Merge staging-next into staging

2021-11-10 00:02:09 +00:00 · 2021-11-10 00:02:09 +00:00 · d5964b8c81
commit d5964b8c81
parent 92a74926fa 6e4d2d1f10
115 changed files with 4225 additions and 890 deletions
--- a/doc/builders/trivial-builders.chapter.md
+++ b/doc/builders/trivial-builders.chapter.md
@ -47,6 +47,28 @@ These functions write `text` to the Nix store. This is useful for creating scrip

 Many more commands wrap `writeTextFile` including `writeText`, `writeTextDir`, `writeScript`, and `writeScriptBin`. These are convenience functions over `writeTextFile`.

+## `writeShellApplication` {#trivial-builder-writeShellApplication}
+
+This can be used to easily produce a shell script that has some dependencies (`runtimeInputs`). It automatically sets the `PATH` of the script to contain all of the listed inputs, sets some sanity shellopts (`errexit`, `nounset`, `pipefail`), and checks the resulting script with [`shellcheck`](https://github.com/koalaman/shellcheck).
+
+For example, look at the following code:
+
+```nix
+writeShellApplication {
+  name = "show-nixos-org";
+
+  runtimeInputs = [ curl w3m ];
+
+  text = ''
+    curl -s 'https://nixos.org' | w3m -dump -T text/html
+  '';
+}
+```
+
+Unlike with normal `writeShellScriptBin`, there is no need to manually write out `${curl}/bin/curl`, setting the PATH
+was handled by `writeShellApplication`. Moreover, the script is being checked with `shellcheck` for more strict
+validation.
+
 ## `symlinkJoin` {#trivial-builder-symlinkJoin}

 This can be used to put many derivations into the same directory structure. It works by creating a new derivation and adding symlinks to each of the paths listed. It expects two arguments, `name`, and `paths`. `name` is the name used in the Nix store path for the created derivation. `paths` is a list of paths that will be symlinked. These paths can be to Nix store derivations or any other subdirectory contained within.
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -62,17 +62,17 @@ checkConfigError() {

 # Check boolean option.
 checkConfigOutput "false" config.enable ./declare-enable.nix
-checkConfigError 'The option .* does not exist. Definition values:\n- In .*: true' config.enable ./define-enable.nix
+checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*: true' config.enable ./define-enable.nix

 # Check integer types.
 # unsigned
 checkConfigOutput "42" config.value ./declare-int-unsigned-value.nix ./define-value-int-positive.nix
-checkConfigError 'A definition for option .* is not of type.*unsigned integer.*. Definition values:\n- In .*: -23' config.value ./declare-int-unsigned-value.nix ./define-value-int-negative.nix
+checkConfigError 'A definition for option .* is not of type.*unsigned integer.*. Definition values:\n\s*- In .*: -23' config.value ./declare-int-unsigned-value.nix ./define-value-int-negative.nix
 # positive
-checkConfigError 'A definition for option .* is not of type.*positive integer.*. Definition values:\n- In .*: 0' config.value ./declare-int-positive-value.nix ./define-value-int-zero.nix
+checkConfigError 'A definition for option .* is not of type.*positive integer.*. Definition values:\n\s*- In .*: 0' config.value ./declare-int-positive-value.nix ./define-value-int-zero.nix
 # between
 checkConfigOutput "42" config.value ./declare-int-between-value.nix ./define-value-int-positive.nix
-checkConfigError 'A definition for option .* is not of type.*between.*-21 and 43.*inclusive.*. Definition values:\n- In .*: -23' config.value ./declare-int-between-value.nix ./define-value-int-negative.nix
+checkConfigError 'A definition for option .* is not of type.*between.*-21 and 43.*inclusive.*. Definition values:\n\s*- In .*: -23' config.value ./declare-int-between-value.nix ./define-value-int-negative.nix

 # Check either types
 # types.either
@ -125,7 +125,7 @@ checkConfigOutput 'true' "$@" ./define-enable.nix ./define-attrsOfSub-foo-enable
 set -- config.enable ./define-enable.nix ./declare-enable.nix
 checkConfigOutput "true" "$@"
 checkConfigOutput "false" "$@" ./disable-define-enable.nix
-checkConfigError "The option .*enable.* does not exist. Definition values:\n- In .*: true" "$@" ./disable-declare-enable.nix
+checkConfigError "The option .*enable.* does not exist. Definition values:\n\s*- In .*: true" "$@" ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-define-enable.nix ./disable-declare-enable.nix
 checkConfigError "attribute .*enable.* in selection path .*config.enable.* not found" "$@" ./disable-enable-modules.nix

@ -142,18 +142,18 @@ checkConfigError 'infinite recursion encountered' "$@"

 # Check _module.check.
 set -- config.enable ./declare-enable.nix ./define-enable.nix ./define-attrsOfSub-foo.nix
-checkConfigError 'The option .* does not exist. Definition values:\n- In .*' "$@"
+checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*' "$@"
 checkConfigOutput "true" "$@" ./define-module-check.nix

 # Check coerced value.
 checkConfigOutput "\"42\"" config.value ./declare-coerced-value.nix
 checkConfigOutput "\"24\"" config.value ./declare-coerced-value.nix ./define-value-string.nix
-checkConfigError 'A definition for option .* is not.*string or signed integer convertible to it.*. Definition values:\n- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix
+checkConfigError 'A definition for option .* is not.*string or signed integer convertible to it.*. Definition values:\n\s*- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix

 # Check coerced value with unsound coercion
 checkConfigOutput "12" config.value ./declare-coerced-value-unsound.nix
-checkConfigError 'A definition for option .* is not of type .*. Definition values:\n- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
-checkConfigError 'unrecognised JSON value' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix
+checkConfigError 'A definition for option .* is not of type .*. Definition values:\n\s*- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
+checkConfigError 'json.exception.parse_error' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix

 # Check mkAliasOptionModule.
 checkConfigOutput "true" config.enable ./alias-with-priority.nix
@ -169,7 +169,7 @@ checkConfigOutput "foo" config.submodule.foo ./declare-submoduleWith-special.nix
 ## shorthandOnlyDefines config behaves as expected
 checkConfigOutput "true" config.submodule.config ./declare-submoduleWith-shorthand.nix ./define-submoduleWith-shorthand.nix
 checkConfigError 'is not of type `boolean' config.submodule.config ./declare-submoduleWith-shorthand.nix ./define-submoduleWith-noshorthand.nix
-checkConfigError "You're trying to declare a value of type \`bool'\nrather than an attribute-set for the option" config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-shorthand.nix
+checkConfigError "You're trying to declare a value of type \`bool'\n\s*rather than an attribute-set for the option" config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-shorthand.nix
 checkConfigOutput "true" config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-noshorthand.nix

 ## submoduleWith should merge all modules in one swoop
@ -193,7 +193,7 @@ checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.ni
 checkConfigOutput "true" config.enable ./disable-recursive/main.nix
 checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-foo.nix}
 checkConfigOutput "true" config.enable ./disable-recursive/{main.nix,disable-bar.nix}
-checkConfigError 'The option .* does not exist. Definition values:\n- In .*: true' config.enable ./disable-recursive/{main.nix,disable-foo.nix,disable-bar.nix}
+checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*: true' config.enable ./disable-recursive/{main.nix,disable-foo.nix,disable-bar.nix}

 # Check that imports can depend on derivations
 checkConfigOutput "true" config.enable ./import-from-store.nix
@ -277,7 +277,7 @@ checkConfigOutput baz config.value.nested.bar.baz ./types-anything/mk-mods.nix
 ## types.functionTo
 checkConfigOutput "input is input" config.result ./functionTo/trivial.nix
 checkConfigOutput "a b" config.result ./functionTo/merging-list.nix
-checkConfigError 'A definition for option .fun.\[function body\]. is not of type .string.. Definition values:\n- In .*wrong-type.nix' config.result ./functionTo/wrong-type.nix
+checkConfigError 'A definition for option .fun.\[function body\]. is not of type .string.. Definition values:\n\s*- In .*wrong-type.nix' config.result ./functionTo/wrong-type.nix
 checkConfigOutput "b a" config.result ./functionTo/list-order.nix
 checkConfigOutput "a c" config.result ./functionTo/merging-attrs.nix

--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@ -23,6 +23,10 @@ pkgs.runCommand "nixpkgs-lib-tests" {
    export NIX_STORE_DIR=$TEST_ROOT/store
    export PAGER=cat
    cacheDir=$TEST_ROOT/binary-cache
+
+    mkdir -p $NIX_CONF_DIR
+    echo "experimental-features = nix-command" >> $NIX_CONF_DIR/nix.conf
+
    nix-store --init

    cp -r ${../.} lib
--- a/lib/tests/sources.sh
+++ b/lib/tests/sources.sh
@ -26,7 +26,7 @@ touch {README.md,module.o,foo.bar}
 # nix-instantiate doesn't write out the source, only computing the hash, so
 # this uses the experimental nix command instead.

-dir="$(nix eval --raw '(with import <nixpkgs/lib>; "${
+dir="$(nix eval --impure --raw --expr '(with import <nixpkgs/lib>; "${
  cleanSource ./.
 }")')"
 (cd $dir; find) | sort -f | diff -U10 - <(cat <<EOF
@ -37,7 +37,7 @@ EOF
 ) || die "cleanSource 1"


-dir="$(nix eval --raw '(with import <nixpkgs/lib>; "${
+dir="$(nix eval --impure --raw --expr '(with import <nixpkgs/lib>; "${
  cleanSourceWith { src = '"$work"'; filter = path: type: ! hasSuffix ".bar" path; }
 }")')"
 (cd $dir; find) | sort -f | diff -U10 - <(cat <<EOF
@ -47,7 +47,7 @@ dir="$(nix eval --raw '(with import <nixpkgs/lib>; "${
 EOF
 ) || die "cleanSourceWith 1"

-dir="$(nix eval --raw '(with import <nixpkgs/lib>; "${
+dir="$(nix eval --impure --raw --expr '(with import <nixpkgs/lib>; "${
  cleanSourceWith { src = cleanSource '"$work"'; filter = path: type: ! hasSuffix ".bar" path; }
 }")')"
 (cd $dir; find) | sort -f | diff -U10 - <(cat <<EOF
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -10185,6 +10185,12 @@
    githubId = 720864;
    name = "Sébastien Bourdeauducq";
  };
+  sbellem = {
+    email = "sbellem@gmail.com";
+    github = "sbellem";
+    githubId = 125458;
+    name = "Sylvain Bellemare";
+  };
  sbond75 = {
    name = "sbond75";
    email = "43617712+sbond75@users.noreply.github.com";
@ -11698,6 +11704,12 @@
    githubId = 1568873;
    name = "Torsten Scholak";
  };
+  tshaynik = {
+    email = "tshaynik@protonmail.com";
+    github = "tshaynik";
+    githubId = 15064765;
+    name = "tshaynik";
+  };
  tstrobel = {
    email = "4ZKTUB6TEP74PYJOPWIR013S2AV29YUBW5F9ZH2F4D5UMJUJ6S@hash.domains";
    name = "Thomas Strobel";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -15,6 +15,15 @@
  <section xml:id="sec-release-21.11-highlights">
    <title>Highlights</title>
    <itemizedlist>
+      <listitem>
+        <para>
+          Nix has been updated to version 2.4, reference its
+          <link xlink:href="https://discourse.nixos.org/t/nix-2-4-released/15822">release
+          notes</link> for more information on what has changed. The
+          previous version of Nix, 2.3.16, remains available for the
+          time being in the <literal>nix_2_3</literal> package.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>iptables</literal> now uses
@ -142,6 +151,27 @@
          </listitem>
        </itemizedlist>
      </listitem>
+      <listitem>
+        <para>
+          OpenSSH was updated to version 8.8p1
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              This breaks connections to old SSH daemons as ssh-rsa host
+              keys and ssh-rsa public keys that were signed with SHA-1
+              are disabled by default now
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              These can be re-enabled, see the
+              <link xlink:href="https://www.openssh.com/txt/release-8.8">OpenSSH
+              changelog</link> for details
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-new-services">
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -6,6 +6,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 ## Highlights {#sec-release-21.11-highlights}

+- Nix has been updated to version 2.4, reference its [release notes](https://discourse.nixos.org/t/nix-2-4-released/15822) for more information on what has changed. The previous version of Nix, 2.3.16, remains available for the time being in the `nix_2_3` package.
+
 - `iptables` now uses `nf_tables` backend.

 - PHP now defaults to PHP 8.0, updated from 7.4.
@ -44,6 +46,10 @@ In addition to numerous new and upgraded packages, this release has the followin
  - building LXD images from configurations is now directly possible with just nixpkgs
  - hydra is now building nixOS LXD images that can be used standalone with full nixos-rebuild support

+- OpenSSH was updated to version 8.8p1
+  - This breaks connections to old SSH daemons as ssh-rsa host keys and ssh-rsa public keys that were signed with SHA-1 are disabled by default now
+  - These can be re-enabled, see the [OpenSSH changelog](https://www.openssh.com/txt/release-8.8) for details
+
 ## New Services {#sec-release-21.11-new-services}

 - [btrbk](https://digint.ch/btrbk/index.html), a backup tool for btrfs subvolumes, taking advantage of btrfs specific capabilities to create atomic snapshots and transfer them incrementally to your backup locations. Available as [services.btrbk](options.html#opt-services.brtbk.instances).
--- a/nixos/maintainers/scripts/ec2/create-amis.sh
+++ b/nixos/maintainers/scripts/ec2/create-amis.sh
@ -65,13 +65,18 @@ read_image_info() {
 # We handle a single image per invocation, store all attributes in
 # globals for convenience.
 zfs_disks=$(read_image_info .disks)
-image_label="$(read_image_info .label)${zfs_disks:+-ZFS}"
+is_zfs_image=
+if jq -e .boot <<< "$zfs_disks"; then
+  is_zfs_image=1
+  zfs_boot=".disks.boot"
+fi
+image_label="$(read_image_info .label)${is_zfs_image:+-ZFS}"
 image_system=$(read_image_info .system)
-image_files=( $(read_image_info "${zfs_disks:+.disks.root}.file") )
+image_files=( $(read_image_info ".disks.root.file") )

-image_logical_bytes=$(read_image_info "${zfs_disks:+.disks.boot}.logical_bytes")
+image_logical_bytes=$(read_image_info "${zfs_boot:-.disks.root}.logical_bytes")

-if [[ -n "$zfs_disks" ]]; then
+if [[ -n "$is_zfs_image" ]]; then
  image_files+=( $(read_image_info .disks.boot.file) )
 fi

@ -192,7 +197,7 @@ upload_image() {
    for image_file in "${image_files[@]}"; do
        local aws_path=${image_file#/}

-        if [[ -n "$zfs_disks" ]]; then
+        if [[ -n "$is_zfs_image" ]]; then
            local suffix=${image_file%.*}
            suffix=${suffix##*.}
        fi
@ -239,7 +244,7 @@ upload_image() {
            "DeviceName=/dev/xvda,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp3}"
        )

-        if [[ -n "$zfs_disks" ]]; then
+        if [[ -n "$is_zfs_image" ]]; then
            local root_snapshot_id=$(read_state "$region.$image_label.root.$image_system" snapshot_id)

            local root_image_logical_bytes=$(read_image_info ".disks.root.logical_bytes")
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/nzp4m3cmm7wawk031byh8jg4cdzjq212-nix-2.3.16";
-  i686-linux = "/nix/store/zsaza9pwim617ak15fsc31lv65b9w3in-nix-2.3.16";
-  aarch64-linux = "/nix/store/7f6z40gyd405yd50qkyzwilnqw106bx8-nix-2.3.16";
-  x86_64-darwin = "/nix/store/c43kyri67ia8mibs0id5ara7gqwlkybf-nix-2.3.16";
-  aarch64-darwin = "/nix/store/6jwhak3cvsgnbqs540n27g8pxnk427fr-nix-2.3.16";
+  x86_64-linux = "/nix/store/hapw7q1fkjxvprnkcgw9ppczavg4daj2-nix-2.4";
+  i686-linux = "/nix/store/8qlvh8pp5j8wgrzj3is2jlbhgrwgsiy9-nix-2.4";
+  aarch64-linux = "/nix/store/h48lkygcqj4hdibbdnpl67q7ks6vkrd6-nix-2.4";
+  x86_64-darwin = "/nix/store/c3mvzszvyzakvcp9spnjvsb8m2bpjk7m-nix-2.4";
+  aarch64-darwin = "/nix/store/hbfqs62r0hga2yr4zi5kc7fzhf71bq9n-nix-2.4";
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -685,6 +685,7 @@
  ./services/networking/3proxy.nix
  ./services/networking/adguardhome.nix
  ./services/networking/amuled.nix
+  ./services/networking/antennas.nix
  ./services/networking/aria2.nix
  ./services/networking/asterisk.nix
  ./services/networking/atftpd.nix
--- a/nixos/modules/services/networking/antennas.nix
+++ b/nixos/modules/services/networking/antennas.nix
@ -0,0 +1,80 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.services.antennas;
+in
+
+{
+  options = {
+    services.antennas = {
+      enable = mkEnableOption "Antennas";
+
+      tvheadendUrl = mkOption {
+        type        = types.str;
+        default     = "http://localhost:9981";
+        description = "URL of Tvheadend.";
+      };
+
+      antennasUrl = mkOption {
+        type        = types.str;
+        default     = "http://127.0.0.1:5004";
+        description = "URL of Antennas.";
+      };
+
+      tunerCount = mkOption {
+        type        = types.int;
+        default     = 6;
+        description = "Numbers of tuners in tvheadend.";
+      };
+
+      deviceUUID = mkOption {
+        type        = types.str;
+        default     = "2f70c0d7-90a3-4429-8275-cbeeee9cd605";
+        description = "Device tuner UUID. Change this if you are running multiple instances.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.antennas = {
+      description = "Antennas HDHomeRun emulator for Tvheadend. ";
+      wantedBy    = [ "multi-user.target" ];
+
+      # Config
+      environment = {
+        TVHEADEND_URL = cfg.tvheadendUrl;
+        ANTENNAS_URL = cfg.antennasUrl;
+        TUNER_COUNT = toString cfg.tunerCount;
+        DEVICE_UUID = cfg.deviceUUID;
+      };
+
+      serviceConfig = {
+         ExecStart = "${pkgs.antennas}/bin/antennas";
+
+        # Antennas expects all resources like html and config to be relative to it's working directory
+        WorkingDirectory = "${pkgs.antennas}/libexec/antennas/deps/antennas/";
+
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DynamicUser = true;
+        LockPersonality = true;
+        ProcSubset = "pid";
+        PrivateDevices = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+      };
+    };
+  };
+}
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@ -289,13 +289,13 @@ in
            };

            chroot = mkOption {
-              default = true;
+              default = false;
              type = types.bool;
              description = ''
                Change process root directory to the directory where the config file is located (/etc/tinc/netname/), for added security.
                The chroot is performed after all the initialization is done, after writing pid files and opening network sockets.

