summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS1
-rw-r--r--maintainers/maintainer-list.nix24
-rw-r--r--nixos/doc/manual/release-notes/rl-2009.xml11
-rw-r--r--nixos/lib/eval-config.nix4
-rw-r--r--nixos/lib/test-driver/test-driver.py7
-rw-r--r--nixos/modules/services/misc/ssm-agent.nix6
-rw-r--r--nixos/modules/services/monitoring/prometheus/default.nix27
-rw-r--r--nixos/modules/virtualisation/docker-preloader.nix134
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix1
-rw-r--r--nixos/tests/all-tests.nix6
-rw-r--r--nixos/tests/common/ec2.nix58
-rw-r--r--nixos/tests/containers-reloadable.nix4
-rw-r--r--nixos/tests/cri-o.nix19
-rw-r--r--nixos/tests/docker-preloader.nix27
-rw-r--r--nixos/tests/ec2.nix140
-rw-r--r--nixos/tests/gnome3.nix10
-rw-r--r--nixos/tests/hardened.nix114
-rw-r--r--nixos/tests/hocker-fetchdocker/default.nix9
-rw-r--r--nixos/tests/installer.nix2
-rw-r--r--nixos/tests/openstack-image.nix70
-rw-r--r--pkgs/applications/blockchains/clightning.nix4
-rw-r--r--pkgs/applications/gis/gmt/dcw.nix32
-rw-r--r--pkgs/applications/gis/gmt/default.nix73
-rw-r--r--pkgs/applications/gis/gmt/gshhg.nix31
-rw-r--r--pkgs/applications/graphics/write_stylus/default.nix22
-rw-r--r--pkgs/applications/misc/html5validator/default.nix25
-rw-r--r--pkgs/applications/misc/snowsql/default.nix50
-rw-r--r--pkgs/applications/misc/super_user_spark/default.nix32
-rw-r--r--pkgs/applications/networking/browsers/opera/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/argo/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/cni/plugins.nix2
-rw-r--r--pkgs/applications/networking/cluster/helmfile/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/ssm-agent/default.nix47
-rw-r--r--pkgs/applications/networking/instant-messengers/ytalk/default.nix21
-rw-r--r--pkgs/applications/networking/nextdns/default.nix4
-rw-r--r--pkgs/applications/office/espanso/default.nix6
-rw-r--r--pkgs/applications/science/biology/igv/default.nix22
-rw-r--r--pkgs/applications/science/electronics/kicad/base.nix2
-rw-r--r--pkgs/applications/science/electronics/kicad/default.nix2
-rw-r--r--pkgs/applications/science/electronics/kicad/libraries.nix6
-rw-r--r--pkgs/applications/science/electronics/kicad/versions.nix24
-rw-r--r--pkgs/applications/science/electronics/verilator/default.nix23
-rw-r--r--pkgs/applications/science/logic/isabelle/default.nix22
-rw-r--r--pkgs/applications/science/logic/mcy/default.nix6
-rw-r--r--pkgs/applications/science/logic/symbiyosys/default.nix25
-rw-r--r--pkgs/applications/science/math/qalculate-gtk/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/fast-export/default.nix36
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix2
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/cri-o/default.nix3
-rw-r--r--pkgs/applications/virtualization/cri-o/wrapper.nix2
-rw-r--r--pkgs/applications/virtualization/crun/default.nix2
-rw-r--r--pkgs/applications/virtualization/podman/default.nix2
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix2
-rw-r--r--pkgs/applications/virtualization/runc/default.nix2
-rw-r--r--pkgs/data/fonts/clearlyU/default.nix11
-rw-r--r--pkgs/data/fonts/creep/default.nix6
-rw-r--r--pkgs/data/fonts/dina/default.nix6
-rw-r--r--pkgs/data/fonts/envypn-font/default.nix6
-rw-r--r--pkgs/data/fonts/gohufont/default.nix11
-rw-r--r--pkgs/data/fonts/profont/default.nix7
-rw-r--r--pkgs/data/fonts/siji/default.nix6
-rw-r--r--pkgs/data/fonts/tamsyn/default.nix6
-rw-r--r--pkgs/data/fonts/tamzen/default.nix6
-rw-r--r--pkgs/data/fonts/terminus-font/default.nix6
-rw-r--r--pkgs/data/fonts/tewi/default.nix8
-rw-r--r--pkgs/data/fonts/ucs-fonts/default.nix8
-rw-r--r--pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix6
-rw-r--r--pkgs/data/fonts/uni-vga/default.nix9
-rw-r--r--pkgs/data/fonts/unifont/default.nix6
-rw-r--r--pkgs/data/fonts/uw-ttyp0/default.nix4
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell/default.nix6
-rw-r--r--pkgs/desktops/gnome-3/extensions/night-theme-switcher/default.nix12
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-volumed/default.nix52
-rw-r--r--pkgs/desktops/xfce/default.nix4
-rw-r--r--pkgs/development/compilers/nextpnr/default.nix6
-rw-r--r--pkgs/development/compilers/yosys/default.nix6
-rw-r--r--pkgs/development/coq-modules/coqprime/default.nix10
-rw-r--r--pkgs/development/interpreters/clojure/default.nix5
-rw-r--r--pkgs/development/interpreters/groovy/default.nix4
-rw-r--r--pkgs/development/interpreters/guile/2.0.nix2
-rw-r--r--pkgs/development/libraries/libguestfs/default.nix4
-rw-r--r--pkgs/development/libraries/oneDNN/default.nix4
-rw-r--r--pkgs/development/libraries/openxr-loader/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/magma/default.nix12
-rw-r--r--pkgs/development/libraries/tk/generic.nix2
-rw-r--r--pkgs/development/libraries/utf8proc/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/containers/data.nix18
-rw-r--r--pkgs/development/ocaml-modules/containers/default.nix14
-rw-r--r--pkgs/development/ocaml-modules/dune-action-plugin/default.nix19
-rw-r--r--pkgs/development/ocaml-modules/dune-glob/default.nix19
-rw-r--r--pkgs/development/ocaml-modules/dune-private-libs/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/hidapi/default.nix27
-rw-r--r--pkgs/development/ocaml-modules/ocamlgraph/default.nix28
-rw-r--r--pkgs/development/ocaml-modules/ocamlgraph/destdir.patch13
-rw-r--r--pkgs/development/python-modules/awkward1/default.nix4
-rw-r--r--pkgs/development/python-modules/gspread/default.nix5
-rw-r--r--pkgs/development/python-modules/pandas/default.nix4
-rw-r--r--pkgs/development/python-modules/pelican/default.nix27
-rw-r--r--pkgs/development/python-modules/sabyenc3/default.nix22
-rw-r--r--pkgs/development/python-modules/test-tube/default.nix46
-rw-r--r--pkgs/development/python-modules/userpath/default.nix30
-rw-r--r--pkgs/development/tools/analysis/tflint/default.nix4
-rw-r--r--pkgs/development/tools/bazel-kazel/default.nix4
-rw-r--r--pkgs/development/tools/cloudfoundry-cli/default.nix15
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/icestorm/default.nix8
-rw-r--r--pkgs/development/tools/misc/itm-tools/cargo-lock.patch321
-rw-r--r--pkgs/development/tools/misc/itm-tools/default.nix28
-rw-r--r--pkgs/development/tools/ocaml/dune/2.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-cache/default.nix26
-rw-r--r--pkgs/development/tools/rust/cargo-fuzz/default.nix4
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/trellis/default.nix8
-rw-r--r--pkgs/games/tome2/default.nix2
-rw-r--r--pkgs/misc/hdt/default.nix27
-rw-r--r--pkgs/os-specific/linux/lvm2/default.nix4
-rw-r--r--pkgs/servers/bazarr/default.nix6
-rw-r--r--pkgs/servers/rippled/default.nix19
-rw-r--r--pkgs/servers/sabnzbd/default.nix24
-rw-r--r--pkgs/servers/sql/dolt/default.nix6
-rw-r--r--pkgs/tools/X11/wmutils-libwm/default.nix25
-rw-r--r--pkgs/tools/X11/xpra/default.nix5
-rw-r--r--pkgs/tools/admin/lego/default.nix6
-rw-r--r--pkgs/tools/filesystems/fuse-overlayfs/default.nix2
-rw-r--r--pkgs/tools/graphics/swfdec/default.nix37
-rw-r--r--pkgs/tools/misc/mutagen/default.nix4
-rw-r--r--pkgs/tools/networking/mailutils/default.nix2
-rw-r--r--pkgs/tools/networking/slirp4netns/default.nix2
-rw-r--r--pkgs/tools/security/1password-gui/default.nix4
-rw-r--r--pkgs/tools/security/creddump/default.nix36
-rw-r--r--pkgs/tools/security/ibm-sw-tpm2/default.nix4
-rw-r--r--pkgs/tools/text/miller/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix50
-rw-r--r--pkgs/top-level/coq-packages.nix2
-rw-r--r--pkgs/top-level/ocaml-packages.nix10
-rw-r--r--pkgs/top-level/python-packages.nix6
139 files changed, 1639 insertions, 846 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 29fbfa2a0bc..19b9ad57933 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -198,6 +198,7 @@
 /nixos/modules/virtualisation/containers.nix @NixOS/podman @zowoq
 /nixos/modules/virtualisation/cri-o.nix      @NixOS/podman @zowoq
 /nixos/modules/virtualisation/podman.nix     @NixOS/podman @zowoq
+/nixos/tests/cri-o.nix                       @NixOS/podman @zowoq
 /nixos/tests/podman.nix                      @NixOS/podman @zowoq
 
 # Blockchains
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e53e8e5f832..efdc0fc7bc7 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -472,6 +472,12 @@
     githubId = 858965;
     name = "Andrew Morsillo";
   };
+  andehen = {
+    email = "git@andehen.net";
+    github = "andehen";
+    githubId = 754494;
+    name = "Anders Asheim Hennum";
+  };
   andersk = {
     email = "andersk@mit.edu";
     github = "andersk";
@@ -3349,6 +3355,12 @@
     githubId = 131599;
     name = "Martin Weinelt";
   };
+  hh = {
+    email = "hh@m-labs.hk";
+    github = "HarryMakes";
+    githubId = 66358631;
+    name = "Harry Ho";
+  };
   hhm = {
     email = "heehooman+nixpkgs@gmail.com";
     github = "hhm0";
@@ -8547,6 +8559,12 @@
     githubId = 699403;
     name = "Tomas Vestelind";
   };
+  tviti = {
+    email = "tviti@hawaii.edu";
+    github = "tviti";
+    githubId = 2251912;
+    name = "Taylor Viti";
+  };
   tvorog = {
     email = "marszaripov@gmail.com";
     github = "tvorog";
@@ -9438,4 +9456,10 @@
     github = "fzakaria";
     githubId = 605070;
   };
+  yevhenshymotiuk = {
+    name = "Yevhen Shymotiuk";
+    email = "yevhenshymotiuk@gmail.com";
+    github = "yevhenshymotiuk";
+    githubId = 44244245;
+  };
 }
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index 83bc2f82bbf..b958aab07c5 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -128,7 +128,7 @@ GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
    </listitem>
    <listitem>
     <para>
-      Two new option <link linkend="opt-documentation.man.generateCaches">documentation.man.generateCaches</link>
+      The new option <link linkend="opt-documentation.man.generateCaches">documentation.man.generateCaches</link>
       has been added to automatically generate the <literal>man-db</literal> caches, which are needed by utilities
       like <command>whatis</command> and <command>apropos</command>. The caches are generated during the build of
       the NixOS configuration: since this can be expensive when a large number of packages are installed, the
@@ -195,6 +195,15 @@ GRANT ALL PRIVILEGES ON *.* TO 'mysql'@'localhost' WITH GRANT OPTION;
       The NixOS module system now supports freeform modules as a mix between <literal>types.attrsOf</literal> and <literal>types.submodule</literal>. These allow you to explicitly declare a subset of options while still permitting definitions without an associated option. See <xref linkend='sec-freeform-modules'/> for how to use them.
      </para>
    </listitem>
+   <listitem>
+     <para>
+       The GRUB module gained support for basic password protection, which
+       allows to restrict non-default entries in the boot menu to one or more
+       users. The users and passwords are defined via the option
+       <option>boot.loader.grub.users</option>.
+       Note: Password support is only avaiable in GRUB version 2.
+     </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/lib/eval-config.nix b/nixos/lib/eval-config.nix
index c8824c2690d..15429a7160c 100644
--- a/nixos/lib/eval-config.nix
+++ b/nixos/lib/eval-config.nix
@@ -24,11 +24,11 @@
   check ? true
 , prefix ? []
 , lib ? import ../../lib
+, extraModules ? let e = builtins.getEnv "NIXOS_EXTRA_MODULE_PATH";
+                 in if e == "" then [] else [(import e)]
 }:
 
 let extraArgs_ = extraArgs; pkgs_ = pkgs;
-    extraModules = let e = builtins.getEnv "NIXOS_EXTRA_MODULE_PATH";
-                   in if e == "" then [] else [(import e)];
 in
 
 let
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
index 7b8d5803aa5..f4e2bb6100f 100644
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -424,15 +424,18 @@ class Machine:
                 output += out
         return output
 
-    def fail(self, *commands: str) -> None:
+    def fail(self, *commands: str) -> str:
         """Execute each command and check that it fails."""
+        output = ""
         for command in commands:
             with self.nested("must fail: {}".format(command)):
-                status, output = self.execute(command)
+                (status, out) = self.execute(command)
                 if status == 0:
                     raise Exception(
                         "command `{}` unexpectedly succeeded".format(command)
                     )
+                output += out
+        return output
 
     def wait_until_succeeds(self, command: str) -> str:
         """Wait until a command returns success and return its output.
diff --git a/nixos/modules/services/misc/ssm-agent.nix b/nixos/modules/services/misc/ssm-agent.nix
index f7c05deeecb..00e806695fd 100644
--- a/nixos/modules/services/misc/ssm-agent.nix
+++ b/nixos/modules/services/misc/ssm-agent.nix
@@ -29,13 +29,15 @@ in {
 
   config = mkIf cfg.enable {
     systemd.services.ssm-agent = {
+      users.extraUsers.ssm-user = {};
+
       inherit (cfg.package.meta) description;
       after    = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      path = [ fake-lsb-release ];
+      path = [ fake-lsb-release pkgs.coreutils ];
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/agent";
+        ExecStart = "${cfg.package}/bin/amazon-ssm-agent";
         KillMode = "process";
         Restart = "on-failure";
         RestartSec = "15min";
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index 84a72afac2f..d7e06484b69 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -46,7 +46,7 @@ let
   cmdlineArgs = cfg.extraFlags ++ [
     "--storage.tsdb.path=${workingDir}/data/"
     "--config.file=${prometheusYml}"
-    "--web.listen-address=${cfg.listenAddress}"
+    "--web.listen-address=${cfg.listenAddress}:${builtins.toString cfg.port}"
     "--alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}"
     "--alertmanager.timeout=${toString cfg.alertmanagerTimeout}s"
   ] ++
@@ -489,9 +489,17 @@ in {
       '';
     };
 
+    port = mkOption {
+      type = types.port;
+      default = 9090;
+      description = ''
+        Port to listen on.
+      '';
+    };
+
     listenAddress = mkOption {
       type = types.str;
-      default = "0.0.0.0:9090";
+      default = "0.0.0.0";
       description = ''
         Address to listen on for the web interface, API, and telemetry.
       '';
@@ -619,6 +627,21 @@ in {
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      ( let
+          legacy = builtins.match "(.*):(.*)" cfg.listenAddress;
+        in {
+          assertion = legacy == null;
+          message = ''
+            Do not specify the port for Prometheus to listen on in the
+            listenAddress option; use the port option instead:
+              services.prometheus.listenAddress = ${builtins.elemAt legacy 0};
+              services.prometheus.port = ${builtins.elemAt legacy 1};
+          '';
+        }
+      )
+    ];
+
     users.groups.prometheus.gid = config.ids.gids.prometheus;
     users.users.prometheus = {
       description = "Prometheus daemon user";
diff --git a/nixos/modules/virtualisation/docker-preloader.nix b/nixos/modules/virtualisation/docker-preloader.nix
deleted file mode 100644
index 6ab83058dee..00000000000
--- a/nixos/modules/virtualisation/docker-preloader.nix
+++ /dev/null
@@ -1,134 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-with builtins;
-
-let
-  cfg = config.virtualisation;
-
-  sanitizeImageName = image: replaceStrings ["/"] ["-"] image.imageName;
-  hash = drv: head (split "-" (baseNameOf drv.outPath));
-  # The label of an ext4 FS is limited to 16 bytes
-  labelFromImage = image: substring 0 16 (hash image);
-
-  # The Docker image is loaded and some files from /var/lib/docker/
-  # are written into a qcow image.
-  preload = image: pkgs.vmTools.runInLinuxVM (
-    pkgs.runCommand "docker-preload-image-${sanitizeImageName image}" {
-      buildInputs = with pkgs; [ docker e2fsprogs utillinux curl kmod ];
-      preVM = pkgs.vmTools.createEmptyImage {
-        size = cfg.dockerPreloader.qcowSize;
-        fullName = "docker-deamon-image.qcow2";
-      };
-    }
-    ''
-      mkfs.ext4 /dev/vda
-      e2label /dev/vda ${labelFromImage image}
-      mkdir -p /var/lib/docker
-      mount -t ext4 /dev/vda /var/lib/docker
-
-      modprobe overlay
-
-      # from https://github.com/tianon/cgroupfs-mount/blob/master/cgroupfs-mount
-      mount -t tmpfs -o uid=0,gid=0,mode=0755 cgroup /sys/fs/cgroup
-      cd /sys/fs/cgroup
-      for sys in $(awk '!/^#/ { if ($4 == 1) print $1 }' /proc/cgroups); do
-        mkdir -p $sys
-        if ! mountpoint -q $sys; then
-          if ! mount -n -t cgroup -o $sys cgroup $sys; then
-            rmdir $sys || true
-          fi
-        fi
-      done
-
-      dockerd -H tcp://127.0.0.1:5555 -H unix:///var/run/docker.sock &
-
-      until $(curl --output /dev/null --silent --connect-timeout 2 http://127.0.0.1:5555); do
-        printf '.'
-        sleep 1
-      done
-
-      docker load -i ${image}
-
-      kill %1
-      find /var/lib/docker/ -maxdepth 1 -mindepth 1 -not -name "image" -not -name "overlay2" | xargs rm -rf
-    '');
-
-  preloadedImages = map preload cfg.dockerPreloader.images;
-
-in
-
-{
-  options.virtualisation.dockerPreloader = {
-    images = mkOption {
-      default = [ ];
-      type = types.listOf types.package;
-      description =
-      ''
-        A list of Docker images to preload (in the /var/lib/docker directory).
-      '';
-    };
-    qcowSize = mkOption {
-      default = 1024;
-      type = types.int;
-      description =
-      ''
-        The size (MB) of qcow files.
-      '';
-    };
-  };
-
-  config = mkIf (cfg.dockerPreloader.images != []) {
-    assertions = [{
-      # If docker.storageDriver is null, Docker choose the storage
-      # driver. So, in this case, we cannot be sure overlay2 is used.
-      assertion = cfg.docker.storageDriver == "overlay2"
-        || cfg.docker.storageDriver == "overlay"
-        || cfg.docker.storageDriver == null;
-      message = "The Docker image Preloader only works with overlay2 storage driver!";
-    }];
-
-    virtualisation.qemu.options =
-      map (path: "-drive if=virtio,file=${path}/disk-image.qcow2,readonly,media=cdrom,format=qcow2")
-      preloadedImages;
-
-
-    # All attached QCOW files are mounted and their contents are linked
-    # to /var/lib/docker/ in order to make image available.
-    systemd.services.docker-preloader = {
-      description = "Preloaded Docker images";
-      wantedBy = ["docker.service"];
-      after = ["network.target"];
-      path = with pkgs; [ mount rsync jq ];
-      script = ''
-        mkdir -p /var/lib/docker/overlay2/l /var/lib/docker/image/overlay2
-        echo '{}' > /tmp/repositories.json
-
-        for i in ${concatStringsSep " " (map labelFromImage cfg.dockerPreloader.images)}; do
-          mkdir -p /mnt/docker-images/$i
-
-          # The ext4 label is limited to 16 bytes
-          mount /dev/disk/by-label/$(echo $i | cut -c1-16) -o ro,noload /mnt/docker-images/$i
-
-          find /mnt/docker-images/$i/overlay2/ -maxdepth 1 -mindepth 1 -not -name l\
-             -exec ln -s '{}' /var/lib/docker/overlay2/ \;
-          cp -P /mnt/docker-images/$i/overlay2/l/* /var/lib/docker/overlay2/l/
-
-          rsync -a /mnt/docker-images/$i/image/ /var/lib/docker/image/
-
-          # Accumulate image definitions
-          cp /tmp/repositories.json /tmp/repositories.json.tmp
-          jq -s '.[0] * .[1]' \
-            /tmp/repositories.json.tmp \
-            /mnt/docker-images/$i/image/overlay2/repositories.json \
-            > /tmp/repositories.json
-        done
-
-        mv /tmp/repositories.json /var/lib/docker/image/overlay2/repositories.json
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-      };
-    };
-  };
-}
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index a650dd72c2a..42e43f5ee02 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -264,7 +264,6 @@ in
 {
   imports = [
     ../profiles/qemu-guest.nix
-   ./docker-preloader.nix
   ];
 
   options = {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0ce5f89b27c..7b8e1b2b56d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -66,11 +66,13 @@ in
   containers-macvlans = handleTest ./containers-macvlans.nix {};
   containers-physical_interfaces = handleTest ./containers-physical_interfaces.nix {};
   containers-portforward = handleTest ./containers-portforward.nix {};
+  containers-reloadable = handleTest ./containers-reloadable.nix {};
   containers-restart_networking = handleTest ./containers-restart_networking.nix {};
   containers-tmpfs = handleTest ./containers-tmpfs.nix {};
   convos = handleTest ./convos.nix {};
   corerad = handleTest ./corerad.nix {};
   couchdb = handleTest ./couchdb.nix {};
+  cri-o = handleTestOn ["x86_64-linux"] ./cri-o.nix {};
   deluge = handleTest ./deluge.nix {};
   dhparams = handleTest ./dhparams.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
@@ -79,15 +81,13 @@ in
   docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
   oci-containers = handleTestOn ["x86_64-linux"] ./oci-containers.nix {};
   docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
-  docker-preloader = handleTestOn ["x86_64-linux"] ./docker-preloader.nix {};
   docker-registry = handleTest ./docker-registry.nix {};
   docker-tools = handleTestOn ["x86_64-linux"] ./docker-tools.nix {};
   docker-tools-overlay = handleTestOn ["x86_64-linux"] ./docker-tools-overlay.nix {};
   documize = handleTest ./documize.nix {};
   dokuwiki = handleTest ./dokuwiki.nix {};
   dovecot = handleTest ./dovecot.nix {};
-  # ec2-config doesn't work in a sandbox as the simulated ec2 instance needs network access
-  #ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
+  ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
   ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
   ecryptfs = handleTest ./ecryptfs.nix {};
   ejabberd = handleTest ./xmpp/ejabberd.nix {};
diff --git a/nixos/tests/common/ec2.nix b/nixos/tests/common/ec2.nix
index ba087bb6009..502fe96231f 100644
--- a/nixos/tests/common/ec2.nix
+++ b/nixos/tests/common/ec2.nix
@@ -20,30 +20,44 @@ with pkgs.lib;
     in makeTest {
       name = "ec2-" + name;
       nodes = {};
-      testScript =
-        ''
-          my $imageDir = ($ENV{'TMPDIR'} // "/tmp") . "/vm-state-machine";
-          mkdir $imageDir, 0700;
-          my $diskImage = "$imageDir/machine.qcow2";
-          system("qemu-img create -f qcow2 -o backing_file=${image} $diskImage") == 0 or die;
-          system("qemu-img resize $diskImage 10G") == 0 or die;
+      testScript = ''
+        import os
+        import subprocess
 
