoptions_to_homedir.patch
+++ b/pkgs/applications/science/misc/cytoscape/gen_vmoptions_to_homedir.patch
@ -0,0 +1,19 @@
+diff -Nur a/gen_vmoptions.sh b/gen_vmoptions.sh
+--- a/gen_vmoptions.sh	2020-03-30 21:57:47.000000000 +0100
+++ b/gen_vmoptions.sh	2020-05-05 09:49:57.974989824 +0100
+@@ -1,13 +1,10 @@
+ #!/bin/sh
+ # Generates the Cytoscape.vmoptions file
+ 
+-script_path="$(dirname -- $0)"
+-
+-#vm_options_path="$HOME/.cytoscape"
+-vm_options_path=$script_path
+vm_options_path="$HOME/.cytoscape"
+ 
+ if [ ! -e $vm_options_path ]; then
+-    /bin/mkdir $vm_options_path
+    @coreutils@/bin/mkdir $vm_options_path
+ fi
+ 
+ # Determine amount of physical memory present:
--- a/pkgs/applications/science/misc/foldingathome/control.nix
+++ b/pkgs/applications/science/misc/foldingathome/control.nix
@ -8,7 +8,7 @@
 }:
 let
  majMin = stdenv.lib.versions.majorMinor version;
-  version = "7.6.9";
+  version = "7.6.13";

  python = python2.withPackages
    (
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://download.foldingathome.org/releases/public/release/fahcontrol/debian-stable-64bit/v${majMin}/fahcontrol_${version}-1_all.deb";
-    sha256 = "1fh7ybbp3qlqzh18c4gva3aaymv7d31mqchrv235a1axldha1s9s";
+    sha256 = "0qfvhwc29cgqkwf2bkhq4gr2d1c4jgccfs58916ss03n4rwz9gng";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/misc/foldingathome/viewer.nix
+++ b/pkgs/applications/science/misc/foldingathome/viewer.nix
@ -11,7 +11,7 @@
 }:
 let
  majMin = stdenv.lib.versions.majorMinor version;
-  version = "7.6.9";
+  version = "7.6.13";
 in
 stdenv.mkDerivation rec {
  inherit version;
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://download.foldingathome.org/releases/public/release/fahviewer/debian-stable-64bit/v${majMin}/fahviewer_${version}_amd64.deb";
-    sha256 = "04wr86g11wpmsczzwzak4gvalcihb47rn3zp6qriawhxyac9nf93";
+    sha256 = "09yfvk16j1iwx8h1xg678ks3bc8760gfdn7n32j8r893kd32cwyk";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/bcompare/default.nix
+++ b/pkgs/applications/version-management/bcompare/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "bcompare";
-  version = "4.3.2.24472";
+  version = "4.3.4.24657";

  src = fetchurl {
    url = "https://www.scootersoftware.com/${pname}-${version}_amd64.deb";
-    sha256 = "1msygg01yi0n8lpk8sl226p09ls7wvd3z3k067mdgrss8rjy5va5";
+    sha256 = "031ivmpy0mk43skb30r7p5zwf0m90pmsqhaq5kc08gzy6g4s0wd0";
  };

  unpackPhase = ''
--- a/pkgs/applications/version-management/git-and-tools/gitui/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitui";
-  version = "0.2.5";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "extrawurst";
    repo = pname;
    rev = "v${version}";
-    sha256 = "12zqsnkask2hhbvvyym4w21yx9rgwpqx2mnj6qds3y2qmcy1yhi4";
+    sha256 = "0rdaschf6030zprz81g7xnx57idjsq3bjhjp5d9387ha5njq0bp1";
  };

-  cargoSha256 = "1kbaqpfj7b9asyyqjdljyga3v428yzlsgpnn9187hf4ydhpr6zrz";
+  cargoSha256 = "1k24xabhgwwdvslq81w6b8jnnjxbafj4s0zpcq2c4hals2xxwfy4";

  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];

--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@ -7,7 +7,7 @@
 # be nice to add the native GUI (and/or the GTK GUI) as an option too, but that
 # requires invoking the Xcode build system, which is non-trivial for now.

