Merge master into staging-next

.github/PULL_REQUEST_TEMPLATE.md

@@ -17,7 +17,3 @@
 - [ ] Determined the impact on package closure size (by running `nix path-info -S` before and after)
 - [ ] Ensured that relevant documentation is up to date
 - [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
-
-###### Notify maintainers
-
-cc @

doc/contributing/submitting-changes.xml

@@ -13,7 +13,7 @@
    </listitem>
    <listitem>
     <para>
-     Fork the repository on GitHub.
+     Fork <link xlink:href="https://github.com/nixos/nixpkgs/">the Nixpkgs repository</link> on GitHub.
     </para>
    </listitem>
    <listitem>
@@ -22,15 +22,10 @@
      <itemizedlist>
       <listitem>
        <para>
-        You can make branch from a commit of your local <command>nixos-version</command>. That will help you to avoid additional local compilations. Because you will receive packages from binary cache.
+        You can make branch from a commit of your local <command>nixos-version</command>. That will help you to avoid additional local compilations. Because you will receive packages from binary cache. For example
-        <itemizedlist>
-         <listitem>
-          <para>
-           For example: <command>nixos-version</command> returns <command>15.05.git.0998212 (Dingo)</command>. So you can do:
-          </para>
-         </listitem>
-        </itemizedlist>
 <screen>
+<prompt>$ </prompt>nixos-version --hash
+0998212
 <prompt>$ </prompt>git checkout 0998212
 <prompt>$ </prompt>git checkout -b 'fix/pkg-name-update'
 </screen>
@@ -47,13 +42,11 @@
    <listitem>
     <para>
      Make commits of logical units.
-     <itemizedlist>
-      <listitem>
-       <para>
-        If you removed pkgs, made some major NixOS changes etc., write about them in <command>nixos/doc/manual/release-notes/rl-unstable.xml</command>.
     </para>
    </listitem>
-     </itemizedlist>
+   <listitem>
+    <para>
+     If you removed pkgs or made some major NixOS changes, write about it in the release notes for the next stable release. For example <command>nixos/doc/manual/release-notes/rl-2003.xml</command>.
     </para>
    </listitem>
    <listitem>
@@ -178,7 +171,7 @@ Additional information.
    </listitem>
    <listitem>
     <para>
-     Rebase you branch against current <command>master</command>.
+     <link xlink:href="https://git-scm.com/book/en/v2/Git-Branching-Rebasing">Rebase</link> your branch against current <command>master</command>.
     </para>
    </listitem>
   </itemizedlist>
@@ -194,36 +187,12 @@ Additional information.
    </listitem>
    <listitem>
     <para>
-     Create pull request:
+     Create the pull request
-     <itemizedlist>
-      <listitem>
-       <para>
-        Write the title in format <command>(pkg-name | nixos/&lt;module>): improvement</command>.
-        <itemizedlist>
-         <listitem>
-          <para>
-           If you update the pkg, write versions <command>from -> to</command>.
-          </para>
-         </listitem>
-        </itemizedlist>
     </para>
    </listitem>
    <listitem>
     <para>
-        Write in comment if you have tested your patch. Do not rely much on <command>TravisCI</command>.
+     Follow <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md#submitting-changes">the contribution guidelines</link>.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        If you make an improvement, write about your motivation.
-       </para>
-      </listitem>
-      <listitem>
-       <para>
-        Notify maintainers of the package. For example add to the message: <command>cc @jagajaga @domenkozar</command>.
-       </para>
-      </listitem>
-     </itemizedlist>
     </para>
    </listitem>
   </itemizedlist>

doc/languages-frameworks/haskell.section.md

@@ -84,37 +84,36 @@ nix-env -qaP -A nixos.haskellPackages
 nix-env -iA nixos.haskellPackages.cabal-install
 ```
 
-Our current default compiler is GHC 7.10.x and the `haskellPackages` set
+Our current default compiler is GHC 8.6.x and the `haskellPackages` set
-contains packages built with that particular version. Nixpkgs contains the
+contains packages built with that particular version. Nixpkgs contains the last
-latest major release of every GHC since 6.10.4, however, and there is a whole
+three major releases of GHC and there is a whole family of package sets
-family of package sets available that defines Hackage packages built with each
+available that defines Hackage packages built with each of those compilers,
-of those compilers, too:
+too:
 ```shell
-nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc6123
+nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc844
-nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc763
+nix-env -f "<nixpkgs>" -qaP -A haskell.packages.ghc882
 ```
 
 The name `haskellPackages` is really just a synonym for
-`haskell.packages.ghc7102`, because we prefer that package set internally and
+`haskell.packages.ghc865`, because we prefer that package set internally and
 recommend it to our users as their default choice, but ultimately you are free
 to compile your Haskell packages with any GHC version you please. The following
 command displays the complete list of available compilers:
 ```
 $ nix-env -f "<nixpkgs>" -qaP -A haskell.compiler
-haskell.compiler.ghc822                  ghc-8.2.2
+haskell.compiler.ghc8101                 ghc-8.10.0.20191210
-haskell.compiler.integer-simple.ghc822   ghc-8.2.2
+haskell.compiler.integer-simple.ghc8101  ghc-8.10.0.20191210
+haskell.compiler.ghcHEAD                 ghc-8.10.20191119
+haskell.compiler.integer-simple.ghcHEAD  ghc-8.10.20191119
 haskell.compiler.ghc822Binary            ghc-8.2.2-binary
 haskell.compiler.ghc844                  ghc-8.4.4
 haskell.compiler.ghc863Binary            ghc-8.6.3-binary
-haskell.compiler.ghc864                  ghc-8.6.4
-haskell.compiler.integer-simple.ghc864   ghc-8.6.4
 haskell.compiler.ghc865                  ghc-8.6.5
 haskell.compiler.integer-simple.ghc865   ghc-8.6.5
 haskell.compiler.ghc881                  ghc-8.8.1
 haskell.compiler.integer-simple.ghc881   ghc-8.8.1
-haskell.compiler.ghcHEAD                 ghc-8.9.20190601
+haskell.compiler.ghc882                  ghc-8.8.1.20191211
-haskell.compiler.integer-simple.ghcHEAD  ghc-8.9.20190601
+haskell.compiler.integer-simple.ghc882   ghc-8.8.1.20191211
-haskell.compiler.ghcjs84                 ghcjs-8.4.0.1
 haskell.compiler.ghcjs                   ghcjs-8.6.0.1
 ```
 

lib/default.nix

@@ -101,7 +101,7 @@ let
       cleanSource sourceByRegex sourceFilesBySuffices
       commitIdFromGitRepo cleanSourceWith pathHasContext
       canCleanSource;
-    inherit (modules) evalModules closeModules unifyModuleSyntax
+    inherit (modules) evalModules unifyModuleSyntax
       applyIfFunction mergeModules
       mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
       pushDownProperties dischargeProperties filterOverrides
@@ -110,7 +110,7 @@ let
       mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
       mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
       mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
-      mkAliasOptionModule doRename filterModules;
+      mkAliasOptionModule doRename;
     inherit (options) isOption mkEnableOption mkSinkUndeclaredOptions
       mergeDefaultOption mergeOneOption mergeEqualOption getValues
       getFiles optionAttrSetToDocList optionAttrSetToDocList'

lib/modules.nix

@@ -59,9 +59,12 @@ rec {
         };
       };
 
-      closed = closeModules (modules ++ [ internalModule ]) ({ inherit config options lib; } // specialArgs);
+      collected = collectModules
+        (specialArgs.modulesPath or "")
+        (modules ++ [ internalModule ])
+        ({ inherit config options lib; } // specialArgs);
 
-      options = mergeModules prefix (reverseList (filterModules (specialArgs.modulesPath or "") closed));
+      options = mergeModules prefix (reverseList collected);
 
       # Traverse options and extract the option values into the final
       # config set.  At the same time, check whether all option
@@ -87,31 +90,76 @@ rec {
       result = { inherit options config; };
     in result;
 
+  # collectModules :: (modulesPath: String) -> (modules: [ Module ]) -> (args: Attrs) -> [ Module ]
+  #
+  # Collects all modules recursively through `import` statements, filtering out
+  # all modules in disabledModules.
+  collectModules = let
 
- # Filter disabled modules. Modules can be disabled allowing
+      # Like unifyModuleSyntax, but also imports paths and calls functions if necessary
- # their implementation to be replaced.
+      loadModule = args: fallbackFile: fallbackKey: m:
- filterModules = modulesPath: modules:
+        if isFunction m || isAttrs m then
+          unifyModuleSyntax fallbackFile fallbackKey (applyIfFunction fallbackKey m args)
+        else unifyModuleSyntax (toString m) (toString m) (applyIfFunction (toString m) (import m) args);
+
+      /*
+      Collects all modules recursively into the form
+
+        {
+          disabled = [ <list of disabled modules> ];
+          # All modules of the main module list
+          modules = [
+            {
+              key = <key1>;
+              module = <module for key1>;
+              # All modules imported by the module for key1
+              modules = [
+                {
+                  key = <key1-1>;
+                  module = <module for key1-1>;
+                  # All modules imported by the module for key1-1
+                  modules = [ ... ];
+                }
+                ...
+              ];
+            }
+            ...
+          ];
+        }
+      */
+      collectStructuredModules =
+        let
+          collectResults = modules: {
+            disabled = concatLists (catAttrs "disabled" modules);
+            inherit modules;
+          };
+        in parentFile: parentKey: initialModules: args: collectResults (imap1 (n: x:
+          let
+            module = loadModule args parentFile "${parentKey}:anon-${toString n}" x;
+            collectedImports = collectStructuredModules module._file module.key module.imports args;
+          in {
+            key = module.key;
+            module = module;
+            modules = collectedImports.modules;
+            disabled = module.disabledModules ++ collectedImports.disabled;
+          }) initialModules);
+
+      # filterModules :: String -> { disabled, modules } -> [ Module ]
+      #
+      # Filters a structure as emitted by collectStructuredModules by removing all disabled
+      # modules recursively. It returns the final list of unique-by-key modules
+      filterModules = modulesPath: { disabled, modules }:
         let
           moduleKey = m: if isString m then toString modulesPath + "/" + m else toString m;
-     disabledKeys = map moduleKey (concatMap (m: m.disabledModules) modules);
+          disabledKeys = map moduleKey disabled;
-   in
+          keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
-     filter (m: !(elem m.key disabledKeys)) modules;
+        in map (attrs: attrs.module) (builtins.genericClosure {
+          startSet = keyFilter modules;
+          operator = attrs: keyFilter attrs.modules;
+        });
 
-  /* Close a set of modules under the ‘imports’ relation. */
+    in modulesPath: initialModules: args:
-  closeModules = modules: args:
+      filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
-    let
-      toClosureList = file: parentKey: imap1 (n: x:
-        if isAttrs x || isFunction x then
-          let key = "${parentKey}:anon-${toString n}"; in
-          unifyModuleSyntax file key (applyIfFunction key x args)
-        else
-          let file = toString x; key = toString x; in
-          unifyModuleSyntax file key (applyIfFunction key (import x) args));
-    in
-      builtins.genericClosure {
-        startSet = toClosureList unknownModule "" modules;
-        operator = m: toClosureList m._file m.key m.imports;
-      };
 
   /* Massage a module into canonical form, that is, a set consisting
      of ‘options’, ‘config’ and ‘imports’ attributes. */

lib/tests/modules.sh

@@ -12,7 +12,7 @@ evalConfig() {
     local attr=$1
     shift;
     local script="import ./default.nix { modules = [ $@ ];}"
-    nix-instantiate --timeout 1 -E "$script" -A "$attr" --eval-only --show-trace
+    nix-instantiate --timeout 1 -E "$script" -A "$attr" --eval-only --show-trace --read-write-mode
 }
 
 reportFailure() {
@@ -177,6 +177,15 @@ checkConfigOutput "true" config.submodule.outer ./declare-submoduleWith-modules.
