Merge commit '0c0954781e257b8b0dc49341795a2fe7d96945a3'

31 files changed, 383 insertions, 165 deletions

diff --git a/nixpkgs/pkgs/os-specific/linux/anbox/default.nix b/nixpkgs/pkgs/os-specific/linux/anbox/default.nix
new file mode 100644
index 000000000000..a21a0bb58bd8
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/anbox/default.nix
@@ -0,0 +1,138 @@
+{ stdenv, lib, fetchFromGitHub, fetchurl
+, cmake, pkgconfig, dbus, makeWrapper
+, gtest
+, boost
+, libcap
+, systemd
+, mesa
+, libGL
+, libglvnd
+, glib
+, git
+, SDL2
+, SDL2_image
+, properties-cpp
+, protobuf
+, protobufc
+, python
+, lxc
+, writeText
+, writeScript
+, runtimeShell
+}:
+
+let
+
+  dbus-service = writeText "org.anbox.service" ''
+    [D-BUS Service]
+    Name=org.anbox
+    Exec=@out@/libexec/anbox-session-manager
+  '';
+
+  anbox-application-manager = writeScript "anbox-application-manager" ''
+    #!${runtimeShell}
+
+    ${systemd}/bin/busctl --user call \
+        org.freedesktop.DBus \
+        /org/freedesktop/DBus \
+        org.freedesktop.DBus \
+        StartServiceByName "su" org.anbox 0
+
+    @out@/bin/anbox launch --package=org.anbox.appmgr --component=org.anbox.appmgr.AppViewActivity
+  '';
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "anbox";
+  version = "unstable-2019-03-07";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "d521e282965462e82465045ab95d4ae1c4619685";
+    sha256 = "1wfx4bsyxvrjl16dq5pqgial8rnnsnxzbak2ap0waddz847czxwz";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    cmake pkgconfig dbus boost libcap gtest systemd mesa glib
+    SDL2 SDL2_image protobuf protobufc properties-cpp lxc python
+    libGL
+  ];
+
+  patchPhase = ''
+    patchShebangs scripts
+
+    cat >cmake/FindGMock.cmake <<'EOF'
+      add_library(gtest INTERFACE)
+      target_include_directories(gtest INTERFACE ${gtest.dev}/include)
+      target_link_libraries(gtest INTERFACE ${gtest}/lib/libgtest.so ''${CMAKE_THREAD_LIBS_INIT})
+      add_dependencies(gtest GMock)
+
+      add_library(gtest_main INTERFACE)
+      target_include_directories(gtest_main INTERFACE ${gtest.dev}/include)
+      target_link_libraries(gtest_main INTERFACE ${gtest}/lib/libgtest_main.so gtest)
+
+      add_library(gmock INTERFACE)
+      target_include_directories(gmock INTERFACE ${gtest.dev}/include)
+      target_link_libraries(gmock INTERFACE ${gtest}/lib/libgmock.so gtest)
+
+      add_library(gmock_main INTERFACE)
+      target_include_directories(gmock_main INTERFACE ${gtest.dev}/include)
+      target_link_libraries(gmock_main INTERFACE ${gtest}/lib/libgmock_main.so gmock gtest_main)
+
+      set(GTEST_LIBRARIES gtest)
+      set(GTEST_MAIN_LIBRARIES gtest_main)
+      set(GMOCK_LIBRARIES gmock gmock_main)
+      set(GTEST_BOTH_LIBRARIES ''${GTEST_LIBRARIES} ''${GTEST_MAIN_LIBRARIES})
+    EOF
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/anbox \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [libGL libglvnd]} \
+      --prefix PATH : ${git}/bin
+
+    mkdir -p $out/share/dbus-1/services
+    substitute ${dbus-service} $out/share/dbus-1/services/org.anbox.service \
+      --subst-var out
+
+    mkdir $out/libexec
+    makeWrapper $out/bin/anbox $out/libexec/anbox-session-manager \
+      --add-flags session-manager
+
+    substitute ${anbox-application-manager} $out/bin/anbox-application-manager \
+      --subst-var out
+  '';
+
+  passthru.image = let
+    imgroot = "https://build.anbox.io/android-images";
+  in
+    {
+      armv7l-linux = fetchurl {
+        url = imgroot + "/2017/06/12/android_1_armhf.img";
+        sha256 = "1za4q6vnj8wgphcqpvyq1r8jg6khz7v6b7h6ws1qkd5ljangf1w5";
+      };
+      aarch64-linux = fetchurl {
+        url = imgroot + "/2017/08/04/android_1_arm64.img";
+        sha256 = "02yvgpx7n0w0ya64y5c7bdxilaiqj9z3s682l5s54vzfnm5a2bg5";
+      };
+      x86_64-linux = fetchurl {
+        url = imgroot + "/2018/07/19/android_amd64.img";
+        sha256 = "1jlcda4q20w30cm9ikm6bjq01p547nigik1dz7m4v0aps4rws13b";
+      };
+    }.${stdenv.system} or null;
+
+  meta = with stdenv.lib; {
+    homepage = https://anbox.io;
+    description = "Android in a box";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ edwtjo ];
+    platforms = [ "armv7l-linux" "aarch64-linux" "x86_64-linux" ];
+  };
+
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/anbox/kmod.nix b/nixpkgs/pkgs/os-specific/linux/anbox/kmod.nix
new file mode 100644
index 000000000000..8a102996cab6
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/anbox/kmod.nix
@@ -0,0 +1,43 @@
+{ stdenv, lib, kernel, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "anbox-modules";
+  version = "2018-09-08-" + kernel.version;
+
+  src = fetchFromGitHub {
+    owner = "anbox";
+    repo = "anbox-modules";
+    rev = "27fd47e11ef6eef93738f8f3df3e42c88975544e";
+    sha256 = "1hnf5x5swjcws6mnxmd3byll8l7qsxxj9pgki2k31rbmqqf2sb0x";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  KERNEL_SRC="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  buildPhase = ''
+    for d in ashmem binder;do
+      cd $d
+      make
+      cd -
+    done
+  '';
+
+  installPhase = ''
+    modDir=$out/lib/modules/${kernel.modDirVersion}/kernel/updates/
+    mkdir -p $modDir
+    for d in ashmem binder;do
+      mv $d/$d*.ko $modDir/.
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Anbox ashmem and binder drivers.";
+    homepage = https://github.com/anbox/anbox-modules;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    broken = (versionOlder kernel.version "4.4") || (kernel.features.grsecurity);
+    maintainers = with maintainers; [ edwtjo ];
+  };
+
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix
index 1227d22916c9..671b13c4d79c 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }:
 
