Merge branch 'staging' into glibc230

doc/languages-frameworks/python.section.md

@@ -833,6 +833,7 @@ used in `buildPythonPackage`.
 - `pythonRemoveBinBytecode` to remove bytecode from the `/bin` folder.
 - `setuptoolsBuildHook` to build a wheel using `setuptools`.
 - `setuptoolsCheckHook` to run tests with `python setup.py test`.
+- `venvShellHook` to source a Python 3 `venv` at the `venvDir` location. A `venv` is created if it does not yet exist.
 - `wheelUnpackHook` to move a wheel to the correct folder so it can be installed with the `pipInstallHook`.
 
 ### Development mode

doc/languages-frameworks/rust.section.md

@@ -32,17 +32,17 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust
 
 ```
 rustPlatform.buildRustPackage rec {
-  name = "ripgrep-${version}";
+  pname = "ripgrep";
-  version = "0.4.0";
+  version = "11.0.2";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
-    repo = "ripgrep";
+    repo = pname;
-    rev = "${version}";
+    rev = version;
-    sha256 = "0y5d1n6hkw85jb3rblcxqas2fp82h3nghssa4xqrhqnz25l799pj";
+    sha256 = "1iga3320mgi7m853la55xip514a3chqsdi1a1rwv25lr9b1p7vd3";
   };
 
-  cargoSha256 = "0q68qyl2h6i0qsz82z840myxlnjay8p1w5z7hfyr8fqp7wgwa9cx";
+  cargoSha256 = "17ldqr3asrdcsh4l29m3b5r37r5d0b3npq1lrgjmxb6vlx6a36qh";
   verifyCargoDeps = true;
 
   meta = with stdenv.lib; {
@@ -66,7 +66,11 @@ added in `cargoPatches` will also be prepended to the patches in `patches` at
 build-time.
 
 When `verifyCargoDeps` is set to `true`, the build will also verify that the
-`cargoSha256` is not out of date by comparing the `Cargo.lock` file in both the `cargoDeps` and `src`. Note that this option changes the value of `cargoSha256` since it also copies the `Cargo.lock` in it. To avoid breaking backward-compatibility this option is not enabled by default but hopefully will be in the future.
+`cargoSha256` is not out of date by comparing the `Cargo.lock` file in both the
+`cargoDeps` and `src`. Note that this option changes the value of `cargoSha256`
+since it also copies the `Cargo.lock` in it. To avoid breaking
+backward-compatibility this option is not enabled by default but hopefully will
+be in the future.
 
 ### Building a crate for a different target
 

doc/overrides.css

@@ -1,9 +1,22 @@
 .docbook .xref img[src^=images\/callouts\/],
 .screen img,
-.programlisting img {
+.programlisting img,
+.literallayout img,
+.synopsis img {
     width: 1em;
 }
 
 .calloutlist img {
     width: 1.5em;
 }
+
+.prompt,
+.screen img,
+.programlisting img,
+.literallayout img,
+.synopsis img {
+    -moz-user-select: none;
+    -webkit-user-select: none;
+    -ms-user-select: none;
+    user-select: none;
+}

lib/cli.nix

@@ -0,0 +1,56 @@
+{ lib }:
+
+rec {
+  /* Automatically convert an attribute set to command-line options.
+
+     This helps protect against malformed command lines and also to reduce
+     boilerplate related to command-line construction for simple use cases.
+
+     Example:
+       encodeGNUCommandLine
+         { }
+         { data = builtins.toJSON { id = 0; };
+
+           X = "PUT";
+
+           retry = 3;
+
+           retry-delay = null;
+
+           url = [ "https://example.com/foo" "https://example.com/bar" ];
+
+           silent = false;
+
+           verbose = true;
+         };
+       => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'"
+  */
+  encodeGNUCommandLine =
+    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+
+  toGNUCommandLine =
+    { renderKey ?
+        key: if builtins.stringLength key == 1 then "-${key}" else "--${key}"
+
+    , renderOption ?
+        key: value:
+          if value == null
+          then []
+          else [ (renderKey key) (builtins.toString value) ]
+
+    , renderBool ? key: value: lib.optional value (renderKey key)
+
+    , renderList ? key: value: lib.concatMap (renderOption key) value
+    }:
+    options:
+      let
+        render = key: value:
+                 if builtins.isBool value
+            then renderBool key value
+            else if builtins.isList value
+            then renderList key value
+            else renderOption key value;
+
+      in
+        builtins.concatLists (lib.mapAttrsToList render options);
+}

lib/default.nix

@@ -39,6 +39,7 @@ let
 
     # misc
     asserts = callLibs ./asserts.nix;
+    cli = callLibs ./cli.nix;
     debug = callLibs ./debug.nix;
     generators = callLibs ./generators.nix;
     misc = callLibs ./deprecated.nix;
@@ -100,7 +101,7 @@ let
     inherit (sources) pathType pathIsDirectory cleanSourceFilter
       cleanSource sourceByRegex sourceFilesBySuffices
       commitIdFromGitRepo cleanSourceWith pathHasContext
-      canCleanSource;
+      canCleanSource pathIsRegularFile;
     inherit (modules) evalModules unifyModuleSyntax
       applyIfFunction mergeModules
       mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
@@ -120,6 +121,7 @@ let
       isOptionType mkOptionType;
     inherit (asserts)
       assertMsg assertOneOf;
+    inherit (cli) encodeGNUCommandLine toGNUCommandLine;
     inherit (debug) addErrorContextToAttrs traceIf traceVal traceValFn
       traceXMLVal traceXMLValMarked traceSeq traceSeqN traceValSeq
       traceValSeqFn traceValSeqN traceValSeqNFn traceShowVal

lib/sources.nix

@@ -9,6 +9,9 @@ rec {
   # Returns true if the path exists and is a directory, false otherwise
   pathIsDirectory = p: if builtins.pathExists p then (pathType p) == "directory" else false;
 
+  # Returns true if the path exists and is a regular file, false otherwise
+  pathIsRegularFile = p: if builtins.pathExists p then (pathType p) == "regular" else false;
+
   # Bring in a path as a source, filtering out all Subversion and CVS
   # directories, as well as backup files (*~).
   cleanSourceFilter = name: type: let baseName = baseNameOf (toString name); in ! (
@@ -110,24 +113,43 @@ rec {
       with builtins;
         let fileName       = toString path + "/" + file;
             packedRefsName = toString path + "/packed-refs";
-        in if lib.pathExists fileName
+        in if pathIsRegularFile path
+           # Resolve git worktrees. See gitrepository-layout(5)
            then
-             let fileContent = lib.fileContents fileName;
+             let m   = match "^gitdir: (.*)$" (lib.fileContents path);
+             in if m == null
+                then throw ("File contains no gitdir reference: " + path)
+                else
+                  let gitDir     = lib.head m;
+                      commonDir' = if pathIsRegularFile "${gitDir}/commondir"
+                                   then lib.fileContents "${gitDir}/commondir"
+                                   else gitDir;
+                      commonDir  = if lib.hasPrefix "/" commonDir'
+                                   then commonDir'
+                                   else toString (/. + "${gitDir}/${commonDir'}");
+                      refFile    = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
+                  in readCommitFromFile refFile commonDir
+
+           else if pathIsRegularFile fileName
            # Sometimes git stores the commitId directly in the file but
            # sometimes it stores something like: «ref: refs/heads/branch-name»
+           then
+             let fileContent = lib.fileContents fileName;
                  matchRef    = match "^ref: (.*)$" fileContent;
              in if  matchRef == null
                 then fileContent
                 else readCommitFromFile (lib.head matchRef) path
+
+           else if pathIsRegularFile packedRefsName
            # Sometimes, the file isn't there at all and has been packed away in the
            # packed-refs file, so we have to grep through it:
-           else if lib.pathExists packedRefsName
            then
              let fileContent = readFile packedRefsName;
                  matchRef    = match (".*\n([^\n ]*) " + file + "\n.*") fileContent;
              in if  matchRef == null
                 then throw ("Could not find " + file + " in " + packedRefsName)
                 else lib.head matchRef
+
            else throw ("Not a .git directory: " + path);
     in readCommitFromFile "HEAD";
 

lib/tests/misc.nix

@@ -441,4 +441,25 @@ runTests {
     expected  = "«foo»";
   };
 
+  testRenderOptions = {
+    expr =
+       encodeGNUCommandLine
+         { }
+         { data = builtins.toJSON { id = 0; };
+
+           X = "PUT";
+
+           retry = 3;
+
+           retry-delay = null;
+
+           url = [ "https://example.com/foo" "https://example.com/bar" ];
+
+           silent = false;
+
+           verbose = true;
+         };
+
+    expected = "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+  };
 }

lib/tests/modules.sh

@@ -174,8 +174,7 @@ checkConfigOutput "true" config.submodule.inner ./declare-submoduleWith-modules.
 checkConfigOutput "true" config.submodule.outer ./declare-submoduleWith-modules.nix
 
 ## Paths should be allowed as values and work as expected
-# Temporarily disabled until https://github.com/NixOS/nixpkgs/pull/76861
+checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix
-#checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix
 
 # Check that disabledModules works recursively and correctly
 checkConfigOutput "true" config.enable ./disable-recursive/main.nix

lib/trivial.nix

@@ -191,7 +191,7 @@ rec {
     let
       revisionFile = "${toString ./..}/.git-revision";
       gitRepo      = "${toString ./..}/.git";
-    in if lib.pathIsDirectory gitRepo
+    in if builtins.pathExists gitRepo
        then lib.commitIdFromGitRepo gitRepo
        else if lib.pathExists revisionFile then lib.fileContents revisionFile
        else default;

lib/types.nix

@@ -340,18 +340,68 @@ rec {
             let
               padWidth = stringLength (toString (length def.value));
               unnamed = i: unnamedPrefix + fixedWidthNumber padWidth i;
+              anyString = placeholder "name";
+              nameAttrs = [
+                { path = [ "environment" "etc" ];
+                  name = "target";
+                }
+                { path = [ "containers" anyString "bindMounts" ];
+                  name = "mountPoint";
+                }
+                { path = [ "programs" "ssh" "knownHosts" ];
+                  # hostNames is actually a list so we would need to handle it only when singleton
+                  name = "hostNames";
+                }
+                { path = [ "fileSystems" ];
+                  name = "mountPoint";
+                }
+                { path = [ "boot" "specialFileSystems" ];
+                  name = "mountPoint";
+                }
+                { path = [ "services" "znapzend" "zetup" ];
+                  name = "dataset";
+                }
+                { path = [ "services" "znapzend" "zetup" anyString "destinations" ];
+                  name = "label";
+                }
+                { path = [ "services" "geoclue2" "appConfig" ];
+                  name = "desktopID";
+                }
+              ];
+              matched = let
+                equals = a: b: b == anyString || a == b;
+                fallback = { name = "name"; };
+              in findFirst ({ path, ... }: all (v: v == true) (zipListsWith equals loc path)) fallback nameAttrs;
+              nameAttr = matched.name;
+              nameValueOld = value:
+                if isList value then
+                  if length value > 0 then
+                    "[ " + concatMapStringsSep " " escapeNixString value + " ]"
+                  else
+                    "[ ]"
+                else
+                  escapeNixString value;
+              nameValueNew = value: unnamed:
+                if isList value then
+                  if length value > 0 then
+                    head value
+                  else
+                    unnamed
+                else
+                  value;
               res =
                 { inherit (def) file;
                   value = listToAttrs (
                     imap1 (elemIdx: elem:
-                      { name  = elem.name or (unnamed elemIdx);
+                      { name  = nameValueNew (elem.${nameAttr} or (unnamed elemIdx)) (unnamed elemIdx);
                         value = elem;
                       }) def.value);
                 };
               option = concatStringsSep "." loc;
               sample = take 3 def.value;
-              list = concatMapStrings (x: ''{ name = "${x.name or "unnamed"}"; ...} '') sample;
+              more = lib.optionalString (length def.value > 3) "... ";
-              set = concatMapStrings (x: ''${x.name or "unnamed"} = {...}; '') sample;
+              list = concatMapStrings (x: ''{ ${nameAttr} = ${nameValueOld (x.${nameAttr} or "unnamed")}; ...} '') sample;
+              set = concatMapStrings (x: ''${nameValueNew (x.${nameAttr} or "unnamed") "unnamed"} = {...}; '') sample;
               msg = ''
                 In file ${def.file}
                 a list is being assigned to the option config.${option}.
@@ -359,10 +409,10 @@ rec {
                 See https://git.io/fj2zm for more information.
                 Do
                   ${option} =
-                    { ${set}...}
+                    { ${set}${more}}
                 instead of
                   ${option} =
-                    [ ${list}...]
+                    [ ${list}${more}]
               '';
             in
               lib.warn msg res
@@ -430,14 +480,16 @@ rec {
           else unify (if shorthandOnlyDefinesConfig then { config = value; } else value);
 
         allModules = defs: modules ++ imap1 (n: { value, file }:
+          if isAttrs value || isFunction value then
             # Annotate the value with the location of its definition for better error messages
             coerce (lib.modules.unifyModuleSyntax file "${toString file}-${toString n}") value
+          else value
         ) defs;
 
       in
       mkOptionType rec {
         name = "submodule";
-        check = x: isAttrs x || isFunction x;
+        check = x: isAttrs x || isFunction x || path.check x;
         merge = loc: defs:
           (evalModules {
             modules = allModules defs;
@@ -538,7 +590,7 @@ rec {
         tail' = tail ts;
       in foldl' either head' tail';
 
-    # Either value of type `finalType` or `coercedType`, the latter is
+    # Either value of type `coercedType` or `finalType`, the former is
     # converted to `finalType` using `coerceFunc`.
     coercedTo = coercedType: coerceFunc: finalType:
       assert lib.assertMsg (coercedType.getSubModules == null)
@@ -547,12 +599,12 @@ rec {
       mkOptionType rec {
         name = "coercedTo";
         description = "${finalType.description} or ${coercedType.description} convertible to it";
-        check = x: finalType.check x || (coercedType.check x && finalType.check (coerceFunc x));
+        check = x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
         merge = loc: defs:
           let
             coerceVal = val:
-              if finalType.check val then val
+              if coercedType.check val then coerceFunc val
-              else coerceFunc val;
+              else val;
           in finalType.merge loc (map (def: def // { value = coerceVal def.value; }) defs);
         emptyValue = finalType.emptyValue;
         getSubOptions = finalType.getSubOptions;

maintainers/maintainer-list.nix

@@ -505,6 +505,12 @@
     githubId = 750786;
     name = "Justin Wood";
   };
+  anmonteiro = {
+    email = "anmonteiro@gmail.com";
+    github = "anmonteiro";
+    githubId = 661909;
+    name = "Antonio Nuno Monteiro";
+  };
   anpryl = {
     email = "anpryl@gmail.com";
     github = "anpryl";
@@ -2433,6 +2439,12 @@
     githubId = 844574;
     name = "Daniel Austin";
   };
+  flyfloh = {
+    email = "nix@halbmastwurf.de";
+    github = "flyfloh";
+    githubId = 74379;
+    name = "Florian Pester";
+  };
   fmthoma = {
     email = "f.m.thoma@googlemail.com";
     github = "fmthoma";
@@ -4430,6 +4442,12 @@
     githubId = 158568;
     name = "Matthias C. M. Troffaes";
   };
+  McSinyx = {
+    email = "vn.mcsinyx@gmail.com";
+    github = "McSinyx";
+    githubId = 13689192;
+    name = "Nguyễn Gia Phong";
+  };
   mdaiter = {
     email = "mdaiter8121@gmail.com";
     github = "mdaiter";
@@ -5070,6 +5088,12 @@
     githubId = 7588406;
     name = "Andrew R. M.";
   };
+  nloomans = {
+    email = "noah@nixos.noahloomans.com";
+    github = "nloomans";
+    githubId = 7829481;
+    name = "Noah Loomans";
+  };
   nmattia = {
     email = "nicolas@nmattia.com";
     github = "nmattia";
@@ -7014,6 +7038,11 @@
     github = "timbertson";
     name = "Tim Cuthbertson";
   };
+  timma = {
+    email = "kunduru.it.iitb@gmail.com";
+    github = "ktrsoft";
+    name = "Timma";
+  };
   timokau = {
     email = "timokau@zoho.com";
     github = "timokau";

nixos/doc/manual/development/option-types.xml

@@ -257,9 +257,9 @@
     <listitem>
      <para>
       A set of sub options <replaceable>o</replaceable>.
-      <replaceable>o</replaceable> can be an attribute set or a function
+      <replaceable>o</replaceable> can be an attribute set, a function
-      returning an attribute set. Submodules are used in composed types to
+      returning an attribute set, or a path to a file containing such a value. Submodules are used in
-      create modular options. This is equivalent to
+      composed types to create modular options. This is equivalent to
       <literal>types.submoduleWith { modules = toList o; shorthandOnlyDefinesConfig = true; }</literal>.