 # Temporarily disabled until https://github.com/NixOS/nixpkgs/pull/76861
 #checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix
 
+# Check that disabledModules works recursively and correctly
+checkConfigOutput "true" config.enable ./disable-recursive/main.nix
+checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-foo.nix}
+checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-bar.nix}
+checkConfigError 'The option .* defined in .* does not exist' config.enable ./disable-recursive/{main.nix,disable-foo.nix,disable-bar.nix}
+
+# Check that imports can depend on derivations
+checkConfigOutput "true" config.enable ./import-from-store.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass

lib/tests/modules/disable-recursive/bar.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../declare-enable.nix
+  ];
+}

lib/tests/modules/disable-recursive/disable-bar.nix

@@ -0,0 +1,7 @@
+{
+
+  disabledModules = [
+    ./bar.nix
+  ];
+
+}

lib/tests/modules/disable-recursive/disable-foo.nix

@@ -0,0 +1,7 @@
+{
+
+  disabledModules = [
+    ./foo.nix
+  ];
+
+}

lib/tests/modules/disable-recursive/foo.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../declare-enable.nix
+  ];
+}

lib/tests/modules/disable-recursive/main.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./foo.nix
+    ./bar.nix
+  ];
+
+  enable = true;
+}

lib/tests/modules/import-from-store.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+let
+  drv = derivation {
+    name = "derivation";
+    system = builtins.currentSystem;
+    builder = "/bin/sh";
+    args = [ "-c" "echo {} > $out" ];
+  };
+in {
+
+  imports = [
+    "${drv}"
+    ./declare-enable.nix
+    ./define-enable.nix
+  ];
+
+}

maintainers/maintainer-list.nix

@@ -4592,6 +4592,12 @@
     githubId = 3958340;
     name = "Eshin Kunishima";
   };
+  mildlyincompetent = {
+    email = "nix@kch.dev";
+    github = "mildlyincompetent";
+    githubId = 19479662;
+    name = "Kajetan Champlewski";
+  };
   miltador = {
     email = "miltador@yandex.ua";
     name = "Vasiliy Solovey";
@@ -6859,6 +6865,11 @@
     githubId = 863327;
     name = "Tyler Benster";
   };
+  tckmn = {
+    email = "andy@tck.mn";
+    github = "tckmn";
+    name = "Andy Tockman";
+  };
   teh = {
     email = "tehunger@gmail.com";
     github = "teh";

nixos/doc/manual/development/replace-modules.xml

@@ -6,8 +6,8 @@
  <title>Replace Modules</title>
 
  <para>
-  Modules that are imported can also be disabled. The option declarations and
+  Modules that are imported can also be disabled. The option declarations,
-  config implementation of a disabled module will be ignored, allowing another
+  config implementation and the imports of a disabled module will be ignored, allowing another
   to take it's place. This can be used to import a set of modules from another
   channel while keeping the rest of the system on a stable release.
  </para>

nixos/maintainers/scripts/azure/create-azure.sh

@@ -1,6 +1,6 @@
-#! /bin/sh -e
+#! /bin/sh -eu
 
-export NIX_PATH=nixpkgs=../../../..
+export NIX_PATH=nixpkgs=$(dirname $(readlink -f $0))/../../../..
 export NIXOS_CONFIG=$(dirname $(readlink -f $0))/../../../modules/virtualisation/azure-image.nix
 export TIMESTAMP=$(date +%Y%m%d%H%M)
 

nixos/modules/misc/documentation.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, baseModules, extraModules, modules, ... }:
+{ config, lib, pkgs, baseModules, extraModules, modules, modulesPath, ... }:
 
 with lib;
 
@@ -22,7 +22,10 @@ let
         scrubbedEval = evalModules {
           modules = [ { nixpkgs.localSystem = config.nixpkgs.localSystem; } ] ++ manualModules;
           args = (config._module.args) // { modules = [ ]; };
-          specialArgs = { pkgs = scrubDerivations "pkgs" pkgs; };
+          specialArgs = {
+            pkgs = scrubDerivations "pkgs" pkgs;
+            inherit modulesPath;
+          };
         };
         scrubDerivations = namePrefix: pkgSet: mapAttrs
           (name: value:

nixos/modules/module-list.nix

@@ -806,6 +806,7 @@
   ./services/web-apps/gotify-server.nix
   ./services/web-apps/icingaweb2/icingaweb2.nix
   ./services/web-apps/icingaweb2/module-monitoring.nix
+  ./services/web-apps/ihatemoney
   ./services/web-apps/limesurvey.nix
   ./services/web-apps/mattermost.nix
   ./services/web-apps/mediawiki.nix

nixos/modules/programs/screen.nix

@@ -27,6 +27,7 @@ in
     environment.etc.screenrc.text = cfg.screenrc;
 
     environment.systemPackages = [ pkgs.screen ];
+    security.pam.services.screen = {};
   };
 
 }

nixos/modules/security/pam.nix

@@ -776,11 +776,8 @@ in
           '';
 
         # Most of these should be moved to specific modules.
-        cups = {};
-        ftp = {};
         i3lock = {};
         i3lock-color = {};
-        screen = {};
         vlock = {};
         xlock = {};
         xscreensaver = {};

nixos/modules/services/databases/mysql.nix

@@ -320,6 +320,8 @@ in
           Type = if hasNotify then "notify" else "simple";
           RuntimeDirectory = "mysqld";
           RuntimeDirectoryMode = "0755";
+          Restart = "on-abort";
+          RestartSec = "5s";
           # The last two environment variables are used for starting Galera clusters
           ExecStart = "${mysql}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION";
           ExecStartPost =

nixos/modules/services/misc/home-assistant.nix

@@ -11,6 +11,9 @@ let
     (recursiveUpdate defaultConfig cfg.config) else cfg.config));
   configFile = pkgs.runCommand "configuration.yaml" { preferLocalBuild = true; } ''
     ${pkgs.remarshal}/bin/json2yaml -i ${configJSON} -o $out
+    # Hack to support secrets, that are encoded as custom yaml objects,
+    # https://www.home-assistant.io/docs/configuration/secrets/
+    sed -i -e "s/'\!secret \(.*\)'/\!secret \1/" $out
   '';
 
   lovelaceConfigJSON = pkgs.writeText "ui-lovelace.json"
@@ -98,6 +101,10 @@ in {
         {
           homeassistant = {
             name = "Home";
+            latitude = "!secret latitude";
+            longitude = "!secret longitude";
+            elevation = "!secret elevation";
+            unit_system = "metric";
             time_zone = "UTC";
           };
           frontend = { };
@@ -108,6 +115,8 @@ in {
       description = ''
         Your <filename>configuration.yaml</filename> as a Nix attribute set.
         Beware that setting this option will delete your previous <filename>configuration.yaml</filename>.
+        <link xlink:href="https://www.home-assistant.io/docs/configuration/secrets/">Secrets</link>
+        are encoded as strings as shown in the example.
       '';
     };
 

nixos/modules/services/misc/matrix-synapse.nix

@@ -657,8 +657,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    users.users.matrix-synapse =
+    users.users.matrix-synapse = { 
-      { name = "";
         group = "matrix-synapse";
         home = cfg.dataDir;
         createHome = true;

nixos/modules/services/networking/gnunet.nix

@@ -42,6 +42,7 @@ in
     services.gnunet = {
 
       enable = mkOption {
+        type = types.bool;
         default = false;
         description = ''
           Whether to run the GNUnet daemon.  GNUnet is GNU's anonymous
@@ -51,6 +52,7 @@ in
 
       fileSharing = {
         quota = mkOption {
+          type = types.int;
           default = 1024;
           description = ''
             Maximum file system usage (in MiB) for file sharing.
@@ -60,6 +62,7 @@ in
 
       udp = {
         port = mkOption {
+          type = types.port;
           default = 2086;  # assigned by IANA
           description = ''
             The UDP port for use by GNUnet.
@@ -69,6 +72,7 @@ in
 
       tcp = {
         port = mkOption {
+          type = types.port;
           default = 2086;  # assigned by IANA
           description = ''
             The TCP port for use by GNUnet.
@@ -78,6 +82,7 @@ in
 
       load = {
         maxNetDownBandwidth = mkOption {
+          type = types.int;
           default = 50000;
           description = ''
             Maximum bandwidth usage (in bits per second) for GNUnet
@@ -86,6 +91,7 @@ in
         };
 
         maxNetUpBandwidth = mkOption {
+          type = types.int;
           default = 50000;
           description = ''
             Maximum bandwidth usage (in bits per second) for GNUnet
@@ -94,6 +100,7 @@ in
         };
 
         hardNetUpBandwidth = mkOption {
+          type = types.int;
           default = 0;
           description = ''
             Hard bandwidth limit (in bits per second) when uploading
@@ -111,6 +118,7 @@ in
       };
 
       extraOptions = mkOption {
+        type = types.lines;
         default = "";
         description = ''
           Additional options that will be copied verbatim in `gnunet.conf'.

nixos/modules/services/networking/mxisd.nix

@@ -104,7 +104,6 @@ in {
 
     users.groups.mxisd =
       {
-        name = "";
         gid = config.ids.gids.mxisd;
       };
 

nixos/modules/services/security/torify.nix

@@ -25,6 +25,7 @@ in
     services.tor.tsocks = {
 
       enable = mkOption {
+        type = types.bool;
         default = false;
         description = ''
           Whether to build tsocks wrapper script to relay application traffic via Tor.
@@ -40,6 +41,7 @@ in
       };
 
       server = mkOption {
+        type = types.str;
         default = "localhost:9050";
         example = "192.168.0.20";
         description = ''
@@ -48,6 +50,7 @@ in
       };
 
       config = mkOption {
+        type = types.lines;
         default = "";
         description = ''
           Extra configuration. Contents will be added verbatim to TSocks

nixos/modules/services/web-apps/ihatemoney/default.nix

@@ -0,0 +1,141 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  cfg = config.services.ihatemoney;
+  user = "ihatemoney";
+  group = "ihatemoney";
+  db = "ihatemoney";
+  python3 = config.services.uwsgi.package.python3;
+  pkg = python3.pkgs.ihatemoney;
+  toBool = x: if x then "True" else "False";
+  configFile = pkgs.writeText "ihatemoney.cfg" ''
+        from secrets import token_hex
+        # load a persistent secret key
+        SECRET_KEY_FILE = "/var/lib/ihatemoney/secret_key"
+        SECRET_KEY = ""
+        try:
+          with open(SECRET_KEY_FILE) as f:
+            SECRET_KEY = f.read()
+        except FileNotFoundError:
+          pass
+        if not SECRET_KEY:
+          print("ihatemoney: generating a new secret key")
+          SECRET_KEY = token_hex(50)
+          with open(SECRET_KEY_FILE, "w") as f:
+            f.write(SECRET_KEY)
+        del token_hex
+        del SECRET_KEY_FILE
+
+        # "normal" configuration
+        DEBUG = False
+        SQLALCHEMY_DATABASE_URI = '${
+          if cfg.backend == "sqlite"
+          then "sqlite:////var/lib/ihatemoney/ihatemoney.sqlite"
+          else "postgresql:///${db}"}'
+        SQLALCHEMY_TRACK_MODIFICATIONS = False
+        MAIL_DEFAULT_SENDER = ("${cfg.defaultSender.name}", "${cfg.defaultSender.email}")
+        ACTIVATE_DEMO_PROJECT = ${toBool cfg.enableDemoProject}
+        ADMIN_PASSWORD = "${toString cfg.adminHashedPassword /*toString null == ""*/}"
+        ALLOW_PUBLIC_PROJECT_CREATION = ${toBool cfg.enablePublicProjectCreation}
+        ACTIVATE_ADMIN_DASHBOARD = ${toBool cfg.enableAdminDashboard}
+
+        ${cfg.extraConfig}
+  '';
+in
+  {
+    options.services.ihatemoney = {
+      enable = mkEnableOption "ihatemoney webapp. Note that this will set uwsgi to emperor mode running as root";
+      backend = mkOption {
+        type = types.enum [ "sqlite" "postgresql" ];
+        default = "sqlite";
+        description = ''
+          The database engine to use for ihatemoney.
+          If <literal>postgresql</literal> is selected, then a database called
+          <literal>${db}</literal> will be created. If you disable this option,
+          it will however not be removed.
