Merge remote-tracking branch 'upstream/staging-next' into staging

151 files changed, 1813 insertions, 876 deletions

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 6eda7473bf6b..d1086658a077 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -47,6 +47,9 @@
 /nixos/doc/manual/man-nixos-option.xml                @nbp
 /nixos/modules/installer/tools/nixos-option.sh        @nbp
 
+# NixOS integration test driver
+/nixos/lib/test-driver  @tfc
+
 # New NixOS modules
 /nixos/modules/module-list.nix @Infinisil
 
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 0d51be4b23bc..026117cc34fd 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -37,6 +37,7 @@ rec {
         else if final.isAndroid             then "bionic"
         else if final.isLinux /* default */ then "glibc"
         else if final.isMsp430              then "newlib"
+        else if final.isVc4                 then "newlib"
         else if final.isAvr                 then "avrlibc"
         else if final.isNetBSD              then "nblibc"
         # TODO(@Ericson2314) think more about other operating systems
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index 58cff18e6488..700c895b3aba 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -26,7 +26,7 @@ let
 
     "riscv32-linux" "riscv64-linux"
 
-    "aarch64-none" "avr-none" "arm-none" "i686-none" "x86_64-none" "powerpc-none" "msp430-none" "riscv64-none" "riscv32-none"
+    "aarch64-none" "avr-none" "arm-none" "i686-none" "x86_64-none" "powerpc-none" "msp430-none" "riscv64-none" "riscv32-none" "vc4-none"
   ];
 
   allParsed = map parse.mkSystemFromString all;
@@ -45,6 +45,7 @@ in {
   x86_64  = filterDoubles predicates.isx86_64;
   mips    = filterDoubles predicates.isMips;
   riscv   = filterDoubles predicates.isRiscV;
+  vc4     = filterDoubles predicates.isVc4;
 
   cygwin  = filterDoubles predicates.isCygwin;
   darwin  = filterDoubles predicates.isDarwin;
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 585156c24759..cb8bc3de6c48 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -118,6 +118,12 @@ rec {
     config = "avr";
   };
 
+  vc4 = {
+    config = "vc4-elf";
+    libc = "newlib";
+    platform = {};
+  };
+
   arm-embedded = {
     config = "arm-none-eabi";
     libc = "newlib";
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 8a983b3d3637..d1980c6dff81 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -21,6 +21,7 @@ rec {
     isSparc        = { cpu = { family = "sparc"; }; };
     isWasm         = { cpu = { family = "wasm"; }; };
     isMsp430       = { cpu = { family = "msp430"; }; };
+    isVc4          = { cpu = { family = "vc4"; }; };
     isAvr          = { cpu = { family = "avr"; }; };
     isAlpha        = { cpu = { family = "alpha"; }; };
     isJavaScript   = { cpu = cpuTypes.js; };
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 362357446025..6a02dbb51528 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -112,6 +112,8 @@ rec {
     msp430   = { bits = 16; significantByte = littleEndian; family = "msp430"; };
     avr      = { bits = 8; family = "avr"; };
 
+    vc4      = { bits = 32; significantByte = littleEndian; family = "vc4"; };
+
     js       = { bits = 32; significantByte = littleEndian; family = "js"; };
   };
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8a4a966d4cee..eefc9560f169 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3601,6 +3601,12 @@
     github = "klntsky";
     githubId = 18447310;
   };
+  kmcopper = {
+    email = "kmcopper@danwin1210.me";
+    name = "Kyle Copperfield";
+    github = "kmcopper";
+    githubId = 57132115;
+  };
   kmeakin = {
     email = "karlwfmeakin@gmail.com";
     name = "Karl Meakin";
diff --git a/maintainers/scripts/update.nix b/maintainers/scripts/update.nix
index 7192f6e3b234..60c6113bf70f 100755
--- a/maintainers/scripts/update.nix
+++ b/maintainers/scripts/update.nix
@@ -126,7 +126,7 @@ let
 
   packageData = package: {
     name = package.name;
-    pname = lib.getName package;
+    pname = pkgs.lib.getName package;
     updateScript = map builtins.toString (pkgs.lib.toList package.updateScript);
   };
 
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index e8e89c5bbc28..4980a99e6468 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -181,6 +181,11 @@
      The BeeGFS module has been removed.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The osquery module has been removed.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 35c8b543dece..eee8f612410d 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -86,7 +86,7 @@ let
   optionsList = lib.sort optionLess optionsListDesc;
 
   # Convert the list of options into an XML file.
-  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsList);
+  optionsXML = pkgs.writeText "options.xml" (builtins.toXML optionsList);
 
   optionsNix = builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList);
 
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
index 0b8e3b67c9b2..e45521424de3 100644
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -3,7 +3,6 @@ from contextlib import contextmanager, _GeneratorContextManager
 from xml.sax.saxutils import XMLGenerator
 import _thread
 import atexit
-import json
 import os
 import ptpython.repl
 import pty
@@ -16,7 +15,7 @@ import sys
 import tempfile
 import time
 import unicodedata
-from typing import Tuple, TextIO, Any, Callable, Dict, Iterator, Optional, List
+from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List
 
 CHAR_TO_KEY = {
     "A": "shift-a",
@@ -771,7 +770,9 @@ def run_tests() -> None:
             machine.execute("sync")
 
     if nr_tests != 0:
-        log.log("{} out of {} tests succeeded".format(nr_succeeded, nr_tests))
+        eprint("{} out of {} tests succeeded".format(nr_succeeded, nr_tests))
+        if nr_tests > nr_succeeded:
+            sys.exit(1)
 
 
 @contextmanager
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 6d1ef0d234ab..9e0d9478b5de 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -518,7 +518,6 @@
   ./services/monitoring/munin.nix
   ./services/monitoring/nagios.nix
   ./services/monitoring/netdata.nix
-  ./services/monitoring/osquery.nix
   ./services/monitoring/prometheus/default.nix
   ./services/monitoring/prometheus/alertmanager.nix
   ./services/monitoring/prometheus/exporters.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index c810bcf3bca1..d4bce3b49d36 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -10,6 +10,7 @@ with lib;
     (mkRenamedOptionModule [ "networking" "enableRalinkFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
     (mkRenamedOptionModule [ "networking" "enableRTL8192cFirmware" ] [ "hardware" "enableRedistributableFirmware" ])
     (mkRenamedOptionModule [ "networking" "networkmanager" "useDnsmasq" ] [ "networking" "networkmanager" "dns" ])
+    (mkRenamedOptionModule [ "networking" "connman" ] [ "services" "connman" ])
     (mkChangedOptionModule [ "services" "printing" "gutenprint" ] [ "services" "printing" "drivers" ]
       (config:
         let enabled = getAttrFromPath [ "services" "printing" "gutenprint" ] config;
@@ -284,6 +285,9 @@ with lib;
     (mkRemovedOptionModule [ "services.beegfsEnable" ] "The BeeGFS module has been removed")
     (mkRemovedOptionModule [ "services.beegfs" ] "The BeeGFS module has been removed")
 
+    # osquery
+    (mkRemovedOptionModule [ "services.osquery" ] "The osquery module has been removed")
+
     # Redis
     (mkRemovedOptionModule [ "services" "redis" "user" ] "The redis module now is hardcoded to the redis user.")
     (mkRemovedOptionModule [ "services" "redis" "dbpath" ] "The redis module now uses /var/lib/redis as data directory.")
diff --git a/nixos/modules/services/monitoring/osquery.nix b/nixos/modules/services/monitoring/osquery.nix
deleted file mode 100644
index c8c625577d39..000000000000
--- a/nixos/modules/services/monitoring/osquery.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with builtins;
-with lib;
-
-let
-  cfg = config.services.osquery;
-
-in
-
-{
-
-  options = {
-
-    services.osquery = {
-
-      enable = mkEnableOption "osquery";
-
-      loggerPath = mkOption {
-        type = types.path;
-        description = "Base directory used for logging.";
-        default = "/var/log/osquery";
-      };
-
-      pidfile = mkOption {
-        type = types.path;
-        description = "Path used for pid file.";
-        default = "/var/osquery/osqueryd.pidfile";
-      };
-
-      utc = mkOption {
-        type = types.bool;
-        description = "Attempt to convert all UNIX calendar times to UTC.";
-        default = true;
-      };
-
-      databasePath = mkOption {
-        type = types.path;
-        description = "Path used for database file.";
-        default = "/var/osquery/osquery.db";
-      };
-
-      extraConfig = mkOption {
-        type = types.attrs // {
-          merge = loc: foldl' (res: def: recursiveUpdate res def.value) {};
-        };
-        description = "Extra config to be recursively merged into the JSON config file.";
-        default = { };
-      };
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-
-    environment.systemPackages = [ pkgs.osquery ];
-
-    environment.etc."osquery/osquery.conf".text = toJSON (
-      recursiveUpdate {
-        options = {
-          config_plugin = "filesystem";
-          logger_plugin = "filesystem";
-          logger_path = cfg.loggerPath;
-          database_path = cfg.databasePath;
-          utc = cfg.utc;
-        };
-      } cfg.extraConfig
-    );
-
-    systemd.services.osqueryd = {
-      description = "The osquery Daemon";
-      after = [ "network.target" "syslog.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.osquery ];
-      preStart = ''
-        mkdir -p ${escapeShellArg cfg.loggerPath}
-        mkdir -p "$(dirname ${escapeShellArg cfg.pidfile})"
-        mkdir -p "$(dirname ${escapeShellArg cfg.databasePath})"
-      '';
-      serviceConfig = {
-        TimeoutStartSec = "infinity";
-        ExecStart = "${pkgs.osquery}/bin/osqueryd --logger_path ${escapeShellArg cfg.loggerPath} --pidfile ${escapeShellArg cfg.pidfile} --database_path ${escapeShellArg cfg.databasePath}";
-        KillMode = "process";
-        KillSignal = "SIGTERM";
-        Restart = "on-failure";
-      };
-    };
-
-  };
-
-}
diff --git a/nixos/modules/services/networking/connman.nix b/nixos/modules/services/networking/connman.nix
index 31127f790499..cac517f410e5 100644
--- a/nixos/modules/services/networking/connman.nix
+++ b/nixos/modules/services/networking/connman.nix
@@ -4,7 +4,7 @@ with pkgs;
 with lib;
 
 let
-  cfg = config.networking.connman;
+  cfg = config.services.connman;
   configFile = pkgs.writeText "connman.conf" ''
     [General]
     NetworkInterfaceBlacklist=${concatStringsSep "," cfg.networkInterfaceBlacklist}
@@ -17,7 +17,7 @@ in {
 
   options = {
 
-    networking.connman = {
+    services.connman = {
 
       enable = mkOption {
         type = types.bool;
@@ -71,13 +71,13 @@ in {
 
     assertions = [{
       assertion = !config.networking.useDHCP;
-      message = "You can not use services.networking.connman with services.networking.useDHCP";
+      message = "You can not use services.connman with networking.useDHCP";
     }{
       assertion = config.networking.wireless.enable;
-      message = "You must use services.networking.connman with services.networking.wireless";
+      message = "You must use services.connman with networking.wireless";
     }{
       assertion = !config.networking.networkmanager.enable;
-      message = "You can not use services.networking.connman with services.networking.networkmanager";
+      message = "You can not use services.connman with networking.networkmanager";
     }];
 
     environment.systemPackages = [ connman ];
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index f80d5afc55fc..226769f10597 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -924,6 +924,8 @@ in
 
   config = mkIf config.systemd.network.enable {
 
+    users.users.systemd-network.group = "systemd-network";
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-networkd.service" "systemd-networkd-wait-online.service"
     ];
diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index 3ea96f8e4645..da61c64faf8b 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -136,6 +136,8 @@ in
       }
     ];
 
+    users.users.resolved.group = "systemd-resolve";
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-resolved.service"
     ];
diff --git a/nixos/modules/system/boot/timesyncd.nix b/nixos/modules/system/boot/timesyncd.nix
index 0b1d0ff6c22b..9e2f36ca01f8 100644
--- a/nixos/modules/system/boot/timesyncd.nix
+++ b/nixos/modules/system/boot/timesyncd.nix
@@ -50,7 +50,10 @@ with lib;
       ${config.services.timesyncd.extraConfig}
     '';
 
-    users.users.systemd-timesync.uid = config.ids.uids.systemd-timesync;
+    users.users.systemd-timesync = {
+      uid = config.ids.uids.systemd-timesync;
+      group = "systemd-timesync";
+    };
     users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync;
 
     system.activationScripts.systemd-timesyncd-migration = mkIf (versionOlder config.system.stateVersion "19.09") ''
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index 691ee2c136ec..09678ce9ea71 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -149,7 +149,7 @@ let
         --setenv PATH="$PATH" \
         ${optionalString cfg.ephemeral "--ephemeral"} \
         ${if cfg.additionalCapabilities != null && cfg.additionalCapabilities != [] then
-          ''--capability="${concatStringsSep " " cfg.additionalCapabilities}"'' else ""
+          ''--capability="${concatStringsSep "," cfg.additionalCapabilities}"'' else ""
         } \
         ${if cfg.tmpfs != null && cfg.tmpfs != [] then
           ''--tmpfs=${concatStringsSep " --tmpfs=" cfg.tmpfs}'' else ""
diff --git a/nixos/modules/virtualisation/openvswitch.nix b/nixos/modules/virtualisation/openvswitch.nix
index edec37402308..6b8ad83661fe 100644
--- a/nixos/modules/virtualisation/openvswitch.nix
+++ b/nixos/modules/virtualisation/openvswitch.nix
@@ -42,6 +42,9 @@ in {
       default = false;
       description = ''
         Whether to start racoon service for openvswitch.
+        Supported only if openvswitch version is less than 2.6.0.
+        Use <literal>virtualisation.vswitch.package = pkgs.openvswitch-lts</literal>
+        for a version that supports ipsec over GRE.
       '';
     };
   };
@@ -89,6 +92,13 @@ in {
             "${cfg.package}/share/openvswitch/vswitch.ovsschema"
         fi
         chmod -R +w /var/db/openvswitch
+        if ${cfg.package}/bin/ovsdb-tool needs-conversion /var/db/openvswitch/conf.db | grep -q "yes"
+        then
+          echo "Performing database upgrade"
+          ${cfg.package}/bin/ovsdb-tool convert /var/db/openvswitch/conf.db
+        else
+          echo "Database already up to date"
+        fi
         '';
       serviceConfig = {
         ExecStart =
@@ -133,7 +143,7 @@ in {
     };
 
   }
-  (mkIf cfg.ipsec {
+  (mkIf (cfg.ipsec && (versionOlder cfg.package.version "2.6.0")) {
     services.racoon.enable = true;
     services.racoon.configPath = "${runDir}/ipsec/etc/racoon/racoon.conf";
 
@@ -172,5 +182,4 @@ in {
       '';
     };
   })]));
-
 }
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index e313d2b411bb..31d332e9f07a 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -620,7 +620,7 @@ in
 
     # Wireless won't work in the VM.
     networking.wireless.enable = mkVMOverride false;
-    networking.connman.enable = mkVMOverride false;
+    services.connman.enable = mkVMOverride false;
 
     # Speed up booting by not waiting for ARP.
     networking.dhcpcd.extraConfig = "noarp";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 3d5bc408c445..7945a239f6a0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -206,7 +206,6 @@ in
   openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {};
   orangefs = handleTest ./orangefs.nix {};
   os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
-  osquery = handleTest ./osquery.nix {};
   osrm-backend = handleTest ./osrm-backend.nix {};
   overlayfs = handleTest ./overlayfs.nix {};
   packagekit = handleTest ./packagekit.nix {};
diff --git a/nixos/tests/gitolite.nix b/nixos/tests/gitolite.nix
index 690e456ed7c8..a928645bd80f 100644
--- a/nixos/tests/gitolite.nix
+++ b/nixos/tests/gitolite.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...}:
+import ./make-test-python.nix ({ pkgs, ...}:
 
 let
   adminPrivateKey = pkgs.writeText "id_ed25519" ''
@@ -43,7 +43,7 @@ let
     ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZNonUP1ePHLrvn0W9D2hdN6zWWZYFyJc+QR6pOKQEw bob@client
   '';
 
-  gitoliteAdminConfSnippet = ''
+  gitoliteAdminConfSnippet = pkgs.writeText "gitolite-admin-conf-snippet" ''
     repo alice-project
         RW+     =   alice
   '';
@@ -85,55 +85,54 @@ in
   };
 
   testScript = ''
-    startAll;
-
-    subtest "can setup ssh keys on system", sub {
-      $client->mustSucceed("mkdir -p ~root/.ssh");
-      $client->mustSucceed("cp ${adminPrivateKey} ~root/.ssh/id_ed25519");
-      $client->mustSucceed("chmod 600 ~root/.ssh/id_ed25519");
-
-      $client->mustSucceed("sudo -u alice mkdir -p ~alice/.ssh");
-      $client->mustSucceed("sudo -u alice cp ${alicePrivateKey} ~alice/.ssh/id_ed25519");
-      $client->mustSucceed("sudo -u alice chmod 600 ~alice/.ssh/id_ed25519");
-
-      $client->mustSucceed("sudo -u bob mkdir -p ~bob/.ssh");
-      $client->mustSucceed("sudo -u bob cp ${bobPrivateKey} ~bob/.ssh/id_ed25519");
-      $client->mustSucceed("sudo -u bob chmod 600 ~bob/.ssh/id_ed25519");
-    };
-
-    subtest "gitolite server starts", sub {
-      $server->waitForUnit("gitolite-init.service");
-      $server->waitForUnit("sshd.service");
-      $client->mustSucceed('ssh gitolite@server info');
-    };
-
-    subtest "admin can clone and configure gitolite-admin.git", sub {
-      $client->mustSucceed('git clone gitolite@server:gitolite-admin.git');
-      $client->mustSucceed("git config --global user.name 'System Administrator'");
-      $client->mustSucceed("git config --global user.email root\@domain.example");
-      $client->mustSucceed("cp ${alicePublicKey} gitolite-admin/keydir/alice.pub");
-      $client->mustSucceed("cp ${bobPublicKey} gitolite-admin/keydir/bob.pub");
-      $client->mustSucceed('(cd gitolite-admin && git add . && git commit -m "Add keys for alice, bob" && git push)');
-      $client->mustSucceed("printf '${gitoliteAdminConfSnippet}' >> gitolite-admin/conf/gitolite.conf");
-      $client->mustSucceed('(cd gitolite-admin && git add . && git commit -m "Add repo for alice" && git push)');
-    };
-
-    subtest "non-admins cannot clone gitolite-admin.git", sub {
-      $client->mustFail('sudo -i -u alice git clone gitolite@server:gitolite-admin.git');
-      $client->mustFail('sudo -i -u bob git clone gitolite@server:gitolite-admin.git');
-    };
-
-    subtest "non-admins can clone testing.git", sub {
-      $client->mustSucceed('sudo -i -u alice git clone gitolite@server:testing.git');
-      $client->mustSucceed('sudo -i -u bob git clone gitolite@server:testing.git');
-    };
-
-    subtest "alice can clone alice-project.git", sub {
-      $client->mustSucceed('sudo -i -u alice git clone gitolite@server:alice-project.git');
-    };
-
-    subtest "bob cannot clone alice-project.git", sub {
-      $client->mustFail('sudo -i -u bob git clone gitolite@server:alice-project.git');
-    };
+    start_all()
+
+    with subtest("can setup ssh keys on system"):
+        client.succeed(
+            "mkdir -p ~root/.ssh",
+            "cp ${adminPrivateKey} ~root/.ssh/id_ed25519",
+            "chmod 600 ~root/.ssh/id_ed25519",
+        )
+        client.succeed(
+            "sudo -u alice mkdir -p ~alice/.ssh",
+            "sudo -u alice cp ${alicePrivateKey} ~alice/.ssh/id_ed25519",
+            "sudo -u alice chmod 600 ~alice/.ssh/id_ed25519",
+        )
+        client.succeed(
+            "sudo -u bob mkdir -p ~bob/.ssh",
+            "sudo -u bob cp ${bobPrivateKey} ~bob/.ssh/id_ed25519",
+            "sudo -u bob chmod 600 ~bob/.ssh/id_ed25519",
+        )
+
+    with subtest("gitolite server starts"):
+        server.wait_for_unit("gitolite-init.service")
+        server.wait_for_unit("sshd.service")
+        client.succeed("ssh gitolite@server info")
+
+    with subtest("admin can clone and configure gitolite-admin.git"):
+        client.succeed(
+            "git clone gitolite@server:gitolite-admin.git",
+            "git config --global user.name 'System Administrator'",
+            "git config --global user.email root\@domain.example",
+            "cp ${alicePublicKey} gitolite-admin/keydir/alice.pub",
+            "cp ${bobPublicKey} gitolite-admin/keydir/bob.pub",
+            "(cd gitolite-admin && git add . && git commit -m 'Add keys for alice, bob' && git push)",
+            "cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf",
+            "(cd gitolite-admin && git add . && git commit -m 'Add repo for alice' && git push)",
+        )
+
+    with subtest("non-admins cannot clone gitolite-admin.git"):
+        client.fail("sudo -i -u alice git clone gitolite@server:gitolite-admin.git")
+        client.fail("sudo -i -u bob git clone gitolite@server:gitolite-admin.git")
+
+    with subtest("non-admins can clone testing.git"):
+        client.succeed("sudo -i -u alice git clone gitolite@server:testing.git")
+        client.succeed("sudo -i -u bob git clone gitolite@server:testing.git")
+
+    with subtest("alice can clone alice-project.git"):
+        client.succeed("sudo -i -u alice git clone gitolite@server:alice-project.git")
+
+    with subtest("bob cannot clone alice-project.git"):
+        client.fail("sudo -i -u bob git clone gitolite@server:alice-project.git")
   '';
 })
diff --git a/nixos/tests/influxdb.nix b/nixos/tests/influxdb.nix
index 61201202204b..04ef80461010 100644
--- a/nixos/tests/influxdb.nix
+++ b/nixos/tests/influxdb.nix
@@ -1,6 +1,6 @@
 # This test runs influxdb and checks if influxdb is up and running
 
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
   name = "influxdb";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ offline ];
@@ -9,25 +9,32 @@ import ./make-test.nix ({ pkgs, ...} : {
   nodes = {
     one = { ... }: {
       services.influxdb.enable = true;
+      environment.systemPackages = [ pkgs.httpie ];
     };
   };
 
   testScript = ''
-    startAll;
-  
-    $one->waitForUnit("influxdb.service");
+    import shlex
+
+    start_all()
+
+    one.wait_for_unit("influxdb.service")
 
     # create database
-    $one->succeed(q~
-      curl -XPOST http://localhost:8086/query --data-urlencode "q=CREATE DATABASE test"
-    ~);
+    one.succeed(
+        "curl -XPOST http://localhost:8086/query --data-urlencode 'q=CREATE DATABASE test'"
+    )
 
     # write some points and run simple query
-    $one->succeed(q~
-      curl -XPOST 'http://localhost:8086/write?db=test' --data-binary 'cpu_load_short,host=server01,region=us-west value=0.64 1434055562000000000'
-    ~);
-    $one->succeed(q~
-      curl -GET 'http://localhost:8086/query' --data-urlencode "db=test" --data-urlencode "q=SELECT \"value\" FROM \"cpu_load_short\" WHERE \"region\"='us-west'"  | grep "0\.64"
-    ~);
+    out = one.succeed(
+        "curl -XPOST 'http://localhost:8086/write?db=test' --data-binary 'cpu_load_short,host=server01,region=us-west value=0.64 1434055562000000000'"
+    )
+
+    qv = "SELECT value FROM cpu_load_short WHERE region='us-west'"
+    cmd = f'curl -GET "http://localhost:8086/query?db=test" --data-urlencode {shlex.quote("q="+ qv)}'
+    out = one.succeed(cmd)
+
+    assert "2015-06-11T20:46:02Z" in out
+    assert "0.64" in out
   '';
 })
diff --git a/nixos/tests/jenkins.nix b/nixos/tests/jenkins.nix
index a6eec411ff28..cd64ff512878 100644
--- a/nixos/tests/jenkins.nix
+++ b/nixos/tests/jenkins.nix
@@ -3,7 +3,7 @@
 #   2. jenkins user can be extended on both master and slave
 #   3. jenkins service not started on slave node
 
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
   name = "jenkins";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ bjornfor coconnor domenkozar eelco ];
@@ -33,18 +33,17 @@ import ./make-test.nix ({ pkgs, ...} : {
   };
 
   testScript = ''
-    startAll;
+    start_all()
 
-    $master->waitForUnit("jenkins");
+    master.wait_for_unit("jenkins")
 
-    $master->mustSucceed("curl http://localhost:8080 | grep 'Authentication required'");
+    assert "Authentication required" in master.succeed("curl http://localhost:8080")
 
-    print $master->execute("sudo -u jenkins groups");
-    $master->mustSucceed("sudo -u jenkins groups | grep jenkins | grep users");
+    for host in master, slave:
+        groups = host.succeed("sudo -u jenkins groups")
+        assert "jenkins" in groups
+        assert "users" in groups
 