-{ stdenv, lib, fetchurl,
+{ stdenv, lib, fetchFromGitHub,
  # Main build tools
  pkgconfig, autoconf, automake, libtool, m4, lzma, python3,
  numactl,
@ -30,35 +30,62 @@
  # for now we disable GTK GUI support on Darwin. (It may be possible to remove
  # this restriction later.)
  useGtk ? !stdenv.isDarwin, wrapGAppsHook ? null,
-                             intltool ? null,
-                             glib ? null,
-                             gtk3 ? null,
-                             libappindicator-gtk3 ? null,
-                             libnotify ? null,
-                             gst_all_1 ? null,
-                             dbus-glib ? null,
-                             udev ? null,
-                             libgudev ? null,
-                             hicolor-icon-theme ? null,
+  intltool ? null,
+  glib ? null,
+  gtk3 ? null,
+  libappindicator-gtk3 ? null,
+  libnotify ? null,
+  gst_all_1 ? null,
+  dbus-glib ? null,
+  udev ? null,
+  libgudev ? null,
+  hicolor-icon-theme ? null,
  # FDK
  useFdk ? false, fdk_aac ? null
 }:

-assert stdenv.isDarwin -> AudioToolbox != null && Foundation != null
-  && libobjc != null && VideoToolbox != null;
+assert stdenv.isDarwin -> AudioToolbox != null
+       && Foundation != null
+       && libobjc != null
+       && VideoToolbox != null;

 stdenv.mkDerivation rec {
  pname = "handbrake";
  version = "1.3.2";

-  src = fetchurl {
-    #  2020-05-05: NOTE: Thou fetching from GitHub, still fetchurl required,
-    #  because this tarball has their "special" packaging and so
-    #  internal "special" version information
-    url = ''https://github.com/HandBrake/HandBrake/releases/download/${version}/HandBrake-${version}-source.tar.bz2'';
-    sha256 = "0w7jxjrccvxp7g15dv0spildg5apmqp4gwbcqmg58va2gylynvzc";
+  src = fetchFromGitHub {
+    owner = "HandBrake";
+    repo = "HandBrake";
+    rev = version;
+    sha256 = "04z3hcy7m5yvma849rlrsx2wdqmkilkl1qds9yrzr2ydpw697f85";
+    extraPostFetch = ''
+      echo "DATE=$(date +"%F %T %z" -r $out/NEWS.markdown)" > $out/version.txt
+    '';
  };

+  # we put as little as possible in src.extraPostFetch as it's much easier to
+  # add to it here without having to fiddle with src.sha256
+  # only DATE and HASH are absolutely necessary
+  postPatch = ''
+    cat >> version.txt <<_EOF
+HASH=${src.rev}
+SHORTHASH=${src.rev}
+TAG=${version}
+URL=${src.meta.homepage}
+_EOF
+
+    patchShebangs scripts
+
+    substituteInPlace libhb/module.defs \
+      --replace /usr/include/libxml2 ${libxml2.dev}/include/libxml2
+
+    # Force using nixpkgs dependencies
+    sed -i '/MODULES += contrib/d' make/include/main.defs
+    sed -e 's/^[[:space:]]*\(meson\|ninja\|nasm\)[[:space:]]*= ToolProbe.*$//g' \
+        -e '/    ## Additional library and tool checks/,/    ## MinGW specific library and tool checks/d' \
+        -i make/configure.py
+  '';
+
  nativeBuildInputs = [
    pkgconfig autoconf automake libtool m4 python3
  ] ++ lib.optionals useGtk [ intltool wrapGAppsHook ];
@ -73,23 +100,12 @@ stdenv.mkDerivation rec {
    gst_all_1.gstreamer gst_all_1.gst-plugins-base dbus-glib udev
    libgudev hicolor-icon-theme
  ] ++ lib.optional useFdk fdk_aac
-    ++ lib.optionals stdenv.isDarwin [ AudioToolbox Foundation libobjc VideoToolbox ]
+  ++ lib.optionals stdenv.isDarwin [ AudioToolbox Foundation libobjc VideoToolbox ]
  # NOTE: 2018-12-27: Handbrake supports nv-codec-headers for Linux only,
  # look at ./make/configure.py search "enable_nvenc"
-    ++ lib.optional stdenv.isLinux nv-codec-headers;
+  ++ lib.optional stdenv.isLinux nv-codec-headers;