+        '';
+      };
+      adminHashedPassword = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "The hashed password of the administrator. To obtain it, run <literal>ihatemoney generate_password_hash</literal>";
+      };
+      uwsgiConfig = mkOption {
+        type = types.attrs;
+        example = {
+          http = ":8000";
+        };
+        description = "Additionnal configuration of the UWSGI vassal running ihatemoney. It should notably specify on which interfaces and ports the vassal should listen.";
+      };
+      defaultSender = {
+        name = mkOption {
+          type = types.str;
+          default = "Budget manager";
+          description = "The display name of the sender of ihatemoney emails";
+        };
+        email = mkOption {
+          type = types.str;
+          default = "ihatemoney@${config.networking.hostName}";
+          description = "The email of the sender of ihatemoney emails";
+        };
+      };
+      enableDemoProject = mkEnableOption "access to the demo project in ihatemoney";
+      enablePublicProjectCreation = mkEnableOption "permission to create projects in ihatemoney by anyone";
+      enableAdminDashboard = mkEnableOption "ihatemoney admin dashboard";
+      extraConfig = mkOption {
+        type = types.str;
+        default = "";
+        description = "Extra configuration appended to ihatemoney's configuration file. It is a python file, so pay attention to indentation.";
+      };
+    };
+    config = mkIf cfg.enable {
+      services.postgresql = mkIf (cfg.backend == "postgresql") {
+        enable = true;
+        ensureDatabases = [ db ];
+        ensureUsers = [ {
+          name = user;
+          ensurePermissions = {
+            "DATABASE ${db}" = "ALL PRIVILEGES";
+          };
+        } ];
+      };
+      systemd.services.postgresql = mkIf (cfg.backend == "postgresql") {
+        wantedBy = [ "uwsgi.service" ];
+        before = [ "uwsgi.service" ];
+      };
+      systemd.tmpfiles.rules = [
+        "d /var/lib/ihatemoney 770 ${user} ${group}"
+      ];
+      users = {
+        users.${user} = {
+          isSystemUser = true;
+          inherit group;
+        };
+        groups.${group} = {};
+      };
+      services.uwsgi = {
+        enable = true;
+        plugins = [ "python3" ];
+        # the vassal needs to be able to setuid
+        user = "root";
+        group = "root";
+        instance = {
+          type = "emperor";
+          vassals.ihatemoney = {
+            type = "normal";
+            strict = true;
+            uid = user;
+            gid = group;
+            # apparently flask uses threads: https://github.com/spiral-project/ihatemoney/commit/c7815e48781b6d3a457eaff1808d179402558f8c
+            enable-threads = true;
+            module = "wsgi:application";
+            chdir = "${pkg}/${pkg.pythonModule.sitePackages}/ihatemoney";
+            env = [ "IHATEMONEY_SETTINGS_FILE_PATH=${configFile}" ];
+            pythonPackages = self: [ self.ihatemoney ];
+          } // cfg.uwsgiConfig;
+        };
+      };
+    };
+  }
+
+

nixos/modules/services/web-servers/uwsgi.nix

@@ -5,10 +5,6 @@ with lib;
 let
   cfg = config.services.uwsgi;
 
-  uwsgi = pkgs.uwsgi.override {
-    plugins = cfg.plugins;
-  };
-
   buildCfg = name: c:
     let
       plugins =
@@ -23,8 +19,8 @@ let
       python =
         if hasPython2 && hasPython3 then
           throw "`plugins` attribute in UWSGI configuration shouldn't contain both python2 and python3"
-        else if hasPython2 then uwsgi.python2
+        else if hasPython2 then cfg.package.python2
-        else if hasPython3 then uwsgi.python3
+        else if hasPython3 then cfg.package.python3
         else null;
 
       pythonEnv = python.withPackages (c.pythonPackages or (self: []));
@@ -77,6 +73,11 @@ in {
         description = "Where uWSGI communication sockets can live";
       };
 
+      package = mkOption {
+        type = types.package;
+        internal = true;
+      };
+
       instance = mkOption {
         type = types.attrs;
         default = {
@@ -138,7 +139,7 @@ in {
       '';
       serviceConfig = {
         Type = "notify";
-        ExecStart = "${uwsgi}/bin/uwsgi --uid ${cfg.user} --gid ${cfg.group} --json ${buildCfg "server" cfg.instance}/server.json";
+        ExecStart = "${cfg.package}/bin/uwsgi --uid ${cfg.user} --gid ${cfg.group} --json ${buildCfg "server" cfg.instance}/server.json";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
         NotifyAccess = "main";
@@ -156,5 +157,9 @@ in {
     users.groups = optionalAttrs (cfg.group == "uwsgi") {
       uwsgi.gid = config.ids.gids.uwsgi;
     };
+
+    services.uwsgi.package = pkgs.uwsgi.override {
+      inherit (cfg) plugins;
+    };
   };
 }

nixos/modules/services/x11/display-managers/gdm.nix

@@ -171,7 +171,7 @@ in
       "L+ /run/gdm/.config/pulse - - - - ${pulseConfig}"
     ] ++ optionals config.services.gnome3.gnome-initial-setup.enable [
       # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
-      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm yes"
+      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm - yes"
     ];
 
     systemd.services.display-manager.wants = [

nixos/tests/all-tests.nix

@@ -122,6 +122,7 @@ in
   i3wm = handleTest ./i3wm.nix {};
   icingaweb2 = handleTest ./icingaweb2.nix {};
   iftop = handleTest ./iftop.nix {};
+  ihatemoney = handleTest ./ihatemoney.nix {};
   incron = handleTest ./incron.nix {};
   influxdb = handleTest ./influxdb.nix {};
   initrd-network-ssh = handleTest ./initrd-network-ssh {};

nixos/tests/ceph-multi-node.nix

@@ -19,6 +19,12 @@ let
       key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
       uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
     };
+    osd2 = {
+      name = "2";
+      ip = "192.168.1.4";
+      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
+      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
+    };
   };
   generateCephConfig = { daemonConfig }: {
     enable = true;
@@ -72,35 +78,20 @@ let
     };
   }; };
 
-  networkOsd0 = {
+  networkOsd = osd: {
     dhcpcd.enable = false;
     interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-      { address = cfg.osd0.ip; prefixLength = 24; }
+      { address = osd.ip; prefixLength = 24; }
     ];
     firewall = {
       allowedTCPPortRanges = [ { from = 6800; to = 7300; } ];
     };
   };
-  cephConfigOsd0 = generateCephConfig { daemonConfig = {
-    osd = {
-      enable = true;
-      daemons = [ cfg.osd0.name ];
-    };
-  }; };
 
-  networkOsd1 = {
+  cephConfigOsd = osd: generateCephConfig { daemonConfig = {
-    dhcpcd.enable = false;
-    interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
-      { address = cfg.osd1.ip; prefixLength = 24; }
-    ];
-    firewall = {
-      allowedTCPPortRanges = [ { from = 6800; to = 7300; } ];
-    };
-  };
-  cephConfigOsd1 = generateCephConfig { daemonConfig = {
     osd = {
       enable = true;
-      daemons = [ cfg.osd1.name ];
+      daemons = [ osd.name ];
     };
   }; };
 
@@ -114,6 +105,7 @@ let
     monA.wait_for_unit("network.target")
     osd0.wait_for_unit("network.target")
     osd1.wait_for_unit("network.target")
+    osd2.wait_for_unit("network.target")
 
     # Bootstrap ceph-mon daemon
     monA.succeed(
@@ -145,8 +137,9 @@ let
     monA.succeed("cp /etc/ceph/ceph.client.admin.keyring /tmp/shared")
     osd0.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
     osd1.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
+    osd2.succeed("cp /tmp/shared/ceph.client.admin.keyring /etc/ceph")
 
-    # Bootstrap both OSDs
+    # Bootstrap OSDs
     osd0.succeed(
         "mkfs.xfs /dev/vdb",
         "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
@@ -161,6 +154,13 @@ let
         "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
         'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
     )
+    osd2.succeed(
+        "mkfs.xfs /dev/vdb",
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
+        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
+    )
 
     # Initialize the OSDs with regular filestore
     osd0.succeed(
@@ -173,7 +173,12 @@ let
         "chown -R ceph:ceph /var/lib/ceph/osd",
         "systemctl start ceph-osd-${cfg.osd1.name}",
     )
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    osd2.succeed(
+        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
+        "chown -R ceph:ceph /var/lib/ceph/osd",
+        "systemctl start ceph-osd-${cfg.osd2.name}",
+    )
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
@@ -196,16 +201,18 @@ let
     monA.crash()
     osd0.crash()
     osd1.crash()
+    osd2.crash()
 
     # Start it up
     osd0.start()
     osd1.start()
+    osd2.start()
     monA.start()
 
     # Ensure the cluster comes back up again
     monA.succeed("ceph -s | grep 'mon: 1 daemons'")
     monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
   '';
@@ -217,8 +224,9 @@ in {
 
   nodes = {
     monA = generateHost { pkgs = pkgs; cephConfig = cephConfigMonA; networkConfig = networkMonA; };
-    osd0 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd0; networkConfig = networkOsd0; };
+    osd0 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd cfg.osd0; networkConfig = networkOsd cfg.osd0; };
-    osd1 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd1; networkConfig = networkOsd1; };
+    osd1 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd cfg.osd1; networkConfig = networkOsd cfg.osd1; };
+    osd2 = generateHost { pkgs = pkgs; cephConfig = cephConfigOsd cfg.osd2; networkConfig = networkOsd cfg.osd2; };
   };
 
   testScript = testscript;

nixos/tests/ceph-single-node.nix

@@ -17,6 +17,11 @@ let
       key = "AQBEEJNac00kExAAXEgy943BGyOpVH1LLlHafQ==";
       uuid = "5e97a838-85b6-43b0-8950-cb56d554d1e5";
     };
+    osd2 = {
+      name = "2";
+      key = "AQAdyhZeIaUlARAAGRoidDAmS6Vkp546UFEf5w==";
+      uuid = "ea999274-13d0-4dd5-9af9-ad25a324f72f";
+    };
   };
   generateCephConfig = { daemonConfig }: {
     enable = true;
@@ -30,7 +35,7 @@ let
   generateHost = { pkgs, cephConfig, networkConfig, ... }: {
     virtualisation = {
       memorySize = 512;
-      emptyDiskImages = [ 20480 20480 ];
+      emptyDiskImages = [ 20480 20480 20480 ];
       vlans = [ 1 ];
     };
 
@@ -65,7 +70,7 @@ let
     };
     osd = {
       enable = true;
-      daemons = [ cfg.osd0.name cfg.osd1.name ];
+      daemons = [ cfg.osd0.name cfg.osd1.name cfg.osd2.name ];
     };
   }; };
 
@@ -104,29 +109,36 @@ let
     monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
 
-    # Bootstrap both OSDs
+    # Bootstrap OSDs
     monA.succeed(
         "mkfs.xfs /dev/vdb",
         "mkfs.xfs /dev/vdc",
+        "mkfs.xfs /dev/vdd",
         "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
         "mount /dev/vdb /var/lib/ceph/osd/ceph-${cfg.osd0.name}",