-          # Note: we use net=169.0.0.0/8 rather than
-          # net=169.254.0.0/16 to prevent dhcpcd from getting horribly
-          # confused. (It would get a DHCP lease in the 169.254.*
-          # range, which it would then configure and prompty delete
-          # again when it deletes link-local addresses.) Ideally we'd
-          # turn off the DHCP server, but qemu does not have an option
-          # to do that.
-          my $startCommand = "qemu-kvm -m 1024";
-          $startCommand .= " -device virtio-net-pci,netdev=vlan0";
-          $startCommand .= " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd ${metaData}'";
-          $startCommand .= " -drive file=$diskImage,if=virtio,werror=report";
-          $startCommand .= " \$QEMU_OPTS";
+        image_dir = os.path.join(
+            os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
+        )
+        os.makedirs(image_dir, mode=0o700, exist_ok=True)
+        disk_image = os.path.join(image_dir, "machine.qcow2")
+        subprocess.check_call(
+            [
+                "qemu-img",
+                "create",
+                "-f",
+                "qcow2",
+                "-o",
+                "backing_file=${image}",
+                disk_image,
+            ]
+        )
+        subprocess.check_call(["qemu-img", "resize", disk_image, "10G"])
 
-          my $machine = createMachine({ startCommand => $startCommand });
+        # Note: we use net=169.0.0.0/8 rather than
+        # net=169.254.0.0/16 to prevent dhcpcd from getting horribly
+        # confused. (It would get a DHCP lease in the 169.254.*
+        # range, which it would then configure and prompty delete
+        # again when it deletes link-local addresses.) Ideally we'd
+        # turn off the DHCP server, but qemu does not have an option
+        # to do that.
+        start_command = (
+            "qemu-kvm -m 1024"
+            + " -device virtio-net-pci,netdev=vlan0"
+            + " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd ${metaData}'"
+            + f" -drive file={disk_image},if=virtio,werror=report"
+            + " $QEMU_OPTS"
+        )
 
-          ${script}
-        '';
+        machine = create_machine({"startCommand": start_command})
+      '' + script;
     };
 }
diff --git a/nixos/tests/containers-reloadable.nix b/nixos/tests/containers-reloadable.nix
index 35aff91e85b..2d81f163938 100644
--- a/nixos/tests/containers-reloadable.nix
+++ b/nixos/tests/containers-reloadable.nix
@@ -9,13 +9,13 @@ let
       };
     };
 
-    # prevent make-test.nix to change IP
+    # prevent make-test-python.nix to change IP
     networking.interfaces = {
       eth1.ipv4.addresses = lib.mkOverride 0 [ ];
     };
   };
 in {
-  name = "cotnainers-reloadable";
+  name = "containers-reloadable";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ danbst ];
   };
diff --git a/nixos/tests/cri-o.nix b/nixos/tests/cri-o.nix
new file mode 100644
index 00000000000..f13f1bdacb6
--- /dev/null
+++ b/nixos/tests/cri-o.nix
@@ -0,0 +1,19 @@
+# This test runs CRI-O and verifies via critest
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "cri-o";
+  maintainers = with pkgs.stdenv.lib.maintainers; teams.podman.members;
+
+  nodes = {
+    crio = {
+      virtualisation.cri-o.enable = true;
+    };
+  };
+
+  testScript = ''
+    start_all()
+    crio.wait_for_unit("crio.service")
+    crio.succeed(
+        "critest --ginkgo.focus='Runtime info' --runtime-endpoint unix:///var/run/crio/crio.sock"
+    )
+  '';
+})
diff --git a/nixos/tests/docker-preloader.nix b/nixos/tests/docker-preloader.nix
deleted file mode 100644
index c3e8aced351..00000000000
--- a/nixos/tests/docker-preloader.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-import ./make-test.nix ({ pkgs, ...} : {
-  name = "docker-preloader";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ lewo ];
-  };
-
-  nodes = {
-    docker =
-      { pkgs, ... }:
-        {
-          virtualisation.docker.enable = true;
-          virtualisation.dockerPreloader.images = [ pkgs.dockerTools.examples.nix pkgs.dockerTools.examples.bash ];
-
-          services.openssh.enable = true;
-          services.openssh.permitRootLogin = "yes";
-          services.openssh.extraConfig = "PermitEmptyPasswords yes";
-          users.extraUsers.root.password = "";
-        };
-  };
-  testScript = ''
-    startAll;
-
-    $docker->waitForUnit("sockets.target");
-    $docker->succeed("docker run nix nix-store --version");
-    $docker->succeed("docker run bash bash --version");
-  '';
-})
diff --git a/nixos/tests/ec2.nix b/nixos/tests/ec2.nix
index 5a59d65e602..df067248016 100644
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@@ -3,58 +3,58 @@
   pkgs ? import ../.. { inherit system config; }
 }:
 
-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;
 
 with import common/ec2.nix { inherit makeTest pkgs; };
 
 let
-  imageCfg =
-    (import ../lib/eval-config.nix {
-      inherit system;
-      modules = [
-        ../maintainers/scripts/ec2/amazon-image.nix
-        ../modules/testing/test-instrumentation.nix
-        ../modules/profiles/qemu-guest.nix
-        { ec2.hvm = true;
-
-          # Hack to make the partition resizing work in QEMU.
-          boot.initrd.postDeviceCommands = mkBefore
-            ''
-              ln -s vda /dev/xvda
-              ln -s vda1 /dev/xvda1
-            '';
-
-          # Needed by nixos-rebuild due to the lack of network
-          # access. Determined by trial and error.
-          system.extraDependencies =
-            with pkgs; (
-              [
-                # Needed for a nixos-rebuild.
-                busybox
-                stdenv
-                stdenvNoCC
-                mkinitcpio-nfs-utils
-                unionfs-fuse
-                cloud-utils
-                desktop-file-utils
-                texinfo
-                libxslt.bin
-                xorg.lndir
-
-                # These are used in the configure-from-userdata tests
-                # for EC2. Httpd and valgrind are requested by the
-                # configuration.
-                apacheHttpd apacheHttpd.doc apacheHttpd.man valgrind.doc
-              ]
-            );
-        }
-      ];
-    }).config;
+  imageCfg = (import ../lib/eval-config.nix {
+    inherit system;
+    modules = [
+      ../maintainers/scripts/ec2/amazon-image.nix
+      ../modules/testing/test-instrumentation.nix
+      ../modules/profiles/qemu-guest.nix
+      {
+        ec2.hvm = true;
+
+        # Hack to make the partition resizing work in QEMU.
+        boot.initrd.postDeviceCommands = mkBefore ''
+          ln -s vda /dev/xvda
+          ln -s vda1 /dev/xvda1
+        '';
+
+        # Needed by nixos-rebuild due to the lack of network
+        # access. Determined by trial and error.
+        system.extraDependencies = with pkgs; ( [
+          # Needed for a nixos-rebuild.
+          busybox
+          cloud-utils
+          desktop-file-utils
+          libxslt.bin
+          mkinitcpio-nfs-utils
+          stdenv
+          stdenvNoCC
+          texinfo
+          unionfs-fuse
+          xorg.lndir
+
+          # These are used in the configure-from-userdata tests
+          # for EC2. Httpd and valgrind are requested by the
+          # configuration.
+          apacheHttpd
+          apacheHttpd.doc
+          apacheHttpd.man
+          valgrind.doc
+        ]);
+      }
+    ];
+  }).config;
   image = "${imageCfg.system.build.amazonImage}/${imageCfg.amazonImage.name}.vhd";
 
   sshKeys = import ./ssh-keys.nix pkgs;
   snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
+  snakeOilPrivateKeyFile = pkgs.writeText "private-key" snakeOilPrivateKey;
   snakeOilPublicKey = sshKeys.snakeOilPublicKey;
 
 in {
@@ -68,43 +68,47 @@ in {
       SSH_HOST_ED25519_KEY:${replaceStrings ["\n"] ["|"] snakeOilPrivateKey}
     '';
     script = ''
-      $machine->start;
-      $machine->waitForFile("/etc/ec2-metadata/user-data");
-      $machine->waitForUnit("sshd.service");
+      machine.start()
+      machine.wait_for_file("/etc/ec2-metadata/user-data")
+      machine.wait_for_unit("sshd.service")
 
-      $machine->succeed("grep unknown /etc/ec2-metadata/ami-manifest-path");
+      machine.succeed("grep unknown /etc/ec2-metadata/ami-manifest-path")
 
       # We have no keys configured on the client side yet, so this should fail
-      $machine->fail("ssh -o BatchMode=yes localhost exit");
+      machine.fail("ssh -o BatchMode=yes localhost exit")
 
       # Let's install our client private key
-      $machine->succeed("mkdir -p ~/.ssh");
+      machine.succeed("mkdir -p ~/.ssh")
 
-      $machine->succeed("echo '${snakeOilPrivateKey}' > ~/.ssh/id_ed25519");
-      $machine->succeed("chmod 600 ~/.ssh/id_ed25519");
+      machine.copy_from_host_via_shell(
+          "${snakeOilPrivateKeyFile}", "~/.ssh/id_ed25519"
+      )
+      machine.succeed("chmod 600 ~/.ssh/id_ed25519")
 
       # We haven't configured the host key yet, so this should still fail
-      $machine->fail("ssh -o BatchMode=yes localhost exit");
+      machine.fail("ssh -o BatchMode=yes localhost exit")
 
       # Add the host key; ssh should finally succeed
-      $machine->succeed("echo localhost,127.0.0.1 ${snakeOilPublicKey} > ~/.ssh/known_hosts");
-      $machine->succeed("ssh -o BatchMode=yes localhost exit");
+      machine.succeed(
+          "echo localhost,127.0.0.1 ${snakeOilPublicKey} > ~/.ssh/known_hosts"
+      )
+      machine.succeed("ssh -o BatchMode=yes localhost exit")
 
       # Test whether the root disk was resized.
-      my $blocks = $machine->succeed("stat -c %b -f /");
-      my $bsize = $machine->succeed("stat -c %S -f /");
-      my $size = $blocks * $bsize;
-      die "wrong free space $size" if $size < 9.7 * 1024 * 1024 * 1024 || $size > 10 * 1024 * 1024 * 1024;
+      blocks, block_size = map(int, machine.succeed("stat -c %b:%S -f /").split(":"))
+      GB = 1024 ** 3
+      assert 9.7 * GB <= blocks * block_size <= 10 * GB
 
       # Just to make sure resizing is idempotent.
-      $machine->shutdown;
-      $machine->start;
-      $machine->waitForFile("/etc/ec2-metadata/user-data");
+      machine.shutdown()
+      machine.start()
+      machine.wait_for_file("/etc/ec2-metadata/user-data")
     '';
   };
 
   boot-ec2-config = makeEc2Test {
     name         = "config-userdata";
+    meta.broken = true; # amazon-init wants to download from the internet while building the system
     inherit image;
     sshPublicKey = snakeOilPublicKey;
 
@@ -133,17 +137,17 @@ in {
       }
     '';
     script = ''
-      $machine->start;
+      machine.start()
 
       # amazon-init must succeed. if it fails, make the test fail
-      # immediately instead of timing out in waitForFile.
-      $machine->waitForUnit('amazon-init.service');
+      # immediately instead of timing out in wait_for_file.
+      machine.wait_for_unit("amazon-init.service")
 
-      $machine->waitForFile("/etc/testFile");
-      $machine->succeed("cat /etc/testFile | grep -q 'whoa'");
+      machine.wait_for_file("/etc/testFile")
+      assert "whoa" in machine.succeed("cat /etc/testFile")
 
-      $machine->waitForUnit("httpd.service");
-      $machine->succeed("curl http://localhost | grep Valgrind");
+      machine.wait_for_unit("httpd.service")
+      assert "Valgrind" in machine.succeed("curl http://localhost")
     '';
   };
 }
diff --git a/nixos/tests/gnome3.nix b/nixos/tests/gnome3.nix
index b3d7aff8bd7..7e301be49d1 100644
--- a/nixos/tests/gnome3.nix
+++ b/nixos/tests/gnome3.nix
@@ -23,6 +23,13 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
       services.xserver.desktopManager.gnome3.enable = true;
       services.xserver.desktopManager.gnome3.debug = true;
 
+      environment.systemPackages = [
+        (pkgs.makeAutostartItem {
+          name = "org.gnome.Terminal";
+          package = pkgs.gnome3.gnome-terminal;
+        })
+      ];
+
       virtualisation.memorySize = 1024;
     };
 
@@ -65,9 +72,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
           )
 
       with subtest("Open Gnome Terminal"):
-          machine.succeed(
-              "${gnomeTerminalCommand}"
-          )
           # correct output should be (true, '"gnome-terminal-server"')
           machine.wait_until_succeeds(
               "${wmClass} | grep -q 'gnome-terminal-server'"
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index 5ed0dfcf9ab..8d845de70e2 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : {
+import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
   name = "hardened";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ joachifm ];
@@ -47,84 +47,88 @@ import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : {
       };
     in
     ''
-      $machine->waitForUnit("multi-user.target");
+      machine.wait_for_unit("multi-user.target")
+
+
+      with subtest("AppArmor profiles are loaded"):
+          machine.succeed("systemctl status apparmor.service")
 
-      subtest "apparmor-loaded", sub {
-          $machine->succeed("systemctl status apparmor.service");
-      };
 
       # AppArmor securityfs
-      subtest "apparmor-securityfs", sub {
-          $machine->succeed("mountpoint -q /sys/kernel/security");
-          $machine->succeed("cat /sys/kernel/security/apparmor/profiles");
-      };
+      with subtest("AppArmor securityfs is mounted"):
+          machine.succeed("mountpoint -q /sys/kernel/security")
+          machine.succeed("cat /sys/kernel/security/apparmor/profiles")
+
 
       # Test loading out-of-tree modules
-      subtest "extra-module-packages", sub {
-          $machine->succeed("grep -Fq wireguard /proc/modules");
-      };
+      with subtest("Out-of-tree modules can be loaded"):
+          machine.succeed("grep -Fq wireguard /proc/modules")
+
 
       # Test hidepid
-      subtest "hidepid", sub {
-          $machine->succeed("grep -Fq hidepid=2 /proc/mounts");
+      with subtest("hidepid=2 option is applied and works"):
+          machine.succeed("grep -Fq hidepid=2 /proc/mounts")
           # cannot use pgrep -u here, it segfaults when access to process info is denied
-          $machine->succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]");
-          $machine->succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]");
-      };
+          machine.succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]")
+          machine.succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]")
+
 
       # Test kernel module hardening
-      subtest "lock-modules", sub {
+      with subtest("No more kernel modules can be loaded"):
           # note: this better a be module we normally wouldn't load ...
-          $machine->fail("modprobe dccp");
-      };
+          machine.fail("modprobe dccp")
+
 
       # Test userns
-      subtest "userns", sub {
-          $machine->succeed("unshare --user true");
-          $machine->fail("su -l alice -c 'unshare --user true'");
-      };
+      with subtest("User namespaces are restricted"):
+          machine.succeed("unshare --user true")
+          machine.fail("su -l alice -c 'unshare --user true'")
+
 
       # Test dmesg restriction
-      subtest "dmesg", sub {
-          $machine->fail("su -l alice -c dmesg");
-      };
+      with subtest("Regular users cannot access dmesg"):
+          machine.fail("su -l alice -c dmesg")
+
 
       # Test access to kcore
-      subtest "kcore", sub {
-          $machine->fail("cat /proc/kcore");
-      };
+      with subtest("Kcore is inaccessible as root"):
+          machine.fail("cat /proc/kcore")
+
 
       # Test deferred mount
-      subtest "mount", sub {
-        $machine->fail("mountpoint -q /efi"); # was deferred
-        $machine->execute("mkdir -p /efi");
-        $machine->succeed("mount /dev/disk/by-label/EFISYS /efi");
-        $machine->succeed("mountpoint -q /efi"); # now mounted
-      };
+      with subtest("Deferred mounts work"):
+          machine.fail("mountpoint -q /efi")  # was deferred
+          machine.execute("mkdir -p /efi")
+          machine.succeed("mount /dev/disk/by-label/EFISYS /efi")
+          machine.succeed("mountpoint -q /efi")  # now mounted
+
 
       # Test Nix dæmon usage
-      subtest "nix-daemon", sub {
-        $machine->fail("su -l nobody -s /bin/sh -c 'nix ping-store'");
-        $machine->succeed("su -l alice -c 'nix ping-store'") =~ "OK";
-      };
+      with subtest("nix-daemon cannot be used by all users"):
+          machine.fail("su -l nobody -s /bin/sh -c 'nix ping-store'")
+          machine.succeed("su -l alice -c 'nix ping-store'")
+
 
       # Test kernel image protection
-      subtest "kernelimage", sub {
-        $machine->fail("systemctl hibernate");
-        $machine->fail("systemctl kexec");
-      };
+      with subtest("The kernel image is protected"):
+          machine.fail("systemctl hibernate")
+          machine.fail("systemctl kexec")
 
-      # Test hardened memory allocator
-      sub runMallocTestProg {
-          my ($progName, $errorText) = @_;
-          my $text = "fatal allocator error: " . $errorText;
-          $machine->fail("${hardened-malloc-tests}/bin/" . $progName) =~ $text;
-      };
 
-      subtest "hardenedmalloc", sub {
-        runMallocTestProg("double_free_large", "invalid free");
-        runMallocTestProg("unaligned_free_small", "invalid unaligned free");
-        runMallocTestProg("write_after_free_small", "detected write after free");
-      };
+      # Test hardened memory allocator
+      def runMallocTestProg(prog_name, error_text):
+          text = "fatal allocator error: " + error_text
+          if not text in machine.fail(
+              "${hardened-malloc-tests}/bin/"
+              + prog_name
+              + " 2>&1"
+          ):
+              raise Exception("Hardened malloc does not work for {}".format(error_text))
+
+
+      with subtest("The hardened memory allocator works"):
+          runMallocTestProg("double_free_large", "invalid free")
+          runMallocTestProg("unaligned_free_small", "invalid unaligned free")
+          runMallocTestProg("write_after_free_small", "detected write after free")
     '';
 })
diff --git a/nixos/tests/hocker-fetchdocker/default.nix b/nixos/tests/hocker-fetchdocker/default.nix
index 4f30f01e403..978dbf310b1 100644
--- a/nixos/tests/hocker-fetchdocker/default.nix
+++ b/nixos/tests/hocker-fetchdocker/default.nix
@@ -1,15 +1,16 @@
-import ../make-test.nix ({ pkgs, ...} : {
+import ../make-test-python.nix ({ pkgs, ...} : {
   name = "test-hocker-fetchdocker";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ ixmatus ];
+    broken = true; # tries to download from registry-1.docker.io - how did this ever work?
   };
 
   machine = import ./machine.nix;
 
   testScript = ''
-    startAll;
+    start_all()
 
-    $machine->waitForUnit("sockets.target");
-    $machine->waitUntilSucceeds("docker run registry-1.docker.io/v2/library/hello-world:latest");
+    machine.wait_for_unit("sockets.target")
+    machine.wait_until_succeeds("docker run registry-1.docker.io/v2/library/hello-world:latest")
   '';
 })
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 02b839fee3f..50c6af485da 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -799,7 +799,7 @@ in {
           "btrfs subvol create /mnt/badpath/boot",
           "btrfs subvol create /mnt/nixos",
           "btrfs subvol set-default "
-          + "$(btrfs subvol list /mnt | grep 'nixos' | awk '{print \$2}') /mnt",
+          + "$(btrfs subvol list /mnt | grep 'nixos' | awk '{print $2}') /mnt",
           "umount /mnt",
           "mount -o defaults LABEL=root /mnt",
           "mkdir -p /mnt/badpath/boot",  # Help ensure the detection mechanism
diff --git a/nixos/tests/openstack-image.nix b/nixos/tests/openstack-image.nix
index 97c9137fe1d..0b57dfb8e7e 100644
--- a/nixos/tests/openstack-image.nix
+++ b/nixos/tests/openstack-image.nix
@@ -3,30 +3,30 @@
   pkgs ? import ../.. { inherit system config; }
 }:
 
-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
 with pkgs.lib;
 
 with import common/ec2.nix { inherit makeTest pkgs; };
 
 let
-  image =
-    (import ../lib/eval-config.nix {
-      inherit system;
-      modules = [
-        ../maintainers/scripts/openstack/openstack-image.nix
-        ../modules/testing/test-instrumentation.nix
-        ../modules/profiles/qemu-guest.nix
-        {
-          # Needed by nixos-rebuild due to lack of network access.
-          system.extraDependencies = with pkgs; [
-            stdenv
-          ];
-        }
-      ];
-    }).config.system.build.openstackImage + "/nixos.qcow2";
+  image = (import ../lib/eval-config.nix {
+    inherit system;
+    modules = [
+      ../maintainers/scripts/openstack/openstack-image.nix
+      ../modules/testing/test-instrumentation.nix
+      ../modules/profiles/qemu-guest.nix
+      {
+        # Needed by nixos-rebuild due to lack of network access.
+        system.extraDependencies = with pkgs; [
+          stdenv
+        ];
+      }
+    ];
+  }).config.system.build.openstackImage + "/nixos.qcow2";
 
   sshKeys = import ./ssh-keys.nix pkgs;
   snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
+  snakeOilPrivateKeyFile = pkgs.writeText "private-key" snakeOilPrivateKey;
   snakeOilPublicKey = sshKeys.snakeOilPublicKey;
 
 in {
@@ -39,32 +39,36 @@ in {
       SSH_HOST_ED25519_KEY:${replaceStrings ["\n"] ["|"] snakeOilPrivateKey}
     '';
     script = ''
-      $machine->start;
-      $machine->waitForFile("/etc/ec2-metadata/user-data");
-      $machine->waitForUnit("sshd.service");
+      machine.start()
+      machine.wait_for_file("/etc/ec2-metadata/user-data")
+      machine.wait_for_unit("sshd.service")
 