-  preConfigure = ''
-    patchShebangs scripts
-
-    substituteInPlace libhb/module.defs \
-      --replace /usr/include/libxml2 ${libxml2.dev}/include/libxml2
-
-    # Force using nixpkgs dependencies
-    sed -i '/MODULES += contrib/d' make/include/main.defs
-    sed -e 's/^[[:space:]]*\(meson\|ninja\|nasm\)[[:space:]]*= ToolProbe.*$//g' \
-        -e '/    ## Additional library and tool checks/,/    ## MinGW specific library and tool checks/d' \
-        -i make/configure.py
-  '';
+  enableParallelBuilding = true;

  configureFlags = [
    "--disable-df-fetch"
@ -97,10 +113,10 @@ stdenv.mkDerivation rec {
    (if useGtk          then "--disable-gtk-update-checks" else "--disable-gtk")
    (if useFdk          then "--enable-fdk-aac"            else "")
    (if stdenv.isDarwin then "--disable-xcode"             else "")
-  ];
+  ] ++ lib.optional (stdenv.isx86_32 || stdenv.isx86_64) "--harden";

  # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
-  NIX_LDFLAGS = toString [
+  NIX_LDFLAGS = [
    "-lx265"
  ];

--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@ -179,8 +179,8 @@ in stdenv.mkDerivation {
      # libdvdcss libdvdnav libdvdread
    ]
    ++ lib.optional x11Support [
-      libX11 xorgproto libXt libXmu libXext libXdmcp
-      libXinerama libXrandr libXtst libXfixes
+      libX11 xorgproto libXt libXmu libXext.dev libXdmcp
+      libXinerama libXrandr.dev libXtst libXfixes
    ]
    ++ lib.optional  dbusSupport     dbus
    ++ lib.optional joystickSupport cwiid
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -184,6 +184,8 @@ in stdenv.mkDerivation rec {

  # Ensure youtube-dl is available in $PATH for mpv
  wrapperFlags =
+    ''--prefix LUA_CPATH ';' "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \'' +
+    ''--prefix LUA_PATH ';' "${luaEnv}/share/lua/${lua.luaversion}/?.lua" \'' +
    ''--prefix PATH : "${luaEnv}/bin" \''
  + optionalString youtubeSupport ''
      --prefix PATH : "${youtube-dl}/bin" \
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -36,6 +36,7 @@

 let
  inherit (stdenv.lib) optional optionals;
+
 in mkDerivation rec {
  pname = "obs-studio";
  version = "25.0.8";
@ -49,32 +50,37 @@ in mkDerivation rec {

  nativeBuildInputs = [ addOpenGLRunpath cmake pkgconfig ];

-  buildInputs = [ curl
-                  fdk_aac
-                  ffmpeg
-                  jansson
-                  libjack2
-                  libv4l
-                  libxkbcommon
-                  libpthreadstubs
-                  libXdmcp
-                  qtbase
-                  qtx11extras
-                  qtsvg
-                  speex
-                  x264
-                  vlc
-                  makeWrapper
-                  mbedtls
-                ]
-                ++ optionals scriptingSupport [ luajit swig python3 ]
-                ++ optional alsaSupport alsaLib
-                ++ optional pulseaudioSupport libpulseaudio;
+  buildInputs = [
+    curl
+    fdk_aac
+    ffmpeg
+    jansson
+    libjack2
+    libv4l
+    libxkbcommon
+    libpthreadstubs
+    libXdmcp
+    qtbase
+    qtx11extras
+    qtsvg
+    speex
+    x264
+    vlc
+    makeWrapper
+    mbedtls
+  ]
+  ++ optionals scriptingSupport [ luajit swig python3 ]
+  ++ optional alsaSupport alsaLib
+  ++ optional pulseaudioSupport libpulseaudio;