       Submodules are detailed in
       <xref

nixos/doc/manual/man-pages.xml

@@ -6,7 +6,7 @@
   <author><personname><firstname>Eelco</firstname><surname>Dolstra</surname></personname>
    <contrib>Author</contrib>
   </author>
-  <copyright><year>2007-2019</year><holder>Eelco Dolstra</holder>
+  <copyright><year>2007-2020</year><holder>Eelco Dolstra</holder>
   </copyright>
  </info>
  <xi:include href="man-configuration.xml" />

nixos/doc/manual/release-notes/rl-2003.xml

@@ -391,6 +391,16 @@ users.users.me =
      <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     For NixOS modules, the types <literal>types.submodule</literal> and <literal>types.submoduleWith</literal> now support
+     paths as allowed values, similar to how <literal>imports</literal> supports paths.
+     Because of this, if you have a module that defines an option of type
+     <literal>either (submodule ...) path</literal>, it will break since a path
+     is now treated as the first type instead of the second. To fix this, change
+     the type to <literal>either path (submodule ...)</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/lib/test-driver/test-driver.py

@@ -704,7 +704,8 @@ class Machine:
 
         def process_serial_output() -> None:
             for _line in self.process.stdout:
-                line = _line.decode("unicode_escape").replace("\r", "").rstrip()
+                # Ignore undecodable bytes that may occur in boot menus
+                line = _line.decode(errors="ignore").replace("\r", "").rstrip()
                 eprint("{} # {}".format(self.name, line))
                 self.logger.enqueue({"msg": line, "machine": self.name})
 

nixos/lib/testing-python.nix

@@ -155,7 +155,7 @@ in rec {
             --add-flags "''${vms[*]}" \
             ${lib.optionalString enableOCR
               "--prefix PATH : '${ocrProg}/bin:${imagemagick_tiff}/bin'"} \
-            --run "export testScript=\"\$(cat $out/test-script)\"" \
+            --run "export testScript=\"\$(${coreutils}/bin/cat $out/test-script)\"" \
             --set VLANS '${toString vlans}'
           ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
           wrapProgram $out/bin/nixos-run-vms \

nixos/modules/hardware/usb-wwan.nix

@@ -21,6 +21,19 @@ with lib;
   ###### implementation
 
   config = mkIf config.hardware.usbWwan.enable {
+    # Attaches device specific handlers.
     services.udev.packages = with pkgs; [ usb-modeswitch-data ];
+
+    # Triggered by udev, usb-modeswitch creates systemd services via a
+    # template unit in the usb-modeswitch package.
+    systemd.packages = with pkgs; [ usb-modeswitch ];
+
+    # The systemd service requires the usb-modeswitch-data. The
+    # usb-modeswitch package intends to discover this via the
+    # filesystem at /usr/share/usb_modeswitch, and merge it with user
+    # configuration in /etc/usb_modeswitch.d. Configuring the correct
+    # path in the package is difficult, as it would cause a cyclic
+    # dependency.
+    environment.etc."usb_modeswitch.d".source = "${pkgs.usb-modeswitch-data}/share/usb_modeswitch";
   };
 }

nixos/modules/misc/version.nix

@@ -91,8 +91,8 @@ in
       # These defaults are set here rather than up there so that
       # changing them would not rebuild the manual
       version = mkDefault (cfg.release + cfg.versionSuffix);
-      revision      = mkIf (pathIsDirectory gitRepo) (mkDefault            gitCommitId);
+      revision      = mkIf (pathExists gitRepo) (mkDefault            gitCommitId);
-      versionSuffix = mkIf (pathIsDirectory gitRepo) (mkDefault (".git." + gitCommitId));
+      versionSuffix = mkIf (pathExists gitRepo) (mkDefault (".git." + gitCommitId));
     };
 
     # Generate /etc/os-release.  See

nixos/modules/module-list.nix

@@ -735,6 +735,7 @@
   ./services/networking/wicd.nix
   ./services/networking/wireguard.nix
   ./services/networking/wpa_supplicant.nix
+  ./services/networking/xandikos.nix
   ./services/networking/xinetd.nix
   ./services/networking/xl2tpd.nix
   ./services/networking/xrdp.nix

nixos/modules/services/continuous-integration/buildbot/master.nix

@@ -222,7 +222,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    users.groups = optional (cfg.group == "buildbot") {
+    users.groups = optionalAttrs (cfg.group == "buildbot") {
       buildbot = { };
     };
 

nixos/modules/services/continuous-integration/buildbot/worker.nix

@@ -136,7 +136,7 @@ in {
   config = mkIf cfg.enable {
     services.buildbot-worker.workerPassFile = mkDefault (pkgs.writeText "buildbot-worker-password" cfg.workerPass);
 
-    users.groups = optional (cfg.group == "bbworker") {
+    users.groups = optionalAttrs (cfg.group == "bbworker") {
       bbworker = { };
     };
 

nixos/modules/services/continuous-integration/jenkins/slave.nix

@@ -50,7 +50,7 @@ in {
   };
 
   config = mkIf (cfg.enable && !masterCfg.enable) {
-    users.groups = optional (cfg.group == "jenkins") {
+    users.groups = optionalAttrs (cfg.group == "jenkins") {
       jenkins.gid = config.ids.gids.jenkins;
     };
 

nixos/modules/services/databases/openldap.nix

@@ -259,6 +259,8 @@ in
           ${openldap.out}/bin/slapadd ${configOpts} -l ${dataFile}
         ''}
         chown -R "${cfg.user}:${cfg.group}" "${cfg.dataDir}"
+
+        ${openldap}/bin/slaptest ${configOpts}
       '';
       serviceConfig.ExecStart =
         "${openldap.out}/libexec/slapd -d '${cfg.logLevel}' " +

nixos/modules/services/hardware/usbmuxd.nix

@@ -51,7 +51,7 @@ in
       };
     };
 
-    users.groups = optional (cfg.group == defaultUserGroup) {
+    users.groups = optionalAttrs (cfg.group == defaultUserGroup) {
       ${cfg.group} = { };
     };
 

nixos/modules/services/mail/postfix.nix

@@ -612,10 +612,7 @@ in
     {
 
       environment = {
-        etc = singleton
+        etc.postfix.source = "/var/lib/postfix/conf";
-          { source = "/var/lib/postfix/conf";
-            target = "postfix";
-          };
 
         # This makes it comfortable to run 'postqueue/postdrop' for example.
         systemPackages = [ pkgs.postfix ];

nixos/modules/services/mail/spamassassin.nix

@@ -124,7 +124,7 @@ in
     # Allow users to run 'spamc'.
 
     environment = {
-      etc = singleton { source = spamdEnv; target = "spamassassin"; };
+      etc.spamassassin.source = spamdEnv;
       systemPackages = [ pkgs.spamassassin ];
     };
 

nixos/modules/services/misc/gitea.nix

@@ -364,7 +364,7 @@ in
           ''}
           sed -e "s,#secretkey#,$KEY,g" \
               -e "s,#dbpass#,$DBPASS,g" \
-              -e "s,#jwtsecet#,$JWTSECET,g" \
+              -e "s,#jwtsecret#,$JWTSECRET,g" \
               -e "s,#mailerpass#,$MAILERPASSWORD,g" \
               -i ${runConfig}
           chmod 640 ${runConfig} ${secretKey} ${jwtSecret}

nixos/modules/services/misc/paperless.nix

@@ -123,9 +123,9 @@ in
   config = mkIf cfg.enable {
 
     systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' - ${cfg.user} ${cfg.user} - -"
+      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
     ] ++ (optional cfg.consumptionDirIsPublic
-      "d '${cfg.consumptionDir}' 777 ${cfg.user} ${cfg.user} - -"
+      "d '${cfg.consumptionDir}' 777 - - - -"
       # If the consumption dir is not created here, it's automatically created by
       # 'manage' with the default permissions.
     );
@@ -169,17 +169,15 @@ in
     };
 
     users = optionalAttrs (cfg.user == defaultUser) {
-      users = [{
+      users.${defaultUser} = {
-        name = defaultUser;
         group = defaultUser;
         uid = config.ids.uids.paperless;
         home = cfg.dataDir;
-      }];
+      };
 
-      groups = [{
+      groups.${defaultUser} = {
-        name = defaultUser;
         gid = config.ids.gids.paperless;
-      }];
+      };
     };
   };
 }

nixos/modules/services/networking/ndppd.nix

@@ -161,7 +161,25 @@ in {
       documentation = [ "man:ndppd(1)" "man:ndppd.conf(5)" ];
       after = [ "network-pre.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+      serviceConfig = {
+        ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+
+        # Sandboxing
+        CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = "AF_INET6 AF_PACKET AF_NETLINK";
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
     };
   };
 }

nixos/modules/services/networking/wpa_supplicant.nix

@@ -233,6 +233,7 @@ in {
       path = [ pkgs.wpa_supplicant ];
 
       script = ''
+        iface_args="-s -u -D${cfg.driver} -c ${configFile}"
         ${if ifaces == [] then ''
           for i in $(cd /sys/class/net && echo *); do
             DEVTYPE=
@@ -240,14 +241,14 @@ in {
             if [ -e "$UEVENT_PATH" ]; then
               source "$UEVENT_PATH"
               if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
-                ifaces="$ifaces''${ifaces:+ -N} -i$i"
+                args+="''${args:+ -N} -i$i $iface_args"
               fi
             fi
           done
         '' else ''
-          ifaces="${concatStringsSep " -N " (map (i: "-i${i}") ifaces)}"
+          args="${concatMapStringsSep " -N " (i: "-i${i} $iface_args") ifaces}"
         ''}
-        exec wpa_supplicant -s -u -D${cfg.driver} -c ${configFile} $ifaces
+        exec wpa_supplicant $args
       '';
     };
 

nixos/modules/services/networking/xandikos.nix

@@ -0,0 +1,148 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xandikos;
+in
+{
+
+  options = {
+    services.xandikos = {
+      enable = mkEnableOption "Xandikos CalDAV and CardDAV server";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.xandikos;
+        defaultText = "pkgs.xandikos";
+        description = "The Xandikos package to use.";
+      };
+
+      address = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = ''
+          The IP address on which Xandikos will listen.
+          By default listens on localhost.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8080;
+        description = "The port of the Xandikos web application";
+      };
+
+      routePrefix = mkOption {
+        type = types.str;
+        default = "/";
+        description = ''
+          Path to Xandikos.
+          Useful when Xandikos is behind a reverse proxy.
+        '';
+      };
+
+      extraOptions = mkOption {
+        default = [];
+        type = types.listOf types.str;
+        example = literalExample ''
+          [ "--autocreate"
+            "--defaults"
+            "--current-user-principal user"
+            "--dump-dav-xml"
+          ]
+        '';
+        description = ''
+          Extra command line arguments to pass to xandikos.
+        '';
+      };
+
+      nginx = mkOption {
+        default = {};
+        description = ''
+          Configuration for nginx reverse proxy.
+        '';
+
+        type = types.submodule {
+          options = {
+            enable = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Configure the nginx reverse proxy settings.
+              '';
+            };
+
+            hostName = mkOption {
+              type = types.str;
+              description = ''
+                The hostname use to setup the virtualhost configuration
+              '';
+            };
+          };
+        };
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.enable (
+    mkMerge [
+      {
+        meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+        systemd.services.xandikos = {
+          description = "A Simple Calendar and Contact Server";
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            User = "xandikos";
+            Group = "xandikos";
+            DynamicUser = "yes";
+            RuntimeDirectory = "xandikos";
+            StateDirectory = "xandikos";
+            StateDirectoryMode = "0700";
+            PrivateDevices = true;
+            # Sandboxing
+            CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+            ProtectSystem = "strict";
+            ProtectHome = true;
+            PrivateTmp = true;
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectControlGroups = true;
+            RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_PACKET AF_NETLINK";
+            RestrictNamespaces = true;
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            ExecStart = ''
+              ${cfg.package}/bin/xandikos \
+                --directory /var/lib/xandikos \
+                --listen_address ${cfg.address} \
+                --port ${toString cfg.port} \
+                --route-prefix ${cfg.routePrefix} \
+                ${lib.concatStringsSep " " cfg.extraOptions}
+            '';
+          };
+        };
+      }
+
+      (
+        mkIf cfg.nginx.enable {
+          services.nginx = {
+            enable = true;
+            virtualHosts."${cfg.nginx.hostName}" = {
+              locations."/" = {
+                proxyPass = "http://${cfg.address}:${toString cfg.port}/";
+              };
+            };
+          };
+        }
+      )
+    ]
+  );
+}

nixos/modules/services/security/certmgr.nix

@@ -113,7 +113,7 @@ in
         otherCert = "/var/certmgr/specs/other-cert.json";
       }
       '';
-      type = with types; attrsOf (either (submodule {
+      type = with types; attrsOf (either path (submodule {
         options = {
           service = mkOption {
             type = nullOr str;
@@ -148,7 +148,7 @@ in
             description = "certmgr spec request object.";
           };
         };
-    }) path);
+    }));
       description = ''
         Certificate specs as described by:
         <link xlink:href="https://github.com/cloudflare/certmgr#certificate-specs" />

nixos/modules/services/torrent/transmission.nix

@@ -129,18 +129,22 @@ in
     # It's useful to have transmission in path, e.g. for remote control
     environment.systemPackages = [ pkgs.transmission ];
 
-    users.users = optionalAttrs (cfg.user == "transmission") (singleton
+    users.users = optionalAttrs (cfg.user == "transmission") ({
-      { name = "transmission";
+      transmission = {
+        name = "transmission";
         group = cfg.group;
         uid = config.ids.uids.transmission;
         description = "Transmission BitTorrent user";
         home = homeDir;
         createHome = true;
+      };
     });
 
-    users.groups = optionalAttrs (cfg.group == "transmission") (singleton
+    users.groups = optionalAttrs (cfg.group == "transmission") ({
-      { name = "transmission";
+      transmission = {
+        name = "transmission";
         gid = config.ids.gids.transmission;
+      };
     });
 
     # AppArmor profile

nixos/tests/all-tests.nix

@@ -295,6 +295,7 @@ in
   wireguard-generated = handleTest ./wireguard/generated.nix {};
   wireguard-namespaces = handleTest ./wireguard/namespaces.nix {};
   wordpress = handleTest ./wordpress.nix {};
+  xandikos = handleTest ./xandikos.nix {};
   xautolock = handleTest ./xautolock.nix {};
   xfce = handleTest ./xfce.nix {};
   xmonad = handleTest ./xmonad.nix {};

nixos/tests/bittorrent.nix

@@ -18,6 +18,17 @@ let
   externalRouterAddress = "80.100.100.1";
   externalClient2Address = "80.100.100.2";
   externalTrackerAddress = "80.100.100.3";
+
+  transmissionConfig = { ... }: {
+    environment.systemPackages = [ pkgs.transmission ];
+    services.transmission = {
+      enable = true;
+      settings = {
+        dht-enabled = false;
+        message-level = 3;
+      };
+    };
+  };
 in
 
 {
@@ -26,33 +37,31 @@ in
     maintainers = [ domenkozar eelco rob bobvanderlinden ];
   };
 
-  nodes =
+  nodes = {
-    { tracker =
+    tracker = { pkgs, ... }: {
-        { pkgs, ... }:
+      imports = [ transmissionConfig ];
-        { environment.systemPackages = [ pkgs.transmission ];
 
       virtualisation.vlans = [ 1 ];
+      networking.firewall.enable = false;
       networking.interfaces.eth1.ipv4.addresses = [
         { address = externalTrackerAddress; prefixLength = 24; }
       ];
 