-    print $slave->execute("sudo -u jenkins groups");
-    $slave->mustSucceed("sudo -u jenkins groups | grep jenkins | grep users");
-
-    $slave->mustFail("systemctl is-enabled jenkins.service");
+    slave.fail("systemctl is-enabled jenkins.service")
   '';
 })
diff --git a/nixos/tests/minio.nix b/nixos/tests/minio.nix
index f1218b537711..3b0619742671 100644
--- a/nixos/tests/minio.nix
+++ b/nixos/tests/minio.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} :
+import ./make-test-python.nix ({ pkgs, ...} :
 let
     accessKey = "BKIKJAA5BMMU2RHO6IBB";
     secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
@@ -18,7 +18,7 @@ let
       sio.seek(0)
       minioClient.put_object('test-bucket', 'test.txt', sio, sio_len, content_type='text/plain')
     '';
-  in {
+in {
   name = "minio";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ bachp ];
@@ -37,19 +37,19 @@ let
     };
   };
 
-  testScript =
-    ''
-      startAll;
-      $machine->waitForUnit("minio.service");
-      $machine->waitForOpenPort(9000);
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("minio.service")
+    machine.wait_for_open_port(9000)
 
-      # Create a test bucket on the server
-      $machine->succeed("mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} S3v4");
-      $machine->succeed("mc mb minio/test-bucket");
-      $machine->succeed("${minioPythonScript}");
-      $machine->succeed("mc ls minio") =~ /test-bucket/ or die;
-      $machine->succeed("mc cat minio/test-bucket/test.txt") =~ /Test from Python/ or die;
-      $machine->shutdown;
-
-    '';
+    # Create a test bucket on the server
+    machine.succeed(
+        "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} S3v4"
+    )
+    machine.succeed("mc mb minio/test-bucket")
+    machine.succeed("${minioPythonScript}")
+    assert "test-bucket" in machine.succeed("mc ls minio")
+    assert "Test from Python" in machine.succeed("mc cat minio/test-bucket/test.txt")
+    machine.shutdown()
+  '';
 })
diff --git a/nixos/tests/nexus.nix b/nixos/tests/nexus.nix
index 783c9f5c019f..1ec5c40476a6 100644
--- a/nixos/tests/nexus.nix
+++ b/nixos/tests/nexus.nix
@@ -3,7 +3,7 @@
 #   2. nexus service can startup on server (creating database and all other initial stuff)
 #   3. the web application is reachable via HTTP
 
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
   name = "nexus";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ ironpinguin ma27 ];
@@ -22,11 +22,11 @@ import ./make-test.nix ({ pkgs, ...} : {
   };
 
   testScript = ''
-    startAll;
+    start_all()
 
-    $server->waitForUnit("nexus");
-    $server->waitForOpenPort(8081);
+    server.wait_for_unit("nexus")
+    server.wait_for_open_port(8081)
 
-    $server->succeed("curl -f 127.0.0.1:8081");
+    server.succeed("curl -f 127.0.0.1:8081")
   '';
 })
diff --git a/nixos/tests/osquery.nix b/nixos/tests/osquery.nix
deleted file mode 100644
index d95871ffafc6..000000000000
--- a/nixos/tests/osquery.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-import ./make-test.nix ({ pkgs, lib, ... }:
-
-with lib;
-
-{
-  name = "osquery";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ ma27 ];
-  };
-
-  machine = {
-    services.osquery.enable = true;
-    services.osquery.loggerPath = "/var/log/osquery/logs";
-    services.osquery.pidfile = "/run/osqueryd.pid";
-  };
-
-  testScript = ''
-    $machine->start;
-    $machine->waitForUnit("osqueryd.service");
-
-    $machine->succeed("echo 'SELECT address FROM etc_hosts LIMIT 1;' | osqueryi | grep '127.0.0.1'");
-    $machine->succeed(
-      "echo 'SELECT value FROM osquery_flags WHERE name = \"logger_path\";' | osqueryi | grep /var/log/osquery/logs"
-    );
-
-    $machine->succeed("echo 'SELECT value FROM osquery_flags WHERE name = \"pidfile\";' | osqueryi | grep /run/osqueryd.pid");
-  '';
-})
diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix
index 9888887ee8b5..6ff19be1bb95 100644
--- a/nixos/tests/pantheon.nix
+++ b/nixos/tests/pantheon.nix
@@ -1,9 +1,10 @@
-import ./make-test.nix ({ pkgs, ...} :
+import ./make-test-python.nix ({ pkgs, ...} :
 
 {
   name = "pantheon";
+
   meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ worldofpeace ];
+    maintainers = pkgs.pantheon.maintainers;
   };
 
   machine = { ... }:
@@ -21,35 +22,37 @@ import ./make-test.nix ({ pkgs, ...} :
 
   testScript = { nodes, ... }: let
     user = nodes.machine.config.users.users.alice;
+    bob = nodes.machine.config.users.users.bob;
   in ''
-    startAll;
-
-    # Wait for display manager to start
-    $machine->waitForText(qr/${user.description}/);
-    $machine->screenshot("lightdm");
-
-    # Log in
-    $machine->sendChars("${user.password}\n");
-    $machine->waitForFile("/home/alice/.Xauthority");
-    $machine->succeed("xauth merge ~alice/.Xauthority");
-
-    # Check if "pantheon-shell" components actually start
-    $machine->waitUntilSucceeds("pgrep gala");
-    $machine->waitForWindow(qr/gala/);
-    $machine->waitUntilSucceeds("pgrep wingpanel");
-    $machine->waitForWindow("wingpanel");
-    $machine->waitUntilSucceeds("pgrep plank");
-    $machine->waitForWindow(qr/plank/);
-
-    # Check that logging in has given the user ownership of devices.
-    $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
-
-    # Open elementary terminal
-    $machine->execute("su - alice -c 'DISPLAY=:0.0 io.elementary.terminal &'");
-    $machine->waitForWindow(qr/io.elementary.terminal/);
-
-    # Take a screenshot of the desktop
-    $machine->sleep(20);
-    $machine->screenshot("screen");
+    machine.wait_for_unit("display-manager.service")
+
+    with subtest("Test we can see usernames in elementary-greeter"):
+        machine.wait_for_text("${user.description}")
+        machine.wait_for_text("${bob.description}")
+        machine.screenshot("elementary_greeter_lightdm")
+
+    with subtest("Login with elementary-greeter"):
+        machine.send_chars("${user.password}\n")
+        machine.wait_for_x()
+        machine.wait_for_file("${user.home}/.Xauthority")
+        machine.succeed("xauth merge ${user.home}/.Xauthority")
+
+    with subtest("Check that logging in has given the user ownership of devices"):
+        machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+
+    # TODO: DBus API could eliminate this? Pantheon uses Bamf.
+    with subtest("Check if pantheon session components actually start"):
+        machine.wait_until_succeeds("pgrep gala")
+        machine.wait_for_window("gala")
+        machine.wait_until_succeeds("pgrep wingpanel")
+        machine.wait_for_window("wingpanel")
+        machine.wait_until_succeeds("pgrep plank")
+        machine.wait_for_window("plank")
+
+    with subtest("Open elementary terminal"):
+        machine.execute("su - ${user.name} -c 'DISPLAY=:0 io.elementary.terminal &'")
+        machine.wait_for_window("io.elementary.terminal")
+        machine.sleep(20)
+        machine.screenshot("screen")
   '';
 })
diff --git a/nixos/tests/plasma5.nix b/nixos/tests/plasma5.nix
index 614fc9bf316e..6884f17aabbe 100644
--- a/nixos/tests/plasma5.nix
+++ b/nixos/tests/plasma5.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} :
+import ./make-test-python.nix ({ pkgs, ...} :
 
 {
   name = "plasma5";
@@ -7,23 +7,11 @@ import ./make-test.nix ({ pkgs, ...} :
   };
 
   machine = { ... }:
-  let
-    sddm_theme = pkgs.stdenv.mkDerivation {
-      name = "breeze-ocr-theme";
-      phases = "buildPhase";
-      buildCommand = ''
-        mkdir -p $out/share/sddm/themes/
-        cp -r ${pkgs.plasma-workspace}/share/sddm/themes/breeze $out/share/sddm/themes/breeze-ocr-theme
-        chmod -R +w $out/share/sddm/themes/breeze-ocr-theme
-        printf "[General]\ntype=color\ncolor=#1d99f3\nbackground=\n" > $out/share/sddm/themes/breeze-ocr-theme/theme.conf
-      '';
-    };
-  in
+
   {
     imports = [ ./common/user-account.nix ];
     services.xserver.enable = true;
     services.xserver.displayManager.sddm.enable = true;
-    services.xserver.displayManager.sddm.theme = "breeze-ocr-theme";
     services.xserver.desktopManager.plasma5.enable = true;
     services.xserver.desktopManager.default = "plasma5";
     services.xserver.displayManager.sddm.autoLogin = {
@@ -32,34 +20,40 @@ import ./make-test.nix ({ pkgs, ...} :
     };
     hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
     virtualisation.memorySize = 1024;
-    environment.systemPackages = [ sddm_theme ];
   };
 
   testScript = { nodes, ... }: let
     user = nodes.machine.config.users.users.alice;
     xdo = "${pkgs.xdotool}/bin/xdotool";
   in ''
-    startAll;
-    # wait for log in
-    $machine->waitForFile("/home/alice/.Xauthority");
-    $machine->succeed("xauth merge ~alice/.Xauthority");
-
-    $machine->waitUntilSucceeds("pgrep plasmashell");
-    $machine->waitForWindow("^Desktop ");
-
-    # Check that logging in has given the user ownership of devices.
-    $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
-
-    $machine->execute("su - alice -c 'DISPLAY=:0.0 dolphin &'");
-    $machine->waitForWindow(" Dolphin");
-
-    $machine->execute("su - alice -c 'DISPLAY=:0.0 konsole &'");
-    $machine->waitForWindow("Konsole");
-
-    $machine->execute("su - alice -c 'DISPLAY=:0.0 systemsettings5 &'");
-    $machine->waitForWindow("Settings");
-
-    $machine->execute("${xdo} key Alt+F1 sleep 10");
-    $machine->screenshot("screen");
+    with subtest("Wait for login"):
+        start_all()
+        machine.wait_for_file("${user.home}/.Xauthority")
+        machine.succeed("xauth merge ${user.home}/.Xauthority")
+
+    with subtest("Check plasmashell started"):
+        machine.wait_until_succeeds("pgrep plasmashell")
+        machine.wait_for_window("^Desktop ")
+
+    with subtest("Check that logging in has given the user ownership of devices"):
+        machine.succeed("getfacl -p /dev/snd/timer | grep -q ${user.name}")
+
+    with subtest("Run Dolphin"):
+        machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 dolphin &'")
+        machine.wait_for_window(" Dolphin")
+
+    with subtest("Run Konsole"):
+        machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 konsole &'")
+        machine.wait_for_window("Konsole")
+
+    with subtest("Run systemsettings"):
+        machine.execute("su - ${user.name} -c 'DISPLAY=:0.0 systemsettings5 &'")
+        machine.wait_for_window("Settings")
+
+    with subtest("Wait to get a screenshot"):
+        machine.execute(
+            "${xdo} key Alt+F1 sleep 10"
+        )
+        machine.screenshot("screen")
   '';
 })
diff --git a/nixos/tests/prometheus.nix b/nixos/tests/prometheus.nix
index 52f61046be39..8bfd0c131e61 100644
--- a/nixos/tests/prometheus.nix
+++ b/nixos/tests/prometheus.nix
@@ -31,7 +31,7 @@ let
     };
   };
 
-in import ./make-test.nix {
+in import ./make-test-python.nix {
   name = "prometheus";
 
   nodes = {
@@ -173,67 +173,73 @@ in import ./make-test.nix {
   testScript = { nodes, ... } : ''
     # Before starting the other machines we first make sure that our S3 service is online
     # and has a bucket added for thanos:
-    $s3->start;
-    $s3->waitForUnit("minio.service");
-    $s3->waitForOpenPort(${toString minioPort});
-    $s3->succeed(
-      "mc config host add minio " .
-      "http://localhost:${toString minioPort} ${s3.accessKey} ${s3.secretKey} S3v4");
-    $s3->succeed("mc mb minio/thanos-bucket");
+    s3.start()
+    s3.wait_for_unit("minio.service")
+    s3.wait_for_open_port(${toString minioPort})
+    s3.succeed(
+        "mc config host add minio "
+        + "http://localhost:${toString minioPort} "
+        + "${s3.accessKey} ${s3.secretKey} S3v4",
+        "mc mb minio/thanos-bucket",
+    )
 
     # Now that s3 has started we can start the other machines:
-    $prometheus->start;
-    $query->start;
-    $store->start;
+    for machine in prometheus, query, store:
+        machine.start()
 
     # Check if prometheus responds to requests:
-    $prometheus->waitForUnit("prometheus.service");
-    $prometheus->waitForOpenPort(${toString queryPort});
-    $prometheus->succeed("curl -s http://127.0.0.1:${toString queryPort}/metrics");
+    prometheus.wait_for_unit("prometheus.service")
+    prometheus.wait_for_open_port(${toString queryPort})
+    prometheus.succeed("curl -s http://127.0.0.1:${toString queryPort}/metrics")
 
     # Let's test if pushing a metric to the pushgateway succeeds:
-    $prometheus->waitForUnit("pushgateway.service");
-    $prometheus->succeed(
-      "echo 'some_metric 3.14' | " .
-      "curl --data-binary \@- http://127.0.0.1:${toString pushgwPort}/metrics/job/some_job");
+    prometheus.wait_for_unit("pushgateway.service")
+    prometheus.succeed(
+        "echo 'some_metric 3.14' | "
+        + "curl --data-binary \@- "
+        + "http://127.0.0.1:${toString pushgwPort}/metrics/job/some_job"
+    )
 
     # Now check whether that metric gets ingested by prometheus.
     # Since we'll check for the metric several times on different machines
     # we abstract the test using the following function:
 
     # Function to check if the metric "some_metric" has been received and returns the correct value.
-    local *Machine::waitForMetric = sub {
-      my ($self) = @_;
-      $self->waitUntilSucceeds(
-        "curl -sf 'http://127.0.0.1:${toString queryPort}/api/v1/query?query=some_metric' " .
-        "| jq '.data.result[0].value[1]' | grep '\"3.14\"'");
-    };
+    def wait_for_metric(machine):
+        return machine.wait_until_succeeds(
+            "curl -sf 'http://127.0.0.1:${toString queryPort}/api/v1/query?query=some_metric' | "
+            + "jq '.data.result[0].value[1]' | grep '\"3.14\"'"
+        )
+
 
-    $prometheus->waitForMetric;
+    wait_for_metric(prometheus)
 
     # Let's test if the pushgateway persists metrics to the configured location.
-    $prometheus->waitUntilSucceeds("test -e /var/lib/prometheus-pushgateway/metrics");
+    prometheus.wait_until_succeeds("test -e /var/lib/prometheus-pushgateway/metrics")
 
     # Test thanos
-    $prometheus->waitForUnit("thanos-sidecar.service");
+    prometheus.wait_for_unit("thanos-sidecar.service")
 
     # Test if the Thanos query service can correctly retrieve the metric that was send above.
-    $query->waitForUnit("thanos-query.service");
-    $query->waitForMetric;
+    query.wait_for_unit("thanos-query.service")
+    wait_for_metric(query)
 
     # Test if the Thanos sidecar has correctly uploaded its TSDB to S3, if the
     # Thanos storage service has correctly downloaded it from S3 and if the Thanos
     # query service running on $store can correctly retrieve the metric:
-    $store->waitForUnit("thanos-store.service");
-    $store->waitForMetric;
+    store.wait_for_unit("thanos-store.service")
+    wait_for_metric(store)
 
-    $store->waitForUnit("thanos-compact.service");
+    store.wait_for_unit("thanos-compact.service")
 
     # Test if the Thanos bucket command is able to retrieve blocks from the S3 bucket
     # and check if the blocks have the correct labels:
-    $store->succeed(
-      "thanos bucket ls" .
-      " --objstore.config-file=${nodes.store.config.services.thanos.store.objstore.config-file}" .
-      " --output=json | jq .thanos.labels.some_label | grep 'required by thanos'");
+    store.succeed(
+        "thanos bucket ls "
+        + "--objstore.config-file=${nodes.store.config.services.thanos.store.objstore.config-file} "
+        + "--output=json | "
+        + "jq .thanos.labels.some_label | "
+        + "grep 'required by thanos'"
+    )
   '';
 }
diff --git a/nixos/tests/sudo.nix b/nixos/tests/sudo.nix
index fc16b99cc19c..5bbec3d57269 100644
--- a/nixos/tests/sudo.nix
+++ b/nixos/tests/sudo.nix
@@ -4,7 +4,7 @@ let
   password = "helloworld";
 
 in
-  import ./make-test.nix ({ pkgs, ...} : {
+  import ./make-test-python.nix ({ pkgs, ...} : {
     name = "sudo";
     meta = with pkgs.stdenv.lib.maintainers; {
       maintainers = [ lschuermann ];
@@ -50,44 +50,34 @@ in
 
     testScript =
       ''
-        subtest "users in wheel group should have passwordless sudo", sub {
-            $machine->succeed("su - test0 -c \"sudo -u root true\"");
-        };
+        with subtest("users in wheel group should have passwordless sudo"):
+            machine.succeed('su - test0 -c "sudo -u root true"')
 
-        subtest "test1 user should have sudo with password", sub {
-            $machine->succeed("su - test1 -c \"echo ${password} | sudo -S -u root true\"");
-        };
+        with subtest("test1 user should have sudo with password"):
+            machine.succeed('su - test1 -c "echo ${password} | sudo -S -u root true"')
 
-        subtest "test1 user should not be able to use sudo without password", sub {
-            $machine->fail("su - test1 -c \"sudo -n -u root true\"");
-        };
+        with subtest("test1 user should not be able to use sudo without password"):
+            machine.fail('su - test1 -c "sudo -n -u root true"')
 
-        subtest "users in group 'foobar' should be able to use sudo with password", sub {
-            $machine->succeed("sudo -u test2 echo ${password} | sudo -S -u root true");
-        };
+        with subtest("users in group 'foobar' should be able to use sudo with password"):
+            machine.succeed("sudo -u test2 echo ${password} | sudo -S -u root true")
 
-        subtest "users in group 'barfoo' should be able to use sudo without password", sub {
-            $machine->succeed("sudo -u test3 sudo -n -u root true");
-        };
+        with subtest("users in group 'barfoo' should be able to use sudo without password"):
+            machine.succeed("sudo -u test3 sudo -n -u root true")
 
-        subtest "users in group 'baz' (GID 1337) should be able to use sudo without password", sub {
-            $machine->succeed("sudo -u test4 sudo -n -u root echo true");
-        };
+        with subtest("users in group 'baz' (GID 1337)"):
+            machine.succeed("sudo -u test4 sudo -n -u root echo true")
 
-        subtest "test5 user should be able to run commands under test1", sub {
-            $machine->succeed("sudo -u test5 sudo -n -u test1 true");
-        };
+        with subtest("test5 user should be able to run commands under test1"):
+            machine.succeed("sudo -u test5 sudo -n -u test1 true")
 
-        subtest "test5 user should not be able to run commands under root", sub {
-            $machine->fail("sudo -u test5 sudo -n -u root true");
-        };
+        with subtest("test5 user should not be able to run commands under root"):
+            machine.fail("sudo -u test5 sudo -n -u root true")
 
-        subtest "test5 user should be able to keep his environment", sub {
-            $machine->succeed("sudo -u test5 sudo -n -E -u test1 true");
-        };
+        with subtest("test5 user should be able to keep his environment"):
+            machine.succeed("sudo -u test5 sudo -n -E -u test1 true")
 
-        subtest "users in group 'barfoo' should not be able to keep their environment", sub {
-            $machine->fail("sudo -u test3 sudo -n -E -u root true");
-        };
+        with subtest("users in group 'barfoo' should not be able to keep their environment"):
+            machine.fail("sudo -u test3 sudo -n -E -u root true")
       '';
   })
diff --git a/nixos/tests/syncthing-init.nix b/nixos/tests/syncthing-init.nix
index 0de76b688bdc..9c8e0a3d087e 100644
--- a/nixos/tests/syncthing-init.nix
+++ b/nixos/tests/syncthing-init.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ lib, pkgs, ... }: let
+import ./make-test-python.nix ({ lib, pkgs, ... }: let
 
   testId = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
 
@@ -22,13 +22,11 @@ in {
   };
 
   testScript = ''
-    my $config;
-
-    $machine->waitForUnit("syncthing-init.service");
-    $config = $machine->succeed("cat /var/lib/syncthing/.config/syncthing/config.xml");
+    machine.wait_for_unit("syncthing-init.service")
+    config = machine.succeed("cat /var/lib/syncthing/.config/syncthing/config.xml")
    
-    $config =~ /${testId}/ or die;
-    $config =~ /testFolder/ or die;
+    assert "testFolder" in config
+    assert "${testId}" in config
   '';
 })
 
diff --git a/nixos/tests/syncthing-relay.nix b/nixos/tests/syncthing-relay.nix
index f1ceb4993337..cd72ef1cbe1d 100644
--- a/nixos/tests/syncthing-relay.nix
+++ b/nixos/tests/syncthing-relay.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ lib, pkgs, ... }: {
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
   name = "syncthing-relay";
   meta.maintainers = with pkgs.stdenv.lib.maintainers; [ delroth ];
 
@@ -14,9 +14,13 @@ import ./make-test.nix ({ lib, pkgs, ... }: {
   };
 
   testScript = ''
-    $machine->waitForUnit("syncthing-relay.service");
-    $machine->waitForOpenPort(12345);
-    $machine->waitForOpenPort(12346);
-    $machine->succeed("curl http://localhost:12346/status | jq -r '.options.\"provided-by\"'") =~ /nixos-test/ or die;
+    machine.wait_for_unit("syncthing-relay.service")
+    machine.wait_for_open_port(12345)
+    machine.wait_for_open_port(12346)
+
+    out = machine.succeed(
+        "curl -sS http://localhost:12346/status | jq -r '.options.\"provided-by\"'"
+    )
+    assert "nixos-test" in out
   '';
 })
diff --git a/nixos/tests/systemd-networkd-wireguard.nix b/nixos/tests/systemd-networkd-wireguard.nix
index b83e9c7ce190..be5c0da981d2 100644
--- a/nixos/tests/systemd-networkd-wireguard.nix
+++ b/nixos/tests/systemd-networkd-wireguard.nix
@@ -1,4 +1,4 @@
-let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: {
+let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: {
       imports = [ common/user-account.nix ];
       systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
       networking.useNetworkd = true;
@@ -7,13 +7,16 @@ let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...
       virtualisation.vlans = [ 1 ];
       environment.systemPackages = with pkgs; [ wireguard-tools ];
       boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
+      systemd.tmpfiles.rules = [
+        "f /run/wg_priv 0640 root systemd-network - ${privk}"
+      ];
       systemd.network = {
         enable = true;
         netdevs = {
           "90-wg0" = {
             netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
             wireguardConfig = {
-              PrivateKeyFile = privkpath ;
+              PrivateKeyFile = "/run/wg_priv";
               ListenPort = 51820;
               FwMark = 42;
             };
@@ -53,7 +56,7 @@ in import ./make-test-python.nix ({pkgs, ... }: {
   nodes = {
     node1 = { pkgs, ... }@attrs:
     let localConf = {
-        privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
+        privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
         pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
         nodeId = "1";
         peerId = "2";
@@ -62,7 +65,7 @@ in import ./make-test-python.nix ({pkgs, ... }: {
 
     node2 = { pkgs, ... }@attrs:
     let localConf = {
-        privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
+        privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
         pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
         nodeId = "2";
         peerId = "1";
diff --git a/nixos/tests/uwsgi.nix b/nixos/tests/uwsgi.nix
index afc03e74ed7e..78a87147f55c 100644
--- a/nixos/tests/uwsgi.nix
+++ b/nixos/tests/uwsgi.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:
 {
   name = "uwsgi";
   meta = with pkgs.stdenv.lib.maintainers; {
@@ -30,9 +30,9 @@ import ./make-test.nix ({ pkgs, ... }:
 
   testScript =
     ''
-      $machine->waitForUnit('multi-user.target');
-      $machine->waitForUnit('uwsgi.service');
-      $machine->waitForOpenPort(8000);
-      $machine->succeed('curl -v 127.0.0.1:8000 | grep "Hello World!"');
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("uwsgi.service")
+      machine.wait_for_open_port(8000)
+      assert "Hello World" in machine.succeed("curl -v 127.0.0.1:8000")
     '';
 })
diff --git a/nixos/tests/wordpress.nix b/nixos/tests/wordpress.nix
index 64c533d70f42..b7449859f7e6 100644
--- a/nixos/tests/wordpress.nix
+++ b/nixos/tests/wordpress.nix
@@ -45,12 +45,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
     with subtest("wordpress-init went through"):
         for site_name in site_names:
             info = machine.get_unit_info(f"wordpress-init-{site_name}")
-            assert info.Result == "success"
+            assert info["Result"] == "success"
 
     with subtest("secret keys are set"):
-        re.compile(r"^define.*NONCE_SALT.{64,};$")
+        pattern = re.compile(r"^define.*NONCE_SALT.{64,};$", re.MULTILINE)
         for site_name in site_names:
-            assert r.match(
+            assert pattern.search(
                 machine.succeed(f"cat /var/lib/wordpress/{site_name}/secret-keys.php")
             )
   '';
diff --git a/pkgs/applications/audio/audacity/default.nix b/pkgs/applications/audio/audacity/default.nix
index 11434c0b3498..2fd3e5c27fe7 100644
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@@ -7,12 +7,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "2.3.2";
+  version = "2.3.3";
   pname = "audacity";
 
   src = fetchzip {
     url = "https://github.com/audacity/audacity/archive/Audacity-${version}.tar.gz";
-    sha256 = "08w96124vv8k4myd4vifq73ningq6404x889wvg2sk016kc4dfv1";
+    sha256 = "0ddc03dbm4ixy877czmwd03fpjgr3y68bxfgb6n2q6cv4prp30ig";
   };
 
   preConfigure = /* we prefer system-wide libs */ ''
diff --git a/pkgs/applications/audio/spotifyd/default.nix b/pkgs/applications/audio/spotifyd/default.nix
index d420d1a67095..36ab017c5cbb 100644
--- a/pkgs/applications/audio/spotifyd/default.nix
+++ b/pkgs/applications/audio/spotifyd/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotifyd";
-  version = "0.2.19";
+  version = "0.2.20";
 
   src = fetchFromGitHub {
     owner = "Spotifyd";
     repo = "spotifyd";
     rev = "v${version}";
-    sha256 = "063b28ysj224m6ngns9i574i7vnp1x4g07cqjw908ch04yngcg1c";
+    sha256 = "1hf4wpk7r0s4jpjhxaz67y1hd8jx9ns5imd85r3cdg4lxf3j5gph";
   };
 