  # obs attempts to dlopen libobs-opengl, it fails unless we make sure
  # DL_OPENGL is an explicit path. Not sure if there's a better way
  # to handle this.
-  cmakeFlags = [ "-DCMAKE_CXX_FLAGS=-DDL_OPENGL=\\\"$(out)/lib/libobs-opengl.so\\\"" ];
+  cmakeFlags = [
+    "-DCMAKE_CXX_FLAGS=-DDL_OPENGL=\\\"$(out)/lib/libobs-opengl.so\\\""
+    "-DOBS_VERSION_OVERRIDE=${version}"
+    "-Wno-dev" # kill dev warnings that are useless for packaging
+  ];

  postInstall = ''
      wrapProgram $out/bin/obs \
--- a/pkgs/applications/video/smplayer/default.nix
+++ b/pkgs/applications/video/smplayer/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "smplayer";
-  version = "19.10.2";
+  version = "20.4.2";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "0i2c15yxk4by2zyjhb7n08larz9pmpa6zw383aybjxqh0nd9zv9p";
+    sha256 = "0kqdx6q2274gm83rycvdcglka60ymdk4iw2lc39iw7z1zgsv6ky3";
  };

  buildInputs = [ qtscript ];
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@ -4,6 +4,7 @@
 , glib
 , glibc
 , systemd
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -23,6 +24,8 @@ stdenv.mkDerivation rec {

  installFlags = [ "PREFIX=$(out)" ];

+  passthru.tests.podman = nixosTests.podman;
+
  meta = with stdenv.lib; {
    homepage = "https://github.com/containers/conmon";
    description = "An OCI container runtime monitor";
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@ -9,6 +9,7 @@
 , python3
 , systemd
 , yajl
+, nixosTests
 }:

 let
@ -62,6 +63,8 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  passthru.tests.podman = nixosTests.podman;
+
  meta = with lib; {
    description = "A fast and lightweight fully featured OCI runtime and C library for running containers";
    license = licenses.gpl2Plus;
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -197,9 +197,9 @@ rec {
  };

  docker_19_03 = makeOverridable dockerGen {
-    version = "19.03.8";
-    rev = "afacb8b7f0d8d4f9d2a8e8736e9c993e672b41f3";
-    sha256 = "15iq16rlnkw78lvapcfpbnsnxhdjbvfvgzg3xzxhpdg1dmq40b6j";
+    version = "19.03.9";
+    rev = "9d988398e765e4b97f27f93c4d04b272ac64c9c7";
+    sha256 = "0g2jpmqryfpvhdkapl8syi4hccx6czpihp1p1gsp1mfwz9aycsqv";
    runcRev = "dc9208a3303feef5b3839f4323d9beb36df0a9dd"; # v1.0.0-rc10
    runcSha256 = "0pi3rvj585997m4z9ljkxz2z9yxf9p2jr0pmqbqrc7bc95f5hagk";
    containerdRev = "7ad184331fa3e55e52b890ea95e65ba581ae3429"; # v1.2.13
--- a/pkgs/applications/virtualization/podman-compose/default.nix
+++ b/pkgs/applications/virtualization/podman-compose/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchPypi, podman, pyyaml }:
+{ lib, buildPythonApplication, fetchPypi, pyyaml }:

 buildPythonApplication rec {
  version = "0.1.5";
@ -9,13 +9,13 @@ buildPythonApplication rec {
    sha256 = "1sgbc889zq127qhxa9frhswa1mid19fs5qnyzfihx648y5i968pv";
  };