-                Note that tinc can't run scripts anymore (such as tinc-down or host-up), unless it is setup to be runnable inside chroot environment.
+                Note that this currently breaks dns resolution and tinc can't run scripts anymore (such as tinc-down or host-up), unless it is setup to be runnable inside chroot environment.
              '';
            };

--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -1012,6 +1012,7 @@ in
        # Tor cannot currently bind privileged port when PrivateUsers=true,
        # see https://gitlab.torproject.org/legacy/trac/-/issues/20930
        PrivateUsers = !bindsPrivilegedPort;
+        ProcSubset = "pid";
        ProtectClock = true;
        ProtectControlGroups = true;
        ProtectHome = true;
@ -1019,6 +1020,7 @@ in
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
        ProtectSystem = "strict";
        RemoveIPC = true;
        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ];
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@ -248,6 +248,7 @@ in {
        description = ''
          List of systems to emulate. Will also configure Nix to
          support your new systems.
+          Warning: the builder can execute all emulated systems within the same build, which introduces impurities in the case of cross compilation.
        '';
        type = types.listOf types.str;
      };
--- a/pkgs/applications/audio/ChowKick/default.nix
+++ b/pkgs/applications/audio/ChowKick/default.nix
@ -0,0 +1,106 @@
+{ alsa-lib
+, at-spi2-core
+, brotli
+, cmake
+, curl
+, dbus
+, epoxy
+, fetchFromGitHub
+, freeglut
+, freetype
+, gtk2-x11
+, lib
+, libGL
+, libXcursor
+, libXdmcp
+, libXext
+, libXinerama
+, libXrandr
+, libXtst
+, libdatrie
+, libjack2
+, libpsl
+, libselinux
+, libsepol
+, libsysprof-capture
+, libthai
+, libxkbcommon
+, lv2
+, pcre
+, pkg-config
+, python3
+, sqlite
+, stdenv
+, util-linuxMinimal
+, webkitgtk
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ChowKick";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "Chowdhury-DSP";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0amnp0p7ckbbr9dcbdnld1ryv46kvza2dj8m6hzmi7c1s4df8x5q";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+  buildInputs = [
+    alsa-lib
+    at-spi2-core
+    brotli
+    curl
+    dbus
+    epoxy
+    freeglut
+    freetype
+    gtk2-x11
+    libGL
+    libXcursor
+    libXdmcp
+    libXext
+    libXinerama
+    libXrandr
+    libXtst
+    libdatrie
+    libjack2
+    libpsl
+    libselinux
+    libsepol
+    libsysprof-capture
+    libthai
+    libxkbcommon
+    lv2
+    pcre
+    python3
+    sqlite
+    util-linuxMinimal
+    webkitgtk
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_AR=${stdenv.cc.cc}/bin/gcc-ar"
+    "-DCMAKE_RANLIB=${stdenv.cc.cc}/bin/gcc-ranlib"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/lib/lv2 $out/lib/vst3 $out/bin
+    cp -r ChowKick_artefacts/Release/LV2//${pname}.lv2 $out/lib/lv2
+    cp -r ChowKick_artefacts/Release/VST3/${pname}.vst3 $out/lib/vst3
+    cp ChowKick_artefacts/Release/Standalone/${pname}  $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/Chowdhury-DSP/ChowKick";
+    description = "Kick synthesizer based on old-school drum machine circuits";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ magnetophon ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/aumix/default.nix
+++ b/pkgs/applications/audio/aumix/default.nix
@ -4,12 +4,10 @@
 , gettext
 , ncurses
 , gtkGUI ? false
-, pkg-config ? null
-, gtk2 ? null
+, pkg-config
+, gtk2
 }:

-assert gtkGUI -> pkg-config != null && gtk2 != null;
-
 stdenv.mkDerivation rec {
  pname = "aumix";
  version = "2.9.1";
@ -22,16 +20,15 @@ stdenv.mkDerivation rec {
  buildInputs = [ gettext ncurses ]
    ++ lib.optionals gtkGUI [ pkg-config gtk2 ];

-  meta = {
+  meta = with lib; {
    description = "Audio mixer for X and the console";
    longDescription = ''
      Aumix adjusts an audio mixer from X, the console, a terminal,
      the command line or a script.
    '';
    homepage = "http://www.jpj.net/~trevor/aumix.html";
-    license = lib.licenses.gpl2Plus;
-
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/zrythm/default.nix
+++ b/pkgs/applications/audio/zrythm/default.nix
@ -0,0 +1,169 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, SDL2
+, alsa-lib
+, libaudec
+, bash
+, bash-completion
+, breeze-icons
+, carla
+, chromaprint
+, cmake
+, curl
+, dconf
+, epoxy
+, ffmpeg
+, fftw
+, fftwFloat
+, flex
+, glib
+, gtk3
+, gtksourceview3
+, guile
+, graphviz
+, help2man
+, json-glib
+, jq
+, libbacktrace
+, libcyaml
+, libgtop
+, libjack2
+, libpulseaudio
+, libsamplerate
+, libsndfile
+, libsoundio
+, libxml2
+, libyaml
+, lilv
+, lv2
+, meson
+, ninja
+, pandoc
+, pcre
+, pcre2
+, pkg-config
+, python3
+, reproc
+, rtaudio
+, rtmidi
+, rubberband
+, serd
+, sord
+, sratom
+, texi2html
+, wrapGAppsHook
+, xdg-utils
+, xxHash
+, vamp-plugin-sdk
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "zrythm";
+  version = "1.0.0-alpha.26.0.13";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-dkXlkJ+qlfxV9Bv2UvZZa2iRVm8tgpK4JxkWL2Jeq48=";
+  };
+
+  nativeBuildInputs = [
+    help2man
+    jq
+    libaudec
+    libxml2
+    meson
+    ninja
+    pandoc
+    pkg-config
+    python3
+    python3.pkgs.sphinx
+    texi2html
+    wrapGAppsHook
+    cmake
+  ];
+
+  buildInputs = [
+    SDL2
+    alsa-lib
+    bash-completion
+    carla
+    chromaprint
+    curl
+    dconf
+    epoxy
+    ffmpeg
+    fftw
+    fftwFloat
+    flex
+    breeze-icons
+    glib
+    gtk3
+    gtksourceview3
+    graphviz
+    guile
+    json-glib
+    libbacktrace
+    libcyaml
+    libgtop
+    libjack2
+    libpulseaudio
+    libsamplerate
+    libsndfile
+    libsoundio
+    libyaml
+    lilv
+    lv2
+    pcre
+    pcre2
+    reproc
+    rtaudio
+    rtmidi
+    rubberband
+    serd
+    sord
+    sratom
+    vamp-plugin-sdk
+    xdg-utils
+    xxHash
+    zstd
+  ];
+
+  mesonFlags = [
+    "-Denable_ffmpeg=true"
+    "-Denable_rtmidi=true"
+    "-Denable_rtaudio=true"
+    "-Denable_sdl=true"
+    "-Dmanpage=true"
+    # "-Duser_manual=true" # needs sphinx-intl
+    "-Dlsp_dsp=disabled"
+    "-Db_lto=false"
+  ];
+
+  NIX_LDFLAGS = ''
+    -lfftw3_threads -lfftw3f_threads
+  '';
+
+  postPatch = ''
+    chmod +x scripts/meson-post-install.sh
+    patchShebangs ext/sh-manpage-completions/run.sh scripts/generic_guile_wrap.sh \
+      scripts/meson-post-install.sh tools/check_have_unlimited_memlock.sh
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix GSETTINGS_SCHEMA_DIR : "$out/share/gsettings-schemas/${pname}-${version}/glib-2.0/schemas/"
+    )
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.zrythm.org";
+    description = "Highly automated and intuitive digital audio workstation";
+    maintainers = with maintainers; [ tshaynik magnetophon ];
+    platforms = platforms.linux;
+    license = licenses.agpl3Plus;
+  };
+}
--- a/pkgs/applications/editors/emacs/elisp-packages/session-management-for-emacs/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/session-management-for-emacs/default.nix
@ -16,12 +16,14 @@ stdenv.mkDerivation rec {
    cp lisp/*.el "$out/share/emacs/site-lisp/"
  '';

-  meta = {
-    # installation: add to your ~/.emacs
-    #  (require 'session)
-    #  (add-hook 'after-init-hook 'session-initialize)
+  meta = with lib; {
+    /* installation: add to your ~/.emacs
+      (require 'session)
+      (add-hook 'after-init-hook 'session-initialize)
+    */
    description = "Small session management for emacs";
    homepage = "http://emacs-session.sourceforge.net/";
-    license = "GPL";
+    license = license.gpl;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@ -2,17 +2,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "helix";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "helix-editor";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-lScMHZ/pLcHkuvv8kSKnYK5AFVxyhOUMFdsu3nlDVD0=";
+    sha256 = "sha256-NoVg/8oJIgMQtxlCSjrLnYCG8shigYqZzWAQwmiqxgA=";
  };

-  cargoSha256 = "sha256-N5vlPoYyksHEZsyia8u8qtoEBY6qsXqO9CRBFaTQmiw=";
+  cargoSha256 = "sha256-kqPI8WpGpr0VL7CbBTSsjKl3xqJrv/6Qjr6UFnIgaVo=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/graphics/gpicview/default.nix
+++ b/pkgs/applications/graphics/gpicview/default.nix
@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
    })
  ];

+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ intltool gtk2 ];
+
  meta = with lib; {
    description = "A simple and fast image viewer for X";
    homepage = "http://lxde.sourceforge.net/gpicview/";
@ -24,7 +28,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ lovek323 ];
    platforms = platforms.unix;
  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ intltool gtk2 ];
 }
--- a/pkgs/applications/graphics/gqview/default.nix
+++ b/pkgs/applications/graphics/gqview/default.nix
@ -1,10 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, gtk2, libpng }:

-assert pkg-config != null && gtk2 != null && libpng != null;
-# Note that we cannot just copy gtk's png attribute, since gtk might
-# not be linked against png.
-# !!! assert libpng == gtk2.libpng;
-
 stdenv.mkDerivation rec {
  pname = "gqview";
  version = "2.1.5";
@ -15,6 +10,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ gtk2 libpng ];

  hardeningDisable = [ "format" ];
@ -26,5 +22,6 @@ stdenv.mkDerivation rec {
    homepage = "http://gqview.sourceforge.net";
    license = licenses.gpl2;
    platforms = platforms.unix;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/graphics/sane/xsane.nix
+++ b/pkgs/applications/graphics/sane/xsane.nix
@ -7,13 +7,11 @@
 , gtk2
 , pkg-config
 , libpng
-, libusb-compat-0_1 ? null
+, libusb-compat-0_1
 , gimpSupport ? false
-, gimp ? null
+, gimp
 }:

-assert gimpSupport -> gimp != null;
-
 stdenv.mkDerivation rec {
  pname = "xsane";
  version = "0.999";
@ -29,14 +27,15 @@ stdenv.mkDerivation rec {
  '';

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libpng sane-backends sane-frontends libX11 gtk2 ]
-    ++ (if libusb-compat-0_1 != null then [ libusb-compat-0_1 ] else [ ])
+
+  buildInputs = [ libpng libusb-compat-0_1 sane-backends sane-frontends libX11 gtk2 ]
    ++ lib.optional gimpSupport gimp;

-  meta = {
+  meta = with lib; {
    homepage = "http://www.sane-project.org/";
    description = "Graphical scanning frontend for sane";
-    license = lib.licenses.gpl2Plus;
-    platforms = with lib.platforms; linux;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/adobe-reader/default.nix
+++ b/pkgs/applications/misc/adobe-reader/default.nix
@ -13,28 +13,21 @@
 , gdk-pixbuf-xlib
 }:

-assert stdenv.hostPlatform.system == "i686-linux";
-
-let
-  baseVersion = "9.5.5";
-in
 stdenv.mkDerivation rec {
  pname = "adobe-reader";
-  version = "${baseVersion}-1";
+  version = "9.5.5";

+  # TODO: convert to phases
  builder = ./builder.sh;

  src = fetchurl {
-    url = "http://ardownload.adobe.com/pub/adobe/reader/unix/9.x/${baseVersion}/enu/AdbeRdr${version}_i486linux_enu.tar.bz2";
+    url = "http://ardownload.adobe.com/pub/adobe/reader/unix/9.x/${version}/enu/AdbeRdr${version}-1_i486linux_enu.tar.bz2";
    sha256 = "0h35misxrqkl5zlmmvray1bqf4ywczkm89n9qw7d9arqbg3aj3pf";
  };

  # !!! Adobe Reader contains copies of OpenSSL, libcurl, and libicu.
-  # We should probably remove those and use the regular Nixpkgs
-  # versions.
-
-  libPath = lib.makeLibraryPath
-    [ stdenv.cc.cc libX11 zlib libxml2 cups pango atk gtk2 glib gdk-pixbuf gdk-pixbuf-xlib ];
+  # We should probably remove those and use the regular Nixpkgs versions.
+  libPath = lib.makeLibraryPath [ stdenv.cc.cc libX11 zlib libxml2 cups pango atk gtk2 glib gdk-pixbuf gdk-pixbuf-xlib ];

  passthru.mozillaPlugin = "/libexec/adobe-reader/Browser/intellinux";

@ -46,5 +39,6 @@ stdenv.mkDerivation rec {
      "Numerous unresolved vulnerabilities"
      "See: https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader.html?vendor_id=53"
    ];
+    platforms = [ "i686-linux" ];
  };
 }
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@ -5,36 +5,34 @@
 , pkg-config
 , CoreAudio
 , enableAlsa ? true
-, alsa-lib ? null
+, alsa-lib
 , enableLibao ? true
-, libao ? null
+, libao
 , enableLame ? config.sox.enableLame or false
-, lame ? null
+, lame
 , enableLibmad ? true
-, libmad ? null
+, libmad
 , enableLibogg ? true
-, libogg ? null
-, libvorbis ? null
+, libogg
+, libvorbis
 , enableOpusfile ? true
-, opusfile ? null
+, opusfile
 , enableFLAC ? true
-, flac ? null
+, flac
 , enablePNG ? true
-, libpng ? null
+, libpng
 , enableLibsndfile ? true
-, libsndfile ? null
+, libsndfile
 , enableWavpack ? true
-, wavpack ? null
+, wavpack
  # amrnb and amrwb are unfree, disabled by default
 , enableAMR ? false
-, amrnb ? null
-, amrwb ? null
-, enableLibpulseaudio ? true
-, libpulseaudio ? null
+, amrnb
+, amrwb
+, enableLibpulseaudio ? stdenv.isLinux
+, libpulseaudio
 }:

-with lib;
-
 stdenv.mkDerivation rec {
  pname = "sox";
  version = "14.4.2";
@ -45,30 +43,30 @@ stdenv.mkDerivation rec {
  };