-  cargoSha256 = "0pqxqd5dyw9mjclrqkxzfnzsz74xl4bg0b86v5q6kc0a91zd49b9";
+  cargoSha256 = "1h3fis47hmxvppiv1icjhgp48nd46gayfcmzfjs34q6jask90n0w";
 
   cargoBuildFlags = [
     "--no-default-features"
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
     description = "An open source Spotify client running as a UNIX daemon";
     homepage = "https://github.com/Spotifyd/spotifyd";
     license = with licenses; [ gpl3 ];
-    maintainers = [ maintainers.anderslundstedt maintainers.marsam ];
+    maintainers = with maintainers; [ anderslundstedt filalex77 marsam ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/graphics/drawpile/default.nix b/pkgs/applications/graphics/drawpile/default.nix
index b4f6776e02cb..c284f15a8747 100644
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@@ -60,11 +60,11 @@ let
 
 in mkDerivation rec {
   pname = "drawpile";
-  version = "2.1.13";
+  version = "2.1.14";
 
   src = fetchurl {
     url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "0r56hkzjdlg4615zvrjv60i3f06pv7ssh6bs6jb46qs8wbsawsxf";
+    sha256 = "0vpsq8swvli6xiykjqjmdcz33jd44nvhq1n350dm9qap9s9wdr47";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/nomacs/default.nix b/pkgs/applications/graphics/nomacs/default.nix
index 62fae518b929..48a79e8844e8 100644
--- a/pkgs/applications/graphics/nomacs/default.nix
+++ b/pkgs/applications/graphics/nomacs/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkgconfig
 
@@ -9,7 +10,7 @@
 , qtsvg
 
 , exiv2
-, opencv
+, opencv4
 , libraw
 , libtiff
 , quazip
@@ -28,6 +29,12 @@ mkDerivation rec {
 
   patches = [
     ./nomacs-iostream.patch
+    (fetchpatch {
+      name = "darwin-less-restrictive-opencv.patch";
+      url = "https://github.com/nomacs/nomacs/commit/d182fce4bcd9a25bd15e3de065ca67849a32458c.patch";
+      sha256 = "0j6sviwrjn69nqf59hjn30c4j838h8az7rnlwcx8ymlb21vd9x2h";
+      stripLen = 1;
+    })
   ];
 
   enableParallelBuilding = true;
@@ -43,7 +50,7 @@ mkDerivation rec {
                  qttools
                  qtsvg
                  exiv2
-                 opencv
+                 opencv4
                  libraw
                  libtiff
                  quazip];
diff --git a/pkgs/applications/misc/clight/clightd.nix b/pkgs/applications/misc/clight/clightd.nix
index 43ff1d73f78f..f9c08d1f00a1 100644
--- a/pkgs/applications/misc/clight/clightd.nix
+++ b/pkgs/applications/misc/clight/clightd.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clightd";
-  version = "3.4";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clightd";
     rev = version;
-    sha256 = "0g6kawizwfhvigkwm7rbfq6rg872xn8igy8n355w4d7mmcxk0jf8";
+    sha256 = "0cskxy3xsy187in5vg8xcs3kwcx2s160qv009v0ahkcalp29ghz4";
   };
 
   # dbus-1.pc has datadir=/etc
diff --git a/pkgs/applications/misc/clight/default.nix b/pkgs/applications/misc/clight/default.nix
index 829fd4e12231..a2e452562698 100644
--- a/pkgs/applications/misc/clight/default.nix
+++ b/pkgs/applications/misc/clight/default.nix
@@ -1,18 +1,18 @@
 { lib, stdenv, fetchFromGitHub
 , dbus, cmake, pkgconfig, bash-completion
-, gsl, popt, clightd, systemd, libconfig
+, gsl, popt, clightd, systemd, libconfig, libmodule
 , withGeoclue ? true, geoclue2
 , withUpower ? true, upower }:
 
 stdenv.mkDerivation rec {
   pname = "clight";
-  version = "3.1";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clight";
     rev = version;
-    sha256 = "0rzcr1x9h4llnmklhgzs9r7xwhsrw1qkqvfffkp8fs90nycaqx81";
+    sha256 = "101fp9kwmfmfffpdvv41wf96kdjw0b16xk49g43w32a5wlr74zrq";
   };
 
   # bash-completion.pc completionsdir=${bash-completion.out}
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
     systemd
     geoclue2
     libconfig
+    libmodule
   ] ++ optional withGeoclue geoclue2
     ++ optional withUpower upower;
 
diff --git a/pkgs/applications/misc/copyq/default.nix b/pkgs/applications/misc/copyq/default.nix
index 825053483a4b..58a85f8f6e97 100644
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "CopyQ";
-  version = "3.9.2";
+  version = "3.9.3";
 
   src  = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     rev = "v${version}";
-    sha256 = "02zs444i7hnqishs1i6vp8ffjxlxk3xkrw935pdwnwppv9s9v202";
+    sha256 = "0wlwq9xg8rzsbj0b29z358k4mbrqy04iraa8x0p26pa95yskgcma";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/dbeaver/default.nix b/pkgs/applications/misc/dbeaver/default.nix
index 1549ab00a4f7..e3d9e8be0b28 100644
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver-ce";
-  version = "6.2.4";
+  version = "6.2.5";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1k3aan290kfy2b53gl8r4yxvb8jas6sms1r052m3jld3i8frqgva";
+    sha256 = "1bg5cq7ivf263mjr8g9qwdhp9x0gm04nqiya4fyw0k33yiab85zn";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/misc/glava/default.nix b/pkgs/applications/misc/glava/default.nix
index 6f5146161a6d..519df42c789a 100644
--- a/pkgs/applications/misc/glava/default.nix
+++ b/pkgs/applications/misc/glava/default.nix
@@ -8,7 +8,7 @@ let
   wrapperScript = writeScript "glava" ''
     #!${runtimeShell}
     case "$1" in
-      --copy-config)
+      --copy-config|-C)
         # The binary would symlink it, which won't work in Nix because the
         # garbage collector will eventually remove the original files after
         # updates
@@ -45,6 +45,14 @@ in
     ];
 
     preConfigure = ''
+      for f in $(find -type f);do
+        substituteInPlace $f \
+          --replace /etc/xdg $out/etc/xdg
+      done
+
+      substituteInPlace Makefile \
+        --replace '$(DESTDIR)$(SHADERDIR)' '$(SHADERDIR)'
+
       substituteInPlace Makefile \
         --replace 'unknown' 'v${version}'
 
diff --git a/pkgs/applications/misc/polybar/default.nix b/pkgs/applications/misc/polybar/default.nix
index 9ca8c696184c..fcc6ead550a8 100644
--- a/pkgs/applications/misc/polybar/default.nix
+++ b/pkgs/applications/misc/polybar/default.nix
@@ -1,5 +1,5 @@
 { cairo, cmake, fetchFromGitHub, libXdmcp, libpthreadstubs, libxcb, pcre, pkgconfig
-, python2, stdenv, xcbproto, xcbutil, xcbutilcursor, xcbutilimage
+, python3, stdenv, xcbproto, xcbutil, xcbutilcursor, xcbutilimage
 , xcbutilrenderutil, xcbutilwm, xcbutilxrm, makeWrapper
 
 # optional packages-- override the variables ending in 'Support' to enable or
@@ -24,15 +24,16 @@ assert nlSupport     -> ! iwSupport && libnl         != null;
 assert i3Support     -> ! i3GapsSupport && jsoncpp != null && i3      != null;
 assert i3GapsSupport -> ! i3Support     && jsoncpp != null && i3-gaps != null;
 
-stdenv.mkDerivation rec {
+let xcbproto-py3 = xcbproto.override { python = python3; };
+in stdenv.mkDerivation rec {
     pname = "polybar";
-    version = "3.4.0";
+    version = "3.4.1";
 
     src = fetchFromGitHub {
-      owner = "jaagr";
+      owner = pname;
       repo = pname;
       rev = version;
-      sha256 = "1g3zj0788cdlm8inpl19279bw8zjcy7dzj7q4f1l2d8c8g1jhv0m";
+      sha256 = "1z1m6dxh2i5vsnkzaccb9j02ab05wgmcgig5d0l9w856g5jp3zmy";
       fetchSubmodules = true;
     };
 
@@ -45,12 +46,12 @@ stdenv.mkDerivation rec {
         having a black belt in shell scripting.
       '';
       license = licenses.mit;
-      maintainers = [ maintainers.afldcr ];
-      platforms = platforms.unix;
+      maintainers = with maintainers; [ afldcr filalex77 ];
+      platforms = platforms.linux;
     };
 
     buildInputs = [
-      cairo libXdmcp libpthreadstubs libxcb pcre python2 xcbproto xcbutil
+      cairo libXdmcp libpthreadstubs libxcb pcre python3 xcbproto-py3 xcbutil
       xcbutilcursor xcbutilimage xcbutilrenderutil xcbutilwm xcbutilxrm
 
       (if alsaSupport   then alsaLib       else null)
diff --git a/pkgs/applications/networking/c14/default.nix b/pkgs/applications/networking/c14/default.nix
index 3383d6838f7b..c000a37ff029 100644
--- a/pkgs/applications/networking/c14/default.nix
+++ b/pkgs/applications/networking/c14/default.nix
@@ -17,7 +17,7 @@ buildGoPackage rec {
 
   meta = with stdenv.lib; {
     description = "C14 is designed for data archiving & long-term backups.";
-    homepage = https://www.online.net/en/c14;
+    homepage = https://www.online.net/en/storage/c14-cold-storage;
     license = licenses.mit;
     maintainers = with maintainers; [ apeyroux ];
   };
diff --git a/pkgs/applications/networking/datovka/default.nix b/pkgs/applications/networking/datovka/default.nix
index 676737d2a77c..12bad094fcaa 100644
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@@ -11,11 +11,11 @@
 
 mkDerivation rec {
   pname = "datovka";
-  version = "4.14.0";
+  version = "4.14.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/datove_schranky/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0q7zlq522wdgwxgd3jxmxvr3awclcy0mbw3qaymwzn2b8d35168r";
+    sha256 = "0jinxsm2zw77294vz9pjiqpgpzdwx5nijsi4nqzxna5rkmwdyxk6";
   };
 
   buildInputs = [ libisds qmake qtbase qtsvg libxml2 ];
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index 09273b7caa50..b155f3129642 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -2,19 +2,18 @@
 , zlib, libxml2, gtk2, libnotify, speex, ffmpeg, libX11, libsoup, udev
 , ortp, mediastreamer, sqlite, belle-sip, libosip, libexosip, bzrtp
 , mediastreamer-openh264, bctoolbox, makeWrapper, fetchFromGitHub, cmake
-, libmatroska, bcunit, doxygen, gdk-pixbuf, glib, cairo, pango, polarssl
-, python, graphviz, belcard
+, libmatroska, bcunit, doxygen, gdk-pixbuf, glib, cairo, pango, mbedtls
+, python, graphviz, belcard, bcg729
 , withGui ? true
 }:
 
 stdenv.mkDerivation rec {
-  baseName = "linphone";
+  pname = "linphone";
   version = "3.12.0";
-  name = "${baseName}-${version}";
 
   src = fetchFromGitHub {
     owner = "BelledonneCommunications";
-    repo = baseName;
+    repo = pname;
     rev = version;
     sha256 = "0az2ywrpx11sqfb4s4r2v726avcjf4k15bvrqj7xvhz7hdndmh0j";
   };
@@ -27,21 +26,25 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     readline openldap cyrus_sasl libupnp zlib libxml2 gtk2 libnotify speex ffmpeg libX11
-    polarssl libsoup udev ortp mediastreamer sqlite belle-sip libosip libexosip
-    bctoolbox libmatroska bcunit gdk-pixbuf glib cairo pango bzrtp belcard
+    mbedtls libsoup udev ortp mediastreamer sqlite belle-sip libosip libexosip
+    bctoolbox libmatroska gdk-pixbuf glib cairo pango bzrtp belcard bcg729
   ];
 
   nativeBuildInputs = [
-    intltool pkgconfig makeWrapper cmake doxygen graphviz
+    intltool pkgconfig makeWrapper cmake bcunit doxygen graphviz
     (python.withPackages (ps: [ ps.pystache ps.six ]))
   ];
 
-  NIX_CFLAGS_COMPILE = " -Wno-error -I${glib.dev}/include/glib-2.0
-    -I${glib.out}/lib/glib-2.0/include -I${gtk2.dev}/include/gtk-2.0/
-    -I${cairo.dev}/include/cairo -I${pango.dev}/include/pango-1.0
-    -I${gtk2}/lib/gtk-2.0/include
-    -DLIBLINPHONE_GIT_VERSION=\"v${version}\"
-    ";
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error"
+    "-I${glib.dev}/include/glib-2.0"
+    "-I${glib.out}/lib/glib-2.0/include"
+    "-I${gtk2.dev}/include/gtk-2.0/"
+    "-I${cairo.dev}/include/cairo"
+    "-I${pango.dev}/include/pango-1.0"
+    "-I${gtk2}/lib/gtk-2.0/include"
+    "-DLIBLINPHONE_GIT_VERSION=\"v${version}\""
+  ];
 
   postInstall = ''
     for i in $(cd $out/bin && ls); do
@@ -50,8 +53,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.linphone.org/;
-    description = "Open Source video SIP softphone";
+    homepage = https://www.linphone.org/;
+    description = "Open source SIP phone for voice/video calls and instant messaging";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/networking/mailreaders/aerc/default.nix b/pkgs/applications/networking/mailreaders/aerc/default.nix
index 98ab5f563521..6915cfd79821 100644
--- a/pkgs/applications/networking/mailreaders/aerc/default.nix
+++ b/pkgs/applications/networking/mailreaders/aerc/default.nix
@@ -1,21 +1,22 @@
 { stdenv, buildGoModule, fetchurl
-, go, ncurses, scdoc
+, go, ncurses, notmuch, scdoc
 , python3, perl, w3m, dante
 }:
 
 buildGoModule rec {
   pname = "aerc";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchurl {
     url = "https://git.sr.ht/~sircmpwn/aerc/archive/${version}.tar.gz";
-    sha256 = "1ky1nl5b54lf5jnac2kb5404fplwnwypjplas8imdlsf517fw32n";
+    sha256 = "188jln8hmgiqn5il5m54bns0wk4grj09di8y6mmid58ibw6spma4";
   };
 
   nativeBuildInputs = [
     go
     scdoc
     python3.pkgs.wrapPython
+    notmuch
   ];
 
   patches = [
@@ -28,6 +29,8 @@ buildGoModule rec {
 
   buildInputs = [ python3 perl ];
 
+  GOFLAGS="-tags=notmuch";
+
   buildPhase = "
     runHook preBuild
     # we use make instead of go build
@@ -43,12 +46,12 @@ buildGoModule rec {
 
   postFixup = ''
     wrapProgram $out/bin/aerc --prefix PATH ":" \
-      "$out/share/aerc/filters:${stdenv.lib.makeBinPath [ ncurses.dev ]}"
+      "$out/share/aerc/filters:${stdenv.lib.makeBinPath [ ncurses ]}"
     wrapProgram $out/share/aerc/filters/html --prefix PATH ":" \
       ${stdenv.lib.makeBinPath [ w3m dante ]}
   '';
 
-  modSha256 = "0fc9m1qb8innypc8cxzbqyrfkawawyaqq3gqy7lqwmyh32f300jh";
+  modSha256 = "0pxbv4zfhii0g41cy0ycfpkkxw6nnd4ibavic6zqw30j476jnm2x";
 
   meta = with stdenv.lib; {
     description = "aerc is an email client for your terminal";
diff --git a/pkgs/applications/networking/mailreaders/aerc/runtime-sharedir.patch b/pkgs/applications/networking/mailreaders/aerc/runtime-sharedir.patch
index 4ff1283b5e3d..ed670d61a7b3 100644
--- a/pkgs/applications/networking/mailreaders/aerc/runtime-sharedir.patch
+++ b/pkgs/applications/networking/mailreaders/aerc/runtime-sharedir.patch
@@ -1,18 +1,19 @@
-From 7ea68a2eef026723903d72f54ca54b629881ec06 Mon Sep 17 00:00:00 2001
+From 6cf3c2e42d219b9665a43ca65f321c653b0aa102 Mon Sep 17 00:00:00 2001
 From: Tadeo Kondrak <me@tadeo.ca>
 Date: Mon, 28 Oct 2019 08:36:36 -0600
 Subject: [PATCH] Fix aerc breaking every time the package is rebuilt.
 
 On NixOS, the SHAREDIR changes on every rebuild to the package, but aerc
-fills it in as part of the default config. Fix this by not substituting
-@SHAREDIR@ in the default config until runtime.
+fills it in as part of the default config and then installs that config
+to the users home folder. Fix this by not substituting @SHAREDIR@ in the
+default config until runtime.
 ---
  Makefile         | 2 +-
- config/config.go | 3 +++
- 2 files changed, 4 insertions(+), 1 deletion(-)
+ config/config.go | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/Makefile b/Makefile
-index d3072d3..17ca0be 100644
+index d1c755d..1185a96 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -24,7 +24,7 @@ aerc: $(GOSRC)
@@ -25,10 +26,22 @@ index d3072d3..17ca0be 100644
  DOCS := \
  	aerc.1 \
 diff --git a/config/config.go b/config/config.go
-index bfcbecf..2f4e703 100644
+index 32d07fc..8ffd3e8 100644
 --- a/config/config.go
 +++ b/config/config.go
-@@ -377,6 +377,9 @@ func LoadConfigFromFile(root *string, sharedir string) (*AercConfig, error) {
+@@ -355,6 +355,11 @@ func LoadConfigFromFile(root *string, sharedir string) (*AercConfig, error) {
+ 			return nil, err
+ 		}
+ 	}
++	if sec, err := file.GetSection("templates"); err == nil {
++		if key, err := sec.GetKey("template-dirs"); err == nil {
++			sec.NewKey("template-dirs", strings.ReplaceAll(key.String(), "@SHAREDIR@", sharedir))
++		}
++	}
+ 	file.NameMapper = mapName
+ 	config := &AercConfig{
+ 		Bindings: BindingConfig{
+@@ -423,6 +428,9 @@ func LoadConfigFromFile(root *string, sharedir string) (*AercConfig, error) {
  	if err = config.LoadConfig(file); err != nil {
  		return nil, err
  	}
diff --git a/pkgs/applications/version-management/git-and-tools/git-subrepo/default.nix b/pkgs/applications/version-management/git-and-tools/git-subrepo/default.nix
index b196d39b46f6..969ea7cc2fa6 100644
--- a/pkgs/applications/version-management/git-and-tools/git-subrepo/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-subrepo/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/ingydotnet/git-subrepo;
     description = "Git submodule alternative";
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = platforms.unix ++ platforms.darwin;
     maintainers = [ maintainers.ryantrinkle ];
   };
 }
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 42cc127e40d0..722bbc11b30a 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,9 +1,9 @@
 {
-  "version": "12.4.2",
-  "repo_hash": "00y8n0y7wydwxq62fyf7hcpx90zz5sw458m2773lz7pdgnpnrdc2",
+  "version": "12.4.3",
+  "repo_hash": "1qsd3qxvvb3rbyrlyrqvrday4c9s2krgics99ch7v74hprj3xfq9",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v12.4.2-ee",
+  "rev": "v12.4.3-ee",
   "passthru": {
     "GITALY_SERVER_VERSION": "1.67.0",
     "GITLAB_PAGES_VERSION": "1.11.0",
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
index 5b5d0b99bcfe..d5ea22f960bb 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
@@ -163,6 +163,15 @@
     };
   }
   {
+    goPackagePath = "github.com/golang/lint";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/lint";
+      rev = "06c8688daad7";
+      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
+    };
+  }
+  {
     goPackagePath = "github.com/golang/mock";
     fetch = {
       type = "git";
@@ -253,6 +262,15 @@
     };
   }
   {
+    goPackagePath = "github.com/kisielk/gotool";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kisielk/gotool";
+      rev = "v1.0.0";
+      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
+    };
+  }
+  {
     goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
     fetch = {
       type = "git";
diff --git a/pkgs/applications/video/clipgrab/default.nix b/pkgs/applications/video/clipgrab/default.nix
index 145b7cc06c2d..ad175b246766 100644
--- a/pkgs/applications/video/clipgrab/default.nix
+++ b/pkgs/applications/video/clipgrab/default.nix
@@ -5,10 +5,10 @@
 
 mkDerivation rec {
   pname = "clipgrab";
-  version = "3.8.5";
+  version = "3.8.6";
 
   src = fetchurl {
-    sha256 = "0jfjnzwvz4ynlld0ih7f7d575s5w2dag0hvb02c6qan7xm5jdhv9";
+    sha256 = "1w2j1wk9sf22nnschlraxdbxabqblrxyb8kq0lkyk7dkfa5d0hdq";
     # The .tar.bz2 "Download" link is a binary blob, the source is the .tar.gz!
     url = "https://download.clipgrab.org/${pname}-${version}.tar.gz";
   };
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 4dfbf2418c9b..c60abdd03e81 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -184,6 +184,7 @@ stdenv.mkDerivation {
       else if targetPlatform.isMsp430 then "msp430"
       else if targetPlatform.isAvr then "avr"
       else if targetPlatform.isAlpha then "alpha"
+      else if targetPlatform.isVc4 then "vc4"
       else throw "unknown emulation for platform: ${targetPlatform.config}";
     in if targetPlatform.useLLVM or false then ""
        else targetPlatform.platform.bfdEmulation or (fmt + sep + arch);
diff --git a/pkgs/build-support/setup-hooks/set-java-classpath.sh b/pkgs/build-support/setup-hooks/set-java-classpath.sh
index 5d3548dc2e88..445fa56d61de 100644
--- a/pkgs/build-support/setup-hooks/set-java-classpath.sh
+++ b/pkgs/build-support/setup-hooks/set-java-classpath.sh
@@ -6,7 +6,7 @@ export CLASSPATH
 addPkgToClassPath () {
     local jar
     for jar in $1/share/java/*.jar; do
-        export CLASSPATH=''${CLASSPATH}''${CLASSPATH:+:}''${jar}
+        export CLASSPATH=''${CLASSPATH-}''${CLASSPATH:+:}''${jar}
     done
 }
 
diff --git a/pkgs/misc/themes/adapta-kde/default.nix b/pkgs/data/themes/adapta-kde/default.nix
index a7624d2889bb..47740aa67622 100644
--- a/pkgs/misc/themes/adapta-kde/default.nix
+++ b/pkgs/data/themes/adapta-kde/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "adapta-kde-theme";
-  version = "20180512";
+  version = "20180828";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "adapta-kde";
     rev = version;
-    sha256 = "1lgpkylhzbayk892inql16sjyy9d3v126f9i1v7qgha1203rwcji";
+    sha256 = "1q85678sff8is2kwvgd703ckcns42gdga2c1rqlp61gb6bqf09j8";
   };
 
-  makeFlags = ["PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" ];
 
   # Make this a fixed-output derivation
   outputHashMode = "recursive";
diff --git a/pkgs/misc/themes/adapta/default.nix b/pkgs/data/themes/adapta/default.nix
index 02812b1f9397..02812b1f9397 100644
--- a/pkgs/misc/themes/adapta/default.nix
+++ b/pkgs/data/themes/adapta/default.nix
diff --git a/pkgs/misc/themes/adwaita-qt/default.nix b/pkgs/data/themes/adwaita-qt/default.nix
index 16ccee8540bf..16ccee8540bf 100644
--- a/pkgs/misc/themes/adwaita-qt/default.nix
+++ b/pkgs/data/themes/adwaita-qt/default.nix
diff --git a/pkgs/misc/themes/albatross/default.nix b/pkgs/data/themes/albatross/default.nix
index 870b348cc320..870b348cc320 100644
--- a/pkgs/misc/themes/albatross/default.nix
+++ b/pkgs/data/themes/albatross/default.nix
diff --git a/pkgs/misc/themes/arc-kde/default.nix b/pkgs/data/themes/arc-kde/default.nix
index decdbdfac2dc..4937a99daecd 100644
--- a/pkgs/misc/themes/arc-kde/default.nix
+++ b/pkgs/data/themes/arc-kde/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "arc-kde-theme";
-  version = "2017-11-09";
+  version = "20180614";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "arc-kde";
-    rev = "a0abe6fc5ebf74f9ae88b8a2035957cc16f706f5";
-    sha256 = "1p6f4ny97096nb054lrgyjwikmvg0qlbcnsjag7m5dfbclfnvzkg";
+    rev = version;
+    sha256 = "0wli16k9my7m8a9561545vjwfifmxm4w606z1h0j08msvlky40xw";
   };
 