-  propagatedBuildInputs = [ pyyaml podman ];
+  propagatedBuildInputs = [ pyyaml ];

-  meta = with lib; {
+  meta = {
    description = "An implementation of docker-compose with podman backend";
    homepage = "https://github.com/containers/podman-compose";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ sikmir ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.sikmir ] ++ lib.teams.podman.members;
  };
 }
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -45,7 +45,7 @@ buildGoModule rec {
    patchShebangs .
    ${if stdenv.isDarwin
      then "make CGO_ENABLED=0 BUILDTAGS='remoteclient containers_image_openpgp exclude_graphdriver_devicemapper' varlink_generate all"
-      else "make binaries docs"}
+      else "make podman docs"}
  '';

  installPhase = ''
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@ -9,6 +9,7 @@
 , apparmor-parser
 , libseccomp
 , libselinux
+, nixosTests
 }:

 buildGoPackage rec {
@ -45,6 +46,8 @@ buildGoPackage rec {
    installManPage man/*/*.[1-9]
  '';

+  passthru.tests.podman = nixosTests.podman;
+
  meta = with lib; {
    homepage = "https://github.com/opencontainers/runc";
    description = "A CLI tool for spawning and running containers according to the OCI specification";
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -95,7 +95,7 @@ rec {
      sourceURL = "docker://${imageName}@${imageDigest}";
      destNameTag = "${finalImageName}:${finalImageTag}";
    } ''
-      skopeo --override-os ${os} --override-arch ${arch} copy "$sourceURL" "docker-archive://$out:$destNameTag"
+      skopeo --insecure-policy --tmpdir=$TMPDIR --override-os ${os} --override-arch ${arch} copy "$sourceURL" "docker-archive://$out:$destNameTag"
    '';

  # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
@ -392,14 +392,10 @@ rec {
        (cd layer; eval "$extraCommands")
      fi

-      # Tar up the layer and throw it into 'layer.tar'.
+      # Tar up the layer and throw it into 'layer.tar', while calculating its checksum.
      echo "Packing layer..."
      mkdir $out
-      tar --transform='s|^\./||' -C layer --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf $out/layer.tar .
-
-      # Compute a checksum of the tarball.
-      echo "Computing layer checksum..."
-      tarhash=$(tarsum < $out/layer.tar)
+      tarhash=$(tar --transform='s|^\./||' -C layer --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf - . | tee $out/layer.tar | tarsum)

      # Add a 'checksum' field to the JSON, with the value set to the
      # checksum of the tarball.
@ -449,11 +445,7 @@ rec {
      # Tar up the layer and throw it into 'layer.tar'.
      echo "Packing layer..."
      mkdir $out
-      tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf $out/layer.tar .
-
-      # Compute a checksum of the tarball.
-      echo "Computing layer checksum..."
-      tarhash=$(tarsum < $out/layer.tar)
+      tarhash=$(tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=${toString uid} --group=${toString gid} -cf - . | tee $out/layer.tar | tarsum)

      # Add a 'checksum' field to the JSON, with the value set to the
      # checksum of the tarball.
@ -537,11 +529,10 @@ rec {

        echo "Packing layer..."
        mkdir -p $out
-        tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" -cf $out/layer.tar .
+        tarhash=$(tar -C layer --hard-dereference --sort=name --mtime="@$SOURCE_DATE_EPOCH" -cf - . |
+                    tee $out/layer.tar |
+                    ${tarsum}/bin/tarsum)