       # We need Apache on the tracker to serve the torrents.
-          services.httpd.enable = true;
+      services.httpd = {
-          services.httpd.adminAddr = "foo@example.org";
+        enable = true;
-          services.httpd.documentRoot = "/tmp";
+        virtualHosts = {
-
+          "torrentserver.org" = {
-          networking.firewall.enable = false;
+            adminAddr = "foo@example.org";
-
+            documentRoot = "/tmp";
+          };
+        };
+      };
       services.opentracker.enable = true;
-
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.port-forwaring-enabled = false;
     };
 
-      router =
+    router = { pkgs, nodes, ... }: {
-        { pkgs, nodes, ... }:
+      virtualisation.vlans = [ 1 2 ];
-        { virtualisation.vlans = [ 1 2 ];
       networking.nat.enable = true;
       networking.nat.internalInterfaces = [ "eth2" ];
       networking.nat.externalInterface = "eth1";
@@ -75,9 +84,10 @@ in
       };
     };
 
-      client1 =
+    client1 = { pkgs, nodes, ... }: {
-        { pkgs, nodes, ... }:
+      imports = [ transmissionConfig ];
-        { environment.systemPackages = [ pkgs.transmission pkgs.miniupnpc ];
+      environment.systemPackages = [ pkgs.miniupnpc ];
+
       virtualisation.vlans = [ 2 ];
       networking.interfaces.eth0.ipv4.addresses = [];
       networking.interfaces.eth1.ipv4.addresses = [
@@ -85,29 +95,21 @@ in
       ];
       networking.defaultGateway = internalRouterAddress;
       networking.firewall.enable = false;
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.message-level = 3;
     };
 
-      client2 =
+    client2 = { pkgs, ... }: {
-        { pkgs, ... }:
+      imports = [ transmissionConfig ];
-        { environment.systemPackages = [ pkgs.transmission ];
+
       virtualisation.vlans = [ 1 ];
       networking.interfaces.eth0.ipv4.addresses = [];
       networking.interfaces.eth1.ipv4.addresses = [
         { address = externalClient2Address; prefixLength = 24; }
       ];
       networking.firewall.enable = false;
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.port-forwaring-enabled = false;
     };
   };
 
-  testScript =
+  testScript = { nodes, ... }: ''
-    { nodes, ... }:
-    ''
       start_all()
 
       # Wait for network and miniupnpd.
@@ -159,5 +161,4 @@ in
           "cmp /tmp/test.tar.bz2 ${file}"
       )
     '';
-
 })

nixos/tests/xandikos.nix

@@ -0,0 +1,70 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+    {
+      name = "xandikos";
+
+      meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+      nodes = {
+        xandikos_client = {};
+        xandikos_default = {
+          networking.firewall.allowedTCPPorts = [ 8080 ];
+          services.xandikos.enable = true;
+        };
+        xandikos_proxy = {
+          networking.firewall.allowedTCPPorts = [ 80 8080 ];
+          services.xandikos.enable = true;
+          services.xandikos.address = "localhost";
+          services.xandikos.port = 8080;
+          services.xandikos.routePrefix = "/xandikos/";
+          services.xandikos.extraOptions = [
+            "--defaults"
+          ];
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+            virtualHosts."xandikos" = {
+              serverName = "xandikos.local";
+              basicAuth.xandikos = "snakeOilPassword";
+              locations."/xandikos/" = {
+                proxyPass = "http://localhost:8080/";
+              };
+            };
+          };
+        };
+      };
+
+      testScript = ''
+        start_all()
+
+        with subtest("Xandikos default"):
+            xandikos_default.wait_for_unit("multi-user.target")
+            xandikos_default.wait_for_unit("xandikos.service")
+            xandikos_default.wait_for_open_port(8080)
+            xandikos_default.succeed("curl --fail http://localhost:8080/")
+            xandikos_default.succeed(
+                "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+            )
+            xandikos_client.wait_for_unit("network.target")
+            xandikos_client.fail("curl --fail http://xandikos_default:8080/")
+
+        with subtest("Xandikos proxy"):
+            xandikos_proxy.wait_for_unit("multi-user.target")
+            xandikos_proxy.wait_for_unit("xandikos.service")
+            xandikos_proxy.wait_for_open_port(8080)
+            xandikos_proxy.succeed("curl --fail http://localhost:8080/")
+            xandikos_proxy.succeed(
+                "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+            )
+            xandikos_client.wait_for_unit("network.target")
+            xandikos_client.fail("curl --fail http://xandikos_proxy:8080/")
+            xandikos_client.succeed(
+                "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/ | grep -qi Xandikos"
+            )
+            xandikos_client.succeed(
+                "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/user/ | grep -qi Xandikos"
+            )
+      '';
+    }
+)

pkgs/applications/audio/pavucontrol/default.nix

@@ -1,5 +1,5 @@
 { fetchurl, stdenv, pkgconfig, intltool, libpulseaudio, gtkmm3
-, libcanberra-gtk3, makeWrapper, gnome3 }:
+, libcanberra-gtk3, gnome3, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "pavucontrol";
@@ -10,16 +10,10 @@ stdenv.mkDerivation rec {
     sha256 = "1qhlkl3g8d7h72xjskii3g1l7la2cavwp69909pzmbi2jyn5pi4g";
   };
 
-  preFixup = ''
+  buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3
-    wrapProgram "$out/bin/pavucontrol" \
-     --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-     --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
-  '';
-
-  buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3 makeWrapper
                   gnome3.adwaita-icon-theme ];
 
-  nativeBuildInputs = [ pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];
 
   configureFlags = [ "--disable-lynx" ];
 

pkgs/applications/audio/spotifyd/default.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotifyd";
-  version = "0.2.20";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "Spotifyd";
     repo = "spotifyd";
     rev = "v${version}";
-    sha256 = "1hf4wpk7r0s4jpjhxaz67y1hd8jx9ns5imd85r3cdg4lxf3j5gph";
+    sha256 = "0xxr21avgr4pvlr5vgb68jmad5xy5kqvaxfzh0qn1jpiax7y3avm";
   };
 
-  cargoSha256 = "1h3fis47hmxvppiv1icjhgp48nd46gayfcmzfjs34q6jask90n0w";
+  cargoSha256 = "1ykmn7zzwn9my96bbxwkparab5lck1zzdkpafil2mmrjyvyi40da";
 
   cargoBuildFlags = [
     "--no-default-features"

pkgs/applications/editors/emacs-modes/elpa-generated.nix

@@ -3236,10 +3236,10 @@
       elpaBuild {
         pname = "undo-tree";
         ename = "undo-tree";
-        version = "0.7";
+        version = "0.7.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/undo-tree-0.7.el";
+          url = "https://elpa.gnu.org/packages/undo-tree-0.7.2.el";
-          sha256 = "0mc5spiqx20z8vh8b24dp9hqj27h5bm5wqk0ga7c6s6mp69r72h4";
+          sha256 = "0gdqh5rkgwlancbjx5whgl5gqkdipdkspkl2bqmrq70sgg5ahrcc";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/emacs-modes/melpa-packages.nix

@@ -111,6 +111,11 @@ env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPac
 
         flycheck-rtags = fix-rtags super.flycheck-rtags;
 
+        gnuplot = super.gnuplot.overrideAttrs (old: {
+          nativeBuildInputs =
+            (old.nativeBuildInputs or []) ++ [ pkgs.autoreconfHook ];
+        });
+
         pdf-tools = super.pdf-tools.overrideAttrs(old: {
           nativeBuildInputs = [ external.pkgconfig ];
           buildInputs = with external; old.buildInputs ++ [ autoconf automake libpng zlib poppler ];

pkgs/applications/editors/neovim/qt.nix

@@ -4,13 +4,13 @@
 let
   unwrapped = mkDerivation rec {
     pname = "neovim-qt-unwrapped";
-    version = "0.2.12";
+    version = "0.2.15";
 
     src = fetchFromGitHub {
       owner  = "equalsraf";
       repo   = "neovim-qt";
       rev    = "v${version}";
-      sha256 = "09s3044j0y8nmyi8ykslfii6fx7k9mckmdvb0jn2xmdabpb60i20";
+      sha256 = "097nykglqp4jyvla4yp32sc1f1hph4cqqhp6rm9ww7br8c0j54xl";
     };
 
     cmakeFlags = [

pkgs/applications/graphics/openimageio/default.nix

@@ -39,6 +39,5 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.unix;
-    badPlatforms = [ "x86_64-darwin" ];
   };
 }

pkgs/applications/graphics/paraview/default.nix

@@ -30,7 +30,7 @@ mkDerivation rec {
   # libraries.  These reside in build/lib, and are not found by
   # default.
   preBuild = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
   '';
 
   enableParallelBuilding = true;

pkgs/applications/graphics/pencil/default.nix

@@ -1,47 +1,16 @@
-{ stdenv, fetchurl, lib, makeWrapper,
+{ stdenv, fetchurl, lib, makeWrapper, wrapGAppsHook,
   # build dependencies
-  alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
+  alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig,
-  freetype, gdk-pixbuf, glib, gnome2, nspr, nss, xorg,
+  freetype, gdk-pixbuf, glib, glibc, gtk3, libuuid, nspr, nss, pango,
-  glibc, systemd
+  xorg, systemd
 }:
+let
 
-stdenv.mkDerivation rec {
+  deps = [
-  version = "3.0.4";
-  pname = "pencil";
-
-  src = fetchurl {
-    url    = "http://pencil.evolus.vn/dl/V${version}/Pencil_${version}_amd64.deb";
-    sha256 = "58e2b794c615ea8715d8374f177e19c87f7071e359826ec34a59836d537a62fd";
-  };
-
-  sourceRoot = ".";
-
-  unpackCmd = ''
-    ar p "$src" data.tar.xz | tar xJ
-  '';
-
-  dontBuild = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -R usr/share opt $out/
-
-    # fix the path in the desktop file
-    substituteInPlace \
-      $out/share/applications/pencil.desktop \
-      --replace /opt/ $out/opt/
-
-    # symlink the binary to bin/
-    ln -s $out/opt/Pencil/pencil $out/bin/pencil
-  '';
-
-
-  preFixup = let
-    packages = [
     alsaLib
     atk
+    at-spi2-atk
+    at-spi2-core
     cairo
     cups
     dbus
@@ -50,12 +19,14 @@ stdenv.mkDerivation rec {
     freetype
     gdk-pixbuf
     glib
-      gnome2.GConf
+    glibc
-      gnome2.gtk
+    gtk3
-      gnome2.pango
+    libuuid
     nspr
     nss
+    pango
     xorg.libX11
+    xorg.libxcb
     xorg.libXScrnSaver
     xorg.libXcomposite
     xorg.libXcursor
@@ -68,8 +39,47 @@ stdenv.mkDerivation rec {
     xorg.libXtst
     stdenv.cc.cc.lib
     stdenv.cc.cc
-      glibc
   ];
+
+in stdenv.mkDerivation rec {
+  version = "3.1.0";
+  pname = "pencil";
+
+  src = fetchurl {
+    url    = "http://pencil.evolus.vn/dl/V${version}.ga/pencil_${version}.ga_amd64.deb";
+    sha256 = "01ae54b1a1351b909eb2366c6ec00816e1deba370e58f35601cf7368f10aaba3";
+  };
+
+  sourceRoot = ".";
+
+  unpackCmd = ''
+    ar p "$src" data.tar.gz | tar xz
+  '';
+
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+
+  buildInputs = deps;
+
+  installPhase = ''
+    mkdir -p $out/bin $out/opt $out/share/applications
+    cp -R usr/share $out/
+    cp -R opt/pencil*/ $out/opt/pencil
+    cp $out/opt/pencil/pencil.desktop $out/share/applications/
+
+    # fix the path in the desktop file
+    substituteInPlace \
+      $out/share/applications/pencil.desktop \
+      --replace /opt/ $out/opt/
+
+    # symlink the binary to bin/
+    ln -s $out/opt/pencil/pencil $out/bin/pencil
+  '';
+
+
+  preFixup = let
+    packages = deps;
     libPathNative = lib.makeLibraryPath packages;
     libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
     libPath = "${libPathNative}:${libPath64}";
@@ -77,21 +87,13 @@ stdenv.mkDerivation rec {
     # patch executable
     patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}:$out/opt/Pencil" \
+      --set-rpath "${libPath}:$out/opt/pencil" \
-      $out/opt/Pencil/pencil
+      $out/opt/pencil/pencil
-
-    # patch libnode
-    patchelf \
-      --set-rpath "${libPath}" \
-      $out/opt/Pencil/libnode.so
-
-    # libffmpeg is for some reason  not executable
-    chmod a+x $out/opt/Pencil/libffmpeg.so
 
     # fix missing libudev
-    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/Pencil/libudev.so.1
+    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
-    wrapProgram $out/opt/Pencil/pencil \
+    wrapProgram $out/opt/pencil/pencil \
-      --prefix LD_LIBRARY_PATH : $out/opt/Pencil
+      --prefix LD_LIBRARY_PATH : $out/opt/pencil
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/graphics/rx/default.nix

@@ -7,13 +7,13 @@ with stdenv.lib;
 
 rustPlatform.buildRustPackage rec {
   pname = "rx";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "cloudhead";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1byaxbhd3q49473kcdd52rvn3xq7bmy8bdx3pz0jiw96bclzhcgq";
+    sha256 = "1n5s7v2z13550gkqz7w6dw62jdy60wdi8w1lfa23609b4yhg4w94";
   };
 
   cargoSha256 = "173jfjvdag97f6jvfg366hjk9v3cz301cbzpcahy51rbf1cip1w1";

pkgs/applications/misc/audio/soxr/default.nix

@@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "doc" ]; # headers are just two and very small
 
   preConfigure = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:"`pwd`/build/src
+    export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}"`pwd`/build/src
   '' else ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:"`pwd`/build/src
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}"`pwd`/build/src
   '';
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/misc/blender/darwin.patch

@@ -0,0 +1,105 @@
+diff a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake/platform/platform_apple.cmake
+--- a/build_files/cmake/platform/platform_apple.cmake
++++ b/build_files/cmake/platform/platform_apple.cmake
+@@ -35,7 +35,6 @@ else()
+   message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+ endif()
+ if(NOT EXISTS "${LIBDIR}/")
+-  message(FATAL_ERROR "Mac OSX requires pre-compiled libs at: '${LIBDIR}'")
+ endif()
+ 
+ if(WITH_OPENAL)
+@@ -79,7 +78,7 @@ endif()
+ if(WITH_CODEC_SNDFILE)
+   set(LIBSNDFILE ${LIBDIR}/sndfile)
+   set(LIBSNDFILE_INCLUDE_DIRS ${LIBSNDFILE}/include)
+-  set(LIBSNDFILE_LIBRARIES sndfile FLAC ogg vorbis vorbisenc)
++  set(LIBSNDFILE_LIBRARIES sndfile)
+   set(LIBSNDFILE_LIBPATH ${LIBSNDFILE}/lib ${LIBDIR}/ffmpeg/lib)  # TODO, deprecate
+ endif()
+ 
+@@ -90,7 +89,7 @@ if(WITH_PYTHON)
+     # normally cached but not since we include them with blender
+     set(PYTHON_INCLUDE_DIR "${LIBDIR}/python/include/python${PYTHON_VERSION}m")
+     set(PYTHON_EXECUTABLE "${LIBDIR}/python/bin/python${PYTHON_VERSION}m")
+-    set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.a)
++    set(PYTHON_LIBRARY "${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.dylib")
+     set(PYTHON_LIBPATH "${LIBDIR}/python/lib/python${PYTHON_VERSION}")
+     # set(PYTHON_LINKFLAGS "-u _PyMac_Error")  # won't  build with this enabled
+   else()
+@@ -155,10 +154,7 @@ if(WITH_CODEC_FFMPEG)
+   set(FFMPEG_INCLUDE_DIRS ${FFMPEG}/include)
+   set(FFMPEG_LIBRARIES
+     avcodec avdevice avformat avutil
+-    mp3lame swscale x264 xvidcore
+-    theora theoradec theoraenc
+-    vorbis vorbisenc vorbisfile ogg opus
+-    vpx swresample)
++    swscale swresample)
+   set(FFMPEG_LIBPATH ${FFMPEG}/lib)
+ endif()
+ 
+@@ -199,14 +195,14 @@ if(WITH_OPENCOLLADA)
+   set(OPENCOLLADA ${LIBDIR}/opencollada)
+ 
+   set(OPENCOLLADA_INCLUDE_DIRS
+-    ${LIBDIR}/opencollada/include/COLLADAStreamWriter
+-    ${LIBDIR}/opencollada/include/COLLADABaseUtils
+-    ${LIBDIR}/opencollada/include/COLLADAFramework
+-    ${LIBDIR}/opencollada/include/COLLADASaxFrameworkLoader
+-    ${LIBDIR}/opencollada/include/GeneratedSaxParser
++    ${LIBDIR}/opencollada/include/opencollada/COLLADAStreamWriter
++    ${LIBDIR}/opencollada/include/opencollada/COLLADABaseUtils
++    ${LIBDIR}/opencollada/include/opencollada/COLLADAFramework
++    ${LIBDIR}/opencollada/include/opencollada/COLLADASaxFrameworkLoader
++    ${LIBDIR}/opencollada/include/opencollada/GeneratedSaxParser
+   )
+ 
+-  set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib)
++  set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib/opencollada)
+   set(OPENCOLLADA_LIBRARIES
+     OpenCOLLADASaxFrameworkLoader
+     -lOpenCOLLADAFramework
+@@ -215,7 +211,7 @@ if(WITH_OPENCOLLADA)
+     -lMathMLSolver
+     -lGeneratedSaxParser
+     -lbuffer -lftoa -lUTF
+-    ${OPENCOLLADA_LIBPATH}/libxml2.a
++    xml2
+   )
+   # PCRE is bundled with openCollada
+   # set(PCRE ${LIBDIR}/pcre)
+@@ -276,14 +272,13 @@ if(WITH_BOOST)
+ endif()
+ 
+ if(WITH_INTERNATIONAL OR WITH_CODEC_FFMPEG)
+-  set(PLATFORM_LINKFLAGS "${PLATFORM_LINKFLAGS} -liconv") # boost_locale and ffmpeg needs it !