-  makeFlags = ["PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" ];
 
   # Make this a fixed-output derivation
   outputHashMode = "recursive";
diff --git a/pkgs/misc/themes/blackbird/default.nix b/pkgs/data/themes/blackbird/default.nix
index 7ffefb1d67f6..7ffefb1d67f6 100644
--- a/pkgs/misc/themes/blackbird/default.nix
+++ b/pkgs/data/themes/blackbird/default.nix
diff --git a/pkgs/misc/themes/clearlooks-phenix/default.nix b/pkgs/data/themes/clearlooks-phenix/default.nix
index 7c1eb54f92f5..2f701b9b765b 100644
--- a/pkgs/misc/themes/clearlooks-phenix/default.nix
+++ b/pkgs/data/themes/clearlooks-phenix/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchzip }:
 
 stdenv.mkDerivation rec {
   version = "7.0.1";
   pname = "clearlooks-phenix";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://github.com/jpfleury/clearlooks-phenix/archive/${version}.tar.gz";
-    sha256 = "1x2psfbhxc3bk3q795bafxv6p890yfsankfw64p44q4r1x0236ra";
+    sha256 = "1b6y4l3rf3c5r4v72fyj3ppvnvw13kvr2a1dyl63ni1jxnlk50kd";
   };
 
   dontBuild = true;
diff --git a/pkgs/misc/themes/e17gtk/default.nix b/pkgs/data/themes/e17gtk/default.nix
index 74f0a54ccef3..74f0a54ccef3 100644
--- a/pkgs/misc/themes/e17gtk/default.nix
+++ b/pkgs/data/themes/e17gtk/default.nix
diff --git a/pkgs/misc/themes/equilux-theme/default.nix b/pkgs/data/themes/equilux-theme/default.nix
index f24524eb6b97..f24524eb6b97 100644
--- a/pkgs/misc/themes/equilux-theme/default.nix
+++ b/pkgs/data/themes/equilux-theme/default.nix
diff --git a/pkgs/misc/themes/gnome-breeze/default.nix b/pkgs/data/themes/gnome-breeze/default.nix
index 200cc4bae051..200cc4bae051 100644
--- a/pkgs/misc/themes/gnome-breeze/default.nix
+++ b/pkgs/data/themes/gnome-breeze/default.nix
diff --git a/pkgs/misc/themes/kde2/default.nix b/pkgs/data/themes/kde2/default.nix
index fac8c38eecae..547e4f30aa6c 100644
--- a/pkgs/misc/themes/kde2/default.nix
+++ b/pkgs/data/themes/kde2/default.nix
@@ -1,18 +1,17 @@
-{ stdenv, fetchFromGitHub, mkDerivation
+{ lib, fetchFromGitHub, mkDerivation
 , cmake, extra-cmake-modules
-, qtbase, kcoreaddons, kdecoration }:
+, qtbase, kcoreaddons, kdecoration
+}:
 
-let
-  version = "2017-03-15";
-in mkDerivation rec {
+mkDerivation rec {
   pname = "kde2-decoration";
-  inherit version;
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "repos-holder";
     repo = "kdecoration2-kde2";
-    rev = "2a9cf18ac0646b3532d4db2dd28bd73c4c229783";
-    sha256 = "0kilw6sd3blvm6gx9w4w5ivkjfxlv6wnyivw46pwwvhgxqymkbxk";
+    rev = version;
+    sha256 = "1766z9wscybcqvr828xih93b3rab3hb0ghsf818iflhp1xy0js08";
   };
 
   enableParallelBuilding = true;
@@ -21,9 +20,9 @@ in mkDerivation rec {
 
   buildInputs = [ qtbase kcoreaddons kdecoration ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "KDE 2 window decoration ported to Plasma 5";
-    homepage = src.meta.homepage;
+    homepage = "https://github.com/repos-holder/kdecoration2-kde2";
     license = licenses.bsd2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ gnidorah ];
diff --git a/pkgs/misc/themes/numix-solarized/default.nix b/pkgs/data/themes/numix-solarized/default.nix
index 0596141da80b..0596141da80b 100644
--- a/pkgs/misc/themes/numix-solarized/default.nix
+++ b/pkgs/data/themes/numix-solarized/default.nix
diff --git a/pkgs/misc/themes/numix-sx/default.nix b/pkgs/data/themes/numix-sx/default.nix
index 72e87e2e2740..72e87e2e2740 100644
--- a/pkgs/misc/themes/numix-sx/default.nix
+++ b/pkgs/data/themes/numix-sx/default.nix
diff --git a/pkgs/misc/themes/numix/default.nix b/pkgs/data/themes/numix/default.nix
index e01f8174e9ea..e01f8174e9ea 100644
--- a/pkgs/misc/themes/numix/default.nix
+++ b/pkgs/data/themes/numix/default.nix
diff --git a/pkgs/misc/themes/onestepback/default.nix b/pkgs/data/themes/onestepback/default.nix
index 64ead2f75f4b..64ead2f75f4b 100644
--- a/pkgs/misc/themes/onestepback/default.nix
+++ b/pkgs/data/themes/onestepback/default.nix
diff --git a/pkgs/misc/themes/orion/default.nix b/pkgs/data/themes/orion/default.nix
index 9ba8cd368cf7..9ba8cd368cf7 100644
--- a/pkgs/misc/themes/orion/default.nix
+++ b/pkgs/data/themes/orion/default.nix
diff --git a/pkgs/misc/themes/paper/default.nix b/pkgs/data/themes/paper-gtk/default.nix
index e7235a900cf9..e7235a900cf9 100644
--- a/pkgs/misc/themes/paper/default.nix
+++ b/pkgs/data/themes/paper-gtk/default.nix
diff --git a/pkgs/misc/themes/qtcurve/default.nix b/pkgs/data/themes/qtcurve/default.nix
index 0071e386e88c..673b97cc137c 100644
--- a/pkgs/misc/themes/qtcurve/default.nix
+++ b/pkgs/data/themes/qtcurve/default.nix
@@ -11,7 +11,7 @@ in mkDerivation {
   pname = "qtcurve";
   inherit version;
   src = fetchurl {
-    url = "http://download.kde.org/stable/qtcurve/qtcurve-${version}.tar.xz";
+    url = "https://download.kde.org/stable/qtcurve/qtcurve-${version}.tar.xz";
     sha256 = "169gdny1cdld0qnx3nqvx568zjzdba4pwp3gxapc1hdh2cymw7r8";
   };
 
diff --git a/pkgs/misc/themes/solarc/default.nix b/pkgs/data/themes/solarc/default.nix
index 96843e8d78b4..96843e8d78b4 100644
--- a/pkgs/misc/themes/solarc/default.nix
+++ b/pkgs/data/themes/solarc/default.nix
diff --git a/pkgs/misc/themes/vertex/default.nix b/pkgs/data/themes/vertex/default.nix
index 81c681f53715..81c681f53715 100644
--- a/pkgs/misc/themes/vertex/default.nix
+++ b/pkgs/data/themes/vertex/default.nix
diff --git a/pkgs/desktops/gnome-3/apps/accerciser/default.nix b/pkgs/desktops/gnome-3/apps/accerciser/default.nix
index c801657f74bf..0b833a876b61 100644
--- a/pkgs/desktops/gnome-3/apps/accerciser/default.nix
+++ b/pkgs/desktops/gnome-3/apps/accerciser/default.nix
@@ -17,13 +17,13 @@
 
  python3.pkgs.buildPythonApplication rec {
   name = "accerciser-${version}";
-  version = "3.34.1";
+  version = "3.34.2";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/accerciser/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1awf7fcm52r23s51gllyybhywf2kljqkaw4znblajph9sawnfs3l";
+    sha256 = "1n6sy95j0r0v01sc9rbbpzikq2z4z42j8ah73hzmjdmck4iniik4";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome-3/apps/file-roller/default.nix b/pkgs/desktops/gnome-3/apps/file-roller/default.nix
index 36b89a310522..387f0ebdc446 100644
--- a/pkgs/desktops/gnome-3/apps/file-roller/default.nix
+++ b/pkgs/desktops/gnome-3/apps/file-roller/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "file-roller";
-  version = "3.32.2";
+  version = "3.32.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/file-roller/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0w8s6hakgsvb2nqwbv0lr8ki4cbf1pz5z3qwkb0b2k7ppbh7j2n6";
+    sha256 = "0ap2hxvjljh4p6wsd9ikh2my3vsxp9r2nvjxxj3v87nwfyw1y4dy";
   };
 
   LANG = "en_US.UTF-8"; # postinstall.py
diff --git a/pkgs/desktops/gnome-3/core/epiphany/default.nix b/pkgs/desktops/gnome-3/core/epiphany/default.nix
index bfcf01591e56..f042bbd146a4 100644
--- a/pkgs/desktops/gnome-3/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/core/epiphany/default.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "epiphany";
-  version = "3.34.1";
+  version = "3.34.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1nf1pqv3pdgrlq7fbic06rl3731dx5ihpfsphpai9grcmnbwjyx0";
+    sha256 = "18d48vcp2nxs63bddkdplslgbnlfq79pm2ivl8hk38kkggy3dahf";
   };
 
   # Tests need an X display
diff --git a/pkgs/desktops/gnustep/make/setup-hook.sh b/pkgs/desktops/gnustep/make/setup-hook.sh
index 531389011164..b2b90f1e5222 100644
--- a/pkgs/desktops/gnustep/make/setup-hook.sh
+++ b/pkgs/desktops/gnustep/make/setup-hook.sh
@@ -20,57 +20,57 @@ addEnvVars() {
     local filename
 
     for filename in $1/share/GNUstep/Makefiles/Additional/*.make ; do
-	if case "$NIX_GNUSTEP_MAKEFILES_ADDITIONAL" in *"{$filename}"*) false;; *) true;; esac; then
+	if case "${NIX_GNUSTEP_MAKEFILES_ADDITIONAL-}" in *"{$filename}"*) false;; *) true;; esac; then
 	    export NIX_GNUSTEP_MAKEFILES_ADDITIONAL+=" $filename"
 	fi
     done
 
     local tmp="$1/lib/GNUstep/Applications"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_APPS" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$tmp"
     fi
     tmp="$1/lib/GNUstep/Applications"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_APPS" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$tmp"
     fi
     tmp="$1/lib/GNUstep/WebApplications"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_WEB_APPS" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_WEB_APPS-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$tmp"
     fi
     tmp="$1/bin"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$tmp"
     fi
     tmp="$1/sbin"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$tmp"
     fi
     tmp="$1/lib/GNUstep"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARY" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARY-}" in *"${tmp}"*) false;; *) true;; esac; then
     	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$tmp"
     fi
     tmp="$1/include"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_HEADERS" in *"${tmp}"*) false;; *) true;; esac; then
-    	if [ -z "$NIX_GNUSTEP_SYSTEM_HEADERS" ]; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_HEADERS-}" in *"${tmp}"*) false;; *) true;; esac; then
+    	if [ -z "${NIX_GNUSTEP_SYSTEM_HEADERS-}" ]; then
     	    export NIX_GNUSTEP_SYSTEM_HEADERS="$tmp"
     	else
     	    export NIX_GNUSTEP_SYSTEM_HEADERS+=" $tmp"
     	fi
     fi
     tmp="$1/lib"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_LIBRARIES" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_LIBRARIES-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$tmp"
     fi
     tmp="$1/share/GNUstep/Documentation"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$tmp"
     fi
     tmp="$1/share/man"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_MAN" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_MAN-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$tmp"
     fi
     tmp="$1/share/info"
-    if [ -d "$tmp" ] && case "$NIX_GNUSTEP_SYSTEM_DOC_INFO" in *"${tmp}"*) false;; *) true;; esac; then
+    if [ -d "$tmp" ] && case "${NIX_GNUSTEP_SYSTEM_DOC_INFO-}" in *"${tmp}"*) false;; *) true;; esac; then
 	addToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$tmp"
     fi
 }
diff --git a/pkgs/desktops/plasma-5/default.nix b/pkgs/desktops/plasma-5/default.nix
index d80f51831fd9..a199a4a959db 100644
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@@ -43,11 +43,11 @@ let
       propagate = out:
         let setupHook = { writeScript }:
               writeScript "setup-hook" ''
-                if [ "''${hookName:-}" != postHook ]; then
+                if [[ "''${hookName-}" != postHook ]]; then
                     postHooks+=("source @dev@/nix-support/setup-hook")
                 else
                     # Propagate $${out} output
-                    propagatedUserEnvPkgs="$propagatedUserEnvPkgs @${out}@"
+                    propagatedUserEnvPkgs+=" @${out}@"
 
                     if [ -z "$outputDev" ]; then
                         echo "error: \$outputDev is unset!" >&2
@@ -57,7 +57,7 @@ let
                     # Propagate $dev so that this setup hook is propagated
                     # But only if there is a separate $dev output
                     if [ "$outputDev" != out ]; then
-                        propagatedBuildInputs="$propagatedBuildInputs @dev@"
+                        propagatedBuildInputs+=" @dev@"
                     fi
                 fi
               '';
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index b92590aaa165..3ac4fa7032a7 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
+{ stdenv, targetPackages, fetchurl, fetchpatch, fetchFromGitHub, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
@@ -9,6 +9,7 @@
 , enableShared ? true
 , enableLTO ? true
 , texinfo ? null
+, flex
 , perl ? null # optional, for texi2pod (then pod2man); required for Java
 , gmp, mpfr, libmpc, gettext, which
 , libelf                      # optional, for link-time optimizations (LTO)
@@ -108,7 +109,12 @@ stdenv.mkDerivation ({
 
   builder = ../builder.sh;
 
-  src = fetchurl {
+  src = if stdenv.targetPlatform.isVc4 then fetchFromGitHub {
+    owner = "itszor";
+    repo = "gcc-vc4";
+    rev = "e90ff43f9671c760cf0d1dd62f569a0fb9bf8918";
+    sha256 = "0gxf66hwqk26h8f853sybphqa5ca0cva2kmrw5jsiv6139g0qnp8";
+  } else fetchurl {
     url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz";
     sha256 = "0i89fksfp6wr1xg9l8296aslcymv2idn60ip31wr9s4pwin7kwby";
   };
@@ -173,7 +179,8 @@ stdenv.mkDerivation ({
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ texinfo which gettext ]
     ++ (optional (perl != null) perl)
-    ++ (optional javaAwtGtk pkgconfig);
+    ++ (optional javaAwtGtk pkgconfig)
+    ++ (optional (stdenv.targetPlatform.isVc4) flex);
 
   # For building runtime libs
   depsBuildTarget =
diff --git a/pkgs/development/compilers/ghcjs-ng/configured-ghcjs-src.nix b/pkgs/development/compilers/ghcjs-ng/configured-ghcjs-src.nix
index 56b69ea267f9..943866d5f24e 100644
--- a/pkgs/development/compilers/ghcjs-ng/configured-ghcjs-src.nix
+++ b/pkgs/development/compilers/ghcjs-ng/configured-ghcjs-src.nix
@@ -16,7 +16,7 @@
 }:
 
 runCommand "configured-ghcjs-src" {
-  buildInputs = [
+  nativeBuildInputs = [
     perl
     autoconf
     automake
diff --git a/pkgs/development/compilers/scala/dotty-bare.nix b/pkgs/development/compilers/scala/dotty-bare.nix
index 5a01e295e49e..675e91b302a7 100644
--- a/pkgs/development/compilers/scala/dotty-bare.nix
+++ b/pkgs/development/compilers/scala/dotty-bare.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre, ncurses }:
 
 stdenv.mkDerivation rec {
-  version = "0.14.0-RC1";
+  version = "0.20.0-RC1";
   pname = "dotty-bare";
 
   src = fetchurl {
     url = "https://github.com/lampepfl/dotty/releases/download/${version}/dotty-${version}.tar.gz";
-    sha256 = "0nrgsyhqjlpvnjqgb18pryr8q7knq3dq25jhp98s4wh76nssm1zr";
+    sha256 = "08qs3m32cbh6516gcwraa1b5k935awmjxls6kg6xll722hkdd9l6";
   };
 
   propagatedBuildInputs = [ jre ncurses.dev ] ;
@@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
     homepage = http://dotty.epfl.ch/;
     license = licenses.bsd3;
     platforms = platforms.all;
-    maintainers = [maintainers.karolchmist];
+    maintainers = [maintainers.karolchmist maintainers.virusdave];
   };
 }
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index b5a7c2b467ef..7b730fc39265 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.10.1.469";
+  version = "1.10.1.489";
 
   src = fetchurl {
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "0hpb6rixmgllss69vl9zlpb41svm4mx4xmfbq1q7y12jsxckzgpq";
+    sha256 = "12ks7adh5cx99l5vydppkqknk5nvv9vsj2k0afcwwxd897m794kz";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/development/libraries/armadillo/default.nix b/pkgs/development/libraries/armadillo/default.nix
index a74e883dca52..a9fc7d569efd 100644
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "armadillo";
-  version = "9.800.1";
+  version = "9.800.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "1vnshgkz4d992kk2fwqigqfx7gx3145ryb8d2794hn2667h5gkzb";
+    sha256 = "0mslyfzwb8zdhchhj7szj25qi2ain7cnlsrzccrfm2mr4a6jv5h9";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/bcg729/default.nix b/pkgs/development/libraries/bcg729/default.nix
new file mode 100644
index 000000000000..4363948e830d
--- /dev/null
+++ b/pkgs/development/libraries/bcg729/default.nix
@@ -0,0 +1,43 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bcg729";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "BelledonneCommunications";
+    repo = pname;
+    rev = version;
+    sha256 = "05s0c5ps3a763y0v34wg5zghj0cdjnq4ch7g81848xxry7q90fwa";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/BelledonneCommunications/bcg729/commit/a5907daf1b111e4ad7aab4f558f57e2af1e37e55.patch";
+      sha256 = "0445syfwj4w4chh8ak80rq77iqcr27924n1ld5snshk3d21nxd64";
+    })
+    (fetchpatch {
+      url = "https://github.com/BelledonneCommunications/bcg729/commit/697bf6653a8c7421f0e821ee8d42471246e6850f.patch";
+      sha256 = "1h3gf5sj2sg5cs5iv1lcav3lkqmd5jf4agvjzz83l89wd5f5hp5l";
+    })
+    (fetchpatch {
+      url = "https://github.com/BelledonneCommunications/bcg729/commit/d63ce04a93711820d9a6985b1d11d8d91ed8e6b6.patch";
+      sha256 = "1piwf63ci2gma6jd6b4adkvxirysvazf0vklb5pc6vx1g93nkgxs";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with stdenv.lib; {
+    description = "Opensource implementation of both encoder and decoder of the ITU G729 Annex A/B speech codec";
+    homepage = "https://linphone.org/technical-corner/bcg729";
+    changelog = "https://gitlab.linphone.org/BC/public/bcg729/raw/${version}/NEWS";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ c0bw3b ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/libraries/bctoolbox/default.nix b/pkgs/development/libraries/bctoolbox/default.nix
index 2730696344e0..a9d21a1f5a96 100644
--- a/pkgs/development/libraries/bctoolbox/default.nix
+++ b/pkgs/development/libraries/bctoolbox/default.nix
@@ -1,19 +1,23 @@
-{stdenv, fetchFromGitHub, cmake, mbedtls, bcunit, srtp}:
+{ stdenv, fetchFromGitHub, cmake, bcunit, mbedtls }:
+
 stdenv.mkDerivation rec {
-  name = "${baseName}-${version}";
-  baseName = "bctoolbox";
+  pname = "bctoolbox";
   version = "0.6.0";
-  buildInputs = [cmake mbedtls bcunit srtp];
+
+  nativeBuildInputs = [ cmake bcunit ];
+  buildInputs = [ mbedtls ];
+
   src = fetchFromGitHub {
     owner = "BelledonneCommunications";
-    repo = baseName;
+    repo = pname;
     rev = version;
     sha256 = "1cxx243wyzkd4xnvpyqf97n0rjhfckpvw1vhwnbwshq3q6fra909";
   };
 
   meta = {
     inherit version;
-    description = ''Utilities library for Linphone'';
+    description = "Utilities library for Linphone";
+    homepage = "https://github.com/BelledonneCommunications/bctoolbox";
     license = stdenv.lib.licenses.gpl2Plus ;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/belle-sip/default.nix b/pkgs/development/libraries/belle-sip/default.nix
index d4420e40ab69..1745614f741c 100644
--- a/pkgs/development/libraries/belle-sip/default.nix
+++ b/pkgs/development/libraries/belle-sip/default.nix
@@ -1,15 +1,14 @@
-{ stdenv, antlr3_4, libantlr3c, jre, polarssl, fetchFromGitHub
+{ stdenv, antlr3_4, libantlr3c, jre, mbedtls, fetchFromGitHub
   , cmake, zlib, bctoolbox
 }:
 
 stdenv.mkDerivation rec {
-  baseName = "belle-sip";
+  pname = "belle-sip";
   version = "1.6.3";
-  name = "${baseName}-${version}";
 
   src = fetchFromGitHub {
     owner = "BelledonneCommunications";
-    repo = baseName;
+    repo = pname;
     rev = version;
     sha256 = "0q70db1klvhca1af29bm9paka3gyii5hfbzrj4178gclsg7cj8fk";
   };
@@ -24,18 +23,14 @@ stdenv.mkDerivation rec {
     "-Wno-error=cast-function-type"
   ];
 
-  propagatedBuildInputs = [ antlr3_4 libantlr3c polarssl bctoolbox ];
-
-  configureFlags = [
-    "--with-polarssl=${polarssl}"
-  ];
+  propagatedBuildInputs = [ antlr3_4 libantlr3c mbedtls bctoolbox ];
 
   # Fails to build with lots of parallel jobs
   enableParallelBuilding = false;
 
   meta = with stdenv.lib; {
-    homepage = http://www.linphone.org/index.php/eng;
-    description = "A Voice-over-IP phone";
+    homepage = https://linphone.org/technical-corner/belle-sip;
+    description = "Modern library implementing SIP (RFC 3261) transport, transaction and dialog layers";
     license = licenses.gpl2;
     platforms = platforms.all;
   };
diff --git a/pkgs/development/libraries/catch2/default.nix b/pkgs/development/libraries/catch2/default.nix
index 19768d77a8dd..86a5e52353ad 100644
--- a/pkgs/development/libraries/catch2/default.nix
+++ b/pkgs/development/libraries/catch2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "2.10.2";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    sha256="01ldfv4337s3vdhsx415d49jchpvqy61c77dhnri30ip5af0ipjs";
+    sha256="1b07drrclvxj17s67ivypr9vr27rg0m36jqnrbci6f4wsp1b0gbl";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/misc/themes/gtk2/gtk-engine-bluecurve/default.nix b/pkgs/development/libraries/gtk-engine-bluecurve/default.nix
index 99ca221f5ba2..99ca221f5ba2 100644
--- a/pkgs/misc/themes/gtk2/gtk-engine-bluecurve/default.nix
+++ b/pkgs/development/libraries/gtk-engine-bluecurve/default.nix
diff --git a/pkgs/misc/themes/gtk2/gtk-engine-murrine/default.nix b/pkgs/development/libraries/gtk-engine-murrine/default.nix
index 9acb7b25a0dd..9acb7b25a0dd 100644
--- a/pkgs/misc/themes/gtk2/gtk-engine-murrine/default.nix
+++ b/pkgs/development/libraries/gtk-engine-murrine/default.nix
diff --git a/pkgs/misc/themes/gtk2/gtk-engines/default.nix b/pkgs/development/libraries/gtk-engines/default.nix
index 2f56f6eb4c5c..2f56f6eb4c5c 100644
--- a/pkgs/misc/themes/gtk2/gtk-engines/default.nix
+++ b/pkgs/development/libraries/gtk-engines/default.nix
diff --git a/pkgs/development/libraries/kde-frameworks/default.nix b/pkgs/development/libraries/kde-frameworks/default.nix
index 845c911789d0..9e03965441ef 100644
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@@ -48,7 +48,7 @@ let
                     # Propagate $dev so that this setup hook is propagated
                     # But only if there is a separate $dev output
                     if [ "''${outputDev:?}" != out ]; then
-                        propagatedBuildInputs="$propagatedBuildInputs @dev@"
+                        propagatedBuildInputs="''${propagatedBuildInputs-} @dev@"
                     fi
                 fi
               '';
diff --git a/pkgs/development/libraries/libmodule/default.nix b/pkgs/development/libraries/libmodule/default.nix
index bcd20c3b4076..26b81d4d4129 100644
--- a/pkgs/development/libraries/libmodule/default.nix
+++ b/pkgs/development/libraries/libmodule/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmodule";
-  version = "4.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "libmodule";
     rev = version;
-    sha256 = "1qn54pysdm0q7v1gnisd43i5i4ylf8s8an77jk6jd8qimysv08mx";
+    sha256 = "1cf81sl33xmfn5g150iqcdrjn0lpjlgp53mganwi6x7jda2qk7r6";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/mediastreamer/default.nix b/pkgs/development/libraries/mediastreamer/default.nix
index a338c9b49db5..1605ec355cc0 100644
--- a/pkgs/development/libraries/mediastreamer/default.nix
+++ b/pkgs/development/libraries/mediastreamer/default.nix
@@ -1,17 +1,16 @@
 { stdenv, pkgconfig, intltool, alsaLib, libpulseaudio, speex, gsm
 , libopus, ffmpeg, libX11, libXv, libGLU, libGL, glew, libtheora, libvpx, SDL, libupnp
 , ortp, libv4l, libpcap, srtp, fetchFromGitHub, cmake, bctoolbox, doxygen
-, python, libXext, libmatroska, openssl, fetchpatch
+, python, libXext, libmatroska, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
-  baseName = "mediastreamer2";
+  pname = "mediastreamer2";
   version = "2.16.1";
-  name = "${baseName}-${version}";
 
   src = fetchFromGitHub {
     owner = "BelledonneCommunications";
-    repo = baseName;
+    repo = pname;
     rev = version;
     sha256 = "02745bzl2r1jqvdqzyv94fjd4w92zr976la4c4nfvsy52waqah7j";
   };
@@ -31,19 +30,18 @@ stdenv.mkDerivation rec {
     alsaLib libpulseaudio speex gsm libopus
     ffmpeg libX11 libXv libGLU libGL glew libtheora libvpx SDL libupnp
     ortp libv4l libpcap srtp bctoolbox libXext libmatroska
-    openssl
   ];
 