  # configure.ac uses pkg-config only to locate libopusfile
-  nativeBuildInputs = optional enableOpusfile pkg-config;
+  nativeBuildInputs = lib.optional enableOpusfile pkg-config;

  patches = [ ./0001-musl-rewind-pipe-workaround.patch ];

  buildInputs =
-    optional (enableAlsa && stdenv.isLinux) alsa-lib ++
-    optional enableLibao libao ++
-    optional enableLame lame ++
-    optional enableLibmad libmad ++
-    optionals enableLibogg [ libogg libvorbis ] ++
-    optional enableOpusfile opusfile ++
-    optional enableFLAC flac ++
-    optional enablePNG libpng ++
-    optional enableLibsndfile libsndfile ++
-    optional enableWavpack wavpack ++
-    optionals enableAMR [ amrnb amrwb ] ++
-    optional enableLibpulseaudio libpulseaudio ++
-    optional (stdenv.isDarwin) CoreAudio;
+    lib.optional (enableAlsa && stdenv.isLinux) alsa-lib
+    ++ lib.optional enableLibao libao
+    ++ lib.optional enableLame lame
+    ++ lib.optional enableLibmad libmad
+    ++ lib.optionals enableLibogg [ libogg libvorbis ]
+    ++ lib.optional enableOpusfile opusfile
+    ++ lib.optional enableFLAC flac
+    ++ lib.optional enablePNG libpng
+    ++ lib.optional enableLibsndfile libsndfile
+    ++ lib.optional enableWavpack wavpack
+    ++ lib.optionals enableAMR [ amrnb amrwb ]
+    ++ lib.optional enableLibpulseaudio libpulseaudio
+    ++ lib.optional stdenv.isDarwin CoreAudio;

-  meta = {
+  meta = with lib; {
    description = "Sample Rate Converter for audio";
    homepage = "http://sox.sourceforge.net/";
-    maintainers = [ lib.maintainers.marcweber ];
-    license = if enableAMR then lib.licenses.unfree else lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with maintainers; [ marcweber ];
+    license = if enableAMR then licenses.unfree else licenses.gpl2Plus;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonApplication, fetchPypi, requests, pytestCheckHook }:
+{ lib, buildPythonApplication, fetchPypi, requests, youtube-dl, pytestCheckHook }:

 buildPythonApplication rec {
  pname = "gallery_dl";
@ -9,7 +9,7 @@ buildPythonApplication rec {
    sha256 = "7fec9ac69582dbd9922666e6ece3142ae52dc9679a2c4a613f6ee94ad09e5f68";
  };

-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [ requests youtube-dl ];

  checkInputs = [ pytestCheckHook ];
  pytestFlagsArray = [
--- a/pkgs/applications/misc/garmin-plugin/default.nix
+++ b/pkgs/applications/misc/garmin-plugin/default.nix
@ -1,28 +1,39 @@
-{ lib, stdenv, fetchurl, garmintools, libgcrypt, libusb-compat-0_1, pkg-config, tinyxml, zlib }:
+{ lib, stdenv, fetchFromGitHub, garmintools, libgcrypt, libusb-compat-0_1, pkg-config, tinyxml, zlib }:
+
 stdenv.mkDerivation rec {
  pname = "garmin-plugin";
  version = "0.3.26";

-  src = fetchurl {
-    url = "https://github.com/adiesner/GarminPlugin/archive/V${version}.tar.gz";
-    sha256 = "15gads1fj4sj970m5960dgnhys41ksi4cm53ldkf67wn8dc9i4k0";
+  src = fetchFromGitHub {
+    owner = "adiesner";
+    repo = "GarminPlugin";
+    rev = "V${version}";
+    sha256 = "sha256-l0WAbEsQl1dCADf5gTepYjsA1rQCJMLcrTxRR4PfUus=";
  };
-  sourceRoot = "GarminPlugin-${version}/src";
+
+  preConfigure = ''
+    cd src
+  '';
+
  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [ garmintools libusb-compat-0_1 libgcrypt tinyxml zlib ];
+
  configureFlags = [
    "--with-libgcrypt-prefix=${libgcrypt.dev}"
    "--with-garmintools-incdir=${garmintools}/include"
    "--with-garmintools-libdir=${garmintools}/lib"
  ];
+
  installPhase = ''
    mkdir -p $out/lib/mozilla/plugins
    cp npGarminPlugin.so $out/lib/mozilla/plugins
  '';
-  meta = {
-    homepage = "http://www.andreas-diesner.de/garminplugin";
-    license = lib.licenses.gpl3;
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
+
+  meta = with lib; {
+    homepage = "https://adiesner.github.io/GarminPlugin/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/gkrellm/default.nix
+++ b/pkgs/applications/misc/gkrellm/default.nix
@ -15,8 +15,6 @@
 , wrapGAppsHook
 }:

-with lib;
-
 stdenv.mkDerivation rec {
  pname = "gkrellm";
  version = "2.3.11";
@ -28,7 +26,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ copyDesktopItems pkg-config which wrapGAppsHook ];
  buildInputs = [ gettext glib gtk2 libX11 libSM libICE ]
-    ++ optionals stdenv.isDarwin [ IOKit ];
+    ++ lib.optionals stdenv.isDarwin [ IOKit ];

  hardeningDisable = [ "format" ];

@ -62,7 +60,7 @@ stdenv.mkDerivation rec {
    })
  ];

-  meta = {
+  meta = with lib; {
    description = "Themeable process stack of system monitors";
    longDescription = ''
      GKrellM is a single process stack of system monitors which
--- a/pkgs/applications/misc/jigdo/default.nix
+++ b/pkgs/applications/misc/jigdo/default.nix
@ -4,7 +4,6 @@ stdenv.mkDerivation rec {
  pname = "jigdo";
  version = "0.7.3";

-  # Debian sources
  src = fetchurl {
    url = "http://ftp.de.debian.org/debian/pool/main/j/jigdo/jigdo_${version}.orig.tar.gz";
    sha256 = "1qvqzgzb0dzq82fa1ffs6hyij655rajnfwkljk1y0mnkygnha1xv";
@ -22,10 +21,11 @@ stdenv.mkDerivation rec {

  configureFlags = [ "--without-libdb" ];

-  meta = {
+  meta = with lib; {
    description = "Download utility that can fetch files from several sources simultaneously";
-    homepage = "http://atterer.net/jigdo/";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.unix;
+    homepage = "http://atterer.org/jigdo/";
+    license = licenses.gpl2Only;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/loxodo/default.nix
+++ b/pkgs/applications/misc/loxodo/default.nix
@ -1,19 +1,17 @@
-{ lib, python27Packages, fetchgit }:
-let
-  py = python27Packages;
-  python = py.python;
-in
-py.buildPythonApplication {
-  pname = "loxodo";
-  version = "0.20150124";
+{ lib, python2, fetchFromGitHub }:

-  src = fetchgit {
-    url = "https://github.com/sommer/loxodo.git";
+python2.pkgs.buildPythonApplication {
+  pname = "loxodo";
+  version = "unstable-2015-01-24";
+
+  src = fetchFromGitHub {
+    owner = "sommer";
+    repo = "loxodo";
    rev = "6c56efb4511fd6f645ad0f8eb3deafc8071c5795";
    sha256 = "1cg0dfcv57ps54f1a0ksib7hgkrbdi9q699w302xyyfyvjcb5dd2";
  };

-  propagatedBuildInputs = with py; [ wxPython ];
+  propagatedBuildInputs = with python2.pkgs; [ wxPython ];

  postInstall = ''
    mv $out/bin/loxodo.py $out/bin/loxodo
@ -22,7 +20,7 @@ py.buildPythonApplication {
    [Desktop Entry]
    Type=Application
    Exec=$out/bin/loxodo
-    Icon=$out/lib/${python.libPrefix}/site-packages/resources/loxodo-icon.png
+    Icon=$out/lib/${python2.libPrefix}/site-packages/resources/loxodo-icon.png
    Name=Loxodo
    GenericName=Password Vault
    Categories=Application;Other;
@ -34,5 +32,6 @@ py.buildPythonApplication {
    homepage = "https://www.christoph-sommer.de/loxodo/";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/misc/metar/default.nix
+++ b/pkgs/applications/misc/metar/default.nix
@ -1,11 +1,12 @@
-{ lib, stdenv, fetchgit, curl }:
+{ lib, stdenv, fetchFromGitHub, curl }:

 stdenv.mkDerivation {
  pname = "metar";
-  version = "20161013.1";
+  version = "unstable-2017-02-17";

-  src = fetchgit {
-    url = "https://github.com/keesL/metar.git";
+  src = fetchFromGitHub {
+    owner = "keesL";
+    repo = "metar";
    rev = "20e9ca69faea330f6c2493b6829131c24cb55147";
    sha256 = "1fgrlnpasqf1ihh9y6zy6mzzybqx0lxvh7gmv03rjdb55dr42dxj";
  };
@ -14,8 +15,6 @@ stdenv.mkDerivation {

  meta = with lib; {
    homepage = "https://github.com/keesL/metar";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.zalakain ];
    description = "Downloads weather reports and optionally decodes them";
    longDescription = ''
      METAR reports are meteorogical weather reports for aviation. Metar is a small
@ -27,5 +26,7 @@ stdenv.mkDerivation {
      more work in the area of clouds need to be done, as support for Cumulus or
      Cumulunimbus is not yet decoded.
    '';
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ zalakain ];
  };
 }
--- a/pkgs/applications/misc/nwg-launchers/default.nix
+++ b/pkgs/applications/misc/nwg-launchers/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "nwg-launchers";
-  version = "0.5.0";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ZtlAs7McVQKH626h2iOhjpVaiEHeaqs9ncZ6/KnGibg=";
+    sha256 = "sha256-QWDYy0TBxoYxfRAOtAEVM8wsPUi2SnzMXsu38guAURU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/procmail/default.nix
+++ b/pkgs/applications/misc/procmail/default.nix
@ -4,6 +4,11 @@ stdenv.mkDerivation rec {
  pname = "procmail";
  version = "3.22";

+  src = fetchurl {
+    url = "ftp://ftp.fu-berlin.de/pub/unix/mail/procmail/procmail-${version}.tar.gz";
+    sha256 = "05z1c803n5cppkcq99vkyd5myff904lf9sdgynfqngfk9nrpaz08";
+  };
+
  patches = [
    ./CVE-2014-3618.patch
    (fetchurl {
@ -16,20 +21,16 @@ stdenv.mkDerivation rec {
  # getline is defined differently in glibc now. So rename it.
  # Without the .PHONY target "make install" won't install anything on Darwin.
  postPatch = ''
-        sed -e "s%^RM.*$%#%" -i Makefile
-        sed -e "s%^BASENAME.*%\BASENAME=$out%" -i Makefile
-        sed -e "s%^LIBS=.*%LIBS=-lm%" -i Makefile
-        sed -e "s%getline%thisgetline%g" -i src/*.c src/*.h
-        sed -e "3i\
+    sed -i Makefile \
+      -e "s%^RM.*$%#%" \
+      -e "s%^BASENAME.*%\BASENAME=$out%" \
+      -e "s%^LIBS=.*%LIBS=-lm%"
+    sed -e "s%getline%thisgetline%g" -i src/*.c src/*.h
+    sed -e "3i\
    .PHONY: install
    " -i Makefile
  '';

-  src = fetchurl {
-    url = "ftp://ftp.fu-berlin.de/pub/unix/mail/procmail/procmail-${version}.tar.gz";
-    sha256 = "05z1c803n5cppkcq99vkyd5myff904lf9sdgynfqngfk9nrpaz08";
-  };
-
  meta = with lib; {
    description = "Mail processing and filtering utility";
    homepage = "http://www.procmail.org/";
--- a/pkgs/applications/misc/rofi-menugen/default.nix
+++ b/pkgs/applications/misc/rofi-menugen/default.nix
@ -1,26 +1,28 @@
 { lib, stdenv, fetchFromGitHub, rofi, gnused }:

 stdenv.mkDerivation rec {
-  rev = "168efd2608fdb88b1aff3e0244bda8402169f207";
  pname = "rofi-menugen";
-  version = "unstable-2015-12-28-${builtins.substring 0 7 rev}";
+  version = "unstable-2015-12-28";

  src = fetchFromGitHub {
    owner = "octotep";
    repo = "menugen";
-    inherit rev;
+    rev = "168efd2608fdb88b1aff3e0244bda8402169f207";
    sha256 = "09fk9i6crw772qlc5zld35pcff1jq4jcag0syial2q000fbpjx5m";
  };
-  patchPhase = ''
+
+  postPatch = ''
    sed -i -e "s|menugenbase|$out/bin/rofi-menugenbase|" menugen
    sed -i -e "s|rofi |${rofi}/bin/rofi |" menugen
    sed -i -e "s|sed |${gnused}/bin/sed |" menugenbase
  '';
+
  installPhase = ''
    mkdir -p $out/bin
    cp menugen $out/bin/rofi-menugen
    cp menugenbase $out/bin/rofi-menugenbase
  '';
+
  meta = with lib; {
    description = "Generates menu based applications using rofi";
    homepage = "https://github.com/octotep/menugen";
--- a/pkgs/applications/misc/stag/default.nix
+++ b/pkgs/applications/misc/stag/default.nix
@ -1,11 +1,12 @@
-{ lib, stdenv, fetchgit, curses }:
+{ lib, stdenv, fetchFromGitHub, curses }:

 stdenv.mkDerivation {
  pname = "stag";
  version = "1.0";

-  src = fetchgit {
-    url = "https://github.com/seenaburns/stag.git";
+  src = fetchFromGitHub {
+    owner = "seenaburns";
+    repo = "stag";
    rev = "90e2964959ea8242349250640d24cee3d1966ad6";
    sha256 = "1yrzjhcwrxrxq5jj695wvpgb0pz047m88yq5n5ymkcw5qr78fy1v";
  };
@ -16,11 +17,11 @@ stdenv.mkDerivation {
    make install PREFIX=$out
  '';

-  meta = {
+  meta = with lib; {
    homepage = "https://github.com/seenaburns/stag";
    description = "Terminal streaming bar graph passed through stdin";
-    license = lib.licenses.bsdOriginal;
-    maintainers = [ lib.maintainers.matthiasbeyer ];
-    platforms = lib.platforms.unix;
+    license = licenses.bsdOriginal;
+    maintainers = with maintainers; [ matthiasbeyer ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/xfontsel/default.nix
+++ b/pkgs/applications/misc/xfontsel/default.nix
@ -3,6 +3,7 @@
 # That is why this expression is not inside pkgs.xorg

 { lib, stdenv, fetchurl, makeWrapper, libX11, pkg-config, libXaw }:
+
 stdenv.mkDerivation rec {
  pname = "xfontsel";
  version = "1.0.6";
@ -13,6 +14,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config makeWrapper ];
+
  buildInputs = [ libX11 libXaw ];

  # Without this, it gets Xmu as a dependency, but without rpath entry
@ -27,11 +29,11 @@ stdenv.mkDerivation rec {
      --set XAPPLRESDIR $out/share/X11/app-defaults
  '';

-  meta = {
+  meta = with lib; {
    homepage = "https://www.x.org/";
    description = "Allows testing the fonts available in an X server";
-    license = lib.licenses.free;
-    maintainers = with lib.maintainers; [ viric ];
-    platforms = with lib.platforms; linux ++ darwin;
+    license = licenses.free;
+    maintainers = with maintainers; [ viric ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/xxkb/default.nix
+++ b/pkgs/applications/misc/xxkb/default.nix
@ -14,9 +14,6 @@
 , pkg-config
 }:

-assert svgSupport ->
-librsvg != null && glib != null && gdk-pixbuf != null && pkg-config != null;
-
 stdenv.mkDerivation rec {
  pname = "xxkb";
  version = "1.11.1";
@ -27,6 +24,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ imake gccmakedep ];
+
  buildInputs = [
    libX11
    libXt
@ -49,11 +47,11 @@ stdenv.mkDerivation rec {

  installTargets = [ "install" "install.man" ];

-  meta = {
+  meta = with lib; {
    description = "A keyboard layout indicator and switcher";
    homepage = "http://xxkb.sourceforge.net/";
-    license = lib.licenses.artistic2;
-    maintainers = with lib.maintainers; [ rasendubi ];
-    platforms = lib.platforms.linux;
+    license = licenses.artistic2;
+    maintainers = with maintainers; [ rasendubi ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -87,7 +87,7 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "10.5.10";
+  version = "11.0";

  lang = "en-US";

