Merge branch 'master' into staging-next

Fixed trivial conflicts caused by removing rec.

doc/functions.xml

···
  <xi:include href="functions/appimagetools.xml" />
  <xi:include href="functions/prefer-remote-fetch.xml" />
  <xi:include href="functions/nix-gitignore.xml" />
+ <xi:include href="functions/ocitools.xml" />
 </chapter>

doc/functions/ocitools.xml

···
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         xml:id="sec-pkgs-ociTools">
+ <title>pkgs.ociTools</title>
+
+ <para>
+  <varname>pkgs.ociTools</varname> is a set of functions for creating
+  containers according to the
+  <link xlink:href="https://github.com/opencontainers/runtime-spec">OCI
+  container specification v1.0.0</link>. Beyond that it makes no assumptions
+  about the container runner you choose to use to run the created container.
+ </para>
+
+ <section xml:id="ssec-pkgs-ociTools-buildContainer">
+  <title>buildContainer</title>
+
+  <para>
+   This function creates a simple OCI container that runs a single command
+   inside of it. An OCI container consists of a <varname>config.json</varname>
+   and a rootfs directory.The nix store of the container will contain all
+   referenced dependencies of the given command.
+  </para>
+
+  <para>
+   The parameters of <varname>buildContainer</varname> with an example value
+   are described below:
+  </para>
+
+  <example xml:id='ex-ociTools-buildContainer'>
+   <title>Build Container</title>
+<programlisting>
+buildContainer {
+  cmd = with pkgs; writeScript "run.sh" ''
+    #!${bash}/bin/bash
+    ${coreutils}/bin/exec ${bash}/bin/bash
+  ''; <co xml:id='ex-ociTools-buildContainer-1' />
+
+  mounts = {
+    "/data" = {
+      type = "none";
+      source = "/var/lib/mydata";
+      options = [ "bind" ];
+    };
+  };<co xml:id='ex-ociTools-buildContainer-2' />
+
+  readonly = false; <co xml:id='ex-ociTools-buildContainer-3' />
+}
+
+    </programlisting>
+   <calloutlist>
+    <callout arearefs='ex-ociTools-buildContainer-1'>
+     <para>
+      <varname>cmd</varname> specifies the program to run inside the container.
+      This is the only required argument for <varname>buildContainer</varname>.
+      All referenced packages inside the derivation will be made available
+      inside the container
+     </para>
+    </callout>
+    <callout arearefs='ex-ociTools-buildContainer-2'>
+     <para>
+      <varname>mounts</varname> specifies additional mount points chosen by the
+      user. By default only a minimal set of necessary filesystems are mounted
+      into the container (e.g procfs, cgroupfs)
+     </para>
+    </callout>
+    <callout arearefs='ex-ociTools-buildContainer-3'>
+     <para>
+       <varname>readonly</varname> makes the container's rootfs read-only if it is set to true.
+       The default value is false <literal>false</literal>.
+     </para>
+    </callout>
+   </calloutlist>
+  </example>
+ </section>
+</section>

doc/stdenv.xml

···
     </varlistentry>
     <varlistentry>
      <term>
+      installShellFiles
+     </term>
+     <listitem>
+      <para>
+       This hook helps with installing manpages and shell completion files. It
+       exposes 2 shell functions <literal>installManPage</literal> and
+       <literal>installShellCompletion</literal> that can be used from your
+       <literal>postInstall</literal> hook.
+      </para>
+      <para>
+       The <literal>installManPage</literal> function takes one or more paths
+       to manpages to install. The manpages must have a section suffix, and may
+       optionally be compressed (with <literal>.gz</literal> suffix). This
+       function will place them into the correct directory.
+      </para>
+      <para>
+       The <literal>installShellCompletion</literal> function takes one or more
+       paths to shell completion files. By default it will autodetect the shell
+       type from the completion file extension, but you may also specify it by
+       passing one of <literal>--bash</literal>, <literal>--fish</literal>, or
+       <literal>--zsh</literal>. These flags apply to all paths listed after
+       them (up until another shell flag is given). Each path may also have a
+       custom installation name provided by providing a flag <literal>--name
+       NAME</literal> before the path. If this flag is not provided, zsh
+       completions will be renamed automatically such that
+       <literal>foobar.zsh</literal> becomes <literal>_foobar</literal>.
+<programlisting>
+nativeBuildInputs = [ installShellFiles ];
+postInstall = ''
+  installManPage doc/foobar.1 doc/barfoo.3
+  # explicit behavior
+  installShellCompletion --bash --name foobar.bash share/completions.bash
+  installShellCompletion --fish --name foobar.fish share/completions.fish
+  installShellCompletion --zsh --name _foobar share/completions.zsh
+  # implicit behavior
+  installShellCompletion share/completions/foobar.{bash,fish,zsh}
+'';
+</programlisting>
+      </para>
+     </listitem>
+    </varlistentry>
+    <varlistentry>
+     <term>
       libiconv, libintl
      </term>
      <listitem>

nixos/doc/manual/configuration/customizing-packages.xml

···
  <para>
   Apart from high-level options, it’s possible to tweak a package in almost
   arbitrary ways, such as changing or disabling dependencies of a package. For
-  instance, the Emacs package in Nixpkgs by default has a dependency on GTK+ 2.
-  If you want to build it against GTK+ 3, you can specify that as follows:
+  instance, the Emacs package in Nixpkgs by default has a dependency on GTK 2.
+  If you want to build it against GTK 3, you can specify that as follows:
 <programlisting>
 <xref linkend="opt-environment.systemPackages"/> = [ (pkgs.emacs.override { gtk = pkgs.gtk3; }) ];
 </programlisting>
···
   function that produces Emacs, with the original arguments amended by the set
   of arguments specified by you. So here the function argument
   <varname>gtk</varname> gets the value <literal>pkgs.gtk3</literal>, causing
-  Emacs to depend on GTK+ 3. (The parentheses are necessary because in Nix,
+  Emacs to depend on GTK 3. (The parentheses are necessary because in Nix,
   function application binds more weakly than list construction, so without
   them, <xref linkend="opt-environment.systemPackages"/> would be a list with
   two elements.)

nixos/doc/manual/release-notes/rl-1703.xml

···
    </listitem>
    <listitem>
     <para>
-     <literal>jre</literal> now defaults to GTK+ UI by default. This improves
+     <literal>jre</literal> now defaults to GTK UI by default. This improves
      visual consistency and makes Java follow system font style, improving the
      situation on HighDPI displays. This has a cost of increased closure size;
      for server and other headless workloads it's recommended to use

nixos/doc/manual/release-notes/rl-1909.xml

···
        It was not useful except for debugging purposes and was confusingly set as default in some circumstances.
      </para>
    </listitem>
+   <listitem>
+    <para>
+     The WeeChat plugin <literal>pkgs.weechatScripts.weechat-xmpp</literal> has been removed as it doesn't receive
+     any updates from upstream and depends on outdated Python2-based modules.
+    </para>
+   </listitem>
 
   </itemizedlist>
  </section>
···
        <literal>nix-shell -p altcoins.dogecoin</literal>, etc.
      </para>
    </listitem>
+   <listitem>
+     <para>
+       Ceph has been upgraded to v14.2.1.
+       See the <link xlink:href="https://ceph.com/releases/v14-2-0-nautilus-released/">release notes</link> for details.
+       The mgr dashboard as well as osds backed by loop-devices is no longer explicitly supported by the package and module.
+       Note: There's been some issues with python-cherrypy, which is used by the dashboard
+       and prometheus mgr modules (and possibly others), hence 0000-dont-check-cherrypy-version.patch.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      <literal>pkgs.weechat</literal> is now compiled against <literal>pkgs.python3</literal>.
+      Weechat also recommends <link xlink:href="https://weechat.org/scripts/python3/">to use Python3
+      in their docs.</link>
+     </para>
+    </listitem>
   </itemizedlist>
  </section>
 </section>

nixos/maintainers/scripts/ec2/amazon-image.nix

···
     name = mkOption {
       type = types.str;
       description = "The name of the generated derivation";
-      default = "nixos-disk-image";
+      default = "nixos-amazon-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
     };
 
     contents = mkOption {
···
 
     format = mkOption {
       type = types.enum [ "raw" "qcow2" "vpc" ];
-      default = "qcow2";
+      default = "vpc";
       description = "The image format to output";
     };
   };
···
     inherit lib config;
     inherit (cfg) contents format name;
     pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
-    partitionTableType = if config.ec2.hvm then "legacy" else "none";
+    partitionTableType = if config.ec2.efi then "efi"
+                         else if config.ec2.hvm then "legacy"
+                         else "none";
     diskSize = cfg.sizeMB;
     fsType = "ext4";
     configFile = pkgs.writeText "configuration.nix"
···
           ${optionalString config.ec2.hvm ''
             ec2.hvm = true;
           ''}
+          ${optionalString config.ec2.efi ''
+            ec2.efi = true;
+          ''}
         }
       '';
+    postVM = ''
+      extension=''${diskImage##*.}
+      friendlyName=$out/${cfg.name}.$extension
+      mv "$diskImage" "$friendlyName"
+      diskImage=$friendlyName
+
+      mkdir -p $out/nix-support
+      echo "file ${cfg.format} $diskImage" >> $out/nix-support/hydra-build-products
+
+      ${pkgs.jq}/bin/jq -n \
+        --arg label ${lib.escapeShellArg config.system.nixos.label} \
+        --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
+        --arg logical_bytes "$(${pkgs.qemu}/bin/qemu-img info --output json "$diskImage" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+        --arg file "$diskImage" \
+        '$ARGS.named' \
+        > $out/nix-support/image-info.json
+    '';
   };
 }

nixos/maintainers/scripts/ec2/create-amis.sh

···
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p qemu ec2_ami_tools jq ec2_api_tools awscli
+#!nix-shell -p awscli -p jq -p qemu -i bash
 
-# To start with do: nix-shell -p awscli --run "aws configure"
+# Uploads and registers NixOS images built from the
+# <nixos/release.nix> amazonImage attribute. Images are uploaded and
+# registered via a home region, and then copied to other regions.
 
-set -e
-set -o pipefail
+# The home region requires an s3 bucket, and a "vmimport" IAM role
+# with access to the S3 bucket.  Configuration of the vmimport role is
+# documented in
+# https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html
 
-version=$(nix-instantiate --eval --strict '<nixpkgs>' -A lib.version | sed s/'"'//g)
-major=${version:0:5}
-echo "NixOS version is $version ($major)"
+# set -x
+set -euo pipefail
 
-stateDir=/home/deploy/amis/ec2-image-$version
-echo "keeping state in $stateDir"
-mkdir -p $stateDir
+# configuration
+state_dir=/home/deploy/amis/ec2-images
+home_region=eu-west-1
+bucket=nixos-amis
 
-rm -f ec2-amis.nix
+regions=(eu-west-1 eu-west-2 eu-west-3 eu-central-1
+         us-east-1 us-east-2 us-west-1 us-west-2
+         ca-central-1
+         ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2
+         ap-south-1 ap-east-1
+         sa-east-1)
 
-types="hvm"
-stores="ebs"
-regions="eu-west-1 eu-west-2 eu-west-3 eu-central-1 us-east-1 us-east-2 us-west-1 us-west-2 ca-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2 sa-east-1 ap-south-1"
+log() {
+    echo "$@" >&2
+}
 
-for type in $types; do
-    link=$stateDir/$type
-    imageFile=$link/nixos.qcow2
-    system=x86_64-linux
-    arch=x86_64
+if [ -z "$1" ]; then
+    log "Usage: ./upload-amazon-image.sh IMAGE_OUTPUT"
+    exit 1
+fi
 
-    # Build the image.
-    if ! [ -L $link ]; then
-        if [ $type = pv ]; then hvmFlag=false; else hvmFlag=true; fi
+# result of the amazon-image from nixos/release.nix
+store_path=$1
 
-        echo "building image type '$type'..."
-        nix-build -o $link \
-            '<nixpkgs/nixos>' \
-            -A config.system.build.amazonImage \
-            --arg configuration "{ imports = [ <nixpkgs/nixos/maintainers/scripts/ec2/amazon-image.nix> ]; ec2.hvm = $hvmFlag; }"
+if [ ! -e "$store_path" ]; then
+    log "Store path: $store_path does not exist, fetching..."
+    nix-store --realise "$store_path"
+fi
+
+if [ ! -d "$store_path" ]; then
+    log "store_path: $store_path is not a directory. aborting"
+    exit 1
+fi
+
+read_image_info() {
+    if [ ! -e "$store_path/nix-support/image-info.json" ]; then
+        log "Image missing metadata"
+        exit 1
+    fi
+    jq -r "$1" "$store_path/nix-support/image-info.json"
+}
+
+# We handle a single image per invocation, store all attributes in
+# globals for convenience.
+image_label=$(read_image_info .label)
+image_system=$(read_image_info .system)
+image_file=$(read_image_info .file)
+image_logical_bytes=$(read_image_info .logical_bytes)
+
+# Derived attributes
+
+image_logical_gigabytes=$((($image_logical_bytes-1)/1024/1024/1024+1)) # Round to the next GB
+
+case "$image_system" in
+    aarch64-linux)
+        amazon_arch=arm64
+        ;;
+    x86_64-linux)
+        amazon_arch=x86_64
+        ;;
+    *)
+        log "Unknown system: $image_system"
+        exit 1
+esac
+
+image_name="NixOS-${image_label}-${image_system}"
+image_description="NixOS ${image_label} ${image_system}"
+
+log "Image Details:"
+log " Name: $image_name"
+log " Description: $image_description"
+log " Size (gigabytes): $image_logical_gigabytes"
+log " System: $image_system"
+log " Amazon Arch: $amazon_arch"
+
+read_state() {
+    local state_key=$1
+    local type=$2
+
+    cat "$state_dir/$state_key.$type" 2>/dev/null || true
+}
+
+write_state() {
+    local state_key=$1
+    local type=$2
+    local val=$3
+
+    mkdir -p $state_dir
+    echo "$val" > "$state_dir/$state_key.$type"
+}
+
+wait_for_import() {
+    local region=$1
+    local task_id=$2
+    local state snapshot_id
+    log "Waiting for import task $task_id to be completed"
+    while true; do
+        read state progress snapshot_id < <(
+            aws ec2 describe-import-snapshot-tasks --region $region --import-task-ids "$task_id" | \
+                jq -r '.ImportSnapshotTasks[].SnapshotTaskDetail | "\(.Status) \(.Progress) \(.SnapshotId)"'
+        )
+        log " ... state=$state progress=$progress snapshot_id=$snapshot_id"
+        case "$state" in
+            active)
+                sleep 10
+                ;;
+            completed)
+                echo "$snapshot_id"
+                return
+                ;;
+            *)
+                log "Unexpected snapshot import state: '${state}'"
+                exit 1
+                ;;
+        esac
+    done
+}
+
+wait_for_image() {
+    local region=$1
+    local ami_id=$2
+    local state
+    log "Waiting for image $ami_id to be available"
+
+    while true; do
+        read state < <(
+            aws ec2 describe-images --image-ids "$ami_id" --region $region | \
+                jq -r ".Images[].State"
+        )
+        log " ... state=$state"
+        case "$state" in
+            pending)
+                sleep 10
+                ;;
+            available)
+                return
+                ;;
+            *)
+                log "Unexpected AMI state: '${state}'"
+                exit 1
+                ;;
+        esac
+    done
+}
+
+
+make_image_public() {
+    local region=$1
+    local ami_id=$2
+
+    wait_for_image $region "$ami_id"
+
+    log "Making image $ami_id public"
+
+    aws ec2 modify-image-attribute \
+        --image-id "$ami_id" --region "$region" --launch-permission 'Add={Group=all}' >&2
+}
+
+upload_image() {
+    local region=$1
+
+    local aws_path=${image_file#/}
+
+    local state_key="$region.$image_label.$image_system"
+    local task_id=$(read_state "$state_key" task_id)
+    local snapshot_id=$(read_state "$state_key" snapshot_id)
+    local ami_id=$(read_state "$state_key" ami_id)
+
+    if [ -z "$task_id" ]; then
+        log "Checking for image on S3"
+        if ! aws s3 ls --region "$region" "s3://${bucket}/${aws_path}" >&2; then
+            log "Image missing from aws, uploading"
+            aws s3 cp --region $region "$image_file" "s3://${bucket}/${aws_path}" >&2
+        fi
+
+        log "Importing image from S3 path s3://$bucket/$aws_path"
+
+        task_id=$(aws ec2 import-snapshot --disk-container "{
+          \"Description\": \"nixos-image-${image_label}-${image_system}\",
+          \"Format\": \"vhd\",
+          \"UserBucket\": {
+              \"S3Bucket\": \"$bucket\",
+              \"S3Key\": \"$aws_path\"
+          }
+        }" --region $region | jq -r '.ImportTaskId')
+
+        write_state "$state_key" task_id "$task_id"
     fi
 
-    for store in $stores; do
+    if [ -z "$snapshot_id" ]; then
+        snapshot_id=$(wait_for_import "$region" "$task_id")
+        write_state "$state_key" snapshot_id "$snapshot_id"
+    fi
 
-        bucket=nixos-amis
-        bucketDir="$version-$type-$store"
+    if [ -z "$ami_id" ]; then
+        log "Registering snapshot $snapshot_id as AMI"
 
-        prevAmi=
-        prevRegion=
+        local block_device_mappings=(
+            "DeviceName=/dev/sda1,Ebs={SnapshotId=$snapshot_id,VolumeSize=$image_logical_gigabytes,DeleteOnTermination=true,VolumeType=gp2}"
+        )
 
-        for region in $regions; do
+        local extra_flags=(
+            --root-device-name /dev/sda1
+            --sriov-net-support simple
+            --ena-support
+            --virtualization-type hvm
+        )
 
-            name=nixos-$version-$arch-$type-$store
-            description="NixOS $system $version ($type-$store)"
+        block_device_mappings+=(DeviceName=/dev/sdb,VirtualName=ephemeral0)
+        block_device_mappings+=(DeviceName=/dev/sdc,VirtualName=ephemeral1)
+        block_device_mappings+=(DeviceName=/dev/sdd,VirtualName=ephemeral2)
+        block_device_mappings+=(DeviceName=/dev/sde,VirtualName=ephemeral3)
 
-            amiFile=$stateDir/$region.$type.$store.ami-id
+        ami_id=$(
+            aws ec2 register-image \
+                --name "$image_name" \
+                --description "$image_description" \
+                --region $region \
+                --architecture $amazon_arch \
+                --block-device-mappings "${block_device_mappings[@]}" \
+                "${extra_flags[@]}" \
+                | jq -r '.ImageId'
+              )
 
-            if ! [ -e $amiFile ]; then
+        write_state "$state_key" ami_id "$ami_id"
+    fi
 
-                echo "doing $name in $region..."
+    make_image_public $region "$ami_id"
 
-                if [ -n "$prevAmi" ]; then
-                    ami=$(aws ec2 copy-image \
-                        --region "$region" \
-                        --source-region "$prevRegion" --source-image-id "$prevAmi" \
-                        --name "$name" --description "$description" | jq -r '.ImageId')
-                    if [ "$ami" = null ]; then break; fi
-                else
+    echo "$ami_id"
+}
 
-                    if [ $store = s3 ]; then
+copy_to_region() {
+    local region=$1
+    local from_region=$2
+    local from_ami_id=$3
 
-                        # Bundle the image.
-                        imageDir=$stateDir/$type-bundled
+    state_key="$region.$image_label.$image_system"
+    ami_id=$(read_state "$state_key" ami_id)
 
-                        # Convert the image to raw format.
-                        rawFile=$stateDir/$type.raw
-                        if ! [ -e $rawFile ]; then
-                            qemu-img convert -f qcow2 -O raw $imageFile $rawFile.tmp
-                            mv $rawFile.tmp $rawFile
-                        fi
+    if [ -z "$ami_id" ]; then
+        log "Copying $from_ami_id to $region"
+        ami_id=$(
+            aws ec2 copy-image \
+                --region "$region" \
+                --source-region "$from_region" \
+                --source-image-id "$from_ami_id" \
+                --name "$image_name" \
+                --description "$image_description" \
+                | jq -r '.ImageId'
+              )
 
-                        if ! [ -d $imageDir ]; then
-                            rm -rf $imageDir.tmp
-                            mkdir -p $imageDir.tmp
-                            ec2-bundle-image \
-                                -d $imageDir.tmp \
-                                -i $rawFile --arch $arch \
-                                --user "$AWS_ACCOUNT" -c "$EC2_CERT" -k "$EC2_PRIVATE_KEY"
-                            mv $imageDir.tmp $imageDir
-                        fi
+        write_state "$state_key" ami_id "$ami_id"
+    fi
 
-                        # Upload the bundle to S3.
-                        if ! [ -e $imageDir/uploaded ]; then
-                            echo "uploading bundle to S3..."
-                            ec2-upload-bundle \
-                                -m $imageDir/$type.raw.manifest.xml \
-                                -b "$bucket/$bucketDir" \
-                                -a "$AWS_ACCESS_KEY_ID" -s "$AWS_SECRET_ACCESS_KEY" \
-                                --location EU
-                            touch $imageDir/uploaded
-                        fi
+    make_image_public $region "$ami_id"
 
-                        extraFlags="--image-location $bucket/$bucketDir/$type.raw.manifest.xml"
+    echo "$ami_id"
+}
 
-                    else
+upload_all() {
+    home_image_id=$(upload_image "$home_region")
+    jq -n \
+       --arg key "$home_region.$image_system" \
+       --arg value "$home_image_id" \
+       '$ARGS.named'
 
-                        # Convert the image to vhd format so we don't have
-                        # to upload a huge raw image.
-                        vhdFile=$stateDir/$type.vhd
-                        if ! [ -e $vhdFile ]; then
-                            qemu-img convert -f qcow2 -O vpc $imageFile $vhdFile.tmp
-                            mv $vhdFile.tmp $vhdFile
-                        fi
+    for region in "${regions[@]}"; do
+        if [ "$region" = "$home_region" ]; then
+            continue
+        fi
+        copied_image_id=$(copy_to_region "$region" "$home_region" "$home_image_id")
 
-                        vhdFileLogicalBytes="$(qemu-img info "$vhdFile" | grep ^virtual\ size: | cut -f 2 -d \(  | cut -f 1 -d \ )"
-                        vhdFileLogicalGigaBytes=$(((vhdFileLogicalBytes-1)/1024/1024/1024+1)) # Round to the next GB
-
-                        echo "Disk size is $vhdFileLogicalBytes bytes. Will be registered as $vhdFileLogicalGigaBytes GB."
-
-                        taskId=$(cat $stateDir/$region.$type.task-id 2> /dev/null || true)
-                        volId=$(cat $stateDir/$region.$type.vol-id 2> /dev/null || true)
-                        snapId=$(cat $stateDir/$region.$type.snap-id 2> /dev/null || true)
-
-                        # Import the VHD file.
-                        if [ -z "$snapId" -a -z "$volId" -a -z "$taskId" ]; then
-                            echo "importing $vhdFile..."
-                            taskId=$(ec2-import-volume $vhdFile --no-upload -f vhd \
-                                -O "$AWS_ACCESS_KEY_ID" -W "$AWS_SECRET_ACCESS_KEY" \
-                                -o "$AWS_ACCESS_KEY_ID" -w "$AWS_SECRET_ACCESS_KEY" \
-                                --region "$region" -z "${region}a" \
-                                --bucket "$bucket" --prefix "$bucketDir/" \
-                                | tee /dev/stderr \
-                                | sed 's/.*\(import-vol-[0-9a-z]\+\).*/\1/ ; t ; d')
-                            echo -n "$taskId" > $stateDir/$region.$type.task-id
-                        fi
-
-                        if [ -z "$snapId" -a -z "$volId" ]; then
-                            ec2-resume-import  $vhdFile -t "$taskId" --region "$region" \
-                                -O "$AWS_ACCESS_KEY_ID" -W "$AWS_SECRET_ACCESS_KEY" \
-                                -o "$AWS_ACCESS_KEY_ID" -w "$AWS_SECRET_ACCESS_KEY"
-                        fi
-
-                        # Wait for the volume creation to finish.
-                        if [ -z "$snapId" -a -z "$volId" ]; then
-                            echo "waiting for import to finish..."
-                            while true; do
-                                volId=$(aws ec2 describe-conversion-tasks --conversion-task-ids "$taskId" --region "$region" | jq -r .ConversionTasks[0].ImportVolume.Volume.Id)
-                                if [ "$volId" != null ]; then break; fi
-                                sleep 10
-                            done
-
-                            echo -n "$volId" > $stateDir/$region.$type.vol-id
-                        fi
-
-                        # Delete the import task.
-                        if [ -n "$volId" -a -n "$taskId" ]; then
-                            echo "removing import task..."
-                            ec2-delete-disk-image -t "$taskId" --region "$region" \
-                                -O "$AWS_ACCESS_KEY_ID" -W "$AWS_SECRET_ACCESS_KEY" \
-                                -o "$AWS_ACCESS_KEY_ID" -w "$AWS_SECRET_ACCESS_KEY" || true
-                            rm -f $stateDir/$region.$type.task-id
-                        fi
-
-                        # Create a snapshot.
-                        if [ -z "$snapId" ]; then
-                            echo "creating snapshot..."
-                            # FIXME: this can fail with InvalidVolume.NotFound. Eventual consistency yay.
-                            snapId=$(aws ec2 create-snapshot --volume-id "$volId" --region "$region" --description "$description" | jq -r .SnapshotId)
-                            if [ "$snapId" = null ]; then exit 1; fi
-                            echo -n "$snapId" > $stateDir/$region.$type.snap-id
-                        fi
-
-                        # Wait for the snapshot to finish.
-                        echo "waiting for snapshot to finish..."
-                        while true; do
-                            status=$(aws ec2 describe-snapshots --snapshot-ids "$snapId" --region "$region" | jq -r .Snapshots[0].State)
-                            if [ "$status" = completed ]; then break; fi
-                            sleep 10
-                        done
-
-                        # Delete the volume.
-                        if [ -n "$volId" ]; then
-                            echo "deleting volume..."
-                            aws ec2 delete-volume --volume-id "$volId" --region "$region" || true
-                            rm -f $stateDir/$region.$type.vol-id
-                        fi
-
-                        blockDeviceMappings="DeviceName=/dev/sda1,Ebs={SnapshotId=$snapId,VolumeSize=$vhdFileLogicalGigaBytes,DeleteOnTermination=true,VolumeType=gp2}"
-                        extraFlags=""
-
-                        if [ $type = pv ]; then
-                            extraFlags+=" --root-device-name /dev/sda1"
-                        else
-                            extraFlags+=" --root-device-name /dev/sda1"
-                            extraFlags+=" --sriov-net-support simple"
-                            extraFlags+=" --ena-support"
-                        fi
-
-                        blockDeviceMappings+=" DeviceName=/dev/sdb,VirtualName=ephemeral0"
-                        blockDeviceMappings+=" DeviceName=/dev/sdc,VirtualName=ephemeral1"
-                        blockDeviceMappings+=" DeviceName=/dev/sdd,VirtualName=ephemeral2"
-                        blockDeviceMappings+=" DeviceName=/dev/sde,VirtualName=ephemeral3"
-                    fi
-
-                    if [ $type = hvm ]; then
-                        extraFlags+=" --sriov-net-support simple"
-                        extraFlags+=" --ena-support"
-                    fi
-
-                    # Register the AMI.
-                    if [ $type = pv ]; then
-                        kernel=$(aws ec2 describe-images --owner amazon --filters "Name=name,Values=pv-grub-hd0_1.05-$arch.gz" | jq -r .Images[0].ImageId)
-                        if [ "$kernel" = null ]; then break; fi
-                        echo "using PV-GRUB kernel $kernel"
-                        extraFlags+=" --virtualization-type paravirtual --kernel $kernel"
-                    else
-                        extraFlags+=" --virtualization-type hvm"
-                    fi
-
-                    ami=$(aws ec2 register-image \
-                        --name "$name" \
-                        --description "$description" \
-                        --region "$region" \
-                        --architecture "$arch" \
-                        --block-device-mappings $blockDeviceMappings \
-                        $extraFlags | jq -r .ImageId)
-                    if [ "$ami" = null ]; then break; fi
-                fi
-
-                echo -n "$ami" > $amiFile
-                echo "created AMI $ami of type '$type' in $region..."
-
-            else
-                ami=$(cat $amiFile)
-            fi
-
-            echo "region = $region, type = $type, store = $store, ami = $ami"
-
-            if [ -z "$prevAmi" ]; then
-                prevAmi="$ami"
-                prevRegion="$region"
-            fi
-        done
-
+        jq -n \
+           --arg key "$region.$image_system" \
+           --arg value "$copied_image_id" \
+           '$ARGS.named'
     done
+}
 
-done
-
-for type in $types; do
-    link=$stateDir/$type
-    system=x86_64-linux
-    arch=x86_64
-
-    for store in $stores; do
-
-        for region in $regions; do
-
-            name=nixos-$version-$arch-$type-$store
-            amiFile=$stateDir/$region.$type.$store.ami-id
-            ami=$(cat $amiFile)
-
-            echo "region = $region, type = $type, store = $store, ami = $ami"
-
-            echo -n "waiting for AMI..."
-            while true; do
-                status=$(aws ec2 describe-images --image-ids "$ami" --region "$region" | jq -r .Images[0].State)
-                if [ "$status" = available ]; then break; fi
-                sleep 10
-                echo -n '.'
-            done
-            echo
-
-            # Make the image public.
-            aws ec2 modify-image-attribute \
-                --image-id "$ami" --region "$region" --launch-permission 'Add={Group=all}'
-
-            echo "  \"$major\".$region.$type-$store = \"$ami\";" >> ec2-amis.nix
-        done
-
-    done
-
-done
+upload_all | jq --slurp from_entries

nixos/modules/config/gtk/gtk-icon-cache.nix

···
       type = types.bool;
       default = config.services.xserver.enable;
       description = ''
-        Whether to build icon theme caches for GTK+ applications.
+        Whether to build icon theme caches for GTK applications.
       '';
     };
   };

nixos/modules/installer/tools/nix-fallback-paths.nix

···
 {
-  x86_64-linux = "/nix/store/hbhdjn5ik3byg642d1m11k3k3s0kn3py-nix-2.2.2";
-  i686-linux = "/nix/store/fz5cikwvj3n0a6zl44h6l2z3cin64mda-nix-2.2.2";
-  aarch64-linux = "/nix/store/2gba4cyl4wvxzfbhmli90jy4n5aj0kjj-nix-2.2.2";
-  x86_64-darwin = "/nix/store/87i4fp46jfw9yl8c7i9gx75m5yph7irl-nix-2.2.2";
+  x86_64-linux = "/nix/store/3ds3cgji9vjxdbgp10av6smyym1126d1-nix-2.3";
+  i686-linux = "/nix/store/ln1ndqvfpc9cdl03vqxi6kvlxm9wfv9g-nix-2.3";
+  aarch64-linux = "/nix/store/n8a1rwzrp20qcr2c4hvyn6c5q9zx8csw-nix-2.3";
+  x86_64-darwin = "/nix/store/jq6npmpld02sz4rgniz0qrsdfnm6j17a-nix-2.3";
 }

nixos/modules/module-list.nix

···
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix
   ./virtualisation/qemu-guest-agent.nix
+  ./virtualisation/railcar.nix
   ./virtualisation/rkt.nix
   ./virtualisation/virtualbox-guest.nix
   ./virtualisation/virtualbox-host.nix

nixos/modules/programs/plotinus.nix

···
       enable = mkOption {
         default = false;
         description = ''
-          Whether to enable the Plotinus GTK+3 plugin.  Plotinus provides a
+          Whether to enable the Plotinus GTK 3 plugin. Plotinus provides a
           popup (triggered by Ctrl-Shift-P) to search the menus of a
           compatible application.
         '';

nixos/modules/programs/plotinus.xml

···
   <link xlink:href="https://github.com/p-e-w/plotinus"/>
  </para>
  <para>
-  Plotinus is a searchable command palette in every modern GTK+ application.
+  Plotinus is a searchable command palette in every modern GTK application.
  </para>
  <para>
-  When in a GTK+3 application and Plotinus is enabled, you can press
+  When in a GTK 3 application and Plotinus is enabled, you can press
   <literal>Ctrl+Shift+P</literal> to open the command palette. The command
   palette provides a searchable list of of all menu items in the application.
  </para>

nixos/modules/rename.nix

···
     (mkRenamedOptionModule [ "services" "kubernetes" "etcd" "caFile" ] [ "services" "kubernetes" "apiserver" "etcd" "caFile" ])
     (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "applyManifests" ] "")
     (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "cadvisorPort" ] "")
+    (mkRemovedOptionModule [ "services" "kubernetes" "kubelet" "allowPrivileged" ] "")
     (mkRenamedOptionModule [ "services" "kubernetes" "proxy" "address" ] ["services" "kubernetes" "proxy" "bindAddress"])
     (mkRemovedOptionModule [ "services" "kubernetes" "verbose" ] "")
     (mkRenamedOptionModule [ "services" "logstash" "address" ] [ "services" "logstash" "listenAddress" ])

nixos/modules/services/cluster/kubernetes/addon-manager.nix

···
       '';
     };
 
-    enable = mkEnableOption "Kubernetes addon manager";
-
-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes addon manager";
-    bootstrapAddonsKubeconfig = top.lib.mkKubeConfigOptions "Kubernetes addon manager bootstrap";
+    enable = mkEnableOption "Whether to enable Kubernetes addon manager.";
   };
 
   ###### implementation
-  config = let
-
-    addonManagerPaths = filter (a: a != null) [
-      cfg.kubeconfig.caFile
-      cfg.kubeconfig.certFile
-      cfg.kubeconfig.keyFile
-    ];
-    bootstrapAddonsPaths = filter (a: a != null) [
-      cfg.bootstrapAddonsKubeconfig.caFile
-      cfg.bootstrapAddonsKubeconfig.certFile
-      cfg.bootstrapAddonsKubeconfig.keyFile
-    ];
-
-  in mkIf cfg.enable {
+  config = mkIf cfg.enable {
     environment.etc."kubernetes/addons".source = "${addons}/";
 
-    #TODO: Get rid of kube-addon-manager in the future for the following reasons
-    # - it is basically just a shell script wrapped around kubectl
-    # - it assumes that it is clusterAdmin or can gain clusterAdmin rights through serviceAccount
-    # - it is designed to be used with k8s system components only
-    # - it would be better with a more Nix-oriented way of managing addons
     systemd.services.kube-addon-manager = {
       description = "Kubernetes addon manager";
       wantedBy = [ "kubernetes.target" ];
-      after = [ "kube-node-online.target" ];
-      before = [ "kubernetes.target" ];
-      environment = {
-        ADDON_PATH = "/etc/kubernetes/addons/";
-        KUBECONFIG = top.lib.mkKubeConfig "kube-addon-manager" cfg.kubeconfig;
-      };
-      path = with pkgs; [ gawk kubectl ];
-      preStart = ''
-        until kubectl -n kube-system get serviceaccounts/default 2>/dev/null; do
-          echo kubectl -n kube-system get serviceaccounts/default: exit status $?
-          sleep 2
-        done
-      '';
+      after = [ "kube-apiserver.service" ];
+      environment.ADDON_PATH = "/etc/kubernetes/addons/";
+      path = [ pkgs.gawk ];
       serviceConfig = {
         Slice = "kubernetes.slice";
         ExecStart = "${top.package}/bin/kube-addons";
···
         Restart = "on-failure";
         RestartSec = 10;
       };
-      unitConfig.ConditionPathExists = addonManagerPaths;
     };
-
-    systemd.paths.kube-addon-manager = {
-      wantedBy = [ "kube-addon-manager.service" ];
-      pathConfig = {
-        PathExists = addonManagerPaths;
-        PathChanged = addonManagerPaths;
-      };
-    };
-
-    services.kubernetes.addonManager.kubeconfig.server = mkDefault top.apiserverAddress;
-
-    systemd.services.kube-addon-manager-bootstrap = mkIf (top.apiserver.enable && top.addonManager.bootstrapAddons != {}) {
-      wantedBy = [ "kube-control-plane-online.target" ];
-      after = [ "kube-apiserver.service" ];
-      before = [ "kube-control-plane-online.target" ];
-      path = [ pkgs.kubectl ];
-      environment = {
-        KUBECONFIG = top.lib.mkKubeConfig "kube-addon-manager-bootstrap" cfg.bootstrapAddonsKubeconfig;
-      };
-      preStart = with pkgs; let
-        files = mapAttrsToList (n: v: writeText "${n}.json" (builtins.toJSON v))
-          cfg.bootstrapAddons;
-      in ''
-        until kubectl auth can-i '*' '*' -q 2>/dev/null; do
-          echo kubectl auth can-i '*' '*': exit status $?
-          sleep 2
-        done
-
-        kubectl apply -f ${concatStringsSep " \\\n -f " files}
-      '';
-      script = "echo Ok";
-      unitConfig.ConditionPathExists = bootstrapAddonsPaths;
-    };
-
-    systemd.paths.kube-addon-manager-bootstrap = {
-      wantedBy = [ "kube-addon-manager-bootstrap.service" ];
-      pathConfig = {
-        PathExists = bootstrapAddonsPaths;
-        PathChanged = bootstrapAddonsPaths;
-      };
-    };
-
-    services.kubernetes.addonManager.bootstrapAddonsKubeconfig.server = mkDefault top.apiserverAddress;
 
     services.kubernetes.addonManager.bootstrapAddons = mkIf isRBACEnabled
     (let

nixos/modules/services/cluster/kubernetes/addons/dashboard.nix

···
         };
       };
 