 let
-  ver = "2019.0";
+  ver = "2019.1";
 in
 stdenv.mkDerivation rec {
   name = "alfred-${ver}";
 
   src = fetchurl {
     url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0sml6z90kpchmn61597j7yag97gk59fscz4xjxdfh9zycd3nfsn0";
+    sha256 = "0nsi5g77zsl0s683r0hqz91xs2bz91ic9c1qdsa3ikd46z8s8lkj";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix
index b84338ed258b..44c975b8dcc1 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2019.0";
+  ver = "2019.1";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0cdmb3zkjh8xcsicwyrimwzj8f4x3rjsfzk9im7695pkdw4j2xwr";
+    sha256 = "14wp8rvm2m1r5qz7p1m08bzg2gmqyldkw1p6gk8rkdyqb3q0abg8";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix b/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix
index 52ef018cbfeb..c6e23be8b89d 100644
--- a/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, kernel }:
 
-let base = "batman-adv-2019.0"; in
+let base = "batman-adv-2019.1"; in
 
 stdenv.mkDerivation rec {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha256 = "1h5xxf6nkdhk9dxf3d4fsasmiahy0y7bhlicyhnppgfdf6kxi5ry";
+    sha256 = "1af5q4631b72q0gg0xmhxx2k3adky2ahk4dq97k0436a0rg617dr";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/nixpkgs/pkgs/os-specific/linux/cgmanager/default.nix b/nixpkgs/pkgs/os-specific/linux/cgmanager/default.nix
index 9acb011b4633..6ba86036a52a 100644
--- a/nixpkgs/pkgs/os-specific/linux/cgmanager/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cgmanager/default.nix
@@ -1,15 +1,16 @@
-{ stdenv, fetchurl, pkgconfig, libnih, dbus, pam }:
+{ stdenv, fetchurl, pkgconfig, libnih, dbus, pam, popt }:
 