-      $machine->succeed("grep unknown /etc/ec2-metadata/ami-manifest-path");
+      machine.succeed("grep unknown /etc/ec2-metadata/ami-manifest-path")
 
       # We have no keys configured on the client side yet, so this should fail
-      $machine->fail("ssh -o BatchMode=yes localhost exit");
+      machine.fail("ssh -o BatchMode=yes localhost exit")
 
       # Let's install our client private key
-      $machine->succeed("mkdir -p ~/.ssh");
+      machine.succeed("mkdir -p ~/.ssh")
 
-      $machine->succeed("echo '${snakeOilPrivateKey}' > ~/.ssh/id_ed25519");
-      $machine->succeed("chmod 600 ~/.ssh/id_ed25519");
+      machine.copy_from_host_via_shell(
+          "${snakeOilPrivateKeyFile}", "~/.ssh/id_ed25519"
+      )
+      machine.succeed("chmod 600 ~/.ssh/id_ed25519")
 
       # We haven't configured the host key yet, so this should still fail
-      $machine->fail("ssh -o BatchMode=yes localhost exit");
+      machine.fail("ssh -o BatchMode=yes localhost exit")
 
       # Add the host key; ssh should finally succeed
-      $machine->succeed("echo localhost,127.0.0.1 ${snakeOilPublicKey} > ~/.ssh/known_hosts");
-      $machine->succeed("ssh -o BatchMode=yes localhost exit");
+      machine.succeed(
+          "echo localhost,127.0.0.1 ${snakeOilPublicKey} > ~/.ssh/known_hosts"
+      )
+      machine.succeed("ssh -o BatchMode=yes localhost exit")
 
       # Just to make sure resizing is idempotent.
-      $machine->shutdown;
-      $machine->start;
-      $machine->waitForFile("/etc/ec2-metadata/user-data");
+      machine.shutdown()
+      machine.start()
+      machine.wait_for_file("/etc/ec2-metadata/user-data")
     '';
   };
 
@@ -86,9 +90,9 @@ in {
       }
     '';
     script = ''
-      $machine->start;
-      $machine->waitForFile("/etc/testFile");
-      $machine->succeed("cat /etc/testFile | grep -q 'whoa'");
+      machine.start()
+      machine.wait_for_file("/etc/testFile")
+      assert "whoa" in machine.succeed("cat /etc/testFile")
     '';
   };
 }
diff --git a/pkgs/applications/blockchains/clightning.nix b/pkgs/applications/blockchains/clightning.nix
index f289139d8d8..43de23b68fc 100644
--- a/pkgs/applications/blockchains/clightning.nix
+++ b/pkgs/applications/blockchains/clightning.nix
@@ -4,11 +4,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "0.9.0";
+  version = "0.9.0-1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "11ig5bqxvhx82gq9nl7c5iqaf3x8xbwfx7cf2318pyqdimz4r1v6";
+    sha256 = "01cwcrqysqsrf96bbbj0grm8j5m46a3acgwy0kzxdx05jdzld9sc";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/gis/gmt/dcw.nix b/pkgs/applications/gis/gmt/dcw.nix
new file mode 100644
index 00000000000..58390e89290
--- /dev/null
+++ b/pkgs/applications/gis/gmt/dcw.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "dcw-gmt";
+  version = "1.1.4";
+  src = fetchurl {
+    url = "ftp://ftp.soest.hawaii.edu/gmt/dcw-gmt-${version}.tar.gz";
+    sha256 = "8d47402abcd7f54a0f711365cd022e4eaea7da324edac83611ca035ea443aad3";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/dcw-gmt
+    cp -rv ./* $out/share/dcw-gmt
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://www.soest.hawaii.edu/pwessel/dcw/";
+    description = "Vector basemap of the world, for use with GMT";
+    longDescription = ''
+      DCW-GMT is an enhancement to the original 1:1,000,000 scale vector basemap
+      of the world, available from the Princeton University Digital Map and
+      Geospatial Information Center. It contains more state boundaries (the
+      largest 8 countries are now represented) than the original data
+      source. Information about DCW can be found on Wikipedia
+      (https://en.wikipedia.org/wiki/Digital_Chart_of_the_World). This data is
+      for use by GMT, the Generic Mapping Tools.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ tviti ];
+  };
+
+}
diff --git a/pkgs/applications/gis/gmt/default.nix b/pkgs/applications/gis/gmt/default.nix
new file mode 100644
index 00000000000..8c7c7687f3d
--- /dev/null
+++ b/pkgs/applications/gis/gmt/default.nix
@@ -0,0 +1,73 @@
+{ stdenv, fetchurl, cmake, curl, Accelerate, CoreGraphics, CoreVideo
+, fftwSinglePrec, netcdf, pcre, gdal, blas, lapack, glibc, ghostscript, dcw-gmt
+, gshhg-gmt }:
+
+/* The onus is on the user to also install:
+    - ffmpeg for webm or mp4 output
+    - graphicsmagick for gif output
+*/
+
+stdenv.mkDerivation rec {
+  pname = "gmt";
+  version = "6.1.0";
+  src = fetchurl {
+    url = "https://github.com/GenericMappingTools/gmt/releases/download/${version}/gmt-${version}-src.tar.gz";
+    sha256 = "0vzxzpvbf1sqma2airsibxvqb9m4sajm7jsfr7rrv6q7924c7ijw";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ curl gdal netcdf pcre dcw-gmt gshhg-gmt ]
+    ++ (if stdenv.isDarwin then [
+      Accelerate
+      CoreGraphics
+      CoreVideo
+    ] else [
+      glibc
+      fftwSinglePrec
+      blas
+      lapack
+    ]);
+
+  propagatedBuildInputs = [ ghostscript ];
+
+  cmakeFlags = [
+    "-DGMT_DOCDIR=share/doc/gmt"
+    "-DGMT_MANDIR=share/man"
+    "-DGMT_LIBDIR=lib"
+    "-DCOPY_GSHHG:BOOL=FALSE"
+    "-DGSHHG_ROOT=${gshhg-gmt.out}/share/gshhg-gmt"
+    "-DCOPY_DCW:BOOL=FALSE"
+    "-DDCW_ROOT=${dcw-gmt.out}/share/dcw-gmt"
+    "-DGDAL_ROOT=${gdal.out}"
+    "-DNETCDF_ROOT=${netcdf.out}"
+    "-DPCRE_ROOT=${pcre.out}"
+    "-DGMT_INSTALL_TRADITIONAL_FOLDERNAMES:BOOL=FALSE"
+    "-DGMT_ENABLE_OPENMP:BOOL=TRUE"
+    "-DGMT_INSTALL_MODULE_LINKS:BOOL=FALSE"
+    "-DLICENSE_RESTRICTED=LGPL" # "GPL" and "no" also valid
+  ] ++ (with stdenv;
+    lib.optional (!isDarwin) [
+      "-DFFTW3_ROOT=${fftwSinglePrec.dev}"
+      "-DLAPACK_LIBRARY=${lapack}/lib/liblapack.so"
+      "-DBLAS_LIBRARY=${blas}/lib/libblas.so"
+    ]);
+
+  meta = with stdenv.lib; {
+    homepage = "https://www.generic-mapping-tools.org";
+    description = "Tools for manipulating geographic and cartesian data sets";
+    longDescription = ''
+      GMT is an open-source collection of command-line tools for manipulating
+      geographic and Cartesian data sets (including filtering, trend fitting,
+      gridding, projecting, etc.) and producing high-quality illustrations
+      ranging from simple x–y plots via contour maps to artificially illuminated
+      surfaces and 3D perspective views. It supports many map projections and
+      transformations and includes supporting data such as coastlines, rivers,
+      and political boundaries and optionally country polygons.
+    '';
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ tviti ];
+  };
+
+}
diff --git a/pkgs/applications/gis/gmt/gshhg.nix b/pkgs/applications/gis/gmt/gshhg.nix
new file mode 100644
index 00000000000..0f22f87c89b
--- /dev/null
+++ b/pkgs/applications/gis/gmt/gshhg.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "gshhg-gmt";
+  version = "2.3.7";
+  src = fetchurl {
+    url = "ftp://ftp.soest.hawaii.edu/gmt/gshhg-gmt-${version}.tar.gz";
+    sha256 = "9bb1a956fca0718c083bef842e625797535a00ce81f175df08b042c2a92cfe7f";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/gshhg-gmt
+    cp -rv ./* $out/share/gshhg-gmt
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://www.soest.hawaii.edu/pwessel/gshhg/";
+    description = "High-resolution shoreline data set, for use with GMT";
+    longDescription = ''
+      GSHHG is a high-resolution shoreline data set amalgamated from two
+      databases: Global Self-consistent Hierarchical High-resolution Shorelines
+      (GSHHS) and CIA World Data Bank II (WDBII). GSHHG contains vector
+      descriptions at five different resolutions of land outlines, lakes,
+      rivers, and political boundaries. This data is for use by GMT, the Generic
+      Mapping Tools.
+    '';
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ tviti ];
+  };
+
+}
diff --git a/pkgs/applications/graphics/write_stylus/default.nix b/pkgs/applications/graphics/write_stylus/default.nix
index 380f70c7c93..8396ce72e50 100644
--- a/pkgs/applications/graphics/write_stylus/default.nix
+++ b/pkgs/applications/graphics/write_stylus/default.nix
@@ -1,29 +1,22 @@
 { mkDerivation, stdenv, lib, qtbase, qtsvg, libglvnd, libX11, libXi, fetchurl, makeDesktopItem }:
 let
-  # taken from: https://www.iconfinder.com/icons/50835/edit_pencil_write_icon
-  # license: Free for commercial use
-  desktopIcon = fetchurl {
-    url = "https://www.iconfinder.com/icons/50835/download/png/256";
-    sha256 = "0abdya42yf9alxbsmc2nf8jwld50zfria6z3d4ncvp1zw2a9jhb8";
-  };
-in
-mkDerivation rec {
-  pname = "write_stylus";
-  version = "300";
-
   desktopItem = makeDesktopItem {
     name = "Write";
     exec = "Write";
     comment = "A word processor for handwriting";
-    icon = desktopIcon;
+    icon = "write_stylus";
     desktopName = "Write";
     genericName = "Write";
     categories = "Office;Graphics";
   };
+in
+mkDerivation rec {
+  pname = "write_stylus";
+  version = "300";
 
   src = fetchurl {
     url = "http://www.styluslabs.com/write/write${version}.tar.gz";
-    sha256 = "1kg4qqxgg7iyxl13hkbl3j27dykra56dj67hbv0392mwdcgavihq";
+    sha256 = "0h1wf3af7jzp3f3l8mlnshi83d7a4v4y8nfqfai4lmskyicqlz7c";
   };
 
   sourceRoot = ".";
@@ -36,8 +29,11 @@ mkDerivation rec {
     # symlink the binary to bin/
     ln -s $out/Write/Write $out/bin/Write
 
+    # Create desktop item
     mkdir -p $out/share/applications
     ln -s ${desktopItem}/share/applications/* $out/share/applications/
+    mkdir -p $out/share/icons
+    ln -s $out/Write/Write144x144.png $out/share/icons/write_stylus.png
   '';
   preFixup = let
     libPath = lib.makeLibraryPath [
diff --git a/pkgs/applications/misc/html5validator/default.nix b/pkgs/applications/misc/html5validator/default.nix
new file mode 100644
index 00000000000..657996d1da9
--- /dev/null
+++ b/pkgs/applications/misc/html5validator/default.nix
@@ -0,0 +1,25 @@
+{ buildPythonApplication, fetchFromGitHub, nose, openjdk, lib }:
+
+buildPythonApplication rec {
+  pname = "html5validator";
+  version = "0.3.3";
+
+  src = fetchFromGitHub {
+    owner = "svenkreiss";
+    repo = "html5validator";
+    rev = "v${version}";
+    sha256 = "130acqi0dsy3midg7hwslykzry6crr4ln6ia0f0avyywkz4bplsv";
+  };
+
+  propagatedBuildInputs = [ openjdk ];
+
+  checkInputs = [ nose ];
+  checkPhase = "PATH=$PATH:$out/bin nosetests";
+
+  meta = with lib; {
+    homepage = "https://github.com/svenkreiss/html5validator";
+    description = "Command line tool that tests files for HTML5 validity";
+    license = licenses.mit;
+    maintainers = [ maintainers.phunehehe ];
+  };
+}
diff --git a/pkgs/applications/misc/snowsql/default.nix b/pkgs/applications/misc/snowsql/default.nix
new file mode 100644
index 00000000000..a860b555b59
--- /dev/null
+++ b/pkgs/applications/misc/snowsql/default.nix
@@ -0,0 +1,50 @@
+{ stdenv
+, fetchurl
+, rpmextract
+, patchelf
+, makeWrapper
+, openssl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "snowsql";
+  version = "1.2.5";
+
+  src = fetchurl {
+    url = "https://sfc-repo.snowflakecomputing.com/snowsql/bootstrap/1.2/linux_x86_64/snowflake-snowsql-1.2.5-1.x86_64.rpm";
+    sha256 = "c66e2044640197f4a5b5a16b89e8e7c6a816aa539004a0fb016aab185795f2d5";
+  };
+
+  nativeBuildInputs = [ rpmextract makeWrapper ];
+
+  libPath =
+    stdenv.lib.makeLibraryPath
+      [
+        openssl
+      ];
+
+  buildCommand = ''
+    mkdir -p $out/bin/
+    cd $out
+    rpmextract $src
+    rm -R usr/bin
+    mv usr/* $out
+    rmdir usr
+
+    ${patchelf}/bin/patchelf \
+      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+        lib64/snowflake/snowsql/snowsql
+
+    makeWrapper $out/lib64/snowflake/snowsql/snowsql $out/bin/snowsql \
+      --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/lib64/snowflake/snowsql \
+
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Command line client for the Snowflake database";
+    homepage = "https://www.snowflake.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ andehen ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/misc/super_user_spark/default.nix b/pkgs/applications/misc/super_user_spark/default.nix
deleted file mode 100644
index dd1218282d8..00000000000
--- a/pkgs/applications/misc/super_user_spark/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ mkDerivation, fetchgit, aeson, aeson-pretty, base, bytestring, directory
-, filepath, hspec, hspec-core, HUnit, mtl, optparse-applicative
-, parsec, process, pureMD5, QuickCheck, shelly, stdenv, text
-, transformers, unix
-}:
-mkDerivation {
-  pname = "super-user-spark";
-  version = "0.3.2.0-dev";
-  src = fetchgit {
-    url = "https://github.com/NorfairKing/super-user-spark";
-    sha256 = "0akyc51bghzkk8j75n0i8v8rrsklidwvljhx3aibxfbkqp33372g";
-    rev = "ab8635682d67842b9e6d909cf3c618014e4157f2";
-  };
-  isLibrary = true;
-  isExecutable = true;
-  libraryHaskellDepends = [
-    aeson aeson-pretty base bytestring directory filepath mtl
-    optparse-applicative parsec process pureMD5 shelly text
-    transformers unix
-  ];
-  executableHaskellDepends = [ base ];
-  testHaskellDepends = [
-    aeson aeson-pretty base bytestring directory filepath hspec
-    hspec-core HUnit mtl optparse-applicative parsec process pureMD5
-    QuickCheck shelly text transformers unix
-  ];
-  jailbreak = true;
-  description = "Configure your dotfile deployment with a DSL";
-  license = stdenv.lib.licenses.mit;
-  homepage = "https://github.com/NorfairKing/super-user-spark";
-  maintainers = [ stdenv.lib.maintainers.badi ];
-}
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index 686ffee9148..f2bf39b548b 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -47,11 +47,11 @@ let
 in stdenv.mkDerivation rec {
 
   pname = "opera";
-  version = "67.0.3575.31";
+  version = "68.0.3618.63";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "1ghygin7xf5lwd77s8f6bag339di4alwlkqwjzlq20wzwx4lns4w";
+    sha256 = "1643043ywz94x2yr7xyw7krfq53iwkr8qxlbydzq6zb2zina7jxd";
   };
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";
diff --git a/pkgs/applications/networking/cluster/argo/default.nix b/pkgs/applications/networking/cluster/argo/default.nix
index 601b3da1570..45bbfbd6c40 100644
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@@ -19,16 +19,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "2.9.5";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "1x44mgvnbn47a33xnhnh9bxxvj1vsr32lvh9bq6w5hpmxb7qbq4f";
+    sha256 = "19z1v6p59pcl8smywn1b5igqpv9wj48n6500wjxx5ayhc4mg00h2";
   };
 
-  vendorSha256 = "1vqmzz76lcwwnw89n4lyg4jjf7wbdgn9sdzwsgrjwkj8ax7d48cv";
+  vendorSha256 = "0fqdxs3r4249qxlc9cac0lpbqf2aifkcah07v0cckb9rxfyiwhjz";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index d3b2addee10..3822f453a30 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -38,7 +38,7 @@ buildGoModule rec {
     "plugins/meta/tuning"
   ];
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) cri-o podman; };
 
   meta = with lib; {
     description = "Some standard networking plugins, maintained by the CNI team";
diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index d1cfc89f2df..f713d8a8a6d 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "0.125.5";
+  version = "0.125.7";
 
   src = fetchFromGitHub {
     owner = "roboll";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "00c1sppvdnsqay8zk6fz5xz8yw74zv30hq54r4sf1a5rb84nd05h";
+    sha256 = "1m030gjrd98z4vbj7l927qi55vgr11czrb8wmw56ifkqwfi6h9hi";
   };
 
-  vendorSha256 = "04mga3jc2c01daygjcn245mv30lc2ibax0mpb1wjk3s8lkl4cxcz";
+  vendorSha256 = "0w72nlf26k64cq1hrqycks0pyp18y4wh3h40jpn5qnysi5pb2ndj";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/ssm-agent/default.nix b/pkgs/applications/networking/cluster/ssm-agent/default.nix
index 0835d268cd7..c6f9217b35b 100644
--- a/pkgs/applications/networking/cluster/ssm-agent/default.nix
+++ b/pkgs/applications/networking/cluster/ssm-agent/default.nix
@@ -1,22 +1,56 @@
-{ stdenv, fetchFromGitHub, buildGoPackage }:
+{ stdenv, fetchFromGitHub, buildGoPackage, bash, makeWrapper }:
 
 buildGoPackage rec {
   pname   = "amazon-ssm-agent";
-  version = "2.0.633.0";
+  version = "2.3.1319.0";
 
   goPackagePath = "github.com/aws/${pname}";
-  subPackages   = [ "agent" ];
+  subPackages   = [
+    "agent"
+    "agent/framework/processor/executer/outofproc/worker"
+    "agent/framework/processor/executer/outofproc/worker"
+    "agent/framework/processor/executer/outofproc/sessionworker"
+    "agent/session/logging"
+    "agent/cli-main"
+  ];
+
+  buildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
-    rev    = "v${version}";
+    rev    = version;
     owner  = "aws";
     repo   = pname;
-    sha256 = "10arshfn2k3m3zzgw8b3xc6ywd0ss73746nq5srh2jir7mjzi4xv";
+    sha256 = "1yiyhj7ckqa32b1rnbwn7zx89rsj00m5imn1xlpsw002ywxsxbnv";
   };
 
   preBuild = ''
     mv go/src/${goPackagePath}/vendor strange-vendor
     mv strange-vendor/src go/src/${goPackagePath}/vendor
+
+    cd go/src/${goPackagePath}
+    echo ${version} > VERSION
+
+    substituteInPlace agent/plugins/inventory/gatherers/application/dataProvider.go \
+      --replace '"github.com/aws/amazon-ssm-agent/agent/plugins/configurepackage/localpackages"' ""
+
+    go run agent/version/versiongenerator/version-gen.go
+    substituteInPlace agent/appconfig/constants_unix.go \
+      --replace /usr/bin/ssm-document-worker $bin/bin/ssm-document-worker \
+      --replace /usr/bin/ssm-session-worker $bin/bin/ssm-session-worker \
+      --replace /usr/bin/ssm-session-logger $bin/bin/ssm-session-logger
+    cd -
+  '';
+
+  postBuild = ''
+    mv go/bin/agent go/bin/amazon-ssm-agent
+    mv go/bin/worker go/bin/ssm-document-worker
+    mv go/bin/sessionworker go/bin/ssm-session-worker
+    mv go/bin/logging go/bin/ssm-session-logger
+    mv go/bin/cli-main go/bin/ssm-cli
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/amazon-ssm-agent --prefix PATH : ${bash}/bin
   '';
 
   meta = with stdenv.lib; {
@@ -24,7 +58,6 @@ buildGoPackage rec {
     homepage    = "https://github.com/aws/amazon-ssm-agent";
     license     = licenses.asl20;
     platforms   = platforms.unix;
-    maintainers = with maintainers; [ copumpkin ];
+    maintainers = with maintainers; [ copumpkin manveru ];
   };
 }
-
diff --git a/pkgs/applications/networking/instant-messengers/ytalk/default.nix b/pkgs/applications/networking/instant-messengers/ytalk/default.nix
new file mode 100644
index 00000000000..8cb22aabc69
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/ytalk/default.nix
@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "ytalk";
+  version = "3.3.0";
+
+  src = fetchurl {
+    url = "ftp://ftp.ourproject.org/pub/ytalk/${pname}-${version}.tar.gz";
+    sha256 = "1d3jhnj8rgzxyxjwfa22vh45qwzjvxw1qh8fz6b7nfkj3zvk9jvf";
+  };
+
+  buildInputs = [ ncurses ];
+
+  meta = {
+    homepage    = "http://ytalk.ourproject.org";
+    description = "A terminal based talk client";
+    platforms   = stdenv.lib.platforms.unix;
+    maintainers = with stdenv.lib.maintainers; [ taeer ];
+    license     = stdenv.lib.licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/applications/networking/nextdns/default.nix b/pkgs/applications/networking/nextdns/default.nix
index e6bb229b118..de3ff40e43c 100644
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "15xw8d6b9rv0lalzfllixm8n89clz9j8ag1gk4r16k7yv5l6xrpd";
+    sha256 = "001swxmf7ga2g0ri3gsnwvgjcarwdhfg476ymblg34kk9wclidmy";
   };
 
   vendorSha256 = "09whpzsn16znyrknfm5zlhla253r69j6d751czza4c83m4r36swj";
diff --git a/pkgs/applications/office/espanso/default.nix b/pkgs/applications/office/espanso/default.nix
index 04a40875f79..889f363dfb9 100644
--- a/pkgs/applications/office/espanso/default.nix
+++ b/pkgs/applications/office/espanso/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "espanso";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "federico-terzi";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1x5p7hniapggqd18rx26mjvdf33z7rm7zz5vsqm2siv3mcl19033";
+    sha256 = "11xdnn1iwpx58s3wvjb6dkgfc6dzsblzb6fngc0np5vx8r2pccpg";
   };
 