@ -97,7 +97,7 @@ let
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      sha256 = "0mvclh2f2lqj5kf98p0xdbaa6wxshwb8dkcna5sl561cw8nnayc2";
+      sha256 = "0938a9yjfg9qa9rv5acrmbgqq11mc8j0pvl1n64jrdz29crk6sj2";
    };

    i686-linux = fetchurl {
@ -105,7 +105,7 @@ let
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      sha256 = "1g714abhh3ynmparb516z5syl7i64n7s5mga0zxb4598bhzi5zkg";
+      sha256 = "07v1ca66a69jl238qdq81mw654yffrcyq685y4rvv8xvx11fnzzp";
    };
  };
 in
--- a/pkgs/applications/networking/cluster/terranix/default.nix
+++ b/pkgs/applications/networking/cluster/terranix/default.nix
@ -1,26 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, ... }:
+{ stdenv, lib, fetchFromGitHub, jq, nix, ... }:

 stdenv.mkDerivation rec {
  pname = "terranix";
-  version = "2.4.0";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "mrVanDalo";
    repo = "terranix";
    rev = version;
-    sha256 = "sha256-3N4a5VhZqIgJW11w8oJKJ9T8mhfwEM33kEwV/zZkCs8=";
+    sha256 = "sha256-HDiyJGgyDUoLnpL8N+wDm3cM/vEfYYc/p4N1kKH/kLk=";
  };

  installPhase = ''
-    mkdir -p $out
+    mkdir -p $out/{bin,core,modules,lib}
    mv bin core modules lib $out/
+
+    mv $out/bin/terranix-doc-json $out/bin/.wrapper_terranix-doc-json
+
+    # manual wrapper because makeWrapper expectes executables
+    wrapper=$out/bin/terranix-doc-json
+    cat <<EOF>$wrapper
+    #!/usr/bin/env bash
+    export PATH=$PATH:${jq}/bin:${nix}/bin
+    $out/bin/.wrapper_terranix-doc-json "\$@"
+    EOF
+    chmod +x $wrapper
  '';

  meta = with lib; {
    description = "A NixOS like terraform-json generator";
    homepage = "https://terranix.org";
    license = licenses.gpl3;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ mrVanDalo ];
  };

--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@ -26,8 +26,8 @@ in stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoreconfHook pkg-config texinfo ];

-  configureFlags =
-    [ "--sysconfdir=/etc" ] ++ lib.optional stdenv.isDarwin [ "--with-macosx-keyring" ];
+  configureFlags = [ "--sysconfdir=/etc" "--with-libgsasl" ]
+    ++ lib.optional stdenv.isDarwin [ "--with-macosx-keyring" ];

  postInstall = ''
    install -d $out/share/doc/${pname}/scripts
--- a/pkgs/applications/radio/kalibrate-rtl/default.nix
+++ b/pkgs/applications/radio/kalibrate-rtl/default.nix
@ -1,18 +1,18 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, fftw, rtl-sdr, libusb1 }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, fftw, rtl-sdr, libusb1 }:

 stdenv.mkDerivation {
  pname = "kalibrate-rtl";
-  version = "2013-12-14";
+  version = "unstable-2013-12-14";

-  # There are no tags/releases, so use the latest commit from git master.
-  # Currently, the latest commit is from 2013-12-14.
-  src = fetchgit {
-    url = "https://github.com/steve-m/kalibrate-rtl.git";
+  src = fetchFromGitHub {
+    owner = "steve-m";
+    repo = "kalibrate-rtl";
    rev = "aae11c8a8dc79692a94ccfee39ba01e8c8c05d38";
    sha256 = "1spbfflkqnw9s8317ppsf7b1nnkicqsmaqsnz1zf8i49ix70i6kn";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
+
  buildInputs = [ fftw rtl-sdr libusb1 ];

  meta = with lib; {
@ -27,6 +27,6 @@ stdenv.mkDerivation {
    homepage = "https://github.com/steve-m/kalibrate-rtl";
    license = licenses.bsd2;
    platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
+    maintainers = with maintainers; [ bjornfor ];
  };
 }
--- a/pkgs/applications/science/logic/prover9/default.nix
+++ b/pkgs/applications/science/logic/prover9/default.nix
@ -11,7 +11,7 @@ stdenv.mkDerivation {

  hardeningDisable = [ "format" ];

-  patchPhase = ''
+  postPatch = ''
    RM=$(type -tp rm)
    MV=$(type -tp mv)
    CP=$(type -tp cp)
@ -31,16 +31,16 @@ stdenv.mkDerivation {
    cp bin/* $out/bin
  '';

-  meta = {
+  meta = with lib; {
    homepage = "https://www.cs.unm.edu/~mccune/mace4/";
-    license = "GPL";
+    license = licenses.gpl1;
    description = "Automated theorem prover for first-order and equational logic";
    longDescription = ''
      Prover9 is a resolution/paramodulation automated theorem prover
      for first-order and equational logic. Prover9 is a successor of
      the Otter Prover. This is the LADR command-line version.
    '';
-    platforms = lib.platforms.linux;
-    maintainers = [ ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/science/logic/redprl/default.nix
+++ b/pkgs/applications/science/logic/redprl/default.nix
@ -1,25 +1,32 @@
-{ lib, stdenv, fetchgit, mlton }:
+{ lib, stdenv, fetchFromGitHub, mlton }:
+
 stdenv.mkDerivation {
  pname = "redprl";
  version = "unstable-2017-03-28";

-  src = fetchgit {
-    url = "https://github.com/RedPRL/sml-redprl.git";
+  src = fetchFromGitHub {
+    owner = "RedPRL";
+    repo = "sml-redprl";
    rev = "bdf027de732e4a8d10f9f954389dfff0c822f18b";
-    sha256 = "0cihwnd78d3ksxp6mppifm7xpi3fsii5mixvicajy87ggw8z305c";
    fetchSubmodules = true;
+    sha256 = "0cihwnd78d3ksxp6mppifm7xpi3fsii5mixvicajy87ggw8z305c";
  };
+
  buildInputs = [ mlton ];
-  patchPhase = ''
+
+  postPatch = ''
    patchShebangs ./script/
  '';
+
  buildPhase = ''
    ./script/mlton.sh
  '';
+
  installPhase = ''
    mkdir -p $out/bin
    mv ./bin/redprl $out/bin
  '';
+
  meta = with lib; {
    description = "A proof assistant for Nominal Computational Type Theory";
    homepage = "http://www.redprl.org/";
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@ -1,13 +1,38 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, fetchurl, cmake, ctags, swig
-# data, compression
-, bzip2, curl, hdf5, json_c, xz, lzo, protobuf, snappy
-# maths
-, blas, lapack, eigen, nlopt, lp_solve, colpack, glpk
-# libraries
-, libarchive, libxml2
-# extra support
-, pythonSupport ? true, pythonPackages ? null
-, opencvSupport ? false, opencv ? null
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, fetchurl
+  # build
+, cmake
+, ctags
+, pythonPackages
+, swig
+  # math
+, eigen
+, blas
+, lapack
+, glpk
+  # data
+, protobuf
+, json_c
+, libxml2
+, hdf5
+, curl
+  # compression
+, libarchive
+, bzip2
+, xz
+, snappy
+, lzo
+  # more math
+, nlopt
+, lp_solve
+, colpack
+  # extra support
+, pythonSupport ? true
+, opencvSupport ? false
+, opencv ? null
 , withSvmLight ? false
 }:

@ -19,8 +44,10 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 let
  pname = "shogun";
  version = "6.1.4";
+
  rxcppVersion = "4.0.0";
  gtestVersion = "1.8.0";
+
  srcs = {
    toolbox = fetchFromGitHub {
      owner = pname + "-toolbox";
@ -29,7 +56,8 @@ let
      sha256 = "05s9dclmk7x5d7wnnj4qr6r6c827m72a44gizcv09lxr28pr9inz";
      fetchSubmodules = true;
    };
-    # we need the packed archive
+
+    # The CMake external projects expect the packed archives
    rxcpp = fetchurl {
      url = "https://github.com/Reactive-Extensions/RxCpp/archive/v${rxcppVersion}.tar.gz";
      sha256 = "0y2isr8dy2n1yjr9c5570kpc9lvdlch6jv0jvw000amwn5d3krsh";
@ -42,54 +70,90 @@ let
 in

 stdenv.mkDerivation rec {
-
  inherit pname version;

+  outputs = [ "out" "dev" "doc" ];
+
  src = srcs.toolbox;

-  postUnpack = ''
-    mkdir -p $sourceRoot/third_party/{rxcpp,gtest}
-    ln -s ${srcs.rxcpp} $sourceRoot/third_party/rxcpp/v${rxcppVersion}.tar.gz
-    ln -s ${srcs.gtest} $sourceRoot/third_party/gtest/release-${gtestVersion}.tar.gz
-  '';
-
-  # broken
-  doCheck = false;
-
  patches = [
+    # Fix compile errors with json-c
+    # https://github.com/shogun-toolbox/shogun/pull/4104
    (fetchpatch {
-      url = "https://github.com/awild82/shogun/commit/365ce4c4c700736d2eec8ba6c975327a5ac2cd9b.patch";
+      url = "https://github.com/shogun-toolbox/shogun/commit/365ce4c4c700736d2eec8ba6c975327a5ac2cd9b.patch";
      sha256 = "158hqv4xzw648pmjbwrhxjp7qcppqa7kvriif87gn3zdn711c49s";
    })
+
+    # Fix compile errors with GCC 9+
+    # https://github.com/shogun-toolbox/shogun/pull/4811
+    (fetchpatch {
+      url = "https://github.com/shogun-toolbox/shogun/commit/c8b670be4790e0f06804b048a6f3d77c17c3ee95.patch";
+      sha256 = "sha256-MxsR3Y2noFQevfqWK3nmX5iK4OVWeKBl5tfeDNgjcXk=";
+    })
+    (fetchpatch {
+      url = "https://github.com/shogun-toolbox/shogun/commit/5aceefd9fb0e2132c354b9a0c0ceb9160cc9b2f7.patch";
+      sha256 = "sha256-AgJJKQA8vc5oKaTQDqMdwBR4hT4sn9+uW0jLe7GteJw=";
+    })
+
+    # Fix compile errors with Eigen 3.4
+    ./eigen-3.4.patch
+
  ] ++ lib.optional (!withSvmLight) ./svmlight-scrubber.patch;

-  CCACHE_DISABLE="1";
-  CCACHE_DIR=".ccache";
+  nativeBuildInputs = [ cmake swig ctags ]
+    ++ (with pythonPackages; [ python jinja2 ply ]);

-  nativeBuildInputs = [ cmake ];
-  buildInputs = with lib; [
-      blas lapack bzip2 colpack curl ctags eigen hdf5 json_c lp_solve xz lzo
-      protobuf nlopt snappy swig (libarchive.dev) libxml2 lapack glpk
-    ]
-    ++ optionals (pythonSupport) (with pythonPackages; [ python ply numpy ])
-    ++ optional  (opencvSupport) opencv;
+  buildInputs = [
+    eigen
+    blas
+    lapack
+    glpk
+    protobuf
+    json_c
+    libxml2
+    hdf5
+    curl
+    libarchive
+    bzip2
+    xz
+    snappy
+    lzo
+    nlopt
+    lp_solve
+    colpack
+  ] ++ lib.optionals pythonSupport (with pythonPackages; [ python numpy ])
+    ++ lib.optional opencvSupport opencv;

-  NIX_CFLAGS_COMPILE="-faligned-new";
-
-  cmakeFlags =
-  let
-      onOff = b: if b then "ON" else "OFF";
-      flag = n: b: "-D"+n+"="+onOff b;
-  in
-  with lib; [
-    (flag "ENABLE_TESTING" doCheck)
-    (flag "BUILD_META_EXAMPLES" doCheck)
-    (flag "CMAKE_VERBOSE_MAKEFILE:BOOL" doCheck)
-    (flag "PythonModular" pythonSupport)
-    (flag "OpenCV" opencvSupport)
-    (flag "USE_SVMLIGHT" withSvmLight)
+  cmakeFlags = let
+    enableIf = cond: if cond then "ON" else "OFF";
+  in [
+    "-DBUILD_META_EXAMPLES=ON"
+    "-DCMAKE_DISABLE_FIND_PACKAGE_ARPACK=ON"
+    "-DCMAKE_DISABLE_FIND_PACKAGE_ARPREC=ON"
+    "-DCMAKE_DISABLE_FIND_PACKAGE_CPLEX=ON"
+    "-DCMAKE_DISABLE_FIND_PACKAGE_Mosek=ON"
+    "-DCMAKE_DISABLE_FIND_PACKAGE_TFLogger=ON"
+    "-DCMAKE_DISABLE_FIND_PACKAGE_ViennaCL=ON"
+    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+    "-DCMAKE_CTEST_ARGUMENTS='--exclude-regex;TrainedModelSerialization'"  # Sporadic segfault
+    "-DENABLE_TESTING=${enableIf doCheck}"
+    "-DDISABLE_META_INTEGRATION_TESTS=ON"
+    "-DTRAVIS_DISABLE_META_CPP=ON"
+    "-DPythonModular=${enableIf pythonSupport}"
+    "-DOpenCV=${enableIf opencvSupport}"
+    "-DUSE_SVMLIGHT=${enableIf withSvmLight}"
  ];

+  CXXFLAGS = "-faligned-new";
+
+  doCheck = true;
+
+  postUnpack = ''
+    mkdir -p $sourceRoot/third_party/{rxcpp,GoogleMock}
+    ln -s ${srcs.rxcpp} $sourceRoot/third_party/rxcpp/v${rxcppVersion}.tar.gz
+    ln -s ${srcs.gtest} $sourceRoot/third_party/GoogleMock/release-${gtestVersion}.tar.gz
+  '';
+
  postPatch = ''
    # Fix preprocessing SVMlight code
    sed -i \
@ -106,10 +170,17 @@ stdenv.mkDerivation rec {
    ./scripts/light-scrubber.sh
  '';