 stdenv.mkDerivation rec {
-  name = "cgmanager-0.41";
+  pname = "cgmanager";
+  version = "0.42";
 
   src = fetchurl {
-    url = "https://linuxcontainers.org/downloads/cgmanager/${name}.tar.gz";
-    sha256 = "0n5l4g78ifvyfnj8x9xz06mqn4y8j73sgg4xsbak7hiszfz5bc99";
+    url = "https://linuxcontainers.org/downloads/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "15np08h9jrvc1y1iafr8v654mzgsv5hshzc0n4p3pbf0rkra3h7c";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libnih dbus pam ];
+  buildInputs = [ libnih dbus pam popt ];
 
   configureFlags = [
     "--with-init-script=systemd"
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index df917888dc77..ee0a02763d14 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "firmware-linux-nonfree-${version}";
-  version = "2019-02-13";
+  version = "2019-03-12";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
-    rev = "710963fe53ee3f227556d36839df3858daf6e232";
-    sha256 = "1q3jvlqqxba08s2mrh9hwl0d5w6nhkwj63j0m6amxqpf10k49jxp";
+    rev = "20190312";
+    sha256 = "1wk8l75rg7idvsyli29a1fii4xwz3vnm8d65fjw8d3azihdrhbyy";
   };
 
   installFlags = [ "DESTDIR=$(out)" ];
@@ -15,10 +15,6 @@ stdenv.mkDerivation rec {
   # Firmware blobs do not need fixing and should not be modified
   dontFixup = true;
 
-  outputHashMode = "recursive";
-  outputHashAlgo = "sha256";
-  outputHash = "13gqnr6gm7336pm48v5p37clphwwdmgbrcipsg3w44wdwgc7fa2f";
-
   meta = with stdenv.lib; {
     description = "Binary firmware collection packaged by kernel.org";
     homepage = http://packages.debian.org/sid/firmware-linux-nonfree;
diff --git a/nixpkgs/pkgs/os-specific/linux/iputils/build-ninfod-with-openssl.patch b/nixpkgs/pkgs/os-specific/linux/iputils/build-ninfod-with-openssl.patch
new file mode 100644
index 000000000000..7ce1b4f527ec
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/iputils/build-ninfod-with-openssl.patch
@@ -0,0 +1,13 @@
+diff --git a/ninfod/meson.build b/ninfod/meson.build
+index ea7ec1b..fada05b 100644
+--- a/ninfod/meson.build
++++ b/ninfod/meson.build
+@@ -10,7 +10,7 @@ ninfod_sources = files('''
+ 	ninfod_name.c
+ '''.split())
+ executable('ninfod', [ninfod_sources, git_version_h],
+-	dependencies : [cap_dep, crypto_dep, rt_dep, threads],
++	dependencies : [cap_dep, dependency('openssl'), rt_dep, threads],
+ 	link_with : [libcommon],
+ 	include_directories : inc,
+ 	install: true,
diff --git a/nixpkgs/pkgs/os-specific/linux/iputils/default.nix b/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
index 2248f0329c60..223d5c4fe0fb 100644
--- a/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iputils/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub, fetchpatch
-, libxslt, docbook_xsl, docbook_xml_dtd_44
-, libcap, nettle, libidn2, openssl
+, meson, ninja, pkgconfig, gettext, libxslt, docbook_xsl_ns
+, libcap, nettle, libidn2, openssl, systemd
 }:
 
 with stdenv.lib;
 