   NIX_CFLAGS_COMPILE = [
-    "-DGIT_VERSION=\"v2.14.0\""
+    "-DGIT_VERSION=\"v${version}\""
     "-Wno-error=deprecated-declarations"
     "-Wno-error=cast-function-type"
   ];
-  NIX_LDFLAGS = "-lXext -lssl";
+  NIX_LDFLAGS = "-lXext";
 
   meta = with stdenv.lib; {
     description = "A powerful and lightweight streaming engine specialized for voice/video telephony applications";
-    homepage = http://www.linphone.org/technical-corner/mediastreamer2/overview;
+    homepage = http://www.linphone.org/technical-corner/mediastreamer2;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/mediastreamer/msopenh264.nix b/pkgs/development/libraries/mediastreamer/msopenh264.nix
index 38261bd1e53a..f1e9fc301510 100644
--- a/pkgs/development/libraries/mediastreamer/msopenh264.nix
+++ b/pkgs/development/libraries/mediastreamer/msopenh264.nix
@@ -1,23 +1,30 @@
 { stdenv, autoreconfHook, pkgconfig, mediastreamer, openh264
-, fetchgit, cmake
+, fetchurl, fetchpatch, cmake
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "mediastreamer-openh264";
-  version = "0.0pre20160801";
+  version = "1.2.1";
 
-  src = fetchgit {
-    url = "git://git.linphone.org/msopenh264.git";
-    rev = "4cb4b134bf0f1538fd0c2c928eee2d5388115abc";
-    sha256 = "001km4xy1ifwbg1c19ncc75h867fzfcxy9pxvl4pxqb64169xc1k";
+  src = fetchurl {
+    url = "https://www.linphone.org/releases/sources/plugins/msopenh264/msopenh264-${version}.tar.gz";
+    sha256 = "0rdxgazm52560g52pp6mp3mwx6j1z3h2zyizzfycp8y8zi92fqm8";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "msopenh264-build-with-openh264-v2.patch";
+      url = "https://git.pld-linux.org/?p=packages/mediastreamer-plugin-msopenh264.git;a=blob_plain;f=mediastreamer-plugin-msopenh264-openh264.patch;hb=344b8af379701a7e58b4ffb3cbac1517eff079fd";
+      sha256 = "10c24b0afchx78q28176pd8iz7i1nlf57f6v6lyqxpz60fm5nrcc";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook cmake pkgconfig ];
   buildInputs = [ mediastreamer openh264 ];
 
   meta = with stdenv.lib; {
     description = "H.264 encoder/decoder plugin for mediastreamer2";
-    homepage = http://www.linphone.org/technical-corner/mediastreamer2/overview;
+    homepage = "https://www.linphone.org/technical-corner/mediastreamer2";
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/development/libraries/ortp/default.nix b/pkgs/development/libraries/ortp/default.nix
index 58f355b27fe1..7be0e4bb06ab 100644
--- a/pkgs/development/libraries/ortp/default.nix
+++ b/pkgs/development/libraries/ortp/default.nix
@@ -1,13 +1,12 @@
 { stdenv, cmake, fetchFromGitHub, bctoolbox }:
 
 stdenv.mkDerivation rec {
-  baseName = "ortp";
+  pname = "ortp";
   version = "1.0.2";
-  name = "${baseName}-${version}";
 
   src = fetchFromGitHub {
     owner = "BelledonneCommunications";
-    repo = baseName;
+    repo = pname;
     rev = version;
     sha256 = "12cwv593bsdnxs0zfcp07vwyk7ghlz2wv7vdbs1ksv293w3vj2rv";
   };
@@ -17,8 +16,8 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A Real-Time Transport Protocol (RFC3550) stack";
-    homepage = http://www.linphone.org/index.php/eng/code_review/ortp;
-    license = licenses.lgpl21;
+    homepage = https://linphone.org/technical-corner/ortp;
+    license = licenses.gpl2Plus;
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 0a37b1ce39a3..8d27f3a0d4ba 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -80,15 +80,6 @@ let
         url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/qtbug-77037-workaround.patch?h=packages/qt5-webengine&id=fc77d6b3d5ec74e421b58f199efceb2593cbf951";
         sha256 = "1gv733qfdn9746nbqqxzyjx4ijjqkkb7zb71nxax49nna5bri3am";
       })
-      # patch for CVE-2019-13720, can be removed when it is included in the next upstream release
-      # https://bugreports.qt.io/browse/QTBUG-1019226
-      (fetchpatch {
-        name = "qtwebengine-CVE-2019-13720.patch";
-        url = "https://code.qt.io/cgit/qt/qtwebengine-chromium.git/patch/?id=d6e5fc10";
-        sha256 = "0ywc12m196pr6xn7l5xbascihygkjj4pbcgcn9wxvi5ssdr6z46z";
-        extraPrefix = "src/3rdparty/";
-        stripLen = 1;
-      })
     ]
       ++ optional stdenv.isDarwin ./qtwebengine-darwin-no-platform-check.patch;
     qtwebkit = [ ./qtwebkit.patch ]
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 076376dc3c15..a7d01e22d962 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -1,6 +1,6 @@
 {
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   gfortran,
   cmake,
   python2,
@@ -8,19 +8,22 @@
 }:
 let
   inherit (stdenv.lib) optional;
-  version = "3.8.0";
+  version = "3.9.0";
 in
 
 stdenv.mkDerivation {
   pname = "liblapack";
   inherit version;
-  src = fetchurl {
-    url = "http://www.netlib.org/lapack/lapack-${version}.tar.gz";
-    sha256 = "1xmwi2mqmipvg950gb0rhgprcps8gy8sjm8ic9rgy2qjlv22rcny";
+
+  src = fetchFromGitHub {
+    owner = "Reference-LAPACK";
+    repo = "lapack";
+    rev = "v${version}";
+    sha256 = "0sxnc97z67i7phdmcnq8f8lmxgw10wdwvr8ami0w3pb179cgrbpb";
   };
 
-  buildInputs = [ gfortran cmake ];
-  nativeBuildInputs = [ python2 ];
+  buildInputs = [ gfortran ];
+  nativeBuildInputs = [ python2 cmake ];
 
   cmakeFlags = [
     "-DCMAKE_Fortran_FLAGS=-fPIC"
diff --git a/pkgs/development/libraries/tiledb/default.nix b/pkgs/development/libraries/tiledb/default.nix
new file mode 100644
index 000000000000..605307e080ef
--- /dev/null
+++ b/pkgs/development/libraries/tiledb/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, zlib
+, lz4
+, bzip2
+, zstd
+, spdlog_0
+, tbb
+, openssl
+, boost
+, libpqxx
+, clang-tools
+, catch2
+, python
+, gtest
+, doxygen
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tiledb";
+  version = "1.7.0";
+
+  src = fetchFromGitHub {
+    owner = "TileDB-Inc";
+    repo = "TileDB";
+    rev = version;
+    sha256 = "07wh9q72vsaf5j2m2c6cfmllwhr3m9f8xzg8h0i6mhd7d0wr4lna";
+  };
+
+  nativeBuildInputs = [
+    clang-tools
+    cmake
+    python
+    doxygen
+  ];
+
+  checkInputs = [
+    gtest
+  ];
+
+  enableParallelBuilding = true;
+
+  buildInputs = [
+    catch2
+    zlib
+    lz4
+    bzip2
+    zstd
+    spdlog_0
+    tbb
+    openssl
+    boost
+    libpqxx
+  ];
+
+  # emulate the process of pulling catch down
+  postPatch = ''
+    mkdir -p build/externals/src/ep_catch
+    ln -sf ${catch2}/include/catch2 build/externals/src/ep_catch/single_include
+  '';
+
+  doCheck = false; # 9 failing tests due to what seems an overflow
+
+  installTargets = [ "install-tiledb" "doc" ];
+
+  meta = with lib; {
+    description = "TileDB allows you to manage the massive dense and sparse multi-dimensional array data";
+    homepage = https://github.com/TileDB-Inc/TileDB;
+    license = licenses.mit;
+    platforms = [ "x86_64-linux"];
+    maintainers = with maintainers; [ rakesh4g ];
+  };
+
+}
diff --git a/pkgs/development/misc/vc4/newlib.nix b/pkgs/development/misc/vc4/newlib.nix
new file mode 100644
index 000000000000..e1a8b2eeaa6a
--- /dev/null
+++ b/pkgs/development/misc/vc4/newlib.nix
@@ -0,0 +1,28 @@
+{ stdenv, texinfo, flex, bison, fetchFromGitHub, crossLibcStdenv, buildPackages }:
+
+crossLibcStdenv.mkDerivation {
+  name = "newlib";
+  src = fetchFromGitHub {
+    owner = "itszor";
+    repo = "newlib-vc4";
+    rev = "89abe4a5263d216e923fbbc80495743ff269a510";
+    sha256 = "131r4v0nn68flnqibjcvhsrys3hs89bn0i4vwmrzgjd7v1rbgqav";
+  };
+  dontUpdateAutotoolsGnuConfigScripts = true;
+  configurePlatforms = [ "target" ];
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ texinfo flex bison ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  # newlib expects CC to build for build platform, not host platform
+  preConfigure = ''
+    export CC=cc
+  '';
+
+  dontStrip = true;
+
+  passthru = {
+    incdir = "/${stdenv.targetPlatform.config}/include";
+    libdir = "/${stdenv.targetPlatform.config}/lib";
+  };
+}
diff --git a/pkgs/development/python-modules/catalogue/default.nix b/pkgs/development/python-modules/catalogue/default.nix
new file mode 100644
index 000000000000..f9ad59338430
--- /dev/null
+++ b/pkgs/development/python-modules/catalogue/default.nix
@@ -0,0 +1,24 @@
+{ stdenv
+, buildPythonPackage
+, fetchPypi
+, importlib-metadata
+}:
+
+buildPythonPackage rec {
+  pname = "catalogue";
+  version = "0.0.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0m7xp85fg57wi1l1vdsq2k0b8dv5bnfccds33lb04z9vrds4l3jv";
+  };
+
+  propagatedBuildInputs = [ importlib-metadata ];
+
+  meta = with stdenv.lib; {
+    description = "Tiny library for adding function or object registries";
+    homepage = "https://github.com/explosion/catalogue";
+    license = licenses.mit;
+    maintainers = with maintainers; [ danieldk ];
+    };
+}
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index 23f2a6967da0..e35ea517bf13 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -21,16 +21,17 @@
 , blis
 , wasabi
 , srsly
+, catalogue
 , setuptools
 }:
 
 buildPythonPackage rec {
   pname = "spacy";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "193r7rrqxfj4jqzk4aqgbycficzmc606vkc4ffc46zs3myhlf6sa";
+    sha256 = "0shfjk6nhm6gzp5p88pz5k7bkg5dr3x9yvandkayqb2vsvkwj50x";
   };
 
   propagatedBuildInputs = [
@@ -51,6 +52,7 @@ buildPythonPackage rec {
    blis
    wasabi
    srsly
+   catalogue
    setuptools
   ] ++ lib.optional (pythonOlder "3.4") pathlib;
 
diff --git a/pkgs/development/python-modules/tiledb/default.nix b/pkgs/development/python-modules/tiledb/default.nix
new file mode 100644
index 000000000000..b8894f12c6a0
--- /dev/null
+++ b/pkgs/development/python-modules/tiledb/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, python
+, buildPythonPackage
+, fetchFromGitHub
+, cython
+, tiledb
+, numpy
+, wheel
+, isPy3k
+, setuptools_scm
+, psutil
+}:
+
+buildPythonPackage rec {
+  pname = "tiledb";
+  version = "0.5.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "TileDB-Inc";
+    repo = "TileDB-Py";
+    rev = version;
+    sha256 = "1c9wl207c8jz0695gy8p6bxywyd1k7wmczcfl7s0hlbknliamvyx";
+  };
+
+  nativeBuildInputs = [
+    cython
+    setuptools_scm
+  ];
+
+  buildInputs = [
+    tiledb
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    wheel # No idea why but it is listed
+  ];
+
+  checkInputs = [
+    psutil
+  ];
+
+  TILEDB_PATH = tiledb;
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  disabled = !isPy3k; # Not bothering with python2 anymore
+
+  postPatch = ''
+    # Hardcode path to shared object
+    substituteInPlace tiledb/__init__.py --replace \
+      'os.path.join(lib_dir, lib_name)' 'os.path.join("${tiledb}/lib", lib_name)'
+    
+    # Disable failing test
+    substituteInPlace tiledb/tests/test_examples.py --replace \
+      "test_docs" "dont_test_docs"
+  '';
+
+  checkPhase = ''
+    pushd "$out"
+    ${python.interpreter} -m unittest tiledb.tests.all.suite_test
+    popd
+  '';
+
+  meta = with lib; {
+    description = "Python interface to the TileDB storage manager";
+    homepage = https://github.com/TileDB-Inc/TileDB-Py;
+    license = licenses.mit;
+    maintainers = with maintainers; [ fridh ];
+  };
+
+}
\ No newline at end of file
diff --git a/pkgs/development/python-modules/wasabi/default.nix b/pkgs/development/python-modules/wasabi/default.nix
index 6cbb2aa48db6..28912f70471c 100644
--- a/pkgs/development/python-modules/wasabi/default.nix
+++ b/pkgs/development/python-modules/wasabi/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "wasabi";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0f18x27qrr29rgxyiy1k9b469i37n80h0x9vd9i22pyg8wxx67q5";
+    sha256 = "0w2jkgrf0x58v8x90v4nifbwcb87pp613vp3sld1fk2avn80imnw";
   };
 
   checkInputs = [
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
new file mode 100644
index 000000000000..80c23205c407
--- /dev/null
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "tfsec";
+  version = "0.12.2";
+
+  src = fetchFromGitHub {
+    owner = "liamg";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1xrhsl60xf7230z4d2dyy86406a2306yfqchijrz0957xpkrik2r";
+  };
+
+  goPackagePath = "github.com/liamg/tfsec";
+
+  meta = with lib; {
+    homepage = "https://github.com/liamg/tfsec";
+    description = "Static analysis powered security scanner for your terraform code";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 63713acde0e6..82365d986b8a 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -1,11 +1,13 @@
 { stdenv, lib, buildPackages
-, fetchurl, zlib, autoreconfHook, gettext
+, fetchFromGitHub, fetchurl, zlib, autoreconfHook, gettext
 # Enabling all targets increases output size to a multiple.
 , withAllTargets ? false, libbfd, libopcodes
 , enableShared ? true
 , noSysDirs
 , gold ? !stdenv.buildPlatform.isDarwin || stdenv.hostPlatform == stdenv.targetPlatform
 , bison ? null
+, flex
+, texinfo
 }:
 
 let
@@ -20,17 +22,24 @@ let
   # PATH to both be usable.
   targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
                   "${stdenv.targetPlatform.config}-";
+  vc4-binutils-src = fetchFromGitHub {
+    owner = "itszor";
+    repo = "binutils-vc4";
+    rev = "708acc851880dbeda1dd18aca4fd0a95b2573b36";
+    sha256 = "1kdrz6fki55lm15rwwamn74fnqpy0zlafsida2zymk76n3656c63";
+  };
+  # HACK to ensure that we preserve source from bootstrap binutils to not rebuild LLVM
+  normal-src = stdenv.__bootPackages.binutils-unwrapped.src or (fetchurl {
+    url = "mirror://gnu/binutils/${basename}-${version}.tar.bz2";
+    sha256 = "1l34hn1zkmhr1wcrgf0d4z7r3najxnw3cx2y2fk7v55zjlk3ik7z";
+  });
 in
 
 stdenv.mkDerivation {
   pname = targetPrefix + basename;
   inherit version;
 
-  # HACK to ensure that we preserve source from bootstrap binutils to not rebuild LLVM
-  src = stdenv.__bootPackages.binutils-unwrapped.src or (fetchurl {
-    url = "mirror://gnu/binutils/${basename}-${version}.tar.bz2";
-    sha256 = "1l34hn1zkmhr1wcrgf0d4z7r3najxnw3cx2y2fk7v55zjlk3ik7z";
-  });
+  src = if stdenv.targetPlatform.isVc4 then vc4-binutils-src else normal-src;
 
   patches = [
     # Make binutils output deterministic by default.
@@ -55,6 +64,8 @@ stdenv.mkDerivation {
     # cross-compiling.
     ./always-search-rpath.patch
 
+  ] ++ lib.optionals (!stdenv.targetPlatform.isVc4)
+  [
     # https://sourceware.org/bugzilla/show_bug.cgi?id=22868
     ./gold-symbol-visibility.patch
 
@@ -70,9 +81,9 @@ stdenv.mkDerivation {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [
     bison
-  ] ++ lib.optionals stdenv.targetPlatform.isiOS [
+  ] ++ (lib.optionals stdenv.targetPlatform.isiOS [
     autoreconfHook
-  ];
+  ]) ++ lib.optionals stdenv.targetPlatform.isVc4 [ texinfo flex ];
   buildInputs = [ zlib gettext ];
 
   inherit noSysDirs;
diff --git a/pkgs/development/tools/misc/ccls/default.nix b/pkgs/development/tools/misc/ccls/default.nix
index ec97d1bb75b3..8748cdf52b4f 100644
--- a/pkgs/development/tools/misc/ccls/default.nix
+++ b/pkgs/development/tools/misc/ccls/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ccls";
-  version = "0.20190823.4";
+  version = "0.20190823.5";
 
   src = fetchFromGitHub {
     owner = "MaskRay";
     repo = "ccls";
     rev = version;
-    sha256 = "1aq8q32jdkhrdrsghk8sdb8y4si36hfavf7jq2yzbqinjx03y1n4";
+    sha256 = "0b2pkpzn576b92zcxpwchpkyw2fww6s69818rx4g9z34kzm35zy5";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/tools/misc/mkcert/default.nix b/pkgs/development/tools/misc/mkcert/default.nix
index b9b1f83322d1..ae0a4a6dfe21 100644
--- a/pkgs/development/tools/misc/mkcert/default.nix
+++ b/pkgs/development/tools/misc/mkcert/default.nix
@@ -1,17 +1,23 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "mkcert";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0xcmvzh5lq8vs3b0f1zw645fxdr8471v7prl1656q02v38f58ly7";
+    sha256 = "0w1ji96hbd3anzsz82xjcafsqhgyz7c7n41rsq60yrllwbj5946f";
   };
 
+  modSha256 = "13a3snhcqq3a9lfy9zfr2rx10mf2ymvhmds1bg8n4m7lbwnzm4fg";
+
   goPackagePath = "github.com/FiloSottile/mkcert";
+  buildFlagsArray = ''
+    -ldflags=
+      -X ${goPackagePath}/main.Version=${version}
+  '';
 
   meta = with lib; {
     homepage = https://github.com/FiloSottile/mkcert;
diff --git a/pkgs/development/tools/parsing/byacc/default.nix b/pkgs/development/tools/parsing/byacc/default.nix
index 23ea39c6fa9f..8542d4151964 100644
--- a/pkgs/development/tools/parsing/byacc/default.nix
+++ b/pkgs/development/tools/parsing/byacc/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "byacc";
-  version = "20190617";
+  version = "20191119";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/byacc/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/byacc/${pname}-${version}.tgz"
     ];
-    sha256 = "13ai0az00c86s4k94cpgh48nf5dfccpvccpw635z42wjgcb6hy7q";
+    sha256 = "0ch8y9g7b3lnw1r76p65gvdnbpwd60d4pghgadid122fcq7566p2";
   };
 
   configureFlags = [
diff --git a/pkgs/misc/emulators/cdemu/analyzer.nix b/pkgs/misc/emulators/cdemu/analyzer.nix
index e52cf7efc6b5..246dbb7dd350 100644
--- a/pkgs/misc/emulators/cdemu/analyzer.nix
+++ b/pkgs/misc/emulators/cdemu/analyzer.nix
@@ -1,9 +1,9 @@
 { callPackage, makeWrapper, gobject-introspection, cmake
 , python3Packages, gtk3, glib, libxml2, gnuplot, gnome3, gdk-pixbuf, librsvg, intltool, libmirage }:
 let pkg = import ./base.nix {
-  version = "3.2.2";
+  version = "3.2.3";
   pkgName = "image-analyzer";
-  pkgSha256 = "0by3nd5c413cvk3jmv3md6q0axbiidy061g9dhf37qzwgcakcx8j";
+  pkgSha256 = "17yfjmf65s77214qassz6l01cjcni4cv06nzfsm7qrzw172fmci4";
 };
 in callPackage pkg {
   buildInputs = [ glib gtk3 libxml2 gnuplot libmirage makeWrapper
diff --git a/pkgs/misc/emulators/cdemu/client.nix b/pkgs/misc/emulators/cdemu/client.nix
index dbf471d35d1d..087b15cecd16 100644
--- a/pkgs/misc/emulators/cdemu/client.nix
+++ b/pkgs/misc/emulators/cdemu/client.nix
@@ -1,8 +1,8 @@
 { callPackage, python3Packages, intltool, makeWrapper }:
 let pkg = import ./base.nix {
-  version = "3.2.1";
+  version = "3.2.3";
   pkgName = "cdemu-client";
-  pkgSha256 = "1d8m24qvv62xcwafw5zs4yf39vs64kxl4idqcngd8yyjhrb2ykg5";
+  pkgSha256 = "1bvc2m63fx03rbp3ihgl2n7k24lwg5ydwkmr84gsjfcxp46q10zq";
 };
 in callPackage pkg {
   buildInputs = [ python3Packages.python python3Packages.dbus-python python3Packages.pygobject3
diff --git a/pkgs/misc/emulators/cdemu/daemon.nix b/pkgs/misc/emulators/cdemu/daemon.nix
index a80327ce91c0..db6ed7ddb47a 100644
--- a/pkgs/misc/emulators/cdemu/daemon.nix
+++ b/pkgs/misc/emulators/cdemu/daemon.nix
@@ -1,8 +1,8 @@
 { callPackage, glib, libao, intltool, libmirage }:
 let pkg = import ./base.nix {
-  version = "3.2.2";
+  version = "3.2.3";
   pkgName = "cdemu-daemon";
-  pkgSha256 = "0himyrhhfjsr4ff5aci7240bpm9x34h20pid412ci8fm16nk929b";
+  pkgSha256 = "022xzgwmncswb9md71w3ly3mjkdfc93lbij2llp2jamq8grxjjxr";
 };
 in callPackage pkg {
   buildInputs = [ glib libao libmirage intltool ];
diff --git a/pkgs/misc/emulators/cdemu/gui.nix b/pkgs/misc/emulators/cdemu/gui.nix
index e06853b8f736..599531950a21 100644
--- a/pkgs/misc/emulators/cdemu/gui.nix
+++ b/pkgs/misc/emulators/cdemu/gui.nix
@@ -2,9 +2,9 @@
 , python3Packages, gtk3, glib, libnotify, intltool, gnome3, gdk-pixbuf, librsvg }:
 let
   pkg = import ./base.nix {
-    version = "3.2.1";
+    version = "3.2.3";
     pkgName = "gcdemu";
-    pkgSha256 = "0lmyvhbf57wcm8k2a33j2dhy4gblaiycy33q070gdrxi37xk7w5g";
+    pkgSha256 = "19vy1awha8s7cfja3a6npaf3rfy3pl3cbsh4vd609q9jz4v4lyg4";
   };
   inherit (python3Packages) python pygobject3;
 in callPackage pkg {
diff --git a/pkgs/misc/emulators/cdemu/libmirage.nix b/pkgs/misc/emulators/cdemu/libmirage.nix
index 0ead78305cd0..cc3118ace151 100644
--- a/pkgs/misc/emulators/cdemu/libmirage.nix
+++ b/pkgs/misc/emulators/cdemu/libmirage.nix
@@ -3,9 +3,9 @@
 , pcre, utillinux, libselinux, libsepol }:
 