-      kubernetes-dashboard-cm = {
-        apiVersion = "v1";
-        kind = "ConfigMap";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            # Allows editing resource and makes sure it is created first.
-            "addonmanager.kubernetes.io/mode" = "EnsureExists";
-          };
-          name = "kubernetes-dashboard-settings";
-          namespace = "kube-system";
-        };
-      };
-    };
-
-    services.kubernetes.addonManager.bootstrapAddons = mkMerge [{
-
       kubernetes-dashboard-sa = {
         apiVersion = "v1";
         kind = "ServiceAccount";
···
         };
         type = "Opaque";
       };
-    }
-
-    (optionalAttrs cfg.rbac.enable
+      kubernetes-dashboard-cm = {
+        apiVersion = "v1";
+        kind = "ConfigMap";
+        metadata = {
+          labels = {
+            k8s-app = "kubernetes-dashboard";
+            # Allows editing resource and makes sure it is created first.
+            "addonmanager.kubernetes.io/mode" = "EnsureExists";
+          };
+          name = "kubernetes-dashboard-settings";
+          namespace = "kube-system";
+        };
+      };
+    } // (optionalAttrs cfg.rbac.enable
       (let
         subjects = [{
           kind = "ServiceAccount";
···
             inherit subjects;
           };
         })
-    ))];
+    ));
   };
 }

nixos/modules/services/cluster/kubernetes/apiserver.nix

···
   ###### implementation
   config = mkMerge [
 
-    (let
-
-      apiserverPaths = filter (a: a != null) [
-        cfg.clientCaFile
-        cfg.etcd.caFile
-        cfg.etcd.certFile
-        cfg.etcd.keyFile
-        cfg.kubeletClientCaFile
-        cfg.kubeletClientCertFile
-        cfg.kubeletClientKeyFile
-        cfg.serviceAccountKeyFile
-        cfg.tlsCertFile
-        cfg.tlsKeyFile
-      ];
-      etcdPaths = filter (a: a != null) [
-        config.services.etcd.trustedCaFile
-        config.services.etcd.certFile
-        config.services.etcd.keyFile
-      ];
-
-    in mkIf cfg.enable {
+    (mkIf cfg.enable {
         systemd.services.kube-apiserver = {
           description = "Kubernetes APIServer Service";
-          wantedBy = [ "kube-control-plane-online.target" ];
-          after = [ "certmgr.service" ];
-          before = [ "kube-control-plane-online.target" ];
+          wantedBy = [ "kubernetes.target" ];
+          after = [ "network.target" ];
           serviceConfig = {
             Slice = "kubernetes.slice";
             ExecStart = ''${top.package}/bin/kube-apiserver \
···
             Restart = "on-failure";
             RestartSec = 5;
           };
-          unitConfig.ConditionPathExists = apiserverPaths;
-        };
-
-        systemd.paths.kube-apiserver = mkIf top.apiserver.enable {
-          wantedBy = [ "kube-apiserver.service" ];
-          pathConfig = {
-            PathExists = apiserverPaths;
-            PathChanged = apiserverPaths;
-          };
         };
 
         services.etcd = {
···
           initialCluster = mkDefault ["${top.masterAddress}=https://${top.masterAddress}:2380"];
           name = mkDefault top.masterAddress;
           initialAdvertisePeerUrls = mkDefault ["https://${top.masterAddress}:2380"];
-        };
-
-        systemd.services.etcd = {
-          unitConfig.ConditionPathExists = etcdPaths;
-        };
-
-        systemd.paths.etcd = {
-          wantedBy = [ "etcd.service" ];
-          pathConfig = {
-            PathExists = etcdPaths;
-            PathChanged = etcdPaths;
-          };
         };
 
         services.kubernetes.addonManager.bootstrapAddons = mkIf isRBACEnabled {

nixos/modules/services/cluster/kubernetes/controller-manager.nix

···
   };
 
   ###### implementation
-  config = let
-
-    controllerManagerPaths = filter (a: a != null) [
-      cfg.kubeconfig.caFile
-      cfg.kubeconfig.certFile
-      cfg.kubeconfig.keyFile
-      cfg.rootCaFile
-      cfg.serviceAccountKeyFile
-      cfg.tlsCertFile
-      cfg.tlsKeyFile
-    ];
-
-  in mkIf cfg.enable {
-    systemd.services.kube-controller-manager = rec {
+  config = mkIf cfg.enable {
+    systemd.services.kube-controller-manager = {
       description = "Kubernetes Controller Manager Service";
-      wantedBy = [ "kube-control-plane-online.target" ];
+      wantedBy = [ "kubernetes.target" ];
       after = [ "kube-apiserver.service" ];
-      before = [ "kube-control-plane-online.target" ];
-      environment.KUBECONFIG = top.lib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig;
-      preStart = ''
-        until kubectl auth can-i get /api -q 2>/dev/null; do
-          echo kubectl auth can-i get /api: exit status $?
-          sleep 2
-        done
-      '';
       serviceConfig = {
         RestartSec = "30s";
         Restart = "on-failure";
···
             "--cluster-cidr=${cfg.clusterCidr}"} \
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${environment.KUBECONFIG} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
           --leader-elect=${boolToString cfg.leaderElect} \
           ${optionalString (cfg.rootCaFile!=null)
             "--root-ca-file=${cfg.rootCaFile}"} \
···
         User = "kubernetes";
         Group = "kubernetes";
       };
-      path = top.path ++ [ pkgs.kubectl ];
-      unitConfig.ConditionPathExists = controllerManagerPaths;
-    };
-
-    systemd.paths.kube-controller-manager = {
-      wantedBy = [ "kube-controller-manager.service" ];
-      pathConfig = {
-        PathExists = controllerManagerPaths;
-        PathChanged = controllerManagerPaths;
-      };
+      path = top.path;
     };
 
     services.kubernetes.pki.certs = with top.lib; {

nixos/modules/services/cluster/kubernetes/default.nix

···
         wantedBy = [ "multi-user.target" ];
       };
 
-      systemd.targets.kube-control-plane-online = {
-        wantedBy = [ "kubernetes.target" ];
-        before = [ "kubernetes.target" ];
-      };
-
-      systemd.services.kube-control-plane-online = {
-        description = "Kubernetes control plane is online";
-        wantedBy = [ "kube-control-plane-online.target" ];
-        after = [ "kube-scheduler.service" "kube-controller-manager.service" ];
-        before = [ "kube-control-plane-online.target" ];
-        path = [ pkgs.curl ];
-        preStart = ''
-          until curl -Ssf ${cfg.apiserverAddress}/healthz do
-            echo curl -Ssf ${cfg.apiserverAddress}/healthz: exit status $?
-            sleep 3
-          done
-        '';
-        script = "echo Ok";
-        serviceConfig = {
-          TimeoutSec = "500";
-        };
-      };
-
       systemd.tmpfiles.rules = [
         "d /opt/cni/bin 0755 root root -"
         "d /run/kubernetes 0755 kubernetes kubernetes -"
···
       services.kubernetes.apiserverAddress = mkDefault ("https://${if cfg.apiserver.advertiseAddress != null
                           then cfg.apiserver.advertiseAddress
                           else "${cfg.masterAddress}:${toString cfg.apiserver.securePort}"}");
-
-      services.kubernetes.kubeconfig.server = mkDefault cfg.apiserverAddress;
     })
   ];
 }

nixos/modules/services/cluster/kubernetes/flannel.nix

···
     buildInputs = [ pkgs.makeWrapper ];
   } ''
     mkdir -p $out
-    cp ${pkgs.kubernetes.src}/cluster/centos/node/bin/mk-docker-opts.sh $out/mk-docker-opts.sh
 
     # bashInteractive needed for `compgen`
-    makeWrapper ${pkgs.bashInteractive}/bin/bash $out/mk-docker-opts --add-flags "$out/mk-docker-opts.sh"
+    makeWrapper ${pkgs.bashInteractive}/bin/bash $out/mk-docker-opts --add-flags "${pkgs.kubernetes}/bin/mk-docker-opts.sh"
   '';
 in
 {
   ###### interface
   options.services.kubernetes.flannel = {
-    enable = mkEnableOption "flannel networking";
-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes flannel";
+    enable = mkEnableOption "enable flannel networking";
   };
 
   ###### implementation
-  config = let
-
-    flannelPaths = filter (a: a != null) [
-      cfg.kubeconfig.caFile
-      cfg.kubeconfig.certFile
-      cfg.kubeconfig.keyFile
-    ];
-    kubeconfig = top.lib.mkKubeConfig "flannel" cfg.kubeconfig;
-
-  in mkIf cfg.enable {
+  config = mkIf cfg.enable {
     services.flannel = {
 
       enable = mkDefault true;
       network = mkDefault top.clusterCidr;
-      inherit storageBackend kubeconfig;
-      nodeName = top.kubelet.hostname;
+      inherit storageBackend;
+      nodeName = config.services.kubernetes.kubelet.hostname;
     };
 
     services.kubernetes.kubelet = {
···
       }];
     };
 
-    systemd.services.mk-docker-opts = {
+    systemd.services."mk-docker-opts" = {
       description = "Pre-Docker Actions";
-      wantedBy = [ "flannel.target" ];
-      before = [ "flannel.target" ];
       path = with pkgs; [ gawk gnugrep ];
       script = ''
         ${mkDockerOpts}/mk-docker-opts -d /run/flannel/docker
         systemctl restart docker
       '';
-      unitConfig.ConditionPathExists = [ "/run/flannel/subnet.env" ];
       serviceConfig.Type = "oneshot";
     };
 
-    systemd.paths.flannel-subnet-env = {
-      wantedBy = [ "mk-docker-opts.service" ];
+    systemd.paths."flannel-subnet-env" = {
+      wantedBy = [ "flannel.service" ];
       pathConfig = {
-        PathExists = [ "/run/flannel/subnet.env" ];
-        PathChanged = [ "/run/flannel/subnet.env" ];
+        PathModified = "/run/flannel/subnet.env";
         Unit = "mk-docker-opts.service";
       };
     };
-
-    systemd.targets.flannel = {
-      wantedBy = [ "kube-node-online.target" ];
-      before = [ "kube-node-online.target" ];
-    };
-
-    systemd.services.flannel = {
-      wantedBy = [ "flannel.target" ];
-      after = [ "kubelet.target" ];
-      before = [ "flannel.target" ];
-      path = with pkgs; [ iptables kubectl ];
-      environment.KUBECONFIG = kubeconfig;
-      preStart = let
-        args = [
-          "--selector=kubernetes.io/hostname=${top.kubelet.hostname}"
-          # flannel exits if node is not registered yet, before that there is no podCIDR
-          "--output=jsonpath={.items[0].spec.podCIDR}"
-          # if jsonpath cannot be resolved exit with status 1
-          "--allow-missing-template-keys=false"
-        ];
-      in ''
-        until kubectl get nodes ${concatStringsSep " " args} 2>/dev/null; do
-          echo Waiting for ${top.kubelet.hostname} to be RegisteredNode
-          sleep 1
-        done
-      '';
-      unitConfig.ConditionPathExists = flannelPaths;
-    };
-
-    systemd.paths.flannel = {
-      wantedBy = [ "flannel.service" ];
-      pathConfig = {
-        PathExists = flannelPaths;
-        PathChanged = flannelPaths;
-      };
-    };
-
-    services.kubernetes.flannel.kubeconfig.server = mkDefault top.apiserverAddress;
 
     systemd.services.docker = {
       environment.DOCKER_OPTS = "-b none";
···
 
     # give flannel som kubernetes rbac permissions if applicable
     services.kubernetes.addonManager.bootstrapAddons = mkIf ((storageBackend == "kubernetes") && (elem "RBAC" top.apiserver.authorizationMode)) {
+
       flannel-cr = {
         apiVersion = "rbac.authorization.k8s.io/v1beta1";
         kind = "ClusterRole";
···
           name = "flannel-client";
         }];
       };
+
     };
   };
 }

nixos/modules/services/cluster/kubernetes/kubelet.nix

···
       type = str;
     };
 
-    allowPrivileged = mkOption {
-      description = "Whether to allow Kubernetes containers to request privileged mode.";
-      default = false;
-      type = bool;
-    };
-
     clusterDns = mkOption {
       description = "Use alternative DNS.";
       default = "10.1.0.1";
···
 
   ###### implementation
   config = mkMerge [
-    (let
-
-      kubeletPaths = filter (a: a != null) [
-        cfg.kubeconfig.caFile
-        cfg.kubeconfig.certFile
-        cfg.kubeconfig.keyFile
-        cfg.clientCaFile
-        cfg.tlsCertFile
-        cfg.tlsKeyFile
-      ];
-
-    in mkIf cfg.enable {
+    (mkIf cfg.enable {
       services.kubernetes.kubelet.seedDockerImages = [infraContainer];
 
       systemd.services.kubelet = {
         description = "Kubernetes Kubelet Service";
-        wantedBy = [ "kubelet.target" ];
-        after = [ "kube-control-plane-online.target" ];
-        before = [ "kubelet.target" ];
+        wantedBy = [ "kubernetes.target" ];
+        after = [ "network.target" "docker.service" "kube-apiserver.service" ];
         path = with pkgs; [ gitMinimal openssh docker utillinux iproute ethtool thin-provisioning-tools iptables socat ] ++ top.path;
         preStart = ''
-          rm -f /opt/cni/bin/* || true
+          ${concatMapStrings (img: ''
+            echo "Seeding docker image: ${img}"
+            docker load <${img}
+          '') cfg.seedDockerImages}
+
+          rm /opt/cni/bin/* || true
           ${concatMapStrings (package: ''
             echo "Linking cni package: ${package}"
             ln -fs ${package}/bin/* /opt/cni/bin
···
           RestartSec = "1000ms";
           ExecStart = ''${top.package}/bin/kubelet \
             --address=${cfg.address} \
-            --allow-privileged=${boolToString cfg.allowPrivileged} \
             --authentication-token-webhook \
             --authentication-token-webhook-cache-ttl="10s" \
             --authorization-mode=Webhook \
···
           '';
           WorkingDirectory = top.dataDir;
         };
-        unitConfig.ConditionPathExists = kubeletPaths;
-      };
-
-      systemd.paths.kubelet = {
-        wantedBy =  [ "kubelet.service" ];
-        pathConfig = {
-          PathExists = kubeletPaths;
-          PathChanged = kubeletPaths;
-        };
-      };
-
-      systemd.services.docker.before = [ "kubelet.service" ];
-
-      systemd.services.docker-seed-images = {
-        wantedBy = [ "docker.service" ];
-        after = [ "docker.service" ];
-        before = [ "kubelet.service" ];
-        path = with pkgs; [ docker ];
-        preStart = ''
-          ${concatMapStrings (img: ''
-            echo "Seeding docker image: ${img}"
-            docker load <${img}
-          '') cfg.seedDockerImages}
-        '';
-        script = "echo Ok";
-        serviceConfig.Type = "oneshot";
-        serviceConfig.RemainAfterExit = true;
-        serviceConfig.Slice = "kubernetes.slice";
-      };
-
-      systemd.services.kubelet-online = {
-        wantedBy = [ "kube-node-online.target" ];
-        after = [ "flannel.target" "kubelet.target" ];
-        before = [ "kube-node-online.target" ];
-        # it is complicated. flannel needs kubelet to run the pause container before
-        # it discusses the node CIDR with apiserver and afterwards configures and restarts
-        # dockerd. Until then prevent creating any pods because they have to be recreated anyway
-        # because the network of docker0 has been changed by flannel.
-        script = let
-          docker-env = "/run/flannel/docker";
-          flannel-date = "stat --print=%Y ${docker-env}";
-          docker-date = "systemctl show --property=ActiveEnterTimestamp --value docker";
-        in ''
-          until test -f ${docker-env} ; do sleep 1 ; done
-          while test `${flannel-date}` -gt `date +%s --date="$(${docker-date})"` ; do
-            sleep 1
-          done
-        '';
-        serviceConfig.Type = "oneshot";
-        serviceConfig.Slice = "kubernetes.slice";
       };
 
       # Allways include cni plugins
···
       };
     })
 
-    {
-      systemd.targets.kubelet = {
-        wantedBy = [ "kube-node-online.target" ];
-        before = [ "kube-node-online.target" ];
-      };
-
-      systemd.targets.kube-node-online = {
-        wantedBy = [ "kubernetes.target" ];
-        before = [ "kubernetes.target" ];
-      };
-    }
   ];
 }

nixos/modules/services/cluster/kubernetes/pki.nix

···
   certmgrAPITokenPath = "${top.secretsPath}/${cfsslAPITokenBaseName}";
   cfsslAPITokenLength = 32;
 
-  clusterAdminKubeconfig = with cfg.certs.clusterAdmin; {
-    server = top.apiserverAddress;
-    certFile = cert;
-    keyFile = key;
-  };
+  clusterAdminKubeconfig = with cfg.certs.clusterAdmin;
+    top.lib.mkKubeConfig "cluster-admin" {
+        server = top.apiserverAddress;
+        certFile = cert;
+        keyFile = key;
+    };
 
   remote = with config.services; "https://${kubernetes.masterAddress}:${toString cfssl.port}";
 in
···
     cfsslCertPathPrefix = "${config.services.cfssl.dataDir}/cfssl";
     cfsslCert = "${cfsslCertPathPrefix}.pem";
     cfsslKey = "${cfsslCertPathPrefix}-key.pem";
-
-    certmgrPaths = [
-      top.caFile
-      certmgrAPITokenPath
-    ];
   in
   {
 
···
         chown cfssl "${cfsslAPITokenPath}" && chmod 400 "${cfsslAPITokenPath}"
       '')]);
 
-    systemd.targets.cfssl-online = {
-      wantedBy = [ "network-online.target" ];
-      after = [ "cfssl.service" "network-online.target" "cfssl-online.service" ];
-    };
-
-    systemd.services.cfssl-online = {
-      description = "Wait for ${remote} to be reachable.";
-      wantedBy = [ "cfssl-online.target" ];
-      before = [ "cfssl-online.target" ];
-      path = [ pkgs.curl ];
-      preStart = ''
-        until curl --fail-early -fskd '{}' ${remote}/api/v1/cfssl/info -o /dev/null; do
-          echo curl ${remote}/api/v1/cfssl/info: exit status $?
-          sleep 2
-        done
-      '';
-      script = "echo Ok";
-      serviceConfig = {
-        TimeoutSec = "300";
-      };
-    };
-
     systemd.services.kube-certmgr-bootstrap = {
       description = "Kubernetes certmgr bootstrapper";
-      wantedBy = [ "cfssl-online.target" ];
-      after = [ "cfssl-online.target" ];
-      before = [ "certmgr.service" ];
-      path = with pkgs; [ curl cfssl ];
+      wantedBy = [ "certmgr.service" ];
+      after = [ "cfssl.target" ];
       script = concatStringsSep "\n" [''
         set -e
-
-        mkdir -p $(dirname ${certmgrAPITokenPath})
-        mkdir -p $(dirname ${top.caFile})
 
         # If there's a cfssl (cert issuer) running locally, then don't rely on user to
         # manually paste it in place. Just symlink.
···
         fi
       ''
       (optionalString (cfg.pkiTrustOnBootstrap) ''
-        if [ ! -s "${top.caFile}" ]; then
-          until test -s ${top.caFile}.json; do
-            sleep 2
-            curl --fail-early -fskd '{}' ${remote}/api/v1/cfssl/info -o ${top.caFile}.json
-          done
-          cfssljson -f ${top.caFile}.json -stdout >${top.caFile}
-          rm ${top.caFile}.json
+        if [ ! -f "${top.caFile}" ] || [ $(cat "${top.caFile}" | wc -c) -lt 1 ]; then
+          ${pkgs.curl}/bin/curl --fail-early -f -kd '{}' ${remote}/api/v1/cfssl/info | \
+            ${pkgs.cfssl}/bin/cfssljson -stdout >${top.caFile}
         fi
       '')
       ];
       serviceConfig = {
-        TimeoutSec = "500";
+        RestartSec = "10s";
+        Restart = "on-failure";
       };
     };
 
···
           mapAttrs mkSpec cfg.certs;
       };
 
-      systemd.services.certmgr = {
-        wantedBy = [ "cfssl-online.target" ];
-        after = [ "cfssl-online.target" "kube-certmgr-bootstrap.service" ];
-        preStart = ''
-          while ! test -s ${certmgrAPITokenPath} ; do
-            sleep 1
-            echo Waiting for ${certmgrAPITokenPath}
-          done
-        '';
-        unitConfig.ConditionPathExists = certmgrPaths;
-      };
+      #TODO: Get rid of kube-addon-manager in the future for the following reasons
+      # - it is basically just a shell script wrapped around kubectl
+      # - it assumes that it is clusterAdmin or can gain clusterAdmin rights through serviceAccount
+      # - it is designed to be used with k8s system components only
+      # - it would be better with a more Nix-oriented way of managing addons
+      systemd.services.kube-addon-manager = mkIf top.addonManager.enable (mkMerge [{
+        environment.KUBECONFIG = with cfg.certs.addonManager;
+          top.lib.mkKubeConfig "addon-manager" {
+            server = top.apiserverAddress;
+            certFile = cert;
+            keyFile = key;
+          };
+        }
 
-      systemd.paths.certmgr = {
-        wantedBy = [ "certmgr.service" ];
-        pathConfig = {
-          PathExists = certmgrPaths;
-          PathChanged = certmgrPaths;
-        };
-      };
+        (optionalAttrs (top.addonManager.bootstrapAddons != {}) {
+          serviceConfig.PermissionsStartOnly = true;
+          preStart = with pkgs;
+          let
+            files = mapAttrsToList (n: v: writeText "${n}.json" (builtins.toJSON v))
+              top.addonManager.bootstrapAddons;
+          in
+          ''
+            export KUBECONFIG=${clusterAdminKubeconfig}
+            ${kubectl}/bin/kubectl apply -f ${concatStringsSep " \\\n -f " files}
+          '';
+        })]);
 
-      environment.etc.${cfg.etcClusterAdminKubeconfig}.source = mkIf (cfg.etcClusterAdminKubeconfig != null)
-        (top.lib.mkKubeConfig "cluster-admin" clusterAdminKubeconfig);
+      environment.etc.${cfg.etcClusterAdminKubeconfig}.source = mkIf (!isNull cfg.etcClusterAdminKubeconfig)
+        clusterAdminKubeconfig;
 
       environment.systemPackages = mkIf (top.kubelet.enable || top.proxy.enable) [
       (pkgs.writeScriptBin "nixos-kubernetes-node-join" ''
···
           exit 1
         fi
 
-        do_restart=$(test -s ${certmgrAPITokenPath} && echo -n y || echo -n n)
-
         echo $token > ${certmgrAPITokenPath}
         chmod 600 ${certmgrAPITokenPath}
 
-        if [ y = $do_restart ]; then
-          echo "Restarting certmgr..." >&1
-          systemctl restart certmgr
-        fi
+        echo "Restarting certmgr..." >&1
+        systemctl restart certmgr
 
-        echo "Node joined succesfully" >&1
+        echo "Waiting for certs to appear..." >&1
+
+        ${optionalString top.kubelet.enable ''
+          while [ ! -f ${cfg.certs.kubelet.cert} ]; do sleep 1; done
+          echo "Restarting kubelet..." >&1
+          systemctl restart kubelet
+        ''}
+
+        ${optionalString top.proxy.enable ''
+          while [ ! -f ${cfg.certs.kubeProxyClient.cert} ]; do sleep 1; done
+          echo "Restarting kube-proxy..." >&1
+          systemctl restart kube-proxy
+        ''}
+
+        ${optionalString top.flannel.enable ''
+          while [ ! -f ${cfg.certs.flannelClient.cert} ]; do sleep 1; done
+          echo "Restarting flannel..." >&1
+          systemctl restart flannel
+        ''}
+
+        echo "Node joined succesfully"
       '')];
 
       # isolate etcd on loopback at the master node
       # easyCerts doesn't support multimaster clusters anyway atm.
-      services.etcd = mkIf top.apiserver.enable (with cfg.certs.etcd; {
+      services.etcd = with cfg.certs.etcd; {
         listenClientUrls = ["https://127.0.0.1:2379"];
         listenPeerUrls = ["https://127.0.0.1:2380"];
         advertiseClientUrls = ["https://etcd.local:2379"];
···
         certFile = mkDefault cert;
         keyFile = mkDefault key;
         trustedCaFile = mkDefault caCert;
-      });
+      };
       networking.extraHosts = mkIf (config.services.etcd.enable) ''
         127.0.0.1 etcd.${top.addons.dns.clusterDomain} etcd.local
       '';
+
+      services.flannel = with cfg.certs.flannelClient; {
+        kubeconfig = top.lib.mkKubeConfig "flannel" {
+          server = top.apiserverAddress;
+          certFile = cert;
+          keyFile = key;
+        };
+      };
 
       services.kubernetes = {
 
···
           proxyClientCertFile = mkDefault cfg.certs.apiserverProxyClient.cert;
           proxyClientKeyFile = mkDefault cfg.certs.apiserverProxyClient.key;
         });
-        addonManager = mkIf top.addonManager.enable {
-          kubeconfig = with cfg.certs.addonManager; {
-            certFile = mkDefault cert;
-            keyFile = mkDefault key;
-          };
-          bootstrapAddonsKubeconfig = clusterAdminKubeconfig;
-        };
         controllerManager = mkIf top.controllerManager.enable {
           serviceAccountKeyFile = mkDefault cfg.certs.serviceAccount.key;
           rootCaFile = cfg.certs.controllerManagerClient.caCert;
           kubeconfig = with cfg.certs.controllerManagerClient; {
             certFile = mkDefault cert;
             keyFile = mkDefault key;
-          };
-        };
-        flannel = mkIf top.flannel.enable {
-          kubeconfig = with cfg.certs.flannelClient; {
-            certFile = cert;
-            keyFile = key;
           };
         };
         scheduler = mkIf top.scheduler.enable {

nixos/modules/services/cluster/kubernetes/proxy.nix

···
   };
 
   ###### implementation
-  config = let
-
-    proxyPaths = filter (a: a != null) [
-      cfg.kubeconfig.caFile
-      cfg.kubeconfig.certFile
-      cfg.kubeconfig.keyFile
-    ];
-
-  in mkIf cfg.enable {
-    systemd.services.kube-proxy = rec {
+  config = mkIf cfg.enable {
+    systemd.services.kube-proxy = {
       description = "Kubernetes Proxy Service";
-      wantedBy = [ "kube-node-online.target" ];
-      after = [ "kubelet-online.service" ];
-      before = [ "kube-node-online.target" ];
-      environment.KUBECONFIG = top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig;
-      path = with pkgs; [ iptables conntrack_tools kubectl ];
-      preStart = ''
-        until kubectl auth can-i get nodes/${top.kubelet.hostname} -q 2>/dev/null; do
-          echo kubectl auth can-i get nodes/${top.kubelet.hostname}: exit status $?
-          sleep 2
-        done
-      '';
+      wantedBy = [ "kubernetes.target" ];
+      after = [ "kube-apiserver.service" ];
+      path = with pkgs; [ iptables conntrack_tools ];
       serviceConfig = {
         Slice = "kubernetes.slice";
         ExecStart = ''${top.package}/bin/kube-proxy \
···
             "--cluster-cidr=${top.clusterCidr}"} \
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${environment.KUBECONFIG} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
           ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
           ${cfg.extraOpts}
         '';
         WorkingDirectory = top.dataDir;
         Restart = "on-failure";
         RestartSec = 5;
-      };
-      unitConfig.ConditionPathExists = proxyPaths;
-    };
-
-    systemd.paths.kube-proxy = {
-      wantedBy = [ "kube-proxy.service" ];
-      pathConfig = {
-        PathExists = proxyPaths;
-        PathChanged = proxyPaths;
       };
     };
 

nixos/modules/services/cluster/kubernetes/scheduler.nix

···
   };
 
   ###### implementation
-  config =  let
-
-    schedulerPaths = filter (a: a != null) [
-      cfg.kubeconfig.caFile
-      cfg.kubeconfig.certFile
-      cfg.kubeconfig.keyFile
-    ];
-
-  in mkIf cfg.enable {
-    systemd.services.kube-scheduler = rec {
+  config = mkIf cfg.enable {
+    systemd.services.kube-scheduler = {
       description = "Kubernetes Scheduler Service";
-      wantedBy = [ "kube-control-plane-online.target" ];
+      wantedBy = [ "kubernetes.target" ];
       after = [ "kube-apiserver.service" ];
-      before = [ "kube-control-plane-online.target" ];
-      environment.KUBECONFIG = top.lib.mkKubeConfig "kube-scheduler" cfg.kubeconfig;
-      path = [ pkgs.kubectl ];
-      preStart = ''
-        until kubectl auth can-i get /api -q 2>/dev/null; do
-          echo kubectl auth can-i get /api: exit status $?
-          sleep 2
-        done
-      '';
       serviceConfig = {
         Slice = "kubernetes.slice";
         ExecStart = ''${top.package}/bin/kube-scheduler \
           --address=${cfg.address} \
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${environment.KUBECONFIG} \
+          --kubeconfig=${top.lib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
           --leader-elect=${boolToString cfg.leaderElect} \
           --port=${toString cfg.port} \
           ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
···
         Group = "kubernetes";
         Restart = "on-failure";
         RestartSec = 5;
-      };
-      unitConfig.ConditionPathExists = schedulerPaths;
-    };
-
-    systemd.paths.kube-scheduler = {
-      wantedBy = [ "kube-scheduler.service" ];
-      pathConfig = {
-        PathExists = schedulerPaths;
-        PathChanged = schedulerPaths;
       };
     };
 

nixos/modules/services/databases/postgresql.nix

···
         default = "";
         description = ''
           Defines the mapping from system users to database users.
+
+          The general form is:
+
+          map-name system-username database-username
         '';
       };
 

nixos/modules/services/editors/emacs.xml

···
        <para>
         The latest stable version of Emacs 25 using the
         <link
-                xlink:href="http://www.gtk.org">GTK+ 2</link>
+                xlink:href="http://www.gtk.org">GTK 2</link>
         widget toolkit.
        </para>
       </listitem>
···
    <para>
     If you want, you can tweak the Emacs package itself from your
     <filename>emacs.nix</filename>. For example, if you want to have a
-    GTK+3-based Emacs instead of the default GTK+2-based binary and remove the
+    GTK 3-based Emacs instead of the default GTK 2-based binary and remove the
     automatically generated <filename>emacs.desktop</filename> (useful is you
     only use <command>emacsclient</command>), you can change your file
     <filename>emacs.nix</filename> in this way:
···
 
    <para>
     After building this file as shown in <xref linkend="ex-emacsNix" />, you
-    will get an GTK3-based Emacs binary pre-loaded with your favorite packages.
+    will get an GTK 3-based Emacs binary pre-loaded with your favorite packages.
    </para>
   </section>
  </section>

nixos/modules/services/misc/zookeeper.nix

···
 
     systemd.tmpfiles.rules = [
       "d '${cfg.dataDir}' 0700 zookeeper - - -"
+      "Z '${cfg.dataDir}' 0700 zookeeper - - -"
     ];
 
     systemd.services.zookeeper = {

nixos/modules/services/network-filesystems/ceph.nix

···
 with lib;
 
 let
-  ceph = pkgs.ceph;
   cfg  = config.services.ceph;
+
   # function that translates "camelCaseOptions" to "camel case options", credits to tilpner in #nixos@freenode
-  translateOption = replaceStrings upperChars (map (s: " ${s}") lowerChars);
-  generateDaemonList = (daemonType: daemons: extraServiceConfig:
-    mkMerge (
-      map (daemon:
-        { "ceph-${daemonType}-${daemon}" = generateServiceFile daemonType daemon cfg.global.clusterName ceph extraServiceConfig; }
-      ) daemons
-    )
-  );
-  generateServiceFile = (daemonType: daemonId: clusterName: ceph: extraServiceConfig: {
+  expandCamelCase = replaceStrings upperChars (map (s: " ${s}") lowerChars);
+  expandCamelCaseAttrs = mapAttrs' (name: value: nameValuePair (expandCamelCase name) value);
+
+  makeServices = (daemonType: daemonIds: extraServiceConfig:
+    mkMerge (map (daemonId:
+      { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName pkgs.ceph extraServiceConfig; })
+      daemonIds));
+
+  makeService = (daemonType: daemonId: clusterName: ceph: extraServiceConfig: {
     enable = true;
     description = "Ceph ${builtins.replaceStrings lowerChars upperChars daemonType} daemon ${daemonId}";
     after = [ "network-online.target" "time-sync.target" ] ++ optional (daemonType == "osd") "ceph-mon.target";
···
       Restart = "on-failure";
       StartLimitBurst = "5";
       StartLimitInterval = "30min";
-      ExecStart = "${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} -f --cluster ${clusterName} --id ${if daemonType == "rgw" then "client.${daemonId}" else daemonId} --setuser ceph --setgroup ceph";
+      ExecStart = ''${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
+                    -f --cluster ${clusterName} --id ${daemonId} --setuser ceph \
+                    --setgroup ${if daemonType == "osd" then "disk" else "ceph"}'';
     } // extraServiceConfig
-      // optionalAttrs (daemonType == "osd") { ExecStartPre = "${ceph.out}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}"; };
-    } // optionalAttrs (builtins.elem daemonType [ "mds" "mon" "rgw" "mgr" ]) { preStart = ''
+      // optionalAttrs (daemonType == "osd") { ExecStartPre = ''${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh \
+                                                              --id ${daemonId} --cluster ${clusterName}''; };
+    } // optionalAttrs (builtins.elem daemonType [ "mds" "mon" "rgw" "mgr" ]) {
+      preStart = ''
         daemonPath="/var/lib/ceph/${if daemonType == "rgw" then "radosgw" else daemonType}/${clusterName}-${daemonId}"
-        if [ ! -d ''$daemonPath ]; then
-          mkdir -m 755 -p ''$daemonPath
-          chown -R ceph:ceph ''$daemonPath
+        if [ ! -d $daemonPath ]; then
+          mkdir -m 755 -p $daemonPath
+          chown -R ceph:ceph $daemonPath
         fi
       '';
     } // optionalAttrs (daemonType == "osd") { path = [ pkgs.getopt ]; }
   );
-  generateTargetFile = (daemonType:
+
+  makeTarget = (daemonType:
     {
       "ceph-${daemonType}" = {
         description = "Ceph target allowing to start/stop all ceph-${daemonType} services at once";
         partOf = [ "ceph.target" ];
+        wantedBy = [ "ceph.target" ];
         before = [ "ceph.target" ];
       };
     }
···
         default = "ceph";
         description = ''
           Name of cluster
+        '';
+      };
+
+      mgrModulePath = mkOption {
+        type = types.path;
+        default = "${pkgs.ceph.lib}/lib/ceph/mgr";
+        description = ''
+          Path at which to find ceph-mgr modules.
         '';
       };
 
···
           A comma-separated list of subnets that will be used as cluster networks in the cluster.
         '';
       };
+
+      rgwMimeTypesFile = mkOption {
+        type = with types; nullOr path;
+        default = "${pkgs.mime-types}/etc/mime.types";
+        description = ''
+          Path to mime types used by radosgw.
+        '';
+      };
+    };
+
+    extraConfig = mkOption {
+      type = with types; attrsOf str;
+      default = {};
+      example = ''
+        {
+          "ms bind ipv6" = "true";
+        };
+      '';
+      description = ''
+        Extra configuration to add to the global section. Use for setting values that are common for all daemons in the cluster.
+      '';
     };
 
     mgr = {
···
           to the id part in ceph i.e. [ "name1" ] would result in osd.name1
         '';
       };
+
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {
···
       { assertion = cfg.global.fsid != "";
         message = "fsid has to be set to a valid uuid for the cluster to function";
       }
-      { assertion = cfg.mgr.enable == true;
-        message = "ceph 12.x requires atleast 1 MGR daemon enabled for the cluster to function";
-      }
       { assertion = cfg.mon.enable == true -> cfg.mon.daemons != [];
         message = "have to set id of atleast one MON if you're going to enable Monitor";
       }
···
       ''Not setting up a list of members in monInitialMembers requires that you set the host variable for each mon daemon or else the cluster won't function'';
 
     environment.etc."ceph/ceph.conf".text = let
-      # Translate camelCaseOptions to the expected camel case option for ceph.conf
-      translatedGlobalConfig = mapAttrs' (name: value: nameValuePair (translateOption name) value) cfg.global;
       # Merge the extraConfig set for mgr daemons, as mgr don't have their own section
-      globalAndMgrConfig = translatedGlobalConfig // optionalAttrs cfg.mgr.enable cfg.mgr.extraConfig;
+      globalSection = expandCamelCaseAttrs (cfg.global // cfg.extraConfig // optionalAttrs cfg.mgr.enable cfg.mgr.extraConfig);
       # Remove all name-value pairs with null values from the attribute set to avoid making empty sections in the ceph.conf
-      globalConfig = mapAttrs' (name: value: nameValuePair (translateOption name) value) (filterAttrs (name: value: value != null) globalAndMgrConfig);
+      globalSection' = filterAttrs (name: value: value != null) globalSection;
       totalConfig = {
-          global = globalConfig;
+          global = globalSection';
         } // optionalAttrs (cfg.mon.enable && cfg.mon.extraConfig != {}) { mon = cfg.mon.extraConfig; }
           // optionalAttrs (cfg.mds.enable && cfg.mds.extraConfig != {}) { mds = cfg.mds.extraConfig; }
           // optionalAttrs (cfg.osd.enable && cfg.osd.extraConfig != {}) { osd = cfg.osd.extraConfig; }
···
       name = "ceph";
       uid = config.ids.uids.ceph;
       description = "Ceph daemon user";
+      group = "ceph";
+      extraGroups = [ "disk" ];
     };
-
     users.groups = singleton {
       name = "ceph";
       gid = config.ids.gids.ceph;
···
 
     systemd.services = let
       services = []
-        ++ optional cfg.mon.enable (generateDaemonList "mon" cfg.mon.daemons { RestartSec = "10"; })
-        ++ optional cfg.mds.enable (generateDaemonList "mds" cfg.mds.daemons { StartLimitBurst = "3"; })
-        ++ optional cfg.osd.enable (generateDaemonList "osd" cfg.osd.daemons { StartLimitBurst = "30"; RestartSec = "20s"; })
-        ++ optional cfg.rgw.enable (generateDaemonList "rgw" cfg.rgw.daemons { })
-        ++ optional cfg.mgr.enable (generateDaemonList "mgr" cfg.mgr.daemons { StartLimitBurst = "3"; });
+        ++ optional cfg.mon.enable (makeServices "mon" cfg.mon.daemons { RestartSec = "10"; })
+        ++ optional cfg.mds.enable (makeServices "mds" cfg.mds.daemons { StartLimitBurst = "3"; })
+        ++ optional cfg.osd.enable (makeServices "osd" cfg.osd.daemons { StartLimitBurst = "30";
+                                                                         RestartSec = "20s";
+                                                                         PrivateDevices = "no"; # osd needs disk access
+                                                                       })
+        ++ optional cfg.rgw.enable (makeServices "rgw" cfg.rgw.daemons { })
+        ++ optional cfg.mgr.enable (makeServices "mgr" cfg.mgr.daemons { StartLimitBurst = "3"; });
       in
         mkMerge services;
 
     systemd.targets = let
       targets = [
-        { ceph = { description = "Ceph target allowing to start/stop all ceph service instances at once"; }; }
-      ] ++ optional cfg.mon.enable (generateTargetFile "mon")
-        ++ optional cfg.mds.enable (generateTargetFile "mds")
-        ++ optional cfg.osd.enable (generateTargetFile "osd")
-        ++ optional cfg.rgw.enable (generateTargetFile "rgw")
-        ++ optional cfg.mgr.enable (generateTargetFile "mgr");
+        { "ceph" = { description = "Ceph target allowing to start/stop all ceph service instances at once";
+                     wantedBy = [ "multi-user.target" ]; }; }
+      ] ++ optional cfg.mon.enable (makeTarget "mon")
+        ++ optional cfg.mds.enable (makeTarget "mds")
+        ++ optional cfg.osd.enable (makeTarget "osd")
+        ++ optional cfg.rgw.enable (makeTarget "rgw")
+        ++ optional cfg.mgr.enable (makeTarget "mgr");
       in
         mkMerge targets;
 

nixos/modules/services/web-servers/darkhttpd.nix

···
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         DynamicUser = true;
-        ExecStart = "${cfg.package}/bin/darkhttpd ${args}";
+        ExecStart = "${pkgs.darkhttpd}/bin/darkhttpd ${args}";
         AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
         Restart = "on-failure";
         RestartSec = "2s";

nixos/modules/services/x11/desktop-managers/enlightenment.nix

···
       e.efl e.enlightenment
       e.terminology e.econnman
       pkgs.xorg.xauth # used by kdesu
-      pkgs.gtk2 # To get GTK+'s themes.
+      pkgs.gtk2 # To get GTK's themes.
       pkgs.tango-icon-theme
 
       pkgs.gnome2.gnome_icon_theme
···
     services.xserver.desktopManager.session = [
     { name = "Enlightenment";
       start = ''
-        # Set GTK_DATA_PREFIX so that GTK+ can find the themes
+        # Set GTK_DATA_PREFIX so that GTK can find the themes
         export GTK_DATA_PREFIX=${config.system.path}
         # find theme engines
         export GTK_PATH=${config.system.path}/lib/gtk-3.0:${config.system.path}/lib/gtk-2.0

nixos/modules/services/x11/desktop-managers/mate.nix

···
       name = "mate";
       bgSupport = true;
       start = ''
-        # Set GTK_DATA_PREFIX so that GTK+ can find the themes
+        # Set GTK_DATA_PREFIX so that GTK can find the themes
         export GTK_DATA_PREFIX=${config.system.path}
 