         "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
         "mount /dev/vdc /var/lib/ceph/osd/ceph-${cfg.osd1.name}",
+        "mkdir -p /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
+        "mount /dev/vdd /var/lib/ceph/osd/ceph-${cfg.osd2.name}",
         "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd0.name}/keyring --name osd.${cfg.osd0.name} --add-key ${cfg.osd0.key}",
         "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd1.name}/keyring --name osd.${cfg.osd1.name} --add-key ${cfg.osd1.key}",
+        "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-${cfg.osd2.name}/keyring --name osd.${cfg.osd2.name} --add-key ${cfg.osd2.key}",
         'echo \'{"cephx_secret": "${cfg.osd0.key}"}\' | ceph osd new ${cfg.osd0.uuid} -i -',
         'echo \'{"cephx_secret": "${cfg.osd1.key}"}\' | ceph osd new ${cfg.osd1.uuid} -i -',
+        'echo \'{"cephx_secret": "${cfg.osd2.key}"}\' | ceph osd new ${cfg.osd2.uuid} -i -',
     )
 
     # Initialize the OSDs with regular filestore
     monA.succeed(
         "ceph-osd -i ${cfg.osd0.name} --mkfs --osd-uuid ${cfg.osd0.uuid}",
         "ceph-osd -i ${cfg.osd1.name} --mkfs --osd-uuid ${cfg.osd1.uuid}",
+        "ceph-osd -i ${cfg.osd2.name} --mkfs --osd-uuid ${cfg.osd2.uuid}",
         "chown -R ceph:ceph /var/lib/ceph/osd",
         "systemctl start ceph-osd-${cfg.osd0.name}",
         "systemctl start ceph-osd-${cfg.osd1.name}",
+        "systemctl start ceph-osd-${cfg.osd2.name}",
     )
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
@@ -161,11 +173,12 @@ let
     monA.wait_for_unit("ceph-mgr-${cfg.monA.name}")
     monA.wait_for_unit("ceph-osd-${cfg.osd0.name}")
     monA.wait_for_unit("ceph-osd-${cfg.osd1.name}")
+    monA.wait_for_unit("ceph-osd-${cfg.osd2.name}")
 
     # Ensure the cluster comes back up again
     monA.succeed("ceph -s | grep 'mon: 1 daemons'")
     monA.wait_until_succeeds("ceph -s | grep 'quorum ${cfg.monA.name}'")
-    monA.wait_until_succeeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'")
+    monA.wait_until_succeeds("ceph osd stat | grep -e '3 osds: 3 up[^,]*, 3 in'")
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
   '';

nixos/tests/home-assistant.nix

@@ -1,11 +1,10 @@
-import ./make-test.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:
 
 let
   configDir = "/var/lib/foobar";
   apiPassword = "some_secret";
   mqttPassword = "another_secret";
   hassCli = "hass-cli --server http://hass:8123 --password '${apiPassword}'";
-
 in {
   name = "home-assistant";
   meta = with pkgs.stdenv.lib; {
@@ -69,36 +68,44 @@ in {
   };
 
   testScript = ''
-    startAll;
+    start_all()
-    $hass->waitForUnit("home-assistant.service");
+    hass.wait_for_unit("home-assistant.service")
+    with subtest("Check that YAML configuration file is in place"):
+        hass.succeed("test -L ${configDir}/configuration.yaml")
+    with subtest("lovelace config is copied because lovelaceConfigWritable = true"):
+        hass.succeed("test -f ${configDir}/ui-lovelace.yaml")
+    with subtest("Check that Home Assistant's web interface and API can be reached"):
+        hass.wait_for_open_port(8123)
+        hass.succeed("curl --fail http://localhost:8123/states")
+        assert "API running" in hass.succeed(
+            "curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/"
+        )
+    with subtest("Toggle a binary sensor using MQTT"):
+        assert '"state": "off"' in hass.succeed(
+            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
+        )
+        hass.wait_until_succeeds(
+            "mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light"
+        )
+        assert '"state": "on"' in hass.succeed(
+            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
+        )
+    with subtest("Toggle a binary sensor using hass-cli"):
+        assert '"state": "on"' in hass.succeed(
+            "${hassCli} --output json state get binary_sensor.mqtt_binary_sensor"
+        )
+        hass.succeed(
+            "${hassCli} state edit binary_sensor.mqtt_binary_sensor --json='{\"state\": \"off\"}'"
+        )
+        assert '"state": "off"' in hass.succeed(
+            "curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}'"
+        )
+    with subtest("Print log to ease debugging"):
+        output_log = hass.succeed("cat ${configDir}/home-assistant.log")
+        print("\n### home-assistant.log ###\n")
+        print(output_log + "\n")
 
-    # The config is specified using a Nix attribute set,
+    with subtest("Check that no errors were logged"):
-    # converted from JSON to YAML, and linked to the config dir
+        assert "ERROR" not in output_log
-    $hass->succeed("test -L ${configDir}/configuration.yaml");
-    # The lovelace config is copied because lovelaceConfigWritable = true
-    $hass->succeed("test -f ${configDir}/ui-lovelace.yaml");
-
-    # Check that Home Assistant's web interface and API can be reached
-    $hass->waitForOpenPort(8123);
-    $hass->succeed("curl --fail http://localhost:8123/states");
-    $hass->succeed("curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/ | grep -qF 'API running'");
-
-    # Toggle a binary sensor using MQTT
-    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"off\"'");
-    $hass->waitUntilSucceeds("mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light");
-    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"on\"'");
-
-    # Toggle a binary sensor using hass-cli
-    $hass->succeed("${hassCli} --output json state get binary_sensor.mqtt_binary_sensor | grep -qF '\"state\": \"on\"'");
-    $hass->succeed("${hassCli} state edit binary_sensor.mqtt_binary_sensor --json='{\"state\": \"off\"}'");
-    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"off\"'");
-
-    # Print log to ease debugging
-    my $log = $hass->succeed("cat ${configDir}/home-assistant.log");
-    print "\n### home-assistant.log ###\n";
-    print "$log\n";
-
-    # Check that no errors were logged
-    $hass->fail("cat ${configDir}/home-assistant.log | grep -qF ERROR");
   '';
 })

nixos/tests/ihatemoney.nix

@@ -0,0 +1,52 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+let
+  inherit (import ../lib/testing.nix { inherit system pkgs; }) makeTest;
+in
+map (
+  backend: makeTest {
+    name = "ihatemoney-${backend}";
+    machine = { lib, ... }: {
+      services.ihatemoney = {
+        enable = true;
+        enablePublicProjectCreation = true;
+        inherit backend;
+        uwsgiConfig = {
+          http = ":8000";
+        };
+      };
+      boot.cleanTmpDir = true;
+      # ihatemoney needs a local smtp server otherwise project creation just crashes
+      services.opensmtpd = {
+        enable = true;
+        serverConfiguration = ''
+          listen on lo
+          action foo relay
+          match from any for any action foo
+        '';
+      };
+    };
+    testScript = ''
+      $machine->waitForOpenPort(8000);
+      $machine->waitForUnit("uwsgi.service");
+      my $return = $machine->succeed("curl -X POST http://localhost:8000/api/projects -d 'name=yay&id=yay&password=yay&contact_email=yay\@example.com'");
+      die "wrong project id $return" unless "\"yay\"\n" eq $return;
+      my $timestamp = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
+      my $owner = $machine->succeed("stat --printf %U:%G /var/lib/ihatemoney/secret_key");
+      die "wrong ownership for the secret key: $owner, is uwsgi running as the right user ?" unless $owner eq "ihatemoney:ihatemoney";
+      $machine->shutdown();
+      $machine->start();
+      $machine->waitForOpenPort(8000);
+      $machine->waitForUnit("uwsgi.service");
+      # check that the database is really persistent
+      print $machine->succeed("curl --basic -u yay:yay http://localhost:8000/api/projects/yay");
+      # check that the secret key is really persistent
+      my $timestamp2 = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
+      die unless $timestamp eq $timestamp2;
+      $machine->succeed("curl http://localhost:8000 | grep ihatemoney");
+    '';
+  }
+) [ "sqlite" "postgresql" ]

pkgs/applications/audio/kid3/default.nix

@@ -9,11 +9,11 @@
 stdenv.mkDerivation rec {
 
   pname = "kid3";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/kid3/kid3/${version}/${pname}-${version}.tar.gz";
-    sha256 = "1a6ixkkdp1fl3arylx06w73mwf26i0ibyplwwcn2kw5xsfxmbjp6";
+    sha256 = "1d2lr500dx7gnxw2vrvpbhadpn313ly3zyp178864z26dnfkjv8x";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];

pkgs/applications/audio/qmidinet/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, qt5, alsaLib, libjack2 }:
 
 stdenv.mkDerivation rec {
-  version = "0.6.0";
+  version = "0.6.1";
   pname = "qmidinet";
 
   src = fetchurl {
     url = "mirror://sourceforge/qmidinet/${pname}-${version}.tar.gz";
-    sha256 = "07hgk3a8crx262rm1fzggqarz8f1ml910vwgd32mbvlarws5cv0n";
+    sha256 = "1nvbvx3wg2s6s7r4x6m2pm9nx7pdz00ghw9h10wfqi2s474mwip0";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/audio/qsynth/default.nix

@@ -4,11 +4,11 @@
 
 mkDerivation  rec {
   pname = "qsynth";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/qsynth/${pname}-${version}.tar.gz";
-    sha256 = "173v0jqybi5szxxvj4n6wyg9sj54rmm6pxwhynx8wkm7nsbh0aij";
+    sha256 = "12jhfan81a10vbqfky5nmam3lk6d0i4654mm192v68q5r867xmcl";
   };
 
   nativeBuildInputs = [ autoconf pkgconfig ];

pkgs/applications/audio/setbfree/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation  rec {
   pname = "setbfree";
-  version = "0.8.10";
+  version = "0.8.11";
 
   src = fetchzip {
     url = "https://github.com/pantherb/setBfree/archive/v${version}.tar.gz";
-    sha256 = "1hpj8qb5mhkqm4yy8mzzrrq0ljw22y807qly90vjkg61ascyina4";
+    sha256 = "0c2wc8nkrzsy0yic4y7hjz320m3d20r8152j9dk8nsnmgjmyr2ir";
   };
 
   postPatch = ''

pkgs/applications/editors/glow/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "glow";
-  version = "0.1.6";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "glow";
     rev = "v${version}";
-    sha256 = "0q35napi1aa6dfrqz26hvhzijymb9sxsf3mrrn1mh7ssgkhvmqqc";
+    sha256 = "0vhl8d7xxqqyl916nh8sgm1xdaf7xlc3r18464bd2av22q9yz68n";
   };
 
-  modSha256 = "07imn9p0s79x1h45dk05hjcm6946d84j6k5pnljqrz4zk64hy26c";
+  modSha256 = "0r0yq7kgz7i1wf4gxxihdrn1c8mi4wcyhadncxbln24s9c5apxsf";
 
   buildFlagsArray = [ "-ldflags=" "-X=main.Version=${version}" ];
 

pkgs/applications/graphics/imv/default.nix

@@ -2,18 +2,18 @@
 , freeimage, fontconfig, pkgconfig
 , asciidoc, docbook_xsl, libxslt, cmocka
 , librsvg, pango, libxkbcommon, wayland
-, libGLU
+, libGLU, icu
 }:
 
 stdenv.mkDerivation rec {
   pname = "imv";
-  version = "4.0.1";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner  = "eXeC64";
     repo   = "imv";
     rev    = "v${version}";
-    sha256 = "sha256:01fbkbwwsyr00k3mwans8jfb9p4gl02v6z62vgx0pkgrzxjkcz07";
+    sha256 = "sha256:0gk8g178i961nn3bls75a8qpv6wvfvav6hd9lxca1skaikd33zdx";