 let pkg = import ./base.nix {
-  version = "3.2.2";
+  version = "3.2.3";
   pkgName = "libmirage";
-  pkgSha256 = "0gwrfia0fyhi0b3p2pfyyvrcfcb0qysfzgpdqsqjqbx4xaqx5wpi";
+  pkgSha256 = "08mfvqyk3833ksfd47i4j3ppmrw5ry219km6h7lywdh9hm9x14yf";
 };
 in callPackage pkg {
   buildInputs = [ glib libsndfile zlib bzip2 lzma libsamplerate intltool ];
diff --git a/pkgs/misc/emulators/cdemu/vhba.nix b/pkgs/misc/emulators/cdemu/vhba.nix
index 71beaf125481..df25fb96eb1c 100644
--- a/pkgs/misc/emulators/cdemu/vhba.nix
+++ b/pkgs/misc/emulators/cdemu/vhba.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vhba";
-  version = "20190410";
+  version = "20190831";
 
   src  = fetchurl {
     url = "mirror://sourceforge/cdemu/vhba-module-${version}.tar.bz2";
-    sha256 = "1513hq130raxp9z5grj54cwfjfxj05apipxg425j0zicii59a60c";
+    sha256 = "1ybbk6l06n0y11n5wnfmvdz0baizmq55l458ywimghdyz0n7g0ws";
   };
 
   makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" "INSTALL_MOD_PATH=$(out)" ];
diff --git a/pkgs/misc/emulators/resim/default.nix b/pkgs/misc/emulators/resim/default.nix
new file mode 100644
index 000000000000..81acdf81f2ec
--- /dev/null
+++ b/pkgs/misc/emulators/resim/default.nix
@@ -0,0 +1,18 @@
+{ fetchFromGitHub, stdenv, cmake, qt4 }:
+
+stdenv.mkDerivation {
+  name = "resim";
+  src = fetchFromGitHub {
+    owner = "itszor";
+    repo = "resim";
+    rev = "cdc7808ceb7ba4ac00d0d08ca646b58615059150";
+    sha256 = "1743lngqxd7ai4k6cd4d1cf9h60z2pnvr2iynfs1zlpcj3w1hx0c";
+  };
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ qt4 ];
+  installPhase = ''
+    mkdir -pv $out/{lib,bin}
+    cp -v libresim/libarmsim.so $out/lib/libarmsim.so
+    cp -v vc4emul/vc4emul $out/bin/vc4emul
+  '';
+}
diff --git a/pkgs/os-specific/linux/brillo/default.nix b/pkgs/os-specific/linux/brillo/default.nix
index 3ad4acf127b7..6d51907ea166 100644
--- a/pkgs/os-specific/linux/brillo/default.nix
+++ b/pkgs/os-specific/linux/brillo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "brillo";
-  version = "1.4.8";
+  version = "1.4.9";
 
   src = fetchFromGitLab {
     owner= "cameronnemo";
     repo= "brillo";
     rev= "v${version}";
-    sha256 = "0wxvg541caiwm3bjwbmk7xcng7jd9xsiga2agxwp7gpkrlp74j9f";
+    sha256 = "0ab7s60zcgl6hvm0a9rlwq35p25n3jnw6r9256pwl4cdwyjyybsb";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 738a55129b1f..34654643c331 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.155";
+  version = "4.14.156";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "10g4493ldc398qza304z5yz8qdp93w7a2bs5h5dwk0bbamwikmkp";
+    sha256 = "1h47fxfbq0d5ry7j3jxz45v5c4103qncgm2vydpz6zdx1kmrz27q";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index eaf2f7a3ec09..f71ef185199f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.85";
+  version = "4.19.86";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1dsgbys73jga5h0a9icgif6qbi31g84315zlcdid9bzf1abkbx3v";
+    sha256 = "1xmzcxsiydym574y7k313qd8s4c3mdahpb3nx3cingfl36ivnb5z";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index cb9d5a71dd90..94ba9ae6abd8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.202";
+  version = "4.9.203";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1gsfbvsswpwj6r56ynb6mmx7dc8hp9yhi7sfr0hhii0gs4ffq241";
+    sha256 = "0jd8n8y3yf59sgfjhgjxsznxng7s4b30x5vdb48wrpgqmz7m1n8w";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.3.nix b/pkgs/os-specific/linux/kernel/linux-5.3.nix
index 86fc9af4f241..25cdab9c7bea 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.3.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.3.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.3.12";
+  version = "5.3.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "184pmjyqh4bkrc3vj65zn6xnljzv9d1x7c1z0hlgj6fakpwgdgsk";
+    sha256 = "0by9lmgmllf19yflzm9f24cy9glcq6m73ywm25bddsnh0czya14z";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
new file mode 100644
index 000000000000..7745fc8099ff
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -0,0 +1,18 @@
+{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
+
+with stdenv.lib;
+
+buildLinux (args // rec {
+  version = "5.4";
+
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = versions.majorMinor version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
+    sha256 = "14glqppn90z79b36k4c76mv90q933i2bg54rgwlcl2v7n608jcxz";
+  };
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
index bf26b9e2b28b..53fc986d9f63 100644
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -1,24 +1,25 @@
 { stdenv, fetchurl, makeWrapper, pkgconfig, utillinux, which
-, procps, libcap_ng, openssl, python27 , perl
+, procps, libcap_ng, openssl, python3 , perl
 , kernel ? null }:
 
 with stdenv.lib;
 
 let
   _kernel = kernel;
+  pythonEnv = python3.withPackages (ps: with ps; [ six ]);
 in stdenv.mkDerivation rec {
-  version = "2.5.4";
+  version = "2.12.0";
   pname = "openvswitch";
 
   src = fetchurl {
-    url = "http://openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "1lji87wg953lqcdf02f1zv2m54vhd2x9jd03bb91lnlb4qlhifiv";
+    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
+    sha256 = "1y78ix5inhhcvicbvyy2ij38am1215nr55vydhab3d4065q45z8k";
   };
 
   kernel = optional (_kernel != null) _kernel.dev;
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ makeWrapper utillinux openssl libcap_ng python27
+  buildInputs = [ makeWrapper utillinux openssl libcap_ng pythonEnv
                   perl procps which ];
 
   configureFlags = [
@@ -36,27 +37,13 @@ in stdenv.mkDerivation rec {
 
   postBuild = ''
     # fix tests
-    substituteInPlace xenserver/opt_xensource_libexec_interface-reconfigure --replace '/usr/bin/env python' '${python27.interpreter}'
-    substituteInPlace vtep/ovs-vtep --replace '/usr/bin/env python' '${python27.interpreter}'
+    substituteInPlace xenserver/opt_xensource_libexec_interface-reconfigure --replace '/usr/bin/env python' '${pythonEnv.interpreter}'
+    substituteInPlace vtep/ovs-vtep --replace '/usr/bin/env python' '${pythonEnv.interpreter}'
   '';
 
   enableParallelBuilding = true;
   doCheck = false; # bash-completion test fails with "compgen: command not found"
 
-  postInstall = ''
-    cp debian/ovs-monitor-ipsec $out/share/openvswitch/scripts
-    makeWrapper \
-      $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      $out/bin/ovs-monitor-ipsec \
-      --prefix PYTHONPATH : "$out/share/openvswitch/python"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "UnixctlServer.create(None)" "UnixctlServer.create(os.environ['UNIXCTLPATH'])"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "self.psk_file" "root_prefix + self.psk_file"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "self.cert_dir" "root_prefix + self.cert_dir"
-  '';
-
   meta = with stdenv.lib; {
     platforms = platforms.linux;
     description = "A multilayer virtual switch";
@@ -71,7 +58,8 @@ in stdenv.mkDerivation rec {
       support distribution across multiple physical servers similar
       to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
       '';
-    homepage = http://openvswitch.org/;
+    homepage = https://www.openvswitch.org/;
     license = licenses.asl20;
+    maintainers = with maintainers; [ netixx kmcopper ];
   };
 }
diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix
new file mode 100644
index 000000000000..4f3f4c5c172a
--- /dev/null
+++ b/pkgs/os-specific/linux/openvswitch/lts.nix
@@ -0,0 +1,82 @@
+{ stdenv, fetchurl, makeWrapper, pkgconfig, utillinux, which
+, procps, libcap_ng, openssl, python2, iproute , perl
+, automake, autoconf, libtool, kernel ? null }:
+
+with stdenv.lib;
+
+let
+  _kernel = kernel;
+in stdenv.mkDerivation rec {
+  version = "2.5.9";
+  pname = "openvswitch";
+
+  src = fetchurl {
+    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
+    sha256 = "0iv0ncwl6s4qyyb655yj5xvqrjr1zbymmab96q259wa09xnyw7b7";
+  };
+
+  patches = [ ./patches/lts-ssl.patch ];
+
+  kernel = optional (_kernel != null) _kernel.dev;
+
+  nativeBuildInputs = [ autoconf libtool automake pkgconfig  ];
+  buildInputs = [ makeWrapper utillinux openssl libcap_ng python2
+                  perl procps which ];
+
+  preConfigure = "./boot.sh";
+
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sharedstatedir=/var"
+    "--sbindir=$(out)/bin"
+  ] ++ (optionals (_kernel != null) ["--with-linux"]);
+
+  # Leave /var out of this!
+  installFlags = [
+    "LOGDIR=$(TMPDIR)/dummy"
+    "RUNDIR=$(TMPDIR)/dummy"
+    "PKIDIR=$(TMPDIR)/dummy"
+  ];
+
+  postBuild = ''
+    # fix tests
+    substituteInPlace xenserver/opt_xensource_libexec_interface-reconfigure --replace '/usr/bin/env python' '${python2.interpreter}'
+    substituteInPlace vtep/ovs-vtep --replace '/usr/bin/env python' '${python2.interpreter}'
+  '';
+
+  enableParallelBuilding = true;
+  doCheck = false; # bash-completion test fails with "compgen: command not found"
+
+  postInstall = ''
+    cp debian/ovs-monitor-ipsec $out/share/openvswitch/scripts
+    makeWrapper \
+      $out/share/openvswitch/scripts/ovs-monitor-ipsec \
+      $out/bin/ovs-monitor-ipsec \
+      --prefix PYTHONPATH : "$out/share/openvswitch/python"
+    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
+      --replace "UnixctlServer.create(None)" "UnixctlServer.create(os.environ['UNIXCTLPATH'])"
+    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
+      --replace "self.psk_file" "root_prefix + self.psk_file"
+    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
+      --replace "self.cert_dir" "root_prefix + self.cert_dir"
+  '';
+
+  meta = with stdenv.lib; {
+    platforms = platforms.linux;
+    description = "A multilayer virtual switch";
+    longDescription =
+      ''
+      Open vSwitch is a production quality, multilayer virtual switch
+      licensed under the open source Apache 2.0 license. It is
+      designed to enable massive network automation through
+      programmatic extension, while still supporting standard
+      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
+      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
+      support distribution across multiple physical servers similar
+      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
+      '';
+    homepage = https://www.openvswitch.org/;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ netixx kmcopper ];
+  };
+}
diff --git a/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch b/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch
new file mode 100644
index 000000000000..0d8ff5b0d523
--- /dev/null
+++ b/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch
@@ -0,0 +1,274 @@
+diff --git a/build-aux/automake.mk b/build-aux/automake.mk
+new file mode 100644
+index 000000000..5d2657fd6
+--- /dev/null
++++ b/build-aux/automake.mk
+@@ -0,0 +1,2 @@
++EXTRA_DIST += \
++	build-aux/generate-dhparams-c 
+diff --git a/build-aux/generate-dhparams-c b/build-aux/generate-dhparams-c
+new file mode 100755
+index 000000000..bcd25e2d8
+--- /dev/null
++++ b/build-aux/generate-dhparams-c
+@@ -0,0 +1,33 @@
++#! /bin/sh -e
++
++cat <<'EOF'
++/* Generated automatically; do not modify!     -*- buffer-read-only: t -*-
++ *
++ * If you do need to regenerate this file, run "make generate-dhparams-c". */
++
++#include <config.h>
++#include "lib/dhparams.h"
++#include "lib/util.h"
++
++static int
++my_DH_set0_pqg(DH *dh, BIGNUM *p, const BIGNUM **q OVS_UNUSED, BIGNUM *g)
++{
++    ovs_assert(q == NULL);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
++    dh->p = p;
++    dh->g = g;
++    return 1;
++#else
++    return DH_set0_pqg(dh, p, NULL, g);
++#endif
++}
++EOF
++(openssl dhparam -C -in lib/dh1024.pem -noout &&
++openssl dhparam -C -in lib/dh2048.pem -noout &&
++openssl dhparam -C -in lib/dh4096.pem -noout) | sed '
++    s/^static DH/DH/
++    s/\(get_dh[0-9]*\)()/\1(void)/
++    s/\(DH_set0_pqg\)/my_\1/
++    s/[ 	]*$//
++    s/	/        /g
++'
+diff --git a/lib/automake.mk b/lib/automake.mk
+index 5387d519a..804a8b7d7 100644
+--- a/lib/automake.mk
++++ b/lib/automake.mk
+@@ -399,15 +399,16 @@ lib_libopenvswitch_la_SOURCES += \
+ 	lib/route-table-bsd.c
+ endif
+ 
++.PHONY: generate-dhparams-c
+ if HAVE_OPENSSL
+-lib_libopenvswitch_la_SOURCES += lib/stream-ssl.c
+-nodist_lib_libopenvswitch_la_SOURCES += lib/dhparams.c
+-lib/dhparams.c: lib/dh1024.pem lib/dh2048.pem lib/dh4096.pem
+-	$(AM_V_GEN)(echo '#include "lib/dhparams.h"' &&                 \
+-	 openssl dhparam -C -in $(srcdir)/lib/dh1024.pem -noout &&	\
+-	 openssl dhparam -C -in $(srcdir)/lib/dh2048.pem -noout &&	\
+-	 openssl dhparam -C -in $(srcdir)/lib/dh4096.pem -noout)	\
+-	| sed 's/\(get_dh[0-9]*\)()/\1(void)/' > lib/dhparams.c.tmp &&  \
++lib_libopenvswitch_la_SOURCES += lib/stream-ssl.c lib/dhparams.c
++
++# Manually regenerates lib/dhparams.c.  Not normally necessary since
++# lib/dhparams.c is part of the repository and doesn't normally need
++# updates.
++generate-dhparams-c:
++	$(AM_V_GEN)cd $(srcdir) && \
++	build-aux/generate-dhparams-c > lib/dhparams.c.tmp && \
+ 	mv lib/dhparams.c.tmp lib/dhparams.c
+ else
+ lib_libopenvswitch_la_SOURCES += lib/stream-nossl.c
+diff --git a/lib/dhparams.c b/lib/dhparams.c
+new file mode 100644
+index 000000000..4e42efad2
+--- /dev/null
++++ b/lib/dhparams.c
+@@ -0,0 +1,192 @@
++/* Generated automatically; do not modify!     -*- buffer-read-only: t -*-
++ *
++ * If you do need to regenerate this file, run "make generate-dhparams-c". */
++
++#include <config.h>
++#include "lib/dhparams.h"
++#include "lib/util.h"
++
++static int
++my_DH_set0_pqg(DH *dh, BIGNUM *p, const BIGNUM **q OVS_UNUSED, BIGNUM *g)
++{
++    ovs_assert(q == NULL);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
++    dh->p = p;
++    dh->g = g;
++    return 1;
++#else
++    return DH_set0_pqg(dh, p, NULL, g);
++#endif
++}
++#ifndef HEADER_DH_H
++# include <openssl/dh.h>
++#endif
++
++DH *get_dh1024(void)
++{
++    static unsigned char dhp_1024[] = {
++        0xF4, 0x88, 0xFD, 0x58, 0x4E, 0x49, 0xDB, 0xCD, 0x20, 0xB4,
++        0x9D, 0xE4, 0x91, 0x07, 0x36, 0x6B, 0x33, 0x6C, 0x38, 0x0D,
++        0x45, 0x1D, 0x0F, 0x7C, 0x88, 0xB3, 0x1C, 0x7C, 0x5B, 0x2D,
++        0x8E, 0xF6, 0xF3, 0xC9, 0x23, 0xC0, 0x43, 0xF0, 0xA5, 0x5B,
++        0x18, 0x8D, 0x8E, 0xBB, 0x55, 0x8C, 0xB8, 0x5D, 0x38, 0xD3,
++        0x34, 0xFD, 0x7C, 0x17, 0x57, 0x43, 0xA3, 0x1D, 0x18, 0x6C,
++        0xDE, 0x33, 0x21, 0x2C, 0xB5, 0x2A, 0xFF, 0x3C, 0xE1, 0xB1,
++        0x29, 0x40, 0x18, 0x11, 0x8D, 0x7C, 0x84, 0xA7, 0x0A, 0x72,
++        0xD6, 0x86, 0xC4, 0x03, 0x19, 0xC8, 0x07, 0x29, 0x7A, 0xCA,
++        0x95, 0x0C, 0xD9, 0x96, 0x9F, 0xAB, 0xD0, 0x0A, 0x50, 0x9B,
++        0x02, 0x46, 0xD3, 0x08, 0x3D, 0x66, 0xA4, 0x5D, 0x41, 0x9F,
++        0x9C, 0x7C, 0xBD, 0x89, 0x4B, 0x22, 0x19, 0x26, 0xBA, 0xAB,
++        0xA2, 0x5E, 0xC3, 0x55, 0xE9, 0x2F, 0x78, 0xC7
++    };
++    static unsigned char dhg_1024[] = {
++        0x02
++    };
++    DH *dh = DH_new();
++    BIGNUM *dhp_bn, *dhg_bn;
++
++    if (dh == NULL)
++        return NULL;
++    dhp_bn = BN_bin2bn(dhp_1024, sizeof (dhp_1024), NULL);
++    dhg_bn = BN_bin2bn(dhg_1024, sizeof (dhg_1024), NULL);
++    if (dhp_bn == NULL || dhg_bn == NULL
++            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
++        DH_free(dh);
++        BN_free(dhp_bn);
++        BN_free(dhg_bn);
++        return NULL;
++    }
++    return dh;
++}
++#ifndef HEADER_DH_H
++# include <openssl/dh.h>
++#endif
++
++DH *get_dh2048(void)
++{
++    static unsigned char dhp_2048[] = {
++        0xF6, 0x42, 0x57, 0xB7, 0x08, 0x7F, 0x08, 0x17, 0x72, 0xA2,
++        0xBA, 0xD6, 0xA9, 0x42, 0xF3, 0x05, 0xE8, 0xF9, 0x53, 0x11,
++        0x39, 0x4F, 0xB6, 0xF1, 0x6E, 0xB9, 0x4B, 0x38, 0x20, 0xDA,
++        0x01, 0xA7, 0x56, 0xA3, 0x14, 0xE9, 0x8F, 0x40, 0x55, 0xF3,
++        0xD0, 0x07, 0xC6, 0xCB, 0x43, 0xA9, 0x94, 0xAD, 0xF7, 0x4C,
++        0x64, 0x86, 0x49, 0xF8, 0x0C, 0x83, 0xBD, 0x65, 0xE9, 0x17,
++        0xD4, 0xA1, 0xD3, 0x50, 0xF8, 0xF5, 0x59, 0x5F, 0xDC, 0x76,
++        0x52, 0x4F, 0x3D, 0x3D, 0x8D, 0xDB, 0xCE, 0x99, 0xE1, 0x57,
++        0x92, 0x59, 0xCD, 0xFD, 0xB8, 0xAE, 0x74, 0x4F, 0xC5, 0xFC,
++        0x76, 0xBC, 0x83, 0xC5, 0x47, 0x30, 0x61, 0xCE, 0x7C, 0xC9,
++        0x66, 0xFF, 0x15, 0xF9, 0xBB, 0xFD, 0x91, 0x5E, 0xC7, 0x01,
++        0xAA, 0xD3, 0x5B, 0x9E, 0x8D, 0xA0, 0xA5, 0x72, 0x3A, 0xD4,
++        0x1A, 0xF0, 0xBF, 0x46, 0x00, 0x58, 0x2B, 0xE5, 0xF4, 0x88,
++        0xFD, 0x58, 0x4E, 0x49, 0xDB, 0xCD, 0x20, 0xB4, 0x9D, 0xE4,
++        0x91, 0x07, 0x36, 0x6B, 0x33, 0x6C, 0x38, 0x0D, 0x45, 0x1D,
++        0x0F, 0x7C, 0x88, 0xB3, 0x1C, 0x7C, 0x5B, 0x2D, 0x8E, 0xF6,
++        0xF3, 0xC9, 0x23, 0xC0, 0x43, 0xF0, 0xA5, 0x5B, 0x18, 0x8D,
++        0x8E, 0xBB, 0x55, 0x8C, 0xB8, 0x5D, 0x38, 0xD3, 0x34, 0xFD,
++        0x7C, 0x17, 0x57, 0x43, 0xA3, 0x1D, 0x18, 0x6C, 0xDE, 0x33,
++        0x21, 0x2C, 0xB5, 0x2A, 0xFF, 0x3C, 0xE1, 0xB1, 0x29, 0x40,
++        0x18, 0x11, 0x8D, 0x7C, 0x84, 0xA7, 0x0A, 0x72, 0xD6, 0x86,
++        0xC4, 0x03, 0x19, 0xC8, 0x07, 0x29, 0x7A, 0xCA, 0x95, 0x0C,
++        0xD9, 0x96, 0x9F, 0xAB, 0xD0, 0x0A, 0x50, 0x9B, 0x02, 0x46,
++        0xD3, 0x08, 0x3D, 0x66, 0xA4, 0x5D, 0x41, 0x9F, 0x9C, 0x7C,
++        0xBD, 0x89, 0x4B, 0x22, 0x19, 0x26, 0xBA, 0xAB, 0xA2, 0x5E,
++        0xC3, 0x55, 0xE9, 0x32, 0x0B, 0x3B
++    };
++    static unsigned char dhg_2048[] = {
++        0x02
++    };
++    DH *dh = DH_new();
++    BIGNUM *dhp_bn, *dhg_bn;
++
++    if (dh == NULL)
++        return NULL;
++    dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL);
++    dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL);
++    if (dhp_bn == NULL || dhg_bn == NULL
++            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
++        DH_free(dh);
++        BN_free(dhp_bn);
++        BN_free(dhg_bn);
++        return NULL;
++    }
++    return dh;
++}
++#ifndef HEADER_DH_H
++# include <openssl/dh.h>
++#endif
++
++DH *get_dh4096(void)
++{
++    static unsigned char dhp_4096[] = {
++        0xFA, 0x14, 0x72, 0x52, 0xC1, 0x4D, 0xE1, 0x5A, 0x49, 0xD4,
++        0xEF, 0x09, 0x2D, 0xC0, 0xA8, 0xFD, 0x55, 0xAB, 0xD7, 0xD9,
++        0x37, 0x04, 0x28, 0x09, 0xE2, 0xE9, 0x3E, 0x77, 0xE2, 0xA1,
++        0x7A, 0x18, 0xDD, 0x46, 0xA3, 0x43, 0x37, 0x23, 0x90, 0x97,
++        0xF3, 0x0E, 0xC9, 0x03, 0x50, 0x7D, 0x65, 0xCF, 0x78, 0x62,
++        0xA6, 0x3A, 0x62, 0x22, 0x83, 0xA1, 0x2F, 0xFE, 0x79, 0xBA,
++        0x35, 0xFF, 0x59, 0xD8, 0x1D, 0x61, 0xDD, 0x1E, 0x21, 0x13,
++        0x17, 0xFE, 0xCD, 0x38, 0x87, 0x9E, 0xF5, 0x4F, 0x79, 0x10,
++        0x61, 0x8D, 0xD4, 0x22, 0xF3, 0x5A, 0xED, 0x5D, 0xEA, 0x21,
++        0xE9, 0x33, 0x6B, 0x48, 0x12, 0x0A, 0x20, 0x77, 0xD4, 0x25,
++        0x60, 0x61, 0xDE, 0xF6, 0xB4, 0x4F, 0x1C, 0x63, 0x40, 0x8B,
++        0x3A, 0x21, 0x93, 0x8B, 0x79, 0x53, 0x51, 0x2C, 0xCA, 0xB3,
++        0x7B, 0x29, 0x56, 0xA8, 0xC7, 0xF8, 0xF4, 0x7B, 0x08, 0x5E,
++        0xA6, 0xDC, 0xA2, 0x45, 0x12, 0x56, 0xDD, 0x41, 0x92, 0xF2,
++        0xDD, 0x5B, 0x8F, 0x23, 0xF0, 0xF3, 0xEF, 0xE4, 0x3B, 0x0A,
++        0x44, 0xDD, 0xED, 0x96, 0x84, 0xF1, 0xA8, 0x32, 0x46, 0xA3,
++        0xDB, 0x4A, 0xBE, 0x3D, 0x45, 0xBA, 0x4E, 0xF8, 0x03, 0xE5,
++        0xDD, 0x6B, 0x59, 0x0D, 0x84, 0x1E, 0xCA, 0x16, 0x5A, 0x8C,
++        0xC8, 0xDF, 0x7C, 0x54, 0x44, 0xC4, 0x27, 0xA7, 0x3B, 0x2A,
++        0x97, 0xCE, 0xA3, 0x7D, 0x26, 0x9C, 0xAD, 0xF4, 0xC2, 0xAC,
++        0x37, 0x4B, 0xC3, 0xAD, 0x68, 0x84, 0x7F, 0x99, 0xA6, 0x17,
++        0xEF, 0x6B, 0x46, 0x3A, 0x7A, 0x36, 0x7A, 0x11, 0x43, 0x92,
++        0xAD, 0xE9, 0x9C, 0xFB, 0x44, 0x6C, 0x3D, 0x82, 0x49, 0xCC,
++        0x5C, 0x6A, 0x52, 0x42, 0xF8, 0x42, 0xFB, 0x44, 0xF9, 0x39,
++        0x73, 0xFB, 0x60, 0x79, 0x3B, 0xC2, 0x9E, 0x0B, 0xDC, 0xD4,
++        0xA6, 0x67, 0xF7, 0x66, 0x3F, 0xFC, 0x42, 0x3B, 0x1B, 0xDB,
++        0x4F, 0x66, 0xDC, 0xA5, 0x8F, 0x66, 0xF9, 0xEA, 0xC1, 0xED,
++        0x31, 0xFB, 0x48, 0xA1, 0x82, 0x7D, 0xF8, 0xE0, 0xCC, 0xB1,
++        0xC7, 0x03, 0xE4, 0xF8, 0xB3, 0xFE, 0xB7, 0xA3, 0x13, 0x73,
++        0xA6, 0x7B, 0xC1, 0x0E, 0x39, 0xC7, 0x94, 0x48, 0x26, 0x00,
++        0x85, 0x79, 0xFC, 0x6F, 0x7A, 0xAF, 0xC5, 0x52, 0x35, 0x75,
++        0xD7, 0x75, 0xA4, 0x40, 0xFA, 0x14, 0x74, 0x61, 0x16, 0xF2,
++        0xEB, 0x67, 0x11, 0x6F, 0x04, 0x43, 0x3D, 0x11, 0x14, 0x4C,
++        0xA7, 0x94, 0x2A, 0x39, 0xA1, 0xC9, 0x90, 0xCF, 0x83, 0xC6,
++        0xFF, 0x02, 0x8F, 0xA3, 0x2A, 0xAC, 0x26, 0xDF, 0x0B, 0x8B,
++        0xBE, 0x64, 0x4A, 0xF1, 0xA1, 0xDC, 0xEE, 0xBA, 0xC8, 0x03,
++        0x82, 0xF6, 0x62, 0x2C, 0x5D, 0xB6, 0xBB, 0x13, 0x19, 0x6E,
++        0x86, 0xC5, 0x5B, 0x2B, 0x5E, 0x3A, 0xF3, 0xB3, 0x28, 0x6B,
++        0x70, 0x71, 0x3A, 0x8E, 0xFF, 0x5C, 0x15, 0xE6, 0x02, 0xA4,
++        0xCE, 0xED, 0x59, 0x56, 0xCC, 0x15, 0x51, 0x07, 0x79, 0x1A,
++        0x0F, 0x25, 0x26, 0x27, 0x30, 0xA9, 0x15, 0xB2, 0xC8, 0xD4,
++        0x5C, 0xCC, 0x30, 0xE8, 0x1B, 0xD8, 0xD5, 0x0F, 0x19, 0xA8,
++        0x80, 0xA4, 0xC7, 0x01, 0xAA, 0x8B, 0xBA, 0x53, 0xBB, 0x47,
++        0xC2, 0x1F, 0x6B, 0x54, 0xB0, 0x17, 0x60, 0xED, 0x79, 0x21,
++        0x95, 0xB6, 0x05, 0x84, 0x37, 0xC8, 0x03, 0xA4, 0xDD, 0xD1,
++        0x06, 0x69, 0x8F, 0x4C, 0x39, 0xE0, 0xC8, 0x5D, 0x83, 0x1D,
++        0xBE, 0x6A, 0x9A, 0x99, 0xF3, 0x9F, 0x0B, 0x45, 0x29, 0xD4,
++        0xCB, 0x29, 0x66, 0xEE, 0x1E, 0x7E, 0x3D, 0xD7, 0x13, 0x4E,
++        0xDB, 0x90, 0x90, 0x58, 0xCB, 0x5E, 0x9B, 0xCD, 0x2E, 0x2B,
++        0x0F, 0xA9, 0x4E, 0x78, 0xAC, 0x05, 0x11, 0x7F, 0xE3, 0x9E,
++        0x27, 0xD4, 0x99, 0xE1, 0xB9, 0xBD, 0x78, 0xE1, 0x84, 0x41,
++        0xA0, 0xDF
++    };
++    static unsigned char dhg_4096[] = {
++        0x02
++    };
++    DH *dh = DH_new();
++    BIGNUM *dhp_bn, *dhg_bn;
++
++    if (dh == NULL)
++        return NULL;
++    dhp_bn = BN_bin2bn(dhp_4096, sizeof (dhp_4096), NULL);
++    dhg_bn = BN_bin2bn(dhg_4096, sizeof (dhg_4096), NULL);
++    if (dhp_bn == NULL || dhg_bn == NULL
++            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
++        DH_free(dh);
++        BN_free(dhp_bn);
++        BN_free(dhg_bn);
++        return NULL;
++    }
++    return dh;
++}
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index b00b97781781..2a708a6d8c7c 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "grafana";
-  version = "6.4.4";
+  version = "6.4.5";
 