         # Find theme engines

nixos/modules/services/x11/desktop-managers/xfce.nix

···
 
   config = mkIf cfg.enable {
     environment.systemPackages = with pkgs.xfce // pkgs; [
-      # Get GTK+ themes and gtk-update-icon-cache
+      # Get GTK themes and gtk-update-icon-cache
       gtk2.out
 
       # Supplies some abstract icons such as:
···
       start = ''
         ${cfg.extraSessionCommands}
 
-        # Set GTK_PATH so that GTK+ can find the theme engines.
+        # Set GTK_PATH so that GTK can find the theme engines.
         export GTK_PATH="${config.system.path}/lib/gtk-2.0:${config.system.path}/lib/gtk-3.0"
 
-        # Set GTK_DATA_PREFIX so that GTK+ can find the Xfce themes.
+        # Set GTK_DATA_PREFIX so that GTK can find the Xfce themes.
         export GTK_DATA_PREFIX=${config.system.path}
 
         ${pkgs.runtimeShell} ${pkgs.xfce.xinitrc} &

nixos/modules/services/x11/desktop-managers/xfce4-14.nix

···
       name = "xfce4-14";
       bgSupport = true;
       start = ''
-        # Set GTK_PATH so that GTK+ can find the theme engines.
+        # Set GTK_PATH so that GTK can find the theme engines.
         export GTK_PATH="${config.system.path}/lib/gtk-2.0:${config.system.path}/lib/gtk-3.0"
 
-        # Set GTK_DATA_PREFIX so that GTK+ can find the Xfce themes.
+        # Set GTK_DATA_PREFIX so that GTK can find the Xfce themes.
         export GTK_DATA_PREFIX=${config.system.path}
 
         ${pkgs.runtimeShell} ${pkgs.xfce4-14.xinitrc} &

nixos/modules/virtualisation/amazon-image.nix

···
       { assertion = cfg.hvm;
         message = "Paravirtualized EC2 instances are no longer supported.";
       }
+      { assertion = cfg.efi -> cfg.hvm;
+        message = "EC2 instances using EFI must be HVM instances.";
+      }
     ];
 
     boot.growPartition = cfg.hvm;
···
       device = "/dev/disk/by-label/nixos";
       fsType = "ext4";
       autoResize = true;
+    };
+
+    fileSystems."/boot" = mkIf cfg.efi {
+      device = "/dev/disk/by-label/ESP";
+      fsType = "vfat";
     };
 
     boot.extraModulePackages = [
···
 
     # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
     boot.loader.grub.version = if cfg.hvm then 2 else 1;
-    boot.loader.grub.device = if cfg.hvm then "/dev/xvda" else "nodev";
+    boot.loader.grub.device = if (cfg.hvm && !cfg.efi) then "/dev/xvda" else "nodev";
     boot.loader.grub.extraPerEntryConfig = mkIf (!cfg.hvm) "root (hd0)";
+    boot.loader.grub.efiSupport = cfg.efi;
+    boot.loader.grub.efiInstallAsRemovable = cfg.efi;
     boot.loader.timeout = 0;
 
     boot.initrd.network.enable = true;
···
     networking.timeServers = [ "169.254.169.123" ];
 
     # udisks has become too bloated to have in a headless system
-    # (e.g. it depends on GTK+).
+    # (e.g. it depends on GTK).
     services.udisks2.enable = false;
   };
 }

nixos/modules/virtualisation/amazon-options.nix

···
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 {
   options = {
     ec2 = {
···
         internal = true;
         description = ''
           Whether the EC2 instance is a HVM instance.
+        '';
+      };
+      efi = lib.mkOption {
+        default = pkgs.stdenv.hostPlatform.isAarch64;
+        internal = true;
+        description = ''
+          Whether the EC2 instance is using EFI.
         '';
       };
     };

nixos/modules/virtualisation/railcar.nix

···
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.railcar;
+  generateUnit = name: containerConfig:
+    let
+      container = pkgs.ociTools.buildContainer {
+        args = [
+          (pkgs.writeShellScript "run.sh" containerConfig.cmd).outPath
+        ];
+      };
+    in
+      nameValuePair "railcar-${name}" {
+        enable = true;
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+            ExecStart = ''
+              ${cfg.package}/bin/railcar -r ${cfg.stateDir} run ${name} -b ${container}
+            '';
+            Type = containerConfig.runType;
+          };
+      };
+  mount = with types; (submodule {
+    options = {
+      type = mkOption {
+        type = string;
+        default = "none";
+        description = ''
+          The type of the filesystem to be mounted.
+          Linux: filesystem types supported by the kernel as listed in 
+          `/proc/filesystems` (e.g., "minix", "ext2", "ext3", "jfs", "xfs", 
+          "reiserfs", "msdos", "proc", "nfs", "iso9660"). For bind mounts 
+          (when options include either bind or rbind), the type is a dummy,
+          often "none" (not listed in /proc/filesystems).
+        '';
+      };
+      source = mkOption {
+        type = string;
+        description = "Source for the in-container mount";
+      };
+      options = mkOption {
+        type = loaOf (string);
+        default = [ "bind" ];
+        description = ''
+          Mount options of the filesystem to be used.
+        
+          Support optoions are listed in the mount(8) man page. Note that 
+          both filesystem-independent and filesystem-specific options 
+          are listed.
+        '';
+      };
+    };
+  });
+in
+{
+  options.services.railcar = {
+    enable = mkEnableOption "railcar";
+
+    containers = mkOption {
+      default = {};
+      description = "Declarative container configuration";
+      type = with types; loaOf (submodule ({ name, config, ... }: {
+        options = {
+          cmd = mkOption {
+            type = types.string;
+            description = "Command or script to run inside the container";
+          };
+
+          mounts = mkOption {
+            type = with types; attrsOf mount;
+            default = {};
+            description = ''
+              A set of mounts inside the container.
+
+              The defaults have been chosen for simple bindmounts, meaning
+              that you only need to provide the "source" parameter.
+            '';
+            example = ''
+              { "/data" = { source = "/var/lib/data"; }; }
+            '';
+          };
+
+          runType = mkOption {
+            type = types.string;
+            default = "oneshot";
+            description = "The systemd service run type";
+          };
+
+          os = mkOption {
+            type = types.string;
+            default = "linux";
+            description = "OS type of the container";
+          };
+
+          arch = mkOption {
+            type = types.string;
+            default = "x86_64";
+            description = "Computer architecture type of the container";
+          };
+        };
+      }));
+    };
+
+    stateDir = mkOption {
+      type = types.path;
+      default = ''/var/railcar'';
+      description = "Railcar persistent state directory";
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.railcar;
+      description = "Railcar package to use";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services = flip mapAttrs' cfg.containers (name: containerConfig:
+      generateUnit name containerConfig
+    );
+  };
+}
+

nixos/release.nix

···
   );
 
 
+  # A disk image that can be imported to Amazon EC2 and registered as an AMI
+  amazonImage = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system:
+
+    with import nixpkgs { inherit system; };
+
+    hydraJob ((import lib/eval-config.nix {
+      inherit system;
+      modules =
+        [ versionModule
+          ./maintainers/scripts/ec2/amazon-image.nix
+        ];
+    }).config.system.build.amazonImage)
+
+  );
+
+
   # Ensure that all packages used by the minimal NixOS config end up in the channel.
   dummy = forAllSystems (system: pkgs.runCommand "dummy"
     { toplevel = (import lib/eval-config.nix {

nixos/tests/ceph.nix

···
-import ./make-test.nix ({pkgs, ...}: {
+import ./make-test.nix ({pkgs, lib, ...}: {
   name = "All-in-one-basic-ceph-cluster";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ lejonet ];
···
   nodes = {
     aio = { pkgs, ... }: {
       virtualisation = {
+        memorySize = 1536;
         emptyDiskImages = [ 20480 20480 ];
         vlans = [ 1 ];
       };
···
         ceph
         xfsprogs
       ];
-      nixpkgs.config.packageOverrides = super: {
-        ceph = super.ceph.override({ nss = super.nss; libxfs = super.libxfs; libaio = super.libaio; jemalloc = super.jemalloc; });
-      };
 
       boot.kernelModules = [ "xfs" ];
 
···
         enable = true;
         daemons = [ "0" "1" ];
       };
+
+      # So that we don't have to battle systemd when bootstraping
+      systemd.targets.ceph.wantedBy = lib.mkForce [];
     };
   };
 
···
 
     # Create the ceph-related directories
     $aio->mustSucceed(
-      "mkdir -p /var/lib/ceph/mgr/ceph-aio/",
-      "mkdir -p /var/lib/ceph/mon/ceph-aio/",
-      "mkdir -p /var/lib/ceph/osd/ceph-{0..1}/",
-      "chown ceph:ceph -R /var/lib/ceph/"
+      "mkdir -p /var/lib/ceph/mgr/ceph-aio",
+      "mkdir -p /var/lib/ceph/mon/ceph-aio",
+      "mkdir -p /var/lib/ceph/osd/ceph-{0,1}",
+      "chown ceph:ceph -R /var/lib/ceph/",
+      "mkdir -p /etc/ceph",
+      "chown ceph:ceph -R /etc/ceph"
     );
 
     # Bootstrap ceph-mon daemon
     $aio->mustSucceed(
-      "mkdir -p /var/lib/ceph/bootstrap-osd && chown ceph:ceph /var/lib/ceph/bootstrap-osd",
       "sudo -u ceph ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *'",
-      "ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --set-uid=0 --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
-      "ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
-            "monmaptool --create --add aio 192.168.1.1 --fsid 066ae264-2a5d-4729-8001-6ad265f50b03 /tmp/monmap",
+      "sudo -u ceph ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *'",
+      "sudo -u ceph ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring",
+      "monmaptool --create --add aio 192.168.1.1 --fsid 066ae264-2a5d-4729-8001-6ad265f50b03 /tmp/monmap",
       "sudo -u ceph ceph-mon --mkfs -i aio --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring",
-      "touch /var/lib/ceph/mon/ceph-aio/done",
+      "sudo -u ceph touch /var/lib/ceph/mon/ceph-aio/done",
       "systemctl start ceph-mon-aio"
     );
     $aio->waitForUnit("ceph-mon-aio");
+    $aio->mustSucceed("ceph mon enable-msgr2");
 
     # Can't check ceph status until a mon is up
     $aio->succeed("ceph -s | grep 'mon: 1 daemons'");
···
     );
     $aio->waitForUnit("ceph-mgr-aio");
     $aio->waitUntilSucceeds("ceph -s | grep 'quorum aio'");
+    $aio->waitUntilSucceeds("ceph -s | grep 'mgr: aio(active,'");
 
     # Bootstrap both OSDs
     $aio->mustSucceed(
···
       "systemctl start ceph-osd-1"
     );
 
-    $aio->waitUntilSucceeds("ceph osd stat | grep '2 osds: 2 up, 2 in'");
-    $aio->waitUntilSucceeds("ceph -s | grep 'mgr: aio(active)'");
+    $aio->waitUntilSucceeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'");
+    $aio->waitUntilSucceeds("ceph -s | grep 'mgr: aio(active,'");
     $aio->waitUntilSucceeds("ceph -s | grep 'HEALTH_OK'");
 
     $aio->mustSucceed(
···
       "ceph osd pool ls | grep 'aio-test'",
       "ceph osd pool delete aio-other-test aio-other-test --yes-i-really-really-mean-it"
     );
+
+    # As we disable the target in the config, we still want to test that it works as intended
+    $aio->mustSucceed(
+      "systemctl stop ceph-osd-0",
+      "systemctl stop ceph-osd-1",
+      "systemctl stop ceph-mgr-aio",
+      "systemctl stop ceph-mon-aio"
+    );
+    $aio->succeed("systemctl start ceph.target");
+    $aio->waitForUnit("ceph-mon-aio");
+    $aio->waitForUnit("ceph-mgr-aio");
+    $aio->waitForUnit("ceph-osd-0");
+    $aio->waitForUnit("ceph-osd-1");
+    $aio->succeed("ceph -s | grep 'mon: 1 daemons'");
+    $aio->waitUntilSucceeds("ceph -s | grep 'quorum aio'");
+    $aio->waitUntilSucceeds("ceph osd stat | grep -e '2 osds: 2 up[^,]*, 2 in'");
+    $aio->waitUntilSucceeds("ceph -s | grep 'mgr: aio(active,'");
+    $aio->waitUntilSucceeds("ceph -s | grep 'HEALTH_OK'");
   '';
 })

nixos/tests/kubernetes/base.nix

···
         { config, pkgs, lib, nodes, ... }:
           mkMerge [
             {
-              boot = {
-                postBootCommands = "rm -fr /var/lib/kubernetes/secrets /tmp/shared/*";
-                kernel.sysctl = { "fs.inotify.max_user_instances" = 256; };
-              };
+              boot.postBootCommands = "rm -fr /var/lib/kubernetes/secrets /tmp/shared/*";
               virtualisation.memorySize = mkDefault 1536;
               virtualisation.diskSize = mkDefault 4096;
               networking = {

nixos/tests/kubernetes/dns.nix

···
   singleNodeTest = {
     test = ''
       # prepare machine1 for test
-      $machine1->waitForUnit("kubernetes.target");
       $machine1->waitUntilSucceeds("kubectl get node machine1.${domain} | grep -w Ready");
       $machine1->waitUntilSucceeds("docker load < ${redisImage}");
       $machine1->waitUntilSucceeds("kubectl create -f ${redisPod}");
···
       # Node token exchange
       $machine1->waitUntilSucceeds("cp -f /var/lib/cfssl/apitoken.secret /tmp/shared/apitoken.secret");
       $machine2->waitUntilSucceeds("cat /tmp/shared/apitoken.secret | nixos-kubernetes-node-join");
-      $machine1->waitForUnit("kubernetes.target");
-      $machine2->waitForUnit("kubernetes.target");
 
       # prepare machines for test
       $machine1->waitUntilSucceeds("kubectl get node machine2.${domain} | grep -w Ready");

nixos/tests/kubernetes/rbac.nix

···
 
   singlenode = base // {
     test = ''
-      $machine1->waitForUnit("kubernetes.target");
-
       $machine1->waitUntilSucceeds("kubectl get node machine1.my.zyx | grep -w Ready");
 
       $machine1->waitUntilSucceeds("docker load < ${kubectlImage}");
···
       # Node token exchange
       $machine1->waitUntilSucceeds("cp -f /var/lib/cfssl/apitoken.secret /tmp/shared/apitoken.secret");
       $machine2->waitUntilSucceeds("cat /tmp/shared/apitoken.secret | nixos-kubernetes-node-join");
-      $machine1->waitForUnit("kubernetes.target");
-      $machine2->waitForUnit("kubernetes.target");
 
       $machine1->waitUntilSucceeds("kubectl get node machine2.my.zyx | grep -w Ready");
 

nixos/tests/quake3.nix

···
 
   # Only allow the demo data to be used (only if it's unfreeRedistributable).
   unfreePredicate = pkg: with pkgs.lib; let
-    allowDrvPredicates = [ "quake3-demo" "quake3-pointrelease" ];
+    allowPackageNames = [ "quake3-demodata" "quake3-pointrelease" ];
     allowLicenses = [ pkgs.lib.licenses.unfreeRedistributable ];
-  in any (flip hasPrefix pkg.name) allowDrvPredicates &&
+  in elem pkg.pname allowPackageNames &&
      elem (pkg.meta.license or null) allowLicenses;
 
 in

pkgs/applications/audio/cozy-audiobooks/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "A modern audio book player for Linux using GTK+ 3";
+    description = "A modern audio book player for Linux using GTK 3";
     homepage = https://cozy.geigi.de/;
     maintainers = [ maintainers.makefu ];
     license = licenses.gpl3;

pkgs/applications/audio/pavucontrol/default.nix

···
     description = "PulseAudio Volume Control";
 
     longDescription = ''
-      PulseAudio Volume Control (pavucontrol) provides a GTK+
+      PulseAudio Volume Control (pavucontrol) provides a GTK
       graphical user interface to connect to a PulseAudio server and
       easily control the volume of all clients, sinks, etc.
     '';

pkgs/applications/audio/quodlibet/default.nix

···
   preFixup = stdenv.lib.optionalString (kakasi != null) "gappsWrapperArgs+=(--prefix PATH : ${kakasi}/bin)";
 
   meta = with stdenv.lib; {
-    description = "GTK+-based audio player written in Python, using the Mutagen tagging library";
+    description = "GTK-based audio player written in Python, using the Mutagen tagging library";
     license = licenses.gpl2Plus;
 
     longDescription = ''
-      Quod Libet is a GTK+-based audio player written in Python, using
+      Quod Libet is a GTK-based audio player written in Python, using
       the Mutagen tagging library. It's designed around the idea that
       you know how to organize your music better than we do. It lets
       you make playlists based on regular expressions (don't worry,

pkgs/applications/audio/sonata/default.nix

···
     longDescription = ''
       Sonata is an elegant client for the Music Player Daemon.
 
-      Written in Python and using the GTK+ 3 widget set, its features
+      Written in Python and using the GTK 3 widget set, its features
       include:
 
        - Expanded and collapsed views

pkgs/applications/editors/leafpad/default.nix

···
   ];
 
   meta = with stdenv.lib; {
-    description = "A notepad clone for GTK+ 2.0";
+    description = "A notepad clone for GTK 2.0";
     homepage = http://tarot.freeshell.org/leafpad;
     platforms = platforms.linux;
     maintainers = [ maintainers.flosse ];

pkgs/applications/editors/vscode/vscode.nix

···
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    "x86_64-linux" = "1np7j6xv0bxmq7762ml0h6pib8963s2vdmyvigi0fz2iik92zv8z";
-    "x86_64-darwin" = "0f87cv1sbcvix9f7hhw0vsypp0bf627xdyh4bmh0g41k17ls8wvc";
+    "x86_64-linux" = "1iz36nhkg78346g5407df6jv4d1ydb22hhgs8hiaxql3hq5z7x3q";
+    "x86_64-darwin" = "1iijk0kx90rax39iradbbafyvd3vwnzsgvyb3s13asy42pbhhkky";
   }.${system};
 in
   callPackage ./generic.nix rec {
 
-    version = "1.37.1";
+    version = "1.38.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";

pkgs/applications/editors/vscode/vscodium.nix

···
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    "x86_64-linux" = "0j6188gm66bwffyg0vn3ak8242vs2vb2cw92b9wfkiml6sfg555n";
-    "x86_64-darwin" = "0iblg0hn6jdds7d2hzp0icb5yh6hhw3fd5g4iim64ibi7lpwj2cj";
+    "x86_64-linux" = "09rq5jx7aicwp3qqi5pcv6bmyyp1rm5cfa96hvy3f4grhq1fi132";
+    "x86_64-darwin" = "1y1lbb3q5myaz7jg21x5sl0in8wr46brqj9zyrg3f16zahsagzr4";
   }.${system};
 in
   callPackage ./generic.nix rec {
 
-    version = "1.37.1";
+    version = "1.38.0";
     pname = "vscodium";
 
     executableName = "codium";

pkgs/applications/graphics/gcolor2/default.nix

···
     ++ (with perlPackages; [ perl XMLParser ]);
 
   meta = {
-    description = "Simple GTK+2 color selector";
+    description = "Simple GTK 2 color selector";
     homepage = http://gcolor2.sourceforge.net/;
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = with stdenv.lib.maintainers; [ notthemessiah ];

pkgs/applications/graphics/geeqie/default.nix

···
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    description = "Lightweight GTK+ based image viewer";
+    description = "Lightweight GTK based image viewer";
 
     longDescription =
       ''
-        Geeqie is a lightweight GTK+ based image viewer for Unix like
+        Geeqie is a lightweight GTK based image viewer for Unix like
         operating systems.  It features: EXIF, IPTC and XMP metadata
         browsing and editing interoperability; easy integration with other
         software; geeqie works on files and directories, there is no need to

pkgs/applications/graphics/mcomix/default.nix

···
         MComix is an user-friendly, customizable image viewer. It is specifically
         designed to handle comic books, but also serves as a generic viewer.
         It reads images in ZIP, RAR, 7Zip or tar archives as well as plain image
-        files. It is written in Python and uses GTK+ through the PyGTK bindings,
+        files. It is written in Python and uses GTK through the PyGTK bindings,
         and runs on both Linux and Windows.
 
         MComix is a fork of the Comix project, and aims to add bug fixes and

pkgs/applications/graphics/mtpaint/default.nix

···
   ];
 
   meta = {
-    description = "A simple GTK+1/2 painting program";
+    description = "A simple GTK painting program";
     longDescription = ''
-      mtPaint is a simple GTK+1/2 painting program designed for
+      mtPaint is a simple GTK painting program designed for
       creating icons and pixel based artwork.  It can edit indexed palette
       or 24 bit RGB images and offers basic painting and palette manipulation
       tools. It also has several other more powerful features such as channels,

pkgs/applications/misc/calibre/default.nix

···
 
 mkDerivation rec {
   pname = "calibre";
-  version = "3.47.0";
+  version = "3.47.1";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0mjj47w9pa7ihycialijrfq2qk107dcxwcwriz3b2mg4lixlawy4";
+    sha256 = "17lz6rawlv268vv8i5kj59rswsipq3c14066adaz1paw54zr62dk";
   };
 
   patches = [
···
   disallowedReferences = [ podofo.dev ];
 
   calibreDesktopItem = makeDesktopItem {
-    name = "calibre";
+    name = "calibre-gui";
     desktopName = "calibre";
     exec = "@out@/bin/calibre --detach %F";
     genericName = "E-book library management";
···
   };
 
   ebookEditDesktopItem = makeDesktopItem {
-    name = "calibre-edit-ebook";
+    name = "calibre-edit-book";
     desktopName = "Edit E-book";
     genericName = "E-book Editor";
     comment = "Edit e-books";

pkgs/applications/misc/clipit/default.nix

···
   buildInputs = [ intltool gtk2 xdotool hicolor-icon-theme ];
 
   meta = with stdenv.lib; {
-    description = "Lightweight GTK+ Clipboard Manager";
+    description = "Lightweight GTK Clipboard Manager";
     homepage    = "http://clipit.rspwn.com";
     license     = licenses.gpl3;
     platforms   = platforms.linux;

pkgs/applications/misc/epdfview/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://packages.debian.org/wheezy/epdfview;
-    description = "A lightweight PDF document viewer using Poppler and GTK+";
+    description = "A lightweight PDF document viewer using Poppler and GTK";
     longDescription = ''
-        ePDFView is a free lightweight PDF document viewer using Poppler and
-        GTK+ libraries. The aim of ePDFView is to make a simple PDF document
-        viewer, in the lines of Evince but without using the Gnome libraries.
+      ePDFView is a free lightweight PDF document viewer using Poppler and
+      GTK libraries. The aim of ePDFView is to make a simple PDF document
+      viewer, in the lines of Evince but without using the Gnome libraries.
     '';
     license = licenses.gpl2;
     maintainers = [ maintainers.astsmtl ];

pkgs/applications/misc/font-manager/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://fontmanager.github.io/;
-    description = "Simple font management for GTK+ desktop environments";
+    description = "Simple font management for GTK desktop environments";
     longDescription = ''
       Font Manager is intended to provide a way for average users to
       easily manage desktop fonts, without having to resort to command
       line tools or editing configuration files by hand. While designed
       primarily with the Gnome Desktop Environment in mind, it should
-      work well with other Gtk+ desktop environments.
+      work well with other GTK desktop environments.
 
       Font Manager is NOT a professional-grade font management solution.
     '';

pkgs/applications/misc/girara/default.nix

···
     homepage = https://pwmt.org/projects/girara/;
     description = "User interface library";
     longDescription = ''
-      girara is a library that implements a GTK+ based VIM-like user interface
+      girara is a library that implements a GTK based VIM-like user interface
       that focuses on simplicity and minimalism.
     '';
     license = licenses.zlib;

pkgs/applications/misc/gksu/default.nix

···
   meta = {
     description = "A graphical frontend for libgksu";
     longDescription = ''
-      GKSu is a library that provides a Gtk+ frontend to su and sudo.
+      GKSu is a library that provides a GTK frontend to su and sudo.
       It supports login shells and preserving environment when acting as
       a su frontend. It is useful to menu items or other graphical
       programs that need to ask a user's password to run another program

pkgs/applications/misc/gmrun/default.nix

···
     description = "Gnome Completion-Run Utility";
     longDescription = ''
       A simple program which provides a "run program" window, featuring a bash-like TAB completion.
-      It uses GTK+ interface.
+      It uses GTK interface.
       Also, supports CTRL-R / CTRL-S / "!" for searching through history.
       Running commands in a terminal with CTRL-Enter. URL handlers.
     '';

pkgs/applications/misc/grip/default.nix

···
   hardeningDisable = [ "format" ];
 
   meta = {
-    description = "GTK+-based audio CD player/ripper";
+    description = "GTK-based audio CD player/ripper";
     homepage = http://nostatic.org/grip;
     license = stdenv.lib.licenses.gpl2;
 

pkgs/applications/misc/gtk2fontsel/default.nix

···
   preferLocalBuild = true;
 
   meta = with stdenv.lib; {
-    description = "A font selection program for X11 using the GTK2 toolkit";
+    description = "A font selection program for X11 using the GTK 2 toolkit";
     longDescription = ''
-      Font selection tool similar to xfontsel implemented using GTK+ 2.
+      Font selection tool similar to xfontsel implemented using GTK 2.
       Trivial, but useful nonetheless.
     '';
     homepage = http://gtk2fontsel.sourceforge.net/;

pkgs/applications/misc/michabo/default.nix

···
+{ lib
+, mkDerivation
+, makeDesktopItem
+, fetchFromGitLab
+, qmake
+# qt
+, qtbase
+, qtwebsockets
+}:
+
+let
+  desktopItem = makeDesktopItem {
+    type = "Application";
+    name = "Michabo";
+    desktopName = "Michabo";
+    exec = "Michabo";
+  };
+
+in mkDerivation rec {
+  pname = "michabo";
+  version = "0.1";
+
+  src = fetchFromGitLab {
+    domain = "git.pleroma.social";
+    owner = "kaniini";
+    repo = "michabo";
+    rev = "v${version}";
+    sha256 = "0pl4ymdb36r0kwlclfjjp6b1qml3fm9ql7ag5inprny5y8vcjpzn";
+  };
+
+  nativeBuildInputs = [
+    qmake
+  ];
+  buildInputs = [
+    qtbase
+    qtwebsockets
+  ];
+
+  qmakeFlags = [ "michabo.pro" "DESTDIR=${placeholder "out"}/bin" ];
+
+  postInstall = ''
+    ln -s ${desktopItem}/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "A native desktop app for Pleroma and Mastodon servers";
+    homepage = "https://git.pleroma.social/kaniini/michabo";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+  };
+}
+

pkgs/applications/misc/orca/default.nix

···
       access to the graphical desktop via speech and refreshable braille.
       It works with applications and toolkits that support the Assistive
       Technology Service Provider Interface (AT-SPI). That includes the GNOME
-      Gtk+ toolkit, the Java platform's Swing toolkit, LibreOffice, Gecko, and
+      GTK toolkit, the Java platform's Swing toolkit, LibreOffice, Gecko, and
       WebKitGtk. AT-SPI support for the KDE Qt toolkit is being pursued.
 
       Needs `services.gnome3.at-spi2-core.enable = true;` in `configuration.nix`.

pkgs/applications/misc/pcmanfm/default.nix

···
   meta = with stdenv.lib; {
     homepage = https://blog.lxde.org/category/pcmanfm/;
     license = licenses.gpl2Plus;
-    description = "File manager with GTK+ interface";
+    description = "File manager with GTK interface";
     maintainers = [ maintainers.ttuegel ];
     platforms = platforms.linux;
   };

pkgs/applications/misc/pcmanx-gtk2/default.nix

···
   meta = with stdenv.lib; {
     homepage = https://pcman.ptt.cc;
     license = licenses.gpl2;
-    description = "Telnet BBS browser with GTK+ interface";
+    description = "Telnet BBS browser with GTK interface";
     maintainers = [ maintainers.sifmelcara ];
     platforms = platforms.linux;
   };

pkgs/applications/misc/stupidterm/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "Simple wrapper around the VTE terminal emulator widget for GTK+";
-    longDescription = ''
-      Simple wrapper around the VTE terminal emulator widget for GTK+
-    '';
+    description = "Simple wrapper around the VTE terminal emulator widget for GTK";
     homepage = https://github.com/esmil/stupidterm;
     license = licenses.lgpl3Plus;
     maintainers = [ maintainers.etu ];

pkgs/applications/misc/taskell/default.nix

···
 { lib, haskellPackages, fetchFromGitHub }:
 
 let
-  version = "1.6.0";
-  sha256  = "1yq7lbqg759i3hyxcskx3924b7xmw6i4ny6n8yq80k4hikw2k6mf";
+  version = "1.6.1";
+  sha256  = "047gvpq52pif9sfb4qcfdiwz50x3wlnjvsnnjzypm1qlwyl2rbz1";
 
 in (haskellPackages.mkDerivation {
   pname = "taskell";

pkgs/applications/misc/zathura/wrapper.nix

···
     description = "A highly customizable and functional PDF viewer";
     longDescription = ''
       Zathura is a highly customizable and functional PDF viewer based on the
-      poppler rendering library and the gtk+ toolkit. The idea behind zathura
+      poppler rendering library and the GTK toolkit. The idea behind zathura
       is an application that provides a minimalistic and space saving interface
       as well as an easy usage that mainly focuses on keyboard interaction.
     '';

pkgs/applications/networking/browsers/midori/default.nix

···
   ];
 
   meta = with stdenv.lib; {
-    description = "Lightweight WebKitGTK+ web browser";
+    description = "Lightweight WebKitGTK web browser";
     homepage = https://www.midori-browser.org/;
     license = with licenses; [ lgpl21Plus ];
     platforms = with platforms; linux;

pkgs/applications/networking/browsers/surf/default.nix

···
   installFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
-    description = "A simple web browser based on WebKit/GTK+";
+    description = "A simple web browser based on WebKit/GTK";
     longDescription = ''
-      Surf is a simple web browser based on WebKit/GTK+. It is able to display
+      Surf is a simple web browser based on WebKit/GTK. It is able to display
       websites and follow links. It supports the XEmbed protocol which makes it
       possible to embed it in another application. Furthermore, one can point
       surf to another URI by setting its XProperties.

pkgs/applications/networking/browsers/vivaldi/default.nix

···
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "2.7.1628.30-1";
+  version = "2.7.1628.33-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "1lz8adwiwll8g246s5pa0ipfraph51s9f4lcfysdrp1s3s1qhw8x";
+    sha256 = "1km5ccxqyd5xgmzm42zca670jf7wd4j7c726fhyj4wjni71zar34";
   };
 
   unpackPhase = ''

pkgs/applications/networking/cluster/kubernetes/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "kubernetes";
-  version = "1.14.3";
+  version = "1.15.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "1r31ssf8bdbz8fdsprhkc34jqhz5rcs3ixlf0mbjcbq0xr7y651z";
+    sha256 = "0vamr7m8i5svmvb0z01cngv3sffdfjj0bky2zalm7cfnapib8vz1";
   };
 
   buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
···
   outputs = ["out" "man" "pause"];
 
   postPatch = ''
-    substituteInPlace "hack/lib/golang.sh" --replace "_cgo" ""
+    # go env breaks the sandbox
+    substituteInPlace "hack/lib/golang.sh" \
+      --replace 'echo "$(go env GOHOSTOS)/$(go env GOHOSTARCH)"' 'echo "${go.GOOS}/${go.GOARCH}"'
+
     substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
     # hack/update-munge-docs.sh only performs some tests on the documentation.
     # They broke building k8s; disabled for now.
···
     cp build/pause/pause "$pause/bin/pause"
     cp -R docs/man/man1 "$man/share/man"
 
-    cp cluster/addons/addon-manager/namespace.yaml $out/share
     cp cluster/addons/addon-manager/kube-addons.sh $out/bin/kube-addons
     patchShebangs $out/bin/kube-addons
-    substituteInPlace $out/bin/kube-addons \
-      --replace /opt/namespace.yaml $out/share/namespace.yaml
     wrapProgram $out/bin/kube-addons --set "KUBECTL_BIN" "$out/bin/kubectl"
+
+    cp ${./mk-docker-opts.sh} $out/bin/mk-docker-opts.sh
 