   };
 
   preBuild = ''
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
     pango
     pkgconfig
     wayland
+    icu
   ];
 
   installFlags = [ "PREFIX=$(out)" "CONFIGPREFIX=$(out)/etc" ];

pkgs/applications/graphics/kodelife/default.nix

@@ -9,11 +9,23 @@
 
 stdenv.mkDerivation rec {
   pname = "kodelife";
-  version = "0.8.7.105";
+  version = "0.8.8.110";
+
+  suffix = {
+    aarch64-linux = "linux-arm64";
+    armv7l-linux  = "linux-armhf";
+    x86_64-darwin = "macos";
+    x86_64-linux  = "linux-x86_64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   src = fetchzip {
-    url = "https://hexler.net/pub/${pname}/${pname}-${version}-linux-x86_64.zip";
+    url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.zip";
-    sha256 = "0ld4lwigzwlikx04qy3gskqqg0wzlk8m3ccrd704ifl8lsp46n5r";
+    sha256 = {
+      aarch64-linux = "1lcpj1mgkvksq1d08ibh59y0dmdh7zm77wi5ziqhg3p5g9nxyasd";
+      armv7l-linux  = "0sljy06302x567jqw5lagbyhpc3j140jk4wccacxjrbb6hcx3l42";
+      x86_64-darwin = "1b058s9kny026q395nj99v8hggxkgv43nnjkmx1a2siajw0db94c";
+      x86_64-linux  = "1q77cpz4gflrvfz6dm6np8sqbwyr235gq7y4pzs4hnqbrdzd4nwl";
+    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
   dontConfigure = true;
@@ -36,7 +48,7 @@ stdenv.mkDerivation rec {
       libGLU libGL
       xorg.libX11
     ];
-  in ''
+  in stdenv.lib.optionalString (!stdenv.isDarwin) ''
     patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${libPath}" \
@@ -48,6 +60,6 @@ stdenv.mkDerivation rec {
     description = "Real-time GPU shader editor";
     license = licenses.unfree;
     maintainers = with maintainers; [ prusnak ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "aarch64-linux" "armv7l-linux" "x86_64-darwin" "x86_64-linux" ];
   };
 }

pkgs/applications/misc/alacritty/default.nix

@@ -5,6 +5,7 @@
 
   cmake,
   gzip,
+  installShellFiles,
   makeWrapper,
   ncurses,
   pkgconfig,
@@ -52,20 +53,21 @@ let
   ];
 in buildRustPackage rec {
   pname = "alacritty";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "jwilm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0adaqdbma6gskb2g14yscrgr9gch5wf2g2clchplv72c2qr1k427";
+    sha256 = "05jcg33ifngpzw2hdhgb614j87ihhhlqgar0kky183rywg0dxikg";
   };
 
-  cargoSha256 = "1r267g8f986nxh8ms5yhp50qy1yl8gly2jr78p738qqc6frlxlhv";
+  cargoSha256 = "1kc9n10kb4j87x337pzl6wpi0qj5ib2mqmrjag2yld3138dag71n";
 
   nativeBuildInputs = [
     cmake
     gzip
+    installShellFiles
     makeWrapper
     ncurses
     pkgconfig
@@ -93,9 +95,9 @@ in buildRustPackage rec {
     patchelf --set-rpath "${stdenv.lib.makeLibraryPath rpathLibs}" $out/bin/alacritty
   '') + ''
 
-    install -D extra/completions/_alacritty -t "$out/share/zsh/site-functions/"
+    installShellCompletion --zsh extra/completions/_alacritty
-    install -D extra/completions/alacritty.bash -t "$out/etc/bash_completion.d/"
+    installShellCompletion --bash extra/completions/alacritty.bash
-    install -D extra/completions/alacritty.fish -t "$out/share/fish/vendor_completions.d/"
+    installShellCompletion --fish extra/completions/alacritty.fish
 
     install -dm 755 "$out/share/man/man1"
     gzip -c extra/alacritty.man > "$out/share/man/man1/alacritty.1.gz"
@@ -112,9 +114,9 @@ in buildRustPackage rec {
 
   meta = with stdenv.lib; {
     description = "GPU-accelerated terminal emulator";
-    homepage = https://github.com/jwilm/alacritty;
+    homepage = "https://github.com/jwilm/alacritty";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ filalex77 mic92 ];
-    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
+    platforms = platforms.unix;
   };
 }

pkgs/applications/misc/cherrytree/default.nix

@@ -2,11 +2,11 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "cherrytree";
-  version = "0.38.9";
+  version = "0.38.10";
 
   src = fetchurl {
     url = "https://www.giuspen.com/software/${pname}-${version}.tar.xz";
-    sha256 = "0xal09ijgxbzvp003s40xbrfnpq3ald1fw8nnpqq3yg7h6g6c5pw";
+    sha256 = "1bj83b7lwqir13fp9slcdn8mgign06vywy42x8zvsp22fjn4p7f7";
   };
 
   nativeBuildInputs = [ gettext ];

pkgs/applications/misc/librecad/default.nix

@@ -1,8 +1,23 @@
-{ mkDerivation, lib, fetchFromGitHub, installShellFiles, pkgconfig, runtimeShell
+{ boost
-, qtbase, qtsvg, qttools, qmake
+, fetchFromGitHub
-, boost, muparser }:
+, installShellFiles
+, mkDerivationWith
+, muparser
+, pkgconfig
+, qmake
+, qtbase
+, qtsvg
+, qttools
+, runtimeShell
+, gcc8Stdenv
+}:
 
-mkDerivation rec {
+let
+  stdenv = gcc8Stdenv;
+in
+
+# Doesn't build with gcc9
+mkDerivationWith stdenv.mkDerivation rec {
   pname = "librecad";
   version = "2.2.0-rc1";
 
@@ -13,7 +28,9 @@ mkDerivation rec {
     sha256 = "0kwj838hqzbw95gl4x6scli9gj3gs72hdmrrkzwq5rjxam18k3f3";
   };
 
-  patches = [ ./fix_qt_5_11_build.patch ];
+  patches = [
+    ./fix_qt_5_11_build.patch
+  ];
 
   postPatch = ''
     substituteInPlace scripts/postprocess-unix.sh \
@@ -48,17 +65,30 @@ mkDerivation rec {
     runHook postInstall
   '';
 
-  buildInputs = [ boost muparser qtbase qtsvg ];
+  buildInputs = [
+    boost
+    muparser
+    qtbase
+    qtsvg
+  ];
 
-  nativeBuildInputs = [ installShellFiles pkgconfig qmake qttools ];
+  nativeBuildInputs = [
+    installShellFiles
+    pkgconfig
+    qmake
+    qttools
+  ];
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = with stdenv.lib; {
     description = "2D CAD package based on Qt";
     homepage = "https://librecad.org";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ viric ];
+    maintainers = with maintainers; [
+      kiwi
+      viric
+    ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/networking/browsers/firefox/common.nix

@@ -373,5 +373,12 @@ stdenv.mkDerivation (rec {
 # unfortunately we can't just set this to `false` when we do not want it.
 # See https://github.com/NixOS/nixpkgs/issues/77289 for more details
 lib.optionalAttrs (lib.versionAtLeast ffversion "72") {
+  # Ideally we would figure out how to tell the build system to not
+  # care about changed hashes as we are already doing that when we
+  # fetch the sources. Any further modifications of the source tree
+  # is on purpose by some of our tool (or by accident and a bug?).
   dontFixLibtool = true;
+
+  # on aarch64 this is also required
+  dontUpdateAutotoolsGnuConfigScripts = true;
 })

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -16,10 +16,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "72.0";
+    ffversion = "72.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "3ri375myxn040avylz3xdvbgyb0ixn0q1sszrsc4b9jp620j1732qixylw0lyfym5a0vkhpmihbp5kdjrmc4r26myjar5c9zjzisnd0";
+      sha512 = "37ryimi6yfpcha4c9mcv8gjk38kia1lr5xrj2lglwsr1jai7qxrcd8ljcry8bg87qfwwb9fa13prmn78f5pzpxr7jf8gnsbvr6adxld";
     };
 
     patches = [
@@ -99,10 +99,10 @@ rec {
 
   firefox-esr-68 = common rec {
     pname = "firefox-esr";
-    ffversion = "68.4.0esr";
+    ffversion = "68.4.1esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "29h0fm929jrk9nbb40bajf6a6s4x9w8zc2qw1hrg5jki1pabx30wdgn372pb51ak371a0q59k8p1vab6j31q7par6xvpwh7aiydfq04";
+      sha512 = "3nqchvyr95c9xvz23z0kcqqyx8lskw0lxa3rahiagc7b71pnrk8l40c7327q1wd4y5g16lix0fg04xiy6lqjfycjsrjlfr2y6b51n4d";
     };
 
     patches = [

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -93,19 +93,19 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "9.0.2";
+  version = "9.0.3";
 
   lang = "en-US";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "1xdnqphsj7wzwyv927jwd3fi36srx0minydwl5jg5yyd3m3if9hb";
+      sha256 = "0saipnmhjfqwrx0q8mn3zc9n0j5a754cfipdaizbcqwm9dwd70w9";
     };
 
     i686-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "1qk9fg5dvyyvbngsqla00by8a974mpvq9pnm2djif54lr2nfivwf";
+      sha256 = "19r6zm81p9fv9ldsck5wilcihvb5bifmd1cms6wdkldz8crnn9l6";
     };
   };
 in

pkgs/applications/networking/calls/default.nix

@@ -14,6 +14,7 @@
 , libpeas
 , dbus
 , vala
+, wrapGAppsHook
 , xorg
 , xvfb_run
 , libxml2
@@ -21,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "calls";
-  version = "unstable-2019-10-29";
+  version = "0.1.1";
 
   src = fetchFromGitLab {
     domain = "source.puri.sm";
     owner = "Librem5";
     repo = "calls";
-    rev = "9fe575053d8f01c3a76a6c20d39f0816166d5afd";
+    rev = "v${version}";
     sha256 = "01inx4mvrzvklwrfryw5hw9p89v8cn78m3qmv97g7a3v0h5c0n35";
   };
 
@@ -37,6 +38,7 @@ stdenv.mkDerivation rec {
     pkgconfig
     desktop-file-utils
     vala
+    wrapGAppsHook
   ];
 
   buildInputs = [

pkgs/applications/networking/cluster/terraform/default.nix

@@ -112,8 +112,8 @@ in rec {
   terraform_0_11-full = terraform_0_11.full;
 
   terraform_0_12 = pluggable (generic {
-    version = "0.12.18";
+    version = "0.12.19";
-    sha256 = "1p2rvs9dw2rzzggf3q2lifwbd82b7xb3jpb4yz5nmggn5g22qlc1";
+    sha256 = "067gzxysz8r2myj3rh0vwrs0pmbgb21jxlmawlf4v0lkjnhj6kwv";
     patches = [ ./provider-path.patch ];
     passthru = { inherit plugins; };
   });

pkgs/applications/networking/ids/suricata/default.nix

@@ -34,11 +34,11 @@
 in
 stdenv.mkDerivation rec {
   pname = "suricata";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchurl {
     url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    sha256 = "0qwav4qpvx3i5khkyvdvx42n8b9mza8c4cpxvrf7m4lnf51cqgba";
+    sha256 = "034b0nl0hkh0v26gwbawi2wdv7mb9p54cfg8gc9b8hsw49k3c1wh";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/mpop/default.nix

@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mpop";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "0q4ifzvl1gcndvqqqk7n9mc599r4s2knxjc7alflwb366fql58gv";
+    sha256 = "0c6n5afn9pr4p7gxkv462lysrw52w9fhvavzm99c78dcp9dj5xnk";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/networking/msmtp/default.nix

@@ -9,11 +9,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "msmtp";
-  version = "1.8.6";
+  version = "1.8.7";
 
   src = fetchurl {
     url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "1qa260xrm0fzlwxpjvgvq39m4dfkskjlyb7m4y2vlr8c8d3z29b6";
+    sha256 = "1waiiksa57byb7gvx1zmh6srvl6r8rvwqklk0slb3iaf4kfbqlws";
   };
 
   patches = [

pkgs/applications/networking/syncthing/default.nix

@@ -3,19 +3,19 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
-      version = "1.3.2";
+      version = "1.3.3";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "029mym3vdfg616gpmhv6p22iy65h8vff2sq6z70l37bjf3zx1cms";
+        sha256 = "0bcp8kbj8xsnly2dfafnfvj6vl27mbgvj84pjk0wxdjfnr2my9ic";
       };
 
       goPackagePath = "github.com/syncthing/syncthing";
 
-      modSha256 = "06anhfi9mswmwhhjyz8mla6h8v83cc7slfr752fvgfaxra1fwgx8";
+      modSha256 = "0kv24bi3w3pvjyjng7ly67brq8wkc1xnhsyha1h7v3jbmj5fgb12";
 
       patches = [
         ./add-stcli-target.patch

pkgs/applications/office/vnote/default.nix

@@ -3,7 +3,7 @@
 let
   description = "A note-taking application that knows programmers and Markdown better";
 in mkDerivation rec {
-  version = "2.7.2";
+  version = "2.8.2";