+  postInstall = ''
+    mkdir -p $doc/share/doc/shogun/examples
+    mv $out/share/shogun/examples/cpp $doc/share/doc/shogun/examples
+    cp ../examples/undocumented/libshogun/*.cpp $doc/share/doc/shogun/examples/cpp
+    rm -r $out/share
+  '';
+
  meta = with lib; {
    description = "A toolbox which offers a wide range of efficient and unified machine learning methods";
    homepage = "http://shogun-toolbox.org/";
    license = if withSvmLight then licenses.unfree else licenses.gpl3Plus;
-    maintainers = with maintainers; [ edwtjo ];
+    maintainers = with maintainers; [ edwtjo smancill ];
  };
 }
--- a/pkgs/applications/science/machine-learning/shogun/eigen-3.4.patch
+++ b/pkgs/applications/science/machine-learning/shogun/eigen-3.4.patch
@ -0,0 +1,74 @@
+From: Sebastián Mancilla <smancill@smancill.dev>
+Subject: [PATCH] Fix compile errors when using Eigen 3.4
+
+---
+ .../machine/gp/MultiLaplaceInferenceMethod.cpp | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/src/shogun/machine/gp/MultiLaplaceInferenceMethod.cpp b/src/shogun/machine/gp/MultiLaplaceInferenceMethod.cpp
+index 2e27678d2..60050afea 100644
+--- a/src/shogun/machine/gp/MultiLaplaceInferenceMethod.cpp
+++ b/src/shogun/machine/gp/MultiLaplaceInferenceMethod.cpp
+@@ -84,9 +84,9 @@ class CMultiPsiLine : public func_base
+ 		float64_t result=0;
+ 		for(index_t bl=0; bl<C; bl++)
+ 		{
+-			eigen_f.block(bl*n,0,n,1)=K*alpha->block(bl*n,0,n,1)*CMath::exp(log_scale*2.0);
+-			result+=alpha->block(bl*n,0,n,1).dot(eigen_f.block(bl*n,0,n,1))/2.0;
+-			eigen_f.block(bl*n,0,n,1)+=eigen_m;
+			eigen_f.segment(bl*n,n)=K*alpha->segment(bl*n,n)*CMath::exp(log_scale*2.0);
+			result+=alpha->segment(bl*n,n).dot(eigen_f.segment(bl*n,n))/2.0;
+			eigen_f.segment(bl*n,n)+=eigen_m;
+ 		}
+ 
+ 		// get first and second derivatives of log likelihood
+@@ -272,7 +272,7 @@ void CMultiLaplaceInferenceMethod::update_alpha()
+ 	{
+ 		Map<VectorXd> alpha(m_alpha.vector, m_alpha.vlen);
+ 		for(index_t bl=0; bl<C; bl++)
+-			eigen_mu.block(bl*n,0,n,1)=eigen_ktrtr*CMath::exp(m_log_scale*2.0)*alpha.block(bl*n,0,n,1);
+			eigen_mu.segment(bl*n,n)=eigen_ktrtr*CMath::exp(m_log_scale*2.0)*alpha.segment(bl*n,n);
+ 
+ 		//alpha'*(f-m)/2.0
+ 		Psi_New=alpha.dot(eigen_mu)/2.0;
+@@ -316,7 +316,7 @@ void CMultiLaplaceInferenceMethod::update_alpha()
+ 
+ 		for(index_t bl=0; bl<C; bl++)
+ 		{
+-			VectorXd eigen_sD=eigen_dpi.block(bl*n,0,n,1).cwiseSqrt();
+			VectorXd eigen_sD=eigen_dpi.segment(bl*n,n).cwiseSqrt();
+ 			LLT<MatrixXd> chol_tmp((eigen_sD*eigen_sD.transpose()).cwiseProduct(eigen_ktrtr*CMath::exp(m_log_scale*2.0))+
+ 				MatrixXd::Identity(m_ktrtr.num_rows, m_ktrtr.num_cols));
+ 			MatrixXd eigen_L_tmp=chol_tmp.matrixU();
+@@ -341,11 +341,11 @@ void CMultiLaplaceInferenceMethod::update_alpha()
+ 		VectorXd tmp2=m_tmp.array().rowwise().sum();
+ 
+ 		for(index_t bl=0; bl<C; bl++)
+-			eigen_b.block(bl*n,0,n,1)+=eigen_dpi.block(bl*n,0,n,1).cwiseProduct(eigen_mu.block(bl*n,0,n,1)-eigen_mean_bl-tmp2);
+			eigen_b.segment(bl*n,n)+=eigen_dpi.segment(bl*n,n).cwiseProduct(eigen_mu.segment(bl*n,n)-eigen_mean_bl-tmp2);
+ 
+ 		Map<VectorXd> &eigen_c=eigen_W;
+ 		for(index_t bl=0; bl<C; bl++)
+-			eigen_c.block(bl*n,0,n,1)=eigen_E.block(0,bl*n,n,n)*(eigen_ktrtr*CMath::exp(m_log_scale*2.0)*eigen_b.block(bl*n,0,n,1));
+			eigen_c.segment(bl*n,n)=eigen_E.block(0,bl*n,n,n)*(eigen_ktrtr*CMath::exp(m_log_scale*2.0)*eigen_b.segment(bl*n,n));
+ 
+ 		Map<MatrixXd> c_tmp(eigen_c.data(),n,C);
+ 
+@@ -409,7 +409,7 @@ float64_t CMultiLaplaceInferenceMethod::get_derivative_helper(SGMatrix<float64_t
+ 	{
+ 		result+=((eigen_E.block(0,bl*n,n,n)-eigen_U.block(0,bl*n,n,n).transpose()*eigen_U.block(0,bl*n,n,n)).array()
+ 			*eigen_dK.array()).sum();
+-		result-=(eigen_dK*eigen_alpha.block(bl*n,0,n,1)).dot(eigen_alpha.block(bl*n,0,n,1));
+		result-=(eigen_dK*eigen_alpha.segment(bl*n,n)).dot(eigen_alpha.segment(bl*n,n));
+ 	}
+ 
+ 	return result/2.0;
+@@ -489,7 +489,7 @@ SGVector<float64_t> CMultiLaplaceInferenceMethod::get_derivative_wrt_mean(
+ 		result[i]=0;
+ 		//currently only compute the explicit term
+ 		for(index_t bl=0; bl<C; bl++)
+-			result[i]-=eigen_alpha.block(bl*n,0,n,1).dot(eigen_dmu);
+			result[i]-=eigen_alpha.segment(bl*n,n).dot(eigen_dmu);
+ 	}
+ 
+ 	return result;
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@ -19,11 +19,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "gromacs";
-  version = "2021.3";
+  version = "2021.4";

  src = fetchurl {
    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "4QmFbsREdo373kHzBZ4xI6vbj+Vsozsag/Me1FdaHMY=";
+    sha256 = "07ds8abxq0k7vfpjvxb8in3fhb6lz0pbdzbmlidyzaw37qz8lw6b";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/terminal-emulators/mrxvt/default.nix
+++ b/pkgs/applications/terminal-emulators/mrxvt/default.nix
@ -16,8 +16,12 @@ stdenv.mkDerivation rec {
  pname = "mrxvt";
  version = "0.5.4";

-  buildInputs =
-    [ libX11 libXft libXi xorgproto libSM libICE freetype pkg-config which ];
+  src = fetchurl {
+    url = "mirror://sourceforge/materm/mrxvt-${version}.tar.gz";
+    sha256 = "1mqhmnlz32lvld9rc6c1hyz7gjw4anwf39yhbsjkikcgj1das0zl";
+  };
+
+  buildInputs = [ libX11 libXft libXi xorgproto libSM libICE freetype pkg-config which ];

  configureFlags = [
    "--with-x"
@ -34,11 +38,6 @@ stdenv.mkDerivation rec {
    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${freetype.dev}/include/freetype2";
  '';

-  src = fetchurl {
-    url = "mirror://sourceforge/materm/mrxvt-${version}.tar.gz";
-    sha256 = "1mqhmnlz32lvld9rc6c1hyz7gjw4anwf39yhbsjkikcgj1das0zl";
-  };
-
  meta = with lib; {
    description = "Lightweight multitabbed feature-rich X11 terminal emulator";
    longDescription = "
@ -48,6 +47,7 @@ stdenv.mkDerivation rec {
    homepage = "https://sourceforge.net/projects/materm";
    license = licenses.gpl2;
    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
    knownVulnerabilities = [
      "Usage of ANSI escape sequences causes unexpected newline-termination, leading to unexpected command execution (https://www.openwall.com/lists/oss-security/2021/05/17/1)"
    ];
--- a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-theme-switch/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-theme-switch/default.nix
@ -1,16 +1,15 @@
 { lib, stdenv, fetchFromGitHub }:

 stdenv.mkDerivation rec {
-  rev = "cfcbcc3dd5a5b09a3fec0f6a1fea95f4a36a48c4";
  pname = "urxvt-theme-switch";
-  version = "unstable-2014-12-21_rev${builtins.substring 0 1 rev}";
+  version = "unstable-2014-12-21";

  dontPatchShebangs = true;

  src = fetchFromGitHub {
    owner = "felixr";
    repo = "urxvt-theme-switch";
-    inherit rev;
+    rev = "cfcbcc3dd5a5b09a3fec0f6a1fea95f4a36a48c4";
    sha256 = "0x27m1vdqprn3lqpwgxvffill7prmaj6j9rhgvkvi13mzl5wmlli";
  };

@ -25,6 +24,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/felixr/urxvt-theme-switch";
    license = "CCBYNC";
    maintainers = with maintainers; [ ];
-    platforms = with platforms; unix;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/video/cinelerra/default.nix
+++ b/pkgs/applications/video/cinelerra/default.nix
@ -63,45 +63,46 @@ stdenv.mkDerivation {
  preBuild = ''
    make -C cinelerra versioninfo.h
  '';
+
  enableParallelBuilding = true;

  nativeBuildInputs = [ automake autoconf libtool pkg-config file intltool ];
-  buildInputs =
-    [
-      faad2
-      faac
-      a52dec
-      alsa-lib
-      fftw
-      lame
-      libavc1394
-      libiec61883
-      libraw1394
-      libsndfile
-      libvorbis
-      libogg
-      libjpeg
-      libtiff
-      freetype
-      mjpegtools
-      x264
-      gettext
-      openexr
-      libXext
-      libXxf86vm
-      libXv
-      libXi
-      libX11
-      libXft
-      xorgproto
-      libtheora
-      libpng
-      libdv
-      libuuid
-      nasm
-      perl
-      fontconfig
-    ];
+
+  buildInputs = [
+    faad2
+    faac
+    a52dec
+    alsa-lib
+    fftw
+    lame
+    libavc1394
+    libiec61883
+    libraw1394
+    libsndfile
+    libvorbis
+    libogg
+    libjpeg
+    libtiff
+    freetype
+    mjpegtools
+    x264
+    gettext
+    openexr
+    libXext
+    libXxf86vm
+    libXv
+    libXi
+    libX11
+    libXft
+    xorgproto
+    libtheora
+    libpng
+    libdv
+    libuuid
+    nasm
+    perl
+    fontconfig
+  ];

  meta = with lib; {
    description = "Professional video editing and compositing environment (community version)";
--- a/pkgs/applications/video/omxplayer/default.nix
+++ b/pkgs/applications/video/omxplayer/default.nix
@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchFromGitHub
 , fetchurl
 , raspberrypifw
 , pcre
@ -69,26 +70,31 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "omxplayer";
-  version = "20130328-fbee325dc2";
-  src = fetchurl {
-    url = "https://github.com/huceke/omxplayer/tarball/fbee325dc2";
-    name = "omxplayer-${version}.tar.gz";
+  version = "unstable-2013-03-28";
+
+  src = fetchFromGitHub {
+    owner = "huceke";
+    repo = "omxplayer";
+    rev = "fbee325dc20441138d04d8d2022ad85956302e97";
    sha256 = "0fkvv8il7ffqxki2gp8cxa5shh6sz9jsy5vv3f4025g4gss6afkg";
  };
-  patchPhase = ''
+
+  postPatch = ''
    sed -i 1d Makefile
    export INCLUDES="-I${raspberrypifw}/include/interface/vcos/pthreads -I${raspberrypifw}/include/interface/vmcs_host/linux/"
  '';
+
  installPhase = ''
    mkdir -p $out/bin
    cp omxplayer.bin $out/bin
  '';
+
  buildInputs = [ raspberrypifw ffmpeg pcre boost freetype zlib ];

-  meta = {
+  meta = with lib; {
    homepage = "https://github.com/huceke/omxplayer";
    description = "Commandline OMX player for the Raspberry Pi";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.arm;
+    license = licenses.gpl2Plus;
+    platforms = platforms.arm;
  };
 }
--- a/pkgs/applications/video/subdl/default.nix
+++ b/pkgs/applications/video/subdl/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation {
  pname = "subdl";
-  version = "0.0pre.2017.11.06";
+  version = "unstable-2017-11.06";

  src = fetchFromGitHub {
    owner = "alexanderwink";
@ -11,6 +11,12 @@ stdenv.mkDerivation {
    sha256 = "0kmk5ck1j49q4ww0lvas2767kwnzhkq0vdwkmjypdx5zkxz73fn8";
  };

+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    install -vD subdl $out/bin/subdl
+  '';
+
  meta = {
    homepage = "https://github.com/alexanderwink/subdl";
    description = "A command-line tool to download subtitles from opensubtitles.org";
@ -18,10 +24,4 @@ stdenv.mkDerivation {
    license = lib.licenses.gpl3;
    maintainers = [ lib.maintainers.exfalso ];
  };
-
-  buildInputs = [ python3 ];
-
-  installPhase = ''
-    install -vD subdl $out/bin/subdl
-  '';
 }
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@ -6,7 +6,7 @@

 buildGoPackage rec {
  pname = "docker-slim";
-  version = "1.37.0";
+  version = "1.37.2";

  goPackagePath = "github.com/docker-slim/docker-slim";

@ -14,7 +14,7 @@ buildGoPackage rec {
    owner = "docker-slim";
    repo = "docker-slim";
    rev = version;
-    sha256 = "1gxbgn61qv4zhzxwdd917hywwicr3jand34ghjzha35r44lmyzgz";
+    sha256 = "1svhi9xf71zrk843bnwkpmq4iaaln07dpfrdvq0vdqhj5xvbx47g";
  };

  subPackages = [ "cmd/docker-slim" "cmd/docker-slim-sensor" ];
--- a/pkgs/applications/virtualization/driver/win-pvdrivers/default.nix
+++ b/pkgs/applications/virtualization/driver/win-pvdrivers/default.nix
@ -1,11 +1,12 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenv, fetchFromGitHub }:

 stdenv.mkDerivation {
  pname = "win-pvdrivers";
  version = "unstable-2015-07-01";

-  src = fetchgit {
-    url = "https://github.com/ts468/win-pvdrivers";
+  src = fetchFromGitHub {
+    owner = "ts468";
+    repo = "win-pvdrivers";
    rev = "3054d645fc3ee182bea3e97ff01869f01cc3637a";
    sha256 = "6232ca2b7c9af874abbcb9262faf2c74c819727ed2eb64599c790879df535106";
  };
@ -23,7 +24,7 @@ stdenv.mkDerivation {
  meta = with lib; {
    description = "Xen Subproject: Windows PV Driver";
    homepage = "http://xenproject.org/downloads/windows-pv-drivers.html";
-    maintainers = [ maintainers.tstrobel ];
+    maintainers = with maintainers; [ tstrobel ];
    platforms = platforms.linux;
    license = licenses.bsd3;
  };
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@ -15,11 +15,11 @@ with lib;

 buildGoPackage rec {
  pname = "singularity";
-  version = "3.8.3";
+  version = "3.8.4";

  src = fetchurl {
    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "sha256-LiLrnuG3P91RuHgxSfDk2DwNLYoMHt9gNBV9UO7vuDU=";
+    sha256 = "sha256-y5Xm1osNIPK4fWDyOjv3B7fT6HzuDdSqQ4D49IGlfrw=";
  };

  goPackagePath = "github.com/sylabs/singularity";
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@ -12,7 +12,7 @@
      else "";
  in "${if matched == null then base else builtins.head matched}${appendShort}";
 in
-{ url, rev ? "HEAD", md5 ? "", sha256 ? "", leaveDotGit ? deepClone
+{ url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone
 , fetchSubmodules ? true, deepClone ? false
 , branchName ? null
 , name ? urlToName url rev
@ -54,6 +54,8 @@ assert deepClone -> leaveDotGit;

 if md5 != "" then
  throw "fetchgit does not support md5 anymore, please use sha256"
+else if hash != "" && sha256 != "" then
+  throw "Only one of sha256 or hash can be set"
 else
 stdenvNoCC.mkDerivation {
  inherit name;
@ -63,9 +65,14 @@ stdenvNoCC.mkDerivation {
  nativeBuildInputs = [ git ]
    ++ lib.optionals fetchLFS [ git-lfs ];

-  outputHashAlgo = "sha256";
+  outputHashAlgo = if hash != "" then null else "sha256";
  outputHashMode = "recursive";
-  outputHash = sha256;
+  outputHash = if hash != "" then
+    hash
+  else if sha256 != "" then
+    sha256
+  else
+    lib.fakeSha256;

  inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName postFetch;

--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, stdenvNoCC, lndir, runtimeShell }:
+{ lib, stdenv, stdenvNoCC, lndir, runtimeShell, shellcheck }:

 rec {

@ -111,9 +111,10 @@ rec {
    , executable ? false # run chmod +x ?
    , destination ? ""   # relative path appended to $out eg "/bin/foo"
    , checkPhase ? ""    # syntax checks, e.g. for scripts
+    , meta ? { }
    }:
    runCommand name
-      { inherit text executable checkPhase;
+      { inherit text executable checkPhase meta;
        passAsFile = [ "text" ];
        # Pointless to do this on a remote machine.
        preferLocalBuild = true;
@ -249,6 +250,60 @@ rec {
      '';
    };

+  /*
+   * Similar to writeShellScriptBin and writeScriptBin.
+   * Writes an executable Shell script to /nix/store/<store path>/bin/<name> and
+   * checks its syntax with shellcheck and the shell's -n option.
+   * Automatically includes sane set of shellopts (errexit, nounset, pipefail)
+   * and handles creation of PATH based on runtimeInputs
+   *
+   * Note that the checkPhase uses stdenv.shell for the test run of the script,
+   * while the generated shebang uses runtimeShell. If, for whatever reason,
+   * those were to mismatch you might lose fidelity in the default checks.
+   *
+   * Example:
+   * # Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
+   * writeShellApplication {
+   *   name = "my-file";
+   *   runtimeInputs = [ curl w3m ];
+   *   text = ''
+   *     curl -s 'https://nixos.org' | w3m -dump -T text/html
+   *    '';
+   * }
+  */
+  writeShellApplication =
+    { name
+    , text
+    , runtimeInputs ? [ ]
+    , checkPhase ? null
+    }:
+    writeTextFile {
+      inherit name;
+      executable = true;
+      destination = "/bin/${name}";
+      text = ''
+        #!${runtimeShell}
+        set -o errexit
+        set -o nounset
+        set -o pipefail
+
+        export PATH="${lib.makeBinPath runtimeInputs}:$PATH"
+
+        ${text}
+      '';
+
+      checkPhase =
+        if checkPhase == null then ''
+          runHook preCheck
+          ${stdenv.shell} -n $out/bin/${name}
+          ${shellcheck}/bin/shellcheck $out/bin/${name}
+          runHook postCheck
+        ''
+        else checkPhase;
+
+      meta.mainProgram = name;
+    };
+
  # Create a C binary
  writeCBin = name: code:
    runCommandCC name
--- a/pkgs/development/embedded/platformio/core.nix
+++ b/pkgs/development/embedded/platformio/core.nix
@ -19,6 +19,27 @@ let
        };
      });