+ endif()
+ 
+ if(WITH_OPENIMAGEIO)
+   set(OPENIMAGEIO ${LIBDIR}/openimageio)
+   set(OPENIMAGEIO_INCLUDE_DIRS ${OPENIMAGEIO}/include)
+   set(OPENIMAGEIO_LIBRARIES
+-    ${OPENIMAGEIO}/lib/libOpenImageIO.a
++    ${OPENIMAGEIO}/lib/libOpenImageIO.dylib
+     ${PNG_LIBRARIES}
+     ${JPEG_LIBRARIES}
+     ${TIFF_LIBRARY}
+@@ -306,7 +301,7 @@ endif()
+ if(WITH_OPENCOLORIO)
+   set(OPENCOLORIO ${LIBDIR}/opencolorio)
+   set(OPENCOLORIO_INCLUDE_DIRS ${OPENCOLORIO}/include)
+-  set(OPENCOLORIO_LIBRARIES OpenColorIO tinyxml yaml-cpp)
++  set(OPENCOLORIO_LIBRARIES OpenColorIO)
+   set(OPENCOLORIO_LIBPATH ${OPENCOLORIO}/lib)
+ endif()
+ 
+@@ -443,7 +438,7 @@ else()
+   set(CMAKE_CXX_FLAGS_RELEASE "-mdynamic-no-pic -fno-strict-aliasing")
+ endif()
+ 
+-if(${XCODE_VERSION} VERSION_EQUAL 5 OR ${XCODE_VERSION} VERSION_GREATER 5)
++if(FALSE)
+   # Xcode 5 is always using CLANG, which has too low template depth of 128 for libmv
+   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -ftemplate-depth=1024")
+ endif()

pkgs/applications/misc/blender/default.nix

@@ -1,13 +1,14 @@
 { config, stdenv, lib, fetchurl, boost, cmake, ffmpeg, gettext, glew
 , ilmbase, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
-, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio, openjpeg_1, python3Packages
+, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio2, openjpeg, python3Packages
 , openvdb, libXxf86vm, tbb
 , zlib, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
 , jackaudioSupport ? false, libjack2
 , cudaSupport ? config.cudaSupport or false, cudatoolkit
 , colladaSupport ? true, opencollada
 , enableNumpy ? false, makeWrapper
+, pugixml, SDL, Cocoa, CoreGraphics, ForceFeedback, OpenAL, OpenGL
 }:
 
 with lib;
@@ -23,22 +24,53 @@ stdenv.mkDerivation rec {
     sha256 = "1zl0ar95qkxsrbqw9miz2hrjijlqjl06vg3clfk9rm7krr2l3b2j";
   };
 
+  patches = lib.optional stdenv.isDarwin ./darwin.patch;
+
   nativeBuildInputs = [ cmake ] ++ optional cudaSupport addOpenGLRunpath;
   buildInputs =
     [ boost ffmpeg gettext glew ilmbase
-      libXi libX11 libXext libXrender
+      freetype libjpeg libpng libsamplerate libsndfile libtiff
-      freetype libjpeg libpng libsamplerate libsndfile libtiff libGLU libGL openal
+      opencolorio openexr openimageio2 openjpeg python zlib fftw jemalloc
-      opencolorio openexr openimageio openjpeg_1 python zlib fftw jemalloc
       (opensubdiv.override { inherit cudaSupport; })
-      openvdb libXxf86vm tbb
+      tbb
       makeWrapper
     ]
+    ++ (if (!stdenv.isDarwin) then [
+      libXi libX11 libXext libXrender
+      libGLU libGL openal
+      libXxf86vm
+      # OpenVDB currently doesn't build on darwin
+      openvdb
+    ]
+    else [
+      pugixml SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
+    ])
     ++ optional jackaudioSupport libjack2
     ++ optional cudaSupport cudatoolkit
     ++ optional colladaSupport opencollada;
 
   postPatch =
-    ''
+    if stdenv.isDarwin then ''
+      : > build_files/cmake/platform/platform_apple_xcode.cmake
+      substituteInPlace source/creator/CMakeLists.txt \
+        --replace '${"$"}{LIBDIR}/python' \
+                  '${python}'
+      substituteInPlace build_files/cmake/platform/platform_apple.cmake \
+        --replace '${"$"}{LIBDIR}/python' \
+                  '${python}' \
+        --replace '${"$"}{LIBDIR}/opencollada' \
+                  '${opencollada}' \
+        --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
+                  '${python3Packages.numpy}/${python.sitePackages}/numpy' \
+        --replace 'set(OPENJPEG_INCLUDE_DIRS ' \
+                  'set(OPENJPEG_INCLUDE_DIRS "'$(echo ${openjpeg.dev}/include/openjpeg-*)'") #' \
+        --replace 'set(OPENJPEG_LIBRARIES ' \
+                  'set(OPENJPEG_LIBRARIES "${openjpeg}/lib/libopenjp2.dylib") #' \
+        --replace 'set(OPENIMAGEIO ' \
+                  'set(OPENIMAGEIO "${openimageio2.out}") #' \
+        --replace 'set(OPENEXR_INCLUDE_DIRS ' \
+                  'set(OPENEXR_INCLUDE_DIRS "${openexr.dev}/include/OpenEXR") #'
+    '' else ''
       substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
     '';
 
@@ -48,7 +80,7 @@ stdenv.mkDerivation rec {
       "-DWITH_CODEC_SNDFILE=ON"
       "-DWITH_INSTALL_PORTABLE=OFF"
       "-DWITH_FFTW3=ON"
-      #"-DWITH_SDL=ON"
+      "-DWITH_SDL=OFF"
       "-DWITH_OPENCOLORIO=ON"
       "-DWITH_OPENSUBDIV=ON"
       "-DPYTHON_LIBRARY=${python.libPrefix}m"
@@ -61,10 +93,18 @@ stdenv.mkDerivation rec {
       "-DWITH_OPENVDB=ON"
       "-DWITH_TBB=ON"
       "-DWITH_IMAGE_OPENJPEG=ON"
+      "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
     ]
+    ++ optionals stdenv.isDarwin [
+      "-DWITH_CYCLES_OSL=OFF" # requires LLVM
+      "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
+
+      "-DLIBDIR=/does-not-exist"
+    ]
+    # Clang doesn't support "-export-dynamic"
+    ++ optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS="
     ++ optional jackaudioSupport "-DWITH_JACK=ON"
-    ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON"
+    ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON";
-    ++ optional colladaSupport "-DWITH_OPENCOLLADA=ON";
 
   NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";
 
@@ -95,7 +135,7 @@ stdenv.mkDerivation rec {
     # They comment two licenses: GPLv2 and Blender License, but they
     # say: "We've decided to cancel the BL offering for an indefinite period."
     license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
     maintainers = [ maintainers.goibhniu ];
   };
 }

pkgs/applications/misc/font-manager/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3, fetchpatch,
+{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3,
   pkgconfig, libxml2, json-glib , sqlite, itstool, librsvg, yelp-tools,
   vala, gtk3, gnome3, desktop-file-utils, wrapGAppsHook, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "font-manager";
-  version = "0.7.5";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "FontManager";
     repo = "master";
     rev = version;
-    sha256 = "16hma8rrkam6ngn5vbdaryn31vdixvii6920g9z928gylz9xkd3g";
+    sha256 = "1bzqvspplp1zj0n0869jqbc60wgbjhf0vdrn5bj8dfawxynh8s5f";
   };
 
   nativeBuildInputs = [
@@ -38,19 +38,6 @@ stdenv.mkDerivation rec {
     gnome3.adwaita-icon-theme
   ];
 
-  mesonFlags = [
-    "-Ddisable_pycompile=true"
-  ];
-
-  patches = [
-    # fix build with Vala 0.46
-    (fetchpatch {
-      url = "https://github.com/FontManager/font-manager/commit/c73b40de11f376f4515a0edfe97fb3721a264b35.patch";
-      sha256 = "0lacwsifgvda2r3z6j2a0svdqr6mgav7zkvih35xa8155y8wfpnw";
-      excludes = [ "fedora/font-manager.spec" ];
-    })
-  ];
-
   postPatch = ''
     chmod +x meson_post_install.py
     patchShebangs meson_post_install.py

pkgs/applications/misc/mako/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mako";
-  version = "1.4";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11ymiq6cr2ma0iva1mqybn3j6k73bsc6lv6pcbdq7hkhd4f9b7j9";
+    sha256 = "0hwvibpnrximb628w9dsfjpi30b5jy7nfkm4d94z5vhp78p43vxh";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig scdoc wayland-protocols ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     description = "A lightweight Wayland notification daemon";
     homepage = https://wayland.emersion.fr/mako/;
     license = licenses.mit;
-    maintainers = with maintainers; [ dywedir ];
+    maintainers = with maintainers; [ dywedir synthetica ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/osmctools/default.nix

@@ -1,46 +1,27 @@
-{ stdenv, fetchurl, zlib } :
+{ stdenv, fetchFromGitLab, autoreconfHook, zlib }:
 
-let
+stdenv.mkDerivation rec {
-
-  convert_src = fetchurl {
-    url = http://m.m.i24.cc/osmconvert.c;
-    sha256 = "1mvmb171c1jqxrm80jc7qicwk4kgg7yq694n7ci65g6i284r984x";
-    # version = 0.8.5
-  };
-
-  filter_src = fetchurl {
-    url = http://m.m.i24.cc/osmfilter.c;
-    sha256 = "0vm3bls9jb2cb5b11dn82sxnc22qzkf4ghmnkivycigrwa74i6xl";
-    # version = 1.4.0
-  };
-
-in
-
-stdenv.mkDerivation {
   pname = "osmctools";
-  version = "0.8.5plus1.4.0";
+  version = "0.9";
 
+  src = fetchFromGitLab {
+    owner = "osm-c-tools";
+    repo = pname;
+    rev = version;
+    sha256 = "1m8d3r1q1v05pkr8k9czrmb4xjszw6hvgsf3kn9pf0v14gpn4r8f";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ zlib ];
 
-  phases = [ "buildPhase" "installPhase" ];
-
-  buildPhase = ''
-    cc ${convert_src} -lz -O3 -o osmconvert
-    cc ${filter_src} -O3 -o osmfilter
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv osmconvert $out/bin
-    mv osmfilter $out/bin
-  '';
-
   meta = with stdenv.lib; {
     description = "Command line tools for transforming Open Street Map files";
     homepage = [
-      https://wiki.openstreetmap.org/wiki/Osmconvert
+      https://wiki.openstreetmap.org/wiki/osmconvert
-      https://wiki.openstreetmap.org/wiki/Osmfilter
+      https://wiki.openstreetmap.org/wiki/osmfilter
+      https://wiki.openstreetmap.org/wiki/osmupdate
     ];
+    maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
     license = licenses.agpl3;
   };

pkgs/applications/misc/waybar/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja
+{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja, wrapGAppsHook
 , wayland, wlroots, gtkmm3, libinput, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
 , traySupport  ? true,  libdbusmenu-gtk3
 , pulseSupport ? false, libpulseaudio
@@ -19,7 +19,7 @@
     };
 
     nativeBuildInputs = [
-      meson ninja pkgconfig scdoc
+      meson ninja pkgconfig scdoc wrapGAppsHook
     ];
 
     buildInputs = with stdenv.lib;

pkgs/applications/networking/Sylk/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "Sylk";
-  version = "2.1.0";
+  version = "2.5.0";
 in
 
 appimageTools.wrapType2 rec {
@@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {
 
   src = fetchurl {
     url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    sha256 = "1ifi8qr6f84dcssxhv5ar1s48nsqxiv2j1blc82248hmq5is24mf";
+    sha256 = "1jhs25zzdac3r2wz886vlpb0bz77p52mdlrbsbv28h6is79pbd69";
   };
 
   profile = ''

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.303";
+    version = "32.0.0.314";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0b2cw8y9rif2p0lyy2ir1v5lchxlsh543b9c743a2p85c9p7q62b";
+      sha256 = "05xcscpzglpfpiiqc3ngs5snxli99irjk18g5vdhw91jk9808gnl";
       stripRoot = false;
     };
 

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.303";
+  version = "32.0.0.314";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "05hfc5ywmcvp6zf8aqmzjp3qy3byp0zdl0ssrv9gvzcskdqkhsj2"
+          "076l93wjcy15sic88cyq6msp87gdhcvbk4ym2vbvvjz2bav2z456"
         else
-          "12hl8lvxz648ha70gi3v85mwf0nnayjiaslr669vjan3ww94jymv"
+          "0kxr8d6fh00akqgk3lwv0z6rk7xswislicsbh9b9p33f19mj7c8a"
       else
         if arch == "x86_64" then
-          "0x0mabgswly2v8z13832pkbjsv404aq61pback6sgmp2lyycdg6w"
+          "0a3hvp0qmqlann8k875ajf0i70cv0an1a3mr8kbgji46dxqvwjxz"
         else
-          "16kbpf1i3aqlrfbfh5ncg1n46ncl9hp6qdp36s5j3ivbc68pj81z";
+          "0jyywas2z7ssgzng82qgnp01gy6nccqavkbx9529m07xrclvqbxn";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.303";
+  version = "32.0.0.314";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0xkzlv90lpyy54j6pllknrp1l9vjyh6dsl63l4c8cgh4i830gi14"
+        "0zlin94rip13rn58m7v5l6m20ylnw59l77rbg5j5qyxkr53zawdz"
       else
-        "0mi3ggv6zhzmdd1h68cgl87n6izhp0pbkhnidd2gl2cp95f23c2d";
+        "0pfrm02iwa01pqx3adqj0sw27p1ddlz9knjky6x248ak8zywsqr2";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/cawbird/default.nix

@@ -20,14 +20,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.3.1";
+  version = "1.0.4";
   pname = "cawbird";
 
   src = fetchFromGitHub {
     owner = "IBBoard";
     repo = "cawbird";
     rev = "v${version}";
-    sha256 = "sha256:1v1y4bx0mm518b9vlpsry12fw1qz2j28jfhjqq73blvzd89lgb0y";
+    sha256 = "sha256:1gqi7bn08b9cjpb0mgs6bk1a2npdfhn56ckps95nck0jyqzfbnir";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -1,13 +1,13 @@
 { stdenv, lib, fetchFromGitHub, go, removeReferencesTo, buildGoPackage }:
 buildGoPackage rec {
   pname = "cni-plugins";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    sha256 = "0dc4fs08x4x518yhgvq3drjvansnc0cb8rm4h5wiw7k3whjii3cd";
+    sha256 = "02kz6y3klhbriybsskn4hmldwli28cycnp2klsm2x0y9c73iczdp";
   };
 
   goDeps = ./plugins-deps.nix;

pkgs/applications/networking/cluster/docker-machine/xhyve-deps.nix

@@ -1,21 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/docker/machine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/docker/machine";
-      rev = "5b274558ea6ca822c06dd407a4e774a0105c3f60";
-      sha256 = "1wdq9h4bx7awgclh969gvmcnl9jvgv7ldfklnclh5iv47mi7q22d";
-    };
-  }
-  {
-    goPackagePath = "github.com/zchee/libhyperkit";
-    fetch = {
-      type = "git";
-      url = "https://github.com/zchee/libhyperkit";
-      rev = "1a19a7693fac32b46ec6cdd22da6fbec974447fc";
-      sha256 = "119f5gcl24znwnmi837jk667asd3lirx32jldpd4mbyb3sm9nz24";
-    };
-  }
-]

pkgs/applications/networking/cluster/docker-machine/xhyve.nix

@@ -1,24 +1,36 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, pkgconfig, Hypervisor, vmnet }:
+{ stdenv, buildGoPackage, fetchFromGitHub, fetchpatch, pkgconfig, cctools, Hypervisor, vmnet }:
 
 buildGoPackage rec {
   pname = "docker-machine-xhyve";
-  version = "0.3.3";
+  version = "0.4.0";
 
   goPackagePath = "github.com/zchee/docker-machine-driver-xhyve";
-  goDeps = ./xhyve-deps.nix;
+
+  # https://github.com/machine-drivers/docker-machine-driver-xhyve/pull/225
+  patches = fetchpatch {
+    url = "https://github.com/machine-drivers/docker-machine-driver-xhyve/commit/546256494bf2ccc33e4125bf45f504b0e3027d5a.patch";
+    sha256 = "1i8wxqccqkxvqrbsyd0g9s0kdskd8xi2jv0c1bji9aj4rq0a8cgz";
+  };
+
+  preBuild = ''
+    make -C go/src/${goPackagePath} CC=${stdenv.cc}/bin/cc LIBTOOL=${cctools}/bin/libtool GIT_CMD=: lib9p
+    export CGO_CFLAGS=-I$(pwd)/go/src/${goPackagePath}/vendor/github.com/jceel/lib9p
+    export CGO_LDFLAGS=$(pwd)/go/src/${goPackagePath}/vendor/build/lib9p/lib9p.a
+  '';
+  buildFlags = "--tags lib9p";
 
   src = fetchFromGitHub {
     rev    = "v${version}";
-    owner  = "zchee";
+    owner  = "machine-drivers";
     repo   = "docker-machine-driver-xhyve";
-    sha256 = "0rj6pyqp4yv4j28bglqjs95rip5i77vv8mrkmqv1rxrsl3i8aqqy";
+    sha256 = "0000v97fr8xc5b39v44hsa87wrbk4bcwyaaivxv4hxlf4vlgg863";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ Hypervisor vmnet ];
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/zchee/docker-machine-driver-xhyve;
+    homepage = https://github.com/machine-drivers/docker-machine-driver-xhyve;
     description = "Xhyve driver for docker-machine.";
     license = licenses.bsd3;
     maintainers = with maintainers; [ periklis ];

pkgs/applications/networking/mailreaders/claws-mail/default.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     # autotools check tries to dlopen libpython as a requirement for the python plugin
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${python}/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${python}/lib
   '';
 
   postPatch = ''

pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0x4yfvk8415p80h9an242n6q3b43mw6mnnczh95zd3j0zwdr6wrg";
+    sha256 = "0y3ks10mc7m8c7pd4c4j8pj7n5rqcvzrjs8mzldv7z7jnlb30hkq";
   };
 
   patches = optional smimeSupport (fetchpatch {

pkgs/applications/office/gnucash/default.nix

@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
   #   80 - test-gnc-module-scm-module (Failed)
   #   81 - test-gnc-module-scm-multi (Failed)
   preCheck = ''
-    export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test:$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
     export NIX_CFLAGS_LINK="-lgtest -lgtest_main"