   pname = "vnote";
 
   src = fetchFromGitHub {
@@ -11,7 +11,7 @@ in mkDerivation rec {
     repo = "vnote";
     fetchSubmodules = true;
     rev = "v${version}";
-    sha256 = "0mk1ingcyznpwq4bfkxa8nx9yx5y3kgsmr4qffriq7bh1cx9dwjy";
+    sha256 = "18qffq5c2plr5rjb5lafhdz1v5kbbb2wiyacgdhh3xni3khni52l";
   };
 
   nativeBuildInputs = [ qmake ];

pkgs/applications/radio/qsstv/default.nix

@@ -1,13 +1,13 @@
-{ stdenv, fetchurl, qtbase, qmake, makeDesktopItem, openjpeg, pkgconfig, fftw,
+{ mkDerivation, stdenv, fetchurl, qtbase, qmake, openjpeg, pkgconfig, fftw,
   libpulseaudio, alsaLib, hamlib, libv4l, fftwFloat }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
-  version = "9.2.6";
+  version = "9.4.4";
   pname = "qsstv";
 
   src = fetchurl {
     url = "http://users.telenet.be/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
-    sha256 = "0sx70yk389fq5djvjwnam6ics5knmg9b5x608bk2sjbfxkila108";
+    sha256 = "0f9hx6sy418cb23fadll298pqbc5l2lxsdivi4vgqbkvx7sw58zi";
   };
 
   enableParallelBuilding = true;
@@ -20,27 +20,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ qtbase openjpeg fftw libpulseaudio alsaLib hamlib libv4l
                   fftwFloat ];
 
-  desktopItem = makeDesktopItem {
+  postInstall = ''
-    name = "QSSTV";
-    exec = "qsstv";
-    icon = "qsstv.png";
-    comment = "Qt-based slow-scan TV and fax";
-    desktopName = "QSSTV";
-    genericName = "qsstv";
-    categories = "Application;HamRadio;";
-  };
-
-  installPhase = ''
-    # Install binary to the right location
-    make install INSTALL_ROOT=$out
-    mv $out/usr/bin $out/
-    rm -r $out/usr
-
     # Install desktop icon
     install -D qsstv/icons/qsstv.png $out/share/pixmaps/qsstv.png
-
-    # Install desktop item
-    cp -rv ${desktopItem}/share $out
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/science/biology/bayescan/default.nix

@@ -0,0 +1,39 @@
+{ stdenv, fetchurl, unzip, llvmPackages }:
+
+stdenv.mkDerivation rec {
+  pname = "bayescan";
+  version = "2.1";
+
+  src = fetchurl {
+    url = "http://cmpg.unibe.ch/software/BayeScan/files/BayeScan${version}.zip";
+    sha256 = "0ismima8j8z0zj9yc267rpf7z90w57b2pbqzjnayhc3ab8mcbfy6";
+  };
+
+  nativeBuildInputs = [ unzip ];
+  buildInputs = stdenv.lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  # Disable FORTIFY_SOURCE or the binary fails with "buffer overflow"
+  hardeningDisable = [ "fortify" ];
+
+  sourceRoot = "BayeScan${version}/source";
+
+  postPatch = ''
+    substituteInPlace Makefile --replace "-static" "" \
+                               --replace "g++" "c++"
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/doc/bayescan
+    cp bayescan_${version} $out/bin
+    cp -r ../*pdf ../input_examples ../"R functions" $out/share/doc/bayescan
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Detecting natural selection from population-based genetic data";
+    homepage = "http://cmpg.unibe.ch/software/BayeScan";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.bzizou ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}

pkgs/applications/science/electronics/ngspice/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ngspice";
-  version = "30";
+  version = "31";
 
   src = fetchurl {
     url = "mirror://sourceforge/ngspice/ngspice-${version}.tar.gz";
-    sha256 = "15v0jdfy2a2zxp8dmy04fdp7w7a4vwvffcwa688r81b86wphxzh8";
+    sha256 = "10n2lnfrpsv4vyrirkphr4jwjjhy7i617g6za78dwirfjq63npw4";
   };
 
   nativeBuildInputs = [ flex bison ];

pkgs/applications/science/electronics/pcb/default.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pcb";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/pcb/${pname}-${version}.tar.gz";
-    sha256 = "0hwsqmcrnk4wipbmfqx1yckmmgfn8vr37d1gh5srfy27czgkcjyd";
+    sha256 = "1i9zvcj0vgwp2g2hkmvafdq0k39klj90jsdanqx9xl7gl70345cq";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/math/gmsh/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gmsh";
-  version = "4.4.1";
+  version = "4.5.1";
 
   src = fetchurl {
     url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "1p7hibmsgv961lfkzdxlgcvmcb0q155m2sp60r97cjsfzhw68g45";
+    sha256 = "0rjwxpz5qwq6dj7ka53mhxlgnp9bs5jphhsamlb0nk3h8kzckisq";
   };
 
   buildInputs = [ openblasCompat gmm fltk libjpeg zlib libGLU libGL

pkgs/applications/window-managers/sway/lock-fancy.nix

@@ -0,0 +1,47 @@
+{ stdenv, fetchFromGitHub, coreutils, grim, gawk, swaylock
+, imagemagick, getopt, fontconfig, makeWrapper
+}:
+
+let
+  depsPath = stdenv.lib.makeBinPath [
+    coreutils
+    grim
+    gawk
+    swaylock
+    imagemagick
+    getopt
+    fontconfig
+  ];
+in stdenv.mkDerivation rec {
+  pname = "swaylock-fancy-unstable";
+  version = "2019-03-31";
+
+  src = fetchFromGitHub {
+    owner = "Big-B";
+    repo = pname;
+    rev = "35618ceec70338047355b6b057825e68f16971b5";
+    sha256 = "06fjqwblmj0d9pq6y11rr73mizirna4ixy6xkvblf1c7sn5n8lpc";
+  };
+
+  postPatch = ''
+    substituteInPlace swaylock-fancy \
+      --replace "/usr/share" "$out/share"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/swaylock-fancy \
+      --prefix PATH : "${depsPath}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "This is an swaylock bash script that takes a screenshot of the desktop, blurs the background and adds a lock icon and text";
+    homepage = "https://github.com/Big-B/swaylock-fancy";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ma27 ];
+  };
+}

pkgs/data/fonts/iosevka/default.nix

@@ -30,13 +30,13 @@ assert (privateBuildPlan != null) -> set != null;
 stdenv.mkDerivation rec {
   pname = if set != null then "iosevka-${set}" else "iosevka";
 
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "Iosevka";
     rev = "v${version}";
-    sha256 = "0s0vdvp1sn8p2pi2xm9n05pabk30ki7wjlmr0zz0nkhidb8apw6k";
+    sha256 = "0k7xij473g5g0lwhb6qpn70v3n2d025dww3nlb7jwbpnp03zliz0";
   };
 
   nativeBuildInputs = [

pkgs/data/fonts/iosevka/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "iosevka-build-deps",
-	"version": "2.3.2",
+	"version": "2.3.3",
 	"scripts": {
 		"build": "verda -f verdafile.js"
 	},
@@ -15,12 +15,12 @@
 		"patrisika-scopes": "^0.11.1",
 		"primitive-quadify-off-curves": "^0.4.0",
 		"stylus": "^0.54.5",
-		"toml": "^2.3.2",
+		"toml": "^3.0.0",
 		"topsort": "0.0.2",
 		"ttf2woff": "^2.0.1",
 		"ttf2woff2": "^2.0.3",
-		"unorm": "^1.4.1",
+		"unorm": "^1.6.0",
 		"verda": "^1.0.0-0",
-		"yargs": "^12.0.0"
+		"yargs": "^14.2.0"
 	}
 }

pkgs/data/fonts/public-sans/default.nix

@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "1.007";
+  version = "1.008";
 in fetchzip {
   name = "public-sans-${version}";
 
@@ -16,7 +16,7 @@ in fetchzip {
     unzip -j $downloadedFile binaries/webfonts/\*.woff2 -d $out/share/fonts/woff2
   '';
 
-  sha256 = "1yzraw08qm1ig7ks850b329xp6zv2znjwl610dppax34kwhqghsm";
+  sha256 = "1s4xmliri3r1gcn1ws3wa6davj6giliqjdbcv0bh9ryg3dfpjz74";
 
   meta = with lib; {
     description = "A strong, neutral, principles-driven, open source typeface for text or display";

pkgs/data/themes/amber/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amber-theme";
-  version = "3.34-1";
+  version = "3.34-2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fmsjhaxlw2znlbjys3ggmsr7zlfk1wlng7bh54g6b0vjgdbik3r";
+    sha256 = "0809l4r1qrzs9z04kcs1j962dpsvgpwpksnxs09md5722mynn65l";
   };
 
   nativeBuildInputs = [ meson ninja sassc ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "GTK, gnome-shell and Xfce theme based on Ubuntu Ambiance";
-    homepage = https://github.com/lassekongo83/amber-theme;
+    homepage = "https://github.com/lassekongo83/amber-theme";
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = [ maintainers.romildo ];

pkgs/data/themes/plano/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, gdk-pixbuf, gtk_engines, gtk-engine-murrine }:
+{ stdenv, fetchFromGitHub, gdk-pixbuf, gtk_engines, gtk-engine-murrine, librsvg }:
 
 stdenv.mkDerivation rec {
   pname = "plano-theme";
-  version = "3.34-1";
+  version = "3.34-2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0fdg4jyc3xv98yg2r6c8rccvbpf8y2l3x79qbpiq6ck9k6d34ycq";
+    sha256 = "0spbyvzb47vyfhcn3gr0z1gdb5xrprynm6442y1z32znai2bgpnd";
   };
 
-  buildInputs = [ gdk-pixbuf gtk_engines ];
+  buildInputs = [ gdk-pixbuf gtk_engines librsvg ];
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
@@ -20,12 +20,12 @@ stdenv.mkDerivation rec {
   installPhase = ''
     install -dm 755 $out/share/themes/Plano
     cp -a * $out/share/themes/Plano/
-    rm $out/share/themes/Plano/{COPYING.LGPL-2.1,LICENSE,README.md}
+    rm $out/share/themes/Plano/{LICENSE,README.md}
   '';
 
   meta = with stdenv.lib; {
     description = "Flat theme for GNOME and Xfce";
-    homepage = https://github.com/lassekongo83/plano-theme;
+    homepage = "https://github.com/lassekongo83/plano-theme";
     license = licenses.gpl3;
     platforms = platforms.unix;
     maintainers = [ maintainers.romildo ];

pkgs/data/themes/stilo/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stilo-themes";
-  version = "3.34-1";
+  version = "3.34-2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1qwz7i32jk7wm7m9ah6g1pxldz0rnviancndsr2lqmg55x36rs01";
+    sha256 = "1i5cl61dk8sxa6h61ghynm4wp1qzp3c7kwf4ks0ddzzk9dbvdrhb";
   };
 
   nativeBuildInputs = [ meson ninja sassc ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Minimalistic GTK, gnome shell and Xfce themes";
-    homepage = https://github.com/lassekongo83/stilo-themes;
+    homepage = "https://github.com/lassekongo83/stilo-themes";
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = [ maintainers.romildo ];

pkgs/data/themes/zuki/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zuki-themes";
-  version = "3.34-1";
+  version = "3.34-2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "19qg60rw5b0caqc542j2nrpkv8d37pai1cr1h0x2nvx0fkc3rmi2";
+    sha256 = "1nc0qh6qai6ybmz3a44q0rirri0gfg7lyqy4k4l1sci5q5ckl7x4";
   };
 
   nativeBuildInputs = [ meson ninja sassc ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Themes for GTK, gnome-shell and Xfce";
-    homepage = https://github.com/lassekongo83/zuki-themes;
+    homepage = "https://github.com/lassekongo83/zuki-themes";
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = [ maintainers.romildo ];

pkgs/development/compilers/fasm/bin.nix

@@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
   pname = "fasm-bin";
 
-  version = "1.73.18";
+  version = "1.73.21";
 
   src = fetchurl {
     url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "0m88vi8ac9mlak430nyrg3nxsj0fzy3yli8kk0mqsw8rqw2pfvqb";
+    sha256 = "143zh7x3q0r2kclshh8n5w4i5pw4lh60si7rspvc725xxjpjkvcv";
   };
 
   installPhase = ''

pkgs/development/libraries/SDL2_mixer/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, autoreconfHook, pkgconfig, which
-, SDL2, libogg, libvorbis, smpeg2, flac, libmodplug
+, SDL2, libogg, libvorbis, smpeg2, flac, libmodplug, opusfile
 , CoreServices, AudioUnit, AudioToolbox