     $out/bin/kubectl completion bash > $out/share/bash-completion/completions/kubectl
     $out/bin/kubectl completion zsh > $out/share/zsh/site-functions/_kubectl

pkgs/applications/networking/cluster/kubernetes/mk-docker-opts.sh

···
+#!/usr/bin/env bash
+
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generate Docker daemon options based on flannel env file.
+
+# exit on any error
+set -e
+
+usage() {
+  echo "$0 [-f FLANNEL-ENV-FILE] [-d DOCKER-ENV-FILE] [-i] [-c] [-m] [-k COMBINED-KEY]
+
+Generate Docker daemon options based on flannel env file
+OPTIONS:
+    -f  Path to flannel env file. Defaults to /run/flannel/subnet.env
+    -d  Path to Docker env file to write to. Defaults to /run/docker_opts.env
+    -i  Output each Docker option as individual var. e.g. DOCKER_OPT_MTU=1500
+    -c  Output combined Docker options into DOCKER_OPTS var
+    -k  Set the combined options key to this value (default DOCKER_OPTS=)
+    -m  Do not output --ip-masq (useful for older Docker version)
+" >/dev/stderr
+  exit 1
+}
+
+flannel_env="/run/flannel/subnet.env"
+docker_env="/run/docker_opts.env"
+combined_opts_key="DOCKER_OPTS"
+indiv_opts=false
+combined_opts=false
+ipmasq=true
+val=""
+
+while getopts "f:d:icmk:" opt; do
+  case $opt in
+    f)
+      flannel_env=$OPTARG
+      ;;
+    d)
+      docker_env=$OPTARG
+      ;;
+    i)
+      indiv_opts=true
+      ;;
+    c)
+      combined_opts=true
+      ;;
+    m)
+      ipmasq=false
+      ;;
+    k)
+      combined_opts_key=$OPTARG
+      ;;
+    \?)
+      usage
+      ;;
+  esac
+done
+
+if [[ $indiv_opts = false ]] && [[ $combined_opts = false ]]; then
+  indiv_opts=true
+  combined_opts=true
+fi
+
+if [[ -f "${flannel_env}" ]]; then
+  source "${flannel_env}"
+fi
+
+if [[ -n "$FLANNEL_SUBNET" ]]; then
+  # shellcheck disable=SC2034  # Variable name referenced in OPT_LOOP below
+  DOCKER_OPT_BIP="--bip=$FLANNEL_SUBNET"
+fi
+
+if [[ -n "$FLANNEL_MTU" ]]; then
+  # shellcheck disable=SC2034  # Variable name referenced in OPT_LOOP below
+  DOCKER_OPT_MTU="--mtu=$FLANNEL_MTU"
+fi
+
+if [[ "$FLANNEL_IPMASQ" = true ]] && [[ $ipmasq = true ]]; then
+  # shellcheck disable=SC2034  # Variable name referenced in OPT_LOOP below
+  DOCKER_OPT_IPMASQ="--ip-masq=false"
+fi
+
+eval docker_opts="\$${combined_opts_key}"
+docker_opts+=" "
+
+echo -n "" >"${docker_env}"
+
+# OPT_LOOP
+for opt in $(compgen -v DOCKER_OPT_); do
+  eval val=\$"${opt}"
+
+  if [[ "$indiv_opts" = true ]]; then
+    echo "$opt=\"$val\"" >>"${docker_env}"
+  fi
+
+  docker_opts+="$val "
+done
+
+if [[ "$combined_opts" = true ]]; then
+  echo "${combined_opts_key}=\"${docker_opts}\"" >>"${docker_env}"
+fi

pkgs/applications/networking/cluster/terraform/default.nix

···
   terraform_0_11-full = terraform_0_11.full;
 
   terraform_0_12 = pluggable (generic {
-    version = "0.12.7";
-    sha256 = "09zsak1a9z2mk88vb6xs9jaxfpazhs0p7x68mw62c9mm13m8kq02";
+    version = "0.12.8";
+    sha256 = "1qlhbn6xj2nd8gwr6aiyjsb62qmj4j9jnxab006xgdr1avvl2p67";
     patches = [ ./provider-path.patch ];
     passthru = { inherit plugins; };
   });

pkgs/applications/networking/corebird/default.nix

···
   '';
 
   meta = {
-    description = "Native Gtk+ Twitter client for the Linux desktop";
+    description = "Native GTK Twitter client for the Linux desktop";
     longDescription = "Corebird is a modern, easy and fun Twitter client.";
     homepage = https://corebird.baedert.org/;
     license = stdenv.lib.licenses.gpl3;

pkgs/applications/networking/instant-messengers/dino/default.nix

···
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    description = "Modern Jabber/XMPP Client using GTK+/Vala";
+    description = "Modern Jabber/XMPP Client using GTK/Vala";
     homepage = https://github.com/dino/dino;
     license = licenses.gpl3;
     platforms = platforms.linux;

pkgs/applications/networking/instant-messengers/discord/default.nix

···
     pname = "discord-canary";
     binaryName = "DiscordCanary";
     desktopName = "Discord Canary";
-    version = "0.0.95";
+    version = "0.0.96";
     src = fetchurl {
-      url = "https://dl-canary.discordapp.net/apps/linux/0.0.95/discord-canary-0.0.95.tar.gz";
-      sha256 = "06qhm73kc88pq0lgbi7qjy4gx9ighkmx128fdm1dpzfv62fjdasw";
+      url = "https://dl-canary.discordapp.net/apps/linux/0.0.96/discord-canary-0.0.96.tar.gz";
+      sha256 = "1fxyh9v5xglwbgr5sidn0cv70qpzcd2q240wsv87k3nawhvfcwsp";
     };
   };
 }.${branch}

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

···
 , gnome2, gtk3, atk, at-spi2-atk, cairo, pango, gdk-pixbuf, glib, freetype, fontconfig
 , dbus, libX11, xorg, libXi, libXcursor, libXdamage, libXrandr, libXcomposite
 , libXext, libXfixes, libXrender, libXtst, libXScrnSaver, nss, nspr, alsaLib
-, cups, expat, udev, libnotify, libuuid
+, cups, expat, udev, libnotify, libuuid, at-spi2-core
 # Unfortunately this also overwrites the UI language (not just the spell
 # checking language!):
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
···
     alsaLib
     atk
     at-spi2-atk
+    at-spi2-core
     cairo
     cups
     dbus
···
 
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.26.2";
+  version = "1.27.1";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "08qx7k82x6ybqi3lln6ixzmdz4sr8yz8vfx0y408b85wjfc7ncjk";
+    sha256 = "16fg60c5r7zcjs8ya6jk33l5kz8m21y9a1si3i0a2dvyaclz4a3q";
   };
 
   phases = [ "unpackPhase" "installPhase" ];

pkgs/applications/networking/irc/weechat/default.nix

···
 , guileSupport ? true, guile
 , luaSupport ? true, lua5
 , perlSupport ? true, perl
-, pythonSupport ? true, pythonPackages
+, pythonSupport ? true, python3Packages
 , rubySupport ? true, ruby
 , tclSupport ? true, tcl
 , extraBuildInputs ? []
 }:
 
 let
-  inherit (pythonPackages) python;
+  inherit (python3Packages) python;
   plugins = [
     { name = "perl"; enabled = perlSupport; cmakeFlag = "ENABLE_PERL"; buildInputs = [ perl ]; }
     { name = "tcl"; enabled = tclSupport; cmakeFlag = "ENABLE_TCL"; buildInputs = [ tcl ]; }
     { name = "ruby"; enabled = rubySupport; cmakeFlag = "ENABLE_RUBY"; buildInputs = [ ruby ]; }
     { name = "guile"; enabled = guileSupport; cmakeFlag = "ENABLE_GUILE"; buildInputs = [ guile ]; }
     { name = "lua"; enabled = luaSupport; cmakeFlag = "ENABLE_LUA"; buildInputs = [ lua5 ]; }
-    { name = "python"; enabled = pythonSupport; cmakeFlag = "ENABLE_PYTHON"; buildInputs = [ python ]; }
+    { name = "python"; enabled = pythonSupport; cmakeFlag = "ENABLE_PYTHON3"; buildInputs = [ python ]; }
   ];
   enabledPlugins = builtins.filter (p: p.enabled) plugins;
 

pkgs/applications/networking/irc/weechat/scripts/default.nix

···
-{ callPackage, luaPackages, pythonPackages }:
+{ callPackage, luaPackages }:
 
 {
-  weechat-xmpp = callPackage ./weechat-xmpp {
-    inherit (pythonPackages) pydns;
-  };
-
   weechat-matrix-bridge = callPackage ./weechat-matrix-bridge {
     inherit (luaPackages) cjson luaffi;
   };
 
-  wee-slack = callPackage ./wee-slack {
-    inherit pythonPackages;
-  };
+  wee-slack = callPackage ./wee-slack { };
 
   weechat-autosort = callPackage ./weechat-autosort { };
+
+  weechat-otr = callPackage ./weechat-otr { };
 }

pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix

···
-{ stdenv, substituteAll, buildEnv, fetchFromGitHub, pythonPackages }:
+{ stdenv, substituteAll, buildEnv, fetchFromGitHub, python3Packages }:
 
 stdenv.mkDerivation rec {
   pname = "wee-slack";
···
       src = ./libpath.patch;
       env = "${buildEnv {
         name = "wee-slack-env";
-        paths = with pythonPackages; [ websocket_client six ];
-      }}/${pythonPackages.python.sitePackages}";
+        paths = with python3Packages; [ websocket_client six ];
+      }}/${python3Packages.python.sitePackages}";
     })
   ];
 

pkgs/applications/networking/irc/weechat/scripts/weechat-otr/default.nix

···
+{ stdenv, substituteAll, buildEnv, fetchgit, fetchFromGitHub, python3Packages, gmp }:
+
+let
+  # pure-python-otr (potr) requires an older version of pycrypto, which is
+  # not compatible with pycryptodome. Therefore, the latest patched version
+  # of pycrypto will be fetched from the Debian project.
+  # https://security-tracker.debian.org/tracker/source-package/python-crypto
+
+  pycrypto = python3Packages.buildPythonPackage rec {
+    pname = "pycrypto";
+    version = "2.6.1-10";
+
+    src = fetchgit {
+      url = "https://salsa.debian.org/sramacher/python-crypto.git";
+      rev = "debian/${version}";
+      sha256 = "10rgq8bmjfpiqqa1g1p1hh7pxlxs7x0nawvk6zip0pd6x2vsr661";
+    };
+
+    buildInputs = [ gmp ];
+
+    preConfigure = ''
+      sed -i 's,/usr/include,/no-such-dir,' configure
+      sed -i "s!,'/usr/include/'!!" setup.py
+    '';
+  };
+
+  potr = python3Packages.potr.overridePythonAttrs (oldAttrs: {
+    propagatedBuildInputs = [ pycrypto ];
+  });
+in stdenv.mkDerivation rec {
+  pname = "weechat-otr";
+  version = "1.9.2";
+
+  src = fetchFromGitHub {
+    repo = pname;
+    owner = "mmb";
+    rev = "v${version}";
+    sha256 = "1lngv98y6883vk8z2628cl4d5y8jxy39w8245gjdvshl8g18k5s2";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./libpath.patch;
+      env = "${buildEnv {
+        name = "weechat-otr-env";
+        paths = [ potr pycrypto ];
+      }}/${python3Packages.python.sitePackages}";
+    })
+  ];
+
+  passthru.scripts = [ "weechat_otr.py" ];
+
+  installPhase = ''
+    mkdir -p $out/share
+    cp weechat_otr.py $out/share/weechat_otr.py
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/mmb/weechat-otr";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ geistesk ];
+    description = "WeeChat script for Off-the-Record messaging";
+  };
+}

pkgs/applications/networking/irc/weechat/scripts/weechat-otr/libpath.patch

···
+diff --git a/weechat_otr.py b/weechat_otr.py
+index 0ccfb35..c42bebf 100644
+--- a/weechat_otr.py
++++ b/weechat_otr.py
+@@ -41,6 +41,8 @@ import shlex
+ import shutil
+ import sys
+ 
++sys.path.append('@env@')
++
+ import potr
+ import weechat
+ 

pkgs/applications/networking/irc/weechat/scripts/weechat-xmpp/default.nix

···
-{ stdenv, fetchFromGitHub, xmpppy, pydns, substituteAll, buildEnv }:
-
-stdenv.mkDerivation {
-  name = "weechat-jabber-2017-08-30";
-
-  src = fetchFromGitHub {
-    repo = "weechat-xmpp";
-    owner = "sleduc";
-    sha256 = "0s02xs0ynld9cxxzj07al364sfglyc5ir1i82133mq0s8cpphnxv";
-    rev = "8f6c21f5a160c9318c7a2d8fd5dcac7ab2e0d843";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share
-    cp jabber.py $out/share/jabber.py
-  '';
-
-  patches = [
-    (substituteAll {
-      src = ./libpath.patch;
-      env = "${buildEnv {
-        name = "weechat-xmpp-env";
-        paths = [ pydns xmpppy ];
-      }}/lib/python2.7/site-packages";
-    })
-  ];
-
-  passthru.scripts = [ "jabber.py" ];
-
-  meta = with stdenv.lib; {
-    description = "A fork of the jabber plugin for weechat";
-    homepage = "https://github.com/sleduc/weechat-xmpp";
-    maintainers = with maintainers; [ ma27 ];
-    license = licenses.gpl3Plus;
-  };
-}

pkgs/applications/networking/irc/weechat/scripts/weechat-xmpp/libpath.patch

···
-diff --git a/jabber.py b/jabber.py
-index 27006a3..e53c2c0 100644
---- a/jabber.py
-+++ b/jabber.py
-@@ -95,6 +95,11 @@ SCRIPT_COMMAND = SCRIPT_NAME
- import re
- import warnings
- 
-+import sys
-+
-+sys.path.append('@env@')
-+
-+
- import_ok = True
- 
- try:

pkgs/applications/networking/irc/weechat/wrapper.nix

···
 { lib, runCommand, writeScriptBin, buildEnv
-, pythonPackages, perlPackages, runtimeShell
+, python3Packages, perlPackages, runtimeShell
 }:
 
 weechat:
···
       in rec {
         python = (simplePlugin "python") // {
           extraEnv = ''
-            export PATH="${pythonPackages.python}/bin:$PATH"
+            export PATH="${python3Packages.python}/bin:$PATH"
           '';
           withPackages = pkgsFun: (python // {
             extraEnv = ''
-              export PYTHONHOME="${pythonPackages.python.withPackages pkgsFun}"
+              export PYTHONHOME="${python3Packages.python.withPackages pkgsFun}"
             '';
           });
         };

pkgs/applications/networking/mailreaders/astroid/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://astroidmail.github.io/;
-    description = "GTK+ frontend to the notmuch mail system";
+    description = "GTK frontend to the notmuch mail system";
     maintainers = with maintainers; [ bdimcheff SuprDewd ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;

pkgs/applications/networking/modem-manager-gui/default.nix

···
   meta = with stdenv.lib; {
     description = "An app to send/receive SMS, make USSD requests, control mobile data usage and more";
     longDescription = ''
-      A simple GTK+ based GUI compatible with Modem manager, Wader and oFono
+      A simple GTK based GUI compatible with Modem manager, Wader and oFono
       system services able to control EDGE/3G/4G broadband modem specific
       functions. You can check balance of your SIM card, send or receive SMS
       messages, control mobile traffic consumption and more.

pkgs/applications/networking/newsreaders/pan/default.nix

···
   enableParallelBuilding = true;
 
   meta = {
-    description = "A GTK+-based Usenet newsreader good at both text and binaries";
+    description = "A GTK-based Usenet newsreader good at both text and binaries";
     homepage = http://pan.rebelbase.com/;
     maintainers = [ stdenv.lib.maintainers.eelco ];
     platforms = stdenv.lib.platforms.linux;

pkgs/applications/networking/p2p/transmission/default.nix

···
       on top of a cross-platform back-end.
       Feature spotlight:
         * Uses fewer resources than other clients
-        * Native Mac, GTK+ and Qt GUI clients
+        * Native Mac, GTK and Qt GUI clients
         * Daemon ideal for servers, embedded systems, and headless use
         * All these can be remote controlled by Web and Terminal clients
         * Bluetack (PeerGuardian) blocklists with automatic updates

pkgs/applications/networking/remote/remmina/default.nix

···
   meta = {
     license = licenses.gpl2;
     homepage = https://gitlab.com/Remmina/Remmina;
-    description = "Remote desktop client written in GTK+";
+    description = "Remote desktop client written in GTK";
     maintainers = with maintainers; [ melsigl ryantm ];
     platforms = platforms.linux;
   };

pkgs/applications/office/planner/default.nix

···
       Its goal is to be an easy-to-use no-nonsense cross-platform
       project management application.
 
-      Planner is a GTK+ application written in C and licensed under the
+      Planner is a GTK application written in C and licensed under the
       GPLv2 or any later version. It can store its data in either xml
       files or in a postgresql database. Projects can also be printed
       to PDF or exported to HTML for easy viewing from any web browser.

pkgs/applications/science/astronomy/gpredict/default.nix

···
     description = "Real time satellite tracking and orbit prediction";
     longDescription = ''
       Gpredict is a real time satellite tracking and orbit prediction program
-      written using the Gtk+ widgets. Gpredict is targetted mainly towards ham radio
+      written using the GTK widgets. Gpredict is targetted mainly towards ham radio
       operators but others interested in satellite tracking may find it useful as
       well. Gpredict uses the SGP4/SDP4 algorithms, which are compatible with the
       NORAD Keplerian elements.

pkgs/applications/science/biology/xenomapper/default.nix

···
+{buildPythonPackage, lib, fetchFromGitHub, statistics}:
+
+buildPythonPackage rec {
+  pname = "xenomapper";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "genomematt";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0mnmfzlq5mhih6z8dq5bkx95vb8whjycz9mdlqwbmlqjb3gb3zhr";
+  };
+
+  propagatedBuildInputs = [ statistics ];
+
+  meta = with lib; {
+    homepage = "http://github.com/genomematt/xenomapper";
+    description = "A utility for post processing mapped reads that have been aligned to a primary genome and a secondary genome and binning reads into species specific, multimapping in each species, unmapped and unassigned bins";
+    license = licenses.gpl3;
+    platforms = platforms.all;
+    maintainers = [ maintainers.jbedo ];
+  };
+}

pkgs/applications/search/catfish/default.nix

···
     description = "A handy file search tool";
     longDescription = ''
       Catfish is a handy file searching tool. The interface is
-      intentionally lightweight and simple, using only GTK+3.
+      intentionally lightweight and simple, using only GTK 3.
       You can configure it to your needs by using several command line
       options.
     '';

pkgs/applications/video/celluloid/default.nix

···
   doCheck = true;
 
   meta = with stdenv.lib; {
-    description = "Simple GTK+ frontend for the mpv video player";
+    description = "Simple GTK frontend for the mpv video player";
     longDescription = ''
       GNOME MPV interacts with mpv via the client API exported by libmpv,
       allowing access to mpv's powerful playback capabilities through an

pkgs/applications/video/handbrake/default.nix

···
       and containers. Very versatile and customizable.
       Package provides:
       CLI - `HandbrakeCLI`
-      GTK+ GUI - `ghb`
+      GTK GUI - `ghb`
     '';
     license = licenses.gpl2;
     maintainers = with maintainers; [ Anton-Latukha wmertens ];

pkgs/applications/video/mkvtoolnix/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "36.0.0";
+  version = "37.0.0";
 
   src = fetchFromGitLab {
     owner  = "mbunkus";
     repo   = "mkvtoolnix";
     rev    = "release-${version}";
-    sha256 = "114j9n2m6dkh7vqzyhcsjzzffadr0lzyjmh31cbl4mvvkg9j5z6r";
+    sha256 = "0r1qzvqc6xx7rmv4v4fjc70cqy832h8v0fjf6c5ljbg1c6pgkl0l";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/subtitleeditor/default.nix

···
   configureFlags = [ "--disable-debug" ];
 
   meta = {
-    description = "GTK+3 application to edit video subtitles";
+    description = "GTK 3 application to edit video subtitles";
     longDescription = ''
-      Subtitle Editor is a GTK+3 tool to edit subtitles for GNU/Linux/*BSD. It
+      Subtitle Editor is a GTK 3 tool to edit subtitles for GNU/Linux/*BSD. It
       can be used for new subtitles or as a tool to transform, edit, correct
       and refine existing subtitle. This program also shows sound waves, which
       makes it easier to synchronise subtitles to voices.

pkgs/applications/virtualization/docker-compose/default.nix

···
 , six, texttable, websocket_client, cached-property
 , enum34, functools32, paramiko
 }:
+
 buildPythonApplication rec {
   version = "1.24.1";
   pname = "docker-compose";
···
   '';
 
   postInstall = ''
-    mkdir -p $out/share/bash-completion/completions/
-    cp contrib/completion/bash/docker-compose $out/share/bash-completion/completions/docker-compose
+    install -D -m 0444 contrib/completion/bash/docker-compose \
+      $out/share/bash-completion/completions/docker-compose
+
+    install -D -m 0444 contrib/completion/zsh/_docker-compose \
+      $out/share/zsh-completion/zsh/site-functions/_docker-compose
   '';
 
   meta = with stdenv.lib; {
     homepage = https://docs.docker.com/compose/;
     description = "Multi-container orchestration for Docker";
     license = licenses.asl20;
-    maintainers = with maintainers; [
-    ];
+    maintainers = [ ];
   };
 }

pkgs/applications/virtualization/virtualbox/default.nix

···
 { config, stdenv, fetchurl, lib, iasl, dev86, pam, libxslt, libxml2, wrapQtAppsHook
 , libX11, xorgproto, libXext, libXcursor, libXmu, libIDL, SDL, libcap, libGL
 , libpng, glib, lvm2, libXrandr, libXinerama, libopus, qtbase, qtx11extras
-, qttools, pkgconfig, which, docbook_xsl, docbook_xml_dtd_43
-, alsaLib, curl, libvpx, nettools, dbus
+, qttools, qtsvg, qtwayland, pkgconfig, which, docbook_xsl, docbook_xml_dtd_43
+, alsaLib, curl, libvpx, nettools, dbus, substituteAll
 , makeself, perl
 , javaBindings ? true, jdk ? null # Almost doesn't affect closure size
 , pythonBindings ? false, python3 ? null
···
   nativeBuildInputs = [ pkgconfig which docbook_xsl docbook_xml_dtd_43 patchelfUnstable ]
     ++ optional (!headless) wrapQtAppsHook;
 
-  # Wrap manually because we just need to wrap one executable
+  # Wrap manually because we wrap just a small number of executables.
   dontWrapQtApps = true;
 
   buildInputs =
···
 
   patches =
      optional enableHardening ./hardened.patch
+     # When hardening is enabled, we cannot use wrapQtApp to ensure that VirtualBoxVM sees
+     # the correct environment variables needed for Qt to work, specifically QT_PLUGIN_PATH.
+     # This is because VirtualBoxVM would detect that it is wrapped that and refuse to run,
+     # and also because it would unset QT_PLUGIN_PATH for security reasons. We work around
+     # these issues by patching the code to set QT_PLUGIN_PATH to the necessary paths,
+     # after the code that unsets it. Note that qtsvg is included so that SVG icons from
+     # the user's icon theme can be loaded.
+  ++ optional (!headless && enableHardening) (substituteAll {
+      src = ./qt-env-vars.patch;
+      qtPluginPath = "${qtbase.bin}/${qtbase.qtPluginPrefix}:${qtsvg.bin}/${qtbase.qtPluginPrefix}:${qtwayland.bin}/${qtbase.qtPluginPrefix}";
+    })
   ++ [
     ./qtx11extras.patch
   ];
···
 
   preFixup = optionalString (!headless) ''
     wrapQtApp $out/bin/VirtualBox
+  ''
+  # If hardening is disabled, wrap the VirtualBoxVM binary instead of patching
+  # the source code (see postPatch).
+  + optionalString (!headless && !enableHardening) ''
+    wrapQtApp $out/libexec/virtualbox/VirtualBoxVM
   '';
 
   passthru = {

pkgs/applications/virtualization/virtualbox/qt-env-vars.patch

···
+--- a/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp
++++ b/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp
+@@ -2131,6 +2131,11 @@ static void supR3HardenedMainPurgeEnvironment(char **envp)
+         /** @todo Call NT API to do the same. */
+ #endif
+     }
++
++    /*
++     * NixOS hack: Set QT_PLUGIN_PATH to make Qt find plugins.
++     */
++    setenv("QT_PLUGIN_PATH", "@qtPluginPath@", /*overwrite=*/ 1);
+ }
+ 
+ 

pkgs/applications/window-managers/i3/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "i3";
-  version = "4.17";
+  version = "4.17.1";
 
   src = fetchurl {
     url = "https://i3wm.org/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "1z8qmkkq9dhqmqy8sjw3rnpnmnb8v7lr456bs0qzp23bgpj17gjf";
+    sha256 = "0iazv2i2rgmakzh95pgj6iapyzn7bdpcbcd35a79mhlml4ry33qy";
   };
 
   nativeBuildInputs = [ which pkgconfig makeWrapper ];

pkgs/applications/window-managers/i3/lock-fancy.nix

···
     sed -i -e 's|icon="/usr/share/i3lock-fancy/icons/lock.png"|icon="'$out'/share/i3lock-fancy/icons/lock.png"|' i3lock-fancy
     sed -i -e "s|getopt |${getopt}/bin/getopt |" i3lock-fancy
     sed -i -e "s|fc-match |${fontconfig.bin}/bin/fc-match |" i3lock-fancy
-    sed -i -e "s|shot=(import -window root)|shot=(${scrot}/bin/scrot -z)|" i3lock-fancy
+    sed -i -e "s|shot=(import -window root)|shot=(${scrot}/bin/scrot -z -o)|" i3lock-fancy
     rm Makefile
   '';
   installPhase = ''

pkgs/build-support/install-shell-files/default.nix

···
+{ makeSetupHook }:
+
+# See the header comment in ../setup-hooks/install-shell-files.sh for example usage.
+makeSetupHook { name = "install-shell-files"; } ../setup-hooks/install-shell-files.sh

pkgs/build-support/oci-tools/default.nix

···
+{ lib, writeText, runCommand, writeReferencesToFile }:
+
+{
+  buildContainer =
+    { args
+    , mounts ? {}
+    , os ? "linux"
+    , arch ? "x86_64"
+    , readonly ? false
+    }:
+  let
+    sysMounts = {
+      "/proc" = {
+        type = "proc";
+        source = "proc";
+      };
+      "/dev" = {
+        type = "tmpfs";
+        source = "tmpfs";
+        options = [ "nosuid" "strictatime" "mode=755" "size=65536k" ];
+      };
+      "/dev/pts" = {
+        type = "devpts";
+        source = "devpts";
+        options = [ "nosuid" "noexec" "newinstance" "ptmxmode=0666" "mode=755" "gid=5" ];
+      };
+      "/dev/shm" = {
+        type = "tmpfs";
+        source = "shm";
+        options = [ "nosuid" "noexec" "nodev" "mode=1777" "size=65536k" ];
+      };
+      "/dev/mqueue" = {
+        type = "mqueue";
+        source = "mqueue";
+        options = [ "nosuid" "noexec" "nodev" ];
+      };
+      "/sys" = {
+        type = "sysfs";
+        source = "sysfs";
+        options = [ "nosuid" "noexec" "nodev" "ro" ];
+      };
+      "/sys/fs/cgroup" = {
+        type = "cgroup";
+        source = "cgroup";
+        options = [ "nosuid" "noexec" "nodev" "realatime" "ro" ];
+      };
+    };
+    config = writeText "config.json" (builtins.toJSON {
+      ociVersion = "1.0.0";
+      platform = {
+        inherit os arch;
+      };
+
+      linux = {
+        namespaces = map (type: { inherit type; }) [ "pid" "network" "mount" "ipc" "uts" ];
+      };
+
+      root = { path = "rootfs"; inherit readonly; };
+
+      process = {
+        inherit args;
+        user = { uid = 0; gid = 0; };
+        cwd = "/";
+      };
+
+      mounts = lib.mapAttrsToList (destination: { type, source, options ? null }: {
+        inherit destination type source options;
+      }) sysMounts;
+    });
+  in
+    runCommand "join" {} ''
+      set -o pipefail
+      mkdir -p $out/rootfs/{dev,proc,sys}
+      cp ${config} $out/config.json
+      xargs tar c < ${writeReferencesToFile args} | tar -xC $out/rootfs/
+    '';
+}
+

pkgs/build-support/setup-hooks/install-shell-files.sh

···
+#!/bin/bash
+# Setup hook for the `installShellFiles` package.
+#
+# Example usage in a derivation:
+#
+#   { …, installShellFiles, … }:
+#   stdenv.mkDerivation {
+#     …
+#     nativeBuildInputs = [ installShellFiles ];
+#     postInstall = ''
+#       installManPage share/doc/foobar.1
+#       installShellCompletion share/completions/foobar.{bash,fish,zsh}
+#     '';
+#     …
+#   }
+#
+# See comments on each function for more details.
+
+# installManPage <path> [...<path>]
+#
+# Each argument is checked for its man section suffix and installed into the appropriate
+# share/man<n>/ directory. The function returns an error if any paths don't have the man section
+# suffix (with optional .gz compression).
+installManPage() {
+    local path
+    for path in "$@"; do
+        if (( "${NIX_DEBUG:-0}" >= 1 )); then
+            echo "installManPage: installing $path"
+        fi
+        if test -z "$path"; then
+            echo "installManPage: error: path cannot be empty" >&2
+            return 1
+        fi
+        local basename
+        basename=$(stripHash "$path") # use stripHash in case it's a nix store path
+        local trimmed=${basename%.gz} # don't get fooled by compressed manpages
+        local suffix=${trimmed##*.}
+        if test -z "$suffix" -o "$suffix" = "$trimmed"; then
+            echo "installManPage: error: path missing manpage section suffix: $path" >&2
+            return 1
+        fi
+        local outRoot
+        if test "$suffix" = 3; then
+            outRoot=${!outputDevman:?}
+        else
+            outRoot=${!outputMan:?}
+        fi
+        install -Dm644 -T "$path" "${outRoot}/share/man/man$suffix/$basename" || return
+    done
+}
+
+# installShellCompletion [--bash|--fish|--zsh] ([--name <name>] <path>)...
+#
+# Each path is installed into the appropriate directory for shell completions for the given shell.
+# If one of `--bash`, `--fish`, or `--zsh` is given the path is assumed to belong to that shell.
+# Otherwise the file extension will be examined to pick a shell. If the shell is unknown a warning
+# will be logged and the command will return a non-zero status code after processing any remaining
+# paths. Any of the shell flags will affect all subsequent paths (unless another shell flag is
+# given).
+#
+# If the shell completion needs to be renamed before installing the optional `--name <name>` flag
+# may be given. Any name provided with this flag only applies to the next path.
+#
+# For zsh completions, if the `--name` flag is not given, the path will be automatically renamed
+# such that `foobar.zsh` becomes `_foobar`.
+#
+# This command accepts multiple shell flags in conjunction with multiple paths if you wish to
+# install them all in one command:
+#
+#   installShellCompletion share/completions/foobar.{bash,fish} --zsh share/completions/_foobar
+#
+# However it may be easier to read if each shell is split into its own invocation, especially when
+# renaming is involved:
+#
+#   installShellCompletion --bash --name foobar.bash share/completions.bash
+#   installShellCompletion --fish --name foobar.fish share/completions.fish
+#   installShellCompletion --zsh --name _foobar share/completions.zsh
+#
+# If any argument is `--` the remaining arguments will be treated as paths.
+installShellCompletion() {
+    local shell='' name='' retval=0 parseArgs=1 arg
+    while { arg=$1; shift; }; do
+        # Parse arguments
+        if (( parseArgs )); then
+            case "$arg" in
+            --bash|--fish|--zsh)
+                shell=${arg#--}
+                continue;;
+            --name)
+                name=$1
+                shift || {
+                    echo 'installShellCompletion: error: --name flag expected an argument' >&2
+                    return 1
+                }
+                continue;;
+            --name=*)
+                # treat `--name=foo` the same as `--name foo`
+                name=${arg#--name=}
+                continue;;
+            --?*)
+                echo "installShellCompletion: warning: unknown flag ${arg%%=*}" >&2
+                retval=2
+                continue;;
+            --)
+                # treat remaining args as paths
+                parseArgs=0
+                continue;;
+            esac
+        fi
+        if (( "${NIX_DEBUG:-0}" >= 1 )); then
+            echo "installShellCompletion: installing $arg${name:+ as $name}"
+        fi
+        # if we get here, this is a path
+        # Identify shell
+        local basename
+        basename=$(stripHash "$arg")
+        local curShell=$shell
+        if [[ -z "$curShell" ]]; then
+            # auto-detect the shell
+            case "$basename" in
+            ?*.bash) curShell=bash;;
+            ?*.fish) curShell=fish;;
+            ?*.zsh) curShell=zsh;;
+            *)
+                if [[ "$basename" = _* && "$basename" != *.* ]]; then
+                    # probably zsh
+                    echo "installShellCompletion: warning: assuming path \`$arg' is zsh; please specify with --zsh" >&2
+                    curShell=zsh
+                else
+                    echo "installShellCompletion: warning: unknown shell for path: $arg" >&2
+                    retval=2
+                    continue
+                fi;;
+            esac
+        fi
+        # Identify output path
+        local outName sharePath
+        outName=${name:-$basename}
+        case "$curShell" in
+        bash) sharePath=bash-completion/completions;;
+        fish) sharePath=fish/vendor_completions.d;;
+        zsh)
+            sharePath=zsh/site-functions
+            # only apply automatic renaming if we didn't have a manual rename
+            if test -z "$name"; then
+                # convert a name like `foo.zsh` into `_foo`
+                outName=${outName%.zsh}
+                outName=_${outName#_}
+            fi;;
+        *)
+            # Our list of shells is out of sync with the flags we accept or extensions we detect.
+            echo 'installShellCompletion: internal error' >&2
+            return 1;;
+        esac
+        # Install file
+        install -Dm644 -T "$arg" "${!outputBin:?}/share/$sharePath/$outName" || return
+        # Clear the name, it only applies to one path
+        name=
+    done
+    if [[ -n "$name" ]]; then
+        echo 'installShellCompletion: error: --name flag given with no path' >&2
+        return 1
+    fi
+    return $retval
+}

pkgs/data/fonts/sudo/default.nix

···
 { lib, fetchzip }:
 
 let
-  version = "0.37";
+  version = "0.40";
 in fetchzip {
   name = "sudo-font-${version}";
   url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-  sha256 = "16x6vs016wz6rmd4p248ri9fn35xq7r3dc8hv4w2c4rz1xl8c099";
+  sha256 = "1nf025sjps4yysf6zkns5fzjgls6xdpifh7bz4ray9x8h5pz0z64";
 
   postFetch = ''
     mkdir -p $out/share/fonts/truetype/

pkgs/data/fonts/victor-mono/default.nix

···
 
 let
   pname = "victor-mono";
-  version = "1.2.1";
+  version = "1.2.5";
 in fetchFromGitHub rec {
   name = "${pname}-${version}";
 
···
     unzip -j VictorMonoAll.zip \*.otf -d $out/share/fonts/opentype/${pname}
   '';
 
-  sha256 = "0347n3kdyrbg42rxcgnyghi21qz5iz6w30v7ms2vjal7pfm6h2vn";
+  sha256 = "0dj5h45qk6abggj6mgm19sb0a7q0v4x41f2zds1ab79yd22gbjns";
 
   meta = with lib; {
     description = "Free programming font with cursive italics and ligatures";

pkgs/data/icons/elementary-xfce-icon-theme/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "Elementary icons for Xfce and other GTK+ desktops like GNOME";
+    description = "Elementary icons for Xfce and other GTK desktops like GNOME";
     homepage = https://github.com/shimmerproject/elementary-xfce;
     license = licenses.gpl2;
     # darwin cannot deal with file names differing only in case

pkgs/data/themes/adementary/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "Adwaita-based gtk+ theme with design influence from elementary OS and Vertex gtk+ theme";
+    description = "Adwaita-based GTK theme with design influence from elementary OS and Vertex GTK theme";
     homepage    = https://github.com/hrdwrrsk/adementary-theme;
     license     = licenses.gpl3;
     maintainers = with maintainers; [ dtzWill ];

pkgs/data/themes/greybird/default.nix

···
   ];
 
   meta = with stdenv.lib; {
-    description = "Grey and blue theme from the Shimmer Project for GTK+-based environments";
+    description = "Grey and blue theme from the Shimmer Project for GTK-based environments";
     homepage = https://github.com/shimmerproject/Greybird;
     license = with licenses; [ gpl2Plus ]; # or alternatively: cc-by-nc-sa-30
     platforms = platforms.linux;

pkgs/data/themes/materia-theme/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "Material Design theme for GNOME/GTK+ based desktop environments";
+    description = "Material Design theme for GNOME/GTK based desktop environments";
     homepage = https://github.com/nana-4/materia-theme;
     license = licenses.gpl2;
     platforms = platforms.all;

pkgs/data/themes/plata/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "A Gtk+ theme based on Material Design Refresh";
+    description = "A GTK theme based on Material Design Refresh";
     homepage = https://gitlab.com/tista500/plata-theme;
     license = with licenses; [ gpl2 cc-by-sa-40 ];
     platforms = platforms.linux;

pkgs/desktops/gnome-2/desktop/vte/default.nix

···
 
   meta = {
     homepage = https://www.gnome.org/;
-    description = "A library implementing a terminal emulator widget for GTK+";
+    description = "A library implementing a terminal emulator widget for GTK";
     longDescription = ''
       VTE is a library (libvte) implementing a terminal emulator widget for
-      GTK+, and a minimal sample application (vte) using that.  Vte is
+      GTK, and a minimal sample application (vte) using that.  Vte is
       mainly used in gnome-terminal, but can also be used to embed a
       console/terminal in games, editors, IDEs, etc. VTE supports Unicode and
       character set conversion, as well as emulating any terminal known to

pkgs/desktops/gnome-2/platform/gtkglext/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://projects.gnome.org/gtkglext/;
-    description = "GtkGLExt, an OpenGL extension to GTK+";
-    longDescription =
-      '' GtkGLExt is an OpenGL extension to GTK+. It provides additional GDK
-         objects which support OpenGL rendering in GTK+ and GtkWidget API
-         add-ons to make GTK+ widgets OpenGL-capable.  In contrast to Janne
-         Löf's GtkGLArea, GtkGLExt provides a GtkWidget API that enables
-         OpenGL drawing for standard and custom GTK+ widgets.
-      '';
+    description = "GtkGLExt, an OpenGL extension to GTK";
+    longDescription = ''
+      GtkGLExt is an OpenGL extension to GTK. It provides additional GDK
+      objects which support OpenGL rendering in GTK and GtkWidget API
+      add-ons to make GTK widgets OpenGL-capable.  In contrast to Janne
+      Löf's GtkGLArea, GtkGLExt provides a GtkWidget API that enables
+      OpenGL drawing for standard and custom GTK widgets.
+    '';
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
   };

pkgs/desktops/gnome-3/apps/glade/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Glade;
-    description = "User interface designer for GTK+ applications";
+    description = "User interface designer for GTK applications";
     maintainers = gnome3.maintainers;
     license = licenses.lgpl2;
     platforms = platforms.linux;

pkgs/desktops/gnome-3/games/hitori/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Hitori;
-    description = "GTK+ application to generate and let you play games of Hitori";
+    description = "GTK application to generate and let you play games of Hitori";
     maintainers = gnome3.maintainers;
     license = licenses.gpl2;
     platforms = platforms.linux;

pkgs/desktops/lxde/core/lxtask/default.nix

···
       with all xfce4 dependencies removed, some bugs fixed, and some
       improvement of UI. Although being part of LXDE, the Lightweight X11
       Desktop Environment, it's totally desktop independent and only
-      requires pure gtk+.
+      requires pure GTK.
     '';
     homepage = https://wiki.lxde.org/en/LXTask;
     license = stdenv.lib.licenses.gpl2Plus;

pkgs/desktops/pantheon/granite/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "An extension to GTK+ used by elementary OS";
+    description = "An extension to GTK used by elementary OS";
     longDescription = ''
-      Granite is a companion library for GTK+ and GLib. Among other things, it provides complex widgets and convenience functions
+      Granite is a companion library for GTK and GLib. Among other things, it provides complex widgets and convenience functions
       designed for use in apps built for elementary OS.
     '';
     homepage = https://github.com/elementary/granite;

pkgs/desktops/xfce/core/gtk-xfce-engine.nix

···
 
   meta = {
     homepage = https://www.xfce.org/;
-    description = "GTK+ theme engine for Xfce";
+    description = "GTK theme engine for Xfce";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.linux;
     maintainers = [ stdenv.lib.maintainers.eelco ];

pkgs/desktops/xfce/default.nix

···
 
   garcon = callPackage ./core/garcon.nix { };
 