   goPackagePath = "github.com/grafana/grafana";
 
@@ -12,12 +12,12 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "0v5iwny96kb07qkj2qqqfgvnsw3dfcq3wf66zsllqavnahvrd1s8";
+    sha256 = "0chfskz3j0jc25fj7zpbs46lp6a426gz6nigiana04sqylmxm851";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "15583cdi4yajg678d3kj8nngs9lwj0qqn2nh5zm8il9p71w57x0k";
+    sha256 = "0sfs8kv4sxacly39ddy05i3gv14i7d14fc1fb952kdx0zzm8zray";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/monitoring/prometheus/nginxlog-exporter.nix b/pkgs/servers/monitoring/prometheus/nginxlog-exporter.nix
new file mode 100644
index 000000000000..68bac5c560e3
--- /dev/null
+++ b/pkgs/servers/monitoring/prometheus/nginxlog-exporter.nix
@@ -0,0 +1,27 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "nginxlog_exporter";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "martin-helmich";
+    repo = "prometheus-nginxlog-exporter";
+    rev = "v${version}";
+    sha256 = "0cma6hgagqdms6x40v0q4jn8gjq1awyg1aqk5l8mz7l6k132qq7k";
+  };
+
+  goPackagePath = "github.com/martin-helmich/prometheus-nginxlog-exporter";
+
+  goDeps = ./nginxlog-exporter_deps.nix;
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Export metrics from Nginx access log files to Prometheus";
+    homepage = "https://github.com/martin-helmich/prometheus-nginxlog-exporter";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mmahut ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/monitoring/prometheus/nginxlog-exporter_deps.nix b/pkgs/servers/monitoring/prometheus/nginxlog-exporter_deps.nix
new file mode 100644
index 000000000000..3051258a6361
--- /dev/null
+++ b/pkgs/servers/monitoring/prometheus/nginxlog-exporter_deps.nix
@@ -0,0 +1,282 @@
+# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
+[
+  {
+    goPackagePath = "github.com/armon/go-radix";
+    fetch = {
+      type = "git";
+      url = "https://github.com/armon/go-radix";
+      rev = "v1.0.0";
+      sha256 = "1m1k0jz9gjfrk4m7hjm7p03qmviamfgxwm2ghakqxw3hdds8v503";
+    };
+  }
+  {
+    goPackagePath = "github.com/beorn7/perks";
+    fetch = {
+      type = "git";
+      url = "https://github.com/beorn7/perks";
+      rev = "3ac7bf7a47d1";
+      sha256 = "1qc3l4r818xpvrhshh1sisc5lvl9479qspcfcdbivdyh0apah83r";
+    };
+  }
+  {
+    goPackagePath = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.1";
+      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
+    };
+  }
+  {
+    goPackagePath = "github.com/fsnotify/fsnotify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fsnotify/fsnotify";
+      rev = "v1.4.7";
+      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
+    };
+  }
+  {
+    goPackagePath = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev = "0c1f6d65b5a1";
+      sha256 = "1ad3zv0s3swslfwmk0wry9qbjz596689z13f2s7d9gska6msigsl";
+    };
+  }
+  {
+    goPackagePath = "github.com/gopherjs/gopherjs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gopherjs/gopherjs";
+      rev = "0766667cb4d1";
+      sha256 = "13pfc9sxiwjky2lm1xb3i3lcisn8p6mgjk2d927l7r92ysph8dmw";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/consul";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/consul";
+      rev = "de080672fee9";
+      sha256 = "1q46gn7gv7ara21akkbyzlnari4naxax2d0z917y56ra4lwm259i";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/go-msgpack";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/go-msgpack";
+      rev = "v0.5.3";
+      sha256 = "00jv0ajqd58pkb2yyhlrjp0rv1mvb1ijx3yqjyikcmzvk9jb4h5m";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/golang-lru";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/golang-lru";
+      rev = "v0.5.1";
+      sha256 = "13f870cvk161bzjj6x41l45r5x9i1z9r2ymwmvm7768kg08zznpy";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/hcl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/hcl";
+      rev = "v1.0.0";
+      sha256 = "0q6ml0qqs0yil76mpn4mdx4lp94id8vbv575qm60jzl1ijcl5i66";
+    };
+  }
+  {
+    goPackagePath = "github.com/hpcloud/tail";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hpcloud/tail";
+      rev = "v1.0.0";
+      sha256 = "1njpzc0pi1acg5zx9y6vj9xi6ksbsc5d387rd6904hy6rh2m6kn0";
+    };
+  }
+  {
+    goPackagePath = "github.com/jtolds/gls";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jtolds/gls";
+      rev = "v4.20.0";
+      sha256 = "1k7xd2q2ysv2xsh373qs801v6f359240kx0vrl0ydh7731lngvk6";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pretty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pretty";
+      rev = "v0.1.0";
+      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/pty";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/pty";
+      rev = "v1.1.1";
+      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
+    };
+  }
+  {
+    goPackagePath = "github.com/kr/text";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kr/text";
+      rev = "v0.1.0";
+      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
+    };
+  }
+  {
+    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/matttproud/golang_protobuf_extensions";
+      rev = "v1.0.1";
+      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
+    };
+  }
+  {
+    goPackagePath = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev = "v1.0.0";
+      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_golang";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_golang";
+      rev = "5636dc67ae77";
+      sha256 = "0fb4w52zp0jk8218gwk4wgbhpj7d4hp6n00dvm8s0ajbysbx524d";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/client_model";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/client_model";
+      rev = "fa8ad6fec335";
+      sha256 = "11a7v1fjzhhwsl128znjcf5v7v6129xjgkdpym2lial4lac1dhm9";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/common";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/common";
+      rev = "4402f4e5ea79";
+      sha256 = "1nskicw0k0kay9dqg8hw2clgcnvjfcz839rijvrz4wh7gl42qiag";
+    };
+  }
+  {
+    goPackagePath = "github.com/prometheus/procfs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/prometheus/procfs";
+      rev = "abf152e5f3e9";
+      sha256 = "0cp8lznv1b4zhi3wnbjkfxwzhkqd3wbmiy6mwgjanip8l9l3ykws";
+    };
+  }
+  {
+    goPackagePath = "github.com/satyrius/gonx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/satyrius/gonx";
+      rev = "47c52b995fe5";
+      sha256 = "0f0b6ac9xlai168d32zas4v2afk5b2q1bs0qi3dykkk6lhq7b58m";
+    };
+  }
+  {
+    goPackagePath = "github.com/smartystreets/assertions";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/assertions";
+      rev = "b2de0cb4f26d";
+      sha256 = "1i7ldgavgl35c7gk25p7bvdr282ckng090zr4ch9mk1705akx09y";
+    };
+  }
+  {
+    goPackagePath = "github.com/smartystreets/goconvey";
+    fetch = {
+      type = "git";
+      url = "https://github.com/smartystreets/goconvey";
+      rev = "200a235640ff";
+      sha256 = "08hgfwjs5zqwsx1z5ja15d0g4glprb3ck7dfi88kwv5q5fl1p139";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/objx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/objx";
+      rev = "v0.1.0";
+      sha256 = "19ynspzjdynbi85xw06mh8ad5j0qa1vryvxjgvbnyrr8rbm4vd8w";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "v1.4.0";
+      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "c200b10b5d5e";
+      sha256 = "1f764m3q05q2dq1pdms07jcixw4xakqw46w1djrmbhjmd9q8b0av";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/check.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/check.v1";
+      rev = "788fd7840127";
+      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/fsnotify.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/fsnotify.v1";
+      rev = "v1.4.7";
+      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/tomb.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/tomb.v1";
+      rev = "dd632973f1e7";
+      sha256 = "1lqmq1ag7s4b3gc3ddvr792c5xb5k6sfn0cchr3i2s7f1c231zjv";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v2";
+      rev = "v2.2.4";
+      sha256 = "11bwj757wi8kdrcnlgfqb8vv2d2xdhlghmyagd19i62khrkchsg2";
+    };
+  }
+]
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 3b994337e9ce..02c3759c58b3 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud";
-  version = "17.0.0";
+  version = "17.0.1";
 
   src = fetchurl {
     url = "https://download.nextcloud.com/server/releases/${pname}-${version}.tar.bz2";
-    sha256 = "19j2l4qxkqsxcw75gvkinjqawia07wx2kcmzn8q33nzc6cdl50b0";
+    sha256 = "0jrbpzc4xf52zfncn6w2m0ch2fszqqz3ny0jq1cw7fy24vjhwgkp";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/nginx-sso/default.nix b/pkgs/servers/nginx-sso/default.nix
index a89604c4e7cd..5cc583c68b3a 100644
--- a/pkgs/servers/nginx-sso/default.nix
+++ b/pkgs/servers/nginx-sso/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "nginx-sso";
-  version = "0.16.1";
+  version = "0.22.0";
   rev = "v${version}";
 
   goPackagePath = "github.com/Luzifer/nginx-sso";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "Luzifer";
     repo = "nginx-sso";
-    sha256 = "100k5dxrwj5xa1yh79qmyv6jampijqjbr4vkn1d9avim352yhnk1";
+    sha256 = "1kcyb7sbqna18yw3myi3c0imhh4hsa0h2k2y0bqfr2pqsnssz54a";
   };
 
   postInstall = ''
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index 3ca91cfd6256..f86ae9d7cec4 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -49,7 +49,7 @@ in {
   };
 
   unifiStable = generic {
-    version = "5.11.39";
-    sha256 = "0v1gnvdazxa3bcbq8hl6796yw0mxzki2xn4s5im5k5ngmfmnswyj";
+    version = "5.12.35";
+    sha256 = "0ln8x7yisanbx1afclhffa0f3fk0sgh7dpj548xyhn5mgpwbj4i2";
   };
 }
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 8140e654d241..db19d340a570 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -4,13 +4,13 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  version = "2019-11-21";
+  version = "2019-11-23";
   pname = "oh-my-zsh";
-  rev = "76d6b0256398ad1becbc304a78f51bbacfee50e5";
+  rev = "7b73c9ca1ced57cdf545e860e880658753b81777";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/robbyrussell/oh-my-zsh";
-    sha256 = "0p049v1v0jk3v8inn99ankgdn2q5iamsxn203w4vb53266xjgx2r";
+    sha256 = "1mxqa2gf309vjdb1snbczrqwpwi7y6rnmv3n77hsph41bb6j64rz";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/admin/aws-google-auth/default.nix b/pkgs/tools/admin/aws-google-auth/default.nix
index 0fc001d5a19b..e878369f1770 100644
--- a/pkgs/tools/admin/aws-google-auth/default.nix
+++ b/pkgs/tools/admin/aws-google-auth/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonApplication rec {
   pname = "aws-google-auth";
-  version = "0.0.32";
+  version = "0.0.33";
 
   # Pypi doesn't ship the tests, so we fetch directly from GitHub
   # https://github.com/cevoaustralia/aws-google-auth/issues/120
@@ -27,7 +27,7 @@ buildPythonApplication rec {
     owner = "cevoaustralia";
     repo = "aws-google-auth";
     rev = version;
-    sha256 = "0blsvdkb28g1s3c7f8brjjai7lq9ij76xqr5z6zlxxafc4qqwhh3";
+    sha256 = "07sisv7b17bpjwikmm9zpxn3l3xpzywsbxi4brri2hdjmjb6p7w7";
   };
 
   propagatedBuildInputs = [ 
diff --git a/pkgs/tools/admin/fbvnc/default.nix b/pkgs/tools/admin/fbvnc/default.nix
new file mode 100644
index 000000000000..ec32b5f0a268
--- /dev/null
+++ b/pkgs/tools/admin/fbvnc/default.nix
@@ -0,0 +1,30 @@
+{stdenv, fetchFromGitHub}:
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "fbvnc";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "zohead";
+    repo = pname;
+    sha256 = "0lkr4j1wsa05av2g9w99rr9w4j4k7a21vp36x0a3h50y8bmgwgm1";
+    rev = "783204ff6c92afec33d6d36f7e74f1fcf2b1b601";
+  };
+
+  buildInputs = [];
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    cp fbvnc "$out/bin"
+    mkdir -p "$out/share/doc/${pname}"
+    cp README* "$out/share/doc/${pname}"
+  '';
+
+  meta = {
+    description = "Framebuffer VNC client";
+    license = stdenv.lib.licenses.bsd3;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+    homepage = "https://github.com/zohead/fbvnc/";
+  };
+}
diff --git a/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15678.patch b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15678.patch
new file mode 100644
index 000000000000..cd65d2fb5dd9
--- /dev/null
+++ b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15678.patch
@@ -0,0 +1,18 @@
+Adapted from https://github.com/LibVNC/libvncserver/commit/c5ba3fee85a7ecbbca1df5ffd46d32b92757bc2a
+diff --git a/vncviewer/rfbproto.c b/vncviewer/rfbproto.c
+index 04b0230..47a6863 100644
+--- a/vncviewer/rfbproto.c
++++ b/vncviewer/rfbproto.c
+@@ -1217,6 +1217,12 @@ HandleRFBServerMessage()
+     if (serverCutText)
+       free(serverCutText);
+ 
++    if (msg.sct.length > 1<<20) {
++      fprintf(stderr,"Ignoring too big cut text length sent by server: %u B > 1 MB\n",
++              (unsigned int)msg.sct.length);
++      return False;
++    }
++
+     serverCutText = malloc(msg.sct.length+1);
+ 
+     if (!ReadFromRFBServer(serverCutText, msg.sct.length))
diff --git a/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15679.patch b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15679.patch
new file mode 100644
index 000000000000..6d7b3e89e0c4
--- /dev/null
+++ b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15679.patch
@@ -0,0 +1,19 @@
+Adapted from https://github.com/LibVNC/libvncserver/commit/c2c4b81e6cb3b485fb1ec7ba9e7defeb889f6ba7
+diff --git a/vncviewer/rfbproto.c b/vncviewer/rfbproto.c
+index 04b0230..bd11b54 100644
+--- a/vncviewer/rfbproto.c
++++ b/vncviewer/rfbproto.c
+@@ -303,7 +303,12 @@ InitialiseRFBConnection(void)
+   si.format.blueMax = Swap16IfLE(si.format.blueMax);
+   si.nameLength = Swap32IfLE(si.nameLength);
+ 
+-  /* FIXME: Check arguments to malloc() calls. */
++  if (si.nameLength > 1<<20) {
++    fprintf(stderr, "Too big desktop name length sent by server: %lu B > 1 MB\n",
++            (unsigned long)si.nameLength);
++    return False;
++  }
++
+   desktopName = malloc(si.nameLength + 1);
+   if (!desktopName) {
+     fprintf(stderr, "Error allocating memory for desktop name, %lu bytes\n",
diff --git a/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15680.patch b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15680.patch
new file mode 100644
index 000000000000..7426a2b58b10
--- /dev/null
+++ b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15680.patch
@@ -0,0 +1,16 @@
+diff --git a/vncviewer/zlib.c b/vncviewer/zlib.c
+index 80c4eee..76998d8 100644
+--- a/vncviewer/zlib.c
++++ b/vncviewer/zlib.c
+@@ -55,6 +55,11 @@ HandleZlibBPP (int rx, int ry, int rw, int rh)
+     raw_buffer_size = (( rw * rh ) * ( BPP / 8 ));
+     raw_buffer = (char*) malloc( raw_buffer_size );
+ 
++    if ( raw_buffer == NULL ) {
++      fprintf(stderr,
++              "couldn't allocate raw_buffer in HandleZlibBPP");
++      return False;
++    }
+   }
+ 
+   if (!ReadFromRFBServer((char *)&hdr, sz_rfbZlibHeader))
diff --git a/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-8287.patch b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-8287.patch
new file mode 100644
index 000000000000..5bfd1b9ea87f
--- /dev/null
+++ b/pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-8287.patch
@@ -0,0 +1,14 @@
+Adapted from https://github.com/LibVNC/libvncserver/commit/7b1ef0ffc4815cab9a96c7278394152bdc89dc4d
+diff --git a/vncviewer/corre.c b/vncviewer/corre.c
+index c846a10..a4c272d 100644
+--- a/vncviewer/corre.c
++++ b/vncviewer/corre.c
+@@ -56,7 +56,7 @@ HandleCoRREBPP (int rx, int ry, int rw, int rh)
+     XChangeGC(dpy, gc, GCForeground, &gcv);
+     XFillRectangle(dpy, desktopWin, gc, rx, ry, rw, rh);
+ 
+-    if (!ReadFromRFBServer(buffer, hdr.nSubrects * (4 + (BPP / 8))))
++    if (hdr.nSubrects > BUFFER_SIZE / (4 + (BPP / 8)) || !ReadFromRFBServer(buffer, hdr.nSubrects * (4 + (BPP / 8))))
+ 	return False;
+ 
+     ptr = (CARD8 *)buffer;
diff --git a/pkgs/tools/admin/tightvnc/default.nix b/pkgs/tools/admin/tightvnc/default.nix
index 5a76b500d149..1a65c31102e9 100644
--- a/pkgs/tools/admin/tightvnc/default.nix
+++ b/pkgs/tools/admin/tightvnc/default.nix
@@ -9,6 +9,13 @@ stdenv.mkDerivation {
     sha256 = "f48c70fea08d03744ae18df6b1499976362f16934eda3275cead87baad585c0d";
   };
 
+  patches = [
+    ./1.3.10-CVE-2019-15678.patch
+    ./1.3.10-CVE-2019-15679.patch
+    ./1.3.10-CVE-2019-15680.patch
+    ./1.3.10-CVE-2019-8287.patch
+  ];
+
   # for the builder script
   inherit fontDirectories;
 
diff --git a/pkgs/tools/filesystems/dislocker/default.nix b/pkgs/tools/filesystems/dislocker/default.nix
index 81faed5bfa8d..cf87f9ca98e0 100644
--- a/pkgs/tools/filesystems/dislocker/default.nix
+++ b/pkgs/tools/filesystems/dislocker/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, fetchFromGitHub
+{ stdenv
+, fetchFromGitHub
 , cmake
-, polarssl , fuse
+, mbedtls
+, fuse
 }:
-with stdenv.lib;
-let
-  version = "0.7.1";
-in
-stdenv.mkDerivation {
+
+
+stdenv.mkDerivation rec {
   pname = "dislocker";
-  inherit version;
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "aorimn";
@@ -17,9 +17,10 @@ stdenv.mkDerivation {
     sha256 = "1crh2sg5x1kgqmdrl1nmrqwxjykxa4zwnbggcpdn97mj2gvdw7sb";
   };
 
-  buildInputs = [ cmake fuse polarssl ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ fuse mbedtls ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Read BitLocker encrypted partitions in Linux";
     homepage    = https://github.com/aorimn/dislocker;
     license     = licenses.gpl2;
diff --git a/pkgs/tools/misc/bandwidth/default.nix b/pkgs/tools/misc/bandwidth/default.nix
index 3b5e72c89f7f..b4cbc747b1dc 100644
--- a/pkgs/tools/misc/bandwidth/default.nix
+++ b/pkgs/tools/misc/bandwidth/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bandwidth";
-  version = "1.5.1";
+  version = "1.9.3";
 
   src = fetchurl {
     url = "https://zsmith.co/archives/${pname}-${version}.tar.gz";
-    sha256 = "1v9k1a2ilkbhc3viyacgq88c9if60kwsd1fy6rn84317qap4i7ib";
+    sha256 = "0zpv2qgkbak0llw47qcakhyh2z3zv4d69kasldmpdlpqryd9za84";
   };
 
   buildInputs = [ nasm ];
diff --git a/pkgs/tools/misc/bibutils/default.nix b/pkgs/tools/misc/bibutils/default.nix
index d84c6ebaabc6..d099a8aba9b0 100644
--- a/pkgs/tools/misc/bibutils/default.nix
+++ b/pkgs/tools/misc/bibutils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bibutils";
-  version = "6.7";
+  version = "6.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/bibutils/bibutils_${version}_src.tgz";
-    sha256 = "072cmhv692nk1lfcwmaqid5gpg8q4jc4vai5ss8lj72zms32p882";
+    sha256 = "1n28fjrl7zxjxvcqzmrc9xj8ly6nkxviimxbzamj8dslnkzpzqw1";
   };
 
   configureFlags = [ "--dynamic" "--install-dir" "$(out)/bin" "--install-lib" "$(out)/lib" ];
diff --git a/pkgs/tools/misc/calamares/default.nix b/pkgs/tools/misc/calamares/default.nix
index 4adadbf47071..1fd76eb4db64 100644
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@@ -6,12 +6,12 @@
 
 mkDerivation rec {
   pname = "calamares";
-  version = "3.2.15";
+  version = "3.2.16";
 