 let
-  time = "20180629";
+  time = "20190324";
   # ninfod probably could build on cross, but the Makefile doesn't pass --host
   # etc to the sub configure...
   withNinfod = stdenv.hostPlatform == stdenv.buildPlatform;
@@ -21,63 +21,37 @@ in stdenv.mkDerivation {
     owner = "iputils";
     repo = "iputils";
     rev = "s${time}";
-    sha256 = "19rpl48pjgmyqlm4h7sml5gy7yg4cxciadxcs24q1zj40c05jls0";
+    sha256 = "0b755gv3370c0rrphx14mrsqjb396zqnsm9lsws842a4k4zrqmvi";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "dont-hardcode-the-location-of-xsltproc.patch";
-      url = "https://github.com/iputils/iputils/commit/d0ff83e87ea9064d9215a18e93076b85f0f9e828.patch";
-      sha256 = "05wrwf0bfmax69bsgzh3b40n7rvyzw097j8z5ix0xsg0kciygjvx";
-    })
-    (fetchpatch {
-      name = "add-missing-idn-declarations.patch";
-      url = "https://github.com/iputils/iputils/commit/5007d7067918fb3d950d34c01d059e5222db679a.patch";
-      sha256 = "0dhgxdhjcbb2q6snm3mjp38l066knykmrx4k8rn167cizn7akpdx";
-    })
-    (fetchpatch {
-      name = "fix-ping-idn.patch";
-      url = "https://github.com/iputils/iputils/commit/25899e849aa3abc1ad29ebf0b830262a859eaed5.patch";
-      sha256 = "1bqjcdjjnc2j6indcli7s7gbbhkcaligvh94asixfrmjzkbn533n";
-    })
-  ];
-
-  prePatch = ''
-    substituteInPlace doc/custom-man.xsl \
-      --replace "http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl" "${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"
-    for xmlFile in doc/*.xml; do
-      substituteInPlace $xmlFile \
-        --replace "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" "${docbook_xml_dtd_44}/xml/dtd/docbook/docbookx.dtd"
-    done
-  '';
-
-  # Disable idn usage w/musl: https://github.com/iputils/iputils/pull/111
-  makeFlags = optional stdenv.hostPlatform.isMusl "USE_IDN=no";
-
-  nativeBuildInputs = [ libxslt.bin ];
-  buildInputs = [ libcap nettle ]
+  # ninfod cannot be build with nettle yet:
+  patches =
+    [ ./build-ninfod-with-openssl.patch
+      (fetchpatch { # tracepath: fix musl build, again
+        url = "https://github.com/iputils/iputils/commit/c9aca1b53324bcd1b5a2de5c645813f80eccd016.patch";
+        sha256 = "0faqgkqbi57cyx1zgzzy6xgd24xr0iawix7mjs47j92ra9gw90cz";
+      })
+      (fetchpatch { # doc: Use namespace correctly
+        url = "https://github.com/iputils/iputils/commit/c503834519d21973323980850431101f90e663ef.patch";
+        sha256 = "1yp6b6403ddccbhfzsb36cscxd36d4xb8syc1g02a18xkswiwf09";
+      })
+    ];
+
+  mesonFlags =
+    [ "-DUSE_CRYPTO=nettle"
+      "-DBUILD_RARPD=true"
+      "-DBUILD_TRACEROUTE6=true"
+      "-Dsystemdunitdir=etc/systemd/system"
+    ]
+    ++ optional (!withNinfod) "-DBUILD_NINFOD=false"
+    # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
+    ++ optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
+
+  nativeBuildInputs = [ meson ninja pkgconfig gettext libxslt.bin docbook_xsl_ns libcap ];
+  buildInputs = [ libcap nettle systemd ]
     ++ optional (!stdenv.hostPlatform.isMusl) libidn2
     ++ optional withNinfod openssl; # TODO: Build with nettle
 