-  # When built with GTK+3, it was breaking GTK+3 app layout
+  # When built with GTK 3, it was breaking GTK 3 app layout
   gtk-xfce-engine = callPackage ./core/gtk-xfce-engine.nix { withGtk3 = false; };
 
   libxfce4ui = callPackage ./core/libxfce4ui.nix { };
···
 
   xfce4-pulseaudio-plugin = callPackage ./panel-plugins/xfce4-pulseaudio-plugin.nix { };
 
-  #### GTK+3 (deprecated, see NixOS/nixpkgs#32763)
+  #### GTK3 (deprecated, see NixOS/nixpkgs#32763)
 
   libxfce4ui_gtk3 = libxfce4ui.override { withGtk3 = true; };
 

pkgs/desktops/xfce/panel-plugins/xfce4-vala-panel-appmenu-plugin/appmenu-gtk-module.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "Port of the Unity GTK+ Module";
+    description = "Port of the Unity GTK Module";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ jD91mZM2 ];
   };

pkgs/development/arduino/platformio/chrootenv.nix

···
 let
   pio-pkgs = pkgs:
     let
-      python = pkgs.python.override {
+      python = pkgs.python3.override {
         packageOverrides = self: super: {
-
-          # https://github.com/platformio/platformio-core/issues/349
-          click = super.click.overridePythonAttrs (oldAttrs: rec {
-            version = "5.1";
-            src = oldAttrs.src.override {
-              inherit version;
-              sha256 = "678c98275431fad324275dec63791e4a17558b40e5a110e20a82866139a85a5a";
-            };
-            postPatch = "";
-          });
-
           platformio = self.callPackage ./core.nix { };
         };
       };
···
 
   meta = with lib; {
     description = "An open source ecosystem for IoT development";
-    homepage = http://platformio.org;
+    homepage = "https://platformio.org";
     maintainers = with maintainers; [ mog ];
     license = licenses.asl20;
     platforms = with platforms; linux;

pkgs/development/arduino/platformio/core.nix

···
 { stdenv, lib, buildPythonApplication, fetchFromGitHub
 , bottle, click, colorama
 , lockfile, pyserial, requests
-, pytest, semantic-version, tox
+, pytest, semantic-version, tox, tabulate
 , git
 }:
 
···
     "test_builder.py::test_build_unflags"
     "test_misc.py::test_api_cache"
     "test_misc.py::test_ping_internet_ips"
+    "test_misc.py::test_platformio_cli"
     "test_pkgmanifest.py::test_packages"
   ]) ++ (map (e: "--ignore=tests/${e}") [
     "commands/test_boards.py"
···
 
 in buildPythonApplication rec {
   pname = "platformio";
-  version = "3.6.6";
+  version = "4.0.3";
 
   # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
   src = fetchFromGitHub {
     owner = "platformio";
     repo = "platformio-core";
     rev = "v${version}";
-    sha256 = "1qwd6684y2xagl375sv8fm6a535hcdqx296hknjlbvsgc1jc514a";
+    sha256 = "1naaa53cc7n7zyqggqjvvgkcq8cyzngdf904y9ag0x1vvb70f8j9";
   };
 
   propagatedBuildInputs =  [
     bottle click colorama git lockfile
     pyserial requests semantic-version
+    tabulate
   ];
 
   HOME = "/tmp";

pkgs/development/arduino/platformio/fix-searchpath.patch

···
---- ./platformio/util.py-old	2017-09-29 01:20:08.174548250 +0200
-+++ ./platformio/util.py	2017-09-29 01:19:48.410485308 +0200
-@@ -395,7 +395,7 @@
+--- ./platformio/proc.py-old	2017-09-29 01:20:08.174548250 +0200
++++ ./platformio/proc.py	2017-09-29 01:19:48.410485308 +0200
+@@ -164,7 +164,7 @@
                  isdir(join(p, "click")) or isdir(join(p, "platformio")))
          if all(conditions):
              _PYTHONPATH.append(p)

pkgs/development/compilers/gcc/4.8/default.nix

···
 
 in
 
-# We need all these X libraries when building AWT with GTK+.
+# We need all these X libraries when building AWT with GTK.
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
 stdenv.mkDerivation ({
···
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
   # library headers and binaries, regarless of the language being compiled.
   #
-  # Note: When building the Java AWT GTK+ peer, the build system doesn't honor
+  # Note: When building the Java AWT GTK peer, the build system doesn't honor
   # `--with-gmp' et al., e.g., when building
   # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
   # them to $CPATH and $LIBRARY_PATH in this case.

pkgs/development/compilers/gcc/4.9/default.nix

···
 
 in
 
-# We need all these X libraries when building AWT with GTK+.
+# We need all these X libraries when building AWT with GTK.
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
 stdenv.mkDerivation ({
···
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
   # library headers and binaries, regarless of the language being compiled.
   #
-  # Note: When building the Java AWT GTK+ peer, the build system doesn't honor
+  # Note: When building the Java AWT GTK peer, the build system doesn't honor
   # `--with-gmp' et al., e.g., when building
   # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
   # them to $CPATH and $LIBRARY_PATH in this case.

pkgs/development/compilers/gcc/5/default.nix

···
 
 in
 
-# We need all these X libraries when building AWT with GTK+.
+# We need all these X libraries when building AWT with GTK.
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
 stdenv.mkDerivation ({
···
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
   # library headers and binaries, regarless of the language being compiled.
   #
-  # Note: When building the Java AWT GTK+ peer, the build system doesn't honor
+  # Note: When building the Java AWT GTK peer, the build system doesn't honor
   # `--with-gmp' et al., e.g., when building
   # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
   # them to $CPATH and $LIBRARY_PATH in this case.

pkgs/development/compilers/gcc/6/default.nix

···
 
 in
 
-# We need all these X libraries when building AWT with GTK+.
+# We need all these X libraries when building AWT with GTK.
 assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
 
 stdenv.mkDerivation ({
···
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
   # library headers and binaries, regarless of the language being compiled.
   #
-  # Note: When building the Java AWT GTK+ peer, the build system doesn't honor
+  # Note: When building the Java AWT GTK peer, the build system doesn't honor
   # `--with-gmp' et al., e.g., when building
   # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
   # them to $CPATH and $LIBRARY_PATH in this case.

pkgs/development/guile-modules/guile-gnome/default.nix

···
     longDescription = ''
       GNU guile-gnome brings the power of Scheme to your graphical application.
       guile-gnome modules support the entire Gnome library stack: from Pango to
-      GnomeCanvas, Gtk+ to GStreamer, Glade to GtkSourceView, you will find in
+      GnomeCanvas, GTK to GStreamer, Glade to GtkSourceView, you will find in
       guile-gnome a comprehensive environment for developing modern
       applications.
     '';

pkgs/development/libraries/amtk/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Projects/Amtk;
-    description = "Actions, Menus and Toolbars Kit for GTK+ applications";
+    description = "Actions, Menus and Toolbars Kit for GTK applications";
     maintainers = [ maintainers.manveru ];
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;

pkgs/development/libraries/fflas-ffpack/default.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "fflas-ffpack";
-  version = "2.4.0";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "linbox-team";
     repo = "${pname}";
-    rev = "v${version}";
-    sha256 = "1q1ala88ysz14pb5cn2kskv829nc1qif7zfzjwzhd5nnzwyivmc4";
+    rev = "${version}";
+    sha256 = "1ynbjd72qrwp0b4kpn0p5d7gddpvj8dlb5fwdxajr5pvkvi3if74";
   };
 
   checkInputs = [

pkgs/development/libraries/goffice/default.nix

···
   };
 
   meta = {
-    description = "A Glib/GTK+ set of document centric objects and utilities";
+    description = "A Glib/GTK set of document centric objects and utilities";
 
     longDescription = ''
       There are common operations for document centric applications that are

pkgs/development/libraries/goocanvas/2.x.nix

···
   PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_TYPELIBDIR = "$(out)/lib/girepository-1.0";
 
   meta = with stdenv.lib; {
-    description = "Canvas widget for GTK+ based on the the Cairo 2D library";
+    description = "Canvas widget for GTK based on the the Cairo 2D library";
     homepage = https://wiki.gnome.org/Projects/GooCanvas;
     license = licenses.lgpl2;
     maintainers = with maintainers; [ ];

pkgs/development/libraries/goocanvas/default.nix

···
   };
 
   meta = with stdenv.lib; {
-    description = "Canvas widget for GTK+ based on the the Cairo 2D library";
+    description = "Canvas widget for GTK based on the the Cairo 2D library";
     homepage = "https://wiki.gnome.org/Projects/GooCanvas";
     license = licenses.lgpl2;
     platforms = stdenv.lib.platforms.unix;

pkgs/development/libraries/gspell/default.nix

···
   };
 
   meta = with stdenv.lib; {
-    description = "A spell-checking library for GTK+ applications";
+    description = "A spell-checking library for GTK applications";
     homepage = https://wiki.gnome.org/Projects/gspell;
     license = licenses.lgpl21Plus;
     maintainers = gnome3.maintainers;

pkgs/development/libraries/gtk+/2.x.nix pkgs/development/libraries/gtk/2.x.nix

···
     platforms   = platforms.all;
 
     longDescription = ''
-      GTK+ is a highly usable, feature rich toolkit for creating
+      GTK is a highly usable, feature rich toolkit for creating
       graphical user interfaces which boasts cross platform
-      compatibility and an easy to use API.  GTK+ it is written in C,
+      compatibility and an easy to use API.  GTK it is written in C,
       but has bindings to many other popular programming languages
-      such as C++, Python and C# among others.  GTK+ is licensed
+      such as C++, Python and C# among others.  GTK is licensed
       under the GNU LGPL 2.1 allowing development of both free and
-      proprietary software with GTK+ without any license fees or
+      proprietary software with GTK without any license fees or
       royalties.
     '';
   };

pkgs/development/libraries/gtk+/3.x.nix pkgs/development/libraries/gtk/3.x.nix

···
   meta = {
     description = "A multi-platform toolkit for creating graphical user interfaces";
     longDescription = ''
-      GTK+ is a highly usable, feature rich toolkit for creating
+      GTK is a highly usable, feature rich toolkit for creating
       graphical user interfaces which boasts cross platform
-      compatibility and an easy to use API.  GTK+ it is written in C,
+      compatibility and an easy to use API.  GTK it is written in C,
       but has bindings to many other popular programming languages
-      such as C++, Python and C# among others.  GTK+ is licensed
+      such as C++, Python and C# among others.  GTK is licensed
       under the GNU LGPL 2.1 allowing development of both free and
-      proprietary software with GTK+ without any license fees or
+      proprietary software with GTK without any license fees or
       royalties.
     '';
     homepage = https://www.gtk.org/;

pkgs/development/libraries/gtk-mac-integration/default.nix

···
   '';
 
   meta = with lib; {
-    description = "Provides integration for Gtk+ applications into the Mac desktop";
+    description = "Provides integration for GTK applications into the Mac desktop";
 
     license = licenses.lgpl21;
 
-    homepage = https://wiki.gnome.org/Projects/GTK+/OSX/Integration;
+    homepage = https://wiki.gnome.org/Projects/GTK/OSX/Integration;
 
     maintainers = [ maintainers.matthewbauer ];
     platforms = platforms.darwin;

pkgs/development/libraries/gtk-sharp-beans/default.nix

···
   dontStrip = true;
 
   meta = with stdenv.lib; {
-    description = "Binds some API from Gtk+ that isn't in Gtk# 2.12.x";
+    description = "Binds some API from GTK that isn't in GTK# 2.12.x";
     platforms = platforms.linux;
     license = licenses.lgpl21;
   };

pkgs/development/libraries/gtkd/default.nix

···
   installFlags = "prefix=$(out)";
 
   meta = with stdenv.lib; {
-    description = "D binding and OO wrapper for GTK+";
+    description = "D binding and OO wrapper for GTK";
     homepage = https://gtkd.org;
     license = licenses.lgpl3Plus;
     platforms = platforms.linux ++ platforms.darwin;

pkgs/development/libraries/gtkdatabox/default.nix

···
   propagatedBuildInputs = [ gtk2 ];
 
   meta = {
-    description = "Gtk+ widget for displaying large amounts of numerical data";
+    description = "GTK widget for displaying large amounts of numerical data";
 
     license = stdenv.lib.licenses.lgpl2;
 

pkgs/development/libraries/gtkimageview/default.nix

···
   meta = {
     homepage = "https://wiki.gnome.org/Projects/GTK%2B/GtkImageView";
 
-    description = "Image viewer widget for GTK+";
+    description = "Image viewer widget for GTK";
 
     longDescription =
-      '' GtkImageView is a simple image viewer widget for GTK+.  Similar to
+      '' GtkImageView is a simple image viewer widget for GTK.  Similar to
          the image viewer panes in gThumb or Eye of Gnome.  It makes writing
          image viewing and editing applications easy.  Among its features
          are: mouse and keyboard zooming; scrolling and dragging; adjustable

pkgs/development/libraries/gtkmm/2.x.nix

···
   enableParallelBuilding = true;
 
   meta = {
-    description = "C++ interface to the GTK+ graphical user interface library";
+    description = "C++ interface to the GTK graphical user interface library";
 
     longDescription = ''
       gtkmm is the official C++ interface for the popular GUI library
-      GTK+.  Highlights include typesafe callbacks, and a
+      GTK.  Highlights include typesafe callbacks, and a
       comprehensive set of widgets that are easily extensible via
       inheritance.  You can create user interfaces either in code or
       with the Glade User Interface designer, using libglademm.

pkgs/development/libraries/gtkmm/3.x.nix

···
   };
 
   meta = with stdenv.lib; {
-    description = "C++ interface to the GTK+ graphical user interface library";
+    description = "C++ interface to the GTK graphical user interface library";
 
     longDescription = ''
       gtkmm is the official C++ interface for the popular GUI library
-      GTK+.  Highlights include typesafe callbacks, and a
+      GTK.  Highlights include typesafe callbacks, and a
       comprehensive set of widgets that are easily extensible via
       inheritance.  You can create user interfaces either in code or
       with the Glade User Interface designer, using libglademm.

pkgs/development/libraries/indicator-application/gtk2.nix

···
   ];
 
   meta = {
-    description = "Indicator to take menus from applications and place them in the panel (GTK+ 2 library for Xfce/LXDE)";
+    description = "Indicator to take menus from applications and place them in the panel (GTK 2 library for Xfce/LXDE)";
     homepage = https://launchpad.net/indicators-gtk2;
     license = licenses.gpl3;
     platforms = platforms.linux;

pkgs/development/libraries/libchamplain/default.nix

···
 
     longDescription = ''
       libchamplain is a C library providing a ClutterActor to display
-       maps.  It also provides a Gtk+ widget to display maps in Gtk+
+       maps.  It also provides a GTK widget to display maps in GTK
        applications.  Python and Perl bindings are also available.  It
        supports numerous free map sources such as OpenStreetMap,
        OpenCycleMap, OpenAerialMap, and Maps for free.

pkgs/development/libraries/libdazzle/default.nix

···
   meta = with stdenv.lib; {
     description = "A library to delight your users with fancy features";
     longDescription = ''
-      The libdazzle library is a companion library to GObject and Gtk+. It
+      The libdazzle library is a companion library to GObject and GTK. It
       provides various features that we wish were in the underlying library but
       cannot for various reasons. In most cases, they are wildly out of scope
       for those libraries. In other cases, our design isn't quite generic

pkgs/development/libraries/libhandy/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "A library full of GTK+ widgets for mobile phones";
+    description = "A library full of GTK widgets for mobile phones";
     homepage = https://source.puri.sm/Librem5/libhandy;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ jtojnar ];

pkgs/development/libraries/libnotify/default.nix

···
   ];
 
   mesonFlags = [
-    # disable tests as we don't need to depend on gtk+(2/3)
+    # disable tests as we don't need to depend on GTK (2/3)
     "-Dtests=false"
     "-Ddocbook_docs=disabled"
     "-Dgtk_doc=false"

pkgs/development/libraries/libsexy/default.nix

···
 { stdenv, fetchurl, pkgconfig
 , glib, gtk2, libxml2, pango
 }:
- 
+
 stdenv.mkDerivation {
   name = "libsexy-0.1.11";
 
···
   buildInputs = [ glib gtk2 libxml2 pango ];
 
   meta = with stdenv.lib; {
-    description = "A collection of GTK+ widgets";
+    description = "A collection of GTK widgets";
     homepage = https://blog.chipx86.com/tag/libsexy/;
     license = licenses.lgpl21;
     maintainers = with maintainers; [ ];

pkgs/development/libraries/libyaml-cpp/default.nix

···
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = "-DBUILD_SHARED_LIBS=ON";
+  cmakeFlags = "-DBUILD_SHARED_LIBS=ON -DYAML_CPP_BUILD_TESTS=OFF";
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;

pkgs/development/libraries/mm-common/default.nix

···
   };
 
   meta = with stdenv.lib; {
-    description = "Common build files of GLib/GTK+ C++ bindings";
+    description = "Common build files of GLib/GTK C++ bindings";
     longDescription = ''
       The mm-common module provides the build infrastructure and utilities
       shared among the GNOME C++ binding libraries. It is only a required

pkgs/development/libraries/osm-gps-map/default.nix

···
   ];
 
   meta = with stdenv.lib; {
-    description = "Gtk+ widget for displaying OpenStreetMap tiles";
+    description = "GTK widget for displaying OpenStreetMap tiles";
     homepage = https://nzjrs.github.io/osm-gps-map;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ hrdinka ];

pkgs/development/libraries/pango/default.nix

···
       Pango is a library for laying out and rendering of text, with an
       emphasis on internationalization.  Pango can be used anywhere
       that text layout is needed, though most of the work on Pango so
-      far has been done in the context of the GTK+ widget toolkit.
-      Pango forms the core of text and font handling for GTK+-2.x.
+      far has been done in the context of the GTK widget toolkit.
+      Pango forms the core of text and font handling for GTK.
     '';
 
     homepage = https://www.pango.org/;

pkgs/development/libraries/pangomm/default.nix

···
       Pango is a library for laying out and rendering of text, with an
       emphasis on internationalization.  Pango can be used anywhere
       that text layout is needed, though most of the work on Pango so
-      far has been done in the context of the GTK+ widget toolkit.
-      Pango forms the core of text and font handling for GTK+-2.x.
+      far has been done in the context of the GTK widget toolkit.
+      Pango forms the core of text and font handling for GTK.
     '';
   };
 }

pkgs/development/libraries/qtstyleplugins/default.nix

···
   buildInputs = [ gtk2 ];
 
   meta = with stdenv.lib; {
-    description = "Additional style plugins for Qt5, including BB10, GTK+, Cleanlooks, Motif, Plastique";
+    description = "Additional style plugins for Qt5, including BB10, GTK, Cleanlooks, Motif, Plastique";
     homepage = http://blog.qt.io/blog/2012/10/30/cleaning-up-styles-in-qt5-and-adding-fusion/;
     license = licenses.lgpl21;
     maintainers = [ maintainers.gnidorah ];

pkgs/development/libraries/rep-gtk/default.nix

···
   '';
 
   meta = {
-    description = "GTK+ bindings for librep";
+    description = "GTK bindings for librep";
     homepage = http://sawfish.wikia.com;
     license = licenses.gpl2;
     maintainers = [ maintainers.AndersonTorres ];

pkgs/development/libraries/spice-gtk/default.nix

···
   ];
 
   meta = with stdenv.lib; {
-    description = "A GTK+3 SPICE widget";
+    description = "GTK 3 SPICE widget";
     longDescription = ''
-      spice-gtk is a GTK+3 SPICE widget. It features glib-based
+      spice-gtk is a GTK 3 SPICE widget. It features glib-based
       objects for SPICE protocol parsing and a gtk widget for embedding
       the SPICE display into other applications such as virt-manager.
       Python bindings are available too.

pkgs/development/libraries/vte/2.90.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://www.gnome.org/;
-    description = "A library implementing a terminal emulator widget for GTK+";
+    description = "A library implementing a terminal emulator widget for GTK";
     longDescription = ''
       VTE is a library (libvte) implementing a terminal emulator widget for
-      GTK+, and a minimal sample application (vte) using that.  Vte is
+      GTK, and a minimal sample application (vte) using that.  Vte is
       mainly used in gnome-terminal, but can also be used to embed a
       console/terminal in games, editors, IDEs, etc. VTE supports Unicode and
       character set conversion, as well as emulating any terminal known to

pkgs/development/libraries/vte/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = https://www.gnome.org/;
-    description = "A library implementing a terminal emulator widget for GTK+";
+    description = "A library implementing a terminal emulator widget for GTK";
     longDescription = ''
       VTE is a library (libvte) implementing a terminal emulator widget for
-      GTK+, and a minimal sample application (vte) using that.  Vte is
+      GTK, and a minimal sample application (vte) using that.  Vte is
       mainly used in gnome-terminal, but can also be used to embed a
       console/terminal in games, editors, IDEs, etc. VTE supports Unicode and
       character set conversion, as well as emulating any terminal known to

pkgs/development/libraries/webkitgtk/2.4.nix

···
   version = "2.4.11";
 
   meta = with stdenv.lib; {
-    description = "Web content rendering engine, GTK+ port";
+    description = "Web content rendering engine, GTK port";
     homepage = http://webkitgtk.org/;
     license = licenses.bsd2;
     platforms = with platforms; linux ++ darwin;

pkgs/development/libraries/webkitgtk/default.nix

···
   version = "2.24.3";
 
   meta = {
-    description = "Web content rendering engine, GTK+ port";
+    description = "Web content rendering engine, GTK port";
     homepage = https://webkitgtk.org/;
     license = licenses.bsd2;
     platforms = platforms.linux;

pkgs/development/ocaml-modules/lablgtk/2.14.0.nix

···
       stdenv.lib.maintainers.roconnor
     ];
     homepage = http://wwwfun.kurims.kyoto-u.ac.jp/soft/lsl/lablgtk.html;
-    description = "LablGTK is is an Objective Caml interface to gtk+";
+    description = "LablGTK is is an Objective Caml interface to GTK";
     license = stdenv.lib.licenses.lgpl21Plus;
   };
 })

pkgs/development/ocaml-modules/lablgtk/default.nix

···
       z77z roconnor vbgl
     ];
     homepage = http://lablgtk.forge.ocamlcore.org/;
-    description = "An OCaml interface to gtk+";
+    description = "An OCaml interface to GTK";
     license = licenses.lgpl21Plus;
   };
 }

pkgs/development/ocaml-modules/lablgtk3/default.nix

···
   propagatedBuildInputs = [ cairo2 ];
 
   meta = {
-    description = "OCaml interface to gtk+-3";
+    description = "OCaml interface to GTK 3";
     homepage = "http://lablgtk.forge.ocamlcore.org/";
     license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.vbgl ];

pkgs/development/pure-modules/gtk/default.nix

···
   setupHook = ../generic-setup-hook.sh;
 
   meta = {
-    description = "A collection of bindings to use the GTK+ GUI toolkit version 2.x with Pure";
+    description = "A collection of bindings to use the GTK GUI toolkit version 2.x with Pure";
     homepage = http://puredocs.bitbucket.org/pure-gtk.html;
     license = stdenv.lib.licenses.lgpl3Plus;
     platforms = stdenv.lib.platforms.linux;

pkgs/development/python-modules/gtimelog/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "A small Gtk+ app for keeping track of your time. It's main goal is to be as unintrusive as possible";
+    description = "A small GTK app for keeping track of your time. It's main goal is to be as unintrusive as possible";
     homepage = https://mg.pov.lt/gtimelog/;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ocharles ];

pkgs/development/python-modules/imagecodecs-lite/default.nix

···
+{ lib, fetchPypi, buildPythonPackage
+, pytest
+, numpy
+, cython
+}:
+
+buildPythonPackage rec {
+  pname = "imagecodecs-lite";
+  version = "2019.4.20";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1cp88g7g91gdhjhaz6gvb4jzvi5ad817id9f2bnc5r95ag93bqb0";
+  };
+
+  checkInputs = [ pytest ];
+  propagatedBuildInputs = [ numpy cython ];
+
+  meta = with lib; {
+    description = "Block-oriented, in-memory buffer transformation, compression, and decompression functions";
+    homepage = "https://www.lfd.uci.edu/~gohlke/";
+    maintainers = [ maintainers.tbenst ];
+    license = licenses.bsd3;
+  };
+}

pkgs/development/python-modules/pygtk/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "GTK+-2 bindings";
+    description = "GTK 2 Python bindings";
     homepage = "https://gitlab.gnome.org/Archive/pygtk";
     platforms = platforms.all;
     license = with licenses; [ lgpl21Plus ];

pkgs/development/python-modules/pyvmomi/default.nix

···
+{ lib, buildPythonPackage, fetchFromGitHub, requests }:
+
+buildPythonPackage rec {
+  pname = "pyvmomi";
+  version = "6.7.1.2018.12";
+
+  src = fetchFromGitHub {
+    owner = "vmware";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1pgl95rbghidbyr8hndjzfzgb1yjchfcknlqgg3qbqvljnz9hfja";
+  };
+
+  # requires old version of vcrpy
+  doCheck = false;
+
+  propagatedBuildInputs = [ requests ];
+
+  meta = with lib; {
+    description = "Python SDK for the VMware vSphere API that allows you to manage ESX, ESXi, and vCenter";
+    homepage = "https://github.com/vmware/pyvmomi";
+    license = licenses.asl20;
+  };
+}

pkgs/development/python-modules/pywebkitgtk/default.nix

···
 
   meta = with stdenv.lib; {
     homepage = "https://code.google.com/p/pywebkitgtk/";
-    description = "Python bindings for the WebKit GTK+ port";
+    description = "Python bindings for the WebKit GTK port";
     license = licenses.lgpl2Plus;
   };
 

pkgs/development/python-modules/semantic-version/default.nix

···
 
 buildPythonPackage rec {
   pname = "semantic_version";
-  version = "2.6.0";
+  version = "2.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1h2l9xyg1zzsda6kjcmfcgycbvrafwci283vcr1v5sbk01l2hhra";
+    sha256 = "1lnnpxmf3z1rcfr5n562vbraq236s13wlj8fmw2kwr2mrq7lqb8r";
   };
 
   # ModuleNotFoundError: No module named 'tests'

pkgs/development/python-modules/speedtest-cli/default.nix

···
 # required for home-assistant
 buildPythonPackage rec {
   pname = "speedtest-cli";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1s3ylvkclzdsyqmpjnsd6ixrbmj7vd4bfsdplkjaz1c2czyy3j9p";
+    sha256 = "0m1fpsb318mrpliw026a7nhx8iky306rmfi565734k7r49i3h7fg";
   };
 
   # tests require working internet connection

pkgs/development/python-modules/textacy/default.nix

···
-{ stdenv
-, buildPythonPackage
-, isPy27
-, fetchPypi
+{ lib, buildPythonPackage, fetchPypi, isPy27
 , cachetools
-, cld2-cffi
 , cytoolz
-, ftfy
-, ijson
+, jellyfish
 , matplotlib
 , networkx
 , numpy
 , pyemd
 , pyphen
-, python-Levenshtein
+, pytest
 , requests
 , scikitlearn
 , scipy
 , spacy
-, tqdm
-, unidecode
+, srsly
 }:
 
 buildPythonPackage rec {
   pname = "textacy";
-  version = "0.6.3";
+  version = "0.9.1";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "50402545ac92b1a931c2365e341cb35c4ebe5575525f1dcc5265901ff3895a5f";
+    sha256 = "1jhj02g6kh5vc0z4az7n547siav3gj5571bqpzdryskj6bsma2z1";
   };
 
   propagatedBuildInputs = [
     cachetools
-    cld2-cffi
     cytoolz
-    ftfy
-    ijson
+    jellyfish
     matplotlib
     networkx
     numpy
     pyemd
     pyphen
-    python-Levenshtein
     requests
     scikitlearn
     scipy
     spacy
-    tqdm
-    unidecode
+    srsly
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'ftfy>=4.2.0,<5.0.0'," "'ftfy>=5.0.0',"
+  checkInputs = [ pytest ];
+  # almost all tests have to deal with downloading a dataset, only test pure tests
+  checkPhase = ''
+    pytest tests/test_text_utils.py \
+      tests/test_utils.py \
+      tests/preprocessing \
+      tests/datasets/test_base_dataset.py
   '';
 
-  doCheck = false;  # tests want to download data files
-
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Higher-level text processing, built on spaCy";
     homepage = "http://textacy.readthedocs.io/";
     license = licenses.asl20;
     maintainers = with maintainers; [ rvl ];
-    # ftfy and jellyfish no longer support python2
-    # latest scikitlearn not supported for this: https://github.com/chartbeat-labs/textacy/issues/260
-    broken = true;
   };
 }

pkgs/development/ruby-modules/bundix/default.nix

···
 
   name = "${gemName}-${version}";
   gemName = "bundix";
-  version = "2.4.2";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
-    owner = "manveru";
+    owner = "nix-community";
     repo = "bundix";
     rev = version;
-    sha256 = "03jhj1dy0ljrymjnpi6mcxn36a29qxr835l1lc11879jjzvnr2ax";
+    sha256 = "05y8sy6v9km1dwvpjzkjxpfzv95g6yzac1b5blac2f1r2kw167p8";
   };
 
   buildInputs = [ ruby bundler ];

pkgs/development/tools/analysis/flow/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "flow";
-  version = "0.106.0";
+  version = "0.107.0";
 
   src = fetchFromGitHub {
     owner  = "facebook";
     repo   = "flow";
     rev    = "refs/tags/v${version}";
-    sha256 = "0da32j8s3avxa84g2gn9sr4nakibllz1kq5i3bgqbndrgcgsdvgw";
+    sha256 = "1in7a006lgw4v2p0gn5sx41cn3p259vncpq0l3rz52lyfpn7ai3b";
   };
 
   installPhase = ''

pkgs/development/tools/analysis/radare2/cutter.nix

···
 , qtbase, qtsvg, qtwebengine
 # buildInputs
 , r2-for-cutter
-, python3 }:
+, python3
+, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "radare2-cutter";
···
   '';
 
   nativeBuildInputs = [ qmake pkgconfig ];
-  buildInputs = [ qtbase qtsvg qtwebengine r2-for-cutter python3 ];
+  buildInputs = [ qtbase qtsvg qtwebengine r2-for-cutter python3 wrapQtAppsHook ];
 
   qmakeFlags = [
     "CONFIG+=link_pkgconfig"

pkgs/development/tools/documentation/gtk-doc/default.nix

···
   };
 
   meta = with stdenv.lib; {
-    description = "Tools to extract documentation embedded in GTK+ and GNOME source code";
+    description = "Tools to extract documentation embedded in GTK and GNOME source code";
     homepage = "https://www.gtk.org/gtk-doc";
     license = licenses.gpl2;
     maintainers = with maintainers; [ pSub ];

pkgs/development/tools/gtk-mac-bundler/default.nix

···
   '';
 
   meta = with lib; {
-    description = "a helper script that creates application bundles form GTK+ executables for macOS";
+    description = "a helper script that creates application bundles form GTK executables for macOS";
     maintainers = [ maintainers.matthewbauer ];
     platforms = platforms.darwin;
-    homepage = https://wiki.gnome.org/Projects/GTK+/OSX/Bundling;
+    homepage = https://wiki.gnome.org/Projects/GTK/OSX/Bundling;
     license = licenses.gpl2;
   };
 }

pkgs/development/tools/misc/gtkperf/default.nix

···
   patches = [ ./bench.patch ];
 
   meta = with stdenv.lib; {
-    description = "Application designed to test GTK+ performance";
+    description = "Application designed to test GTK performance";
     homepage = http://gtkperf.sourceforge.net/;
     license = with licenses; [ gpl2 ];
     maintainers = with maintainers; [ dtzWill ];

pkgs/development/web/postman/default.nix

···
-{ stdenv, lib, gnome2, fetchurl, pkgs, xorg, makeWrapper, makeDesktopItem }:
+{ stdenv, fetchurl, makeDesktopItem, wrapGAppsHook
+, atk, at-spi2-atk, alsaLib, cairo, cups, dbus, expat, gdk-pixbuf, glib, gtk3
+, freetype, fontconfig, nss, nspr, pango, udev, libX11, libxcb, libXi
+, libXcursor, libXdamage, libXrandr, libXcomposite, libXext, libXfixes
+, libXrender, libXtst, libXScrnSaver
+}:
 
 stdenv.mkDerivation rec {
   pname = "postman";
-  version = "7.0.7";
+  version = "7.6.0";
 
   src = fetchurl {
     url = "https://dl.pstmn.io/download/version/${version}/linux64";
-    sha256 = "47be1b955759520f3a2c7dcdecb85b4c52c38df717da294ba184f46f2058014a";
-    name = "${pname}-${version}.tar.gz";
+    sha256 = "sha256:03y82ydkj46l7dn35y944gnghbrrhc75y3yxdyidbh8fl3xvmlfv";
+    name = "${pname}.tar.gz";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-
-  dontPatchELF = true;
-
-  buildPhase = ":";   # nothing to build
+  dontBuild = true; # nothing to build
+  dontConfigure = true;
 
   desktopItem = makeDesktopItem {
     name = "postman";
···
     categories = "Application;Development;";
   };
 
+  buildInputs = [
+    stdenv.cc.cc.lib
+    atk
+    at-spi2-atk
+    alsaLib
+    cairo
+    cups
+    dbus
+    expat
+    gdk-pixbuf
+    glib
+    gtk3
+    freetype
+    fontconfig
+    nss
+    nspr
+    pango
+    udev
+    libX11
+    libxcb
+    libXi
+    libXcursor
+    libXdamage
+    libXrandr
+    libXcomposite
+    libXext
+    libXfixes
+    libXrender
+    libXtst
+    libXScrnSaver
+  ];
+
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+
   installPhase = ''
     mkdir -p $out/share/postman
     cp -R app/* $out/share/postman
+    rm $out/share/postman/Postman
 
     mkdir -p $out/bin
-    ln -s $out/share/postman/Postman $out/bin/postman
+    ln -s $out/share/postman/_Postman $out/bin/postman
 
     mkdir -p $out/share/applications
     ln -s ${desktopItem}/share/applications/* $out/share/applications/
···
     ln -s $out/share/postman/resources/app/assets/icon.png $iconSizeDir/postman.png
   '';
 
-  preFixup = let
-    libPath = lib.makeLibraryPath [
-      stdenv.cc.cc.lib
-      gnome2.pango
-      gnome2.GConf
-      pkgs.atk
-      pkgs.alsaLib
-      pkgs.cairo
-      pkgs.cups
-      pkgs.dbus.daemon.lib
-      pkgs.expat
-      pkgs.gdk-pixbuf
-      pkgs.glib
-      pkgs.gtk2-x11
-      pkgs.freetype
-      pkgs.fontconfig
-      pkgs.nss
-      pkgs.nspr
-      pkgs.udev.lib
-      xorg.libX11
-      xorg.libxcb
-      xorg.libXi
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXrandr
-      xorg.libXcomposite
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXrender
-      xorg.libX11
-      xorg.libXtst
-      xorg.libXScrnSaver
-    ];
-  in ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}:$out/share/postman" \
-      $out/share/postman/Postman
-    patchelf --set-rpath "${libPath}" $out/share/postman/libnode.so
-    patchelf --set-rpath "${libPath}" $out/share/postman/libffmpeg.so
-
-    wrapProgram $out/share/postman/Postman --prefix LD_LIBRARY_PATH : ${libPath}
+  postFixup = ''
+    pushd $out/share/postman
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" _Postman
+    for file in $(find . -type f \( -name \*.node -o -name _Postman -o -name \*.so\* \) ); do
+      ORIGIN=$(patchelf --print-rpath $file); \
+      patchelf --set-rpath "${stdenv.lib.makeLibraryPath buildInputs}:$ORIGIN" $file
+    done
+    popd
   '';
 
   meta = with stdenv.lib; {
     homepage = https://www.getpostman.com;
     description = "API Development Environment";
-    license = stdenv.lib.licenses.postman;
+    license = licenses.postman;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ xurei ];
+    maintainers = with maintainers; [ xurei evanjs ];
   };
 }

pkgs/misc/emulators/gens-gs/default.nix

···
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gtk2 SDL nasm zlib libpng libGLU_combined ];
 
-  # Work around build failures on recent GTK+.
+  # Work around build failures on recent GTK.
   # See http://ubuntuforums.org/showthread.php?p=10535837
   NIX_CFLAGS_COMPILE = "-UGTK_DISABLE_DEPRECATED -UGSEAL_ENABLE";
 

pkgs/misc/screensavers/xlockmore/default.nix

···
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
-  # Optionally, it can use GTK+.
+  # Optionally, it can use GTK.
   buildInputs = [ pam libX11 libXext libXinerama libXdmcp libXt ];
 