 , enableNativeMidi ? false, fluidsynth ? null }:
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices AudioUnit AudioToolbox ];
 
-  propagatedBuildInputs = [ SDL2 libogg libvorbis fluidsynth smpeg2 flac libmodplug ];
+  propagatedBuildInputs = [ SDL2 libogg libvorbis fluidsynth smpeg2 flac libmodplug opusfile ];
 
   configureFlags = [ "--disable-music-ogg-shared" ]
     ++ lib.optional enableNativeMidi "--enable-music-native-midi-gpl"

pkgs/development/libraries/cereal/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "cereal";
-  version = "1.2.2";
+  version = "1.3.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "USCiLab";
     repo = "cereal";
     rev = "v${version}";
-    sha256 = "1ckr8r03ggg5pyzg8yw40d5ssq40h5najvyqlnxc85fxxp8rnrx4";
+    sha256 = "0hc8wh9dwpc1w1zf5lfss4vg5hmgpblqxbrpp1rggicpx9ar831p";
   };
 
   cmakeFlagsArray = [ "-DJUST_INSTALL_CEREAL=yes" ];

pkgs/development/libraries/cimg/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cimg";
-  version = "2.7.5";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "http://cimg.eu/files/CImg_${version}.zip";
-    sha256 = "1xhs0j7mfiln9apfcc9cd3cmjj1prm211vih2zn2qi87ialv36cg";
+    sha256 = "1nm9zpx9k3pb1p726ihw13y0d3y3xqafml7mhnx6wrkg9sfgs17n";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/development/libraries/intel-media-sdk/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
-  version = "19.3.1";
+  version = "19.4.0";
 
   src = fetchurl {
     url = "https://github.com/Intel-Media-SDK/MediaSDK/archive/intel-mediasdk-${version}.tar.gz";
-    sha256 = "12w1f3krcrjyhax4y3hbs7galhf4rabxym2fxjyil8cszx5fh433";
+    sha256 = "1l8wjb933wdl3vyq6r36a9pgf8n6pm9g9vcp3m393hixwzzl16i8";
   };
 
   # patchelf is needed for binaries in $out/share/samples

pkgs/development/libraries/java/lombok/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "lombok-1.18.8";
+  name = "lombok-1.18.10";
 
   src = fetchurl {
     url = "https://projectlombok.org/downloads/${name}.jar";
-    sha256 = "1z14rc3fh03qvn2xkjrb7ha0hddv3f3vsp781xm336sp4cl9b5h3";
+    sha256 = "1ymjwxg01dq8qq89hx23yvk5h46hwfb8ihbqbvabmz1vh9afjdi8";
   };
 
   buildCommand = ''

pkgs/development/libraries/libev/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, static ? false }:
 
 stdenv.mkDerivation rec {
   pname = "libev";
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0nkfqv69wfyy2bpga4d53iqydycpik8jp8x6q70353hia8mmv1gd";
   };
 
+  configureFlags = stdenv.lib.optional (static) "LDFLAGS=-static";
+
   meta = {
     description = "A high-performance event loop/event model with lots of features";
     maintainers = [ stdenv.lib.maintainers.raskin ];

pkgs/development/libraries/science/math/primesieve/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "primesieve";
-  version = "7.4";
+  version = "7.5";
 
   nativeBuildInputs = [cmake];
 
   src = fetchurl {
     url = "https://github.com/kimwalisch/primesieve/archive/v${version}.tar.gz";
-    sha256 = "16930d021ai8cl3gsnn2v6l30n6mklwwqd53z51cddd3dj69x6zz";
+    sha256 = "0g60br3p8di92jx3pr2bb51xh15gg57l7qvwzwn7xf7l585hgi7v";
   };
 
   meta = with stdenv.lib; {

pkgs/development/ocaml-modules/ppxfind/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildDunePackage, fetchurl, ocaml, ocaml-migrate-parsetree }:
+{ stdenv, lib, buildDunePackage, fetchurl, ocaml, ocaml-migrate-parsetree }:
 
 buildDunePackage (rec {
 	pname = "ppxfind";
@@ -12,6 +12,9 @@ buildDunePackage (rec {
 
 	buildInputs = [ ocaml-migrate-parsetree ];
 
+  # Don't run the native `strip' when cross-compiling.
+  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
+
 	meta = {
 		homepage = "https://github.com/diml/ppxfind";
 		description = "ocamlfind ppx tool";

pkgs/development/python-modules/azure-mgmt-iotcentral/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-iotcentral";
-  version = "1.0.0";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "9aac88ed1f993965015f4e9986931fc08798e09d7b864928681a7cebff053de8";
+    sha256 = "1fql0j28d2r6slgabb7b438gdga513iskqh4al6c7dsmj1yzdzwa";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/colormath/default.nix

@@ -0,0 +1,32 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, networkx
+, nose
+, numpy
+, lib
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "colormath";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "gtaylor";
+    rev = "3.0.0";
+    repo = "python-colormath";
+    sha256 = "1nqf5wy8ikx2g684khzvjc4iagkslmbsxxwilbv4jpaznr9lahdl";
+  };
+
+  propagatedBuildInputs = [ networkx numpy ];
+
+  checkInputs = [ nose ];
+  checkPhase = "nosetests";
+
+  meta = with lib; {
+    description = "Color math and conversion library";
+    homepage = "https://github.com/gtaylor/python-colormath";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ jonathanreeve ];
+  };
+}

pkgs/development/python-modules/coordinates/default.nix

@@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder
+, pytest
+}:
+
+buildPythonPackage rec {
+  pname = "coordinates";
+  version = "0.4.0";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "clbarnes";
+    repo = "coordinates";
+    rev = "v${version}";
+    sha256 = "1zha594rshjg3qjq9mrai2hfldya282ihasp2i3km7b2j4gjdw2b";
+  };
+
+  checkInputs = [ pytest ];
+
+  checkPhase = ''
+    runHook preCheck
+    pytest tests/
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Convenience class for doing maths with explicit coordinates";
+    homepage = https://github.com/clbarnes/coordinates;
+    license = licenses.mit;
+    maintainers = [ maintainers.mildlyincompetent ];
+  };
+}

pkgs/development/python-modules/dodgy/default.nix

@@ -0,0 +1,40 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, lib
+
+# pythonPackages
+, mock
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "dodgy";
+  version = "0.2.1";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "landscapeio";
+    repo = pname;
+    rev = version;
+    sha256 = "0ywwjpz0p6ls3hp1lndjr9ql6s5lkj7dgpll1h87w04kwan70j0x";
+  };
+
+  checkInputs = [
+    mock
+    nose
+  ];
+
+  checkPhase = ''
+    nosetests tests/test_checks.py
+  '';
+
+  meta = with lib; {
+    description = "Looks at Python code to search for things which look \"dodgy\" such as passwords or diffs";
+    homepage = "https://github.com/landscapeio/dodgy";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}

pkgs/development/python-modules/geoip2/default.nix

@@ -7,12 +7,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.9.0";
+  version = "3.0.0";
   pname = "geoip2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1w7cay5q6zawjzivqbwz5cqx1qbdjw6kbriccb7l46p7b39fkzzp";
+    sha256 = "1q1ciqqd0qjkpgwsg9fws8wcqchkcq84gv2g4q3xgh2lpj3yjsaq";
   };
 
   propagatedBuildInputs = [ requests maxminddb ]

pkgs/development/python-modules/hydra/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, fetchFromGitHub, isPy27, pytest, omegaconf, pathlib2 }:
+
+buildPythonPackage rec {
+  pname = "hydra";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "facebookresearch";
+    repo = pname;
+    rev = version;
+    sha256 = "0plbls65qfrvvigza3qvy0pwjzgkz8ylpgb1im14k3b125ny41ad";
+  };
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ omegaconf ] ++ lib.optional isPy27 pathlib2;
+
+  checkPhase = ''
+    runHook preCheck
+    pytest tests/
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "A framework for configuring complex applications";
+    homepage = https://hydra.cc;
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}

pkgs/development/python-modules/ihatemoney/default.nix

@@ -0,0 +1,92 @@
+{ buildPythonPackage, lib, fetchFromGitHub, isPy27, nixosTests
+, alembic
+, aniso8601
+, Babel
+, blinker
+, click
+, dnspython
+, email_validator
+, flask
+, flask-babel
+, flask-cors
+, flask_mail
+, flask_migrate
+, flask-restful
+, flask_script
+, flask_sqlalchemy
+, flask_wtf
+, idna
+, itsdangerous
+, jinja2
+, Mako
+, markupsafe
+, mock
+, python-dateutil
+, pytz
+, six
+, sqlalchemy
+, werkzeug
+, wtforms
+, psycopg2 # optional, for postgresql support
+, flask_testing
+}:
+
+buildPythonPackage rec {
+  pname = "ihatemoney";
+  version = "4.1";
+
+  src = fetchFromGitHub {
+    owner = "spiral-project";
+    repo = pname;
+    rev = version;
+    sha256 = "1ai7v2i2rvswzv21nwyq51fvp8lr2x2cl3n34p11br06kc1pcmin";
+  };
+
+  propagatedBuildInputs = [
+    alembic
+    aniso8601
+    Babel
+    blinker
+    click
+    dnspython
+    email_validator
+    flask
+    flask-babel
+    flask-cors
+    flask_mail
+    flask_migrate
+    flask-restful
+    flask_script
+    flask_sqlalchemy
+    flask_wtf
+    idna
+    itsdangerous
+    jinja2
+    Mako
+    markupsafe
+    python-dateutil
+    pytz
+    six
+    sqlalchemy
+    werkzeug
+    wtforms
+    psycopg2
+  ];
+
+  checkInputs = [
+    flask_testing
+  ] ++ lib.optionals isPy27 [ mock ];
+
+  passthru.tests = {
+    inherit (nixosTests) ihatemoney;
+  };
+  meta = with lib; {
+    homepage = "https://ihatemoney.org";
+    description = "A simple shared budget manager web application";
+    platforms = platforms.linux;
+    license = licenses.beerware;
+    maintainers = [ maintainers.symphorien ];
+  };
+}
+
+

pkgs/development/python-modules/jenkins-job-builder/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "jenkins-job-builder";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1wcmn01md6hykblk5zz8wd5zizyisspspakz446jg2kqfv4y3q03";
+    sha256 = "1njxww53d92cpgrqlr09w2n0pk6wamjcb0mvpns1mr2pn5hy1jhi";
   };
 
   postPatch = ''

pkgs/development/python-modules/m3u8/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, python, fetchFromGitHub, requests, iso8601, bottle, pytest, pytestcov }:
+
+buildPythonPackage rec {
+  pname = "m3u8";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "globocom";
+    repo = pname;
+    rev = version;
+    sha256 = "0p6wmwv1nfa5pyakq5d55w9v142z5ja3db3s3qr44kx895d9lhng";
+  };
+
+  checkInputs = [ bottle pytest pytestcov ];
+
+  checkPhase = ''
+    pytest tests/test_{parser,model,variant_m3u8}.py
+  '';
+
+  propagatedBuildInputs = [ requests iso8601 ];
+
+  meta = with lib; {
+    homepage = "https://github.com/globocom/m3u8";
+    description = "Python m3u8 parser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Scriptkiddi ];
+  };
+}
+

pkgs/development/python-modules/omegaconf/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, pythonOlder
+, pytest, pytestrunner, pyyaml, six, pathlib2, isPy27 }:
+
+buildPythonPackage rec {
+  pname = "omegaconf";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "omry";
+    repo = pname;
+    rev = version;
+    sha256 = "1vpcdjlq54pm8xmkv2hqm2n1ysvz2a9iqgf55x0w6slrb4595cwb";
+  };
+
+  checkInputs = [ pytest ];
+  buildInputs = [ pytestrunner ];
+  propagatedBuildInputs = [ pyyaml six ] ++ stdenv.lib.optional isPy27 pathlib2;
+
+  meta = with stdenv.lib; {
+    description = "A framework for configuring complex applications";
+    homepage = "https://github.com/omry/omegaconf";