+      click = super.click.overridePythonAttrs (oldAttrs: rec {
+        version = "8.0.3";
+        src = fetchFromGitHub {
+          owner = "pallets";
+          repo = "click";
+          rev = version;
+          sha256 = "0pxvxgfhqjgsjbgfnilqjki1l24r0rdfd98cl77i71yqdd2f497g";
+        };
+      });
+
+      starlette = super.starlette.overridePythonAttrs (oldAttrs: rec {
+        version = "0.17.0";
+        src = fetchFromGitHub {
+          owner = "encode";
+          repo = "starlette";
+          rev = version;
+          sha256 = "1g76qpvqzivmwll5ir4bf45jx5kilnkadvy6b7qjisvr402i3qmw";
+        };
+        disabledTestPaths = [];
+      });
+
      uvicorn = super.uvicorn.overridePythonAttrs (oldAttrs: rec {
        version = "0.15.0";
        src = fetchFromGitHub {
--- a/pkgs/development/embedded/platformio/default.nix
+++ b/pkgs/development/embedded/platformio/default.nix
@ -4,14 +4,14 @@
 let
  callPackage = newScope self;

-  version = "5.2.1";
+  version = "5.2.3";

  # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
  src = fetchFromGitHub {
    owner = "platformio";
    repo = "platformio-core";
    rev = "v${version}";
-    sha256 = "1kmwr21djcz1qnpbsk0za244rp6rkh0vp6wss1vjks4waambiqnl";
+    sha256 = "0wbmwawn25srkyrd6hwrgli1himzsj08vbm76fgnpqdc84n78ckl";
  };

  self = {
--- a/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
+++ b/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
@ -1,8 +1,8 @@
 diff --git a/platformio/package/manifest/schema.py b/platformio/package/manifest/schema.py
-index addc4c5..514b0ad 100644
+index 416dccfd..896c3649 100644
 --- a/platformio/package/manifest/schema.py
 +++ b/platformio/package/manifest/schema.py
-@@ -253,9 +253,4 @@ class ManifestSchema(BaseSchema):
+@@ -253,9 +253,6 @@ class ManifestSchema(BaseSchema):
     @staticmethod
     @memoized(expire="1h")
     def load_spdx_licenses():
@ -12,4 +12,6 @@ index addc4c5..514b0ad 100644
 -            "v%s/json/licenses.json" % version
 -        )
 -        return json.loads(fetch_remote_content(spdx_data_url))
-+        return json.load(open("@SPDX_LICENSE_LIST_DATA@/json/licenses.json"))
+        with open("@SPDX_LICENSE_LIST_DATA@/json/licenses.json") as f:
+            spdx = json.load(f)
+        return spdx
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -935,7 +935,11 @@ self: super: builtins.intersectAttrs super {

  rel8 = addTestToolDepend super.rel8 pkgs.postgresql;

-  cachix = generateOptparseApplicativeCompletion "cachix" super.cachix;
+  cachix = generateOptparseApplicativeCompletion "cachix" (super.cachix.override { nix = pkgs.nix_2_3; });
+
+  hercules-ci-agent = super.hercules-ci-agent.override { nix = pkgs.nix_2_3; };
+  hercules-ci-cnix-expr = super.hercules-ci-cnix-expr.override { nix = pkgs.nix_2_3; };
+  hercules-ci-cnix-store = super.hercules-ci-cnix-store.override { nix = pkgs.nix_2_3; };

  # Enable extra optimisations which increase build time, but also
  # later compiler performance, so we should do this for user's benefit.
--- a/pkgs/development/interpreters/bqn/cbqn/default.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/default.nix
@ -11,21 +11,21 @@ let
    name = "cbqn-bytecode-files";
    owner = "dzaima";
    repo = "CBQN";
-    rev = "4d23479cdbd5ac6eb512c376ade58077b814b2b7";
-    hash = "sha256-MTvg4lOB26bqvJTqV71p4Y4qDjTYaOE40Jk4Sle/hsY=";
+    rev = "db686e89d4d2e9bfac3dddf306dff890135b2de1";
+    hash = "sha256-RJ751jCsAGjqQx3V5S5Uc611n+/TBs6G2o0q26x98NM=";
  };
 in
 assert genBytecode -> ((bqn-path != null) && (mbqn-source != null));

 stdenv.mkDerivation rec {
  pname = "cbqn" + lib.optionalString (!genBytecode) "-standalone";
-  version = "0.pre+date=2021-10-20";
+  version = "0.pre+date=2021-11-06";

  src = fetchFromGitHub {
    owner = "dzaima";
    repo = "CBQN";
-    rev = "f50b8ab503d05cccb6ff61df52f2625df3292a9e";
-    hash = "sha256-pxToXVIKYS9P2TnGMGmKfJmAP54GVPVls9bm9tmS21s=";
+    rev = "cd866e1e45ce0f22bfacd25565ab912c06cb040f";
+    hash = "sha256-XuowrGDgrttRL/SY5si0nqHMKEidSNrQuquxNdBCW8o=";
  };

  dontConfigure = true;
--- a/pkgs/development/interpreters/bqn/mlochbaum-bqn/default.nix
+++ b/pkgs/development/interpreters/bqn/mlochbaum-bqn/default.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "bqn";
-  version = "0.pre+date=2021-10-21";
+  version = "0.pre+date=2021-11-08";

  src = fetchFromGitHub {
    owner = "mlochbaum";
    repo = "BQN";
-    rev = "e4edda2a8cf2309b77808cc749a8e6ff8a282b17";
-    hash = "sha256-wCpwFV9AI0bfDQX9ARWHkTICmNnRu4vBACXBTM/RNeM=";
+    rev = "5c68173276c1c1b136a7eda3ad8f4423ab0ee9d0";
+    hash = "sha256-e0P1I8I/J41Hk7Edb4uKCdx30Azkiheq014kSZzJ8yg=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/interpreters/joker/default.nix
+++ b/pkgs/development/interpreters/joker/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "joker";
-  version = "0.17.2";
+  version = "0.17.3";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "candid82";
    repo = "joker";
-    sha256 = "sha256-rboyRancRTyrSY+13Blrz7OsIzclDS4X4hkHGD6cpyk=";
+    sha256 = "sha256-mm1vFXaQEljsU7Yg+3zDF2MBsc/ePSVF9LezeMWCyL0=";
  };

  vendorSha256 = "sha256-AYoespfzFLP/jIIxbw5K653wc7sSfLY8K7di8GZ64wA=";
--- a/pkgs/development/libraries/gexiv2/default.nix
+++ b/pkgs/development/libraries/gexiv2/default.nix
@ -55,13 +55,15 @@ stdenv.mkDerivation rec {

  doCheck = true;

-  preCheck = ''
+  preCheck = let
+    libSuffix = if stdenv.isDarwin then "2.dylib" else "so.2";
+  in ''
    # Our gobject-introspection patches make the shared library paths absolute
    # in the GIR files. When running unit tests, the library is not yet installed,
    # though, so we need to replace the absolute path with a local one during build.
    # We are using a symlink that will be overridden during installation.
    mkdir -p $out/lib
-    ln -s $PWD/gexiv2/libgexiv2.so.2 $out/lib/libgexiv2.so.2
+    ln -s $PWD/gexiv2/libgexiv2.${libSuffix} $out/lib/libgexiv2.${libSuffix}
  '';

  passthru = {
--- a/pkgs/development/libraries/gtkimageview/default.nix
+++ b/pkgs/development/libraries/gtkimageview/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
  doCheck = true;

  meta = {
-    homepage = "https://wiki.gnome.org/Projects/GTK%2B/GtkImageView";
+    homepage = "https://wiki.gnome.org/Projects/GTK/GtkImageView";

    description = "Image viewer widget for GTK";

--- a/pkgs/development/libraries/libkml/default.nix
+++ b/pkgs/development/libraries/libkml/default.nix
@ -1,56 +0,0 @@
-{ lib, stdenv
-, fetchFromGitHub
-, cmake
-, boost
-, expat
-, zlib
-, uriparser
-, minizip
-, gtest
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libkml";
-  version = "1.3.0";
-
-  src = fetchFromGitHub {
-    owner = "libkml";
-    repo = pname;
-    rev = version;
-    sha256 = "0gl4cqfps9mzx6hzf3dc10hy5y8smpyf1s31sqm7w343hgsllv0z";
-  };
-
-  nativeBuildInputs = [
-    cmake
-  ];
-
-  cmakeFlags = [
-    "-DBUILD_TESTING=ON"
-  # Darwin tests require rpath for libs in build dir
-  ] ++ lib.optional stdenv.isDarwin [
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
-  ];
-
-  buildInputs = [
-    gtest
-    boost
-    expat
-    zlib
-    uriparser
-    minizip
-  ];
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$PWD/lib
-  '';
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "Reference implementation of OGC KML 2.2";
-    homepage = "https://github.com/libkml/libkml";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ costrouc ];
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/development/libraries/physics/lhapdf/default.nix
+++ b/pkgs/development/libraries/physics/lhapdf/default.nix
@ -9,6 +9,12 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-fS8CZ+LWWw3e4EhVOzQtfIk6bbq+HjJsrWLeABDdgQw=";
  };

+  # The Apple SDK only exports locale_t from xlocale.h whereas glibc
+  # had decided that xlocale.h should be a part of locale.h
+  postPatch = lib.optionalString (stdenv.isDarwin && stdenv.cc.isGNU) ''
+    substituteInPlace src/GridPDF.cc --replace '#include <locale>' '#include <xlocale.h>'
+  '';
+
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ python ];

--- a/pkgs/development/libraries/stargate-libcds/Makefile.patch
+++ b/pkgs/development/libraries/stargate-libcds/Makefile.patch
@ -0,0 +1,19 @@
+diff --git a/Makefile b/Makefile
+index 872af46..7eba8a1 100644
+--- a/Makefile
+++ b/Makefile
+@@ -156,13 +156,7 @@ test:
+ 	# Compile and run the test suite through Valgrind to check for
+ 	# memory errors, then generate an HTML code coverage report
+ 	# using gcovr
+-	$(CC) $(CC_ARGS) -O0 $(DEBUG_FLAGS) $(PLAT_FLAGS) $(GCOVARGS) \
+	$(CC) $(CC_ARGS) -O0 $(DEBUG_FLAGS) $(PLAT_FLAGS) \
+ 	    $(shell find src tests -name *.c) \
+ 	    -Iinclude \
+ 	    -o $(NAME).tests
+-	# If Valgrind exits non-zero, try running 'gdb ./libcds.tests'
+-	# to debug the test suite
+-	valgrind ./$(NAME).tests --track-origins=yes --leak-check=full
+-	mkdir html || rm -rf html/*
+-	gcovr -r . --exclude=bench --html --html-details -o html/coverage.html
+-	$(BROWSER) html/coverage.html &
--- a/pkgs/development/libraries/stargate-libcds/default.nix
+++ b/pkgs/development/libraries/stargate-libcds/default.nix
@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchpatch
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "stargate-libcds";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "stargateaudio";
+    repo = "libcds";
+    rev = version;
+    sha256 = "sha256-THThEzS8gGdwn3h0EBttaX5ljZH9Ma2Rcg143+GIdU8=";
+  };
+
+  # Fix 'error: unrecognized command line option' in platforms other than x86
+  PLAT_FLAGS = lib.optionalString stdenv.isx86_64 "-mfpmath=sse -mssse3";
+
+  patches = [
+    # Remove unecessary tests (valgrind, coverage)
+    ./Makefile.patch
+
+    # Fix for building on darwin
+    (fetchpatch {
+      name = "malloc-to-stdlib.patch";
+      url = "https://github.com/stargateaudio/libcds/commit/65dc08f059deda8ba5707ba6116b616d0ad0bd8d.patch";
+      sha256 = "sha256-FIGlobUVrDYOtnHjsWyE420PoULPHEK/3T9Fv8hfTl4=";
+    })
+  ];
+
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D libcds.so -t $out/lib/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "C data structure library";
+    homepage = "https://github.com/stargateaudio/libcds";
+    maintainers = with maintainers; [ yuu ];
+    license = licenses.lgpl3Only;
+  };
+}
--- a/pkgs/development/mobile/gomobile/default.nix
+++ b/pkgs/development/mobile/gomobile/default.nix
@ -1,6 +1,7 @@
 { stdenv, lib, fetchgit, buildGoModule, zlib, makeWrapper, xcodeenv, androidenv
 , xcodeWrapperArgs ? { }
 , xcodeWrapper ? xcodeenv.composeXcodeWrapper xcodeWrapperArgs
+, withAndroidPkgs ? true
 , androidPkgs ? androidenv.composeAndroidPackages {
    includeNDK = true;
    ndkVersion = "22.1.7171670";
@ -43,10 +44,12 @@ buildGoModule {
    mkdir -p $out/src/golang.org/x
    ln -s $src $out/src/golang.org/x/mobile
    wrapProgram $out/bin/gomobile \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ zlib ]}" \
+  '' + lib.optionalString withAndroidPkgs ''
      --prefix PATH : "${androidPkgs.androidsdk}/bin" \
      --set ANDROID_NDK_HOME "${androidPkgs.androidsdk}/libexec/android-sdk/ndk-bundle" \
-      --set ANDROID_HOME "${androidPkgs.androidsdk}/libexec/android-sdk"
+      --set ANDROID_HOME "${androidPkgs.androidsdk}/libexec/android-sdk" \
+  '' + ''
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ zlib ]}"
  '';

  meta = with lib; {
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -126,6 +126,7 @@
 , "gitmoji-cli"
 , "glob"
 , "graphql-cli"
+, "graphqurl"
 , "grunt-cli"
 , "makam"
 , "meshcommander"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@ -1,8 +1,6 @@
 { stdenv, lib, fetchzip, which, ocsigen_server, ocaml,
  lwt_react,
  opaline, ppx_deriving, findlib
-, ocaml-migrate-parsetree
-, ppx_tools_versioned
 , js_of_ocaml-ocamlbuild, js_of_ocaml-ppx, js_of_ocaml-ppx_deriving_json
 , js_of_ocaml-lwt
 , js_of_ocaml-tyxml
@ -13,17 +11,15 @@
 stdenv.mkDerivation rec
 {
  pname = "eliom";
-  version = "8.6.0";
+  version = "8.9.0";

  src = fetchzip {
    url = "https://github.com/ocsigen/eliom/archive/${version}.tar.gz";
-    sha256 = "0s1hpawwhqp4qcy8w1067n8c6zg8jcjpzplc39bjbb1ycqw667j9";
+    sha256 = "sha256:1b1vb3ilb54ffzb98mqa6zggqchsnjspbni8qxi6j42pbajp7p2l";
  };

  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild
-    ocaml-migrate-parsetree
    js_of_ocaml-ppx_deriving_json opaline
-    ppx_tools_versioned
    ocamlnet
  ];

--- a/pkgs/development/python-modules/aenum/default.nix
+++ b/pkgs/development/python-modules/aenum/default.nix
@ -8,16 +8,17 @@

 buildPythonPackage rec {
  pname = "aenum";
-  version = "3.1.2";
+  version = "3.1.3";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "806dd4791298e19daff2cdfe7be3ae6d931d0d03097973f802b3ea55066f62dd";
+    sha256 = "sha256-HUlOTTs+PpU4mu5CAgPZRXdtJDDumj1PFi4mezp+w6Y=";
  };

  checkInputs = [
    pyparsing
-  ] ;
+  ];

  # py2 likes to reorder tests
  doCheck = isPy3k;
@ -28,12 +29,14 @@ buildPythonPackage rec {
    runHook postCheck
  '';

-  pythonImportsCheck = [ "aenum" ];
+  pythonImportsCheck = [
+    "aenum"
+  ];

  meta = with lib; {
    description = "Advanced Enumerations (compatible with Python's stdlib Enum), NamedTuples, and NamedConstants";
-    maintainers = with maintainers; [ vrthra ];
-    license = licenses.bsd3;
    homepage = "https://github.com/ethanfurman/aenum";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ vrthra ];
  };
 }
--- a/pkgs/development/python-modules/agate/default.nix
+++ b/pkgs/development/python-modules/agate/default.nix
@ -1,37 +1,73 @@
-{ lib, fetchFromGitHub, buildPythonPackage, isPy3k
-, six, pytimeparse, parsedatetime, Babel
-, isodate, python-slugify, leather
-, glibcLocales, nose, lxml, cssselect, unittest2 }:
+{ lib
+, Babel
+, buildPythonPackage
+, cssselect
+, fetchFromGitHub
+, glibcLocales
+, isodate
+, leather
+, lxml
+, nose
+, parsedatetime
+, PyICU
+, python-slugify
+, pytimeparse
+, pythonOlder
+, pytz
+, six
+}:

 buildPythonPackage rec {
  pname = "agate";
-  version = "1.6.1";
+  version = "1.6.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