   # Don't try to install `xlock' setuid. Password authentication works

pkgs/misc/themes/adapta/default.nix

···
   ];
 
   meta = with stdenv.lib; {
-    description = "An adaptive Gtk+ theme based on Material Design Guidelines";
+    description = "An adaptive GTK theme based on Material Design Guidelines";
     homepage = https://github.com/adapta-project/adapta-gtk-theme;
     license = with licenses; [ gpl2 cc-by-sa-30 ];
     platforms = platforms.linux;

pkgs/misc/themes/e17gtk/default.nix

···
   '';
 
   meta = {
-    description = "An Enlightenment-like GTK+ theme with sharp corners";
+    description = "An Enlightenment-like GTK theme with sharp corners";
     homepage = https://github.com/tsujan/E17gtk;
     license = stdenv.lib.licenses.gpl3;
     platforms = stdenv.lib.platforms.unix;

pkgs/misc/themes/equilux-theme/default.nix

···
 
   meta = with stdenv.lib; {
     inherit (src.meta) homepage;
-    description = "A Material Design theme for GNOME/GTK+ based desktop environments";
+    description = "A Material Design theme for GNOME/GTK based desktop environments";
     license = licenses.gpl2;
     platforms = platforms.all;
     maintainers = [ maintainers.fpletz ];

pkgs/misc/themes/gtk2/gtk-engines/default.nix

···
   buildInputs = [ intltool gtk2 ];
 
   meta = {
-    description = "Theme engines for GTK+ 2";
+    description = "Theme engines for GTK 2";
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = stdenv.lib.platforms.linux;
   };

pkgs/os-specific/linux/fwts/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "19.07.00";
+  version = "19.08.00";
 
   src = fetchzip {
-    url = "http://fwts.ubuntu.com/release/fwts-V${version}.tar.gz";
-    sha256 = "04h99ri3nzhxr2js2a04bcj6zm17zlybqzv528j6hr6v0pv5wn4p";
+    url = "http://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
+    sha256 = "14v4vxvfsl008xalsmlhl9wh89xlrfffh3pky9m90flaizdzwyp4";
     stripRoot = false;
   };
 

pkgs/os-specific/linux/sysdig/default.nix

···
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "sysdig";
-  version = "0.26.2";
+  version = "0.26.4";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "1a74cvvy3lhilibc3lzcsvs6pwrdvdx2580qgckp1lrra9gf5hga";
+    sha256 = "1v2j1ns17wyj7xl91p6wy1iwfx2fnn8af9nm939skc6229m87zzn";
   };
 
   nativeBuildInputs = [ cmake perl ];

pkgs/os-specific/linux/usbguard/default.nix

···
 {
   stdenv, fetchurl, lib,
-  pkgconfig, libxml2, libxslt,
-  dbus-glib, libcap_ng, libqb, libseccomp, polkit, protobuf, audit,
-  withGui ? true,
-  qtbase ? null,
-  qttools ? null,
-  qtsvg ? null,
+  pkgconfig, libxslt, libxml2, docbook_xml_dtd_45, docbook_xsl, asciidoc,
+  dbus-glib, libcap_ng, libqb, libseccomp, polkit, protobuf,
+  audit,
   libgcrypt ? null,
   libsodium ? null
 }:
···
 assert libgcrypt != null -> libsodium == null;
 
 stdenv.mkDerivation rec {
-  version = "0.7.4";
+  version = "0.7.5";
   pname = "usbguard";
 
   repo = "https://github.com/USBGuard/usbguard";
 
   src = fetchurl {
     url = "${repo}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "1qkskd6q5cwlh2cpcsbzmmmgk6w63z0825wlb2sjwqq3kfgwjb3k";
+    sha256 = "0jj56sls13ryfgz6vajq8p4dm3grgb6rf2cmga6sckmzd4chk65b";
   };
 
   nativeBuildInputs = [
+    asciidoc
     pkgconfig
     libxslt # xsltproc
     libxml2 # xmllint
+    docbook_xml_dtd_45
+    docbook_xsl
   ];
 
   buildInputs = [
···
     audit
   ]
   ++ (lib.optional (libgcrypt != null) libgcrypt)
-  ++ (lib.optional (libsodium != null) libsodium)
-  ++ (lib.optionals withGui [ qtbase qtsvg qttools ]);
+  ++ (lib.optional (libsodium != null) libsodium);
 
   configureFlags = [
     "--with-bundled-catch"
···
     "--with-polkit"
   ]
   ++ (lib.optional (libgcrypt != null) "--with-crypto-library=gcrypt")
-  ++ (lib.optional (libsodium != null) "--with-crypto-library=sodium")
-  ++ (lib.optional withGui "--with-gui-qt=qt5");
+  ++ (lib.optional (libsodium != null) "--with-crypto-library=sodium");
 
   enableParallelBuilding = true;
 

pkgs/os-specific/linux/v4l-utils/default.nix

···
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.16.6";
+  version = "1.16.7";
 
   src = fetchurl {
-    url = "https://linuxtv.org/downloads/v4l-utils/${pname}-${version}.tar.bz2";
-    sha256 = "1bkqlrizx0j2rd6ybam2x17bjrpwzl4v4szmnzm3cmixis3w3npr";
+    url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
+    sha256 = "1ng0x3wj3a1ckfd00yxa4za43xms92gdp7rdag060b7p39z7m4gf";
   };
 
   outputs = [ "out" "dev" ];

pkgs/servers/mautrix-whatsapp/default.nix

···
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage {
+buildGoModule {
   pname = "mautrix-unstable";
-  version = "2019-07-04";
-
-  goPackagePath = "maunium.net/go/mautrix-whatsapp";
+  version = "2019-09-03";
 
   src = fetchFromGitHub {
     owner = "tulir";
     repo = "mautrix-whatsapp";
-    rev = "29f5ae45c4b22f463003b23e355b951831f08b3e";
-    sha256 = "12209m3x01i7bnnkg57ag1ivsk6n6pqaqfin7y02irgi3i3rm31r";
+    rev = "22fb5c125db1a0a3a8be8e8e09e92bb38718e6bf";
+    sha256 = "03wd6mn9jr1hr3qxg1r707ibi1s9511y97bfrmzka4mrsymgamxa";
   };
 
-  goDeps = ./deps.nix;
+  modSha256 = "14bqxx2hcr8yhcd5hi087pyc1hzqmr13p2fqb3nnsx12j7n07gww";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/tulir/mautrix-whatsapp;
     description = "Matrix <-> Whatsapp hybrid puppeting/relaybot bridge";
     license = licenses.agpl3;
-    maintainers = with maintainers; [ vskilet ];
+    maintainers = with maintainers; [ vskilet ma27 ];
   };
 }

pkgs/servers/mautrix-whatsapp/deps.nix

···
-# NOTE: this file isn't entirely generated, while performing the bump
-# from 2019-02-24 to 2019-06-01, a lot of stuff broke during `vgo2nix` as the
-# tool is unable to parse `replace` statements atm.
-#
-# The following sources were altered manually:
-# * github.com/Rhymen/go-whatsapp -> github.com/tulir/go-whatsapp (at 36ed380bdc18)
-# * github.com/golang/protobuf: v1.2.0 -> v1.3.1
-# * maunium.net/go/mautrix: v0.1.0-alpha3 -> ca5d9535b6cc
-# * maunium.net/go/mautrix-appservice: v0.1.0-alpha3 -> 6e6c9bb47548
-
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/Rhymen/go-whatsapp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tulir/go-whatsapp";
-      rev = "36ed380bdc188e35fe804d6dd4809ee170136670";
-      sha256 = "1ida4j5hgqc5djwfsaqp8g6iynn150rwj42kqk9q2srwz5075n4p";
-    };
-  }
-  {
-    goPackagePath = "github.com/fatih/color";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/color";
-      rev = "v1.7.0";
-      sha256 = "0v8msvg38r8d1iiq2i5r4xyfx0invhc941kjrsg5gzwvagv55inv";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.3.1";
-      sha256 = "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/mux";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/mux";
-      rev = "v1.6.2";
-      sha256 = "0pvzm23hklxysspnz52mih6h1q74vfrdhjfm1l3sa9r8hhqmmld2";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/websocket";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/websocket";
-      rev = "v1.4.0";
-      sha256 = "00i4vb31nsfkzzk7swvx3i75r2d960js3dri1875vypk3v2s0pzk";
-    };
-  }
-  {
-    goPackagePath = "github.com/lib/pq";
-    fetch = {
-      type = "git";
-      url = "https://github.com/lib/pq";
-      rev = "v1.1.1";
-      sha256 = "0g64wlg1l1ybq4x44idksl4pgm055s58jxc6r6x4qhqm5q76h0km";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev = "v0.0.9";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.4";
-      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-sqlite3";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-sqlite3";
-      rev = "v1.10.0";
-      sha256 = "1zmz6asplixfihxhj11spgfs0v3xzb3nv0hlq6n6zsg781ni31xx";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.8.1";
-      sha256 = "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/russross/blackfriday.v2";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v2.0.1";
-      sha256 = "0nlz7isdd4rgnwzs68499hlwicxz34j2k2a0b8jy0y7ycd2bcr5j";
-    };
-  }
-  {
-    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev = "v1.0.0";
-      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
-    };
-  }
-  {
-    goPackagePath = "github.com/skip2/go-qrcode";
-    fetch = {
-      type = "git";
-      url = "https://github.com/skip2/go-qrcode";
-      rev = "dc11ecdae0a9";
-      sha256 = "0mc70hsn5x2a66a9sbwlq51cng2s1aq7rw4pr9pif4xdzflkl057";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "b8fe1690c613";
-      sha256 = "1mbfpbrirsz8fsdkibm9l4sccpm774p9201mpmfh4hxshz3girq3";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "915654e7eabc";
-      sha256 = "0fzd7n2yc4qnnf2wk21zxy6gb01xviq2z1dzrbqcn8p1s4fjsqw5";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "37e7f081c4d4";
-      sha256 = "1bb0mw6ckb1k7z8v3iil2qlqwfj408fvvp8m1cik2b46p7snyjhm";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "788fd7840127";
-      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.2";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
-    };
-  }
-  {
-    goPackagePath = "maunium.net/go/mauflag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tulir/mauflag.git";
-      rev = "v1.0.0";
-      sha256 = "09jv1819jwq5i29y6ngf4j4ii6qwlshydvprfvsfplc419dkz1vx";
-    };
-  }
-  {
-    goPackagePath = "maunium.net/go/maulogger";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tulir/maulogger.git";
-      rev = "v2.0.0";
-      sha256 = "0qz4cpaqvcmrj3fb2bb6yrhw3k5h51crskricyqgg1b7aklphan5";
-    };
-  }
-  {
-    goPackagePath = "maunium.net/go/mautrix";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tulir/mautrix-go.git";
-      rev = "ca5d9535b6ccee8fdf473f9cc935932ef3e53ae7";
-      sha256 = "1qrh77c8vh2k6ffwf0cymjmhcp7d0rdad1ixqx5r1xig27f7v0qg";
-    };
-  }
-  {
-    goPackagePath = "maunium.net/go/mautrix-appservice";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tulir/mautrix-appservice-go.git";
-      rev = "6e6c9bb4754849443cb3c64d9510f8d2eb3e668d";
-      sha256 = "1zwsfvgxs2zbc6yvgnk16w2wkh891kihrzar3qzz9cvsgjznlyvy";
-    };
-  }
-]

pkgs/servers/monitoring/prometheus/process-exporter.nix

···
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "process-exporter";
+  version = "0.5.0";
+
+  goPackagePath = "github.com/ncabatoff/process-exporter";
+
+  goDeps = ./process-exporter_deps.nix;
+
+  src = fetchFromGitHub {
+    owner = "ncabatoff";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "129vqry3l8waxcyvx83wg0dvh3qg4pr3rl5fw7vmhgdzygbaq3bq";
+  };
+
+  postPatch = ''
+    substituteInPlace proc/read_test.go --replace /bin/cat cat
+  '';
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Prometheus exporter that mines /proc to report on selected processes";
+    homepage = "https://github.com/ncabatoff/process-exporter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ maintainers."1000101" ];
+    platforms = platforms.linux;
+  };
+}

pkgs/servers/monitoring/prometheus/process-exporter_deps.nix

···
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
+[
+  {
+    goPackagePath = "github.com/beorn7/perks";
+    fetch = {
+      type = "git";
+      url = "https://github.com/beorn7/perks";
+      rev = "3a771d992973";
+      sha256 = "1l2lns4f5jabp61201sh88zf3b0q793w4zdgp9nll7mmfcxxjif3";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev = "v1.1.0";
+      sha256 = "0ya4ha7m20bw048m1159ppqzlvda4x0vdprlbk5sdgmy74h3xcdq";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/go-cmp";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/go-cmp";
+      rev = "v0.2.0";
+      sha256 = "1fbv0x27k9sn8svafc0hjwsnckk864lv4yi7bvzrxvmd3d5hskds";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pretty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pretty";
+      rev = "v0.1.0";
+      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pty";
+      rev = "v1.1.1";
+      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/text";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/text";
+      rev = "v0.1.0";
+      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
+    };
+  }
+  {
+    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/matttproud/golang_protobuf_extensions";
+      rev = "v1.0.1";
+      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
+    };
+  }
+  {
+    goPackagePath = "github.com/ncabatoff/fakescraper";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ncabatoff/fakescraper";
+      rev = "15938421d91a";
+      sha256 = "1in2iakq6xly9r8gk0mfim8n0glbjzpa07hkaj1rlrm0i11jlc6f";
+    };
+  }
+  {
+    goPackagePath = "github.com/ncabatoff/go-seq";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ncabatoff/go-seq";
+      rev = "b08ef85ed833";
+      sha256 = "1x88x285n4wf221pp7ccmh2ai7rgcnwz764gn8k861qg30jl1ky6";
+    };
+  }
+  {
+    goPackagePath = "github.com/ncabatoff/procfs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ncabatoff/procfs";
+      rev = "9ced60d7b905";
+      sha256 = "19756h4lw5v8f0xr70cl8gd0wfqcnszrhhgawqhyinnir82rz728";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_golang";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_golang";
+      rev = "v0.8.0";
+      sha256 = "1xqny3147g12n4j03kxm8s9mvdbs3ln6i56c655mybrn9jjy48kd";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_model";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_model";
+      rev = "5c3871d89910";
+      sha256 = "04psf81l9fjcwascsys428v03fx4fi894h7fhrj2vvcz723q57k0";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/common";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/common";
+      rev = "c7de2306084e";
+      sha256 = "11dqfm2d0m4sjjgyrnayman96g59x2apmvvqby9qmww2qj2k83ig";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/procfs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/procfs";
+      rev = "ea9eea638872";
+      sha256 = "1j99qszynx2asac82bhzhk0g1nav87nfgkb1cz5a2iywj81liirj";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev = "37e7f081c4d4";
+      sha256 = "1bb0mw6ckb1k7z8v3iil2qlqwfj408fvvp8m1cik2b46p7snyjhm";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/check.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/check.v1";
+      rev = "788fd7840127";
+      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "v2.2.1";
+      sha256 = "0dwjrs2lp2gdlscs7bsrmyc5yf6mm4fvgw71bzr9mv2qrd2q73s1";
+    };
+  }
+]

pkgs/tools/X11/caffeine-ng/default.nix

···
 { gdk-pixbuf, glib, gobject-introspection, gtk3, lib, libnotify,
-  pythonPackages, wrapGAppsHook
+  python3Packages, wrapGAppsHook
 }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "caffeine-ng";
   version = "3.4.2";
 
-  src = pythonPackages.fetchPypi{
+  src = python3Packages.fetchPypi{
     inherit pname version;
     sha256="05k8smjlfjcccgmp8qi04l7106k46fs4p8fl5bdqqjwv6pwl7y4w";
   };
 
   nativeBuildInputs = [ wrapGAppsHook glib ];
-  buildInputs = [ gdk-pixbuf gobject-introspection libnotify gtk3 ];
-  pythonPath = with pythonPackages; [
-    dbus-python docopt ewmh pygobject3 pyxdg
-    setproctitle setuptools setuptools_scm wheel
+  buildInputs = [ 
+    gdk-pixbuf gobject-introspection libnotify gtk3 
+    python3Packages.setuptools_scm
   ];
+  pythonPath = with python3Packages; [
+    dbus-python docopt ewmh pygobject3 pyxdg
+    setproctitle 
+  ];
+
+  doCheck = false; # There are no tests.
 
   postBuild = ''
     mkdir -p $out/share

pkgs/tools/X11/wpgtk/default.nix

···
     longDescription = ''
      In short, wpgtk is a colorscheme/wallpaper manager with a template system attached which lets you create templates from any textfile and will replace keywords on it on the fly, allowing for great styling and theming possibilities.
 
-     wpgtk uses pywal as its colorscheme generator, but builds upon it with a UI and other features, such as the abilty to mix and edit the colorschemes generated and save them with their respective wallpapers, having light and dark themes, hackable and fast GTK+ theme made specifically for wpgtk and custom keywords and values to replace in templates.
+     wpgtk uses pywal as its colorscheme generator, but builds upon it with a UI and other features, such as the abilty to mix and edit the colorschemes generated and save them with their respective wallpapers, having light and dark themes, hackable and fast GTK theme made specifically for wpgtk and custom keywords and values to replace in templates.
 
      INFO: To work properly, this tool needs "programs.dconf.enable = true" on nixos or dconf installed. A reboot may be required after installing dconf.
      '';

pkgs/tools/admin/aws-rotate-key/default.nix

···
 
 buildGoPackage rec {
   pname = "aws-rotate-key";
-  version = "1.0.4";
+  version = "1.0.6";
 
   goPackagePath = "github.com/Fullscreen/aws-rotate-key";
 
···
     rev = "v${version}";
     owner = "Fullscreen";
     repo = "aws-rotate-key";
-    sha256 = "14bcs434646qdywws55r1a1v8ncwz8n0yljaa8zb5796pv4445wf";
+    sha256 = "sha256:1w9704g1l2b0y6g6mk79g28kk0yaswpgljkk85d0i10wyxq4icby";
   };
 
   goDeps = ./deps.nix;

pkgs/tools/admin/eksctl/default.nix

···
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.4.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    sha256 = "1h7fyxlwa9f9r08rpl05r62ap7h7viaqchldbnv7j3vs2j23k127";
+    sha256 = "1aifdrxasg7d6gpy7s6kdjz9ky2kddpigh8z0f3zckw7hd68jk0g";
   };
 
-  modSha256 = "17bb1k18x1xfq9bi9qbm8pln6h6pkhaqzy07qdvnhinmspll1695";
+  modSha256 = "18vsi1hrv3z36w7vwl2bg8b2p5dwzw7dsw434adw9l1k7yv5x4vv";
 
   subPackages = [ "cmd/eksctl" ];
 

pkgs/tools/archivers/xarchive/default.nix

···
   hardeningDisable = [ "format" ];
 
   meta = {
-    description = "A GTK+ front-end for command line archiving tools";
+    description = "A GTK front-end for command line archiving tools";
     maintainers = [ stdenv.lib.maintainers.domenkozar ];
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.all;

pkgs/tools/archivers/xarchiver/default.nix

···
   buildInputs = [ gtk3 intltool libxslt hicolor-icon-theme ];
 
   meta = {
-    description = "GTK+ frontend to 7z,zip,rar,tar,bzip2, gzip,arj, lha, rpm and deb (open and extract only)";
+    description = "GTK frontend to 7z,zip,rar,tar,bzip2, gzip,arj, lha, rpm and deb (open and extract only)";
     homepage = https://github.com/ib/xarchiver;
     maintainers = [ stdenv.lib.maintainers.domenkozar ];
     license = stdenv.lib.licenses.gpl2;

pkgs/tools/audio/aucdtect/default.nix

···
 with lib;
 
 stdenv.mkDerivation rec {
-  pname = "aucdtext";
+  pname = "aucdtect";
   version = "0.8-2";
 
   src = fetchurl {
-    url = "http://www.true-audio.com/ftp/aucdtect-${version}.i586.rpm";
+    url = "http://www.true-audio.com/ftp/${pname}-${version}.i586.rpm";
     sha256 = "1lp5f0rq5b5n5il0c64m00gcfskarvgqslpryms9443d200y6mmd";
   };
 
   unpackCmd = "${rpmextract}/bin/rpmextract $src";
 
   installPhase = ''
-    mkdir -p $out/bin
-    install -m755 local/bin/auCDtect $out/bin/aucdtect
+    runHook preInstall
+
+    install -Dm755 local/bin/auCDtect $out/bin/aucdtect
+
+    runHook postInstall
   '';
 
   dontStrip = true;
 
   meta = with stdenv.lib; {
     description = "Verify authenticity of lossless audio files";
-    homepage = http://tausoft.org;
+    homepage = "http://tausoft.org";
     license = licenses.unfreeRedistributable;
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;

pkgs/tools/bluetooth/blueman/default.nix

···
 
   meta = with lib; {
     homepage = https://github.com/blueman-project/blueman;
-    description = "GTK+-based Bluetooth Manager";
+    description = "GTK-based Bluetooth Manager";
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ abbradar ];

pkgs/tools/filesystems/ceph/0000-dont-check-cherrypy-version.patch

···
+diff --git a/src/pybind/mgr/dashboard/module.py b/src/pybind/mgr/dashboard/module.py
+index a8a3ec07c1..bcc9b86c37 100644
+--- a/src/pybind/mgr/dashboard/module.py
++++ b/src/pybind/mgr/dashboard/module.py
+@@ -25,40 +25,6 @@ except ImportError:
+ 
+ from .services.sso import load_sso_db
+ 
+-# The SSL code in CherryPy 3.5.0 is buggy.  It was fixed long ago,
+-# but 3.5.0 is still shipping in major linux distributions
+-# (Fedora 27, Ubuntu Xenial), so we must monkey patch it to get SSL working.
+-if cherrypy is not None:
+-    v = StrictVersion(cherrypy.__version__)
+-    # It was fixed in 3.7.0.  Exact lower bound version is probably earlier,
+-    # but 3.5.0 is what this monkey patch is tested on.
+-    if StrictVersion("3.5.0") <= v < StrictVersion("3.7.0"):
+-        from cherrypy.wsgiserver.wsgiserver2 import HTTPConnection,\
+-                                                    CP_fileobject
+-
+-        def fixed_init(hc_self, server, sock, makefile=CP_fileobject):
+-            hc_self.server = server
+-            hc_self.socket = sock
+-            hc_self.rfile = makefile(sock, "rb", hc_self.rbufsize)
+-            hc_self.wfile = makefile(sock, "wb", hc_self.wbufsize)
+-            hc_self.requests_seen = 0
+-
+-        HTTPConnection.__init__ = fixed_init
+-
+-# When the CherryPy server in 3.2.2 (and later) starts it attempts to verify
+-# that the ports its listening on are in fact bound. When using the any address
+-# "::" it tries both ipv4 and ipv6, and in some environments (e.g. kubernetes)
+-# ipv6 isn't yet configured / supported and CherryPy throws an uncaught
+-# exception.
+-if cherrypy is not None:
+-    v = StrictVersion(cherrypy.__version__)
+-    # the issue was fixed in 3.2.3. it's present in 3.2.2 (current version on
+-    # centos:7) and back to at least 3.0.0.
+-    if StrictVersion("3.1.2") <= v < StrictVersion("3.2.3"):
+-        # https://github.com/cherrypy/cherrypy/issues/1100
+-        from cherrypy.process import servers
+-        servers.wait_for_occupied_port = lambda host, port: None
+-
+ if 'COVERAGE_ENABLED' in os.environ:
+     import coverage
+     __cov = coverage.Coverage(config_file="{}/.coveragerc".format(os.path.dirname(__file__)),
+diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
+index b7fecf8d85..dfd4160591 100644
+--- a/src/pybind/mgr/prometheus/module.py
++++ b/src/pybind/mgr/prometheus/module.py
+@@ -18,20 +18,6 @@ from rbd import RBD
+ DEFAULT_ADDR = '::'
+ DEFAULT_PORT = 9283
+ 
+-# When the CherryPy server in 3.2.2 (and later) starts it attempts to verify
+-# that the ports its listening on are in fact bound. When using the any address
+-# "::" it tries both ipv4 and ipv6, and in some environments (e.g. kubernetes)
+-# ipv6 isn't yet configured / supported and CherryPy throws an uncaught
+-# exception.
+-if cherrypy is not None:
+-    v = StrictVersion(cherrypy.__version__)
+-    # the issue was fixed in 3.2.3. it's present in 3.2.2 (current version on
+-    # centos:7) and back to at least 3.0.0.
+-    if StrictVersion("3.1.2") <= v < StrictVersion("3.2.3"):
+-        # https://github.com/cherrypy/cherrypy/issues/1100
+-        from cherrypy.process import servers
+-        servers.wait_for_occupied_port = lambda host, port: None
+-
+ # cherrypy likes to sys.exit on error.  don't let it take us down too!
+ def os_exit_noop(*args, **kwargs):
+     pass

pkgs/tools/filesystems/ceph/0000-fix-SPDK-build-env.patch

···
+--- a/cmake/modules/BuildSPDK.cmake	2018-08-09 09:22:34.950684960 +0200
++++ b/cmake/modules/BuildSPDK.cmake	2018-08-09 09:21:59.986964224 +0200
+@@ -16,7 +16,7 @@
+     # unset $CFLAGS, otherwise it will interfere with how SPDK sets
+     # its include directory.
+     # unset $LDFLAGS, otherwise SPDK will fail to mock some functions.
+-    BUILD_COMMAND env -i PATH=$ENV{PATH} CC=${CMAKE_C_COMPILER} $(MAKE) EXTRA_CFLAGS="-fPIC"
++    BUILD_COMMAND env PATH=$ENV{PATH} CC=${CMAKE_C_COMPILER} $(MAKE) EXTRA_CFLAGS="-fPIC" C_OPT="-mssse3"
+     BUILD_IN_SOURCE 1
+     INSTALL_COMMAND "true")
+   ExternalProject_Get_Property(spdk-ext source_dir)

pkgs/tools/filesystems/ceph/0001-kv-RocksDBStore-API-break-additional.patch

···
-Seulement dans ceph: ceph.old
-diff -ur ceph.old/src/kv/RocksDBStore.cc ceph/src/kv/RocksDBStore.cc
---- ceph.old/src/kv/RocksDBStore.cc	1980-01-02 00:00:00.000000000 +0100
-+++ ceph/src/kv/RocksDBStore.cc	2018-01-24 14:08:35.017553372 +0100
-@@ -505,7 +505,7 @@
-   // considering performance overhead, default is disabled
-   if (g_conf->rocksdb_perf) {
-     rocksdb::SetPerfLevel(rocksdb::PerfLevel::kEnableTimeExceptForMutex);
--    rocksdb::perf_context.Reset();
-+    rocksdb::get_perf_context()->Reset();
-   }
- 
-   RocksDBTransactionImpl * _t =
-@@ -532,13 +532,13 @@
-     utime_t write_wal_time;
-     utime_t write_pre_and_post_process_time;
-     write_wal_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_wal_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_wal_time)/1000000000);
-     write_memtable_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_memtable_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_memtable_time)/1000000000);
-     write_delay_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_delay_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_delay_time)/1000000000);
-     write_pre_and_post_process_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_pre_and_post_process_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_pre_and_post_process_time)/1000000000);
-     logger->tinc(l_rocksdb_write_memtable_time, write_memtable_time);
-     logger->tinc(l_rocksdb_write_delay_time, write_delay_time);
-     logger->tinc(l_rocksdb_write_wal_time, write_wal_time);
-@@ -558,7 +558,7 @@
-   // considering performance overhead, default is disabled
-   if (g_conf->rocksdb_perf) {
-     rocksdb::SetPerfLevel(rocksdb::PerfLevel::kEnableTimeExceptForMutex);
--    rocksdb::perf_context.Reset();
-+    rocksdb::get_perf_context()->Reset();
-   }
- 
-   RocksDBTransactionImpl * _t =
-@@ -586,13 +586,13 @@
-     utime_t write_wal_time;
-     utime_t write_pre_and_post_process_time;
-     write_wal_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_wal_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_wal_time)/1000000000);
-     write_memtable_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_memtable_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_memtable_time)/1000000000);
-     write_delay_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_delay_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_delay_time)/1000000000);
-     write_pre_and_post_process_time.set_from_double(
--	static_cast<double>(rocksdb::perf_context.write_pre_and_post_process_time)/1000000000);
-+	static_cast<double>(rocksdb::get_perf_context()->write_pre_and_post_process_time)/1000000000);
-     logger->tinc(l_rocksdb_write_memtable_time, write_memtable_time);
-     logger->tinc(l_rocksdb_write_delay_time, write_delay_time);
-     logger->tinc(l_rocksdb_write_wal_time, write_wal_time);

pkgs/tools/filesystems/ceph/0002-fix-absolute-include-path.patch

···
-diff -ru ceph/src/key_value_store/kv_flat_btree_async.cc ceph-copy/src/key_value_store/kv_flat_btree_async.cc
---- ceph/src/key_value_store/kv_flat_btree_async.cc	1980-01-02 00:00:00.000000000 +0100
-+++ ceph-copy/src/key_value_store/kv_flat_btree_async.cc	2018-02-13 21:49:59.232860487 +0100
-@@ -15,13 +15,13 @@
- #include "key_value_store/kv_flat_btree_async.h"
- #include "key_value_store/kvs_arg_types.h"
- #include "include/rados/librados.hpp"
--#include "/usr/include/asm-generic/errno.h"
--#include "/usr/include/asm-generic/errno-base.h"
- #include "common/ceph_context.h"
- #include "common/Clock.h"
- #include "include/types.h"
- 
- 
-+#include <asm-generic/errno.h>
-+#include <asm-generic/errno-base.h>
- #include <string>
- #include <iostream>
- #include <cassert>

pkgs/tools/filesystems/ceph/default.nix

···
-{ callPackage, fetchgit, fetchpatch, ... } @ args:
+{ stdenv, runCommand, fetchurl
+, ensureNewerSourcesHook
+, cmake, pkgconfig
+, which, git
+, boost, python3Packages
+, libxml2, zlib, lz4
+, openldap, lttng-ust
+, babeltrace, gperf
+, cunit, snappy
+, rocksdb, makeWrapper
+, leveldb, oathToolkit, removeReferencesTo
 
-callPackage ./generic.nix (args // rec {
-  version = "12.2.7";
+# Optional Dependencies
+, yasm ? null, fcgi ? null, expat ? null
+, curl ? null, fuse ? null
+, libedit ? null, libatomic_ops ? null
+, libs3 ? null
 
-  src = fetchgit {
-    url = "https://github.com/ceph/ceph.git";
-    rev = "refs/tags/v${version}";
-    sha256 = "031nfw2g2fdpxxx39g862phgmdx68hj9r54axazandghfhc1bzrl";
+# Mallocs
+, jemalloc ? null, gperftools ? null
+
+# Crypto Dependencies
+, cryptopp ? null
+, nss ? null, nspr ? null
+
+# Linux Only Dependencies
+, linuxHeaders, utillinux, libuuid, udev, keyutils, rdma-core, rabbitmq-c
+, libaio ? null, libxfs ? null, zfs ? null
+, ...
+}:
+
+# We must have one crypto library
+assert cryptopp != null || (nss != null && nspr != null);
+
+with stdenv; with stdenv.lib;
+let
+  shouldUsePkg = pkg: if pkg != null && pkg.meta.available then pkg else null;
+
+  optYasm = shouldUsePkg yasm;
+  optFcgi = shouldUsePkg fcgi;
+  optExpat = shouldUsePkg expat;
+  optCurl = shouldUsePkg curl;
+  optFuse = shouldUsePkg fuse;
+  optLibedit = shouldUsePkg libedit;
+  optLibatomic_ops = shouldUsePkg libatomic_ops;
+  optLibs3 = shouldUsePkg libs3;
+
+  optJemalloc = shouldUsePkg jemalloc;
+  optGperftools = shouldUsePkg gperftools;
+
+  optCryptopp = shouldUsePkg cryptopp;
+  optNss = shouldUsePkg nss;
+  optNspr = shouldUsePkg nspr;
+
+  optLibaio = shouldUsePkg libaio;
+  optLibxfs = shouldUsePkg libxfs;
+  optZfs = shouldUsePkg zfs;
+
+  hasRadosgw = optFcgi != null && optExpat != null && optCurl != null && optLibedit != null;
+
+
+  # Malloc implementation (can be jemalloc, tcmalloc or null)
+  malloc = if optJemalloc != null then optJemalloc else optGperftools;
+
+  # We prefer nss over cryptopp
+  cryptoStr = if optNss != null && optNspr != null then "nss" else
+    if optCryptopp != null then "cryptopp" else "none";
+
+  cryptoLibsMap = {
+    nss = [ optNss optNspr ];
+    cryptopp = [ optCryptopp ];
+    none = [ ];
   };
 
-})
+  ceph-python-env = python3Packages.python.withPackages (ps: [
+    ps.sphinx
+    ps.flask
+    ps.cython
+    ps.setuptools
+    ps.virtualenv
+    # Libraries needed by the python tools
+    ps.Mako
+    ps.cherrypy
+    ps.pecan
+    ps.prettytable
+    ps.pyjwt
+    ps.webob
+    ps.bcrypt
+    ps.six
+  ]);
+
+  version = "14.2.1";
+in rec {
+  ceph = stdenv.mkDerivation {
+    name="ceph-${version}";
+
+    src = fetchurl {
+      url = "http://download.ceph.com/tarballs/ceph-${version}.tar.gz";
+      sha256 = "0qa9p8xp26d45h3jfj1rbwhmqv44f9n1mvccmpzaf2i05v42kmzb";
+    };
+
+    patches = [
+      ./0000-fix-SPDK-build-env.patch
+      ./0000-dont-check-cherrypy-version.patch
+    ];
+
+    nativeBuildInputs = [
+      cmake
+      pkgconfig which git python3Packages.wrapPython makeWrapper
+      (ensureNewerSourcesHook { year = "1980"; })
+    ];
+
+    buildInputs = cryptoLibsMap.${cryptoStr} ++ [
+      boost ceph-python-env libxml2 optYasm optLibatomic_ops optLibs3
+      malloc zlib openldap lttng-ust babeltrace gperf cunit
+      snappy rocksdb lz4 oathToolkit leveldb
+      removeReferencesTo
+    ] ++ optionals stdenv.isLinux [
+      linuxHeaders utillinux libuuid udev keyutils optLibaio optLibxfs optZfs
+      # ceph 14
+      rdma-core rabbitmq-c
+    ] ++ optionals hasRadosgw [
+      optFcgi optExpat optCurl optFuse optLibedit
+    ];
+
+    preConfigure =''
+      substituteInPlace src/common/module.c --replace "/sbin/modinfo"  "modinfo"
+      substituteInPlace src/common/module.c --replace "/sbin/modprobe" "modprobe"
+      # Since Boost 1.67 this seems to have changed
+      substituteInPlace CMakeLists.txt --replace "list(APPEND BOOST_COMPONENTS python)" "list(APPEND BOOST_COMPONENTS python37)"
+      substituteInPlace src/CMakeLists.txt --replace "Boost::python " "Boost::python37 "
+
+      # for pybind/rgw to find internal dep
+      export LD_LIBRARY_PATH="$PWD/build/lib:$LD_LIBRARY_PATH"
+      # install target needs to be in PYTHONPATH for "*.pth support" check to succeed
+      export PYTHONPATH=${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/python3.7/site-packages/:$out/lib/python3.7/site-packages/
+
+      patchShebangs src/spdk
+    '';
+
+    cmakeFlags = [
+      "-DWITH_PYTHON3=ON"
+      "-DWITH_SYSTEM_ROCKSDB=OFF"
+
+      "-DWITH_SYSTEM_BOOST=ON"
+      "-DWITH_SYSTEMD=OFF"
+      "-DWITH_TESTS=OFF"
+      # TODO breaks with sandbox, tries to download stuff with npm
+      "-DWITH_MGR_DASHBOARD_FRONTEND=OFF"
+    ];
+
+    preFixup = ''
+      find $lib -type f -exec remove-references-to -t $out '{}' +
+      mv $out/share/ceph/mgr $lib/lib/ceph/
+    '';
+
+    postFixup = ''
+      export PYTHONPATH="${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/ceph/mgr:$out/lib/python3.7/site-packages/"
+      wrapPythonPrograms
+      wrapProgram $out/bin/ceph-mgr --prefix PYTHONPATH ":" "${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/ceph/mgr:$out/lib/python3.7/site-packages/"
+      wrapProgram $out/bin/ceph-volume --prefix PYTHONPATH ":" "${ceph-python-env}/lib/python3.7/site-packages:$lib/lib/ceph/mgr:$out/lib/python3.7/site-packages/"
+    '';
+
+    enableParallelBuilding = true;
+
+    outputs = [ "out" "lib" "dev" "doc" "man" ];
+
+    meta = {
+      homepage = https://ceph.com/;
+      description = "Distributed storage system";
+      license = with licenses; [ lgpl21 gpl2 bsd3 mit publicDomain ];
+      maintainers = with maintainers; [ adev ak krav johanot ];
+      platforms = platforms.unix;
+    };
+
+    passthru.version = version;
+  };
+
+  ceph-client = runCommand "ceph-client-${version}" {
+     meta = {
+        homepage = https://ceph.com/;
+        description = "Tools needed to mount Ceph's RADOS Block Devices";
+        license = with licenses; [ lgpl21 gpl2 bsd3 mit publicDomain ];
+        maintainers = with maintainers; [ adev ak krav ];
+        platforms = platforms.unix;
+      };
+    } ''
+      mkdir -p $out/{bin,etc,lib/python3.7/site-packages}
+      cp -r ${ceph}/bin/{ceph,.ceph-wrapped,rados,rbd,rbdmap} $out/bin
+      cp -r ${ceph}/bin/ceph-{authtool,conf,dencoder,rbdnamer,syn} $out/bin
+      cp -r ${ceph}/bin/rbd-replay* $out/bin
+      cp -r ${ceph}/lib/python3.7/site-packages $out/lib/python3.7/
+      cp -r ${ceph}/etc/bash_completion.d $out/etc
+      # wrapPythonPrograms modifies .ceph-wrapped, so lets just update its paths
+      substituteInPlace $out/bin/ceph          --replace ${ceph} $out
+      substituteInPlace $out/bin/.ceph-wrapped --replace ${ceph} $out
+   '';
+}