-  cargoSha256 = "0liwwdncymjql5dw7rwhhimcr7qdbyvfgmsd0bawvi0ym7m1v408";
+  cargoSha256 = "1yjpqjfrixscg52yhalybgp734w3sdqg5hxka8ppcvz7lp3w5b1s";
 
   nativeBuildInputs = [
     extra-cmake-modules
diff --git a/pkgs/applications/science/biology/igv/default.nix b/pkgs/applications/science/biology/igv/default.nix
index aa6c95071b7..bc4f1677fc9 100644
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@@ -1,32 +1,34 @@
-{ stdenv, fetchurl, unzip, jre }:
+{ stdenv, fetchzip, jdk11 }:
 
 stdenv.mkDerivation rec {
   pname = "igv";
-  version = "2.4.19";
-
-  src = fetchurl {
-    url = "https://data.broadinstitute.org/igv/projects/downloads/2.4/IGV_${version}.zip";
-    sha256 = "048dgrhxcb854d24kyjkqz12bw04bsv49i5jawb75yzkswwfkb0z";
+  version = "2.8.9";
+  src = fetchzip {
+    url = "https://data.broadinstitute.org/igv/projects/downloads/2.8/IGV_${version}.zip";
+    sha256 = "1874w1xprv91caz1ymfxilq6inhj36xzx8j9m0mcyp0qfvfvyjp7";
   };
 
-  buildInputs = [ unzip jre ];
-
   installPhase = ''
     mkdir -pv $out/{share,bin}
     cp -Rv * $out/share/
 
     sed -i "s#prefix=.*#prefix=$out/share#g" $out/share/igv.sh
-    sed -i 's#java#${jre}/bin/java#g' $out/share/igv.sh
+    sed -i 's#java#${jdk11}/bin/java#g' $out/share/igv.sh
+
+    sed -i "s#prefix=.*#prefix=$out/share#g" $out/share/igvtools
+    sed -i 's#java#${jdk11}/bin/java#g' $out/share/igvtools
 
     ln -s $out/share/igv.sh $out/bin/igv
+    ln -s $out/share/igvtools $out/bin/igvtools
 
     chmod +x $out/bin/igv
+    chmod +x $out/bin/igvtools
   '';
 
   meta = with stdenv.lib; {
     homepage = "https://www.broadinstitute.org/igv/";
     description = "A visualization tool for interactive exploration of genomic datasets";
-    license = licenses.lgpl21;
+    license = licenses.mit;
     platforms = platforms.unix;
     maintainers = [ maintainers.mimame ];
   };
diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index b7ab5fa70d9..2fd4c122041 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   i18n = libraries.i18n;
 
   pname = "kicad-base";
-  version = "${versions.${baseName}.kicadVersion.version}";
+  version = "${builtins.substring 0 10 versions.${baseName}.kicadVersion.src.rev}";
 
   src = fetchFromGitLab (
     {
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index a8340a2c22c..e5ce1f0092e 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -9,7 +9,7 @@
 , oceSupport ? false, opencascade
 , withOCCT ? true, opencascade-occt
 , ngspiceSupport ? true, libngspice
-, scriptingSupport ? false, swig, python3
+, scriptingSupport ? true, swig, python3
 , debug ? false, valgrind
 , with3d ? true
 , withI18n ? true
diff --git a/pkgs/applications/science/electronics/kicad/libraries.nix b/pkgs/applications/science/electronics/kicad/libraries.nix
index 4dde2a0a122..91ce30de5f0 100644
--- a/pkgs/applications/science/electronics/kicad/libraries.nix
+++ b/pkgs/applications/science/electronics/kicad/libraries.nix
@@ -15,7 +15,9 @@ let
   mkLib = name:
     stdenv.mkDerivation {
       pname = "kicad-${name}";
-      version = "${version}";
+      # Use the revision instead of `version` (which is an ISO 8601 date)
+      # to prevent duplicating the library when just the date changed
+      version = "${builtins.substring 0 10 libSources.${name}.rev}";
       src = fetchFromGitHub (
         {
           owner = "KiCad";
@@ -50,7 +52,7 @@ in
   i18n = let name = "i18n"; in
     stdenv.mkDerivation {
       pname = "kicad-${name}";
-      version = "${version}";
+      version = "${builtins.substring 0 10 libSources.${name}.rev}";
       src = fetchFromGitLab (
         {
           group = "kicad";
diff --git a/pkgs/applications/science/electronics/kicad/versions.nix b/pkgs/applications/science/electronics/kicad/versions.nix
index 7299e8ee907..d001cc43367 100644
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@@ -27,25 +27,25 @@
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version =			"2020-07-21";
+      version =			"2020-08-22";
       src = {
-        rev =			"9a801d8b72f24e297a7d9d6e8cee2eef6cab2988";
-        sha256 =		"0yilmmng7y3rz1bxw2b0s0aqs8hdqr7ach2r45bx8v1f4bih4ka9";
+        rev =			"a2341f0f335b0abb9fc8cb86d19cbe6f9b38fade";
+        sha256 =		"0167yb39f800xarq3khn7sbdkgcx9j2ayhy8c7lhhks6kh7459g0";
       };
     };
     libVersion = {
-      version =			"2020-07-21";
+      version =			"2020-08-22";
       libSources = {
-        i18n.rev =		"a311975d139caf8be9848dd613a9800570adc245";
-        i18n.sha256 =		"1bkn2hhwcg8xdpn9yfm9nnqsg02c1nizhpxd4yhpxgifhh4psz1g";
-        symbols.rev =		"18572c4c118fe8ef779edf3131eebf2c33c6fa46";
-        symbols.sha256 =	"0hqx0aznzrnlbdkpsnl8mbs9bdgiv029d6zjh10nyjzcw27q3hxz";
+        i18n.rev =		"cbbb1efd940094bf0c3168280698b2b059a8c509";
+        i18n.sha256 =		"1q4jakn6m8smnr2mg7jgb520nrb6fag9mdvlcpx3smp3qbxka818";
+        symbols.rev =		"9ca6a5348cdeb88e699582d4ed051ff7303b44d3";
+        symbols.sha256 =	"13w6pb34rhz96rnar25z7kiscy6q1fm8l39hq1bpb8g9yn86ssz4";
         templates.rev =		"ae16953b81055855bcede4a33305413599d86a15";
         templates.sha256 =	"1pkv90p3liy3bj4nklxsvpzh9m56p0k5ldr22armvgqfaqaadx9v";
-        footprints.rev =	"4835f80b4a52256aa7a3eb650e6e0fef33a77d0d";
-        footprints.sha256 =	"00rc6phxmkry35i0xzry14axvh2akvvkly45s3xxi06vaydaw7i5";
-        packages3d.rev =	"9b560cf94a35b692ca516d37bdaf392ce10e549d";
-        packages3d.sha256 =	"0b9jglf77fy0n0r8xs4yqkv6zvipyfvp0z5dnqlzp32csy5aqpi1";
+        footprints.rev =	"f94c2d5d619d16033f69a555b449f59604d97865";
+        footprints.sha256 =	"1g71sk77jvqaf9xvgq6dkyvd9pij2lb4n0bn0dqnwddhwam935db";
+        packages3d.rev =	"f699b0e3c13fe75618086913e39279c85da14cc7";
+        packages3d.sha256 =	"0m5rb5axa946v729z35ga84in76y4zpk32qzi0hwqx957zy72hs9";
       };
     };
   };
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index 0613e22bbda..9c59ad3a394 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -1,22 +1,29 @@
-{ stdenv, fetchurl, perl, flex, bison }:
+{ stdenv, fetchurl
+, perl, flex, bison
+}:
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "4.036";
+  version = "4.040";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${pname}-${version}.tgz";
-    sha256 = "1sy02pgq3kvk8548l57hsh08vfbqdg8dghj8mwlybdi8fdjz4z1h";
+    sha256 = "1qy0wllsmxva3c838spxwmacxx36r3njxwhgp172m4l3829785bf";
   };
 
   enableParallelBuilding = true;
-  buildInputs = [ perl flex bison ];
+  buildInputs = [ perl ];
+  nativeBuildInputs = [ flex bison ];
 
-  meta = {
+  # these tests need some interpreter paths patched early on...
+  doCheck = false;
+  checkTarget = "test";
+
+  meta = with stdenv.lib; {
     description = "Fast and robust (System)Verilog simulator/compiler";
     homepage    = "https://www.veripool.org/wiki/verilator";
-    license     = stdenv.lib.licenses.lgpl3;
-    platforms   = stdenv.lib.platforms.unix;
-    maintainers = with stdenv.lib.maintainers; [ thoughtpolice ];
+    license     = licenses.lgpl3;
+    platforms   = platforms.unix;
+    maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/applications/science/logic/isabelle/default.nix b/pkgs/applications/science/logic/isabelle/default.nix
index d2e49d81783..a12d75eabbe 100644
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@@ -3,18 +3,18 @@
 
 stdenv.mkDerivation rec {
   pname = "isabelle";
-  version = "2018";
+  version = "2020";
 
   dirname = "Isabelle${version}";
 
   src = if stdenv.isDarwin
     then fetchurl {
-      url = "http://isabelle.in.tum.de/website-${dirname}/dist/${dirname}.dmg";
-      sha256 = "0jwnvsf5whklq14ihaxs7b9nbic94mm56nvxljrdbvl6y628j9r5";
+      url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_macos.tar.gz";
+      sha256 = "1sfr5filsaqj93g5y4p9n8g5652dhr4whj25x4lifdxr2pp560xx";
     }
     else fetchurl {
       url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
-      sha256 = "1928lwrw1v1p9s23kix30ncpqm8djmrnjixj82f3ni2a8sc3hrsp";
+      sha256 = "1bibabhlsvf6qsjjkgxcpq3cvl1z7r8yfcgqbhbvsiv69n3gyfk3";
     };
 
   buildInputs = [ perl polyml z3 ]
@@ -42,14 +42,14 @@ stdenv.mkDerivation rec {
       ML_SOURCES="\$POLYML_HOME/src"
     EOF
 
-    cat >contrib/jdk/etc/settings <<EOF
+    cat >contrib/jdk*/etc/settings <<EOF
       ISABELLE_JAVA_PLATFORM=${stdenv.system}
       ISABELLE_JDK_HOME=${java}
     EOF
 
     echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings
 
-    for comp in contrib/jdk contrib/polyml-* contrib/z3-*; do
+    for comp in contrib/jdk* contrib/polyml-* contrib/z3-*; do
       rm -rf $comp/x86*
     done
     '' + (if ! stdenv.isLinux then "" else ''
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     bin/isabelle install $out/bin
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A generic proof assistant";
 
     longDescription = ''
@@ -74,9 +74,9 @@ stdenv.mkDerivation rec {
       to be expressed in a formal language and provides tools for proving those
       formulas in a logical calculus.
     '';
-    homepage = "http://isabelle.in.tum.de/";
-    license = "LGPL";
-    maintainers = [ stdenv.lib.maintainers.jwiegley ];
-    platforms = stdenv.lib.platforms.linux;
+    homepage = "https://isabelle.in.tum.de/";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.jwiegley ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/science/logic/mcy/default.nix b/pkgs/applications/science/logic/mcy/default.nix
index bbdcacf2b50..eba910e07eb 100644
--- a/pkgs/applications/science/logic/mcy/default.nix
+++ b/pkgs/applications/science/logic/mcy/default.nix
@@ -7,13 +7,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "mcy";
-  version = "2020.07.06";
+  version = "2020.08.03";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "mcy";
-    rev    = "6e8433ed9acbface5e080719110a957d89d849df";
-    sha256 = "1vbzg0rgmf7kp735m6p4msxc51vpsrdwk24ir7z0zxsb8lv53gg7";
+    rev    = "62048e69df13f8e03670424626755ae8ef4c36ff";
+    sha256 = "15xxgzx1zxzx5kshqyrxnfx33cz6cjzxcdcn6z98jhs9bwyvf96f";
   };
 
   buildInputs = [ python ];
diff --git a/pkgs/applications/science/logic/symbiyosys/default.nix b/pkgs/applications/science/logic/symbiyosys/default.nix
index b3ae4580256..9cf8b0845d4 100644
--- a/pkgs/applications/science/logic/symbiyosys/default.nix
+++ b/pkgs/applications/science/logic/symbiyosys/default.nix
@@ -1,20 +1,20 @@
 { stdenv, fetchFromGitHub
 , bash, python3, yosys
-, yices, boolector, aiger
+, yices, boolector, z3, aiger
 }:
 
 stdenv.mkDerivation {
   pname = "symbiyosys";
-  version = "2020.07.03";
+  version = "2020.08.22";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "SymbiYosys";
-    rev    = "06e80194c77f5cc38c6999b1d3047a2d6ca82e15";
-    sha256 = "1hl03qy98pgq24ijyimf9pf7qxp42l7cki66wx48jys4m1s6n8v9";
+    rev    = "33b0bb7d836fe2a73dc7b10587222f2a718beef4";
+    sha256 = "03rbrbwsji1sqcp2yhgbc0fca04zsryv2g4izjhdzv64nqjzjyhn";
   };
 
-  buildInputs = [ python3 ];
+  buildInputs = [ ];
   patchPhase = ''
     patchShebangs .
 
@@ -26,14 +26,15 @@ stdenv.mkDerivation {
     # Fix various executable references
     substituteInPlace sbysrc/sby_core.py \
       --replace '"/usr/bin/env", "bash"' '"${bash}/bin/bash"' \
-      --replace ': "btormc"'       ': "${boolector}/bin/btormc"' \
-      --replace ': "yosys"'        ': "${yosys}/bin/yosys"' \
-      --replace ': "yosys-smtbmc"' ': "${yosys}/bin/yosys-smtbmc"' \
-      --replace ': "yosys-abc"'    ': "${yosys}/bin/yosys-abc"' \
-      --replace ': "aigbmc"'       ': "${aiger}/bin/aigbmc"' \
+      --replace ', "btormc"'             ', "${boolector}/bin/btormc"' \
+      --replace ', "aigbmc"'             ', "${aiger}/bin/aigbmc"'
+
+    substituteInPlace sbysrc/sby_core.py \
+      --replace '##yosys-program-prefix##' '"${yosys}/bin/"'
   '';
 
   buildPhase = "true";
+
   installPhase = ''
     mkdir -p $out/bin $out/share/yosys/python3
 
@@ -43,6 +44,10 @@ stdenv.mkDerivation {
     chmod +x $out/bin/sby
   '';
 
+  doCheck = false; # not all provers are yet packaged...
+  checkInputs = [ python3 yosys boolector yices z3 aiger ];
+  checkPhase = "make test";
+
   meta = {
     description = "Tooling for Yosys-based verification flows";
     homepage    = "https://symbiyosys.readthedocs.io/";
diff --git a/pkgs/applications/science/math/qalculate-gtk/default.nix b/pkgs/applications/science/math/qalculate-gtk/default.nix
index d1ab05d4cde..df622e7303d 100644
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@@ -12,7 +12,11 @@ stdenv.mkDerivation rec {
   };
 
   patchPhase = ''
+    # The gnome-search-provider2.c file generated by gdbus-codegen depends
+    # on gio-unix-2.0, which is a Requires.private of gtk+-3.0,
+    # and private dependencies are dropped in our default patched pkg-config.
     # https://github.com/Qalculate/qalculate-gtk/pull/178
+    # https://github.com/NixOS/nixpkgs/issues/292
     substituteInPlace configure.ac --replace 'libxml-2.0' 'libxml-2.0 gio-unix-2.0'
 
     # https://github.com/Qalculate/qalculate-gtk/pull/179
diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index 41ef3cce465..657ae4605eb 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -98,7 +98,7 @@ let
 
   git-fame = callPackage ./git-fame {};
 
-  git-fast-export = callPackage ./fast-export { };
+  git-fast-export = callPackage ./fast-export { mercurial = mercurial_4; };
 
   git-filter-repo = callPackage ./git-filter-repo {
     pythonPackages = python3Packages;
diff --git a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
index 22009f10d44..80f048d0575 100644
--- a/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/fast-export/default.nix
@@ -1,13 +1,14 @@
-{stdenv, fetchgit, mercurial, makeWrapper}:
+{stdenv, fetchFromGitHub, git, mercurial, makeWrapper}:
 
 stdenv.mkDerivation rec {
   pname = "fast-export";
-  version = "190107";
+  version = "200213";
 
-  src = fetchgit {
-    url = "git://repo.or.cz/fast-export.git";
+  src = fetchFromGitHub {
+    owner = "frej";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "14azfps9jd5anivcvfwflgsvqdyy6gm9jy284kzx2ng9f7871d14";
+    sha256 = "0hzyh66rlawxip4n2pvz7pbs0cq82clqv1d6c7hf60v1drjxw287";
   };
 
   buildInputs = [mercurial.python mercurial makeWrapper];
@@ -27,11 +28,34 @@ stdenv.mkDerivation rec {
 
     for script in $out/bin/*.sh; do
       wrapProgram $script \
-        --prefix PATH : "${mercurial.python}/bin":$libexec \
+        --prefix PATH : "${git}/bin":"${mercurial.python}/bin":$libexec \
         --prefix PYTHONPATH : "${mercurial}/${mercurial.python.sitePackages}":$sitepackagesPath
     done
   '';
 
+  doInstallCheck = true;
+  # deliberately not adding git or hg into installCheckInputs - package should
+  # be able to work without them in runtime env
+  installCheckPhase = ''
+    mkdir repo-hg
+    pushd repo-hg
+    ${mercurial}/bin/hg init
+    echo foo > bar
+    ${mercurial}/bin/hg add bar
+    ${mercurial}/bin/hg commit --message "baz"
+    popd
+
+    mkdir repo-git
+    pushd repo-git
+    ${git}/bin/git init
+    ${git}/bin/git config core.ignoreCase false  # for darwin
+    $out/bin/hg-fast-export.sh -r ../repo-hg/ --hg-hash
+    for s in "foo" "bar" "baz" ; do
+      (${git}/bin/git show | grep $s > /dev/null) && echo $s found
+    done
+    popd
+  '';
+
   meta = with stdenv.lib; {
     description = "Import mercurial into git";
     homepage = "https://repo.or.cz/w/fast-export.git";
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index 675d713f4b4..064500fde7f 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) cri-o podman; };
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/containers/conmon";
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 4210994f435..e6595a207b8 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 buildGoPackage rec {
   pname = "containerd";
-  version = "1.2.13";
+  version = "1.4.0";
   # git commit for the above version's tag
   commit = "7ad184331fa3e55e52b890ea95e65ba581ae3429";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "1rac3iak3jpz57yarxc72bxgxvravwrl0j6s6w2nxrmh2m3kxqzn";
+    sha256 = "1ajns679ck5yp6vmf39pyshzf8jijw5fcg5biixkj54jhj3bv1sq";
   };
 
   goPackagePath = "github.com/containerd/containerd";
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index 9ec34e1b54a..d0c8938e6de 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -10,6 +10,7 @@
 , libselinux
 , lvm2
 , pkg-config
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -57,6 +58,8 @@ buildGoModule rec {
     installManPage docs/*.[1-9]
   '';
 
+  passthru.tests = { inherit (nixosTests) cri-o; };
+
   meta = with stdenv.lib; {
     homepage = "https://cri-o.io";
     description = ''
diff --git a/pkgs/applications/virtualization/cri-o/wrapper.nix b/pkgs/applications/virtualization/cri-o/wrapper.nix
index 1578eaf4f58..298bec6550e 100644
--- a/pkgs/applications/virtualization/cri-o/wrapper.nix
+++ b/pkgs/applications/virtualization/cri-o/wrapper.nix
@@ -27,7 +27,7 @@ let
 
 in runCommand cri-o.name {
   name = "${cri-o.pname}-wrapper-${cri-o.version}";
-  inherit (cri-o) pname version;
+  inherit (cri-o) pname version passthru;
 
   meta = builtins.removeAttrs cri-o.meta [ "outputsToInstall" ];
 
diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 4c5699419eb..5f002f5ddc8 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with lib; {
     description = "A fast and lightweight fully featured OCI runtime and C library for running containers";
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index cc805aefc9f..b6656ea50bd 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -60,7 +60,7 @@ buildGoModule rec {
     MANDIR=$man/share/man make install.man-nobuild
   '';
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with stdenv.lib; {
     homepage = "https://podman.io/";
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 7cbc3e4c619..535f8371153 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -18,6 +18,7 @@
 , openGLSupport ? sdlSupport, mesa, epoxy, libdrm
 , virglSupport ? openGLSupport, virglrenderer
 , smbdSupport ? false, samba
+, tpmSupport ? true
 , hostCpuOnly ? false
 , hostCpuTargets ? (if hostCpuOnly
                     then (stdenv.lib.optional stdenv.isx86_64 "i386-softmmu"
@@ -127,6 +128,7 @@ stdenv.mkDerivation rec {
     ++ optional cephSupport "--enable-rbd"
     ++ optional openGLSupport "--enable-opengl"
     ++ optional virglSupport "--enable-virglrenderer"
+    ++ optional tpmSupport "--enable-tpm"
     ++ optional smbdSupport "--smbd=${samba}/bin/smbd";
 
   doCheck = false; # tries to access /dev
diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index ecd282d6f7d..fd3d914af66 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -45,7 +45,7 @@ buildGoPackage rec {
     installManPage man/*/*.[1-9]
   '';
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) cri-o podman; };
 
   meta = with lib; {
     homepage = "https://github.com/opencontainers/runc";
diff --git a/pkgs/data/fonts/clearlyU/default.nix b/pkgs/data/fonts/clearlyU/default.nix
index 62002b14dd5..84cf3ebc538 100644
--- a/pkgs/data/fonts/clearlyU/default.nix
+++ b/pkgs/data/fonts/clearlyU/default.nix
@@ -20,19 +20,12 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    # install bdf fonts
+    # install otb and bdf fonts
     fontDir="$out/share/fonts"
-    install -m 644 -D *.bdf -t "$fontDir"
-    mkfontdir "$fontDir"
-
-    # install otb fonts
-    fontDir="$otb/share/fonts"
-    install -m 644 -D *.otb -t "$fontDir"
+    install -m 644 -D *.bdf *.otb -t "$fontDir"
     mkfontdir "$fontDir"
   '';
 