-  # PyPI tarball does not include all test files
-  # https://github.com/wireservice/agate/pull/716
  src = fetchFromGitHub {
    owner = "wireservice";
    repo = pname;
    rev = version;
-    sha256 = "077zj8xad8hsa3nqywvf7ircirmx3krxdipl8wr3dynv3l3khcpl";
+    sha256 = "sha256-tuUoLvztCYHIPJTBgw1eByM0zfaHDyc+h7SWsxutKos=";
  };

  propagatedBuildInputs = [
-    six pytimeparse parsedatetime Babel
-    isodate python-slugify leather
+    Babel
+    isodate
+    leather
+    parsedatetime
+    python-slugify
+    pytimeparse
+    six
  ];

-  checkInputs = [ glibcLocales nose lxml cssselect ]
-    ++ lib.optional (!isPy3k) unittest2;
+  checkInputs = [
+    cssselect
+    glibcLocales
+    lxml
+    nose
+    PyICU
+    pytz
+  ];
+
+  postPatch = ''
+    # No Python 2 support, thus constraint is not needed
+    substituteInPlace setup.py \
+      --replace "'parsedatetime>=2.1,!=2.5,!=2.6'," "'parsedatetime>=2.1',"
+  '';

  checkPhase = ''
    LC_ALL="en_US.UTF-8" nosetests tests
  '';

+  pythonImportsCheck = [
+    "agate"
+  ];
+
  meta = with lib; {
-    description = "A Python data analysis library that is optimized for humans instead of machines";
-    homepage    = "https://github.com/wireservice/agate";
-    license     = with licenses; [ mit ];
+    description = "Python data analysis library that is optimized for humans instead of machines";
+    homepage = "https://github.com/wireservice/agate";
+    license = with licenses; [ mit ];
    maintainers = with maintainers; [ vrthra ];
  };
 }
--- a/pkgs/development/python-modules/airtouch4pyapi/default.nix
+++ b/pkgs/development/python-modules/airtouch4pyapi/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, numpy
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "airtouch4pyapi";
+  version = "1.0.5";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "LonePurpleWolf";
+    repo = pname;
+    # https://github.com/LonePurpleWolf/airtouch4pyapi/issues/5
+    rev = "34783888846783c058fe79cec16feda45504f701";
+    sha256 = "17c7fm72p085pg9msvsfdggbskvm12a6jlb5bw1cndrqsqcrxywx";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "airtouch4pyapi" ];
+
+  meta = with lib; {
+    description = "Python API for Airtouch 4 controllers";
+    homepage = "https://github.com/LonePurpleWolf/airtouch4pyapi";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/nassl/default.nix
+++ b/pkgs/development/python-modules/nassl/default.nix
@ -3,7 +3,8 @@
 , fetchurl
 , buildPythonPackage
 , pkgsStatic
-, openssl
+, openssl_1_1
+, openssl_1_0_2
 , invoke
 , tls-parser
 , cacert
@ -36,7 +37,7 @@ let
    "enable-mdc2"
    "-fPIC"
  ];
-  opensslStatic = (openssl.override nasslOpensslArgs).overrideAttrs (
+  opensslStatic = (openssl_1_1.override nasslOpensslArgs).overrideAttrs (
    oldAttrs: rec {
      name = "openssl-${version}";
      version = "1.1.1h";
@ -49,10 +50,24 @@ let
        "enable-tls1_3"
        "no-async"
      ];
+      patches = builtins.filter (
+        p: (builtins.baseNameOf (toString p)) != "macos-yosemite-compat.patch"
+      ) oldAttrs.patches;
      buildInputs = oldAttrs.buildInputs ++ [ zlibStatic cacert ];
+      meta = oldAttrs.meta // {
+        knownVulnerabilities = [
+          "CVE-2020-1971"
+          "CVE-2021-23840"
+          "CVE-2021-23841"
+          "CVE-2021-3449"
+          "CVE-2021-3450"
+          "CVE-2021-3711"
+          "CVE-2021-3712"
+        ];
+      };
    }
  );
-  opensslLegacyStatic = (openssl.override nasslOpensslArgs).overrideAttrs (
+  opensslLegacyStatic = (openssl_1_0_2.override nasslOpensslArgs).overrideAttrs (
    oldAttrs: rec {
      name = "openssl-${version}";
      version = "1.0.2e";
@ -61,7 +76,9 @@ let
        sha256 = "1zqb1rff1wikc62a7vj5qxd1k191m8qif5d05mwdxz2wnzywlg72";
      };
      configureFlags = oldAttrs.configureFlags ++ nasslOpensslFlagsCommon;
-      patches = [ ];
+      patches = builtins.filter (
+        p: (builtins.baseNameOf (toString p)) == "darwin64-arm64.patch"
+      ) oldAttrs.patches;
      buildInputs = oldAttrs.buildInputs ++ [ zlibStatic ];
      # openssl_1_0_2 needs `withDocs = false`
      outputs = lib.remove "doc" oldAttrs.outputs;
--- a/pkgs/development/python-modules/nbval/default.nix
+++ b/pkgs/development/python-modules/nbval/default.nix
@ -11,7 +11,6 @@
 , glibcLocales
 , matplotlib
 , sympy
-, pytest-cov
 }:

 buildPythonPackage rec {
@ -23,15 +22,10 @@ buildPythonPackage rec {
    sha256 = "cfefcd2ef66ee2d337d0b252c6bcec4023384eb32e8b9e5fcc3ac80ab8cd7d40";
  };

-  checkInputs = [
-    pytestCheckHook
-    matplotlib
-    sympy
-    pytest-cov
+  buildInputs = [
+    glibcLocales
  ];

-  buildInputs = [ glibcLocales ];
-
  propagatedBuildInputs = [
    coverage
    ipykernel
@ -41,23 +35,35 @@ buildPythonPackage rec {
    six
  ];

-  pytestFlagsArray = [
-    "tests"
+  checkInputs = [
+    pytestCheckHook
+    matplotlib
+    sympy
+  ];
+
+  disabledTestPaths = [
+    "tests/test_ignore.py"
    # These are the main tests but they're fragile so skip them. They error
    # whenever matplotlib outputs any unexpected warnings, e.g. deprecation
    # warnings.
-    "--ignore=tests/test_unit_tests_in_notebooks.py"
+    "tests/test_unit_tests_in_notebooks.py"
    # Impure
-    "--ignore=tests/test_timeouts.py"
+    "tests/test_timeouts.py"
+    # No value for us
+    "tests/test_coverage.py"
  ];

  # Some of the tests use localhost networking.
  __darwinAllowLocalNetworking = true;

+  pythonImportsCheck = [
+    "nbval"
+  ];
+
  meta = with lib; {
    description = "A py.test plugin to validate Jupyter notebooks";
    homepage = "https://github.com/computationalmodelling/nbval";
    license = licenses.bsd3;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/python-ecobee-api/default.nix
+++ b/pkgs/development/python-modules/python-ecobee-api/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "python-ecobee-api";
-  version = "0.2.13";
+  version = "0.2.14";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "7c39f5aac854a2fb8fb33f41b351769a92ff784bc6112e7a5c1b9e1949a0fefe";
+    sha256 = "sha256-QfVOgX/psFB/l9dPBcaHh+2v9+7LjDCUAvaEQjUrxmA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/python-engineio/default.nix
+++ b/pkgs/development/python-modules/python-engineio/default.nix
@ -1,28 +1,32 @@
-{ lib, stdenv
-, buildPythonPackage
-, fetchFromGitHub
+{ lib
+, stdenv
 , aiohttp
+, buildPythonPackage
 , eventlet
+, fetchFromGitHub
 , iana-etc
 , libredirect
 , mock
+, pytestCheckHook
+, pythonOlder
 , requests
 , six
 , tornado
 , websocket-client
-, websockets
-, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "python-engineio";
-  version = "4.2.1";
+  version = "4.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "miguelgrinberg";
    repo = "python-engineio";
    rev = "v${version}";
-    sha256 = "sha256-aAoTeQZCtxddVBPwlyv2j4aACMO9p0vQ/ESkkv4E3VE=";
+    sha256 = "sha256-ohNRtceh0bHBlnGSFUckG5KzoLY8Q1jvpFee7T78Vto=";
  };

  checkInputs = [
@ -32,7 +36,6 @@ buildPythonPackage rec {
    requests
    tornado
    websocket-client
-    websockets
    pytestCheckHook
  ];

@ -43,11 +46,19 @@ buildPythonPackage rec {
    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf) \
      LD_PRELOAD=${libredirect}/lib/libredirect.so
  '';
-  postCheck = "unset NIX_REDIRECTS LD_PRELOAD";
+
+  postCheck = ''
+    unset NIX_REDIRECTS LD_PRELOAD
+  '';

  # somehow effective log level does not change?
-  disabledTests = [ "test_logger" ];
-  pythonImportsCheck = [ "engineio" ];
+  disabledTests = [
+    "test_logger"
+  ];
+
+  pythonImportsCheck = [
+    "engineio"
+  ];

  meta = with lib; {
    description = "Python based Engine.IO client and server";
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@ -1,4 +1,5 @@
 { lib
+, aiohttp
 , bidict
 , buildPythonPackage
 , fetchFromGitHub
@ -6,22 +7,31 @@
 , msgpack
 , pytestCheckHook
 , python-engineio
+, pythonOlder
+, requests
+, websocket-client
 }:

 buildPythonPackage rec {
  pname = "python-socketio";
-  version = "5.4.0";
+  version = "5.4.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "miguelgrinberg";
    repo = "python-socketio";
    rev = "v${version}";
-    sha256 = "sha256-0Q1R8XPciU5AEkj7Exlc906eyA5juYKzzA/Ygnzx7XU=";
+    sha256 = "sha256-qmC7AL2ZNB0D5p3c8ozacNMKc2COzYzPJfz6KXwWsd0=";
  };

  propagatedBuildInputs = [
+    aiohttp
    bidict
    python-engineio
+    requests
+    websocket-client
  ];

  checkInputs = [
@ -30,7 +40,9 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "socketio" ];
+  pythonImportsCheck = [
+    "socketio"
+  ];

  meta = with lib; {
    description = "Python Socket.IO server and client";
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@ -13,12 +13,14 @@

 buildPythonPackage rec {
  pname = "python-telegram-bot";
-  version = "13.7";
+  version = "13.8.1";
+  format = "setuptools";
+
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-JN91RZ4zW5a6/6aZFnn4RL1CaXivWmnKQZoKxDpAYCw=";
+    sha256 = "sha256-sGaR5Vw1lDJn7mNtmqcCs1eRVdLzLg4tbX8R8LXnJ/A=";
  };

  propagatedBuildInputs = [
@ -45,7 +47,9 @@ buildPythonPackage rec {
  # tests not included with release
  doCheck = false;

-  pythonImportsCheck = [ "telegram" ];
+  pythonImportsCheck = [
+    "telegram"
+  ];

  meta = with lib; {
    description = "Python library to interface with the Telegram Bot API";
--- a/pkgs/development/python-modules/pyturbojpeg/default.nix
+++ b/pkgs/development/python-modules/pyturbojpeg/default.nix
@ -1,21 +1,22 @@
 { lib
 , stdenv
-, python
 , buildPythonPackage
 , fetchPypi
-, substituteAll
 , libjpeg_turbo
 , numpy
+, python
+, substituteAll
 }:

 buildPythonPackage rec {
  pname = "pyturbojpeg";
-  version = "1.6.2";
+  version = "1.6.3";
+  format = "setuptools";

  src = fetchPypi {
    pname = "PyTurboJPEG";
    inherit version;
-    sha256 = "sha256-gOf/i2OyNtB3oIATXzijRUnhEaMlHRvwWXPguqHDG1A=";
+    sha256 = "sha256-5g9MQB7vpeuorVGExt0scHtLdrWlkuLOZMT38FhAsi4=";
  };

  patches = [
@ -34,7 +35,9 @@ buildPythonPackage rec {
    ${python.interpreter} -c 'from turbojpeg import TurboJPEG; TurboJPEG()'
  '';

-  pythonImportsCheck = [ "turbojpeg" ];
+  pythonImportsCheck = [
+    "turbojpeg"
+  ];

  meta = with lib; {
    description = "A Python wrapper of libjpeg-turbo for decoding and encoding JPEG image";
--- a/pkgs/development/python-modules/rdflib/default.nix
+++ b/pkgs/development/python-modules/rdflib/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
 , html5lib
@ -47,6 +48,11 @@ buildPythonPackage rec {
    "test_bad_password"
    "test_service"
    "testGuessFormatForParse"
+  ] ++ lib.optional stdenv.isDarwin [
+    # Require loopback network access
+    "test_sparqlstore"
+    "test_sparqlupdatestore_mock"
+    "TestGraphHTTP"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/streamz/default.nix
+++ b/pkgs/development/python-modules/streamz/default.nix
@ -1,44 +1,39 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, fetchpatch
 , confluent-kafka
 , distributed
+, fetchPypi
 , flaky
 , graphviz
 , networkx
-, pytest
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
 , requests
 , six
 , toolz
 , tornado
 , zict
-, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "streamz";
-  version = "0.6.2";
+  version = "0.6.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "04446ece273c041506b1642bd3d8380367a8372196be4d6d6d03faafadc590b2";
+    sha256 = "sha256-0wZ1ldLFRAIL9R+gLfwsFbL+gvdORAkYWNjnDmeafm8=";
  };

-  patches = [
-    # Fix apply import from dask
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/python-streamz/streamz/pull/423.patch";
-      sha256 = "sha256-CR+uRvzaFu9WQ633tbvX3gAnudhlVN6VvmxKiR37diw=";
-    })
-  ];
-
  propagatedBuildInputs = [
    networkx
-    tornado
-    toolz
-    zict
    six
+    toolz
+    tornado
+    zict
  ];

  checkInputs = [
@ -46,25 +41,31 @@ buildPythonPackage rec {
    distributed
    flaky
    graphviz
-    pytest
+    pytest-asyncio
+    pytestCheckHook
    requests
  ];

-  disabled = pythonOlder "3.6";
+  disabledTests = [
+    # Disable test_tcp_async because fails on sandbox build
+    "test_partition_timeout"
+    "test_tcp_async"
+    "test_tcp"
+  ];

-  # Disable test_tcp_async because fails on sandbox build
-  # disable kafka tests
-  checkPhase = ''
-    pytest --deselect=streamz/tests/test_sources.py::test_tcp_async \
-      --deselect=streamz/tests/test_sources.py::test_tcp \
-      --deselect=streamz/tests/test_core.py::test_partition_timeout \
-      --ignore=streamz/tests/test_kafka.py
-  '';
+  disabledTestPaths = [
+    # Disable kafka tests
+    "streamz/tests/test_kafka.py"
+  ];
+
+  pythonImportsCheck = [
+    "streamz"
+  ];

  meta = with lib; {
    description = "Pipelines to manage continuous streams of data";
    homepage = "https://github.com/python-streamz/streamz";
    license = licenses.bsd3;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@ -283,6 +283,7 @@ let
    bazelBuildFlags = [
      "--config=opt" # optimize using the flags set in the configure phase
    ]
+    ++ lib.optionals stdenv.cc.isClang [ "--cxxopt=-x" "--cxxopt=c++" "--host_cxxopt=-x" "--host_cxxopt=c++" ]
    ++ lib.optionals (mklSupport) [ "--config=mkl" ];

    bazelTarget = "//tensorflow/tools/pip_package:build_pip_package //tensorflow/tools/lib_package:libtensorflow";
--- a/pkgs/development/python-modules/yappi/default.nix
+++ b/pkgs/development/python-modules/yappi/default.nix
@ -1,23 +1,38 @@
-{ lib, buildPythonPackage, fetchFromGitHub, gevent, isPy27, python }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, gevent
+, isPy27
+, python
+}:

 buildPythonPackage rec {
  pname = "yappi";
-  version = "1.3.0";
+  version = "1.3.2";
+
  disabled = isPy27; # invalid syntax

  src = fetchFromGitHub {
    owner = "sumerc";
    repo = pname;
-    rev = "30f94024a0e2e4fa21c220de6a0dc97b4cb2c319";
-    sha256 = "1kvwl3y3c2hivf9y2x1q1s8a2y724iwqd1krq6ryvsbg3inyh8qw";
+    rev = "8bf7a650066f104f59c3cae4a189ec15e7d51c8c";
+    sha256 = "1q8lr9n0lny2g3mssy3mksbl9m4k1kqn1a4yv1hfqsahxdvpw2dp";
  };

  patches = [ ./tests.patch ];
-  checkInputs = [ gevent ];
+
+  checkInputs = [
+    gevent
+  ];
+
  checkPhase = ''
    ${python.interpreter} run_tests.py
  '';

+  pythonImportsCheck = [
+    "yappi"
+  ];
+
  meta = with lib; {
    homepage = "https://github.com/sumerc/yappi";
    description = "Python profiler that supports multithreading and measuring CPU time";
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@ -1,19 +1,20 @@
 { lib
 , buildPythonPackage
-, isPy27
 , fetchPypi
+, pythonOlder
 , requests
 }:

 buildPythonPackage rec {
  pname = "ytmusicapi";
-  version = "0.19.3";
+  version = "0.19.4";
+  format = "setuptools";