pkgs/tools/filesystems/ceph/generic.nix

···
-{ stdenv, ensureNewerSourcesHook, cmake, pkgconfig
-, which, git
-, boost, python2Packages
-, libxml2, zlib
-, openldap, lttng-ust
-, babeltrace, gperf
-, cunit, snappy
-, rocksdb, makeWrapper
-
-# Optional Dependencies
-, yasm ? null, fcgi ? null, expat ? null
-, curl ? null, fuse ? null
-, libedit ? null, libatomic_ops ? null, kinetic-cpp-client ? null
-, libs3 ? null
-
-# Mallocs
-, jemalloc ? null, gperftools ? null
-
-# Crypto Dependencies
-, cryptopp ? null
-, nss ? null, nspr ? null
-
-# Linux Only Dependencies
-, linuxHeaders, libuuid, udev, keyutils, libaio ? null, libxfs ? null
-, zfs ? null
-
-# Version specific arguments
-, version, src ? [], buildInputs ? []
-, ...
-}:
-
-# We must have one crypto library
-assert cryptopp != null || (nss != null && nspr != null);
-
-with stdenv;
-with stdenv.lib;
-let
-
-  shouldUsePkg = pkg_: let pkg = (builtins.tryEval pkg_).value;
-    in if lib.any (lib.meta.platformMatch stdenv.hostPlatform) pkg.meta.platforms
-      then pkg else null;
-
-  optYasm = shouldUsePkg yasm;
-  optFcgi = shouldUsePkg fcgi;
-  optExpat = shouldUsePkg expat;
-  optCurl = shouldUsePkg curl;
-  optFuse = shouldUsePkg fuse;
-  optLibedit = shouldUsePkg libedit;
-  optLibatomic_ops = shouldUsePkg libatomic_ops;
-  optKinetic-cpp-client = shouldUsePkg kinetic-cpp-client;
-  optLibs3 = if versionAtLeast version "10.0.0" then null else shouldUsePkg libs3;
-
-  optJemalloc = shouldUsePkg jemalloc;
-  optGperftools = shouldUsePkg gperftools;
-
-  optCryptopp = shouldUsePkg cryptopp;
-  optNss = shouldUsePkg nss;
-  optNspr = shouldUsePkg nspr;
-
-  optLibaio = shouldUsePkg libaio;
-  optLibxfs = shouldUsePkg libxfs;
-  optZfs = shouldUsePkg zfs;
-
-  hasRadosgw = optFcgi != null && optExpat != null && optCurl != null && optLibedit != null;
-
-
-  # TODO: Reenable when kinetic support is fixed
-  #hasKinetic = versionAtLeast version "9.0.0" && optKinetic-cpp-client != null;
-  hasKinetic = false;
-
-  # Malloc implementation (can be jemalloc, tcmalloc or null)
-  malloc = if optJemalloc != null then optJemalloc else optGperftools;
-
-  # We prefer nss over cryptopp
-  cryptoStr = if optNss != null && optNspr != null then "nss" else
-    if optCryptopp != null then "cryptopp" else "none";
-  cryptoLibsMap = {
-    nss = [ optNss optNspr ];
-    cryptopp = [ optCryptopp ];
-    none = [ ];
-  };
-
-  ceph-python-env = python2Packages.python.withPackages (ps: [
-    ps.sphinx
-    ps.flask
-    ps.cython
-    ps.setuptools
-    ps.pip
-    # Libraries needed by the python tools
-    ps.Mako
-    ps.pecan
-    ps.prettytable
-    ps.webob
-    ps.cherrypy
-  ]);
-
-in
-stdenv.mkDerivation {
-  pname = "ceph";
-  inherit version;
-
-  inherit src;
-
-  patches = [
- #   ./ceph-patch-cmake-path.patch
-    ./0001-kv-RocksDBStore-API-break-additional.patch
-  ] ++ optionals stdenv.isLinux [
-    ./0002-fix-absolute-include-path.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkgconfig which git python2Packages.wrapPython makeWrapper
-    (ensureNewerSourcesHook { year = "1980"; })
-  ];
-
-  buildInputs = buildInputs ++ cryptoLibsMap.${cryptoStr} ++ [
-    boost ceph-python-env libxml2 optYasm optLibatomic_ops optLibs3
-    malloc zlib openldap lttng-ust babeltrace gperf cunit
-    snappy rocksdb
-  ] ++ optionals stdenv.isLinux [
-    linuxHeaders libuuid udev keyutils optLibaio optLibxfs optZfs
-  ] ++ optionals hasRadosgw [
-    optFcgi optExpat optCurl optFuse optLibedit
-  ] ++ optionals hasKinetic [
-    optKinetic-cpp-client
-  ];
-
-
-  preConfigure =''
-    # rip off submodule that interfer with system libs
-	rm -rf src/boost
-	rm -rf src/rocksdb
-
-	# require LD_LIBRARY_PATH for cython to find internal dep
-	export LD_LIBRARY_PATH="$PWD/build/lib:$LD_LIBRARY_PATH"
-
-	# requires setuptools due to embedded in-cmake setup.py usage
-	export PYTHONPATH="${python2Packages.setuptools}/lib/python2.7/site-packages/:$PYTHONPATH"
-  '';
-
-  cmakeFlags = [
-    "-DENABLE_GIT_VERSION=OFF"
-    "-DWITH_SYSTEM_BOOST=ON"
-    "-DWITH_SYSTEM_ROCKSDB=ON"
-    "-DWITH_LEVELDB=OFF"
-
-    # enforce shared lib
-    "-DBUILD_SHARED_LIBS=ON"
-
-    # disable cephfs, cmake build broken for now
-    "-DWITH_CEPHFS=OFF"
-    "-DWITH_LIBCEPHFS=OFF"
-  ];
-
-  postFixup = ''
-    wrapPythonPrograms
-    wrapProgram $out/bin/ceph-mgr --set PYTHONPATH $out/${python2Packages.python.sitePackages}
-  '';
-
-  enableParallelBuilding = true;
-
-  outputs = [ "dev" "lib" "out" "doc" ];
-
-  meta = {
-    homepage = https://ceph.com/;
-    description = "Distributed storage system";
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [ adev ak ];
-    platforms = platforms.unix;
-    broken = true;
-  };
-
-  passthru.version = version;
-}

pkgs/tools/graphics/pngquant/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "pngquant";
-  version = "2.12.1";
+  version = "2.12.5";
 
   src = fetchFromGitHub {
     owner = "pornel";
     repo = "pngquant";
     rev = version;
-    sha256 = "0jdvry3kvmmxcgwf5a3zbfz0idl6yl3700ag7pf8sk4lg4qp0llp";
+    sha256 = "0sq398iv5cacblz6pb4j2hn16cnszsbkahikdpfq84rb9bj0ya40";
     fetchSubmodules = true;
   };
 

pkgs/tools/misc/bdf2psf/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "bdf2psf";
-  version = "1.192";
+  version = "1.193";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "0yjylbj88p2a7qi1wicicl1ivrhp52pnzy44mc1yg6l3n7zifcwn";
+    sha256 = "1mykng02fyxshm02kywrk16f27b1jhgn9zcaxcvxd255sn58w68k";
   };
 
   buildInputs = [ dpkg ];

pkgs/tools/misc/heimdall/default.nix

···
-{ stdenv, fetchFromGitHub, cmake
-, zlib, libusb1
-, enableGUI ? false, qtbase ? null }:
+{ stdenv, mkDerivation, fetchFromGitHub, cmake, zlib, libusb1
+, enableGUI ? false, qtbase ? null
+}:
 
-stdenv.mkDerivation rec {
+let version = "1.4.2"; in
+
+mkDerivation {
   name = "heimdall-${if enableGUI then "gui-" else ""}${version}";
-  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner  = "Benjamin-Dobell";

pkgs/tools/misc/html-proofer/Gemfile.lock

···
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (5.2.3)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
-    concurrent-ruby (1.1.5)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     ethon (0.12.0)
       ffi (>= 1.3.0)
     ffi (1.11.1)
-    html-proofer (3.11.1)
-      activesupport (>= 4.2, < 6.0)
+    html-proofer (3.12.0)
       addressable (~> 2.3)
-      mercenary (~> 0.3.2)
-      nokogiri (~> 1.9)
+      mercenary (~> 0.3)
+      nokogiri (~> 1.10)
       parallel (~> 1.3)
       rainbow (~> 3.0)
+      timerizer (~> 0.3)
       typhoeus (~> 1.3)
       yell (~> 2.0)
-    i18n (1.6.0)
-      concurrent-ruby (~> 1.0)
     mercenary (0.3.6)
     mini_portile2 (2.4.0)
-    minitest (5.11.3)
     nokogiri (1.10.4)
       mini_portile2 (~> 2.4.0)
     parallel (1.17.0)
-    public_suffix (3.1.1)
+    public_suffix (4.0.1)
     rainbow (3.0.0)
-    thread_safe (0.3.6)
+    timerizer (0.3.2)
     typhoeus (1.3.1)
       ethon (>= 0.9.0)
-    tzinfo (1.2.5)
-      thread_safe (~> 0.1)
     yell (2.2.0)
 
 PLATFORMS

pkgs/tools/misc/html-proofer/gemset.nix

···
 {
-  activesupport = {
-    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "110vp4frgkw3mpzlmshg2f2ig09cknls2w68ym1r1s39d01v0mi8";
-      type = "gem";
-    };
-    version = "5.2.3";
-  };
   addressable = {
     dependencies = ["public_suffix"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bcm2hchn897xjhqj9zzsxf3n9xhddymj4lsclz508f4vw3av46l";
+      sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
       type = "gem";
     };
-    version = "2.6.0";
-  };
-  concurrent-ruby = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
-      type = "gem";
-    };
-    version = "1.1.5";
+    version = "2.7.0";
   };
   ethon = {
     dependencies = ["ffi"];
···
     version = "1.11.1";
   };
   html-proofer = {
-    dependencies = ["activesupport" "addressable" "mercenary" "nokogiri" "parallel" "rainbow" "typhoeus" "yell"];
+    dependencies = ["addressable" "mercenary" "nokogiri" "parallel" "rainbow" "timerizer" "typhoeus" "yell"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kpcz7p0yjr1y9fs8gila2bkgb8y6qkyqv5a8yymw0hkvddnqig4";
+      sha256 = "1a5h5ijrngfd4ri36g7bs5lcg4001i5xx7nlk35rsg34xpy8mp04";
       type = "gem";
     };
-    version = "3.11.1";
-  };
-  i18n = {
-    dependencies = ["concurrent-ruby"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hfxnlyr618s25xpafw9mypa82qppjccbh292c4l3bj36az7f6wl";
-      type = "gem";
-    };
-    version = "1.6.0";
+    version = "3.12.0";
   };
   mercenary = {
     groups = ["default"];
···
       type = "gem";
     };
     version = "2.4.0";
-  };
-  minitest = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0icglrhghgwdlnzzp4jf76b0mbc71s80njn5afyfjn4wqji8mqbq";
-      type = "gem";
-    };
-    version = "5.11.3";
   };
   nokogiri = {
     dependencies = ["mini_portile2"];
···
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g9ds2ffzljl6jjmkjffwxc1z6lh5nkqqmhhkxjk71q5ggv0rkpm";
+      sha256 = "0xnfv2j2bqgdpg2yq9i2rxby0w2sc9h5iyjkpaas2xknwrgmhdb0";
       type = "gem";
     };
-    version = "3.1.1";
+    version = "4.0.1";
   };
   rainbow = {
     groups = ["default"];
···
     };
     version = "3.0.0";
   };
-  thread_safe = {
+  timerizer = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
+      sha256 = "06zk04kprgj0abws15wqrk4q29f3wcx7z2jj3v25nnb2517lk66c";
       type = "gem";
     };
-    version = "0.3.6";
+    version = "0.3.2";
   };
   typhoeus = {
     dependencies = ["ethon"];
···
       type = "gem";
     };
     version = "1.3.1";
-  };
-  tzinfo = {
-    dependencies = ["thread_safe"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1fjx9j327xpkkdlxwmkl3a8wqj7i4l4jwlrv3z13mg95z9wl253z";
-      type = "gem";
-    };
-    version = "1.2.5";
   };
   yell = {
     groups = ["default"];

pkgs/tools/misc/parcellite/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "Lightweight GTK+ clipboard manager";
+    description = "Lightweight GTK clipboard manager";
     homepage = https://github.com/rickyrockrat/parcellite;
     license = licenses.gpl3Plus;
     platforms = platforms.linux;

pkgs/tools/misc/plotinus/default.nix

···
   ];
 
   meta = with stdenv.lib; {
-    description = "A searchable command palette in every modern GTK+ application";
+    description = "A searchable command palette in every modern GTK application";
     homepage = https://github.com/p-e-w/plotinus;
     maintainers = with maintainers; [ samdroid-apps ];
     platforms = platforms.linux;

pkgs/tools/misc/txr/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "txr";
-  version = "220";
+  version = "224";
 
   src = fetchurl {
     url = "http://www.kylheku.com/cgit/txr/snapshot/${pname}-${version}.tar.bz2";
-    sha256 = "00jg1zhsqhi146xrh0bfb2czfgfw9i2xbpqwk3yh0n766wcm4ryd";
+    sha256 = "10xz140i4sam9r7r8rz5mz5jbwal7xvaimzrb7lmisqsvby2qcw7";
   };
 
   nativeBuildInputs = [ bison flex ];

pkgs/tools/networking/gftp/default.nix

···
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gtk2 readline ncurses gettext openssl ];
 
-  meta = { 
-    description = "GTK+-based FTP client";
+  meta = {
+    description = "GTK-based FTP client";
     homepage = http://www.gftp.org;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.unix;

pkgs/tools/networking/httpie/default.nix

···
 { stdenv, fetchurl, pythonPackages }:
 
 pythonPackages.buildPythonApplication rec {
-  name = "httpie-1.0.2";
+  pname = "httpie";
+  version = "1.0.3";
 
-  src = fetchurl {
-    url = "mirror://pypi/h/httpie/${name}.tar.gz";
-    sha256 = "1ax22jh5lpjywpj7lsl072wdhr1pxiqzmxhyph5diwxxzs2nqrzw";
+  src = pythonPackages.fetchPypi {
+    inherit pname version;
+    sha256 = "103fcigpxf4nqmrdqjnyz7d9n4n16906slwmmqqc0gkxv8hnw6vd";
   };
 
   propagatedBuildInputs = with pythonPackages; [ pygments requests ];

pkgs/tools/networking/p2p/gtk-gnutella/default.nix

···
   '';
 
   meta = with stdenv.lib; {
-    description = "A GTK+ Gnutella client, optimized for speed and scalability";
+    description = "A GTK Gnutella client, optimized for speed and scalability";
     homepage = "http://gtk-gnutella.sourceforge.net/"; # Code: https://github.com/gtk-gnutella/gtk-gnutella
     changelog = "https://raw.githubusercontent.com/gtk-gnutella/gtk-gnutella/v${version}/ChangeLog";
     license = licenses.gpl2Plus;

pkgs/tools/networking/uget/default.nix

···
                ''gappsWrapperArgs+=(--suffix PATH : "${aria2}/bin")'';
 
   meta = with stdenv.lib; {
-    description = "Download manager using gtk+ and libcurl";
+    description = "Download manager using GTK and libcurl";
     longDescription = ''
       uGet is a VERY Powerful download manager application with a large
       inventory of features but is still very light-weight and low on

pkgs/tools/package-management/home-manager/default.nix

···
 stdenv.mkDerivation rec {
 
   pname = "home-manager";
-  version = "2019-06-25";
+  version = "2019-09-04";
 
   src = fetchFromGitHub {
     owner = "rycee";
     repo = "home-manager";
-    rev = "95d55b8da152f1efffb7713c82ead83a3fcf476d";
-    sha256 = "1zbx051rc0b880wjl832m9sliwrhrm1dbdxw8734gvc0pfz6qwn1";
+    rev = "1923ac3358cbd2d75352c2db2178314eb4623818";
+    sha256 = "1xdsz62sjh8j3p8jfz449gv9vl01adk3qdyjvbpgi7y5c09ymwg7";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/package-management/nix/default.nix

···
   };
 
   nixStable = callPackage common (rec {
-    name = "nix-2.2.2";
+    name = "nix-2.3";
     src = fetchurl {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "f80a1b4f9837a8d33209f0b7769d5038335459ff4303eccf3e9217a9eca8594c";
+      sha256 = "b1d1b4d87390941fc64b19776f1ed9e3871231d38f5a1f295dd13925acd3a98d";
     };
 
     inherit storeDir stateDir confDir boehmgc;

pkgs/tools/package-management/xbps/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "xbps";
-  version = "0.56";
+  version = "0.57";
 
   src = fetchFromGitHub {
     owner = "void-linux";
     repo = "xbps";
     rev = version;
-    sha256 = "0hqvq6fq62l5sgm4fy3zb0ks889d21mqz4f4my3iifs6c9f50na2";
+    sha256 = "1aaa0h265lx85hmcvg7zpg7iiq6dzzlyxqazn1s387ss709i5gxn";
   };
 
   nativeBuildInputs = [ pkgconfig which ];
···
   buildInputs = [ zlib openssl libarchive ];
 
   patches = [ ./cert-paths.patch ];
+
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=unused-result" ];
 
   postPatch = ''
     # fix unprefixed ranlib (needed on cross)

pkgs/tools/security/metasploit/Gemfile

···
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/4.16.1"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/5.0.45"

pkgs/tools/security/metasploit/Gemfile.lock

···
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: dbec1c2d2ae4bd77276cbfb3c6ee2902048b9453
-  ref: refs/tags/4.16.1
+  revision: 2b9e74c7a8a4423ea195e75abca1f56c354e5541
+  ref: refs/tags/5.0.45
   specs:
-    metasploit-framework (4.16.1)
+    metasploit-framework (5.0.45)
       actionpack (~> 4.2.6)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
+      aws-sdk-ec2
+      aws-sdk-iam
+      aws-sdk-s3
       backports
-      bcrypt
+      bcrypt (= 3.1.12)
       bcrypt_pbkdf
       bit-struct
+      concurrent-ruby (= 1.0.5)
       dnsruby
+      ed25519
+      em-http-request
+      faker
       filesize
       jsobfu
       json
···
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 1.3.1)
-      metasploit_data_models
-      metasploit_payloads-mettle (= 0.2.0)
+      metasploit-payloads (= 1.3.70)
+      metasploit_data_models (= 3.0.10)
+      metasploit_payloads-mettle (= 0.5.16)
+      mqtt
       msgpack
       nessus_rest
       net-ssh
···
       patch_finder
       pcaprub
       pdf-reader
-      pg (= 0.20.0)
+      pg (~> 0.20)
       railties
       rb-readline
-      rbnacl (< 5.0.0)
-      rbnacl-libsodium
       recog
       redcarpet
       rex-arch
···
       rex-mime
       rex-nop
       rex-ole
-      rex-powershell (< 0.1.73)
+      rex-powershell
       rex-random_identifier
       rex-registry
       rex-rop_builder
-      rex-socket
+      rex-socket (= 0.1.17)
       rex-sslscan
       rex-struct2
       rex-text
       rex-zip
-      robots
+      ruby-macho
       ruby_smb
       rubyntlm
       rubyzip
+      sinatra
       sqlite3
       sshkey
+      thin
       tzinfo
       tzinfo-data
+      warden
       windows_error
       xdr
       xmlrpc
···
 GEM
   remote: https://rubygems.org/
   specs:
-    Ascii85 (1.0.2)
-    actionpack (4.2.9)
-      actionview (= 4.2.9)
-      activesupport (= 4.2.9)
+    Ascii85 (1.0.3)
+    actionpack (4.2.11.1)
+      actionview (= 4.2.11.1)
+      activesupport (= 4.2.11.1)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.9)
-      activesupport (= 4.2.9)
+    actionview (4.2.11.1)
+      activesupport (= 4.2.11.1)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activemodel (4.2.9)
-      activesupport (= 4.2.9)
+    activemodel (4.2.11.1)
+      activesupport (= 4.2.11.1)
       builder (~> 3.1)
-    activerecord (4.2.9)
-      activemodel (= 4.2.9)
-      activesupport (= 4.2.9)
+    activerecord (4.2.11.1)
+      activemodel (= 4.2.11.1)
+      activesupport (= 4.2.11.1)
       arel (~> 6.0)
-    activesupport (4.2.9)
+    activesupport (4.2.11.1)
       i18n (~> 0.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    addressable (2.5.1)
-      public_suffix (~> 2.0, >= 2.0.2)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     afm (0.2.2)
     arel (6.0.4)
-    arel-helpers (2.4.0)
-      activerecord (>= 3.1.0, < 6)
-    backports (3.8.0)
-    bcrypt (3.1.11)
-    bcrypt_pbkdf (1.0.0)
-    bindata (2.4.0)
+    arel-helpers (2.10.0)
+      activerecord (>= 3.1.0, < 7)
+    aws-eventstream (1.0.3)
+    aws-partitions (1.208.0)
+    aws-sdk-core (3.66.0)
+      aws-eventstream (~> 1.0, >= 1.0.2)
+      aws-partitions (~> 1.0)
+      aws-sigv4 (~> 1.1)
+      jmespath (~> 1.0)
+    aws-sdk-ec2 (1.106.0)
+      aws-sdk-core (~> 3, >= 3.61.1)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-iam (1.29.0)
+      aws-sdk-core (~> 3, >= 3.61.1)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-kms (1.24.0)
+      aws-sdk-core (~> 3, >= 3.61.1)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-s3 (1.48.0)
+      aws-sdk-core (~> 3, >= 3.61.1)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.1)
+    aws-sigv4 (1.1.0)
+      aws-eventstream (~> 1.0, >= 1.0.2)
+    backports (3.15.0)
+    bcrypt (3.1.12)
+    bcrypt_pbkdf (1.0.1)
+    bindata (2.4.4)
     bit-struct (0.16)
     builder (3.2.3)
-    dnsruby (1.60.2)
+    concurrent-ruby (1.0.5)
+    cookiejar (0.3.3)
+    crass (1.0.4)
+    daemons (1.3.1)
+    dnsruby (1.61.3)
+      addressable (~> 2.5)
+    ed25519 (1.2.4)
+    em-http-request (1.1.5)
+      addressable (>= 2.3.4)
+      cookiejar (!= 0.3.1)
+      em-socksify (>= 0.3)
+      eventmachine (>= 1.0.3)
+      http_parser.rb (>= 0.6.0)
+    em-socksify (0.3.2)
+      eventmachine (>= 1.0.0.beta.4)
     erubis (2.7.0)
-    faraday (0.13.1)
+    eventmachine (1.2.7)
+    faker (2.2.1)
+      i18n (>= 0.8)
+    faraday (0.15.4)
       multipart-post (>= 1.2, < 3)
-    ffi (1.9.18)
-    filesize (0.1.1)
+    filesize (0.2.0)
     hashery (2.1.2)
-    i18n (0.8.6)
+    http_parser.rb (0.6.0)
+    i18n (0.9.5)
+      concurrent-ruby (~> 1.0)
+    jmespath (1.4.0)
     jsobfu (0.4.2)
       rkelly-remix
-    json (2.1.0)
-    loofah (2.0.3)
+    json (2.2.0)
+    loofah (2.2.3)
+      crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
-    metasm (1.0.3)
+    metasm (1.0.4)
     metasploit-concern (2.0.5)
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-credential (2.0.12)
+    metasploit-credential (3.0.3)
       metasploit-concern
       metasploit-model
-      metasploit_data_models
+      metasploit_data_models (>= 3.0.0)
+      net-ssh
       pg
       railties
       rex-socket
···
       activemodel (~> 4.2.6)
       activesupport (~> 4.2.6)
       railties (~> 4.2.6)
-    metasploit-payloads (1.3.1)
-    metasploit_data_models (2.0.15)
+    metasploit-payloads (1.3.70)
+    metasploit_data_models (3.0.10)
       activerecord (~> 4.2.6)
       activesupport (~> 4.2.6)
       arel-helpers
···
       postgres_ext
       railties (~> 4.2.6)
       recog (~> 2.0)
-    metasploit_payloads-mettle (0.2.0)
-    mini_portile2 (2.2.0)
-    minitest (5.10.3)
-    msgpack (1.1.0)
-    multipart-post (2.0.0)
+    metasploit_payloads-mettle (0.5.16)
+    mini_portile2 (2.4.0)
+    minitest (5.11.3)
+    mqtt (0.5.0)
+    msgpack (1.3.1)
+    multipart-post (2.1.1)
     nessus_rest (0.1.6)
-    net-ssh (4.1.0)
-    network_interface (0.0.1)
-    nexpose (6.1.1)
-    nokogiri (1.8.0)
-      mini_portile2 (~> 2.2.0)
-    octokit (4.7.0)
+    net-ssh (5.2.0)
+    network_interface (0.0.2)
+    nexpose (7.2.1)
+    nokogiri (1.10.4)
+      mini_portile2 (~> 2.4.0)
+    octokit (4.14.0)
       sawyer (~> 0.8.0, >= 0.5.3)
-    openssl-ccm (1.2.1)
+    openssl-ccm (1.2.2)
     openvas-omp (0.0.4)
     packetfu (1.1.13)
       pcaprub
     patch_finder (1.0.2)
-    pcaprub (0.12.4)
-    pdf-reader (2.0.0)
+    pcaprub (0.13.0)
+    pdf-reader (2.2.1)
       Ascii85 (~> 1.0.0)
       afm (~> 0.2.1)
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
-    pg (0.20.0)
+    pg (0.21.0)
     pg_array_parser (0.0.9)
-    postgres_ext (3.0.0)
-      activerecord (>= 4.0.0)
+    postgres_ext (3.0.1)
+      activerecord (~> 4.0)
       arel (>= 4.0.1)
       pg_array_parser (~> 0.0.9)
-    public_suffix (2.0.5)
+    public_suffix (4.0.1)
     rack (1.6.11)
+    rack-protection (1.5.5)
+      rack
     rack-test (0.6.3)
       rack (>= 1.0)
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.8)
-      activesupport (>= 4.2.0.beta, < 5.0)
+    rails-dom-testing (1.0.9)
+      activesupport (>= 4.2.0, < 5.0)
       nokogiri (~> 1.6)
       rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
-    railties (4.2.9)
-      actionpack (= 4.2.9)
-      activesupport (= 4.2.9)
+    rails-html-sanitizer (1.2.0)
+      loofah (~> 2.2, >= 2.2.2)
+    railties (4.2.11.1)
+      actionpack (= 4.2.11.1)
+      activesupport (= 4.2.11.1)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (12.0.0)
+    rake (12.3.3)
     rb-readline (0.5.5)
-    rbnacl (4.0.2)
-      ffi
-    rbnacl-libsodium (1.0.13)
-      rbnacl (>= 3.0.1)
-    recog (2.1.12)
+    recog (2.3.2)
       nokogiri
-    redcarpet (3.4.0)
-    rex-arch (0.1.11)
+    redcarpet (3.5.0)
+    rex-arch (0.1.13)
       rex-text
-    rex-bin_tools (0.1.4)
+    rex-bin_tools (0.1.6)
       metasm
       rex-arch
       rex-core
       rex-struct2
       rex-text
-    rex-core (0.1.12)
+    rex-core (0.1.13)
     rex-encoder (0.1.4)
       metasm
       rex-arch
       rex-text
-    rex-exploitation (0.1.14)
+    rex-exploitation (0.1.21)
       jsobfu
       metasm
       rex-arch
···
       rex-arch
     rex-ole (0.1.6)
       rex-text
-    rex-powershell (0.1.72)
+    rex-powershell (0.1.82)
       rex-random_identifier
       rex-text
-    rex-random_identifier (0.1.2)
+    rex-random_identifier (0.1.4)
       rex-text
     rex-registry (0.1.3)
     rex-rop_builder (0.1.3)
       metasm
       rex-core
       rex-text
-    rex-socket (0.1.8)
+    rex-socket (0.1.17)
       rex-core
     rex-sslscan (0.1.5)
       rex-core
       rex-socket
       rex-text
     rex-struct2 (0.1.2)
-    rex-text (0.2.15)
+    rex-text (0.2.23)
     rex-zip (0.1.3)
       rex-text
     rkelly-remix (0.0.7)
-    robots (0.10.1)
+    ruby-macho (2.2.0)
     ruby-rc4 (0.1.5)
-    ruby_smb (0.0.18)
+    ruby_smb (1.1.0)
       bindata
       rubyntlm
       windows_error
     rubyntlm (0.6.2)
-    rubyzip (1.2.1)
-    sawyer (0.8.1)
-      addressable (>= 2.3.5, < 2.6)
-      faraday (~> 0.8, < 1.0)
-    sqlite3 (1.3.13)
-    sshkey (1.9.0)
-    thor (0.20.0)
+    rubyzip (1.2.3)
+    sawyer (0.8.2)
+      addressable (>= 2.3.5)
+      faraday (> 0.8, < 2.0)
+    sinatra (1.4.8)
+      rack (~> 1.5)
+      rack-protection (~> 1.4)
+      tilt (>= 1.3, < 3)
+    sqlite3 (1.4.1)
+    sshkey (2.0.0)
+    thin (1.7.2)
+      daemons (~> 1.0, >= 1.0.9)
+      eventmachine (~> 1.0, >= 1.0.4)
+      rack (>= 1, < 3)
+    thor (0.20.3)
     thread_safe (0.3.6)
+    tilt (2.0.9)
     ttfunk (1.5.1)
-    tzinfo (1.2.3)
+    tzinfo (1.2.5)
       thread_safe (~> 0.1)
-    tzinfo-data (1.2017.2)
+    tzinfo-data (1.2019.2)
       tzinfo (>= 1.0.0)
+    warden (1.2.7)
+      rack (>= 1.0)
     windows_error (0.1.2)
     xdr (2.0.0)
       activemodel (>= 4.2.7)
···
   metasploit-framework!
 
 BUNDLED WITH
-   1.16.4
+   1.17.2

pkgs/tools/security/metasploit/default.nix

···
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "4.16.1";
+  version = "5.0.45";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "1vilyy0dqzp8kbbpvs2zrv2ac7s39w2vv7mrbzgcjgh2bj7c6bg1";
+    sha256 = "16jl3fkfbwl4wwbj2zrq9yr8y8brkhj9641hplc8idv8gaqkgmm5";
   };
 
   buildInputs = [ makeWrapper ];