-  outputs = [ "out"  "otb" ];
-
   meta = with stdenv.lib; {
     description = "A Unicode font";
     license = licenses.mit;
diff --git a/pkgs/data/fonts/creep/default.nix b/pkgs/data/fonts/creep/default.nix
index 2e66ac468b0..7c7ad4d5aa9 100644
--- a/pkgs/data/fonts/creep/default.nix
+++ b/pkgs/data/fonts/creep/default.nix
@@ -20,14 +20,10 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    install -D -m644 creep.bdf "$out/share/fonts/misc/creep.bdf"
+    install -D -m644 creep.otb creep.bdf -t "$out/share/fonts/misc/"
     mkfontdir "$out/share/fonts/misc"
-    install -D -m644 creep.otb "$otb/share/fonts/misc/creep.otb"
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = "A pretty sweet 4px wide pixel font";
     homepage = "https://github.com/romeovs/creep";
diff --git a/pkgs/data/fonts/dina/default.nix b/pkgs/data/fonts/dina/default.nix
index 49c21947820..1a8ac344a53 100644
--- a/pkgs/data/fonts/dina/default.nix
+++ b/pkgs/data/fonts/dina/default.nix
@@ -41,15 +41,13 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    install -D -m 644 -t "$out/share/fonts/misc" *.pcf.gz
+    install -D -m 644 -t "$out/share/fonts/misc" *.pcf.gz *.otb
     install -D -m 644 -t "$bdf/share/fonts/misc" *.bdf
-    install -D -m 644 -t "$otb/share/fonts/misc" *.otb
     mkfontdir "$out/share/fonts/misc"
     mkfontdir "$bdf/share/fonts/misc"
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "bdf" "otb" ];
+  outputs = [ "out" "bdf" ];
 
   meta = with stdenv.lib; {
     description = "A monospace bitmap font aimed at programmers";
diff --git a/pkgs/data/fonts/envypn-font/default.nix b/pkgs/data/fonts/envypn-font/default.nix
index c26569166a3..0d69b812c4c 100644
--- a/pkgs/data/fonts/envypn-font/default.nix
+++ b/pkgs/data/fonts/envypn-font/default.nix
@@ -25,14 +25,10 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    install -D -m 644 -t "$out/share/fonts/misc" *.pcf.gz
-    install -D -m 644 -t "$otb/share/fonts/misc" *.otb
+    install -D -m 644 -t "$out/share/fonts/misc" *.otb *.pcf.gz
     mkfontdir "$out/share/fonts/misc"
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = ''
       Readable bitmap font inspired by Envy Code R
diff --git a/pkgs/data/fonts/gohufont/default.nix b/pkgs/data/fonts/gohufont/default.nix
index e2361ef8163..ac82c82ae3d 100644
--- a/pkgs/data/fonts/gohufont/default.nix
+++ b/pkgs/data/fonts/gohufont/default.nix
@@ -52,19 +52,12 @@ stdenv.mkDerivation rec {
     fontDir="$out/share/consolefonts"
     install -D -m 644 -t "$fontDir" psf/*.psf
 
-    # install the pcf fonts (for xorg applications)
+    # install the pcf and otb fonts (for X11,GTK applications)
     fontDir="$out/share/fonts/misc"
-    install -D -m 644 -t "$fontDir" *.pcf
-    mkfontdir "$fontDir"
-
-    # install the otb fonts (for gtk applications)
-    fontDir="$otb/share/fonts/misc"
-    install -D -m 644 -t "$fontDir" *.otb
+    install -D -m 644 -t "$fontDir" *.pcf *.otb
     mkfontdir "$fontDir"
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = ''
       A monospace bitmap font well suited for programming and terminal use
diff --git a/pkgs/data/fonts/profont/default.nix b/pkgs/data/fonts/profont/default.nix
index cba08309fac..6297a8fbb20 100644
--- a/pkgs/data/fonts/profont/default.nix
+++ b/pkgs/data/fonts/profont/default.nix
@@ -28,15 +28,10 @@ stdenv.mkDerivation {
       gzip -n -9 -c "$f" > "$out/share/fonts/misc/$f.gz"
     done
     install -D -m 644 LICENSE -t "$out/share/doc/$pname"
+    install -D -m 644 "$srcOtb/profontn.otb" -t $out/share/fonts/misc
     mkfontdir "$out/share/fonts/misc"
-
-    cd $srcOtb
-    install -D -m 644 profontn.otb -t $otb/share/fonts/misc
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     homepage = "https://tobiasjung.name/profont/";
     description = "A monospaced font created to be a most readable font for programming";
diff --git a/pkgs/data/fonts/siji/default.nix b/pkgs/data/fonts/siji/default.nix
index d1e53bbb757..fb13f82263d 100644
--- a/pkgs/data/fonts/siji/default.nix
+++ b/pkgs/data/fonts/siji/default.nix
@@ -24,15 +24,13 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    install -m 644 -D pcf/* -t "$out/share/fonts/misc"
+    install -m 644 -D *.otb pcf/* -t "$out/share/fonts/misc"
     install -m 644 -D bdf/* -t "$bdf/share/fonts/misc"
-    install -m 644 -D *.otb -t "$otb/share/fonts/misc"
     mkfontdir "$out/share/fonts/misc"
     mkfontdir "$bdf/share/fonts/misc"
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "bdf" "otb" ];
+  outputs = [ "out" "bdf" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/stark/siji";
diff --git a/pkgs/data/fonts/tamsyn/default.nix b/pkgs/data/fonts/tamsyn/default.nix
index 2738925478f..4d1e58a6bb3 100644
--- a/pkgs/data/fonts/tamsyn/default.nix
+++ b/pkgs/data/fonts/tamsyn/default.nix
@@ -29,15 +29,11 @@ in stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    install -m 644 -D *.pcf.gz -t "$out/share/fonts/misc"
+    install -m 644 -D *.otb *.pcf.gz -t "$out/share/fonts/misc"
     install -m 644 -D *.psf.gz -t "$out/share/consolefonts"
-    install -m 644 -D *.otb    -t "$otb/share/fonts/misc"
     mkfontdir "$out/share/fonts/misc"
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = "A monospace bitmap font aimed at programmers";
     longDescription = ''Tamsyn is a monospace bitmap font, primarily aimed at
diff --git a/pkgs/data/fonts/tamzen/default.nix b/pkgs/data/fonts/tamzen/default.nix
index 6ecc03d7310..026ec63d670 100644
--- a/pkgs/data/fonts/tamzen/default.nix
+++ b/pkgs/data/fonts/tamzen/default.nix
@@ -14,15 +14,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ mkfontscale ];
 
   installPhase = ''
-    install -m 644 -D pcf/*.pcf -t "$out/share/fonts/misc"
+    install -m 644 -D otb/*.otb pcf/*.pcf -t "$out/share/fonts/misc"
     install -m 644 -D psf/*.psf -t "$out/share/consolefonts"
-    install -m 644 -D otb/*.otb -t "$otb/share/fonts/misc"
     mkfontdir "$out/share/fonts/misc"
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = "Bitmapped programming font based on Tamsyn";
     longDescription = ''
diff --git a/pkgs/data/fonts/terminus-font/default.nix b/pkgs/data/fonts/terminus-font/default.nix
index fb120e5eec6..bbde1dd252c 100644
--- a/pkgs/data/fonts/terminus-font/default.nix
+++ b/pkgs/data/fonts/terminus-font/default.nix
@@ -35,14 +35,12 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # install otb fonts (for GTK applications)
-    install -m 644 -D *.otb -t "$otb/share/fonts/misc";
-    mkfontdir "$otb/share/fonts/misc"
+    install -m 644 -D *.otb -t "$out/share/fonts/misc";
+    mkfontdir "$out/share/fonts/misc"
   '';
 
   installTargets = [ "install" "fontdir" ];
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = "A clean fixed width font";
     longDescription = ''
diff --git a/pkgs/data/fonts/tewi/default.nix b/pkgs/data/fonts/tewi/default.nix
index 7b67c1dd52d..7821cc66041 100644
--- a/pkgs/data/fonts/tewi/default.nix
+++ b/pkgs/data/fonts/tewi/default.nix
@@ -38,16 +38,10 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     fontDir="$out/share/fonts/misc"
-    install -m 644 -D out/* -t "$fontDir"
-    mkfontdir "$fontDir"
-
-    fontDir="$otb/share/fonts/misc"
-    install -m 644 -D *.otb -t "$fontDir"
+    install -m 644 -D *.otb out/* -t "$fontDir"
     mkfontdir "$fontDir"
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = "A nice bitmap font, readable even at small sizes";
     longDescription = ''
diff --git a/pkgs/data/fonts/ucs-fonts/default.nix b/pkgs/data/fonts/ucs-fonts/default.nix
index 7168607ce09..71c42c46b5d 100644
--- a/pkgs/data/fonts/ucs-fonts/default.nix
+++ b/pkgs/data/fonts/ucs-fonts/default.nix
@@ -42,16 +42,14 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    install -m 644 -D *.pcf.gz -t "$out/share/fonts/misc"
-    install -m 644 -D *.bdf    -t "$bdf/share/fonts/misc"
-    install -m 644 -D *.otb    -t "$otb/share/fonts/misc"
+    install -m 644 -D *.otb *.pcf.gz -t "$out/share/fonts/misc"
+    install -m 644 -D *.bdf -t "$bdf/share/fonts/misc"
 
     mkfontdir "$out/share/fonts/misc"
     mkfontdir "$bdf/share/fonts/misc"
-    mkfontdir "$otb/share/fonts/misc"
   '';
 
-  outputs = [ "out" "bdf" "otb" ];
+  outputs = [ "out" "bdf" ];
 
   meta = with stdenv.lib; {
     homepage = "https://www.cl.cam.ac.uk/~mgk25/ucs-fonts.html";
diff --git a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
index 5b07adf822e..b1da06ccd8b 100644
--- a/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
+++ b/pkgs/data/fonts/ultimate-oldschool-pc-font-pack/default.nix
@@ -1,12 +1,12 @@
 { lib, fetchzip }:
 
 let
-  version = "1.0";
+  version = "2.0";
 in
 fetchzip {
   name = "ultimate-oldschool-pc-font-pack-${version}";
-  url = "https://int10h.org/oldschool-pc-fonts/download/ultimate_oldschool_pc_font_pack_v${version}.zip";
-  sha256 = "0hid4dgqfy2w26734vcw2rxmpacd9vd1r2qpdr9ww1n3kgc92k9y";
+  url = "https://int10h.org/oldschool-pc-fonts/download/oldschool_pc_font_pack_v${version}_ttf.zip";
+  sha256 = "0z0fw6ni7iq806y4m83xrfx46r14xxxql09ch2gxjqi062awqyh8";
 
   postFetch= ''
     mkdir -p $out/share/fonts/truetype
diff --git a/pkgs/data/fonts/uni-vga/default.nix b/pkgs/data/fonts/uni-vga/default.nix
index 58a5dbcfdbc..65db46ca2ca 100644
--- a/pkgs/data/fonts/uni-vga/default.nix
+++ b/pkgs/data/fonts/uni-vga/default.nix
@@ -34,23 +34,20 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    # install pcf (for X11 applications)
-    install -m 644 -D *.pcf.gz -t "$out/share/fonts"
+    # install pcf and otb (for X11 and GTK applications)
+    install -m 644 -D *.otb *.pcf.gz -t "$out/share/fonts"
     mkfontdir "$out/share/fonts"
 
     # install bdf font
     install -m 644 -D *.bdf -t "$bdf/share/fonts"
     mkfontdir "$bdf/share/fonts"
 
-    # install otb font (for GTK applications)
-    install -m 644 -D *.otb -t "$otb/share/fonts"
-    mkfontdir "$otb/share/fonts"
   '' + optionalString stdenv.isLinux ''
     # install psf (for linux virtual terminal)
     install -m 644 -D *.psf.gz -t "$out/share/consolefonts"
   '';
 
-  outputs = [ "out" "bdf" "otb" ];
+  outputs = [ "out" "bdf" ];
 
   meta = {
     description = "Unicode VGA font";
diff --git a/pkgs/data/fonts/unifont/default.nix b/pkgs/data/fonts/unifont/default.nix
index 460efc2c581..685b5c452f2 100644
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
   installPhase =
     ''
       # install otb fonts
-      install -m 644 -D unifont.otb "$otb/share/fonts/unifont.otb"
-      mkfontdir "$otb/share/fonts"
+      install -m 644 -D unifont.otb "$out/share/fonts/unifont.otb"
+      mkfontdir "$out/share/fonts"
 
       # install pcf and ttf fonts
       install -m 644 -D ${pcf} $out/share/fonts/unifont.pcf.gz
@@ -41,8 +41,6 @@ stdenv.mkDerivation rec {
       mkfontscale
     '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = "Unicode font for Base Multilingual Plane";
     homepage = "http://unifoundry.com/unifont.html";
diff --git a/pkgs/data/fonts/uw-ttyp0/default.nix b/pkgs/data/fonts/uw-ttyp0/default.nix
index 96cde444d2b..b0e58faed60 100644
--- a/pkgs/data/fonts/uw-ttyp0/default.nix
+++ b/pkgs/data/fonts/uw-ttyp0/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     install -m 644 -D psf/*.psf -t "$fontDir"
 
     # install otb fonts
-    fontDir="$otb/share/fonts/X11/misc"
+    fontDir="$out/share/fonts/X11/misc"
     install -m 644 -D otb/*.otb -t "$fontDir"
     mkfontdir "$fontDir"
   '';
@@ -80,8 +80,6 @@ stdenv.mkDerivation rec {
     runHook postConfigure
   '';
 
-  outputs = [ "out" "otb" ];
-
   meta = with stdenv.lib; {
     description = "Monospace bitmap screen fonts for X11";
     homepage = "https://people.mpi-inf.mpg.de/~uwe/misc/uw-ttyp0/";
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index 17f359e7d28..8f2e78c639c 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gnome-shell";
-  version = "3.36.4";
+  version = "3.36.5";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gnome-shell/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1nyibrr98ijn65z9ki0k7xzcwcliwy2jqssz0l0jalpbkhnr751d";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1hj7gmjmy92xndlgw7pzk5m6j2fbzcgfd1pxc32k38gml8qg19d4";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome-3/extensions/night-theme-switcher/default.nix b/pkgs/desktops/gnome-3/extensions/night-theme-switcher/default.nix
index 71b53094674..f170a2fb190 100644
--- a/pkgs/desktops/gnome-3/extensions/night-theme-switcher/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/night-theme-switcher/default.nix
@@ -1,26 +1,24 @@
-{ stdenv, fetchFromGitLab }:
+{ stdenv, fetchFromGitLab, glib, gnome3, unzip }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-night-theme-switcher";
-  version = "19";
+  version = "36";
 
   src = fetchFromGitLab {
     owner = "rmnvgr";
     repo = "nightthemeswitcher-gnome-shell-extension";
     rev = "v${version}";
-    sha256 = "1ll0yf1skf51wa10mlrajd1dy459w33kx0i3vhfcx2pdk7mw5a3c";
+    sha256 = "1c88979qprwb5lj0v7va017w7rdr89a648anhw4k5q135jwyskpz";
   };
 
-  # makefile tries to do install in home directory using
-  # `gnome-extensions install`
-  dontBuild = true;
+  buildInputs = [ glib gnome3.gnome-shell unzip ];
 
   uuid = "nightthemeswitcher@romainvigier.fr";
 
   installPhase = ''
     runHook preInstall
     mkdir -p $out/share/gnome-shell/extensions/
-    cp -r src/ $out/share/gnome-shell/extensions/${uuid}
+    unzip build/${uuid}.shell-extension.zip -d $out/share/gnome-shell/extensions/${uuid}
     runHook postInstall
   '';
 
diff --git a/pkgs/desktops/xfce/applications/xfce4-volumed/default.nix b/pkgs/desktops/xfce/applications/xfce4-volumed/default.nix
deleted file mode 100644
index aec898161ff..00000000000
--- a/pkgs/desktops/xfce/applications/xfce4-volumed/default.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, makeWrapper
-, gstreamer, gtk2, gst-plugins-base, libnotify
-, keybinder, xfconf, xfce
-}:
-
-let
-  category = "apps";
-
-  # The usual Gstreamer plugins package has a zillion dependencies
-  # that we don't need for a simple mixer, so build a minimal package.
-  gst_plugins_minimal = gst-plugins-base.override {
-    minimalDeps = true;
-  };
-
-in
-
-stdenv.mkDerivation rec {
-  pname  = "xfce4-volumed";
-  version = "0.1.13";
-
-  src = fetchurl {
-    url = "mirror://xfce/src/${category}/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "1aa0a1sbf9yzi7bc78kw044m0xzg1li3y4w9kf20wqv5kfjs7v2c";
-  };
-
-  buildInputs =
-    [ gstreamer gst_plugins_minimal gtk2
-      keybinder xfconf libnotify
-    ];
-
-  nativeBuildInputs = [ pkgconfig makeWrapper ];
-
-  postInstall =
-    ''
-      wrapProgram "$out/bin/xfce4-volumed" \
-        --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH"
-    '';
-
-  passthru.updateScript = xfce.updateScript {
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
-
-  meta = with stdenv.lib; {
-    homepage = "https://www.xfce.org/projects/xfce4-volumed"; # referenced but inactive
-    description = "A volume keys control daemon for the Xfce desktop environment";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.abbradar ];
-  };
-}
diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index 579e863bf9c..09df8d79dca 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -88,9 +88,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   xfdashboard = callPackage ./applications/xfdashboard {};
 
-  # TODO: this repo is inactive for many years. Remove?
-  xfce4-volumed = callPackage ./applications/xfce4-volumed { };
-
   xfce4-volumed-pulse = callPackage ./applications/xfce4-volumed-pulse { };
 
   xfce4-notifyd = callPackage ./applications/xfce4-notifyd { };
@@ -175,7 +172,6 @@ lib.makeScope pkgs.newScope (self: with self; {
   xfce4notifyd = xfce4-notifyd;
   xfce4taskmanager = xfce4-taskmanager;
   xfce4terminal = xfce4-terminal;
-  xfce4volumed = xfce4-volumed;
   xfce4volumed_pulse = xfce4-volumed-pulse;
   xfce4icontheme = xfce4-icon-theme;
   xfwm4themes = xfwm4-themes;
diff --git a/pkgs/development/compilers/nextpnr/default.nix b/pkgs/development/compilers/nextpnr/default.nix
index dc8f750c567..5dfefa61220 100644
--- a/pkgs/development/compilers/nextpnr/default.nix
+++ b/pkgs/development/compilers/nextpnr/default.nix
@@ -14,14 +14,14 @@ let
 in
 with stdenv; mkDerivation rec {
   pname = "nextpnr";
-  version = "2020.07.08";
+  version = "2020.08.22";
 
   srcs = [
     (fetchFromGitHub {
       owner  = "YosysHQ";
       repo   = "nextpnr";
-      rev    = "3cafb16aa634d2bc369077d8d36760d23973a35b";
-      sha256 = "0z6q8f2f97jr037d51h097vck9jspidjn0pb5irlj0xdnb5si0js";
+      rev    = "c8ecb8341ca766e1e7565cc2b652b63eaba67508";
+      sha256 = "1cf9ad7w5x452qdc6m9c3in6v9yzip3n1as978lbdh76f5mc00fv";
       name   = "nextpnr";
     })
     (fetchFromGitHub {
diff --git a/pkgs/development/compilers/yosys/default.nix b/pkgs/development/compilers/yosys/default.nix
index 7d645da8b4b..c3185ca4e0e 100644
--- a/pkgs/development/compilers/yosys/default.nix
+++ b/pkgs/development/compilers/yosys/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "yosys";
-  version = "2020.07.07";
+  version = "2020.08.22";
 
   src = fetchFromGitHub {
     owner  = "YosysHQ";
     repo   = "yosys";
-    rev    = "000fd08198487cd1d36e65e4470f4b0269c23a2b";
-    sha256 = "01s252vwh4g1f4y99nfrkpf6hgvh9k63nz8hvpmjza5z8x6zf4i1";
+    rev    = "12132b6850747aec99715fdfa3184fe3ebefa015";
+    sha256 = "1v6x1y2f3r8vi7pnkgx374rrv02xgmg9yg23f61n7d1v2rd6y5cc";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/coq-modules/coqprime/default.nix b/pkgs/development/coq-modules/coqprime/default.nix
index a049fa94d41..0ead97ffbf0 100644
--- a/pkgs/development/coq-modules/coqprime/default.nix
+++ b/pkgs/development/coq-modules/coqprime/default.nix
@@ -6,6 +6,10 @@ let
           version = "8.8";
           sha256 = "075yjczk79pf1hd3lgdjiz84ilkzfxjh18lgzrhhqp7d3kz5lxp5";
         };
+        v_8_10 = {
+          version = "8.10";
+          sha256 = "0r9gnh5a5ykiiz5h1i8xnzgiydpwc4z9qhndxyya85xq0f910qaz";
+        };
     in
       {
         "8.7" = {
@@ -14,10 +18,8 @@ let
         };
         "8.8" = v_8_8;
         "8.9" = v_8_8;
-        "8.10" = {
-          version = "8.10";
-          sha256 = "0r9gnh5a5ykiiz5h1i8xnzgiydpwc4z9qhndxyya85xq0f910qaz";
-        };
+        "8.10" = v_8_10;
+        "8.11" = v_8_10;
       };
   param = params.${coq.coq-version};
 in
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 7d0857f4e78..53cef387ae4 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.10.1.590";
+  version = "1.10.1.645";
 
   src = fetchurl {
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "18x8xkxsqwnv3k1mf42ylfv7zzjllm7yiagq16b2gkq62j5sm1k7";
+    sha256 = "1z6a9an8ls992y4japmzdxay7c5d2z9s2q1xl4g615r23jwpcsf9";
   };
 
   nativeBuildInputs = [
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
       cp clojure-tools-${version}.jar $out/libexec
       cp example-deps.edn $out
       cp deps.edn $out
+      cp clj_exec.clj $out
 
       substituteInPlace clojure --replace PREFIX $out
 
diff --git a/pkgs/development/interpreters/groovy/default.nix b/pkgs/development/interpreters/groovy/default.nix
index 1572f5e4be2..97e997bdd69 100644
--- a/pkgs/development/interpreters/groovy/default.nix
+++ b/pkgs/development/interpreters/groovy/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "groovy";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchurl {
     url = "http://dl.bintray.com/groovy/maven/apache-groovy-binary-${version}.zip";
-    sha256 = "1ddw3fqrmwh4w6z6xgck4jhmq33rwgbmpjw07g12ri1vgw4xks9w";
+    sha256 = "0xdm70b61pdj8z3g08az16y9b6cpz5hv7iwvwfyfyxrjdi47h419";
   };
 
   buildInputs = [ unzip makeWrapper ];
diff --git a/pkgs/development/interpreters/guile/2.0.nix b/pkgs/development/interpreters/guile/2.0.nix
index b5b83e18025..5b26b38dbd4 100644
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@@ -59,7 +59,7 @@
   # "libgcc_s.so.1 must be installed for pthread_cancel to work".
 