   # release including submodule
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0m2z34vgcqaf1yfa2919v3mz9b0q43mihz6di5kg62h6swaaanxd";
+    sha256 = "0ygmw03n8knczq9a9whslxcpmgyz0ksqwl0k8f7hyf96b9n8inc2";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/system/osquery/default.nix b/pkgs/tools/system/osquery/default.nix
deleted file mode 100644
index c34b53c1e62d..000000000000
--- a/pkgs/tools/system/osquery/default.nix
+++ /dev/null
@@ -1,149 +0,0 @@
-{ stdenv, lib, fetchFromGitHub, pkgconfig, cmake, python
-, udev, audit, aws-sdk-cpp, cryptsetup, lvm2, libgcrypt, libarchive
-, libgpgerror, libuuid, iptables, dpkg, lzma, bzip2, rpm
-, beecrypt, augeas, libxml2, sleuthkit, yara, lldpd, gflags
-, thrift, boost, rocksdb_lite, glog, gbenchmark, snappy
-, openssl, file, doxygen
-, gtest, fpm, zstd, rdkafka, rapidjson, fetchgit, fetchurl, libelfin
-, smartmontools, which, git, cscope, ctags, ssdeep
-}:
-
-let
-  overrides = {
-    # use older `lvm2` source for osquery, the 2.03 sourcetree
-    # will break osquery due to the lacking header `lvm2app.h`.
-    #
-    # https://github.com/NixOS/nixpkgs/pull/51756#issuecomment-446035295
-    lvm2 = lvm2.overrideAttrs (old: rec {
-      name = "lvm2-${version}";
-      version = "2.02.183";
-      src = fetchgit {
-        url = "git://sourceware.org/git/lvm2.git";
-        rev = "v${version}";
-        sha256 = "1ny3srcsxd6kj59zq1cman5myj8kzw010wbyc6mrpk4kp823r5nx";
-      };
-    });
-
-    # use smartmontools fork to programatically retrieve SMART information.
-    # https://github.com/facebook/osquery/pull/4133
-    smartmontools = smartmontools.overrideAttrs (old: rec {
-      name = "smartmontools-${version}";
-      version = "0.3.1";
-      src = fetchFromGitHub {
-        owner = "allanliu";
-        repo = "smartmontools";
-        rev = "v${version}";
-        sha256 = "1i72fk2ranrky02h7nh9l3va4kjzj0lx1gr477zkxd44wf3w0pjf";
-      };
-
-      # Apple build fix doesn't apply here and isn't needed as we
-      # only support `osquery` on Linux.
-      patches = [];
-    });
-
-    # dpkg 1.19.2 dropped api in `<dpkg/dpkg-db.h>` which breaks compilation.
-    dpkg = dpkg.overrideAttrs (old: rec {
-      name = "dpkg-${version}";
-      version = "1.19.0.5";
-      src = fetchurl {
-        url = "mirror://debian/pool/main/d/dpkg/dpkg_${version}.tar.xz";
-        sha256 = "1dc5kp3fqy1k66fly6jfxkkg7w6d0jy8szddpfyc2xvzga94d041";
-      };
-    });
-
-    # filter out static linking configuration to avoid that the library will
-    # be linked both statically and dynamically.
-    gflags = gflags.overrideAttrs (old: {
-      cmakeFlags = stdenv.lib.filter (f: (builtins.match ".*STATIC.*" f) == null) old.cmakeFlags;
-    });
-  };
-in
-
-stdenv.mkDerivation rec {
-  pname = "osquery";
-  version = "3.3.2";
-
-  # this is what `osquery --help` will show as the version.
-  OSQUERY_BUILD_VERSION = version;
-  OSQUERY_PLATFORM = "NixOS;";
-
-  src = fetchFromGitHub {
-    owner = "facebook";
-    repo = pname;
-    rev = version;
-    sha256 = "0nrwmzmbziacs3y0nljyc73bibr3w68myjpfwkicg9zgkq4qihij";
-  };
-
-  patches = [ ./0001-Fix-CMake-configuration-for-Nix.patch ];
-
-  NIX_CFLAGS_COMPILE = [
-    "-I${libxml2.dev}/include/libxml2"
-  ];
-
-  nativeBuildInputs = [ python which git cscope ctags cmake pkgconfig doxygen fpm ]
-    ++ (with python.pkgs; [ jinja2 ]);
-
-  buildInputs = [
-    udev
-    audit
-    (aws-sdk-cpp.override {
-      apis = [ "firehose" "kinesis" "sts" "ec2" ];
-      customMemoryManagement = false;
-    })
-    overrides.lvm2
-    libgcrypt
-    libarchive
-    libgpgerror
-    libuuid
-    iptables
-    overrides.dpkg
-    lzma
-    bzip2
-    rpm
-    beecrypt
-    augeas
-    libxml2
-    sleuthkit
-    yara
-    lldpd
-    overrides.gflags
-    thrift
-    boost
-    glog
-    gbenchmark
-    snappy
-    openssl
-    file
-    cryptsetup
-    gtest
-    zstd
-    rdkafka
-    rapidjson
-    rocksdb_lite
-    libelfin
-    ssdeep
-    overrides.smartmontools
-  ];
-
-  cmakeFlags = [ "-DSKIP_TESTS=1" ];
-
-  preConfigure = ''
-    cp -r ${fetchFromGitHub {
-      owner = "osquery";
-      repo = "third-party";
-      rev = "32e01462fbea75d3b1904693f937dfd62eaced15";
-      sha256 = "0va24gmgk43a1lyjs63q9qrhvpv8gmqjzpjr5595vhr16idv8wyf";
-    }}/* third-party
-
-    chmod +w -R third-party
-  '';
-
-  meta = with lib; {
-    description = "SQL powered operating system instrumentation, monitoring, and analytics";
-    homepage = https://osquery.io/;
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ma27 ];
-    broken = true;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8bc18fc4661b..e8a02b18b0f5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -261,6 +261,7 @@ mapAliases ({
   openjpeg_2_1 = openjpeg_2; # added 2018-10-25
   opensans-ttf = open-sans; # added 2018-12-04
   openssh_with_kerberos = openssh; # added 2018-01-28
+  osquery = throw "osquery has been removed."; # added 2019-11-24
   owncloudclient = owncloud-client;  # added 2016-08
   p11_kit = p11-kit; # added 2018-02-25
   parquet-cpp = arrow-cpp; # added 2018-09-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 391754253bd7..a76ec2257525 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1011,12 +1011,6 @@ in
     novacomd = callPackage ../development/mobile/webos/novacomd.nix { };
   };
 
-  arc-kde-theme = callPackage ../misc/themes/arc-kde { };
-
-  adapta-gtk-theme = callPackage ../misc/themes/adapta { };
-
-  adapta-kde-theme = callPackage ../misc/themes/adapta-kde { };
-
   aria2 = callPackage ../tools/networking/aria2 {
     inherit (darwin.apple_sdk.frameworks) Security;
     inherit (pythonPackages) sphinx;
@@ -3259,6 +3253,8 @@ in
 
   fbv = callPackage ../tools/graphics/fbv { };
 
+  fbvnc = callPackage ../tools/admin/fbvnc {};
+
   fim = callPackage ../tools/graphics/fim { };
 
   flac123 = callPackage ../applications/audio/flac123 { };
@@ -4286,8 +4282,6 @@ in
 
   kdbplus = pkgsi686Linux.callPackage ../applications/misc/kdbplus { };
 
-  kde2-decoration = libsForQt5.callPackage ../misc/themes/kde2 { };
-
   keepalived = callPackage ../tools/networking/keepalived { };
 
   kexectools = callPackage ../os-specific/linux/kexectools { };
@@ -5428,9 +5422,9 @@ in
 
   opentracing-cpp = callPackage ../development/libraries/opentracing-cpp { };
 
-  openvswitch = callPackage ../os-specific/linux/openvswitch {
-    openssl = openssl_1_0_2;
-  };
+  openvswitch = callPackage ../os-specific/linux/openvswitch { };
+
+  openvswitch-lts = callPackage ../os-specific/linux/openvswitch/lts.nix { };
 
   optipng = callPackage ../tools/graphics/optipng {
     libpng = libpng12;
@@ -5493,8 +5487,6 @@ in
 
   pamtester = callPackage ../tools/security/pamtester { };
 
-  paper-gtk-theme = callPackage ../misc/themes/paper { };
-
   paperless = callPackage ../applications/office/paperless { };
 
   paperwork = callPackage ../applications/office/paperwork { };
@@ -6646,6 +6638,8 @@ in
   thin-provisioning-tools = callPackage ../tools/misc/thin-provisioning-tools {  };
 
   tiled = libsForQt5.callPackage ../applications/editors/tiled { };
+  
+  tiledb = callPackage ../development/libraries/tiledb { };
 
   timemachine = callPackage ../applications/audio/timemachine { };
 
@@ -7766,8 +7760,8 @@ in
   gerbil = callPackage ../development/compilers/gerbil { stdenv = gccStdenv; };
   gerbil-unstable = callPackage ../development/compilers/gerbil/unstable.nix { stdenv = gccStdenv; };
 
-  gccFun = callPackage ../development/compilers/gcc/8;
-  gcc = gcc8;
+  gccFun = callPackage (if stdenv.targetPlatform.isVc4 then ../development/compilers/gcc/6 else ../development/compilers/gcc/8);
+  gcc = if stdenv.targetPlatform.isVc4 then gcc6 else gcc8;
   gcc-unwrapped = gcc.cc;
 
   gccStdenv = if stdenv.cc.isGNU then stdenv else stdenv.override {
@@ -9393,6 +9387,9 @@ in
 
   mspdebug = callPackage ../development/misc/msp430/mspdebug.nix { };
 
+  vc4-newlib = callPackage ../development/misc/vc4/newlib.nix {};
+  resim = callPackage ../misc/emulators/resim {};
+
   rappel = callPackage ../development/misc/rappel/default.nix { };
 
   pharo-vms = callPackage ../development/pharo/vm { };
@@ -10469,6 +10466,8 @@ in
 
   tflint = callPackage ../development/tools/analysis/tflint { };
 
+  tfsec = callPackage ../development/tools/analysis/tfsec { };
+
   todoist = callPackage ../applications/misc/todoist { };
 
   todolist = callPackage ../applications/misc/todolist { };
@@ -10698,9 +10697,9 @@ in
 
   bamf = callPackage ../development/libraries/bamf { };
 
-  bctoolbox = callPackage ../development/libraries/bctoolbox {
-    mbedtls = mbedtls_1_3;
-  };
+  bcg729 = callPackage ../development/libraries/bcg729 { };
+
+  bctoolbox = callPackage ../development/libraries/bctoolbox { };
 
   beecrypt = callPackage ../development/libraries/beecrypt { };
 
@@ -11339,6 +11338,7 @@ in
     else if name == "uclibc" then targetPackages.uclibcCross or uclibcCross
     else if name == "avrlibc" then targetPackages.avrlibcCross or avrlibcCross
     else if name == "newlib" && stdenv.targetPlatform.isMsp430 then targetPackages.msp430NewlibCross or msp430NewlibCross
+    else if name == "newlib" && stdenv.targetPlatform.isVc4 then targetPackages.vc4-newlib or vc4-newlib
     else if name == "newlib" then targetPackages.newlibCross or newlibCross
     else if name == "musl" then targetPackages.muslCross or muslCross
     else if name == "msvcrt" then targetPackages.windows.mingw_w64 or windows.mingw_w64
@@ -11593,6 +11593,12 @@ in
   gtkmm2 = callPackage ../development/libraries/gtkmm/2.x.nix { };
   gtkmm3 = callPackage ../development/libraries/gtkmm/3.x.nix { };
 
+  gtk_engines = callPackage ../development/libraries/gtk-engines { };
+
+  gtk-engine-bluecurve = callPackage ../development/libraries/gtk-engine-bluecurve { };
+
+  gtk-engine-murrine = callPackage ../development/libraries/gtk-engine-murrine { };
+
   gtk-sharp-2_0 = callPackage ../development/libraries/gtk-sharp/2.0.nix {
     inherit (gnome2) libglade libgtkhtml gtkhtml
               libgnomecanvas libgnomeui libgnomeprint
@@ -15416,6 +15422,7 @@ in
   prometheus-mysqld-exporter = callPackage ../servers/monitoring/prometheus/mysqld-exporter.nix { };
   prometheus-nextcloud-exporter = callPackage ../servers/monitoring/prometheus/nextcloud-exporter.nix { };
   prometheus-nginx-exporter = callPackage ../servers/monitoring/prometheus/nginx-exporter.nix { };
+  prometheus-nginxlog-exporter = callPackage ../servers/monitoring/prometheus/nginxlog-exporter.nix { };
   prometheus-node-exporter = callPackage ../servers/monitoring/prometheus/node-exporter.nix { };
   prometheus-openvpn-exporter = callPackage ../servers/monitoring/prometheus/openvpn-exporter.nix { };
   prometheus-postfix-exporter = callPackage ../servers/monitoring/prometheus/postfix-exporter.nix { };
@@ -16178,6 +16185,12 @@ in
     ];
   };
 
+  linux_5_4 = callPackage ../os-specific/linux/kernel/linux-5.4.nix {
+    kernelPatches = [
+      kernelPatches.bridge_stp_helper
+    ];
+  };
+
   linux_testing = callPackage ../os-specific/linux/kernel/linux-testing.nix {
     kernelPatches = [
       kernelPatches.bridge_stp_helper
@@ -16374,7 +16387,7 @@ in
   linux = linuxPackages.kernel;
 
   # Update this when adding the newest kernel major version!
-  linuxPackages_latest = linuxPackages_5_3;
+  linuxPackages_latest = linuxPackages_5_4;
   linux_latest = linuxPackages_latest.kernel;
 
   # Build the kernel modules for the some of the kernels.
@@ -16388,6 +16401,7 @@ in
   linuxPackages_4_14 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_14);
   linuxPackages_4_19 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_19);
   linuxPackages_5_3 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_3);
+  linuxPackages_5_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_5_4);
 
   # When adding to this list:
   # - Update linuxPackages_latest to the latest version
@@ -17001,12 +17015,20 @@ in
 
   adapta-backgrounds = callPackage ../data/misc/adapta-backgrounds { };
 
+  adapta-gtk-theme = callPackage ../data/themes/adapta { };
+
+  adapta-kde-theme = callPackage ../data/themes/adapta-kde { };
+
   adementary-theme = callPackage ../data/themes/adementary { };
 
+  adwaita-qt = libsForQt5.callPackage ../data/themes/adwaita-qt { };
+
   agave = callPackage ../data/fonts/agave { };
 
   aileron = callPackage ../data/fonts/aileron { };
 
+  albatross = callPackage ../data/themes/albatross { };
+
   amber-theme = callPackage ../data/themes/amber { };
 
   amiri = callPackage ../data/fonts/amiri { };
@@ -17026,6 +17048,8 @@ in
 
   arc-icon-theme = callPackage ../data/icons/arc-icon-theme { };
 
+  arc-kde-theme = callPackage ../data/themes/arc-kde { };
+
   arc-theme = callPackage ../data/themes/arc { };
 
   arkpandora_ttf = callPackage ../data/fonts/arkpandora { };
@@ -17046,6 +17070,8 @@ in
   bibata-extra-cursors = callPackage ../data/icons/bibata-cursors/extra.nix { };
   bibata-cursors-translucent = callPackage ../data/icons/bibata-cursors/translucent.nix { };
 
+  blackbird = callPackage ../data/themes/blackbird { };
+
   brise = callPackage ../data/misc/brise { };
 
   inherit (kdeFrameworks) breeze-icons;
@@ -17066,6 +17092,8 @@ in
 
   cherry = callPackage ../data/fonts/cherry { inherit (xorg) fonttosfnt mkfontdir; };
 
+  clearlooks-phenix = callPackage ../data/themes/clearlooks-phenix { };
+
   cnstrokeorder = callPackage ../data/fonts/cnstrokeorder {};
 
   comfortaa = callPackage ../data/fonts/comfortaa {};
@@ -17152,10 +17180,14 @@ in
 
   dosemu_fonts = callPackage ../data/fonts/dosemu-fonts { };
 
+  e17gtk = callPackage ../data/themes/e17gtk { };
+
   eb-garamond = callPackage ../data/fonts/eb-garamond { };
 
   elliptic_curves = callPackage ../data/misc/elliptic_curves { };
 
+  equilux-theme = callPackage ../data/themes/equilux-theme { };
+
   eunomia = callPackage ../data/fonts/eunomia { };
 
   f5_6 = callPackage ../data/fonts/f5_6 { };
@@ -17211,6 +17243,8 @@ in
 
   gsettings-desktop-schemas = callPackage ../development/libraries/gsettings-desktop-schemas { };
 
+  gnome-breeze = callPackage ../data/themes/gnome-breeze { };
+
   go-font = callPackage ../data/fonts/go-font { };
 
   greybird = callPackage ../data/themes/greybird { };
@@ -17265,6 +17299,8 @@ in
 
   kawkab-mono-font = callPackage ../data/fonts/kawkab-mono {};
 
+  kde2-decoration = libsForQt5.callPackage ../data/themes/kde2 { };
+
   kochi-substitute = callPackage ../data/fonts/kochi-substitute {};
 
   kochi-substitute-naga10 = callPackage ../data/fonts/kochi-substitute-naga10 {};
@@ -17406,24 +17442,36 @@ in
 
   numix-cursor-theme = callPackage ../data/icons/numix-cursor-theme { };
 
+  numix-gtk-theme = callPackage ../data/themes/numix { };
+
+  numix-solarized-gtk-theme = callPackage ../data/themes/numix-solarized { };
+
+  numix-sx-gtk-theme = callPackage ../data/themes/numix-sx { };
+
   office-code-pro = callPackage ../data/fonts/office-code-pro { };
 
   oldstandard = callPackage ../data/fonts/oldstandard { };
 
   oldsindhi = callPackage ../data/fonts/oldsindhi { };
 
+  onestepback = callPackage ../data/themes/onestepback { };
+
   open-dyslexic = callPackage ../data/fonts/open-dyslexic { };
 
   open-sans = callPackage ../data/fonts/open-sans { };
 
   orbitron = callPackage ../data/fonts/orbitron { };
 
+  orion = callPackage ../data/themes/orion {};
+
   overpass = callPackage ../data/fonts/overpass { };
 
   oxygenfonts = callPackage ../data/fonts/oxygenfonts { };
 
   inherit (kdeFrameworks) oxygen-icons5;
 
+  paper-gtk-theme = callPackage ../data/themes/paper-gtk { };
+
   paper-icon-theme = callPackage ../data/icons/paper-icon-theme { };
 
   papirus-icon-theme = callPackage ../data/icons/papirus-icon-theme { };
@@ -17478,6 +17526,8 @@ in
 
   qogir-theme = callPackage ../data/themes/qogir { };
 
+  qtcurve = libsForQt5.callPackage ../data/themes/qtcurve {};
+
   redhat-official-fonts = callPackage ../data/fonts/redhat-official { };
 
   route159 = callPackage ../data/fonts/route159 { };
@@ -17506,6 +17556,8 @@ in
 
   sierra-gtk-theme = callPackage ../data/themes/sierra { };
 
+  solarc-gtk-theme = callPackage ../data/themes/solarc { };
+
   soundfont-fluid = callPackage ../data/soundfonts/fluid { };
 
   stdmanpages = callPackage ../data/documentation/std-man-pages { };
@@ -17621,6 +17673,8 @@ in
 
   tex-gyre-math = callPackages ../data/fonts/tex-gyre-math { };
 
+  theme-vertex = callPackage ../data/themes/vertex { };
+
   tipa = callPackage ../data/fonts/tipa { };
 
   ttf_bitstream_vera = callPackage ../data/fonts/ttf-bitstream-vera { };
@@ -19712,9 +19766,7 @@ in
 
   links2 = callPackage ../applications/networking/browsers/links2 { };
 
-  linphone = callPackage ../applications/networking/instant-messengers/linphone {
-    polarssl = mbedtls_1_3;
-  };
+  linphone = callPackage ../applications/networking/instant-messengers/linphone { };
 
   linuxsampler = callPackage ../applications/audio/linuxsampler { };
 
@@ -20156,8 +20208,6 @@ in
 
   ptex = callPackage ../development/libraries/ptex {};
 
-  qtcurve = libsForQt5.callPackage ../misc/themes/qtcurve {};
-
   qbec = callPackage ../applications/networking/cluster/qbec { };
 
   rssguard = libsForQt5.callPackage ../applications/networking/feedreaders/rssguard { };
@@ -20409,8 +20459,6 @@ in
 
   osmo = callPackage ../applications/office/osmo { };
 
-  osquery = callPackage ../tools/system/osquery { };
-
   palemoon = callPackage ../applications/networking/browsers/palemoon {
     # https://forum.palemoon.org/viewtopic.php?f=57&t=15296#p111146
     stdenv = gcc49Stdenv;
@@ -23244,8 +23292,6 @@ in
 
   ### DESKTOP ENVIRONMENTS
 
-  clearlooks-phenix = callPackage ../misc/themes/clearlooks-phenix { };
-
   deepin = recurseIntoAttrs (import ../desktops/deepin {
     inherit pkgs libsForQt5;
     inherit (lib) makeScope;
@@ -23319,36 +23365,12 @@ in
 
   latte-dock = libsForQt5.callPackage ../applications/misc/latte-dock { };
 
-  adwaita-qt = libsForQt5.callPackage ../misc/themes/adwaita-qt { };
-
-  orion = callPackage ../misc/themes/orion {};
-
-  albatross = callPackage ../misc/themes/albatross { };
-
-  gtk_engines = callPackage ../misc/themes/gtk2/gtk-engines { };
-
-  gtk-engine-bluecurve = callPackage ../misc/themes/gtk2/gtk-engine-bluecurve { };
-
-  gtk-engine-murrine = callPackage ../misc/themes/gtk2/gtk-engine-murrine { };
-
   gnome-themes-extra = gnome3.gnome-themes-extra;
 
-  numix-gtk-theme = callPackage ../misc/themes/numix { };
-
-  numix-solarized-gtk-theme = callPackage ../misc/themes/numix-solarized { };
-
-  numix-sx-gtk-theme = callPackage ../misc/themes/numix-sx { };
-
-  onestepback = callPackage ../misc/themes/onestepback { };
-
-  theme-vertex = callPackage ../misc/themes/vertex { };
-
   rox-filer = callPackage ../desktops/rox/rox-filer {
     gtk = gtk2;
   };
 
-  solarc-gtk-theme = callPackage ../misc/themes/solarc { };
-
   xfce = recurseIntoAttrs (callPackage ../desktops/xfce { });
 
   xrandr-invert-colors = callPackage ../applications/misc/xrandr-invert-colors { };
@@ -24260,8 +24282,6 @@ in
 
   bees = callPackage ../tools/filesystems/bees { };
 
-  blackbird = callPackage ../misc/themes/blackbird { };
-
   bootil = callPackage ../development/libraries/bootil { };
 
   brgenml1lpr = pkgsi686Linux.callPackage ../misc/cups/drivers/brgenml1lpr {};
@@ -24300,8 +24320,6 @@ in
 
   terminal-parrot = callPackage ../applications/misc/terminal-parrot { };
 
-  e17gtk = callPackage ../misc/themes/e17gtk { };
-
   epson-alc1100 = callPackage ../misc/drivers/epson-alc1100 { };
 
   epson-escpr = callPackage ../misc/drivers/epson-escpr { };
@@ -24370,8 +24388,6 @@ in
 
   electricsheep = callPackage ../misc/screensavers/electricsheep { };
 
-  equilux-theme = callPackage ../misc/themes/equilux-theme { };
-
   flam3 = callPackage ../tools/graphics/flam3 { };
 
   glee = callPackage ../tools/graphics/glee { };
@@ -24431,8 +24447,6 @@ in
 
   glava = callPackage ../applications/misc/glava {};
 
-  gnome-breeze = callPackage ../misc/themes/gnome-breeze { };
-
   gnuk = callPackage ../misc/gnuk {
     gcc-arm-embedded = pkgsCross.arm-embedded.buildPackages.gcc;
     binutils-arm-embedded = pkgsCross.arm-embedded.buildPackages.binutils;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 21db43dd3587..a3a6dbef322d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -499,6 +499,8 @@ in {
 
   cachy = callPackage ../development/python-modules/cachy { };
 
+  catalogue = callPackage ../development/python-modules/catalogue { };
+
   cdecimal = callPackage ../development/python-modules/cdecimal { };
 
   cfn-flip = callPackage ../development/python-modules/cfn-flip { };
@@ -5252,6 +5254,10 @@ in {
 
   texttable = callPackage ../development/python-modules/texttable { };
 
+  tiledb = callPackage ../development/python-modules/tiledb { 
+    inherit (pkgs) tiledb;
+  };
+
   tiros = callPackage ../development/python-modules/tiros { };
 
   tifffile = callPackage ../development/python-modules/tifffile { };