pkgs/tools/security/metasploit/gemset.nix

···
 {
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kgrq74gp2czzxr0f2sqrc98llz03lgq498300z2z5n4khgznwc4";
+      sha256 = "0rmldsk3a4lwxk0lrp6x1nz1v1r2xmbm3300l4ghgfygv3grdwjh";
       type = "gem";
     };
-    version = "4.2.9";
+    version = "4.2.11.1";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubis" "rails-dom-testing" "rails-html-sanitizer"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04kgp4gmahw31miz8xdq1pns14qmvvzd14fgfv7fg9klkw3bxyyp";
+      sha256 = "0x7vjn8q6blzyf7j3kwg0ciy7vnfh28bjdkd1mp9k4ghp9jn0g9p";
       type = "gem";
     };
-    version = "4.2.9";
+    version = "4.2.11.1";
   };
   activemodel = {
     dependencies = ["activesupport" "builder"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qxmivny0ka5s3iyap08sn9bp2bd9wrhqp2njfw26hr9wsjk5kfv";
+      sha256 = "1c1x0rd6wnk1f0gsmxs6x3gx7yf6fs9qqkdv7r4hlbcdd849in33";
       type = "gem";
     };
-    version = "4.2.9";
+    version = "4.2.11.1";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport" "arel"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18i790dfhi4ndypd1pj9pv08knpxr2sayvvwfq7axj5jfwgpmrqb";
+      sha256 = "07ixiwi0zzs9skqarvpfamsnay7npfswymrn28ngxaf8hi279q5p";
       type = "gem";
     };
-    version = "4.2.9";
+    version = "4.2.11.1";
   };
   activesupport = {
     dependencies = ["i18n" "minitest" "thread_safe" "tzinfo"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d0a362p3m2m2kljichar2pwq0qm4vblc3njy1rdzm09ckzd45sp";
+      sha256 = "1vbq7a805bfvyik2q3kl9s3r418f5qzvysqbz2cwy4hr7m2q4ir6";
       type = "gem";
     };
-    version = "4.2.9";
+    version = "4.2.11.1";
   };
   addressable = {
     dependencies = ["public_suffix"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i8q32a4gr0zghxylpyy7jfqwxvwrivsxflg9mks6kx92frh75mh";
+      sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.7.0";
   };
   afm = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "06kj9hgd0z8pj27bxp2diwqh6fv7qhwwm17z64rhdc4sfn76jgn8";
···
     version = "0.2.2";
   };
   arel = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0nfcrdiys6q6ylxiblky9jyssrw2xj96fmxmal7f4f0jj3417vj4";
···
   };
   arel-helpers = {
     dependencies = ["activerecord"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sx4qbzhld3a99175p2krz3hv1npc42rv3sd8x4awzkgplg3zy9c";
+      sha256 = "0lb52rd20ix7khh70vrwd85qivir9sis62s055k3zr5h9iy3lyqi";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.10.0";
   };
   Ascii85 = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0j95sbxd18kc8rhcnvl1w37kflqpax1r12h1x47gh4xxn3mz4m7q";
+      sha256 = "0658m37jjjn6drzqg1gk4p6c205mgp7g1jh2d00n4ngghgmz5qvs";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.0.3";
+  };
+  aws-eventstream = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "100g77a5ixg4p5zwq77f28n2pdkk0y481f7v83qrlmnj22318qq6";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  aws-partitions = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vkjw8cxssfwplrcl593gp4jxxiajihb8gqmpgzyac8i3xigpacb";
+      type = "gem";
+    };
+    version = "1.208.0";
+  };
+  aws-sdk-core = {
+    dependencies = ["aws-eventstream" "aws-partitions" "aws-sigv4" "jmespath"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18h35j7wp7n6zc5r6dpixjcyjshqmpkhwph9qgpv2g0db37zlxyk";
+      type = "gem";
+    };
+    version = "3.66.0";
+  };
+  aws-sdk-ec2 = {
+    dependencies = ["aws-sdk-core" "aws-sigv4"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1sb04blmc0lgdgq909cj8cm63zl2idgc5mcysj6cg4rvm8699ahp";
+      type = "gem";
+    };
+    version = "1.106.0";
+  };
+  aws-sdk-iam = {
+    dependencies = ["aws-sdk-core" "aws-sigv4"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ypv1cmmrc496myllqd8dqz422qm1i0bhskkvqb9b2lbagmzr3l9";
+      type = "gem";
+    };
+    version = "1.29.0";
+  };
+  aws-sdk-kms = {
+    dependencies = ["aws-sdk-core" "aws-sigv4"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14blvvfz67rhffi4ahby50jiip5f0hm85mcxlx6y93g0cfrnxh3m";
+      type = "gem";
+    };
+    version = "1.24.0";
+  };
+  aws-sdk-s3 = {
+    dependencies = ["aws-sdk-core" "aws-sdk-kms" "aws-sigv4"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14iv2wqvvbiz0gdms21i9n6rh8390r1yg4zcf8pzzfplbqfwqw4w";
+      type = "gem";
+    };
+    version = "1.48.0";
+  };
+  aws-sigv4 = {
+    dependencies = ["aws-eventstream"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1dfc8i5cxjwlvi4b665lbpbwvks8a6wfy3vfmwr3pjdmxwdmc2cs";
+      type = "gem";
+    };
+    version = "1.1.0";
   };
   backports = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17pcz0z6jms5jydr1r95kf1bpk3ms618hgr26c62h34icy9i1dpm";
+      sha256 = "0cczfi1yp7a68bg7ipzi4lvrmi4xsi36n9a19krr4yb3nfwd8fn2";
       type = "gem";
     };
-    version = "3.8.0";
+    version = "3.15.0";
   };
   bcrypt = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d254sdhdj6mzak3fb5x3jam8b94pvl1srladvs53j05a89j5z50";
+      sha256 = "0ysblqxkclmnhrd0kmb5mr8p38mbar633gdsb14b7dhkhgawgzfy";
       type = "gem";
     };
-    version = "3.1.11";
+    version = "3.1.12";
   };
   bcrypt_pbkdf = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cj4k13c7qvvck7y25i3xarvyqq8d27vl61jddifkc7llnnap1hv";
+      sha256 = "02vssr285m7kpsr47jdmzbar1h1d0mnkmyrpr1zg828isfmwii35";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
   };
   bindata = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10sii2chgnkp2jw830sbr2wb20p8p1wcwrl9jhadkw94f505qcyg";
+      sha256 = "0kz42nvxnk1j9cj0i8lcnhprcgdqsqska92g6l19ziadydfk2gqy";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.4.4";
   };
   bit-struct = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1w7x1fh4a6inpb46imhdf4xrq0z4d6zdpg7sdf8n98pif2hx50sx";
···
     version = "0.16";
   };
   builder = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
···
     };
     version = "3.2.3";
   };
-  dnsruby = {
+  concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qfvpkka69f8vnmda3zhkr54fjpf7pwgmbx0gcsxg3jd6c7sjs1d";
+      sha256 = "183lszf5gx84kcpb779v6a2y0mx9sssy8dgppng1z9a505nj1qcf";
       type = "gem";
     };
-    version = "1.60.2";
+    version = "1.0.5";
+  };
+  cookiejar = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0q0kmbks9l3hl0wdq744hzy97ssq9dvlzywyqv9k9y1p3qc9va2a";
+      type = "gem";
+    };
+    version = "0.3.3";
+  };
+  crass = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bpxzy6gjw9ggjynlxschbfsgmx8lv3zw1azkjvnb8b9i895dqfi";
+      type = "gem";
+    };
+    version = "1.0.4";
+  };
+  daemons = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0l5gai3vd4g7aqff0k1mp41j9zcsvm2rbwmqn115a325k9r7pf4w";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
+  dnsruby = {
+    dependencies = ["addressable"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "139cbl2k934q7d50g7hi8r4im69ca3iv16y9plq9yc6mgjq1cgfk";
+      type = "gem";
+    };
+    version = "1.61.3";
+  };
+  ed25519 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1f5kr8za7hvla38fc0n9jiv55iq62k5bzclsa5kdb14l3r4w6qnw";
+      type = "gem";
+    };
+    version = "1.2.4";
+  };
+  em-http-request = {
+    dependencies = ["addressable" "cookiejar" "em-socksify" "eventmachine" "http_parser.rb"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13rxmbi0fv91n4sg300v3i9iiwd0jxv0i6xd0sp81dx3jlx7kasx";
+      type = "gem";
+    };
+    version = "1.1.5";
+  };
+  em-socksify = {
+    dependencies = ["eventmachine"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rk43ywaanfrd8180d98287xv2pxyl7llj291cwy87g1s735d5nk";
+      type = "gem";
+    };
+    version = "0.3.2";
   };
   erubis = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1fj827xqjs91yqsydf0zmfyw9p4l2jz5yikg3mppz6d7fi8kyrb3";
···
     };
     version = "2.7.0";
   };
+  eventmachine = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wh9aqb0skz80fhfn66lbpr4f86ya2z5rx6gm5xlfhd05bj1ch4r";
+      type = "gem";
+    };
+    version = "1.2.7";
+  };
+  faker = {
+    dependencies = ["i18n"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1wpzpqzpqd9jjzm3ap8182sfbnhdahcxpbg0dssbwq13qdf1s5xs";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
   faraday = {
     dependencies = ["multipart-post"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gyqsj7vlqynwvivf9485zwmcj04v1z7gq362z0b8zw2zf4ag0hw";
+      sha256 = "0s72m05jvzc1pd6cw1i289chas399q0a14xrwg4rvkdwy7bgzrh0";
       type = "gem";
     };
-    version = "0.13.1";
-  };
-  ffi = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "034f52xf7zcqgbvwbl20jwdyjwznvqnwpbaps9nk18v9lgb1dpx0";
-      type = "gem";
-    };
-    version = "1.9.18";
+    version = "0.15.4";
   };
   filesize = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "061qmg82mm9xnmnq3b7gbi24g28xk62w0b0nw86gybd07m1jn989";
+      sha256 = "17p7rf1x7h3ivaznb4n4kmxnnzj25zaviryqgn2n12v2kmibhp8g";
       type = "gem";
     };
-    version = "0.1.1";
+    version = "0.2.0";
   };
   hashery = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0qj8815bf7q6q7llm5rzdz279gzmpqmqqicxnzv066a020iwqffj";
···
     };
     version = "2.1.2";
   };
-  i18n = {
+  "http_parser.rb" = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i3aqvzfsj786kwjj70jsjpxm6ffw5pwhalzr2abjfv2bdc7k9kw";
+      sha256 = "15nidriy0v5yqfjsgsra51wmknxci2n2grliz78sf9pga3n0l7gi";
       type = "gem";
     };
-    version = "0.8.6";
+    version = "0.6.0";
+  };
+  i18n = {
+    dependencies = ["concurrent-ruby"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "038qvz7kd3cfxk8bvagqhakx68pfbnmghpdkx7573wbf0maqp9a3";
+      type = "gem";
+    };
+    version = "0.9.5";
+  };
+  jmespath = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1d4wac0dcd1jf6kc57891glih9w57552zgqswgy74d1xhgnk0ngf";
+      type = "gem";
+    };
+    version = "1.4.0";
   };
   jsobfu = {
     dependencies = ["rkelly-remix"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1hchns89cfj0gggm2zbr7ghb630imxm2x2d21ffx2jlasn9xbkyk";
···
     version = "0.4.2";
   };
   json = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.2.0";
   };
   loofah = {
-    dependencies = ["nokogiri"];
+    dependencies = ["crass" "nokogiri"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "109ps521p0sr3kgc460d58b4pr1z4mqggan2jbsf0aajy9s6xis8";
+      sha256 = "1ccsid33xjajd0im2xv941aywi58z7ihwkvaf1w2bv89vn5bhsjg";
       type = "gem";
     };
-    version = "2.0.3";
+    version = "2.2.3";
   };
   metasm = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0gss57q4lv6l0jkih77zffrpjjzgkdcsy7b9nvvawyzknis9w4s5";
+      sha256 = "0mbmpc8vsi574s78f23bhiqk07sr6yrrrmk702lfv61ql4ah5l89";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.0.4";
   };
   metasploit-concern = {
     dependencies = ["activemodel" "activesupport" "railties"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0v9lm225fhzhnbjcc0vwb38ybikxwzlv8116rrrkndzs8qy79297";
···
     version = "2.0.5";
   };
   metasploit-credential = {
-    dependencies = ["metasploit-concern" "metasploit-model" "metasploit_data_models" "pg" "railties" "rex-socket" "rubyntlm" "rubyzip"];
+    dependencies = ["metasploit-concern" "metasploit-model" "metasploit_data_models" "net-ssh" "pg" "railties" "rex-socket" "rubyntlm" "rubyzip"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1flahrcl5hf4bncqs40mry6pkffvmir85kqzkad22x3dh6crw50i";
+      sha256 = "0m6j149x502p00y2jzra65281dhhw3m8a41pwfn1sk9wv7aiclvl";
       type = "gem";
     };
-    version = "2.0.12";
+    version = "3.0.3";
   };
   metasploit-framework = {
-    dependencies = ["actionpack" "activerecord" "activesupport" "backports" "bcrypt" "bcrypt_pbkdf" "bit-struct" "dnsruby" "filesize" "jsobfu" "json" "metasm" "metasploit-concern" "metasploit-credential" "metasploit-model" "metasploit-payloads" "metasploit_data_models" "metasploit_payloads-mettle" "msgpack" "nessus_rest" "net-ssh" "network_interface" "nexpose" "nokogiri" "octokit" "openssl-ccm" "openvas-omp" "packetfu" "patch_finder" "pcaprub" "pdf-reader" "pg" "railties" "rb-readline" "rbnacl" "rbnacl-libsodium" "recog" "redcarpet" "rex-arch" "rex-bin_tools" "rex-core" "rex-encoder" "rex-exploitation" "rex-java" "rex-mime" "rex-nop" "rex-ole" "rex-powershell" "rex-random_identifier" "rex-registry" "rex-rop_builder" "rex-socket" "rex-sslscan" "rex-struct2" "rex-text" "rex-zip" "robots" "ruby_smb" "rubyntlm" "rubyzip" "sqlite3" "sshkey" "tzinfo" "tzinfo-data" "windows_error" "xdr" "xmlrpc"];
+    dependencies = ["actionpack" "activerecord" "activesupport" "aws-sdk-ec2" "aws-sdk-iam" "aws-sdk-s3" "backports" "bcrypt" "bcrypt_pbkdf" "bit-struct" "concurrent-ruby" "dnsruby" "ed25519" "em-http-request" "faker" "filesize" "jsobfu" "json" "metasm" "metasploit-concern" "metasploit-credential" "metasploit-model" "metasploit-payloads" "metasploit_data_models" "metasploit_payloads-mettle" "mqtt" "msgpack" "nessus_rest" "net-ssh" "network_interface" "nexpose" "nokogiri" "octokit" "openssl-ccm" "openvas-omp" "packetfu" "patch_finder" "pcaprub" "pdf-reader" "pg" "railties" "rb-readline" "recog" "redcarpet" "rex-arch" "rex-bin_tools" "rex-core" "rex-encoder" "rex-exploitation" "rex-java" "rex-mime" "rex-nop" "rex-ole" "rex-powershell" "rex-random_identifier" "rex-registry" "rex-rop_builder" "rex-socket" "rex-sslscan" "rex-struct2" "rex-text" "rex-zip" "ruby-macho" "ruby_smb" "rubyntlm" "rubyzip" "sinatra" "sqlite3" "sshkey" "thin" "tzinfo" "tzinfo-data" "warden" "windows_error" "xdr" "xmlrpc"];
+    groups = ["default"];
+    platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "dbec1c2d2ae4bd77276cbfb3c6ee2902048b9453";
-      sha256 = "06a2dc64wl8w02zimf44hch4cap7ckw42kg1x01lmcwaa8d5q09w";
+      rev = "2b9e74c7a8a4423ea195e75abca1f56c354e5541";
+      sha256 = "16jl3fkfbwl4wwbj2zrq9yr8y8brkhj9641hplc8idv8gaqkgmm5";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "4.16.1";
+    version = "5.0.45";
   };
   metasploit-model = {
     dependencies = ["activemodel" "activesupport" "railties"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "05pnai1cv00xw87rrz38dz4s3ss45s90290d0knsy1mq6rp8yvmw";
···
     version = "2.0.4";
   };
   metasploit-payloads = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0icha08z4c5rnyp66xcyn9c8lbv43gx7hgs9rsm3539gj8c40znx";
+      sha256 = "01s3xmgw4fp2ic0wql8lswa86q3lgr3z687idx3xkfii3dskjpp3";
+      type = "gem";
+    };
+    version = "1.3.70";
+  };
+  metasploit_data_models = {
+    dependencies = ["activerecord" "activesupport" "arel-helpers" "metasploit-concern" "metasploit-model" "pg" "postgres_ext" "railties" "recog"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h59lblfrx8gsnqr10wk958zp6rsjy3qib3hb87s3nm6m1zhm2bc";
+      type = "gem";
+    };
+    version = "3.0.10";
+  };
+  metasploit_payloads-mettle = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1x2rgs2r16m8z87j5z78vp49xvr2sr4dxjgbi6d0nxrlr52pd8yf";
+      type = "gem";
+    };
+    version = "0.5.16";
+  };
+  mini_portile2 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15zplpfw3knqifj9bpf604rb3wc1vhq6363pd6lvhayng8wql5vy";
+      type = "gem";
+    };
+    version = "2.4.0";
+  };
+  minitest = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0icglrhghgwdlnzzp4jf76b0mbc71s80njn5afyfjn4wqji8mqbq";
+      type = "gem";
+    };
+    version = "5.11.3";
+  };
+  mqtt = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d1khsry5mf63y03r6v91f4vrbn88277ksv7d69z3xmqs9sgpri9";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
+  msgpack = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qr2mkm2i3m76zarvy7qgjl9596hmvjrg7x6w42vx8cfsbf5p0y1";
       type = "gem";
     };
     version = "1.3.1";
   };
-  metasploit_data_models = {
-    dependencies = ["activerecord" "activesupport" "arel-helpers" "metasploit-concern" "metasploit-model" "pg" "postgres_ext" "railties" "recog"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0j3ijxn6n3ack9572a74cwknijymy41c8rx34njyhg25lx4hbvah";
-      type = "gem";
-    };
-    version = "2.0.15";
-  };
-  metasploit_payloads-mettle = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1y2nfzgs17pq3xvlw14jgjcksr4h8p4miypxk9a87l1h7xv7dcgn";
-      type = "gem";
-    };
-    version = "0.2.0";
-  };
-  mini_portile2 = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0g5bpgy08q0nc0anisg3yvwc1gc3inl854fcrg48wvg7glqd6dpm";
-      type = "gem";
-    };
-    version = "2.2.0";
-  };
-  minitest = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05521clw19lrksqgvg2kmm025pvdhdaniix52vmbychrn2jm7kz2";
-      type = "gem";
-    };
-    version = "5.10.3";
-  };
-  msgpack = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ck7w17d6b4jbb8inh1q57bghi9cjkiaxql1d3glmj1yavbpmlh7";
-      type = "gem";
-    };
-    version = "1.1.0";
-  };
   multipart-post = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09k0b3cybqilk1gwrwwain95rdypixb2q9w65gd44gfzsd84xi1x";
+      sha256 = "1zgw9zlwh2a6i1yvhhc4a84ry1hv824d6g2iw2chs3k5aylpmpfj";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.1.1";
   };
   nessus_rest = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1allyrd4rll333zbmsi3hcyg6cw1dhc4bg347ibsw191nswnp8ci";
···
     version = "0.1.6";
   };
   net-ssh = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "013p5jb4wy0cq7x7036piw2a3s1i9p752ki1srx2m289mpz4ml3q";
+      sha256 = "101wd2px9lady54aqmkibvy4j62zk32w0rjz4vnigyg974fsga40";
       type = "gem";
     };
-    version = "4.1.0";
+    version = "5.2.0";
   };
   network_interface = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ir4c1vbz1y0gxyih024262i7ig1nji1lkylcrn9pjzx3798p97a";
+      sha256 = "1xh4knfq77ii4pjzsd2z1p3nd6nrcdjhb2vi5gw36jqj43ffw0zp";
       type = "gem";
     };
-    version = "0.0.1";
+    version = "0.0.2";
   };
   nexpose = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jnyvj09z8r3chhj930fdnashbfcfv0vw2drjvsrcnm7firdhdzb";
+      sha256 = "0i108glkklwgjxhfhnlqf4b16plqf9b84qpfz0pnl2pbnal5af8m";
       type = "gem";
     };
-    version = "6.1.1";
+    version = "7.2.1";
   };
   nokogiri = {
     dependencies = ["mini_portile2"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nffsyx1xjg6v5n9rrbi8y1arrcx2i5f21cp6clgh9iwiqkr7rnn";
+      sha256 = "0nmdrqqz1gs0fwkgzxjl4wr554gr8dc1fkrqjc2jpsvwgm41rygv";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.10.4";
   };
   octokit = {
     dependencies = ["sawyer"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h6cm7bi0y7ysjgwws3paaipqdld6c0m0niazrjahhpz88qqq1g4";
+      sha256 = "1w7agbfg39jzqk81yad9xhscg31869277ysr2iwdvpjafl5lj4ha";
       type = "gem";
     };
-    version = "4.7.0";
+    version = "4.14.0";
   };
   openssl-ccm = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18h5lxv0zh4j2f0wnhdmfz63x02vbzbq2k1clz6kzr0q83h8kj9c";
+      sha256 = "0gxwxk657jya2s5m8cpckvgy5m7qx0hzfp8xvc0hg2wf1lg5gwp0";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.2.2";
   };
   openvas-omp = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "14xf614vd76qjdjxjv14mmjar6s64fwp4cwb7bv5g1wc29srg28x";
···
   };
   packetfu = {
     dependencies = ["pcaprub"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "16ppq9wfxq4x2hss61l5brs3s6fmi8gb50mnp1nnnzb1asq4g8ll";
···
     version = "1.1.13";
   };
   patch_finder = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1md9scls55n1riw26vw1ak0ajq38dfygr36l0h00wqhv51cq745m";
···
     version = "1.0.2";
   };
   pcaprub = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pl4lqy7308185pfv0197n8b4v20fhd0zb3wlpz284rk8ssclkvz";
+      sha256 = "0h4iarqdych6v4jm5s0ywkc01qspadz8sf6qn7pkqmszq4iqv67q";
       type = "gem";
     };
-    version = "0.12.4";
+    version = "0.13.0";
   };
   pdf-reader = {
     dependencies = ["Ascii85" "afm" "hashery" "ruby-rc4" "ttfunk"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nlammdpjy3padmzxhsql7mw31jyqp88n6bdffiarv5kzl4s3y7p";
+      sha256 = "14lqdbiwn2qwgbvnnzxg7haqiy026d8x37hp45c3m9jb9rym92ps";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.2.1";
   };
   pg = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03xcgwjs6faxis81jxf2plnlalg55dhhafqv3kvjxfr8ic7plpw5";
+      sha256 = "00vhasqwc4f98qb4wxqn2h07fjwzhp5lwyi41j2gndi2g02wrdqh";
       type = "gem";
     };
-    version = "0.20.0";
+    version = "0.21.0";
   };
   pg_array_parser = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1034dhg8h53j48sfm373js54skg4vpndjga6hzn2zylflikrrf3s";
···
   };
   postgres_ext = {
     dependencies = ["activerecord" "arel" "pg_array_parser"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1lbp1qf5s1addhznm7d4bzks9adh7jpilgcsr8k7mbd0a1ailcgc";
+      sha256 = "0ni1ajzxvc17ba4rgl27cd3645ddbpqpfckv7m08sfgk015hh7dq";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "3.0.1";
   };
   public_suffix = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "040jf98jpp6w140ghkhw2hvc1qx41zvywx5gj7r2ylr1148qnj7q";
+      sha256 = "0xnfv2j2bqgdpg2yq9i2rxby0w2sc9h5iyjkpaas2xknwrgmhdb0";
       type = "gem";
     };
-    version = "2.0.5";
+    version = "4.0.1";
   };
   rack = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1g9926ln2lw12lfxm4ylq1h6nl0rafl10za3xvjzc87qvnqic87f";
···
     };
     version = "1.6.11";
   };
+  rack-protection = {
+    dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0my0wlw4a5l3hs79jkx2xzv7djhajgf8d28k8ai1ddlnxxb0v7ss";
+      type = "gem";
+    };
+    version = "1.5.5";
+  };
   rack-test = {
     dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0h6x5jq24makgv2fq5qqgjlrk74dxfy62jif9blk43llw8ib2q7z";
···
   };
   rails-deprecated_sanitizer = {
     dependencies = ["activesupport"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0qxymchzdxww8bjsxj05kbf86hsmrjx40r41ksj0xsixr2gmhbbj";
···
   };
   rails-dom-testing = {
     dependencies = ["activesupport" "nokogiri" "rails-deprecated_sanitizer"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ny7mbjxhq20rzg4pivvyvk14irmc7cn20kxfk3vc0z2r2c49p8r";
+      sha256 = "0wssfqpn00byhvp2372p99mphkcj8qx6pf6646avwr9ifvq0q1x6";
       type = "gem";
     };
-    version = "1.0.8";
+    version = "1.0.9";
   };
   rails-html-sanitizer = {
     dependencies = ["loofah"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "138fd86kv073zqfx0xifm646w6bgw2lr8snk16lknrrfrss8xnm7";
+      sha256 = "0ilwxzm3a7bql5c9q2n9g9nb1hax7vd8d65a5yp3d967ld97nvrq";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.2.0";
   };
   railties = {
     dependencies = ["actionpack" "activesupport" "rake" "thor"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1g5jnk1zllm2fr06lixq7gv8l2cwqc99akv7886gz6lshijpfyxd";
+      sha256 = "1bjf21z9maiiazc1if56nnh9xmgbkcqlpznv34f40a1hsvgk1d1m";
       type = "gem";
     };
-    version = "4.2.9";
+    version = "4.2.11.1";
   };
   rake = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01j8fc9bqjnrsxbppncai05h43315vmz9fwg28qdsgcjw9ck1d7n";
+      sha256 = "1cvaqarr1m84mhc006g3l1vw7sa5qpkcw0138lsxlf769zdllsgp";
       type = "gem";
     };
-    version = "12.0.0";
+    version = "12.3.3";
   };
   rb-readline = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "14w79a121czmvk1s953qfzww30mqjb2zc0k9qhi0ivxxk3hxg6wy";
···
     };
     version = "0.5.5";
   };
-  rbnacl = {
-    dependencies = ["ffi"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08dkigw8wdx53hviw1zqrs7rcrzqcwh9jd3dvwr72013z9fmyp48";
-      type = "gem";
-    };
-    version = "4.0.2";
-  };
-  rbnacl-libsodium = {
-    dependencies = ["rbnacl"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1323fli41m01af13xz5xvabsjnz09si1b9l4qd2p802kq0dr61gd";
-      type = "gem";
-    };
-    version = "1.0.13";
-  };
   recog = {
     dependencies = ["nokogiri"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h023ykrrra74bpbibkyg083kafaswvraw4naw9p1ghcjzn9ggj3";
+      sha256 = "0kbv0j82zf90sc9hhwna2bkb5zv0nxagk22gxyfy82kjmcz71c6k";
       type = "gem";
     };
-    version = "2.1.12";
+    version = "2.3.2";
   };
   redcarpet = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h9qz2hik4s9knpmbwrzb3jcp3vc5vygp9ya8lcpl7f1l9khmcd7";
+      sha256 = "0skcyx1h8b5ms0rp2zm3ql6g322b8c1adnkwkqyv7z3kypb4bm7k";
       type = "gem";
     };
-    version = "3.4.0";
+    version = "3.5.0";
   };
   rex-arch = {
     dependencies = ["rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1izzalmjwdyib8y0xlgys8qb60di6xyjk485ylgh14p47wkyc6yp";
+      sha256 = "0cvdy2ysiphdig258lkicbxqq2y47bkl69kgj4kkj8w338rb5kwa";
       type = "gem";
     };
-    version = "0.1.11";
+    version = "0.1.13";
   };
   rex-bin_tools = {
     dependencies = ["metasm" "rex-arch" "rex-core" "rex-struct2" "rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01hi1cjr68adp47nxbjfprvn0r3b72r4ib82x9j33bf2pny6nvaw";
+      sha256 = "19q4cj7cis29k3zx9j2gp4h3ib0zig2fa4rs56c1gjr32f192zzk";
       type = "gem";
     };
-    version = "0.1.4";
+    version = "0.1.6";
   };
   rex-core = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16dwf4pw7bpx8xvlv241imxvwhvjfv0cw9kl7ipsv40yazy5lzpk";
+      sha256 = "1b9pf7f8m2zjck65dpp8h8v4n0a05kfas6cn9adv0w8d9z58aqvv";
       type = "gem";
     };
-    version = "0.1.12";
+    version = "0.1.13";
   };
   rex-encoder = {
     dependencies = ["metasm" "rex-arch" "rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1zm5jdxgyyp8pkfqwin34izpxdrmglx6vmk20ifnvcsm55c9m70z";
···
   };
   rex-exploitation = {
     dependencies = ["jsobfu" "metasm" "rex-arch" "rex-encoder" "rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0gbj28jqaaldpk4qzysgcl6m0wcqx3gcldarqdk55p5z9zasrk19";
+      sha256 = "0b2jg7mccwc34j9mfpndh7b387723qas38qsd906bs4s8b6hf05c";
       type = "gem";
     };
-    version = "0.1.14";
+    version = "0.1.21";
   };
   rex-java = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0j58k02p5g9snkpak64sb4aymkrvrh9xpqh8wsnya4w7b86w2y6i";
···
   };
   rex-mime = {
     dependencies = ["rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "15a14kz429h7pn81ysa6av3qijxjmxagjff6dyss5v394fxzxf4a";
···
   };
   rex-nop = {
     dependencies = ["rex-arch"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0aigf9qsqsmiraa6zvfy1a7cyvf7zc3iyhzxi6fjv5sb8f64d6ny";
···
   };
   rex-ole = {
     dependencies = ["rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1pnzbqfnvbs0vc0z0ryszk3fxhgxrjd6gzwqa937rhlphwp5jpww";
···
   };
   rex-powershell = {
     dependencies = ["rex-random_identifier" "rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nl60fdd1rlckk95d3s3y873w84vb0sgwvwxdzv414qxz8icpjnm";
+      sha256 = "1fcyiz8cgcv6pcn5w969ac4wwhr1cz6jk6kf6p8gyw5rjrlwfz0j";
       type = "gem";
     };
-    version = "0.1.72";
+    version = "0.1.82";
   };
   rex-random_identifier = {
     dependencies = ["rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cksrljaw61mdjvbmj9vqqhd8nra7jv466w5nim47n73rj72jc19";
+      sha256 = "0fg94sczff5c2rlvqqgw2dndlqyzjil5rjk3p9f46ss2hc8zxlbk";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "0.1.4";
   };
   rex-registry = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0wv812ghnz143vx10ixmv32ypj1xrzr4rh4kgam8d8wwjwxsgw1q";
···
   };
   rex-rop_builder = {
     dependencies = ["metasm" "rex-core" "rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0xjd3d6wnbq4ym0d0m268md8fb16f2hbwrahvxnl14q63fj9i3wy";
···
   };
   rex-socket = {
     dependencies = ["rex-core"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bkr64qrfy2mcv6cpp2z2rn9npgn9s0yyagzjh7kawbm80ldwf2h";
+      sha256 = "136szyv31fcdzmcgs44vg009k3ssyawkqppkhm3xyv2ivpp1mlgv";
       type = "gem";
     };
-    version = "0.1.8";
+    version = "0.1.17";
   };
   rex-sslscan = {
     dependencies = ["rex-core" "rex-socket" "rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "06gbx45q653ajcx099p0yxdqqxazfznbrqshd4nwiwg1p498lmyx";
···
     version = "0.1.5";
   };
   rex-struct2 = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1nbdn53264a20cr2m2nq2v4mg0n33dvrd1jj1sixl37qjzw2k452";
···
     version = "0.1.2";
   };
   rex-text = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "024miva867h4wv4y1lnxxrw2d7p51va32ismxqf3fsz4s9cqc88m";
+      sha256 = "0cmfwzd3r6xzhaw5l2grgiivql1yynh620drg8h39q8hiixya6xz";
       type = "gem";
     };
-    version = "0.2.15";
+    version = "0.2.23";
   };
   rex-zip = {
     dependencies = ["rex-text"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1mbfryyhcw47i7jb8cs8vilbyqgyiyjkfl1ngl6wdbf7d87dwdw7";
···
     version = "0.1.3";
   };
   rkelly-remix = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1g7hjl9nx7f953y7lncmfgp0xgxfxvgfm367q6da9niik6rp1y3j";
···
     };
     version = "0.0.7";
   };
-  robots = {
+  ruby-macho = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "141gvihcr2c0dpzl3dqyh8kqc9121prfdql2iamaaw0mf9qs3njs";
+      sha256 = "1k5vvk9d13pixhbram6fs74ibgmr2dngv7bks13npcjb42q275if";
       type = "gem";
     };
-    version = "0.10.1";
+    version = "2.2.0";
   };
   ruby-rc4 = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "00vci475258mmbvsdqkmqadlwn6gj9m01sp7b5a3zd90knil1k00";
···
   };
   ruby_smb = {
     dependencies = ["bindata" "rubyntlm" "windows_error"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jby5wlppxhc2jlqldic05aqd5l57171lsxqv86702grk665n612";
+      sha256 = "125pimmaskp13nkk5j138nfk1kd8n91sfdlx4dhj2j9zk342wsf4";
       type = "gem";
     };
-    version = "0.0.18";
+    version = "1.1.0";
   };
   rubyntlm = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1p6bxsklkbcqni4bcq6jajc2n57g0w5rzn4r49c3lb04wz5xg0dy";
···
     version = "0.6.2";
   };
   rubyzip = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06js4gznzgh8ac2ldvmjcmg9v1vg9llm357yckkpylaj6z456zqz";
+      sha256 = "1w9gw28ly3zyqydnm8phxchf4ymyjl2r7zf7c12z8kla10cpmhlc";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.2.3";
   };
   sawyer = {
     dependencies = ["addressable" "faraday"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sv1463r7bqzvx4drqdmd36m7rrv6sf1v3c6vswpnq3k6vdw2dvd";
+      sha256 = "0yrdchs3psh583rjapkv33mljdivggqn99wkydkjdckcjn43j3cz";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.8.2";
+  };
+  sinatra = {
+    dependencies = ["rack" "rack-protection" "tilt"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0byxzl7rx3ki0xd7aiv1x8mbah7hzd8f81l65nq8857kmgzj1jqq";
+      type = "gem";
+    };
+    version = "1.4.8";
   };
   sqlite3 = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01ifzp8nwzqppda419c9wcvr8n82ysmisrs0hph9pdmv1lpa4f5i";
+      sha256 = "1v903nbcws3ifm6jnxrdfcpgl1qg2x3lbif16mhlbyfn0npzb494";
       type = "gem";
     };
-    version = "1.3.13";
+    version = "1.4.1";
   };
   sshkey = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g02lh50jd5z4l9bp7xirnfn3n1dh9lr06dv3xh0kr3yhsny059h";
+      sha256 = "03bkn55qsng484iqwz2lmm6rkimj01vsvhwk661s3lnmpkl65lbp";
       type = "gem";
     };
-    version = "1.9.0";
+    version = "2.0.0";
+  };
+  thin = {
+    dependencies = ["daemons" "eventmachine" "rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nagbf9pwy1vg09k6j4xqhbjjzrg5dwzvkn4ffvlj76fsn6vv61f";
+      type = "gem";
+    };
+    version = "1.7.2";
   };
   thor = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nmqpyj642sk4g16nkbq6pj856adpv91lp4krwhqkh2iw63aszdl";
+      sha256 = "1yhrnp9x8qcy5vc7g438amd5j9sw83ih7c30dr6g6slgw9zj3g29";
       type = "gem";
     };
-    version = "0.20.0";
+    version = "0.20.3";
   };
   thread_safe = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0nmhcgq6cgz44srylra07bmaw99f5271l0dpsvl5f75m44l0gmwy";
···
     };
     version = "0.3.6";
   };
+  tilt = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ca4k0clwf0rkvy7726x4nxpjxkpv67w043i39saxgldxd97zmwz";
+      type = "gem";
+    };
+    version = "2.0.9";
+  };
   ttfunk = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1mgrnqla5n51v4ivn844albsajkck7k6lviphfqa8470r46c58cd";
···
   };
   tzinfo = {
     dependencies = ["thread_safe"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05r81lk7q7275rdq7xipfm0yxgqyd2ggh73xpc98ypngcclqcscl";
+      sha256 = "1fjx9j327xpkkdlxwmkl3a8wqj7i4l4jwlrv3z13mg95z9wl253z";
       type = "gem";
     };
-    version = "1.2.3";
+    version = "1.2.5";
   };
   tzinfo-data = {
     dependencies = ["tzinfo"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n83rmy476d4qmzq74qx0j7lbcpskbvrj1bmy3np4d5pydyw2yky";
+      sha256 = "1m507in0d7vlfgasxpkz3y1a44zp532k9qlqcaz90ay939sz9h5q";
       type = "gem";
     };
-    version = "1.2017.2";
+    version = "1.2019.2";
+  };
+  warden = {
+    dependencies = ["rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0va966lhpylcwbqb9n151kkihx30agh0a57mwjwdxyanll4s1q12";
+      type = "gem";
+    };
+    version = "1.2.7";
   };
   windows_error = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0kbcv9j5sc7pvjzf1dkp6h69i6lmj205zyy2arxcfgqg11bsz2kp";
···
   };
   xdr = {
     dependencies = ["activemodel" "activesupport"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "0c5cp1k4ij3xq1q6fb0f6xv5b65wy18y7bhwvsdx8wd0zyg3x96m";
···
     version = "2.0.0";
   };
   xmlrpc = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
       sha256 = "1s744iwblw262gj357pky3d9fcx9hisvla7rnw29ysn5zsb6i683";

pkgs/tools/security/pinentry/default.nix

···
     license = licenses.gpl2Plus;
     platforms = platforms.all;
     longDescription = ''
-      Pinentry provides a console and (optional) GTK+ and Qt GUIs allowing users
+      Pinentry provides a console and (optional) GTK and Qt GUIs allowing users
       to enter a passphrase when `gpg' or `gpg2' is run and needs it.
     '';
     maintainers = [ maintainers.ttuegel ];

pkgs/tools/system/netdata/default.nix

···
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "1.16.0";
+  version = "1.17.0";
   pname = "netdata";
 
   src = fetchurl {
     url = "https://github.com/netdata/netdata/releases/download/v${version}/netdata-v${version}.tar.gz";
-    sha256 = "0kwbrkv7g9m7l580myd2r8bpxqn6fxmx5vd6xh7x94wygfffhann";
+    sha256 = "099xvndf5lql4ipwqhm38lpc65yicmpmkk3a7c2j4m48l3vqw9y6";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];

pkgs/tools/system/stress-ng/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "stress-ng";
-  version = "0.10.01";
+  version = "0.10.02";
 
   src = fetchurl {
     url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0gcgm96prkzysszgq34cpx30y0bx9b5zll7943zwg3941fkg4x2a";
+    sha256 = "100daxz0j80jhmpfnqa78mvfwq1qj7zb67y7w9f747a0f1havvim";
   };
 
   # All platforms inputs then Linux-only ones

pkgs/top-level/aliases.nix

···
   ucsFonts = ucs-fonts; # added 2016-07-15
   ultrastardx-beta = ultrastardx; # added 2017-08-12
   usb_modeswitch = usb-modeswitch; # added 2016-05-10
+  usbguard-nox = usbguard; # added 2019-09-04
   v4l_utils = v4l-utils; # added 2019-08-07
   vimbWrapper = vimb; # added 2015-01
   vimprobable2Wrapper = vimprobable2; # added 2015-01
   virtviewer = virt-viewer; # added 2015-12-24
   vorbisTools = vorbis-tools; # added 2016-01-26
   webkit = webkitgtk; # added 2019-03-05
-  weechat-xmpp = weechatScripts.weechat-xmpp; # added 2018-09-06
   weechat-matrix-bridge = weechatScripts.weechat-matrix-bridge; # added 2018-09-06
   wineStaging = wine-staging; # added 2018-01-08
   winusb = woeusb; # added 2017-12-22

pkgs/top-level/all-packages.nix

···
     inherit url;
   };
 
+  installShellFiles = callPackage ../build-support/install-shell-files {};
+
   lazydocker = callPackage ../tools/misc/lazydocker { };
 
   ld-is-cc-hook = makeSetupHook { name = "ld-is-cc-hook"; }
···
   nixBufferBuilders = import ../build-support/emacs/buffer.nix { inherit (pkgs) lib writeText; inherit (emacsPackages) inherit-local; };
 
   nix-gitignore = callPackage ../build-support/nix-gitignore { };
+
+  ociTools = callPackage ../build-support/oci-tools { };
 
   pathsFromGraph = ../build-support/kernel/paths-from-graph.pl;
 
···
   nrg2iso = callPackage ../tools/cd-dvd/nrg2iso { };
 
   libceph = ceph.lib;
-  ceph = callPackage ../tools/filesystems/ceph {
-    boost = boost166.override { enablePython = true; };
-  };
+  inherit (callPackages ../tools/filesystems/ceph {
+    boost = boost167.override { enablePython = true; python = python37; };
+  })
+    ceph
+    ceph-client;
   ceph-dev = ceph;
 
   inherit (callPackages ../tools/security/certmgr { })
···
 
   elementary-cmake-modules = callPackage ../development/libraries/elementary-cmake-modules { };
 
-  gtk2 = callPackage ../development/libraries/gtk+/2.x.nix {
+  gtk2 = callPackage ../development/libraries/gtk/2.x.nix {
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
   };
 
···
     gdktarget = "x11";
   };
 
-  gtk3 = callPackage ../development/libraries/gtk+/3.x.nix {
+  gtk3 = callPackage ../development/libraries/gtk/3.x.nix {
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
   };
 
···
     withGUI = false;
   };
 
-  mlt = callPackage ../development/libraries/mlt {};
+  mlt = callPackage ../development/libraries/mlt { ffmpeg = ffmpeg_4; };
 
   mono-addins = callPackage ../development/libraries/mono-addins { };
 
···
     kpmcore = callPackage ../development/libraries/kpmcore { };
 
     mlt = callPackage ../development/libraries/mlt/qt-5.nix {
-      ffmpeg = ffmpeg_2;
+      ffmpeg = ffmpeg_4;
     };
 
     openbr = callPackage ../development/libraries/openbr { };
···
   prometheus-openvpn-exporter = callPackage ../servers/monitoring/prometheus/openvpn-exporter.nix { };
   prometheus-postfix-exporter = callPackage ../servers/monitoring/prometheus/postfix-exporter.nix { };
   prometheus-postgres-exporter = callPackage ../servers/monitoring/prometheus/postgres-exporter.nix { };
+  prometheus-process-exporter = callPackage ../servers/monitoring/prometheus/process-exporter.nix { };
   prometheus-pushgateway = callPackage ../servers/monitoring/prometheus/pushgateway.nix { };
   prometheus-rabbitmq-exporter = callPackage ../servers/monitoring/prometheus/rabbitmq-exporter.nix { };
   prometheus-snmp-exporter = callPackage ../servers/monitoring/prometheus/snmp-exporter.nix {
···
 
     perf = callPackage ../os-specific/linux/kernel/perf.nix { };
 
-    phc-intel = callPackage ../os-specific/linux/phc-intel { };
+    phc-intel = if stdenv.lib.versionAtLeast kernel.version "4.10" then callPackage ../os-specific/linux/phc-intel { } else null;
 
     # Disable for kernels 4.15 and above due to compatibility issues
     prl-tools = if stdenv.lib.versionOlder kernel.version "4.15" then callPackage ../os-specific/linux/prl-tools { } else null;
···
 
   upower = callPackage ../os-specific/linux/upower { };
 
-  usbguard = libsForQt5.callPackage ../os-specific/linux/usbguard {
+  usbguard = callPackage ../os-specific/linux/usbguard {
     libgcrypt = null;
-  };
-
-  usbguard-nox = usbguard.override {
-    withGui = false;
   };
 
   usbtop = callPackage ../os-specific/linux/usbtop { };
···
   metersLv2 = callPackage ../applications/audio/meters_lv2 { };
 
   mhwaveedit = callPackage ../applications/audio/mhwaveedit {};
+
+  michabo = libsForQt5.callPackage ../applications/misc/michabo { };
 
   mid2key = callPackage ../applications/audio/mid2key { };
 
···
   nix-review = callPackage ../tools/package-management/nix-review { };
 
   nix-serve = callPackage ../tools/package-management/nix-serve { };
+
+  nixfmt = haskell.lib.justStaticExecutables haskellPackages.nixfmt;
 
   nixpkgs-fmt = callPackage ../tools/nix/nixpkgs-fmt { };
 

pkgs/top-level/perl-packages.nix

···
     };
     propagatedBuildInputs = [ pkgs.gtk3 CairoGObject GlibObjectIntrospection ];
     meta = {
-      description = "Perl interface to the 3.x series of the gtk+ toolkit";
+      description = "Perl interface to the 3.x series of the GTK toolkit";
       license = stdenv.lib.licenses.lgpl21Plus;
     };
   };
···
     };
     propagatedBuildInputs = [ AlienWxWidgets ];
     # Testing requires an X server:
-    #   Error: Unable to initialize GTK+, is DISPLAY set properly?"
+    #   Error: Unable to initialize GTK, is DISPLAY set properly?"
     doCheck = false;
     buildInputs = [ ExtUtilsXSpp ];
   };

pkgs/top-level/python-packages.nix

···
 
   ijson = callPackage ../development/python-modules/ijson {};
 
+  imagecodecs-lite = disabledIf (!isPy3k) (callPackage ../development/python-modules/imagecodecs-lite { });
+
   imagesize = callPackage ../development/python-modules/imagesize { };
 
   image-match = callPackage ../development/python-modules/image-match { };
···
 
   pyupdate = callPackage ../development/python-modules/pyupdate {};
 
+  pyvmomi = callPackage ../development/python-modules/pyvmomi { };
+
   pyx = callPackage ../development/python-modules/pyx { };
 
   mmpython = callPackage ../development/python-modules/mmpython { };
···
   x256 = callPackage ../development/python-modules/x256 { };
 
   yattag = callPackage ../development/python-modules/yattag { };
+
+  xenomapper = disabledIf (!isPy3k) (callPackage ../applications/science/biology/xenomapper { });
 
   z3 = (toPythonModule (pkgs.z3.override {
     inherit python;

pkgs/top-level/release.nix

···
               # Needed for support
               jobs.nix-info.x86_64-linux
               jobs.nix-info-tested.x86_64-linux
-              # Ensure that X11/GTK+ are in order.
+              # Ensure that X11/GTK are in order.
               jobs.thunderbird.x86_64-linux
               jobs.unar.x86_64-linux