+    license = licenses.free;  # prior bsd license (1988)
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}

pkgs/development/python-modules/pandas/default.nix

@@ -84,6 +84,9 @@ in buildPythonPackage rec {
     "io"
     # KeyError Timestamp
     "test_to_excel"
+    # ordering logic has changed
+    "numpy_ufuncs_other"
+    "order_without_freq"
   ] ++ optionals isDarwin [
     "test_locale"
     "test_clipboard"

pkgs/development/python-modules/pycm/default.nix

@@ -0,0 +1,35 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub, isPy3k, numpy, pytest }:
+
+buildPythonPackage rec {
+  pname = "pycm";
+  version = "2.5";
+
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner  = "sepandhaghighi";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "0zfv20hd7zq95sflsivjk47b0sm7q76w7fv2i2mafn83ficzx0p0";
+  };
+
+  # remove a trivial dependency on the author's `art` Python ASCII art library
+  postPatch = ''
+    rm pycm/__main__.py
+    substituteInPlace setup.py --replace '=get_requires()' '=[]'
+  '';
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ numpy ];
+
+  checkPhase = ''
+    pytest Test/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Multiclass confusion matrix library";
+    homepage = https://pycm.ir;
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}

pkgs/development/python-modules/pylint-plugin-utils/default.nix

@@ -0,0 +1,38 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+, lib
+
+# pythonPackages
+, pylint
+}:
+
+buildPythonPackage rec {
+  pname = "pylint-plugin-utils";
+  version = "0.6";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "PyCQA";
+    repo = pname;
+    rev = version;
+    sha256 = "1zapmbczxs1phrwbd0yvpfxhljd2pyv4pi9rwggaq38lcnc325s7";
+  };
+
+  propagatedBuildInputs = [
+    pylint
+  ];
+
+  checkPhase = ''
+    python tests.py
+  '';
+
+  meta = with lib; {
+    description = "Utilities and helpers for writing Pylint plugins";
+    homepage = "https://github.com/PyCQA/pylint-plugin-utils";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [
+      kamadorueda
+    ];
+  };
+}

pkgs/development/python-modules/restrictedpython/default.nix

@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# Test dependencies
+, pytest, pytest-mock
+}:
+
+buildPythonPackage rec {
+  pname = "RestrictedPython";
+  version = "5.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1g0sffn6ifkl1w8gq15rpaqm8c7l68bsnm77wcd3flyzzydmd050";
+  };
+
+  #propagatedBuildInputs = [ xmltodict requests ifaddr ];
+
+  checkInputs = [
+    pytest pytest-mock
+  ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = {
+    homepage = https://github.com/zopefoundation/RestrictedPython;
+    description = "A restricted execution environment for Python to run untrusted code";
+    license = lib.licenses.zpl21;
+    maintainers = with lib.maintainers; [ juaningan ];
+  };
+}

pkgs/development/tools/micronaut/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "1.2.6";
+  version = "1.2.8";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-core/releases/download/v${version}/${pname}-${version}.zip";
-    sha256 = "0y7qshg6v8s5rwi0fz9xpyhd1yhv8jrw2jhp276a30dfkglx19qn";
+    sha256 = "1znrgmwi11pnanvlaqlrffp5y3pz2ql6vrglbzqx8m9ydvdn1cp1";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];

pkgs/development/tools/misc/kibana/7.x.nix

@@ -18,12 +18,12 @@ let
   shas =
     if enableUnfree
     then {
-      x86_64-linux  = "0sc5709k3z7lb8qcjpj49s6vfv69ds2wc8319ag9x776nyz1pqxi";
+      x86_64-linux  = "1wq4fc2fifkg1qz7nxdfb4yi2biay8cgdz7kl5k0p37sxn0sbkja";
-      x86_64-darwin = "0zh4q46vfdwaihs838ck8fap92i3b4x10wbpmx8mcwyfk5v0fkch";
+      x86_64-darwin = "06346kj7bv49py49pmmnmh8m24322m88v1af19909pj9cxgd0p6v";
     }
     else {
-      x86_64-linux  = "1pq17fasryharvw4byybvmcf5172hcmy6cp0m8bxhkxagwilprba";
+      x86_64-linux  = "0ygpmcm6wdcnvw8azwqc5257lyic7yw31rqvm2pw3afhpha62lpj";
-      x86_64-darwin = "11crpx2qs2nzkzv6fvs1gqn9v4zalxkzsc5br0fy1y02lzm26zbm";
+      x86_64-darwin = "0xy81g0bhxp47p29kkkh5llfzqkzqzr5dk50ap2hy0hjw33ld6g1";
     };
 
 in stdenv.mkDerivation rec {

pkgs/development/tools/pry/Gemfile

@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'pry'

pkgs/development/tools/pry/Gemfile.lock

@@ -0,0 +1,17 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    coderay (1.1.2)
+    method_source (0.9.2)
+    pry (0.12.2)
+      coderay (~> 1.1.0)
+      method_source (~> 0.9.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  pry
+
+BUNDLED WITH
+   1.17.2

pkgs/development/tools/pry/default.nix

@@ -0,0 +1,17 @@
+{ lib, bundlerApp, bundlerUpdateScript }:
+
+bundlerApp {
+  pname = "pry";
+  gemdir = ./.;
+  exes = [ "pry" ];
+
+  passthru.updateScript = bundlerUpdateScript "pry";
+
+  meta = with lib; {
+    description = "A Ruby runtime developer console and IRB alternative";
+    homepage    = https://pryrepl.org;
+    license     = licenses.mit;
+    maintainers = [ maintainers.tckmn ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/development/tools/pry/gemset.nix

@@ -0,0 +1,33 @@
+{
+  coderay = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  method_source = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pviwzvdqd90gn6y7illcdd9adapw8fczml933p5vl739dkvl3lq";
+      type = "gem";
+    };
+    version = "0.9.2";
+  };
+  pry = {
+    dependencies = ["coderay" "method_source"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00rm71x0r1jdycwbs83lf9l6p494m99asakbvqxh8rz7zwnlzg69";
+      type = "gem";
+    };
+    version = "0.12.2";
+  };
+}

pkgs/games/ivan/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, SDL2, SDL2_mixer, alsaLib, libpng, pcre }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, SDL2, SDL2_mixer, alsaLib, libpng
+, pcre, graphicsmagick, makeDesktopItem }:
 
 stdenv.mkDerivation rec {
 
@@ -12,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0mavmwikfsyr5sp65sl8dqknl1yz7c7ds53y1qkma24vsikz3k64";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig graphicsmagick ];
 
   buildInputs = [ SDL2 SDL2_mixer alsaLib libpng pcre ];
 
@@ -24,6 +25,26 @@ stdenv.mkDerivation rec {
   # Help CMake find SDL_mixer.h
   NIX_CFLAGS_COMPILE = "-I${SDL2_mixer}/include/SDL2";
 
+  # Create "ivan.desktop" file
+  ivanDesktop = makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = "ivan.png";
+    desktopName = "IVAN";
+    genericName = pname;
+    categories = "Game;AdventureGame;RolePlaying;";
+    comment = meta.description;
+  };
+
+  # Create appropriate directories. Convert "Icon.bmp" to "ivan.png", then copy
+  # it and "ivan.desktop" to these directories.
+  postInstall = ''
+    mkdir -p $out/share/applications
+    mkdir -p $out/share/icons/hicolor/32x32/apps
+    gm convert $src/Graphics/Icon.bmp $out/share/icons/hicolor/32x32/apps/ivan.png
+    cp ${ivanDesktop}/share/applications/* $out/share/applications
+  '';
+
   meta = with stdenv.lib; {
     description = "Graphical roguelike game";
     longDescription = ''

pkgs/misc/emulators/mupen64plus/default.nix

@@ -1,15 +1,15 @@
-{stdenv, fetchurl, boost, dash, freetype, libpng, pkgconfig, SDL, which, zlib }:
+{stdenv, fetchurl, boost, dash, freetype, libpng, pkgconfig, SDL, which, zlib, nasm }:
 
 stdenv.mkDerivation rec {
   pname = "mupen64plus";
-  version = "2.5";
+  version = "2.5.9";
 
   src = fetchurl {
     url = "https://github.com/mupen64plus/mupen64plus-core/releases/download/${version}/mupen64plus-bundle-src-${version}.tar.gz";
-    sha256 = "0rmsvfn4zfvbhz6gf1xkb7hnwflv6sbklwjz2xk4dlpj4vcbjxcw";
+    sha256 = "1a21n4gqdvag6krwcjm5bnyw5phrlxw6m0mk73jy53iq03f3s96m";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig nasm ];
   buildInputs = [ boost dash freetype libpng SDL which zlib ];
 
   buildPhase = ''
@@ -19,11 +19,11 @@ stdenv.mkDerivation rec {
     dash m64p_install.sh DESTDIR="$out" PREFIX=""
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A Nintendo 64 Emulator";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
     homepage = http://www.mupen64plus.org/;
-    maintainers = [ stdenv.lib.maintainers.sander ];
+    maintainers = [ maintainers.sander ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = [ "x86_64-linux" ];
   };
 }

pkgs/misc/logging/beats/7.x.nix

@@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
         owner = "elastic";
         repo = "beats";
         rev = "v${version}";
-        sha256 = "0715fgqw6mqms4zld8wyf6appvvpfb1hglcmcn852c66a8zwr2r2";
+        sha256 = "192ygz3ppfah8d2b811x67jfqhcr5ivz7qh4vwrd729rjfr0bbgb";
       };
 
       goPackagePath = "github.com/elastic/beats";

pkgs/misc/vim-plugins/generated.nix

@@ -808,6 +808,17 @@ let
     };
   };
 
+  defx-icons = buildVimPluginFrom2Nix {
+    pname = "defx-icons";
+    version = "2019-11-03";
+    src = fetchFromGitHub {
+      owner = "kristijanhusak";
+      repo = "defx-icons";
+      rev = "1412fd083eb54ffedb4f3ae32ddc7ce28613a144";
+      sha256 = "1x0xpixbmxm15g5nmsslccdngm14sg86ymy6mywg9xfbnrh1vn0p";
+    };
+  };
+
   defx-nvim = buildVimPluginFrom2Nix {
     pname = "defx-nvim";
     version = "2020-01-02";
@@ -2179,6 +2190,17 @@ let
     };
   };
 
+  pear-tree = buildVimPluginFrom2Nix {
+    pname = "pear-tree";
+    version = "2019-12-08";
+    src = fetchFromGitHub {
+      owner = "tmsvg";
+      repo = "pear-tree";
+      rev = "3bb209d9637d6bd7506040b2fcd158c9a7917db3";
+      sha256 = "0n70rzw34lsnnprqna90ssqrka33qx3z0n2kj19ps8yp3j6lsxvk";
+    };
+  };
+
   peskcolor-vim = buildVimPluginFrom2Nix {
     pname = "peskcolor-vim";
     version = "2016-06-11";
@@ -3489,6 +3511,17 @@ let
     };
   };
 
+  vim-dadbod = buildVimPluginFrom2Nix {
+    pname = "vim-dadbod";
+    version = "2020-01-02";
+    src = fetchFromGitHub {
+      owner = "tpope";
+      repo = "vim-dadbod";
+      rev = "59cc0a16970b92afa1c99182c60e35e01cdaa409";
+      sha256 = "0v3jhp33058cl7raqp59704m5ljsibpi9vs1hsiwwxf2pgdjii3f";
+    };
+  };
+
   vim-devicons = buildVimPluginFrom2Nix {
     pname = "vim-devicons";
     version = "2019-11-10";
@@ -3643,6 +3676,17 @@ let
     };
   };
 
+  vim-endwise = buildVimPluginFrom2Nix {
+    pname = "vim-endwise";
+    version = "2019-11-13";
+    src = fetchFromGitHub {
+      owner = "tpope";
+      repo = "vim-endwise";
+      rev = "bf90d8be447de667f4532b934d1a70881be56dd8";
+      sha256 = "1czx891via5783yk222mhki94wvq75hxxp1xk1d5m90vwqb3azfn";
+    };
+  };
+
   vim-eunuch = buildVimPluginFrom2Nix {
     pname = "vim-eunuch";
     version = "2019-11-13";
@@ -5679,6 +5723,17 @@ let
     };
   };
 
+  vista-vim = buildVimPluginFrom2Nix {
+    pname = "vista-vim";
+    version = "2020-01-06";
+    src = fetchFromGitHub {
+      owner = "liuchengxu";
+      repo = "vista.vim";
+      rev = "dcf134c83a6a3f9618a97cafab5b7fb1f1df3f84";
+      sha256 = "0w9q69a2k8a39b8zrd3sildisrdskbk6cgvbkmb3fqsr0zdzjxzv";
+    };
+  };
+
   vundle = buildVimPluginFrom2Nix {
     pname = "vundle";
     version = "2019-08-17";