   '';
   doCheck = false;

pkgs/applications/radio/soapysdr/default.nix

@@ -8,7 +8,7 @@
 
 let
 
-  version = "0.7.1";
+  version = "0.7.2";
   modulesVersion = with lib; versions.major version + "." + versions.minor version;
   modulesPath = "lib/SoapySDR/modules" + modulesVersion;
   extraPackagesSearchPath = lib.makeSearchPath modulesPath extraPackages;
@@ -21,7 +21,7 @@ in stdenv.mkDerivation {
     owner = "pothosware";
     repo = "SoapySDR";
     rev = "soapy-sdr-${version}";
-    sha256 = "1rbnd3w12kzsh94fiywyn4vch7h0kf75m88fi6nq992b3vnmiwvl";
+    sha256 = "102wnpjxrwba20pzdh1vvx0yg1h8vqd8z914idxflg9p14r6v5am";
   };
 
   nativeBuildInputs = [ cmake makeWrapper pkgconfig ];

pkgs/applications/science/math/nota/default.nix

@@ -0,0 +1,40 @@
+{ mkDerivation, haskellPackages, fetchurl, lib }:
+
+mkDerivation rec {
+  pname = "nota";
+  version = "1.0";
+
+  # Can't use fetchFromGitLab since codes.kary.us doesn't support https
+  src = fetchurl {
+    url = "http://codes.kary.us/nota/nota/-/archive/V${version}/nota-V${version}.tar.bz2";
+    sha256 = "0bbs6bm9p852hvqadmqs428ir7m65h2prwyma238iirv42pk04v8";
+  };
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/source
+  '';
+
+  isLibrary = false;
+  isExecutable = true;
+
+  libraryHaskellDepends = with haskellPackages; [
+    base
+    bytestring
+    array
+    split
+    scientific
+    parsec
+    ansi-terminal
+    regex-compat
+    containers
+    terminal-size
+    numbers
+    text
+    time
+  ];
+
+  description = "The most beautiful command line calculator";
+  homepage = "https://kary.us/nota";
+  license = lib.licenses.mpl20;
+  maintainers = with lib.maintainers; [ dtzWill ];
+}

pkgs/applications/science/math/sage/sage-env.nix

@@ -177,7 +177,7 @@ writeTextFile rec {
     export SAGE_EXTCODE='${sagelib.src}/src/ext'
 
   # for find_library
-    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}:$DYLD_LIBRARY_PATH"
+    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
   '';
 } // {
   lib = sagelib; # equivalent of `passthru`, which `writeTextFile` doesn't support

pkgs/applications/version-management/git-and-tools/gitstatus/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];
   patchPhase = ''
-    sed -i "s|local daemon=.*|local daemon=$out/bin/gitstatusd|" gitstatus.plugin.zsh
+    sed -i "1i GITSTATUS_DAEMON=$out/bin/gitstatusd" gitstatus.plugin.zsh
   '';
   installPhase = ''
     install -Dm755 gitstatusd $out/bin/gitstatusd

pkgs/applications/version-management/gitlab/data.json

@@ -1,11 +1,11 @@
 {
-  "version": "12.6.2",
+  "version": "12.6.4",
-  "repo_hash": "0bchamvr3f0ph49f7xa76gsp2mjj1ajy4q0wy1hjvr9bayxx94av",
+  "repo_hash": "0jsww785bxvjdrp1wsz6zkvx9zr69j24bway6nfyjkz8a7vbl9ls",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v12.6.2-ee",
+  "rev": "v12.6.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "a4b6c71d4b7c1588587345e2dfe0c6bd7cc63a83",
+    "GITALY_SERVER_VERSION": "1.77.1",
     "GITLAB_PAGES_VERSION": "1.12.0",
     "GITLAB_SHELL_VERSION": "10.3.0",
     "GITLAB_WORKHORSE_VERSION": "8.18.0"

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -17,14 +17,14 @@ let
       };
   };
 in buildGoPackage rec {
-  version = "a4b6c71d4b7c1588587345e2dfe0c6bd7cc63a83";
+  version = "1.77.1";
   pname = "gitaly";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
-    rev = version;
+    rev = "v${version}";
-    sha256 = "1pxmhq1nrc8q2kk83bz5afx14hshqgzqm6j4vgmyjvbmdvgl80wv";
+    sha256 = "08xc9lxlvga36yq1wdvb1h4zk70c36qspyd7azhkw84kzwfrif1c";
   };
 
   # Fix a check which assumes that hook files are writeable by their

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

@@ -327,7 +327,7 @@ group :metrics do
   gem 'influxdb', '~> 0.2', require: false
 
   # Prometheus
-  gem 'prometheus-client-mmap', '~> 0.9.10'
+  gem 'prometheus-client-mmap', '~> 0.10.0'
   gem 'raindrops', '~> 0.18'
 end
 

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

@@ -531,8 +531,8 @@ GEM
       regexp_parser (~> 1.1)
       regexp_property_values (~> 0.3)
     json (1.8.6)
-    json-jwt (1.9.4)
+    json-jwt (1.11.0)
-      activesupport
+      activesupport (>= 4.2)
       aes_key_wrap
       bindata
     json-schema (2.8.0)
@@ -746,7 +746,7 @@ GEM
       parser
       unparser
     procto (0.0.3)
-    prometheus-client-mmap (0.9.10)
+    prometheus-client-mmap (0.10.0)
     pry (0.11.3)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
@@ -1283,7 +1283,7 @@ DEPENDENCIES
   peek (~> 1.1)
   pg (~> 1.1)
   premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 0.9.10)
+  prometheus-client-mmap (~> 0.10.0)
   pry-byebug (~> 3.5.1)
   pry-rails (~> 0.3.4)
   rack (~> 2.0.7)

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

@@ -2326,10 +2326,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "065k7vffdki73f4nz89lxi6wxmcw5dlf593831pgvlbralll6x3r";
+      sha256 = "18rf9v20i0dk5dblr7m22di959xpch2h7gsx0cl585cryr7apwp3";
       type = "gem";
     };
-    version = "1.9.4";
+    version = "1.11.0";
   };
   json-schema = {
     dependencies = ["addressable"];
@@ -3365,10 +3365,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0immyg4as0isyj2dcjf44n0avg1jv5kx1qk0asrgb5ayzwmjqg1k";
+      sha256 = "00d2c79xhz5k3fcclarjr1ffxbrvc6236f4rrvriad9kwqr7c1mp";
       type = "gem";
     };
-    version = "0.9.10";
+    version = "0.10.0";
   };
   pry = {
     dependencies = ["coderay" "method_source"];

pkgs/applications/video/avidemux/default.nix

@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     cd "$sourceRoot"
     patchPhase
 
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${libXext}/lib"
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${libXext}/lib"
     ${stdenv.shell} bootStrap.bash \
       --with-core \
       ${if withQT then "--with-qt" else "--without-qt"} \

pkgs/applications/window-managers/sway/lock-fancy.nix

@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "Big-B";
-    repo = pname;
+    repo = "swaylock-fancy";
     rev = "35618ceec70338047355b6b057825e68f16971b5";
     sha256 = "06fjqwblmj0d9pq6y11rr73mizirna4ixy6xkvblf1c7sn5n8lpc";
   };

pkgs/build-support/build-fhs-userenv/env.nix

@@ -52,7 +52,7 @@ let
   etcProfile = writeText "profile" ''
     export PS1='${name}-chrootenv:\u@\h:\w\$ '
     export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
-    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
     export TZDIR='/etc/zoneinfo'
 

pkgs/build-support/rust/default.nix

@@ -100,9 +100,9 @@ stdenv.mkDerivation (args // {
   '' + stdenv.lib.optionalString verifyCargoDeps ''
     if ! diff source/Cargo.lock $cargoDeps/Cargo.lock ; then
       echo
-      echo "ERROR: cargoSha256 is out of date."
+      echo "ERROR: cargoSha256 is out of date"
       echo
-      echo "Cargo.lock is not the same in $cargoDeps."
+      echo "Cargo.lock is not the same in $cargoDeps"
       echo
       echo "To fix the issue:"
       echo '1. Use "1111111111111111111111111111111111111111111111111111" as the cargoSha256 value'

pkgs/build-support/setup-hooks/make-symlinks-relative.sh

@@ -0,0 +1,28 @@
+fixupOutputHooks+=(_makeSymlinksRelative)
+
+# For every symlink in $output that refers to another file in $output
+# ensure that the symlink is relative. This removes references to the output
+# has from the resulting store paths and thus the NAR files.
+_makeSymlinksRelative() {
+    local symlinkTarget
+
+    if [ -n "${dontRewriteSymlinks-}" ]; then
+        return 0
+    fi
+
+    while IFS= read -r -d $'\0' f; do
+        symlinkTarget=$(readlink "$f")
+        if [[ "$symlinkTarget"/ != "$prefix"/* ]]; then
+            # skip this symlink as it doesn't point to $prefix
+            continue
+        fi
+
+        if [ ! -e "$symlinkTarget" ]; then
+            echo "the symlink $f is broken, it points to $symlinkTarget (which is missing)"
+        fi
+
+        echo "rewriting symlink $f to be relative to $prefix"
+        ln -snrf "$symlinkTarget" "$f"
+
+    done < <(find $prefix -type l -print0)
+}

pkgs/data/fonts/victor-mono/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "victor-mono";
-  version = "1.3.0";
+  version = "1.3.1";
 in fetchFromGitHub rec {
   name = "${pname}-${version}";
 
@@ -26,7 +26,7 @@ in fetchFromGitHub rec {
     unzip -j VictorMonoAll.zip \*.otf -d $out/share/fonts/opentype/${pname}
   '';
 
-  sha256 = "1lv2x7kfspabnhvm8z79n165fw3awvzj1r8f0g5zn26wgdalgw69";
+  sha256 = "1yj91rhs9pd705406r4lqabdfzjclbz837nzm6z1rziy6mbpd61s";
 
   meta = with lib; {
     description = "Free programming font with cursive italics and ligatures";

pkgs/desktops/deepin/dde-file-manager/default.nix

@@ -228,8 +228,8 @@ mkDerivation rec {
   ];
 
   preBuild = ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${zlib}/lib";
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${zlib}/lib";
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${libX11}/lib";
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${libX11}/lib";
   '';
 
   dontWrapQtApps = true;

pkgs/desktops/enlightenment/efl.nix

@@ -123,7 +123,7 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     # allow ecore_con to find libcurl.so, which is a runtime dependency (it is dlopened)
-    export LD_LIBRARY_PATH="${curl.out}/lib:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="${curl.out}/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
 
     source "$setupHook"
   '';

pkgs/desktops/gnome-3/apps/seahorse/default.nix

@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "seahorse";
-  version = "3.34";
+  version = "3.34.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "16sfnqrdlr5xx6kixx2ln1mva7nngjlw1k3f5n454vyaigffjh2v";
+    sha256 = "19c2zylwgycb5q9hal8rmflc2sywc5c2grpsfsq3rf37i9lfwynw";
   };
 
   doCheck = true;

pkgs/development/compilers/bs-platform/build-bs-platform.nix

@@ -1,35 +1,33 @@
-{ stdenv, fetchFromGitHub, ninja, nodejs, python3 }:
+# This file is based on https://github.com/turboMaCk/bs-platform.nix/blob/master/build-bs-platform.nix
-let
+# to make potential future updates simpler
-  version = "6.2.1";
+
-  ocaml-version = "4.06.1";
+{ stdenv, fetchFromGitHub, ninja, runCommand, nodejs, python3,
-  src = fetchFromGitHub {
+  ocaml-version, version, src,
-    owner = "BuckleScript";
+  ocaml ? (import ./ocaml.nix {
-    repo = "bucklescript";
-    rev = "${version}";
-    sha256 = "0zx9nq7cik0c60n3rndqfqy3vdbj5lcrx6zcqcz2d60jjxi1z32y";
-    fetchSubmodules = true;
-  };
-  ocaml =  import ./ocaml.nix {
-    bs-version = version;
     version = ocaml-version;
     inherit stdenv;
     src = "${src}/ocaml";
-  };
+  }),
-in
+  custom-ninja ? (ninja.overrideAttrs (attrs: {
+    src = runCommand "ninja-patched-source" {} ''
+      mkdir -p $out
+      tar zxvf ${src}/vendor/ninja.tar.gz -C $out
+    '';
+    patches = [];
+  }))
+}:
 stdenv.mkDerivation {
   inherit src version;
   pname = "bs-platform";
   BS_RELEASE_BUILD = "true";
-  buildInputs = [ nodejs python3 ];
+  buildInputs = [ nodejs python3 custom-ninja ];
 
   patchPhase = ''
     sed -i 's:./configure.py --bootstrap:python3 ./configure.py --bootstrap:' ./scripts/install.js
-
     mkdir -p ./native/${ocaml-version}/bin
     ln -sf ${ocaml}/bin/*  ./native/${ocaml-version}/bin
-
     rm -f vendor/ninja/snapshot/ninja.linux
-    cp ${ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
+    cp ${custom-ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
   '';
 
   configurePhase = ''
@@ -42,12 +40,9 @@ stdenv.mkDerivation {
 
   installPhase = ''
     node scripts/install.js
-
     mkdir -p $out/bin
-
     cp -rf jscomp lib vendor odoc_gen native $out
     cp bsconfig.json package.json $out
-
     ln -s $out/lib/bsb $out/bin/bsb
     ln -s $out/lib/bsc $out/bin/bsc
     ln -s $out/lib/bsrefmt $out/bin/bsrefmt

pkgs/development/compilers/bs-platform/default.nix

@@ -1,15 +1,28 @@
-{ stdenv, fetchFromGitHub, ninja, nodejs, python3, ... }:
+{ stdenv, runCommand, fetchFromGitHub, ninja, nodejs, python3, ... }:
 let
+  build-bs-platform = import ./build-bs-platform.nix;
+in
+(build-bs-platform {
+  inherit stdenv runCommand fetchFromGitHub ninja nodejs python3;
+  version = "7.0.1";
+  ocaml-version = "4.06.1";
+
+  src = fetchFromGitHub {
+    owner = "BuckleScript";
+    repo = "bucklescript";
+    rev = "52770839e293ade2bcf187f2639000ca0a9a1d46";
+    sha256 = "0s7g2zfhshsilv9zyp0246bypg34d294z27alpwz03ws9608yr7k";
+    fetchSubmodules = true;
+  };
+}).overrideAttrs (attrs: {
   meta = with stdenv.lib; {
     description = "A JavaScript backend for OCaml focused on smooth integration and clean generated code.";
     homepage = https://bucklescript.github.io;
     license = licenses.lgpl3;
-    maintainers = with maintainers; [ turbomack gamb ];
+    maintainers = with maintainers; [ turbomack gamb anmonteiro ];
     platforms = platforms.all;
+    # Currently there is an issue with aarch build in hydra
+    # https://github.com/BuckleScript/bucklescript/issues/4091
+    badPlatforms = platforms.aarch64;
   };
-in
+})
-{
-  bs-platform-621 = import ./bs-platform-62.nix {
-    inherit stdenv fetchFromGitHub ninja nodejs python3;
-  } // { inherit meta; };
-}

pkgs/development/compilers/bs-platform/ocaml.nix

@@ -1,7 +1,7 @@
-{ stdenv, src, version, bs-version }:
+{ stdenv, src, version }:
 stdenv.mkDerivation rec {
   inherit src version;
-  name = "ocaml-${version}+bs-${bs-version}";
+  name = "ocaml-${version}+bs";
   configurePhase = ''
     ./configure -prefix $out
   '';

pkgs/development/compilers/ghc/8.10.1.nix

@@ -86,12 +86,12 @@ let
 
 in
 stdenv.mkDerivation (rec {
-  version = "8.10.0.20191210";
+  version = "8.10.0.20200108";
   name = "${targetPrefix}ghc-${version}";
 
   src = fetchurl {
-    url = "https://downloads.haskell.org/ghc/8.10.1-alpha2/ghc-${version}-src.tar.xz";
+    url = "https://downloads.haskell.org/ghc/8.10.1-rc1/ghc-${version}-src.tar.xz";
-    sha256 = "1mmv8s9cs41kp7wh1qqnzin5wv32cvs3lmzgda7njz0ssqb0mmvj";
+    sha256 = "1xm6cb3s2x3rycnyvkh12mp65xi3zbwrk5ima8sg7c245f3dl0ay";
   };
 
   enableParallelBuilding = true;

pkgs/development/compilers/graalvm/001_mx.py.patch

@@ -1,57 +1,31 @@
 diff --git a/mx.py b/mx.py
-index af7a9c2..08c0ea8 100755
+index a0b9315..b7d67a0 100755
 --- a/mx.py
 +++ b/mx.py
-@@ -4976,30 +4976,6 @@ class PackedResourceLibrary(ResourceLibrary):
+@@ -238,21 +238,7 @@ def _check_file_with_sha1(path, sha1, sha1path, mustExist=True, newFile=False, l
+             f.write(value or sha1OfFile(path))
  
-     def get_path(self, resolve):
+     if exists(path):
-         extract_path = _make_absolute(self.extract_path, self.suite.dir)
+-        if sha1Check and sha1:
--        download_path = super(PackedResourceLibrary, self).get_path(resolve)
+-            if not _sha1CachedValid() or (newFile and sha1 != _sha1Cached()):
--        if resolve and self._check_extract_needed(extract_path, download_path):
+-                logv('Create/update SHA1 cache file ' + sha1path)
--            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
+-                _writeSha1Cached()
--            try:
--                # extract archive
--                Extractor.create(download_path).extract(extract_path_tmp)
--                # ensure modification time is up to date
--                os.utime(extract_path_tmp, None)
--                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
--                try:
--                    # attempt atomic overwrite
--                    os.rename(extract_path_tmp, extract_path)
--                except OSError:
--                    # clean destination & re-try for cases where atomic overwrite doesn't work
--                    rmtree(extract_path, ignore_errors=True)
--                    os.rename(extract_path_tmp, extract_path)
--            except OSError as ose:
--                # Rename failed. Race with other process?