-  disabled = isPy27;
+  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "dfd0271f7177173cea9c255730151a10a2fe4a32f9accd2fe31e7645936c90c5";
+    sha256 = "sha256-AAGUfa91f9aquPLQZs9kQDbZXrBrxjSBFdWIrxB5D/I=";
  };

  propagatedBuildInputs = [
@ -22,10 +23,12 @@ buildPythonPackage rec {

  doCheck = false; # requires network access

-  pythonImportsCheck = [ "ytmusicapi" ];
+  pythonImportsCheck = [
+    "ytmusicapi"
+  ];

  meta = with lib; {
-    description = "Unofficial API for YouTube Music";
+    description = "Python API for YouTube Music";
    homepage = "https://github.com/sigma67/ytmusicapi";
    license = licenses.mit;
    maintainers = with maintainers; [ dotlambda ];
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "golangci-lint";
-  version = "1.42.1";
+  version = "1.43.0";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    sha256 = "sha256-lhpljK4odn+j+Cb3sp1/cMnBRrLNhWxVoRIO2PDqMHo=";
+    sha256 = "sha256-8aIKFLP1x9B5IMuyQ12LLIq79of4XwCdmDwae4T5MPg=";
  };

-  vendorSha256 = "sha256-Z4lNGWLKagKHbVOy6MiKyuSlXwUCYlkvnvk5zS4vl1A=";
+  vendorSha256 = "sha256-Mxy9VFBwcxyQtnhwuOFWK+0y0pQQDdqtoj0e2UXEo5k=";

  doCheck = false;

--- a/pkgs/development/tools/img/default.nix
+++ b/pkgs/development/tools/img/default.nix
@ -50,6 +50,6 @@ buildGoModule rec {
    description = "Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder. ";
    license = licenses.mit;
    homepage = "https://github.com/genuinetools/img";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ bryanasdev000 ];
  };
 }
--- a/pkgs/games/the-powder-toy/default.nix
+++ b/pkgs/games/the-powder-toy/default.nix
@ -18,6 +18,10 @@ stdenv.mkDerivation rec {

  installPhase = ''
    install -Dm 755 powder $out/bin/powder
+
+    mkdir -p $out/share/applications
+    mv ../resources/powder.desktop $out/share/applications
+    mv ../resources $out/share
  '';

  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@ -26,14 +26,14 @@ let
  optLibopus = shouldUsePkg libopus;
 in
 stdenv.mkDerivation rec {
-  name = "${prefix}jack2-${version}";
-  version = "1.9.17";
+  pname = "${prefix}jack2";
+  version = "1.9.19";

  src = fetchFromGitHub {
    owner = "jackaudio";
    repo = "jack2";
    rev = "v${version}";
-    sha256 = "sha256-T6UJpLsXrsIL3HaChfVP52w0v9DCs/sJqty2/kAWNfE=";
+    sha256 = "01s8i64qczxqawgrzrw19asaqmcspf5l2h3203xzg56wnnhhzcw7";
  };

  nativeBuildInputs = [ pkg-config python makeWrapper wafHook ];
--- a/pkgs/misc/vscode-extensions/cpptools/default.nix
+++ b/pkgs/misc/vscode-extensions/cpptools/default.nix
@ -5,8 +5,6 @@
 , gdbUseFixed ? true, gdb # The gdb default setting will be fixed to specified. Use version from `PATH` otherwise.
 }:

-assert gdbUseFixed -> null != gdb;
-
 /*
  Note that this version of the extension still has some nix specific issues
  which could not be fixed merely by patching (inside a C# dll).
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@ -971,19 +971,19 @@ let
      };

      jnoortheen.nix-ide = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "nix-ide";
+          publisher = "jnoortheen";
+          version = "0.1.18";
+          sha256 = "sha256-dmmx/u+hRQfY/MCIaSdcVtbYnf5cLCDUwr75heQxcuw=";
+        };
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
          description = "Nix language support with formatting and error report";
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jnoortheen.nix-ide";
          homepage = "https://github.com/jnoortheen/vscode-nix-ide";
          license = licenses.mit;
-          maintainers = with maintainers; [ ];
-        };
-        mktplcRef = {
-          name = "nix-ide";
-          publisher = "jnoortheen";
-          version = "0.1.16";
-          sha256 = "04ky1mzyjjr1mrwv3sxz4mgjcq5ylh6n01lvhb19h3fmwafkdxbp";
+          maintainers = with maintainers; [ SuperSandro2000 ];
        };
      };

@ -1435,6 +1435,18 @@ let
        };
      };

+      stkb.rewrap = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "stkb";
+          name = "rewrap";
+          version = "1.14.0";
+          sha256 = "qRwKX36a1aLzE1tqaOkH7JfE//pvKdPZ07zasPF3Dl4=";
+        };
+        meta = with lib; {
+          license = licenses.asl20;
+        };
+      };
+
      streetsidesoftware.code-spell-checker = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "code-spell-checker";
--- a/pkgs/misc/vscode-extensions/remote-ssh/default.nix
+++ b/pkgs/misc/vscode-extensions/remote-ssh/default.nix
@ -1,6 +1,7 @@
 { lib
 , vscode-utils
-, useLocalExtensions ? false}:
+, useLocalExtensions ? false
+}:
 # Note that useLocalExtensions requires that vscode-server is not running
 # on host. If it is, you'll need to remove $HOME/.vscode-server,
 # and redo the install by running "Connect to host" on client
@ -32,24 +33,22 @@ let
    ''}
  '';
 in
-  buildVscodeMarketplaceExtension {
-    mktplcRef = {
-      name = "remote-ssh";
-      publisher = "ms-vscode-remote";
-      version = "0.65.7";
-      sha256 = "ae86c4be79fc5af747bb1f1aa5841221af80ee7476cc2f1c9ac277fa2fa1d683";
-    };
+buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "remote-ssh";
+    publisher = "ms-vscode-remote";
+    version = "0.66.1";
+    sha256 = "sha256-+v4UnGRG5xOc8k0IzvHUBHa128fhgd3jcmEuciiMQmI=";
+  };

-    postPatch = ''
-      substituteInPlace "out/extension.js" \
-        --replace "# install extensions" '${patch}'
-    '';
+  postPatch = ''
+    substituteInPlace "out/extension.js" \
+      --replace "# install extensions" '${patch}'
+  '';

-    meta = with lib; {
-      description ="Use any remote machine with a SSH server as your development environment.";
-      license = licenses.unfree;
-      maintainers = with maintainers; [
-        tbenst
-      ];
-    };
-  }
+  meta = with lib; {
+    description = "Use any remote machine with a SSH server as your development environment.";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ SuperSandro2000 tbenst ];
+  };
+}
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@ -508,7 +508,7 @@ in lib.makeScopeWithSplicing
    nativeBuildInputs = with buildPackages.netbsd; [
      bsdSetupHook netbsdSetupHook
      makeMinimal
-      install mandoc groff nbperf
+      install mandoc groff nbperf rsync
    ];
    makeFlags = defaultMakeFlags ++ [ "TOOLDIR=$(out)" ];
    extraPaths = with self; [
@ -674,7 +674,7 @@ in lib.makeScopeWithSplicing
    nativeBuildInputs = with buildPackages.netbsd; [
      bsdSetupHook netbsdSetupHook
      makeMinimal
-      byacc install tsort lorder mandoc statHook
+      byacc install tsort lorder mandoc statHook rsync
    ];
    buildInputs = with self; [ headers ];
    SHLIBINSTALLDIR = "$(out)/lib";
@ -707,7 +707,7 @@ in lib.makeScopeWithSplicing
    sha256 = "0pq05k3dj0dfsczv07frnnji92mazmy2qqngqbx2zgqc1x251414";
    nativeBuildInputs = with buildPackages.netbsd; [
      bsdSetupHook netbsdSetupHook
-      makeMinimal install tsort lorder mandoc statHook nbperf tic
+      makeMinimal install tsort lorder mandoc statHook nbperf tic rsync
    ];
    buildInputs = with self; compatIfNeeded;
    SHLIBINSTALLDIR = "$(out)/lib";
--- a/pkgs/os-specific/linux/intel-cmt-cat/default.nix
+++ b/pkgs/os-specific/linux/intel-cmt-cat/default.nix
@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "4.2.0";
+  pname = "intel-cmt-cat";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "intel-cmt-cat";
+    rev = "v${version}";
+    sha256 = "sha256-k66FZI76d9HcWEMwEgOlObdPmRhuK5h2GKXOzUY0BKQ=";
+  };
+
+  enableParallelBuilding = true;
+
+  makeFlags = [ "PREFIX=$(out)" "NOLDCONFIG=y" ];
+
+  meta = with lib; {
+    description = "User space software for Intel(R) Resource Director Technology";
+    homepage = "https://github.com/intel/intel-cmt-cat";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ arkivm ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@ -0,0 +1,159 @@
+{ lib
+, stdenv
+, fetchpatch
+, fetchurl
+, fetchFromGitHub
+, callPackage
+, autoconf
+, automake
+, binutils
+, cmake
+, file
+, git
+, libtool
+, nasm
+, ncurses
+, ocaml
+, ocamlPackages
+, openssl
+, perl
+, python3
+, texinfo
+, which
+, writeShellScript
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sgx-sdk";
+  version = "2.14";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "linux-sgx";
+    rev = "0cea078f17a24fb807e706409972d77f7a958db9";
+    sha256 = "1cr2mkk459s270ng0yddgcryi0zc3dfmg9rmdrdh9mhy2mc1kx0g";
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "replace-bin-cp-with-cp.patch";
+      url = "https://github.com/intel/linux-sgx/commit/e0db5291d46d1c124980719d63829d65f89cf2c7.patch";
+      sha256 = "0xwlpm1r4rl4anfhjkr6fgz0gcyhr0ng46fv8iw9hfsh891yqb7z";
+    })
+    (fetchpatch {
+      name = "sgx_ippcp.h.patch";
+      url = "https://github.com/intel/linux-sgx/commit/e5929083f8161a8e7404afc0577936003fbb9d0b.patch";
+      sha256 = "12bgs9rxlq82hn5prl9qz2r4mwypink8hzdz4cki4k4cmkw961f5";
+    })
+  ];
+  postPatch = ''
+    patchShebangs ./linux/installer/bin/build-installpkg.sh \
+      ./linux/installer/common/sdk/createTarball.sh \
+      ./linux/installer/common/sdk/install.sh
+  '';
+
+  dontConfigure = true;
+
+  # SDK built with stackprotector produces broken enclaves which crash at runtime.
+  # Disable all to be safe, SDK build configures compiler mitigations manually.
+  hardeningDisable = [ "all" ];
+
+  nativeBuildInputs = [
+    cmake
+    git
+    ocaml
+    ocamlPackages.ocamlbuild
+    perl
+    python3
+    texinfo
+    nasm
+    file
+    ncurses
+    autoconf
+    automake
+  ];
+
+  buildInputs = [
+    libtool
+    openssl
+  ];
+
+  BINUTILS_DIR = "${binutils}/bin";
+
+  # Build external/ippcp_internal first. The Makefile is rewritten to make the
+  # build faster by splitting different versions of ipp-crypto builds and to
+  # avoid patching the Makefile for reproducibility issues.
+  buildPhase = let
+    ipp-crypto-no_mitigation = callPackage (import ./ipp-crypto.nix) {};
+
+    sgx-asm-pp = "python ${src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
+
+    nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@";
+    ipp-crypto-cve_2020_0551_load = callPackage (import ./ipp-crypto.nix) {
+      extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-load}" ];
+    };
+
+    nasm-cf = writeShellScript "nasm-cf" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=CF $@";
+    ipp-crypto-cve_2020_0551_cf = callPackage (import ./ipp-crypto.nix) {
+      extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-cf}" ];
+    };
+  in ''
+    cd external/ippcp_internal
+
+    mkdir -p lib/linux/intel64/no_mitigation
+    cp ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a lib/linux/intel64/no_mitigation
+    chmod a+w lib/linux/intel64/no_mitigation/libippcp.a
+    cp ${ipp-crypto-no_mitigation}/include/* ./inc
+
+    mkdir -p lib/linux/intel64/cve_2020_0551_load
+    cp ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_load
+    chmod a+w lib/linux/intel64/cve_2020_0551_load/libippcp.a
+
+    mkdir -p lib/linux/intel64/cve_2020_0551_cf
+    cp ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_cf
+    chmod a+w lib/linux/intel64/cve_2020_0551_cf/libippcp.a
+
+    rm -f ./inc/ippcp.h
+    patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp20u3.patch -o ./inc/ippcp.h
+
+    mkdir -p license
+    cp ${ipp-crypto-no_mitigation.src}/LICENSE ./license
+
+    # Build the SDK installation package.
+    cd ../..
+
+    # Nix patches make so that $(SHELL) defaults to "sh" instead of "/bin/sh".
+    # The build uses $(SHELL) as an argument to file -L which requires a path.
+    make SHELL=$SHELL sdk_install_pkg
+
+    runHook postBuild
+  '';
+
+  postBuild = ''
+    patchShebangs ./linux/installer/bin/sgx_linux_x64_sdk_*.bin
+  '';
+
+  installPhase = ''
+    echo -e 'no\n'$out | ./linux/installer/bin/sgx_linux_x64_sdk_*.bin
+  '';
+
+  dontFixup = true;
+
+  doInstallCheck = true;
+  installCheckInputs = [ which ];
+  installCheckPhase = ''
+    source $out/sgxsdk/environment
+    cd SampleCode/SampleEnclave
+    make SGX_MODE=SGX_SIM
+    ./app
+  '';
+
+  meta = with lib; {
+    description = "Intel SGX SDK for Linux built with IPP Crypto Library";
+    homepage = "https://github.com/intel/linux-sgx";
+    maintainers = with maintainers; [ sbellem arturcygan ];
+    platforms = [ "x86_64-linux" ];
+    license = with licenses; [ bsd3 ];
+  };
+}
--- a/pkgs/os-specific/linux/sgx-sdk/ipp-crypto.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/ipp-crypto.nix
@ -0,0 +1,24 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, python3
+, nasm
+, extraCmakeFlags ? []
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ipp-crypto";
+  version = "2020_update3";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ipp-crypto";
+    rev = "ipp-crypto_${version}";
+    sha256 = "02vlda6mlhbd12ljzdf65klpx4kmx1ylch9w3yllsiya4hwqzy4b";
+  };
+
+  cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags;
+
+  nativeBuildInputs = [ cmake python3 nasm ];
+}
--- a/pkgs/servers/antennas/default.nix
+++ b/pkgs/servers/antennas/default.nix
@ -0,0 +1,34 @@
+{ lib, mkYarnPackage, fetchFromGitHub, nodejs }:
+
+mkYarnPackage rec {
+  pname = "antennas";
+  version = "unstable-2021-01-21";
+
+  src = fetchFromGitHub {
+    owner = "TheJF";
+    repo = "antennas";
+    rev = "5e1f7375004001255e3daef7d48f45af321c7a52";
+    sha256 = "0bahn4y0chk70x822nn32ya7kmn9x15jb80xa544y501x1s7w981";
+  };
+
+  preFixup = ''
+    mkdir -p $out/bin
+    chmod a+x $out/libexec/antennas/deps/antennas/index.js
+    sed -i '1i#!${nodejs}/bin/node' $out/libexec/antennas/deps/antennas/index.js
+    ln -s $out/libexec/antennas/deps/antennas/index.js $out/bin/antennas
+  '';
+
+  # The --production flag disables the devDependencies.
+  yarnFlags = [ "--offline" "--production" ];
+  yarnLock = ./yarn.lock;
+  packageJSON = ./package.json;
+  yarnNix = ./yarn.nix;
+
+  meta = with lib; {
+    description = "HDHomeRun emulator for Plex DVR to connect to Tvheadend. ";
+    homepage = "https://github.com/TheJF/antennas";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bachp ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/antennas/package.json
+++ b/pkgs/servers/antennas/package.json
@ -0,0 +1,20 @@
+{
+  "name": "antennas",
+  "version": "3.1.0",
+  "description": "HDHomeRun emulator for Plex DVR to connect to Tvheadend.",
+  "main": "index.js",
+  "repository": "https://github.com/thejf/antennas",
+  "author": "Jean-Francois Arseneau",
+  "license": "MIT",
+  "dependencies": {
+    "js-yaml": "^3.13.1",
+    "koa": "^2.5.0",
+    "koa-logger": "^3.2.0",
+    "koa-request": "^1.0.0",
+    "koa-router": "^7.4.0",
+    "koa-static": "^4.0.2",
+    "node-ssdp": "^3.3.0",
+    "request": "^2.85.0",
+    "request-promise-native": "^1.0.5"
+  }
+}
--- a/Show more
+++ b/Show more