   # don't have "libgcc_s.so.1" on darwin
-  LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin) "-lgcc_s";
+  LDFLAGS = stdenv.lib.optionalString (!stdenv.isDarwin && !stdenv.hostPlatform.isMusl) "-lgcc_s";
 
   configureFlags = [ "--with-libreadline-prefix" ]
     ++ stdenv.lib.optionals stdenv.isSunOS [
diff --git a/pkgs/development/libraries/libguestfs/default.nix b/pkgs/development/libraries/libguestfs/default.nix
index 411ae0a3316..234e1164893 100644
--- a/pkgs/development/libraries/libguestfs/default.nix
+++ b/pkgs/development/libraries/libguestfs/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, makeWrapper
 , ncurses, cpio, gperf, cdrkit, flex, bison, qemu, pcre, augeas, libxml2
-, acl, libcap, libcap_ng, libconfig, systemd, fuse, yajl, libvirt, hivex
+, acl, libcap, libcap_ng, libconfig, systemd, fuse, yajl, libvirt, hivex, db
 , gmp, readline, file, numactl, xen, libapparmor, jansson
 , getopt, perlPackages, ocamlPackages
 , appliance ? null
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     ncurses cpio gperf jansson
     cdrkit flex bison qemu pcre augeas libxml2 acl libcap libcap_ng libconfig
-    systemd fuse yajl libvirt gmp readline file hivex
+    systemd fuse yajl libvirt gmp readline file hivex db
     numactl xen libapparmor getopt perlPackages.ModuleBuild
   ] ++ (with perlPackages; [ perl libintl_perl GetoptLong SysVirt ])
     ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ocaml_libvirt gettext-stub ounit ])
diff --git a/pkgs/development/libraries/oneDNN/default.nix b/pkgs/development/libraries/oneDNN/default.nix
index b2beaee0bc9..1fb0f03d305 100644
--- a/pkgs/development/libraries/oneDNN/default.nix
+++ b/pkgs/development/libraries/oneDNN/default.nix
@@ -5,13 +5,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
   pname = "oneDNN";
-  version = "1.6";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${version}";
-    sha256 = "0w2rgr3zgk7a3cql12dpddyhz2isyqqaks4vm8p45y426pd5m64b";
+    sha256 = "1rdq2rb4f9xbk2a07fpqgvd9mx1r5gwpm0jr8rra815bzddam8zh";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/openxr-loader/default.nix b/pkgs/development/libraries/openxr-loader/default.nix
index 6c5f2af3a52..e03752872f9 100644
--- a/pkgs/development/libraries/openxr-loader/default.nix
+++ b/pkgs/development/libraries/openxr-loader/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openxr-loader";
-  version = "1.0.10";
+  version = "1.0.11";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenXR-SDK-Source";
     rev = "release-${version}";
-    sha256 = "1igxyji2ab3gki1hlndvws1b2868mk1n3c4c3y5z0h3g713zw9ap";
+    sha256 = "0f3x5h0hdjiqgjf5mzzlprbhrbyabxllrjmlzgc9fv5rgqyyphj5";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/libraries/science/math/magma/default.nix b/pkgs/development/libraries/science/math/magma/default.nix
index dbe162c60b3..38700c963bf 100644
--- a/pkgs/development/libraries/science/math/magma/default.nix
+++ b/pkgs/development/libraries/science/math/magma/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchurl, cmake, gfortran, cudatoolkit, libpthreadstubs, lapack, blas }:
+{ stdenv, fetchurl, cmake, gfortran, ninja, cudatoolkit, libpthreadstubs, lapack, blas }:
 
 with stdenv.lib;
 
-let version = "2.5.0";
+let version = "2.5.3";
 
 in stdenv.mkDerivation {
   pname = "magma";
   inherit version;
   src = fetchurl {
     url = "https://icl.cs.utk.edu/projectsfiles/magma/downloads/magma-${version}.tar.gz";
-    sha256 = "0czspk93cv1fy37zyrrc9k306q4yzfxkhy1y4lj937dx8rz5rm2g";
+    sha256 = "1xjy3irdx0w1zyhvn4x47zni5fwsh6z97xd4yqldz8zrm5lx40n6";
     name = "magma-${version}.tar.gz";
   };
 
-  buildInputs = [ gfortran cudatoolkit libpthreadstubs cmake lapack blas ];
+  nativeBuildInputs = [ gfortran cmake ninja ];
+
+  buildInputs = [ cudatoolkit libpthreadstubs lapack blas ];
 
   doCheck = false;
 
@@ -32,7 +34,7 @@ in stdenv.mkDerivation {
     mkdir -p $out/lib/pkgconfig
     cp -a ../include/*.h $out/include
     #cp -a sparse-iter/include/*.h $out/include
-    cp -a lib/*.a $out/lib
+    cp -a lib/*.so $out/lib
     cat ../lib/pkgconfig/magma.pc.in                   | \
     sed -e s:@INSTALL_PREFIX@:"$out":          | \
     sed -e s:@CFLAGS@:"-I$out/include":    | \
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index 745be0be922..1cbf4026cb8 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   postInstall = ''
     ln -s $out/bin/wish* $out/bin/wish
     cp ../{unix,generic}/*.h $out/include
-    ln -s $out/lib/libtk${tcl.release}.so $out/lib/libtk.so
+    ln -s $out/lib/libtk${tcl.release}${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libtk${stdenv.hostPlatform.extensions.sharedLibrary}
   ''
   + stdenv.lib.optionalString (stdenv.isDarwin) ''
     cp ../macosx/*.h $out/include
diff --git a/pkgs/development/libraries/utf8proc/default.nix b/pkgs/development/libraries/utf8proc/default.nix
index 00c09179f1f..e08aea2e1ee 100644
--- a/pkgs/development/libraries/utf8proc/default.nix
+++ b/pkgs/development/libraries/utf8proc/default.nix
@@ -17,6 +17,12 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
+  # the pkg-config file is not created in the cmake installation
+  # process, so we use the Makefile and install it manually
+  # see https://github.com/JuliaStrings/utf8proc/issues/198
+  preConfigure = "make libutf8proc.pc prefix=$out";
+  postInstall = "install -Dm644 ../libutf8proc.pc -t $out/lib/pkgconfig/";
+
   meta = with stdenv.lib; {
     description = "A clean C library for processing UTF-8 Unicode data";
     homepage = "https://juliastrings.github.io/utf8proc/";
diff --git a/pkgs/development/ocaml-modules/containers/data.nix b/pkgs/development/ocaml-modules/containers/data.nix
new file mode 100644
index 00000000000..7d15d7d3c64
--- /dev/null
+++ b/pkgs/development/ocaml-modules/containers/data.nix
@@ -0,0 +1,18 @@
+{ buildDunePackage, containers
+, gen, iter, mdx, ounit, qcheck
+}:
+
+buildDunePackage {
+  pname = "containers-data";
+
+  inherit (containers) src version;
+
+  doCheck = true;
+  checkInputs = [ gen iter mdx.bin ounit qcheck ];
+
+  propagatedBuildInputs = [ containers ];
+
+  meta = containers.meta // {
+    description = "A set of advanced datatypes for containers";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/containers/default.nix b/pkgs/development/ocaml-modules/containers/default.nix
index 16bad5a5ec4..970122dd79f 100644
--- a/pkgs/development/ocaml-modules/containers/default.nix
+++ b/pkgs/development/ocaml-modules/containers/default.nix
@@ -1,24 +1,22 @@
 { lib, fetchFromGitHub, buildDunePackage, ocaml
-, iter, result, uchar
-, gen, mdx, ounit, qcheck, uutf
+, seq
+, gen, iter, ounit, qcheck, uutf
 }:
 
 buildDunePackage rec {
-  version = "2.7";
+  version = "3.0";
   pname = "containers";
 
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = "ocaml-containers";
     rev = "v${version}";
-    sha256 = "1nsxfgn1g1vpqihb9gd6gsab0bcm70nf9z84cp441c8wsc57hi6a";
+    sha256 = "0c75d5csgc68qqbsdz4279nlin111zrjbg4d47k32ska28myvpqn";
   };
 
-  buildInputs = [ iter ];
+  propagatedBuildInputs = [ seq ];
 
-  checkInputs = lib.optionals doCheck [ gen mdx.bin ounit qcheck uutf ];
-
-  propagatedBuildInputs = [ result uchar ];
+  checkInputs = [ gen iter ounit qcheck uutf ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/dune-action-plugin/default.nix b/pkgs/development/ocaml-modules/dune-action-plugin/default.nix
new file mode 100644
index 00000000000..fcb93aac799
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dune-action-plugin/default.nix
@@ -0,0 +1,19 @@
+{ lib, buildDunePackage, dune_2, dune-glob, dune-private-libs }:
+
+buildDunePackage rec {
+  pname = "dune-action-plugin";
+  inherit (dune_2) src version;
+
+  useDune2 = true;
+
+  dontAddPrefix = true;
+
+  propagatedBuildInputs = [ dune-glob dune-private-libs ];
+
+  meta = with lib; {
+    inherit (dune_2.meta) homepage;
+    description = "API for writing dynamic Dune actions";
+    maintainers = [ maintainers.marsam ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/dune-glob/default.nix b/pkgs/development/ocaml-modules/dune-glob/default.nix
new file mode 100644
index 00000000000..34b79068c11
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dune-glob/default.nix
@@ -0,0 +1,19 @@
+{ lib, buildDunePackage, dune_2, dune-private-libs }:
+
+buildDunePackage rec {
+  pname = "dune-glob";
+  inherit (dune_2) src version;
+
+  useDune2 = true;
+
+  dontAddPrefix = true;
+
+  propagatedBuildInputs = [ dune-private-libs ];
+
+  meta = with lib; {
+    inherit (dune_2.meta) homepage;
+    description = "Glob string matching language supported by dune";
+    maintainers = [ maintainers.marsam ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/dune-private-libs/default.nix b/pkgs/development/ocaml-modules/dune-private-libs/default.nix
index 6161bd1fe8e..9eb253f02e5 100644
--- a/pkgs/development/ocaml-modules/dune-private-libs/default.nix
+++ b/pkgs/development/ocaml-modules/dune-private-libs/default.nix
@@ -7,7 +7,7 @@ buildDunePackage rec {
 
   inherit (dune_2) src version;
 
-  minimumOCamlVersion = "4.07";
+  minimumOCamlVersion = "4.08";
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/ocaml-modules/hidapi/default.nix b/pkgs/development/ocaml-modules/hidapi/default.nix
new file mode 100644
index 00000000000..cd95b34fa2b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/hidapi/default.nix
@@ -0,0 +1,27 @@
+{ pkgs, lib, fetchurl, buildDunePackage, pkg-config
+, bigstring,
+}:
+
+buildDunePackage rec {
+  pname = "hidapi";
+  version = "1.1.1";
+
+  src = fetchurl {
+    url = "https://github.com/vbmithr/ocaml-hidapi/releases/download/${version}/${pname}-${version}.tbz";
+    sha256 = "1j7rd7ajrzla76r3sxljx6fb18f4f4s3jd7vhv59l2ilxyxycai2";
+  };
+
+  minimumOCamlVersion = "4.03";
+
+  buildInputs = [ pkgs.hidapi pkg-config ];
+  propagatedBuildInputs = [ bigstring ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = https://github.com/vbmithr/ocaml-hidapi;
+    description = "Bindings to Signal11's hidapi library";
+    license = licenses.isc;
+    maintainers = [ maintainers.alexfmpe ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ocamlgraph/default.nix b/pkgs/development/ocaml-modules/ocamlgraph/default.nix
index d2a94112eb3..df684f166e1 100644
--- a/pkgs/development/ocaml-modules/ocamlgraph/default.nix
+++ b/pkgs/development/ocaml-modules/ocamlgraph/default.nix
@@ -1,4 +1,7 @@
-{stdenv, fetchurl, ocaml, findlib, lablgtk ? null}:
+{ stdenv, fetchurl, ocaml, findlib
+, gtkSupport ? true
+, lablgtk
+}:
 
 stdenv.mkDerivation rec {
   pname = "ocamlgraph";
@@ -9,22 +12,19 @@ stdenv.mkDerivation rec {
     sha256 = "0m9g16wrrr86gw4fz2fazrh8nkqms0n863w7ndcvrmyafgxvxsnr";
   };
 
-  buildInputs = [ ocaml findlib lablgtk ];
-
-  patches = ./destdir.patch;
-
-  postPatch = ''
-    sed -i 's@$(DESTDIR)$(OCAMLLIB)/ocamlgraph@$(DESTDIR)/lib/ocaml/${ocaml.version}/site-lib/ocamlgraph@' Makefile.in
-    sed -i 's@OCAMLFINDDEST := -destdir $(DESTDIR)@@' Makefile.in
-    ${stdenv.lib.optionalString (lablgtk != null)
-      "sed -i 's@+lablgtk2@${lablgtk}/lib/ocaml/${ocaml.version}/site-lib/lablgtk2 -I ${lablgtk}/lib/ocaml/${ocaml.version}/site-lib/stublibs@' configure Makefile.in editor/Makefile"}
-  '';
+  buildInputs = [ ocaml findlib ]
+  ++ stdenv.lib.optional gtkSupport lablgtk
+  ;
 
   createFindlibDestdir = true;
 
-  buildPhase = ''
-    make all
-    make install-findlib
+  buildFlags =  [ "all" ];
+  installTargets = [ "install-findlib" ];
+
+  postInstall = stdenv.lib.optionalString gtkSupport ''
+    mkdir -p $out/bin
+    cp dgraph/dgraph.opt $out/bin/graph-viewer
+    cp editor/editor.opt $out/bin/graph-editor
   '';
 
   meta = {
diff --git a/pkgs/development/ocaml-modules/ocamlgraph/destdir.patch b/pkgs/development/ocaml-modules/ocamlgraph/destdir.patch
deleted file mode 100644
index 38fca1c491f..00000000000
--- a/pkgs/development/ocaml-modules/ocamlgraph/destdir.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff -Naur -x '*~' ocamlgraph-1.8.1/Makefile.in ocamlgraph-1.8.1-new//Makefile.in
---- ocamlgraph-1.8.1/Makefile.in	2011-10-17 09:57:03.000000000 -0430
-+++ ocamlgraph-1.8.1-new//Makefile.in	2011-11-24 13:01:22.626004819 -0430
-@@ -16,8 +16,8 @@
- ##########################################################################
- 
- # Where to install the binaries
--DESTDIR	=
- prefix	=@prefix@
-+DESTDIR=$(prefix)
- exec_prefix=@exec_prefix@
- datarootdir=@datarootdir@
- BINDIR	=$(DESTDIR)@bindir@
diff --git a/pkgs/development/python-modules/awkward1/default.nix b/pkgs/development/python-modules/awkward1/default.nix
index 635ffac2638..1e4958f37e6 100644
--- a/pkgs/development/python-modules/awkward1/default.nix
+++ b/pkgs/development/python-modules/awkward1/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "awkward1";
-  version = "0.2.27";
+  version = "0.2.33";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c868437aabb2e95efbc522c43d47cac42e1c61904c7ddbebf2f41c6b63bb9c6f";
+    sha256 = "bf3de210d0a88fb14a97c296f54ed2d5b686a785bb5fd7a31277f22b8daa9513";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/gspread/default.nix b/pkgs/development/python-modules/gspread/default.nix
index 5c9c644abd3..5fd73541dd4 100644
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , requests
 , google_auth
+, google-auth-oauthlib
 }:
 
 buildPythonPackage rec {
@@ -14,14 +15,12 @@ buildPythonPackage rec {
     sha256 = "e04f1a6267b3929fc1600424c5ec83906d439672cafdd61a9d5b916a139f841c";
   };
 
-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [ requests google_auth google-auth-oauthlib ];
 
   meta = with stdenv.lib; {
     description = "Google Spreadsheets client library";
     homepage = "https://github.com/burnash/gspread";
     license = licenses.mit;
-    # missing multiple google libraries
-    broken = true; # 2020-08-15
   };
 
   # No tests included
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index cebb7c2b938..7b246a38cb9 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -58,6 +58,10 @@ in buildPythonPackage rec {
     xlwt
   ];
 
+  # doesn't work with -Werror,-Wunused-command-line-argument
+  # https://github.com/NixOS/nixpkgs/issues/39687
+  hardeningDisable = optional stdenv.cc.isClang "strictoverflow";
+
   # For OSX, we need to add a dependency on libcxx, which provides
   # `complex.h` and other libraries that pandas depends on to build.
   postPatch = optionalString isDarwin ''
diff --git a/pkgs/development/python-modules/pelican/default.nix b/pkgs/development/python-modules/pelican/default.nix
index c7c1ced34f1..30d6546d570 100644
--- a/pkgs/development/python-modules/pelican/default.nix
+++ b/pkgs/development/python-modules/pelican/default.nix
@@ -1,18 +1,20 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub
+{ stdenv, buildPythonPackage, fetchFromGitHub, isPy27
 , glibcLocales, git
 , mock, nose, markdown, lxml, typogrify
 , jinja2, pygments, docutils, pytz, unidecode, six, dateutil, feedgenerator
-, blinker, pillow, beautifulsoup4, markupsafe }:
+, blinker, pillow, beautifulsoup4, markupsafe, pandoc }:
 
 buildPythonPackage rec {
   pname = "pelican";
-  version = "4.2.0";
+  version = "4.5.0";
+
+  disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "getpelican";
     repo = "pelican";
     rev = version;
-    sha256 = "0w9nqdw2jmqc6kqwg4rh6irr5k6j7hk8axg6vgd137rs50v62yv5";
+    sha256 = "0p8p84fcpkr19d54dhxvldd8ijbg334wmrmkr99pnbrdl1gf64qi";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     extraPostFetch = ''
@@ -24,15 +26,15 @@ buildPythonPackage rec {
 
   # Exclude custom locale test, which files were removed above to fix the source checksum
   checkPhase = ''
-    nosetests -sv --exclude=test_custom_locale_generation_works pelican
+    nosetests -s \
+      --exclude=test_custom_locale_generation_works \
+      --exclude=test_log_filter \
+      pelican
   '';
 
   buildInputs = [
     glibcLocales
-    # Note: Pelican has to adapt to a changed CLI of pandoc before enabling this
-    # again. Compare https://github.com/getpelican/pelican/pull/2252.
-    # Version 4.2.0 is incompatible with our current pandoc version.
-    # pandoc
+    pandoc
     git
     mock
     markdown
@@ -46,21 +48,16 @@ buildPythonPackage rec {
 
   checkInputs = [
     nose
+    pandoc
   ];
 
   postPatch= ''
     substituteInPlace pelican/tests/test_pelican.py \
       --replace "'git'" "'${git}/bin/git'"
-
-    # Markdown-3.1 changed footnote separator to colon
-    # https://github.com/getpelican/pelican/issues/2493#issuecomment-491723744
-    sed -i '/test_article_with_footnote/i\
-        @unittest.skip("")' pelican/tests/test_readers.py
   '';
 
   LC_ALL="en_US.UTF-8";
 
-
   # We only want to patch shebangs in /bin, and not those
   # of the project scripts that are created by Pelican.
   # See https://github.com/NixOS/nixpkgs/issues/30116
diff --git a/pkgs/development/python-modules/sabyenc3/default.nix b/pkgs/development/python-modules/sabyenc3/default.nix
new file mode 100644
index 00000000000..05b667fedc1
--- /dev/null
+++ b/pkgs/development/python-modules/sabyenc3/default.nix
@@ -0,0 +1,22 @@
+{ lib, fetchPypi, python3Packages }:
+
+python3Packages.buildPythonPackage rec {
+  pname = "sabyenc3";
+  version = "4.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0zfj1k4zij8ph8jwkq4d6i6axym8cil16yijxshqla5163d1031z";
+  };
+
+  # tests are not included in pypi distribution
+  doCheck = false;
+
+  meta = {
+    description = "yEnc Decoding for Python 3";
+    homepage = "https://github.com/sabnzbd/sabyenc/";
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.lovek323 ];
+  };
+
+}
diff --git a/pkgs/development/python-modules/test-tube/default.nix b/pkgs/development/python-modules/test-tube/default.nix
new file mode 100644
index 00000000000..f0c26292c84
--- /dev/null
+++ b/pkgs/development/python-modules/test-tube/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy27
+, pytestCheckHook
+, future
+, imageio
+, numpy
+, pandas
+, pytorch
+, tensorflow-tensorboard
+}:
+
+buildPythonPackage rec {
+  pname = "test-tube";
+  version = "0.7.5";
+
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "williamFalcon";
+    repo = pname;
+    rev = version;
+    sha256 = "0zpvlp1ybp2dhgap8jsalpfdyg8ycjhlfi3xrdf5dqffqvh2yhp2";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  propagatedBuildInputs = [
+    future
+    imageio
+    numpy
+    pandas
+    pytorch
+    tensorflow-tensorboard
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/williamFalcon/test-tube";
+    description = "Framework-agnostic library to track and parallelize hyperparameter search in machine learning experiments";
+    license = licenses.mit;
+    maintainers = [ maintainers.tbenst ];
+  };
+}
diff --git a/pkgs/development/python-modules/userpath/default.nix b/pkgs/development/python-modules/userpath/default.nix
new file mode 100644
index 00000000000..8366a56158d
--- /dev/null
+++ b/pkgs/development/python-modules/userpath/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, click
+, distro
+}:
+
+buildPythonPackage rec {
+  pname = "userpath";
+  version = "1.4.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256="0mfjmvx286z1dmnrc7bm65x8gj8qrmkcyagl0vf5ywfq0bm48591";
+  };
+
+  propagatedBuildInputs = [ click distro ];
+
+  # test suite is difficult to emulate in sandbox due to shell manipulation
+  doCheck = false;
+
+  pythonImportsCheck = [ "click" "userpath" ];
+
+  meta = with lib; {
+    description = "Cross-platform tool for adding locations to the user PATH";
+    homepage = "https://github.com/ofek/userpath";
+    license = [ licenses.asl20 licenses.mit ];
+    maintainers = with maintainers; [ yevhenshymotiuk ];
+  };
+}
diff --git a/pkgs/development/tools/analysis/tflint/default.nix b/pkgs/development/tools/analysis/tflint/default.nix
index b4e66f507d1..b6834ea8232 100644
--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tflint";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "terraform-linters";
     repo = pname;
     rev = "v${version}";
-    sha256 = "14pgsx136ibaf1mqkwn8ibnn4g6q5xx0r7xbijj521v12m145i8g";
+    sha256 = "1nj36xxl8zg7wdc36lakzdyr9hk82qwkwrvrw19bqach697y57nf";
   };
 
   vendorSha256 = "0bzd58ry5k100mjgvl1mxz7aysm75s4vkilcykrqy1s5sc0h3ng5";
diff --git a/pkgs/development/tools/bazel-kazel/default.nix b/pkgs/development/tools/bazel-kazel/default.nix
index 62c5e6c9ef9..4ae2a3e68f9 100644
--- a/pkgs/development/tools/bazel-kazel/default.nix
+++ b/pkgs/development/tools/bazel-kazel/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "bazel-kazel";
-  version = "0.0.11";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "repo-infra";
     rev = "v${version}";
-    sha256 = "0fcm7gjsv70qxnwbgy2sgx7clyhlfnkvdxsjgcrkaf5xds8hpys7";
+    sha256 = "1mnyp116q54xy7flml4cdcsbczhyyqnpyn2pnqrzy49aahbhpn5z";
   };
 
   vendorSha256 = "1pzkjh4n9ai8yqi98bkdhicjdr2l8j3fckl5n90c2gdcwqyxvgkf";
diff --git a/pkgs/development/tools/cloudfoundry-cli/default.nix b/pkgs/development/tools/cloudfoundry-cli/default.nix
index 9d0c1ab92ff..642c42108aa 100644
--- a/pkgs/development/tools/cloudfoundry-cli/default.nix
+++ b/pkgs/development/tools/cloudfoundry-cli/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, installShellFiles }:
+{ stdenv, buildGoPackage, fetchFromGitHub, fetchurl, installShellFiles }:
 
 buildGoPackage rec {
   pname = "cloudfoundry-cli";
-  version = "6.51.0";
+  version = "7.0.1";
 
   goPackagePath = "code.cloudfoundry.org/cli";
 