--                if self._check_extract_needed(extract_path, download_path):
--                    # ok something really went wrong
--                    abort("Extracting {} failed!".format(download_path), context=ose)
--            finally:
--                rmtree(extract_path_tmp, ignore_errors=True)
 -
-         return extract_path
+-            if sha1 != _sha1Cached():
- 
+-                computedSha1 = sha1OfFile(path)
-     def _check_download_needed(self):
+-                if sha1 == computedSha1:
-@@ -5900,7 +5876,7 @@ class HgConfig(VC):
+-                    warn('Fixing corrupt SHA1 cache file ' + sha1path)
- 
+-                    _writeSha1Cached(computedSha1)
-     def update_to_branch(self, vcdir, branch, abortOnError=True):
+-                    return True
-         cmd = ['update', branch]
+-                if logErrors:
--        self.hg_command(vcdir, cmd, abortOnError=abortOnError)
+-                    size = os.path.getsize(path)
-+        self.run(['hg', vcdir] + cmd)
+-                    log_error('SHA1 of {} [size: {}] ({}) does not match expected value ({})'.format(TimeStampFile(path), size, computedSha1, sha1))
- 
+-                return False
-     def add(self, vcdir, path, abortOnError=True):
++        return True
-         return self.run(['hg', '-q', '-R', vcdir, 'add', path]) == 0
+     elif mustExist:
-@@ -5937,7 +5913,7 @@ class HgConfig(VC):
+         if logErrors:
-                 return None
+             log_error("'{}' does not exist".format(path))
- 
+@@ -1057,46 +1043,8 @@ class SuiteImport:
-     def parent_info(self, vcdir, abortOnError=True):
--        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
-+        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
-         author, date = out.split("|||")
-         ts, _ = date.split(" ")
-         return self._sanitize_parent_info({
-@@ -8301,46 +8277,8 @@ class SuiteImport:
          version = import_dict.get("version")
          suite_dir = None
          version_from = import_dict.get("versionFrom")
@@ -100,7 +74,7 @@ index af7a9c2..08c0ea8 100755
  
      @staticmethod
      def get_source_urls(source, kind=None):
-@@ -8381,8 +8319,6 @@ class Suite(object):
+@@ -1467,8 +1415,6 @@ class Suite(object):
      :type dists: list[Distribution]
      """
      def __init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=False):
@@ -109,7 +83,7 @@ index af7a9c2..08c0ea8 100755
          self.imported_by = [] if primary else [importing_suite]
          self.mxDir = mxDir
          self.dir = dirname(mxDir)
-@@ -8410,7 +8346,7 @@ class Suite(object):
+@@ -1496,7 +1442,7 @@ class Suite(object):
          self._outputRoot = None
          self._preloaded_suite_dict = None
          self.vc = vc
@@ -118,7 +92,7 @@ index af7a9c2..08c0ea8 100755
          self._preload_suite_dict()
          self._init_imports()
          if load:
-@@ -9310,7 +9246,9 @@ def get_dynamic_imports():
+@@ -2405,7 +2351,9 @@ class Repository(SuiteConstituent):
  class SourceSuite(Suite):
      """A source suite"""
      def __init__(self, mxDir, primary=False, load=True, internal=False, importing_suite=None, dynamicallyImported=False):
@@ -129,7 +103,7 @@ index af7a9c2..08c0ea8 100755
          Suite.__init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=dynamicallyImported)
          logvv("SourceSuite.__init__({}), got vc={}, vc_dir={}".format(mxDir, self.vc, self.vc_dir))
          self.projects = []
-@@ -9359,17 +9297,7 @@ class SourceSuite(Suite):
+@@ -2454,17 +2402,7 @@ class SourceSuite(Suite):
          """
          Gets the release tag from VC or create a time based once if VC is unavailable
          """
@@ -148,73 +122,7 @@ index af7a9c2..08c0ea8 100755
  
      def scm_metadata(self, abortOnError=False):
          scm = self.scm
-@@ -12541,55 +12469,8 @@ def _attempt_download(url, path, jarEntryName=None):
+@@ -2993,12 +2931,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
-     return False
- 
- def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
--    """
--    Attempts to downloads content for each URL in a list, stopping after the first successful download.
--    If the content cannot be retrieved from any URL, the program is aborted, unless abortOnError=False.
--    The downloaded content is written to the file indicated by `path`.
--    """
--    if not verifyOnly:
--        ensure_dirname_exists(path)
--        assert not path.endswith(os.sep)
--
--    # https://docs.oracle.com/javase/7/docs/api/java/net/JarURLConnection.html
--    jarURLPattern = re.compile('jar:(.*)!/(.*)')
--    verify_errors = {}
--    for url in urls:
--        if not verifyOnly or verbose:
--            log('Downloading ' + url + ' to ' + path)
--        m = jarURLPattern.match(url)
--        jarEntryName = None
--        if m:
--            url = m.group(1)
--            jarEntryName = m.group(2)
--
--        if verifyOnly:
--            try:
--                conn = _urlopen(url, timeout=10)
--                conn.close()
--                return True
--            except (IOError, socket.timeout) as e:
--                _suggest_tlsv1_error(e)
--                verify_errors[url] = e
--            continue
--
--        for i in range(4):
--            if i != 0:
--                time.sleep(1)
--                warn('Retry {} to download from {}'.format(i, url))
--            res = _attempt_download(url, path, jarEntryName)
--            if res is True:
--                return True
--            if res is False:
--                break
--
--    if abortOnError:
--        msg = 'Could not download to ' + path + ' from any of the following URLs: ' + ', '.join(urls)
--        if verifyOnly:
--            for url, e in verify_errors.items():
--                msg += '\n  ' + url + ': ' + str(e)
--        abort(msg)
--    else:
--        return False
-+    print("FAKE download(path={} urls={} verbose={} abortOnError={} verifyOnly={})".format(path, urls, verbose, abortOnError, verifyOnly))
-+    return True
- 
- def update_file(path, content, showDiff=False):
-     """
-@@ -13393,6 +13274,7 @@ class Archiver(SafeFileCreation):
- 
-     def _add_zip(self, filename, archive_name, provenance):
-         self._add_provenance(archive_name, provenance)
-+        os.utime(filename, (315532800, 315532800))
-         self.zf.write(filename, archive_name)
- 
-     def _add_str_zip(self, data, archive_name, provenance):
-@@ -18541,12 +18423,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
          Attempts to locate an existing suite in the local context
          Returns the path to the mx.name dir if found else None
          """
@@ -255,3 +163,129 @@ index af7a9c2..08c0ea8 100755
  
      def _get_import_dir(url, mode):
          """Return directory where the suite will be cloned to"""
+@@ -3816,7 +3777,7 @@ def getmtime(name):
+     """
+     Wrapper for builtin open function that handles long path names on Windows.
+     """
+-    return os.path.getmtime(_safe_path(name))
++    return 315532800
+ 
+ 
+ def stat(name):
+@@ -4062,57 +4023,8 @@ def _attempt_download(url, path, jarEntryName=None):
+     return False
+ 
+ def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
+-    """
+-    Attempts to downloads content for each URL in a list, stopping after the first successful download.
+-    If the content cannot be retrieved from any URL, the program is aborted, unless abortOnError=False.
+-    The downloaded content is written to the file indicated by `path`.
+-    """
+-    if not verifyOnly:
+-        ensure_dirname_exists(path)
+-        assert not path.endswith(os.sep)
+-
+-    # https://docs.oracle.com/javase/7/docs/api/java/net/JarURLConnection.html
+-    jarURLPattern = re.compile('jar:(.*)!/(.*)')
+-    verify_errors = {}
+-    for url in urls:
+-        if not verifyOnly or verbose:
+-            log('Downloading ' + url + ' to ' + path)
+-        m = jarURLPattern.match(url)
+-        jarEntryName = None
+-        if m:
+-            url = m.group(1)
+-            jarEntryName = m.group(2)
+-
+-        if not _opts.trust_http and (url.lower().startswith('http://') or url.lower().startswith('ftp://')):
+-            warn('Downloading from non-https URL {}. Use --trust-http mx option to suppress this warning.'.format(url))
+-
+-        if verifyOnly:
+-            try:
+-                conn = _urlopen(url, timeout=10)
+-                conn.close()
+-            except (IOError, socket.timeout) as e:
+-                _suggest_tlsv1_error(e)
+-                verify_errors[url] = e
+-        else:
+-            for i in range(4):
+-                if i != 0:
+-                    time.sleep(1)
+-                    warn('Retry {} to download from {}'.format(i, url))
+-                if _attempt_download(url, path, jarEntryName):
+-                    return True # Download was successful
+-
+-    if verifyOnly and len(verify_errors) < len(urls): # verify-mode at least one success -> success
+-        return True
+-    else: # Either verification error or no download was successful
+-        msg = 'Could not download to ' + path + ' from any of the following URLs: ' + ', '.join(urls)
+-        if verifyOnly: # verify-mode -> print error details
+-            for url, e in verify_errors.items():
+-                msg += '\n  ' + url + ': ' + str(e)
+-        if abortOnError:
+-            abort(msg)
+-        else:
+-            warn(msg)
+-            return False
++    print("FAKE download(path={} urls={} verbose={} abortOnError={} verifyOnly={})".format(path, urls, verbose, abortOnError, verifyOnly))
++    return True
+ 
+ def update_file(path, content, showDiff=False):
+     """
+@@ -7887,30 +7799,6 @@ class PackedResourceLibrary(ResourceLibrary):
+ 
+     def get_path(self, resolve):
+         extract_path = _make_absolute(self.extract_path, self.suite.dir)
+-        download_path = super(PackedResourceLibrary, self).get_path(resolve)
+-        if resolve and self._check_extract_needed(extract_path, download_path):
+-            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
+-            try:
+-                # extract archive
+-                Extractor.create(download_path).extract(extract_path_tmp)
+-                # ensure modification time is up to date
+-                os.utime(extract_path_tmp, None)
+-                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
+-                try:
+-                    # attempt atomic overwrite
+-                    os.rename(extract_path_tmp, extract_path)
+-                except OSError:
+-                    # clean destination & re-try for cases where atomic overwrite doesn't work
+-                    rmtree(extract_path, ignore_errors=True)
+-                    os.rename(extract_path_tmp, extract_path)
+-            except OSError as ose:
+-                # Rename failed. Race with other process?
+-                if self._check_extract_needed(extract_path, download_path):
+-                    # ok something really went wrong
+-                    abort("Extracting {} failed!".format(download_path), context=ose)
+-            finally:
+-                rmtree(extract_path_tmp, ignore_errors=True)
+-
+         return extract_path
+ 
+     def _check_download_needed(self):
+@@ -8430,7 +8318,7 @@ class VC(_with_metaclass(ABCMeta, object)):
+         :param str branch: a branch name
+         :param bool abortOnError: if True abort on error
+         """
+-        abort(self.kind + " update_to_branch is not implemented")
++        self.run(['hg', vcdir] + cmd)
+ 
+     def is_release_from_tags(self, vcdir, prefix):
+         """
+@@ -8831,7 +8719,7 @@ class HgConfig(VC):
+                 return None
+ 
+     def parent_info(self, vcdir, abortOnError=True):
+-        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
++        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
+         author, date = out.split("|||")
+         ts, _ = date.split(" ")
+         return self._sanitize_parent_info({
+@@ -14069,6 +13957,7 @@ class Archiver(SafeFileCreation):
+ 
+     def _add_zip(self, filename, archive_name, provenance):
+         self._add_provenance(archive_name, provenance)
++        os.utime(filename, (315532800, 315532800))
+         self.zf.write(filename, archive_name)
+ 
+     def _add_str_zip(self, data, archive_name, provenance):

pkgs/development/compilers/graalvm/005_tool_jt.rb.patch

@@ -0,0 +1,46 @@
+diff --git a/tool/jt.rb b/tool/jt.rb
+index 870d88edcb..0a6e4c367b 100755
+--- a/tool/jt.rb
++++ b/tool/jt.rb
+@@ -152,13 +152,16 @@ module Utilities
+   end
+ 
+   def find_mx
+-    if which('mx')
+-      'mx'
++    if ENV.key?("MX_GIT_CACHE_DIR")
++      "mx-internal"
+     else
+-      mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
+-      "#{mx_repo}/mx"
++      if which('mx')
++        'mx'
++      else
++        mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
++        "#{mx_repo}/mx"
++      end
+     end
+-  end
+ 
+   def find_launcher(use_native)
+     if use_native
+@@ -444,8 +447,8 @@ module Commands
+           --no-sforceimports                         do not run sforceimports before building
+           parser                                     build the parser
+           options                                    build the options
+-          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby, 
+-                                                     available by default in mxbuild/truffleruby-jvm, 
++          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby,
++                                                     available by default in mxbuild/truffleruby-jvm,
+                                                      the Ruby is symlinked into rbenv or chruby if available
+               --graal      include the GraalVM Compiler in the build
+               --native     build native ruby image as well, available in mxbuild/truffleruby-native
+@@ -491,7 +494,7 @@ module Commands
+       jt test compiler                               run compiler tests
+       jt test integration [TESTS]                    run integration tests
+       jt test bundle [--jdebug]                      tests using bundler
+-      jt test gems [TESTS]                           tests using gems 
++      jt test gems [TESTS]                           tests using gems
+       jt test ecosystem [TESTS]                      tests using the wider ecosystem such as bundler, Rails, etc
+       jt test cexts [--no-openssl] [--no-gems] [test_names...]