-        # Compute the tar checksum and add it to the output json.
-        echo "Computing checksum..."
-        tarhash=$(${tarsum}/bin/tarsum < $out/layer.tar)
        cat ${baseJson} | jshon -s "$tarhash" -i checksum > $out/json
        # Indicate to docker that we're using schema version 1.0.
        echo -n "1.0" > $out/VERSION
--- a/pkgs/build-support/docker/nix-prefetch-docker
+++ b/pkgs/build-support/docker/nix-prefetch-docker
@ -12,6 +12,7 @@ finalImageTag=
 hashType=$NIX_HASH_ALGO
 hashFormat=$hashFormat
 format=nix
+skopeoCmd="skopeo --insecure-policy --tmpdir=$TMPDIR"

 usage(){
    echo  >&2 "syntax: nix-prefetch-docker [options] [IMAGE_NAME [IMAGE_TAG|IMAGE_DIGEST]]
@ -38,7 +39,7 @@ get_image_digest(){
        imageTag="latest"
    fi

-    skopeo inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
+    "$skopeoCmd" inspect "docker://$imageName:$imageTag" | jq '.Digest' -r
 }

 get_name() {
@ -127,9 +128,9 @@ trap "rm -rf \"$tmpPath\"" EXIT
 tmpFile="$tmpPath/$(get_name $finalImageName $finalImageTag)"

 if test -z "$QUIET"; then
-    skopeo --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag"
+    "$skopeoCmd" --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag"
 else
-    skopeo --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" > /dev/null
+    "$skopeoCmd" --override-os ${os} --override-arch ${arch} copy "$sourceUrl" "docker-archive://$tmpFile:$finalImageName:$finalImageTag" > /dev/null
 fi

 # Compute the hash.
--- a/pkgs/build-support/docker/store-path-to-layer.sh
+++ b/pkgs/build-support/docker/store-path-to-layer.sh
@ -11,39 +11,35 @@ echo "Creating layer #$layerNumber for $@"
 mkdir -p "$layerPath"

 # Make sure /nix and /nix/store appear first in the archive.
+#
 # We create the directories here and use them because
 # when there are other things being added to the
 # nix store, tar could fail, saying,
 # "tar: /nix/store: file changed as we read it"
 mkdir -p nix/store
-tar -cf "$layerPath/layer.tar"  \
-    --mtime="@$SOURCE_DATE_EPOCH" \
-    --owner=0 --group=0 \
-    --transform='s,nix,/nix,' \
-    nix

-# We change into the /nix/store in order to avoid a similar
-# "file changed as we read it" error as above. Namely,
-# if we use the absolute path of /nix/store/123-pkg
-# and something new is added to the nix store while tar
-# is running, it will detect a change to /nix/store and
-# fail. Instead, if we cd into the nix store and copy
-# the relative nix store path, tar will ignore changes
-# to /nix/store. In order to create the correct structure
-# in the tar file, we transform the relative nix store
-# path to the absolute store path.
-for storePath in "$@"; do
-  n=$(basename "$storePath")
-  tar -C /nix/store -rpf "$layerPath/layer.tar" \
+# Then we change into the /nix/store in order to
+# avoid a similar "file changed as we read it" error
+# as above. Namely, if we use the absolute path of
+# /nix/store/123-pkg and something new is added to the nix
+# store while tar is running, it will detect a change to
+# /nix/store and fail. Instead, if we cd into the nix store
+# and copy the relative nix store path, tar will ignore
+# changes to /nix/store. In order to create the correct
+# structure in the tar file, we transform the relative nix
+# store path to the absolute store path.
+tarhash=$(
+  basename -a "$@" |
+    tar -cp nix \
+      -C /nix/store --verbatim-files-from --files-from - \
      --hard-dereference --sort=name \
      --mtime="@$SOURCE_DATE_EPOCH" \
      --owner=0 --group=0 \
-      --transform="s,$n,/nix/store/$n," \
-      $n
-done
-
-# Compute a checksum of the tarball.
-tarhash=$(tarsum < $layerPath/layer.tar)
+      --transform 's,^nix(/|$),/nix/,' \
+      --transform 's,^[^/],/nix/store/\0,rS' |
+    tee "$layerPath/layer.tar" |
+    tarsum
+)

 # Add a 'checksum' field to the JSON, with the value set to the
 # checksum of the tarball.
--- a/Show more
+++ b/Show more