@@ -12,7 +12,14 @@ buildGoPackage rec {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "189cqng7y12knqm4n1bfajbc2lx027rwb44wddmj5iya27i7fv8f";
+    sha256 = "0jh4x7xlijp1naak5qyc256zkzlrczl6g4iz94s8wx2zj7np0q5l";
+  };
+
+  # upstream have helpfully moved the bash completion script to a separate
+  # repo which receives no releases or even tags
+  bashCompletionScript = fetchurl {
+    url = "https://raw.githubusercontent.com/cloudfoundry/cli-ci/6087781a0e195465a35c79c8e968ae708c6f6351/ci/installers/completion/cf7";
+    sha256 = "1vhg9jcgaxcvvb4pqnhkf27b3qivs4d3w232j0gbh9393m3qxrvy";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -35,7 +42,7 @@ buildGoPackage rec {
 
   installPhase = ''
     install -Dm555 out/cf "$out/bin/cf"
-    installShellCompletion --bash "$src/ci/installers/completion/cf"
+    installShellCompletion --bash $bashCompletionScript
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index d2e2638a703..4858b84abfa 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "v${version}";
-    sha256 = "0s7ymw1r1k1s8kwyg6nxpgak6kh9z3649a0axdfpjnm62v283shd";
+    sha256 = "09zb7r8f6m1w9ax9ayaxjzwmqcgx5f6x4lclfi1wdn6f6qaans4w";
   };
 
-  vendorSha256 = "00vp925vf9clk5bkw5fvj34id4v548rlssizh52z9psvdizj8q5p";
+  vendorSha256 = "012kgdvw7hj3m40v3nnpg916n02nxv19zid07h8g4qwprzg49iq2";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/icestorm/default.nix b/pkgs/development/tools/icestorm/default.nix
index 091a4638433..15ca059a880 100644
--- a/pkgs/development/tools/icestorm/default.nix
+++ b/pkgs/development/tools/icestorm/default.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "icestorm";
-  version = "2020.07.08";
+  version = "2020.08.19";
 
   passthru = rec {
     pythonPkg = if usePyPy then pypy3 else python3;
@@ -19,10 +19,10 @@ stdenv.mkDerivation rec {
   };
 
   src = fetchFromGitHub {
-    owner  = "cliffordwolf";
+    owner  = "YosysHQ";
     repo   = "icestorm";
-    rev    = "d12308775684cf43ab923227235b4ad43060015e";
-    sha256 = "18ykv6np8sp7rb7c1cm3ha3qnj280gpkyn476faahb15jh0nbjmw";
+    rev    = "da52117ccd5b4147f64dc7345357ec5439cd7543";
+    sha256 = "072bl3vmvb06ry0ci3b1sfjpm3iigb874khzja4azcai969ybp4k";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/tools/misc/itm-tools/cargo-lock.patch b/pkgs/development/tools/misc/itm-tools/cargo-lock.patch
new file mode 100644
index 00000000000..1559510cd9f
--- /dev/null
+++ b/pkgs/development/tools/misc/itm-tools/cargo-lock.patch
@@ -0,0 +1,321 @@
+diff --git a/Cargo.lock b/Cargo.lock
+new file mode 100644
+index 0000000..d9d39e5
+--- /dev/null
++++ b/Cargo.lock
+@@ -0,0 +1,315 @@
++# This file is automatically @generated by Cargo.
++# It is not intended for manual editing.
++[[package]]
++name = "addr2line"
++version = "0.12.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "602d785912f476e480434627e8732e6766b760c045bbf897d9dfaa9f4fbd399c"
++dependencies = [
++ "gimli",
++]
++
++[[package]]
++name = "adler32"
++version = "1.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "567b077b825e468cc974f0020d4082ee6e03132512f207ef1a02fd5d00d1f32d"
++
++[[package]]
++name = "ansi_term"
++version = "0.11.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
++dependencies = [
++ "winapi",
++]
++
++[[package]]
++name = "atty"
++version = "0.2.14"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
++dependencies = [
++ "hermit-abi",
++ "libc",
++ "winapi",
++]
++
++[[package]]
++name = "backtrace"
++version = "0.3.49"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "05100821de9e028f12ae3d189176b41ee198341eb8f369956407fea2f5cc666c"
++dependencies = [
++ "addr2line",
++ "cfg-if",
++ "libc",
++ "miniz_oxide",
++ "object",
++ "rustc-demangle",
++]
++
++[[package]]
++name = "bitflags"
++version = "1.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
++
++[[package]]
++name = "byteorder"
++version = "1.3.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "08c48aae112d48ed9f069b33538ea9e3e90aa263cfa3d1c24309612b1f7472de"
++
++[[package]]
++name = "cfg-if"
++version = "0.1.10"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
++
++[[package]]
++name = "clap"
++version = "2.33.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bdfa80d47f954d53a35a64987ca1422f495b8d6483c0fe9f7117b36c2a792129"
++dependencies = [
++ "ansi_term",
++ "atty",
++ "bitflags",
++ "strsim",
++ "textwrap",
++ "unicode-width",
++ "vec_map",
++]
++
++[[package]]
++name = "either"
++version = "1.5.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bb1f6b1ce1c140482ea30ddd3335fc0024ac7ee112895426e0a629a6c20adfe3"
++
++[[package]]
++name = "exitfailure"
++version = "0.5.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2ff5bd832af37f366c6c194d813a11cd90ac484f124f079294f28e357ae40515"
++dependencies = [
++ "failure",
++]
++
++[[package]]
++name = "failure"
++version = "0.1.8"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d32e9bd16cc02eae7db7ef620b392808b89f6a5e16bb3497d159c6b92a0f4f86"
++dependencies = [
++ "backtrace",
++ "failure_derive",
++]
++
++[[package]]
++name = "failure_derive"
++version = "0.1.8"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn",
++ "synstructure",
++]
++
++[[package]]
++name = "gimli"
++version = "0.21.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bcc8e0c9bce37868955864dbecd2b1ab2bdf967e6f28066d65aaac620444b65c"
++
++[[package]]
++name = "hermit-abi"
++version = "0.1.15"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3deed196b6e7f9e44a2ae8d94225d80302d81208b1bb673fd21fe634645c85a9"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "itm"
++version = "0.4.0"
++source = "git+https://github.com/rust-embedded/itm#5dd476d03de0738062a876fd3845900ab04833a4"
++dependencies = [
++ "byteorder",
++ "either",
++ "thiserror",
++]
++
++[[package]]
++name = "itm-tools"
++version = "0.1.0"
++dependencies = [
++ "clap",
++ "exitfailure",
++ "failure",
++ "itm",
++ "rustc-demangle",
++ "xmas-elf",
++]
++
++[[package]]
++name = "libc"
++version = "0.2.71"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9457b06509d27052635f90d6466700c65095fdf75409b3fbdd903e988b886f49"
++
++[[package]]
++name = "miniz_oxide"
++version = "0.3.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "791daaae1ed6889560f8c4359194f56648355540573244a5448a83ba1ecc7435"
++dependencies = [
++ "adler32",
++]
++
++[[package]]
++name = "object"
++version = "0.20.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5"
++
++[[package]]
++name = "proc-macro2"
++version = "1.0.18"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "beae6331a816b1f65d04c45b078fd8e6c93e8071771f41b8163255bbd8d7c8fa"
++dependencies = [
++ "unicode-xid",
++]
++
++[[package]]
++name = "quote"
++version = "1.0.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
++dependencies = [
++ "proc-macro2",
++]
++
++[[package]]
++name = "rustc-demangle"
++version = "0.1.16"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4c691c0e608126e00913e33f0ccf3727d5fc84573623b8d65b2df340b5201783"
++
++[[package]]
++name = "strsim"
++version = "0.8.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
++
++[[package]]
++name = "syn"
++version = "1.0.33"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e8d5d96e8cbb005d6959f119f773bfaebb5684296108fb32600c00cde305b2cd"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "unicode-xid",
++]
++
++[[package]]
++name = "synstructure"
++version = "0.12.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b834f2d66f734cb897113e34aaff2f1ab4719ca946f9a7358dba8f8064148701"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn",
++ "unicode-xid",
++]
++
++[[package]]
++name = "textwrap"
++version = "0.11.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
++dependencies = [
++ "unicode-width",
++]
++
++[[package]]
++name = "thiserror"
++version = "1.0.20"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "7dfdd070ccd8ccb78f4ad66bf1982dc37f620ef696c6b5028fe2ed83dd3d0d08"
++dependencies = [
++ "thiserror-impl",
++]
++
++[[package]]
++name = "thiserror-impl"
++version = "1.0.20"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bd80fc12f73063ac132ac92aceea36734f04a1d93c1240c6944e23a3b8841793"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn",
++]
++
++[[package]]
++name = "unicode-width"
++version = "0.1.8"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
++
++[[package]]
++name = "unicode-xid"
++version = "0.2.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
++
++[[package]]
++name = "vec_map"
++version = "0.8.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
++
++[[package]]
++name = "winapi"
++version = "0.3.9"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
++dependencies = [
++ "winapi-i686-pc-windows-gnu",
++ "winapi-x86_64-pc-windows-gnu",
++]
++
++[[package]]
++name = "winapi-i686-pc-windows-gnu"
++version = "0.4.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
++
++[[package]]
++name = "winapi-x86_64-pc-windows-gnu"
++version = "0.4.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
++
++[[package]]
++name = "xmas-elf"
++version = "0.6.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "22678df5df766e8d1e5d609da69f0c3132d794edf6ab5e75e7abcd2270d4cf58"
++dependencies = [
++ "zero",
++]
++
++[[package]]
++name = "zero"
++version = "0.1.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5f1bc8a6b2005884962297587045002d8cfb8dcec9db332f4ca216ddc5de82c5"
diff --git a/pkgs/development/tools/misc/itm-tools/default.nix b/pkgs/development/tools/misc/itm-tools/default.nix
new file mode 100644
index 00000000000..6fb25695111
--- /dev/null
+++ b/pkgs/development/tools/misc/itm-tools/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, rustPlatform, pkg-config }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "itm-tools";
+  version = "unstable-2019-11-15";
+
+  src = fetchFromGitHub {
+    owner = "japaric";
+    repo = pname;
+    rev = "e94155e44019d893ac8e6dab51cc282d344ab700";
+    sha256 = "19xkjym0i7y52cfhvis49c59nzvgw4906cd8bkz8ka38mbgfqgiy";
+  };
+
+  cargoPatches = [ ./cargo-lock.patch ];
+
+  cargoSha256 = "0rl2ph5igwjl7rwpwcf6afnxly5av7cd6va6wn82lxm606giyq75";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Tools for analyzing ITM traces";
+    homepage = "https://github.com/japaric/itm-tools";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ hh sb0 ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index d785302ebb5..eac705294f3 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, ocaml, findlib }:
 
-if stdenv.lib.versionOlder ocaml.version "4.07"
+if stdenv.lib.versionOlder ocaml.version "4.08"
 then throw "dune is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "1sc8ax198z42vhc3l6i04kknm9g44whifjivs19qgi3sybrw2vjg";
+    sha256 = "058wiyncczbmlfxj3cnwn5n68wkmbaf4mgjm2bkp2hffpn2wl5xl";
   };
 
   buildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/rust/cargo-cache/default.nix b/pkgs/development/tools/rust/cargo-cache/default.nix
new file mode 100644
index 00000000000..0f3571045d6
--- /dev/null
+++ b/pkgs/development/tools/rust/cargo-cache/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub, rustPlatform, libiconv, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-cache";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "matthiaskrgr";
+    repo = pname;
+    rev = version;
+    sha256 = "02d593w1x8160p4m3jwm1dyvv383cy7njijlcaw49jczxv5isqbi";
+  };
+
+  cargoSha256 = "150ifd7gq6csrasqw91z4nsaj6w7kf69j0w6wydr3z7bdahmlgqw";
+
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
+
+  checkFlagsArray = [ "offline_tests" ];
+
+  meta = with stdenv.lib; {
+    description = "Manage cargo cache (\${CARGO_HOME}, ~/.cargo/), print sizes of dirs and remove dirs selectively";
+    homepage = "https://github.com/matthiaskrgr/cargo-cache";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ filalex77 ];
+  };
+}
diff --git a/pkgs/development/tools/rust/cargo-fuzz/default.nix b/pkgs/development/tools/rust/cargo-fuzz/default.nix
index ecdd2409abd..14c849ac0af 100644
--- a/pkgs/development/tools/rust/cargo-fuzz/default.nix
+++ b/pkgs/development/tools/rust/cargo-fuzz/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchurl, runCommand, rustPlatform }:
+{ stdenv, fetchFromGitHub, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-fuzz";
@@ -13,6 +13,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "0zxhak79f50m8nw95ny733mk4x2f7kyk6q9v4f7jr2rkcldhgrpr";
 
+  doCheck = false;
+
   meta = with stdenv.lib; {
     description = "Command line helpers for fuzzing";
     homepage = "https://github.com/rust-fuzz/cargo-fuzz";
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 8ddbbcc8204..723ea94152c 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -5,16 +5,16 @@ let
   inherit (darwin.apple_sdk.frameworks) Security;
 in rustPlatform.buildRustPackage rec {
   name = "maturin-${version}";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    sha256 = "1y6bxqbv7k8xvqjzgpf6n2n3yad4qxr2dwwlw8cb0knd7cfl2a2n";
+    sha256 = "08l5r7d75id6qzf8xhkjv4hkdr64cq4dbcmdjywmvf9szjbnr65z";
   };
 
-  cargoSha256 = "1f12k6n58ycv79bv416566fnsnsng8jk3f6fy5j78py1qgy30swm";
+  cargoSha256 = "1n0sxkhcdg2rbzqd7826pa7sxlnn0c2sc8l6lc98xw21vvqisc8n";
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/development/tools/trellis/default.nix b/pkgs/development/tools/trellis/default.nix
index 6fc18fabe7b..21f14adc2f7 100644
--- a/pkgs/development/tools/trellis/default.nix
+++ b/pkgs/development/tools/trellis/default.nix
@@ -8,18 +8,18 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "trellis";
-  version = "2020.06.29";
+  version = "2020.07.27";
 
   # git describe --tags
   realVersion = with stdenv.lib; with builtins;
-    "1.0-176-g${substring 0 7 (elemAt srcs 0).rev}";
+    "1.0-182-g${substring 0 7 (elemAt srcs 0).rev}";
 
   srcs = [
     (fetchFromGitHub {
        owner  = "SymbiFlow";
        repo   = "prjtrellis";
-       rev    = "f93243b000c52b755c70829768d2ae6bcf7bb91a";
-       sha256 = "0f7xv99bxmidk7byahc821yzy8mln29gknz3w239i9xbwxzc6wc4";
+       rev    = "8c0a6382e11b160ed88d17af8493c12a897617ed";
+       sha256 = "1g0ppjfw8dq5cg5kl2p1p87grb0i88apaim4f5b6wj4sfqz8iln8";
        name   = "trellis";
      })
 
diff --git a/pkgs/games/tome2/default.nix b/pkgs/games/tome2/default.nix
index a632e523aaa..fa73697ab42 100644
--- a/pkgs/games/tome2/default.nix
+++ b/pkgs/games/tome2/default.nix
@@ -9,7 +9,7 @@ let
     name = pname;
     exec = "${pname}-x11";
     icon = pname;
-    terminal = "False";
+    terminal = "false";
     comment = description;
     type = "Application";
     categories = "Game;RolePlaying;";
diff --git a/pkgs/misc/hdt/default.nix b/pkgs/misc/hdt/default.nix
new file mode 100644
index 00000000000..8a4c7c3e6f5
--- /dev/null
+++ b/pkgs/misc/hdt/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, libtool, pkgconfig, zlib, serd }:
+
+stdenv.mkDerivation rec {
+  pname = "hdt";
+  version = "1.3.3";
+
+  src = fetchFromGitHub {
+    owner = "rdfhdt";
+    repo = "hdt-cpp";
+    rev = "v${version}";
+    sha256 = "1vsq80jnix6cy78ayag7v8ajyw7h8dqyad1q6xkf2hzz3skvr34z";
+  };
+
+  buildInputs = [ zlib serd ];
+
+  nativeBuildInputs = [ autoreconfHook libtool pkgconfig ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.rdfhdt.org/";
+    description = "Header Dictionary Triples (HDT) is a compression format for RDF data that can also be queried for Triple Patterns.";
+    license = licenses.lgpl21;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.koslambrou ];
+  };
+}
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 8bfdb37360d..7bbd1768c04 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -16,11 +16,11 @@ assert enableDmeventd -> enableCmdlib;
 
 stdenv.mkDerivation rec {
   pname = "lvm2" + stdenv.lib.optionalString enableDmeventd "with-dmeventd";
-  version = "2.03.09";
+  version = "2.03.10";
 
   src = fetchurl {
     url = "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz";
-    sha256 = "0xdr9qbqw6kja267wmx6ajnfv1nhw056gpxx9v2qmfh3bj6qnfn0";
+    sha256 = "1l0fkn9abrgk5mfn6jfh9qhdr86b59l1c5pk6lp8jh0491d69las";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/bazarr/default.nix b/pkgs/servers/bazarr/default.nix
index 075b5e58447..08b05084e9e 100644
--- a/pkgs/servers/bazarr/default.nix
+++ b/pkgs/servers/bazarr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bazarr";
-  version = "0.8.4.4";
+  version = "0.9";
 
   src = fetchurl {
     url = "https://github.com/morpheus65535/bazarr/archive/v${version}.tar.gz";
-    sha256 = "09qpy5fyyidi45968qg37cighfh3rgwsi8pfz4fk5fp2v1xq23yg";
+    sha256 = "106f0gagq81rwykppyfjc7q8ibq3j89lp08hqgbmcv26hxb89rbj";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     cp -r * $out/src
 
     mkdir -p $out/bin
-    makeWrapper "${(python3.withPackages (ps: [ps.lxml])).interpreter}" \
+    makeWrapper "${(python3.withPackages (ps: [ps.lxml ps.numpy])).interpreter}" \
       $out/bin/bazarr \
       --add-flags "$out/src/bazarr.py" \
   '';
diff --git a/pkgs/servers/rippled/default.nix b/pkgs/servers/rippled/default.nix
index 426b29c4b08..c9095339cc3 100644
--- a/pkgs/servers/rippled/default.nix
+++ b/pkgs/servers/rippled/default.nix
@@ -31,8 +31,8 @@ let
 
   nudb = fetchgit rec {
     url = "https://github.com/CPPAlliance/NuDB.git";
-    rev = "2.0.1";
-    sha256 = "10hlp2k7pc0c705f8sk0qw6mjfky0k08cjhh262bbjvp9fbdc7r4";
+    rev = "2.0.3";
+    sha256 = "0imd9sh6knydwa3pxa5bbvjs3bmb8650dnsvj04qgns6bynwlqh1";
     leaveDotGit = true;
     fetchSubmodules = true;
     postFetch = "cd $out && git tag ${rev}";
@@ -49,8 +49,8 @@ let
 
   lz4 = fetchgit rec {
     url = "https://github.com/lz4/lz4.git";
-    rev = "v1.8.2";
-    sha256 = "1niv553q60hwn95yflzmrqkp1046hrid13h0yr36lm4fjza21h9w";
+    rev = "v1.9.2";
+    sha256 = "0322xy2vfhxkb8akas7vwajjgcigq1q8l9f5fnfmavcsd6kmxmgg";
     leaveDotGit = true;
     fetchSubmodules = false;
     postFetch = "cd $out && git tag ${rev}";
@@ -58,8 +58,8 @@ let
 
   libarchive = fetchgit rec {
     url = "https://github.com/libarchive/libarchive.git";
-    rev = "v3.3.3";
-    sha256 = "165imgfmizpi4ffpiwfs8gxysn6lw3y1fxj5rga98filkl7hxs31";
+    rev = "v3.4.3";
+    sha256 = "00yrzy2129vr4nfhigd91651984sl447dyfjfz26dmzvna5hwzp1";
     leaveDotGit = true;
     fetchSubmodules = false;
     postFetch = "cd $out && git tag ${rev}";
@@ -116,12 +116,12 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "rippled";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchgit {
     url = "https://github.com/ripple/rippled.git";
     rev = version;
-    sha256 = "0nh0x1ygrj3fw558vxbcp0md80qh27yrp3xhdlasrir7h1l2nplv";
+    sha256 = "176i3dm98zp5jllslpzfhh52bd2lapq9i8r7m45v8sg9icvsmyz7";
     leaveDotGit = true;
     fetchSubmodules = true;
   };
@@ -146,6 +146,9 @@ in stdenv.mkDerivation rec {
     git config --global url."file://${google-test}".insteadOf "${google-test.url}"
     git config --global url."file://${date}".insteadOf "${date.url}"
 