+                                                      run C extension tests (set GEM_HOME)

pkgs/development/compilers/graalvm/006_mx_copylib.py.patch

@@ -0,0 +1,14 @@
+diff --git a/mx.fastr/mx_copylib.py b/mx.fastr/mx_copylib.py
+index 4f57e1954..db45220d9 100644
+--- a/mx.fastr/mx_copylib.py
++++ b/mx.fastr/mx_copylib.py
+@@ -54,6 +54,9 @@ def _copylib(lib, libpath, plain_libpath_base, target):
+     else:
+         try:
+             if platform.system() == 'Linux':
++                # https://github.com/oracle/fastr/issues/110
++                if libpath.endswith("libgcc_s.so"):
++                    libpath = libpath + ".1"
+                 output = subprocess.check_output(['objdump', '-p', libpath])
+             elif platform.system() == 'SunOS':
+                 output = subprocess.check_output(['elfdump', '-d', libpath])

pkgs/development/compilers/graalvm/007_unimplemented.c.patch

@@ -0,0 +1,85 @@
+diff --git a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+index dcf081316..c2cb4879b 100644
+--- a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
++++ b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+@@ -20,8 +20,10 @@
+ 
+ #include <Rinternals.h>
+ #include <stdlib.h>
++#include <rlocale.h>
+ 
+ #include <R_ext/eventloop.h>
++#include <R_ext/GraphicsEngine.h>
+ #include <Defn.h>
+ 
+ Rboolean known_to_be_latin1 = FALSE;
+@@ -166,3 +168,69 @@ int Scollate(SEXP a, SEXP b) {
+ void z_prec_r(Rcomplex *r, Rcomplex *x, double digits) {
+     unimplemented("z_prec_r");
+ }
++
++int Rf_AdobeSymbol2ucs2(int n) {
++  unimplemented("Rf_AdobeSymbol2ucs2");
++  return 0;
++}
++
++size_t Mbrtowc(wchar_t *wc, const char *s, size_t n, mbstate_t *ps) {
++  unimplemented("Mbrtowc");
++  return 0;
++}
++
++double R_GE_VStrHeight(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VStrHeight");
++  return 0;
++}
++
++void R_GE_VText(double x, double y, const char * const s, cetype_t enc,
++		double x_justify, double y_justify, double rotation,
++		const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VText");
++}
++
++double R_GE_VStrWidth(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
++  unimplemented("R_GE_VStrWidth");
++}
++
++void setulb(int n, int m, double *x, double *l, double *u, int *nbd,
++	    double *f, double *g, double factr, double *pgtol,
++	    double *wa, int * iwa, char *task, int iprint, int *isave) {
++  unimplemented("setulb");
++}
++
++void genptry(int n, double *p, double *ptry, double scale, void *ex) {
++  unimplemented("genptry");
++}
++
++double EXP(double x) {
++  unimplemented("EXP");
++  return 0;
++}
++
++double LOG(double x) {
++  unimplemented("LOG");
++  return 0;
++}
++
++Rwchar_t Rf_utf8toucs32(wchar_t high, const char *s) {
++  unimplemented("Rf_utf8toucs32");
++  return 0;
++}
++
++size_t mbtoucs(unsigned int *wc, const char *s, size_t n) {
++  unimplemented("mbtoucs");
++  return (size_t) 0;
++}
++
++
++int DispatchOrEval(SEXP call, SEXP op, const char *generic, SEXP args,
++		   SEXP rho, SEXP *ans, int dropmissing, int argsevald) {
++  unimplemented("DispatchOrEval");
++  return 0;
++}
++
++void ENSURE_NAMEDMAX (SEXP x) {
++  unimplemented("ENSURE_NAMEDMAX");
++}

pkgs/development/compilers/graalvm/008_remove_jfr.patch

@@ -0,0 +1,33 @@
+diff --git a/mx.jvmci/suite.py b/mx.jvmci/suite.py
+index 9690c0a38f..fa1d36b7e1 100644
+--- a/mx.jvmci/suite.py
++++ b/mx.jvmci/suite.py
+@@ -241,18 +241,7 @@ suite = {
+       "workingSets" : "JVMCI,HotSpot,SPARC",
+     },
+ 
+-    "jdk.vm.ci.hotspot.jfr" : {
+-      "subDir" : "jvmci",
+-      "sourceDirs" : ["src"],
+-      "dependencies" : [
+-        "jdk.vm.ci.hotspot",
+-        "JFR",
+-      ],
+-      "checkstyle" : "jdk.vm.ci.hotspot",
+-      "javaCompliance" : "1.8",
+-      "profile" : "",
+-      "workingSets" : "JVMCI,HotSpot",
+-    },
++
+ 
+     "hotspot" : {
+       "native" : True,
+@@ -354,7 +343,7 @@ suite = {
+         "jdk.vm.ci.hotspot.aarch64",
+         "jdk.vm.ci.hotspot.amd64",
+         "jdk.vm.ci.hotspot.sparc",
+-        "jdk.vm.ci.hotspot.jfr",
++
+       ],
+       "distDependencies" : [
+         "JVMCI_SERVICES",

pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch

@@ -0,0 +1,21 @@
+diff --git a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+index 23a76357fd2..f13694b6ed7 100644
+--- a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
++++ b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+@@ -249,15 +249,6 @@ public final class SizeAndSignednessVerifier extends NativeInfoTreeVisitor {
+     }
+ 
+     private void checkSignedness(boolean isUnsigned, ResolvedJavaType type, ResolvedJavaMethod method) {
+-        if (isSigned(type)) {
+-            if (isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is signed, but accessed C value is unsigned", method);
+-            }
+-        } else if (nativeLibs.isWordBase(type)) {
+-            /* every Word type other than Signed is assumed to be unsigned. */
+-            if (!isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is unsigned, but accessed C value is signed", method);
+-            }
+-        }
++
+     }
+ }

pkgs/development/compilers/graalvm/010_mx_substratevm.py

@@ -0,0 +1,13 @@
+diff --git a/substratevm/mx.substratevm/mx_substratevm.py b/substratevm/mx.substratevm/mx_substratevm.py
+index b89163ef983..0fd0138b336 100644
+--- a/substratevm/mx.substratevm/mx_substratevm.py
++++ b/substratevm/mx.substratevm/mx_substratevm.py
+@@ -189,7 +189,7 @@ if str(svm_java_compliance().value) not in GRAAL_COMPILER_FLAGS_MAP:
+     mx.abort("Substrate VM does not support this Java version: " + str(svm_java_compliance()))
+ GRAAL_COMPILER_FLAGS = GRAAL_COMPILER_FLAGS_BASE + GRAAL_COMPILER_FLAGS_MAP[str(svm_java_compliance().value)]
+ 
+-IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases']
++IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases', '-H:+ReportExceptionStackTraces']
+ suite = mx.suite('substratevm')
+ svmSuites = [suite]
+ clibraryDists = ['SVM_HOSTED_NATIVE']

pkgs/development/compilers/graalvm/default.nix

@@ -1,10 +1,11 @@
 { stdenv, lib, fetchFromGitHub, fetchurl, fetchzip, fetchgit, mercurial_4, python27, setJavaClassPath,
-  zlib, makeWrapper, openjdk, unzip, git, clang, llvm, which, icu, ruby, bzip2, glibc
+  which, zlib, makeWrapper, openjdk, unzip, git, clang, llvm, icu, ruby, glibc, bash, gcc, libobjc,
-  # gfortran, readline, bzip2, lzma, pcre, curl, ed, tree ## WIP: fastr deps
+  xcodebuild, gfortran, readline, bzip2, lzma, pcre, curl, ed, libresolv, libiconv, writeScriptBin,
+  openssl, perl, CoreFoundation, Foundation, JavaNativeFoundation, JavaRuntimeSupport, JavaVM, Cocoa
 }:
 
 let
-  version = "19.1.1";
+  version = "19.2.1";
   mercurial = mercurial_4;
   truffleMake = ./truffle.make;
   makeMxGitCache = list: out: ''
@@ -25,6 +26,57 @@ let
     chmod -R +rw ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2
     patchShebangs ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2/python
 
+    # # TUFFLE-RUBY # #
+    (cd ${out}/truffleruby && git apply ${./005_tool_jt.rb.patch})
+    patchShebangs ${out}/truffleruby/tool/query-versions-json.rb
+
+    substituteInPlace ${out}/truffleruby/src/main/c/Makefile \
+      --replace '(MX_HOME)/mx' '(MX_HOME)/mx-internal'
+
+    substituteInPlace ${out}/truffleruby/src/processor/java/org/truffleruby/processor/BuildInformationProcessor.java \
+      --replace 'trufflerubyHome = findHome();' \
+                'trufflerubyHome = new File(System.getenv("MX_GIT_CACHE_DIR"), "truffleruby");' \
+      --replace tool/query-versions-json.rb 'ruby tool/query-versions-json.rb' \
+      --replace 'revision = runCommand("git rev-parse --short=8 HEAD");' \
+                'revision = "${version}";' \
+      --replace 'compileDate = runCommand("git log -1 --date=short --pretty=format:%cd");' \
+                'compileDate = "1970-01-01";'
+
+    substituteInPlace ${out}/truffleruby/mx.truffleruby/mx_truffleruby.py \
+      --replace "mx_binary = join(mx._mx_home, 'mx')" "mx_binary = join(mx._mx_home, 'mx-internal')"
+
+    # # FASTR # #
+    (cd ${out}/fastr && git apply ${ ./006_mx_copylib.py.patch })
+    (cd ${out}/fastr && git apply ${ ./007_unimplemented.c.patch })
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.parser.processor/src/com/oracle/truffle/r/parser/processor/GenerateRParserProcessor.java \
+      --replace 'File suiteRoot = srcGenDir.getCanonicalFile().getParentFile().getParentFile().getParentFile();' \
+                'File suiteRoot = new File(System.getenv("MX_GIT_CACHE_DIR"), "fastr");'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.libs \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/include/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/fficall/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native.recommended/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    # Make sure that the logs aren't hidden when compiling gnur
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.gnur \
+      --replace '> gnur_configure.log 2>&1' "" \
+      --replace '> gnur_make.log 2>&1' ""
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/run/Linux/Renviron \
+      --replace /bin/ "" \
+      --replace /usr/bin/ ""
+
+    sed -i "s|exec \$mx|exec mx-internal|g" ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    chmod +x ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    patchShebangs ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+
     cd ${out}
     hg init
     hg add
@@ -50,12 +102,13 @@ let
                 unzip "$out/${name}" -d "$out/$BASENAME.extracted"
 
                 # Ninja is called later in the build process
+               ${lib.optionalString stdenv.isLinux ''
                  if [ -f $out/$BASENAME.extracted/ninja ]; then
                    patchelf --set-interpreter \
                      "$(cat $NIX_CC/nix-support/dynamic-linker)" \
                      --set-rpath "${stdenv.cc.cc.lib}/lib64" \
                      $out/$BASENAME.extracted/ninja
-                fi
+                 fi''}
                 ''
               else ""}
          '') list}
@@ -89,18 +142,21 @@ let
     rec { sha1 = "42a25dc3219429f0e5d060061f71acb49bf010a0"; name = "HAMCREST_${sha1}/hamcrest.jar";                                                   url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar; }
     rec { sha1 = "1dc37250fbc78e23a65a67fbbaf71d2e9cbc3c0b"; name = "HAMCREST_${sha1}/hamcrest.sources.jar";                                           url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3-sources.jar; }
     rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
+] ++ lib.optionals stdenv.isLinux [
+  rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
+                                                                          ]
+++ lib.optionals stdenv.isDarwin [
+  rec { sha1 = "67f6d23cbebd8998450a88b5bef362171f66f11a"; name = "hsdis_${sha1}/hsdis.dylib";                                                       url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-darwin-${sha1}.dylib"; }
                                                                           ];
 
   graal-mxcache = jvmci8-mxcache ++ [
+    # rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_LIBCXX_SRC_${sha1}/llvm-org-libcxx-src.tar.gz";                          url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_COMPILER_RT_LINUX_${sha1}/llvm-org-compiler-rt-linux.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
     rec { sha1 = "a990b2dba1c706f5c43c56fedfe70bad9a695852"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.jar";                                           url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2.jar; }
     rec { sha1 = "decbd95d46092fa9afaf2523b5b23d07ad7ad6bc"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.sources.jar";                                   url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-sources.jar; }
-    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
-    rec { sha1 = "503402aa0cf80fd95ede043c0011152c2b4556fd"; name = "LLVM_PLATFORM_${sha1}/llvm-platform.jar";                                         url = mirror://maven/org/bytedeco/javacpp-presets/llvm-platform/6.0.1-1.4.2/llvm-platform-6.0.1-1.4.2.jar; }
     rec { sha1 = "cfa6a0259d98bff5aa8d41ba11b4d1dad648fbaa"; name = "JAVACPP_${sha1}/javacpp.jar";                                                     url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2.jar; }
     rec { sha1 = "fdb2d2c17f6b91cdd5421554396da8905f0dfed2"; name = "JAVACPP_${sha1}/javacpp.sources.jar";                                             url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2-sources.jar; }
     rec { sha1 = "702ca2d0ae93841c5ab75e4d119b29780ec0b7d9"; name = "NINJA_SYNTAX_${sha1}/ninja-syntax.tar.gz";                                        url = "https://pypi.org/packages/source/n/ninja_syntax/ninja_syntax-1.7.2.tar.gz"; }
-    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
-          isNinja = true; }
     rec { sha1 = "f2cfb09cee12469ff64f0d698b13de19903bb4f7"; name = "NanoHTTPD-WebSocket_${sha1}/nanohttpd-websocket.jar";                             url = mirror://maven/org/nanohttpd/nanohttpd-websocket/2.3.1/nanohttpd-websocket-2.3.1.jar; }
     rec { sha1 = "a8d54d1ca554a77f377eff6bf9e16ca8383c8f6c"; name = "NanoHTTPD_${sha1}/nanohttpd.jar";                                                 url = mirror://maven/org/nanohttpd/nanohttpd/2.3.1/nanohttpd-2.3.1.jar; }
     rec { sha1 = "946f8aa9daa917dd81a8b818111bec7e288f821a"; name = "ANTLR4_${sha1}/antlr4.jar";                                                       url = mirror://maven/org/antlr/antlr4-runtime/4.7.1/antlr4-runtime-4.7.1.jar; }
@@ -111,8 +167,7 @@ let
     rec { sha1 = "280c265b789e041c02e5c97815793dfc283fb1e6"; name = "LIBFFI_SOURCES_${sha1}/libffi-sources.tar.gz";                                    url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/libffi-3.2.1.tar.gz; }
     rec { sha1 = "8819cea8bfe22c9c63f55465e296b3855ea41786"; name = "TruffleJSON_${sha1}/trufflejson.jar";                                             url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/trufflejson-20180130.jar; }
     rec { sha1 = "9712a8124c40298015f04a74f61b3d81a51513af"; name = "CHECKSTYLE_8.8_${sha1}/checkstyle-8.8.jar";                                       url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/checkstyle-8.8-all.jar; }
-    rec { sha1 = "158ba6f2b346469b5f8083d1700c3f55b8b9082c"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11.tar.gz; }
+    rec { sha1 = "8dc5a90bed5f51d7538d05b8c31c31b7dfddbd66"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20.tar.gz; }
-    rec { sha1 = "eb5ffa476ed2f6fac0ecd4bb2ae32741f9646932"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11-linux-amd64.tar.gz; }
     rec { sha1 = "e6e60889b7211a80b21052a249bd7e0f88f79fee"; name = "Java-WebSocket_${sha1}/java-websocket.jar";                                       url = mirror://maven/org/java-websocket/Java-WebSocket/1.3.9/Java-WebSocket-1.3.9.jar; }
     rec { sha1 = "7a4d00d5ec5febd252a6182e8b6e87a0a9821f81"; name = "ICU4J_${sha1}/icu4j.jar";                                                         url = mirror://maven/com/ibm/icu/icu4j/62.1/icu4j-62.1.jar; }
     # This duplication of asm with underscore and minus is totally weird
@@ -138,15 +193,25 @@ let
     rec { sha1 = "505a09064f6e2209616f38724f6d97d8d889aa92"; name = "JONI_${sha1}/joni.sources.jar";                                                   url = mirror://maven/org/jruby/joni/joni/2.1.25/joni-2.1.25-sources.jar; }
     rec { sha1 = "c4f7d054303948eb6a4066194253886c8af07128"; name = "XZ-1.8_${sha1}/xz-1.8.jar";                                                       url = mirror://maven/org/tukaani/xz/1.8/xz-1.8.jar; }
     rec { sha1 = "9314d3d372b05546a33791fbc8dd579c92ebd16b"; name = "GNUR_${sha1}/gnur.tar.gz";                                                        url = http://cran.rstudio.com/src/base/R-3/R-3.5.1.tar.gz; }
-    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }
+    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }] ++
-  ];
+  lib.optionals stdenv.isLinux [
+    rec { sha1 = "df4c1f784294d02a82d78664064248283bfcc297"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
+    rec { sha1 = "fd1a723d62cbbc591041d303e8b151d89f131643"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-linux-amd64.tar.gz; }
+    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
+          isNinja = true; }] ++
+  lib.optionals stdenv.isDarwin [
+    rec { sha1 = "0fa1af180755fa4cc018ee9be33f2d7d827593c4"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-darwin-amd64.tar.gz; }
+    rec { sha1 = "57bc74574104a9e0a2dc4d7a71ffcc5731909e57"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-macosx-x86_64.jar; }