+    substituteInPlace Builds/CMake/deps/Sqlite.cmake --replace "http://www.sqlite.org/2018/sqlite-amalgamation-3260000.zip" "" 
+    substituteInPlace Builds/CMake/deps/Sqlite.cmake --replace "https://www2.sqlite.org/2018/sqlite-amalgamation-3260000.zip" "" 
+    substituteInPlace Builds/CMake/deps/Sqlite.cmake --replace "http://www2.sqlite.org/2018/sqlite-amalgamation-3260000.zip" "" 
     substituteInPlace Builds/CMake/deps/Sqlite.cmake --replace "URL ${sqlite3.url}" "URL ${sqlite3}"
   '';
 
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 54d327d5fc4..f6b0574fa5c 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -1,17 +1,33 @@
-{stdenv, fetchFromGitHub, python2, par2cmdline, unzip, unrar, p7zip, makeWrapper}:
+{ stdenv
+, fetchFromGitHub
+, python3
+, par2cmdline
+, unzip
+, unrar
+, p7zip
+, makeWrapper
+}:
 
 let
-  pythonEnv = python2.withPackages(ps: with ps; [ cryptography cheetah yenc sabyenc ]);
+  pythonEnv = python3.withPackages(ps: with ps; [
+    chardet
+    cheetah3
+    cherrypy
+    cryptography
+    configobj
+    feedparser
+    sabyenc3
+  ]);
   path = stdenv.lib.makeBinPath [ par2cmdline unrar unzip p7zip ];
 in stdenv.mkDerivation rec {
-  version = "2.3.9";
+  version = "3.0.1";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "06ln00rqz4xpsqhq0f495893xq1w5dfjawb8dgfyjjfds8627p16";
+    sha256 = "1zp8cxz56qmai1z6xcscnq85gxhv64dv1s5zqsqdn0zpbxyqqdlr";
   };
 
   buildInputs = [ pythonEnv makeWrapper ];
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index af95a8aa8e9..e8f9923a87b 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
     pname = "dolt";
-    version = "0.18.2";
+    version = "0.18.3";
 
     src = fetchFromGitHub {
         owner = "liquidata-inc";
         repo = "dolt";
         rev = "v${version}";
-        sha256 = "054dy5n9b8ahfwsih4chqg83c5sp8ihc68y79kz4508d42r0zvxz";
+        sha256 = "0mgawr3nkyna22sqhskvvk7h9c8ivag959liji2qcdfwgfqp0l6z";
     };
 
     modRoot = "./go";
     subPackages = [ "cmd/dolt" "cmd/git-dolt" "cmd/git-dolt-smudge" ];
-  vendorSha256 = "1dp1asi4iz9j0m8bqiap7m6ph0qf2bi9j2yn6q53539qspc5gkr2";
+  vendorSha256 = "0rqkqyvf8mjl7b62ng7vzi6as6qw3sg3lzj2mcg1aiw3h7ikr6hw";
 
   doCheck = false;
 
diff --git a/pkgs/tools/X11/wmutils-libwm/default.nix b/pkgs/tools/X11/wmutils-libwm/default.nix
new file mode 100644
index 00000000000..72022621afe
--- /dev/null
+++ b/pkgs/tools/X11/wmutils-libwm/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, libxcb }:
+
+stdenv.mkDerivation rec {
+  pname = "wmutils-libwm";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "wmutils";
+    repo = "libwm";
+    rev = "v${version}";
+    sha256 = "1lpbqrilhffpzc0b7vnp08jr1wr96lndwc7y0ck8hlbzlvm662l0";
+  };
+
+  buildInputs = [ libxcb ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "A small library for X window manipulation";
+    homepage = "https://github.com/wmutils/libwm";
+    license = licenses.isc;
+    maintainers = with maintainers; [ bhougland ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/X11/xpra/default.nix b/pkgs/tools/X11/xpra/default.nix
index 6fe433daf8b..7f46e017c36 100644
--- a/pkgs/tools/X11/xpra/default.nix
+++ b/pkgs/tools/X11/xpra/default.nix
@@ -90,9 +90,12 @@ in buildPythonApplication rec {
     "--with-vsock"
   ];
 
+  dontWrapGApps = true;
   preFixup = ''
-    gappsWrapperArgs+=(
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
       --set XPRA_INSTALL_PREFIX "$out"
+      --set XPRA_COMMAND "$out/bin/xpra"
       --prefix LD_LIBRARY_PATH : ${libfakeXinerama}/lib
       --prefix PATH : ${stdenv.lib.makeBinPath [ getopt xorgserver xauth which utillinux pulseaudio ]}
     )
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
index e5bc573661c..4517077ac46 100644
--- a/pkgs/tools/admin/lego/default.nix
+++ b/pkgs/tools/admin/lego/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "lego";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = pname;
     rev = "v${version}";
-    sha256 = "03824c5nfii7cc6mr1hdkyd4jjy8vpn08lnj4c6pc61s3i6gacc6";
+    sha256 = "02p7zlrz8fp5bsvhk4jrx5x3gxnl00friay1jihlzyk3s400n9jb";
   };
 
-  vendorSha256 = "14453iiya6algkympyvwm03qgjcwk79z8bbrij7qhnp52qfrbmrp";
+  vendorSha256 = "0jh7qi422i2114198fain9nwwf8yd8vna0p3g0hvginh59svyagc";
 
   doCheck = false;
 
diff --git a/pkgs/tools/filesystems/fuse-overlayfs/default.nix b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
index ba5f4a3dd7e..11a3615a84c 100644
--- a/pkgs/tools/filesystems/fuse-overlayfs/default.nix
+++ b/pkgs/tools/filesystems/fuse-overlayfs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ fuse3 ];
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with stdenv.lib; {
     description = "FUSE implementation for overlayfs";
diff --git a/pkgs/tools/graphics/swfdec/default.nix b/pkgs/tools/graphics/swfdec/default.nix
deleted file mode 100644
index d721d06ad58..00000000000
--- a/pkgs/tools/graphics/swfdec/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{stdenv, fetchurl
-, cairo, pango, glib, liboil, zlib, gstreamer, gst-plugins-base
-, gst-plugins-good , gtk2, libsoup, alsaLib, pkgconfig
-}:
-
-stdenv.mkDerivation rec {
-  pname = "swfdec";
-  version = "0.8.4";
-
-  src = fetchurl {
-    url = "http://swfdec.freedesktop.org/download/swfdec/0.8/swfdec-${version}.tar.gz";
-    sha256 = "00nqrd0fzf0g76rn80d7h56n6hxv7x1x6k89zj45bj564lzwc3vs";
-  };
-
-  buildInputs = [
-    cairo glib liboil pango zlib gstreamer gst-plugins-base gst-plugins-good
-    gtk2 libsoup alsaLib pkgconfig
-  ];
-  
-  postInstall = ''
-    mkdir "$out/bin"
-    cp tools/.libs/swfdec-extract "$out/bin"
-    cp tools/.libs/dump "$out/bin/swfdec-dump"
-    cp player/.libs/swfplay "$out/bin/swfplay"
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    inherit version;
-    description = "Decoder/renderer for Macromedia Flash animations";
-    license = stdenv.lib.licenses.lgpl21 ;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
-    homepage = "https://swfdec.freedesktop.org/wiki/";
-  };
-}
diff --git a/pkgs/tools/misc/mutagen/default.nix b/pkgs/tools/misc/mutagen/default.nix
index c5096ea3579..ca75bf34dd1 100644
--- a/pkgs/tools/misc/mutagen/default.nix
+++ b/pkgs/tools/misc/mutagen/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "mutagen";
-  version = "0.11.6";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0gn0ra2fbnggp82h910hz34b2l5fk7f0p9dk7zl50wxrkydfzrk3";
+    sha256 = "11wp94khj9bzmadij0nq6i6q0x9z6h0zy4a6fhf322y5nxsmvcgy";
   };
 
   vendorSha256 = "0szs9yc49fyh55ra1wf8zj76kdah0x49d45cgivk3gqh2hl17j6l";
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index 935cadbd7b8..9cf5f91cd6d 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -115,6 +115,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.gnu.org/software/mailutils/";
 
     # Some of the dependencies fail to build on {cyg,dar}win.
-    platforms = platforms.gnu ++ platforms.linux;
+    platforms = platforms.gnu ++ platforms.unix;
   };
 }
diff --git a/pkgs/tools/networking/slirp4netns/default.nix b/pkgs/tools/networking/slirp4netns/default.nix
index 93367ea2679..60cb3413253 100644
--- a/pkgs/tools/networking/slirp4netns/default.nix
+++ b/pkgs/tools/networking/slirp4netns/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  passthru.tests.podman = nixosTests.podman;
+  passthru.tests = { inherit (nixosTests) podman; };
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/rootless-containers/slirp4netns";
diff --git a/pkgs/tools/security/1password-gui/default.nix b/pkgs/tools/security/1password-gui/default.nix
index 3fc19c12e8e..3373ab70b14 100644
--- a/pkgs/tools/security/1password-gui/default.nix
+++ b/pkgs/tools/security/1password-gui/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "0.8.0";
+  version = "0.8.2-1";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    sha256 = "1r26vyx724h3k6p340bg3lmcxwyvgxj2kqvwczq784583hpq3lq9";
+    sha256 = "0gxq8xrr20jgp7k0sq5a9k63mz94zb00yvc9jw1zhl2q70ji24sa";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/creddump/default.nix b/pkgs/tools/security/creddump/default.nix
new file mode 100644
index 00000000000..d37c58a5159
--- /dev/null
+++ b/pkgs/tools/security/creddump/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitLab, python2, python2Packages }:
+
+python2Packages.buildPythonApplication rec {
+  pname = "creddump";
+  version = "0.3";
+
+  src = fetchFromGitLab {
+    owner = "kalilinux";
+    repo = "packages/creddump";
+    # url-encoding workaround: https://github.com/NixOS/nixpkgs/issues/65796#issuecomment-517829019
+    rev = "debian%2F${version}-1kali2"; # %2F = urlquote("/")
+    sha256 = "0r3rs2hggsvv619l3fh3c0jli6d3ryyj30ni3hz0nz670z5smzcf";
+  };
+
+  # No setup.py is available
+  dontBuild = true;
+  doCheck = false;
+  propagatedBuildInputs = [ python2Packages.pycrypto ];
+
+  installPhase = ''
+    mkdir -p ${placeholder "out"}/bin
+    cp -r framework ${placeholder "out"}/bin/framework
+    cp pwdump.py ${placeholder "out"}/bin/pwdump
+    cp cachedump.py ${placeholder "out"}/bin/cachedump
+    cp lsadump.py ${placeholder "out"}/bin/lsadump
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Python tool to extract various credentials and secrets from Windows registry hives";
+    homepage = "https://gitlab.com/kalilinux/packages/creddump";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.fishi0x01 ];
+  };
+}
+
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index d6e8a521a2f..c177726bbb1 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
-  version = "1628";
+  version = "1637";
 
   src = fetchurl {
     url = "mirror://sourceforge/ibmswtpm2/ibmtpm${version}.tar.gz";
-    sha256 = "18wywbsdp5sjrapznk2ydbmx0whz513dhybn1lls24xfl7kp9s58";
+    sha256 = "09z3wbv38dc8wnw1q961s6bcd0kvz2xkjp6dxg4kn914fwzlqfnx";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/text/miller/default.nix b/pkgs/tools/text/miller/default.nix
index ead501763e7..4137fd4d278 100644
--- a/pkgs/tools/text/miller/default.nix
+++ b/pkgs/tools/text/miller/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "miller";
 
-  version = "5.8.0";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${version}";
-    sha256 = "06y1l730xps196jbnxahmd5alc9ba5m8hakm9sc8hx1q5b9ylfih";
+    sha256 = "14fi6jlqb980qjcpb90fk85cglskq9b9i2k0216bhpvjmagywgp7";
   };
 
   nativeBuildInputs = [ autoreconfHook flex libtool ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ddf328e0201..54c8948f4a5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -560,6 +560,7 @@ mapAliases ({
   suil-qt5 = suil; # added 2018-05-01
   surf-webkit2 = surf; # added 2017-04-02
   sup = throw "deprecated in 2019-09-10: abandoned by upstream";
+  swfdec = throw "swfdec has been removed as broken and unmaintained."; # added 2020-08-23
   system_config_printer = system-config-printer;  # added 2016-01-03
   systemd-cryptsetup-generator = throw "systemd-cryptsetup-generator is now included in the systemd package"; # added 2020-07-12
   systemd_with_lvm2 = throw "obsolete, enabled by default via the lvm module"; # added 2020-07-12
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 92c74067fa0..7f2704a0fc6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -196,6 +196,8 @@ in
 
   hobbes = callPackage ../development/tools/hobbes { };
 
+  html5validator = python36Packages.callPackage ../applications/misc/html5validator { };
+
   proto-contrib = callPackage ../development/tools/proto-contrib {};
 
   protoc-gen-doc = callPackage ../development/tools/protoc-gen-doc {};
@@ -210,6 +212,8 @@ in
 
   onesixtyone = callPackage ../tools/security/onesixtyone {};
 
+  creddump = callPackage ../tools/security/creddump {};
+
   device-tree_rpi = callPackage ../os-specific/linux/device-tree/raspberrypi.nix {};
 
   diffPlugins = (callPackage ../build-support/plugins.nix {}).diffPlugins;
@@ -1486,8 +1490,12 @@ in
     '';
   });
 
-  caddy = callPackage ../servers/caddy { };
-  caddy2 = callPackage ../servers/caddy/v2.nix { };
+  caddy = callPackage ../servers/caddy {
+    buildGoModule = buildGo114Module;
+  };
+  caddy2 = callPackage ../servers/caddy/v2.nix {
+    buildGoModule = buildGo114Module;
+  };
   traefik = callPackage ../servers/traefik { };
 
   calamares = libsForQt5.callPackage ../tools/misc/calamares {
@@ -1710,6 +1718,8 @@ in
 
   dconf = callPackage ../development/libraries/dconf { };
 
+  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
+
   ddar = callPackage ../tools/backup/ddar { };
 
   ddate = callPackage ../tools/misc/ddate { };
@@ -2008,6 +2018,11 @@ in
     variant = "krita";
   };
 
+  gmt = callPackage ../applications/gis/gmt {
+    inherit (darwin.apple_sdk.frameworks)
+      Accelerate CoreGraphics CoreVideo;
+  };
+
   goa = callPackage ../development/tools/goa { };
 
   gohai = callPackage ../tools/system/gohai { };
@@ -4549,6 +4564,8 @@ in
 
   isync = callPackage ../tools/networking/isync { };
 
+  itm-tools = callPackage ../development/tools/misc/itm-tools { };  
+
   ix = callPackage ../tools/misc/ix { };
 
   jaaa = callPackage ../applications/audio/jaaa { };
@@ -7066,8 +7083,6 @@ in
 
   supertux-editor = callPackage ../applications/editors/supertux-editor { };
 
-  super-user-spark = haskellPackages.callPackage ../applications/misc/super_user_spark { };
-
   svgbob = callPackage ../tools/graphics/svgbob { };
 
   svgcleaner = callPackage ../tools/graphics/svgcleaner { };
@@ -7135,8 +7150,6 @@ in
 
   swec = callPackage ../tools/networking/swec { };
 
-  swfdec = callPackage ../tools/graphics/swfdec {};
-
   svnfs = callPackage ../tools/filesystems/svnfs { };
 
   svtplay-dl = callPackage ../tools/misc/svtplay-dl { };
@@ -8430,7 +8443,9 @@ in
 
   cmucl_binary = pkgsi686Linux.callPackage ../development/compilers/cmucl/binary.nix { };
 
-  compcert = callPackage ../development/compilers/compcert { };
+  compcert = callPackage ../development/compilers/compcert {
+    inherit (coqPackages_8_10) coq;
+  };
 
   computecpp-unwrapped = callPackage ../development/compilers/computecpp {};
   computecpp = wrapCCWith rec {
@@ -9501,6 +9516,9 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
   cargo-bloat = callPackage ../development/tools/rust/cargo-bloat { };
+  cargo-cache = callPackage ../development/tools/rust/cargo-cache {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
   cargo-crev = callPackage ../development/tools/rust/cargo-crev {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -12705,6 +12723,8 @@ in
 
   haxor-news = callPackage ../applications/misc/haxor-news { };
 
+  hdt = callPackage ../misc/hdt {};
+
   herqq = libsForQt5.callPackage ../development/libraries/herqq { };
 
   heyefi = haskellPackages.heyefi;
@@ -22991,7 +23011,9 @@ in
   # this can be changed to python3 once pyside2 is updated to support the latest python version
   syncplay = python37.pkgs.callPackage ../applications/networking/syncplay { };
 
-  inherit (callPackages ../applications/networking/syncthing { })
+  inherit (callPackages ../applications/networking/syncthing {
+    buildGoModule = buildGo114Module;
+  })
     syncthing
     syncthing-cli
     syncthing-discovery
@@ -24034,6 +24056,8 @@ in
 
   youtube-viewer = perlPackages.WWWYoutubeViewer;
 
+  ytalk = callPackage ../applications/networking/instant-messengers/ytalk { };
+
   ytcc = callPackage ../tools/networking/ytcc { };
 
   zam-plugins = callPackage ../applications/audio/zam-plugins { };
@@ -24541,6 +24565,8 @@ in
 
   gshogi = python3Packages.callPackage ../games/gshogi {};
 
+  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+
   qtads = qt5.callPackage ../games/qtads { };
 
   gtetrinet = callPackage ../games/gtetrinet {
@@ -25831,11 +25857,11 @@ in
   ifstat-legacy = callPackage ../tools/networking/ifstat-legacy { };
 
   isabelle = callPackage ../applications/science/logic/isabelle {
-    polyml = stdenv.lib.overrideDerivation polyml57 (attrs: {
+    polyml = stdenv.lib.overrideDerivation polyml (attrs: {
       configureFlags = [ "--enable-intinf-as-int" "--with-gmp" "--disable-shared" ];
     });
 
-    java = if stdenv.isLinux then jre else jdk;
+    java = openjdk11;
   };
 
   iprover = callPackage ../applications/science/logic/iprover { };
@@ -27234,6 +27260,8 @@ in
 
   wmutils-core = callPackage ../tools/X11/wmutils-core { };
 
+  wmutils-libwm = callPackage ../tools/X11/wmutils-libwm { };
+
   wmutils-opt = callPackage ../tools/X11/wmutils-opt { };
 
   wordpress = callPackage ../servers/web-apps/wordpress { };
@@ -27423,6 +27451,8 @@ in
   sequeler = callPackage ../applications/misc/sequeler { };
 
   sequelpro = callPackage ../applications/misc/sequelpro {};
+  
+  snowsql = callPackage ../applications/misc/snowsql {};
 
   sidequest = callPackage ../applications/misc/sidequest {};
 
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 38f23ed8cd4..c6c75cd7ffd 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -130,7 +130,7 @@ in rec {
   coqPackages_8_11 = mkCoqPackages coq_8_11;
   coqPackages_8_12 = mkCoqPackages coq_8_12;
   coqPackages = recurseIntoAttrs (lib.mapDerivationAttrset lib.dontDistribute
-    coqPackages_8_9
+    coqPackages_8_11
   );
   coq = coqPackages.coq;
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index f47fd2fbcfa..dfc2fd2fb98 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -151,6 +151,8 @@ let
 
     containers = callPackage ../development/ocaml-modules/containers { };
 
+    containers-data = callPackage ../development/ocaml-modules/containers/data.nix { };
+
     cow = callPackage ../development/ocaml-modules/cow { };
 
     cpdf = callPackage ../development/ocaml-modules/cpdf { };
@@ -218,16 +220,20 @@ let
     dune = callPackage ../development/tools/ocaml/dune { };
 
     dune_2 =
-      if lib.versionAtLeast ocaml.version "4.07"
+      if lib.versionAtLeast ocaml.version "4.08"
       then callPackage ../development/tools/ocaml/dune/2.nix { }
       else if lib.versionAtLeast ocaml.version "4.02"
       then pkgs.dune_2
       else throw "dune_2 is not available for OCaml ${ocaml.version}";
 
+    dune-action-plugin = callPackage ../development/ocaml-modules/dune-action-plugin { };
+
     dune-build-info = callPackage ../development/ocaml-modules/dune-build-info { };
 
     dune-configurator = callPackage ../development/ocaml-modules/dune-configurator { };
 
+    dune-glob = callPackage ../development/ocaml-modules/dune-glob { };
+
     dune-private-libs = callPackage ../development/ocaml-modules/dune-private-libs { };
 
     dune-release = callPackage ../development/tools/ocaml/dune-release {
@@ -312,6 +318,8 @@ let
 
     herelib = callPackage ../development/ocaml-modules/herelib { };
 
+    hidapi = callPackage ../development/ocaml-modules/hidapi { };
+
     higlo = callPackage ../development/ocaml-modules/higlo { };
 
     hkdf = callPackage ../development/ocaml-modules/hkdf { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dd5b52edc90..8ca643bf6ef 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1560,6 +1560,8 @@ in {
 
   sabyenc = callPackage ../development/python-modules/sabyenc { };
 
+  sabyenc3 = callPackage ../development/python-modules/sabyenc3 { };
+
   salmon-mail = callPackage ../development/python-modules/salmon-mail { };
 
   sanic-auth = callPackage ../development/python-modules/sanic-auth { };
@@ -6735,6 +6737,8 @@ in {
 
   terminaltables = callPackage ../development/python-modules/terminaltables { };
 
+  test-tube = callPackage ../development/python-modules/test-tube { };
+
   testpath = callPackage ../development/python-modules/testpath { };
 
   testrepository = callPackage ../development/python-modules/testrepository { };
@@ -7822,6 +7826,8 @@ in {
 
   rxv     = callPackage ../development/python-modules/rxv     { };
 
+  userpath = callPackage ../development/python-modules/userpath { };
+
 });
 
 in fix' (extends overrides packages)