+    rec { sha1 = "ae23bb365930f720acc88c62640bae6852a37d67"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-macosx-x86_64.tar.gz; }
+    rec { sha1 = "8142c497f7dfbdb052a1e31960fdfe2c6f9a5ca2"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-mac.zip";
+          isNinja = true; }];
 
   graal-mxcachegit = [
-    { sha256 = "05z2830ng71bhgsxc0zyc74l1bz7hg54la8j1r99993fhhch4y36"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
+    { sha256 = "01w39ms39gl3cw7c2fgcacr2yjg94im9x2x7p5g94l6xlcgqvcnr"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
-    { sha256 = "0ai5x4n1c2lcfkfpp29zn1bcmp3khc5hvssyw1qr1l2zy79fxwjp"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
+    { sha256 = "1dps9n5b9c80pbg1fmlwpffy6ina0f0h27di24kafc8isxrdggia"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
-    { sha256 = "010079qsl6dff3yca8vlzcahq9z1ppyr758shjkm1f7izwphjv7p"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
+    { sha256 = "0jdpdqm3ld1wsasmi8ka26qf19cibjac8lrqm040h5vh0iqzxizy"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
-    { sha256 = "0hcqbasqs0yb7p1sal63qbxqxh942gh5vzl95pfdlflmc2g82v4q"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }
+    { sha256 = "1gv8vafwrafjzvgv4gwk4kcsb3bnvsx07qa5inc0bdyxy5shl381"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }];
-  ];
 
   ninja-syntax = python27.pkgs.buildPythonPackage rec {
     version = "1.7.2";
@@ -169,13 +234,13 @@ let
 in rec {
 
   mx = stdenv.mkDerivation rec {
-    version = "5.223.0";
+    version = "5.247.1";
     pname = "mx";
     src = fetchFromGitHub {
       owner  = "graalvm";
       repo   = "mx";
       rev    = version;
-      sha256 = "0q51dnm6n1472p93dxr4jh8d7cv09a70pq89cdgxwh42vapykrn9";
+      sha256 = "038qr49rqzkhj76nqd27h8fysssnlpdhmy23ks2y81xlxhlzkc59";
     };
     nativeBuildInputs = [ makeWrapper ];
     prePatch = ''
@@ -214,15 +279,17 @@ in rec {
   };
 
   jvmci8 = stdenv.mkDerivation rec {
-    version = "19.2-b01";
+    version = "19.3-b05";
     pname = "jvmci";
     src = fetchFromGitHub {
       owner  = "graalvm";
       repo   = "graal-jvmci-8";
       rev    = "jvmci-${version}";
-      sha256 = "0maipj871vaxvap4576m0pzblzqxfjjzmwap3ndd84ny8d6vbqaa";
+      sha256 =  "0j7my76vldbrvki9x1gn9ics3x2z96j05jdy4nflbpik8i396114";
     };
-    buildInputs = [ mx mercurial openjdk ];
+    buildInputs = [ mx mercurial openjdk ] ++ lib.optional stdenv.isDarwin [
+      libobjc CoreFoundation Foundation JavaNativeFoundation JavaRuntimeSupport JavaVM xcodebuild Cocoa
+    ];
     postUnpack = ''
       # a fake mercurial dir to prevent mx crash and supply the version to mx
       ( cd $sourceRoot
@@ -233,17 +300,27 @@ in rec {
         hg checkout ${lib.escapeShellArg src.rev}
       )
     '';
-    patches = [ ./004_mx_jvmci.py.patch ];
+    patches = [ ./004_mx_jvmci.py.patch ] ++
+              lib.optional stdenv.isDarwin [
+                ./008_remove_jfr.patch ];
     postPatch =''
       # The hotspot version name regex fix
       substituteInPlace mx.jvmci/mx_jvmci.py \
-        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-bga"
+        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-b[g\\d][a\\d]"
-      substituteInPlace src/share/vm/jvmci/jvmciCompilerToVM.cpp \
+      # darwin: https://github.com/oracle/graal/issues/1816
-        --replace 'method->name_and_sig_as_C_string(), method->native_function(), entry' \
+      substituteInPlace src/share/vm/code/compiledIC.cpp \
-                  'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
+        --replace 'entry == false' '*entry == false'
     '';
     hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
+    NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.isDarwin [
+      "-Wno-reserved-user-defined-literal"
+      "-Wno-c++11-narrowing"
+    ] ++
+    lib.optional stdenv.isLinux [
+      "-Wno-error=format-overflow" # newly detected by gcc7
+      "-Wno-error=nonnull"
+    ]);
+
     buildPhase = ''
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
       export MX_CACHE_DIR=${makeMxCache jvmci8-mxcache}
@@ -254,7 +331,9 @@ in rec {
     '';
     installPhase = ''
       mkdir -p $out
-      mv openjdk1.8.0_*/linux-amd64/product/* $out
+      ${if stdenv.isDarwin
+        then "mv openjdk1.8.0_*/darwin-amd64/product/* $out"
+        else "mv openjdk1.8.0_*/linux-amd64/product/* $out"}
       install -v -m0555 -D $MX_CACHE_DIR/hsdis*/hsdis.so $out/jre/lib/amd64/hsdis-amd64.so
     '';
     # copy-paste openjdk's preFixup
@@ -283,18 +362,29 @@ in rec {
       owner  = "oracle";
       repo   = "graal";
       rev    = "vm-${version}";
-      sha256 = "0abx6adk91yzaf1md4qbidxykpqcgphh6j4hj01ry57s4if0j66f";
+      sha256 = "0v8zkmzkyhmmmvra5pp876d4i4ijrrw15j98ipayc7is02kwiwmq";
     };
-    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ];
+
-    buildInputs = [ mx zlib mercurial jvmci8 git clang llvm
+    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ] ++
-                    python27withPackages which icu ruby bzip2
+              lib.optional stdenv.isDarwin [
-                    # gfortran readline bzip2 lzma pcre.dev curl ed ## WIP: fastr dependencies
+                ./009_remove_signedness_verifier.patch ./010_mx_substratevm.py
               ];
+
+    buildInputs = [ mx zlib.dev mercurial jvmci8 git llvm clang
+                    python27withPackages icu ruby bzip2 which
+                    readline bzip2 lzma pcre curl ed gfortran
+                  ]  ++ lib.optional stdenv.isDarwin [
+                    CoreFoundation gcc.cc.lib libiconv perl openssl
+                  ];
+
     postUnpack = ''
+      ${lib.optionalString stdenv.isLinux ''
         cp ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/stdlib.h \
           $sourceRoot/sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include
-      cp ${truffleMake} $TMP && mv *truffle.make truffle.make
+      ''}
+      cp ${truffleMake} $TMPDIR/truffle.make
       rm $sourceRoot/truffle/src/libffi/patches/others/0001-Add-mx-bootstrap-Makefile.patch
+
       # a fake mercurial dir to prevent mx crash and supply the version to mx
       ( cd $sourceRoot
         hg init
@@ -303,57 +393,93 @@ in rec {
         hg tag      ${lib.escapeShellArg src.rev}
         hg checkout ${lib.escapeShellArg src.rev}
       )
+
+      # make a copy of jvmci8
+      mkdir $NIX_BUILD_TOP/jvmci8
+      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
+      chmod +w -R $NIX_BUILD_TOP/jvmci8
+      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
+      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
+      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
+      cd $TMPDIR
     '';
+
     postPatch = ''
       substituteInPlace substratevm/src/com.oracle.svm.core.posix/src/com/oracle/svm/core/posix/headers/PosixDirectives.java \
         --replace '<zlib.h>' '<${zlib.dev}/include/zlib.h>'
       substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
         --replace 'cmd.add("-v");' 'cmd.add("-v"); cmd.add("-L${zlib}/lib");'
+
+      # For debugging native-image build, add this replace statement on CCompilerInvoker.java
+      # --replace '(String line : lines) {' '(String line : lines) {System.out.println("DEBUG: " + line);'
+      ${if stdenv.isLinux then ''
           substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
             --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
-          'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");'
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");' ''
+        else ''
+          substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
+            --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${gcc.cc}/bin/gcc");
+                       command.add("-F"); command.add("${CoreFoundation}/Library/Frameworks");
+                       command.add("-framework"); command.add("CoreFoundation");'
+       ''}
+
+      # prevent cyclical imports caused by identical <include> names
       substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
         --replace 'protected String compilerCommand = "cc";' 'protected String compilerCommand = "${stdenv.cc}/bin/cc";'
-      # prevent cyclical imports caused by identical <include> names
-      substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
-        --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
       # dragonegg can't seem to compile on nix, so let's not require it
       substituteInPlace sulong/mx.sulong/suite.py \
         --replace '"requireDragonegg" : True,' '"requireDragonegg" : False,'
       substituteInPlace truffle/mx.truffle/mx_truffle.py \
         --replace 'os.path.relpath(self.subject.delegate.dir, self.subject.suite.vc_dir)' \
                   'self.subject.delegate.dir'
-
+      substituteInPlace sulong/projects/bootstrap-toolchain-launchers/Makefile \
+        --replace /bin/bash ${bash}/bin/bash
       # Patch the native-image template, as it will be run during build
       chmod +x vm/mx.vm/launcher_template.sh && patchShebangs vm/mx.vm
       # Prevent random errors from too low maxRuntimecompilemethods
       substituteInPlace truffle/mx.truffle/macro-truffle.properties \
         --replace '-H:MaxRuntimeCompileMethods=1400' \
                   '-H:MaxRuntimeCompileMethods=28000'
+      ${lib.optionalString stdenv.isDarwin ''
+        substituteInPlace truffle/src/com.oracle.truffle.nfi.test.native/src/object.cc \
+          --replace '#include <stdlib.h>' ""
+      ''}
+      ${lib.optionalString stdenv.isLinux ''
+        substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
+          --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
+      ''}
     '';
 
     buildPhase = ''
-      # make a copy of jvmci8
-      mkdir $NIX_BUILD_TOP/jvmci8
-      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
-      chmod +w -R $NIX_BUILD_TOP/jvmci8
-
       export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
-      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
       export MX_GIT_CACHE='refcache'
-      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
       export JVMCI_VERSION_CHECK='ignore'
       export JAVA_HOME=$NIX_BUILD_TOP/jvmci8
-      # export FASTR_RELEASE=true ## WIP
+      export FASTR_RELEASE=true
-      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
+      export PKG_LDFLAGS_OVERRIDE="-L${pcre.out}/lib -L${zlib}/lib -L${gfortran.cc.lib}/lib64"
-      cd $NIX_BUILD_TOP/source
+      ${lib.optionalString stdenv.isDarwin ''
-
+        export CC="gcc"
+        export CPP="gcc -E"
+        export NIX_CXXSTDLIB_LINK=""
+        export NIX_TARGET_CXXSTDLIB_LINK=""
+        export OPENSSL_PREFIX=$(realpath openssl)
+        # this fixes error: impure path 'LibFFIHeaderDirectives' used in link
+        export NIX_ENFORCE_PURITY=0
+      ''}
       ( cd vm
-        mx-internal -v --dynamicimports /substratevm,/tools,sulong,/graal-nodejs,graalpython build
+        mx-internal -v --suite sdk --suite compiler --suite vm --suite tools --suite regex --suite truffle \
+                       --dynamicimports /substratevm,/sulong,graal-js,graalpython,fastr,truffleruby build
       )
     '';
 
-    installPhase = ''
+    installPhase =
+      (if stdenv.isDarwin then ''
+      mkdir -p $out
+      rm -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM_*STAGE1*
+      cp -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
+      ''
+       else ''
       mkdir -p $out
       rm -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM_*STAGE1*
       cp -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
@@ -366,7 +492,7 @@ in rec {
       cp -rf ${glibc}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
       cp ${glibc.static}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
       cp ${zlib.static}/lib/libz.a $out/jre/lib/svm/clibraries/linux-amd64/libz.a
-    '';
+    '');
 
     inherit (jvmci8) preFixup;
     dontStrip = true; # stripped javac crashes with "segmentaion fault"
@@ -390,12 +516,14 @@ in rec {
       ./helloworld
       ./helloworld | fgrep 'Hello World'
 
-      # Ahead-Of-Time compilation with --static
+      ${lib.optionalString stdenv.isLinux
+        ''
+          # Ahead-Of-Time compilation with --static (supported on linux only)
           $out/bin/native-image --no-server --static HelloWorld
           ./helloworld
           ./helloworld | fgrep 'Hello World'
+        ''}
          '';
-
     enableParallelBuilding = true;
     passthru.home = graalvm8;
 
@@ -404,7 +532,7 @@ in rec {
       description = "High-Performance Polyglot VM";
       license = licenses.gpl2;
       maintainers = with maintainers; [ volth hlolli ];
-      platforms = [ "x86_64-linux" /*"aarch64-linux" "x86_64-darwin"*/ ];
+      platforms = [ "x86_64-linux" "x86_64-darwin" /*"aarch64-linux"*/ ];
     };
   };
 }

pkgs/development/compilers/graalvm/truffle.make

@@ -2,13 +2,15 @@
 
 # `make MX_VERBOSE=y` will report all lines executed. The actual value doesn't
 # matter as long as it's not empty.
+
 QUIETLY$(MX_VERBOSE) = @
 
 .PHONY: default
 
 default:
+	sed -i "s|-print-multi-os-directory||g" ../$(SOURCES)/configure
 	$(QUIETLY) echo CONFIGURE libffi
 	$(QUIETLY) mkdir ../$(OUTPUT)
-	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS) > ../libffi.configure.log
+	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS)
 	$(QUIETLY) echo MAKE libffi
-	$(QUIETLY) $(MAKE) -C ../$(OUTPUT) > ../libffi.build.log
+	$(QUIETLY) $(MAKE) -C ../$(OUTPUT)

pkgs/development/compilers/halide/default.nix

@@ -29,7 +29,7 @@ in llvmPackages.stdenv.mkDerivation {
   # To handle the lack of 'local' RPATH; required, as they call one of
   # their built binaries requiring their libs, in the build process.
   preBuild = ''
-    export LD_LIBRARY_PATH="$(pwd)/lib:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$(pwd)/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
   '';
 
   enableParallelBuilding = true;

pkgs/development/compilers/llvm/4/clang/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, release_version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, release_version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@@ -19,8 +19,8 @@ let
       mv clang-tools-extra-* $sourceRoot/tools/extra
     '';
 
-    nativeBuildInputs = [ cmake python ]
+    nativeBuildInputs = [ cmake python3 ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
     buildInputs = [ libxml2 llvm ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;

pkgs/development/compilers/llvm/4/default.nix

@@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@@ -17,7 +17,7 @@ let
   clang-tools-extra_src = fetch "clang-tools-extra" "1dhmp7ccfpr42bmvk3kp37ngjpf3a9m5d4kkpsn7d00hzi7fdl9m";
 
   tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     llvm = callPackage ./llvm.nix {
@@ -29,12 +29,12 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     clang-manpages = lowPrio (tools.clang-unwrapped.override {
       enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
     });
 
     libclang = tools.clang-unwrapped.lib;
@@ -57,7 +57,7 @@ let
   });
 
   libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
   in {
 
     stdenv = overrideCC stdenv buildLlvmTools.clang;

pkgs/development/compilers/llvm/4/libc++/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version }:
 
 stdenv.mkDerivation {
   pname = "libc++";
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
   '' + lib.optionalString stdenv.hostPlatform.isMusl ''
     patchShebangs utils/cat_files.py
   '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python;
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;
 
   buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 

pkgs/development/compilers/llvm/4/lldb.nix

@@ -9,7 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
-, python
+, python3
 , version
 , darwin
 }:
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
       cmake/modules/LLDBStandalone.cmake
   '';
 
-  nativeBuildInputs = [ cmake python which swig ];
+  nativeBuildInputs = [ cmake python3 which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 

pkgs/development/compilers/llvm/4/llvm.nix

@@ -2,7 +2,7 @@
 , fetch
 , fetchpatch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libxml2
@@ -40,8 +40,8 @@ stdenv.mkDerivation ({
   outputs = [ "out" ]
     ++ stdenv.lib.optional enableSharedLibraries "lib";
 
-  nativeBuildInputs = [ cmake python ]
+  nativeBuildInputs = [ cmake python3 ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
   buildInputs = [ libxml2 libffi ];
 
@@ -143,7 +143,7 @@ stdenv.mkDerivation ({
   '';
 
   preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
   '';
 
   postInstall = stdenv.lib.optionalString enableSharedLibraries ''