-  buildFlags = "man all" + optionalString withNinfod " ninfod";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share/man/man8
-
-    for tool in arping clockdiff ping rarpd rdisc tftpd tracepath traceroute6; do
-      cp $tool $out/bin/
-      cp doc/$tool.8 $out/share/man/man8/
-    done
-
-    # TODO: Requires kernel module pg3
-    cp ipg $out/bin/
-    cp doc/pg3.8 $out/share/man/man8/
-  '' + optionalString withNinfod ''
-    cp ninfod/ninfod $out/bin/
-    cp doc/ninfod.8 $out/share/man/man8/
-  '';
-
   meta = {
     homepage = https://github.com/iputils/iputils;
     description = "A set of small useful utilities for Linux networking";
diff --git a/nixpkgs/pkgs/os-specific/linux/it87/default.nix b/nixpkgs/pkgs/os-specific/linux/it87/default.nix
new file mode 100644
index 000000000000..c115eab1503e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/it87/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  name = "it87-${version}-${kernel.version}";
+  version = "2018-08-14";
+
+  # The original was deleted from github, but this seems to be an active fork
+  src = fetchFromGitHub {
+    owner = "hannesha";
+    repo = "it87";
+    rev = "5515f5b78838cb6be551943ffef5d1792012724c";
+    sha256 = "1ygi4mwds4q7byhg8gqnh3syamdj5rpjy3jj012k7vl54gdgrmgm";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preConfigure = ''
+    sed -i 's|depmod|#depmod|' Makefile
+  '';
+
+  makeFlags = [
+    "TARGET=${kernel.modDirVersion}"
+    "KERNEL_MODULES=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
+    "MODDESTDIR=$(out)/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Patched module for IT87xx superio chip sensors support";
+    homepage = https://github.com/hannesha/it87;
+    license = licenses.gpl2;
+    platforms = [ "x86_64-linux" "i686-linux" ];
+    maintainers = with maintainers; [ yorickvp ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
index 189110445792..5711e019f95b 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
@@ -240,7 +240,7 @@ let
       FANOTIFY        = yes;
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
-      FS_ENCRYPTION   = { optional = true; tristate = whenAtLeast "4.9" "m"; };
+      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else whenAtLeast "4.9" (option module);
 
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
@@ -681,6 +681,9 @@ let
       HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
       HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
 
+      # Enable AMD's ROCm GPU compute stack
+      HSA_AMD = whenAtLeast "4.20" yes;
+
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enable memory hotplug support
       # Allows you to dynamically add & remove memory to a VM client running NixOS without requiring a reboot
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
index f2c50942648e..89639d34a6c3 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.107";
+  version = "4.14.110";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1x2fkcgywiyzjynnz9pldp20nz97zbkpylj3wh1rsfcf8q0hz3g4";
+    sha256 = "0wlysm6j8mmfwcja8pxg6a5c611m3x597591hswpm2nwcja3bslr";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
index dea1e7909c7c..d043a18844b1 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.30";
+  version = "4.19.33";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1hkhxbdxck1hc9hbja5afshmd4afngi4haff57vammrkxfc0jkpy";
+    sha256 = "14yk5hli62q1g8vghjjghbxjkpxns8zp0l2wmyhlx0v21bx2v89r";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.20.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.20.nix
deleted file mode 100644
index 24db21a536d6..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.20.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
-
-with stdenv.lib;
-
-buildLinux (args // rec {
-  version = "4.20.17";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0glabx4v5pgyfwslllbv2qaz5ah492sq1w7bbz0x905r55b284fh";
-  };
-} // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 0b5c5f3e095d..1698c9d70942 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.176";
+  version = "4.4.178";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0pf7y4dcnf4mn11wgjd65v09kx3p712ky50w6vrn45v9m80m9ni7";
+    sha256 = "0g84g808v7zjnfm1nh7ba0swa4n2bfw8m7h5qgmknjwrnwi8qnf3";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 4c8e7f6139c6..f583ced1a631 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.164";
+  version = "4.9.167";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1rzqfcz3zlc86n7df1rmpgpdbk388vbcqm571q890lrsimsrixdd";
+    sha256 = "130a7z31sdha84w67vfx0j1sq68v15aksfkcshz219p75y561f52";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.0.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.0.nix
index d0c7c6439c2f..4038a89f6c63 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.0.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.0.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.0.3";
+  version = "5.0.6";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "12gzpz53kgznk5xg2cgbhfrgxflbx5zsnbpwki8zsjvq59wk7ma0";
+    sha256 = "04zl3xqgr6rlkc44raz3rz74ag7l5j16wkvkdmlzrdq7ia6rljly";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp.nix
index 7375daf61da5..d96853eb7cfc 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-mptcp.nix
@@ -1,10 +1,11 @@
-{ stdenv, buildPackages, fetchFromGitHub, perl, buildLinux, ... } @ args:
-
-buildLinux (rec {
-  mptcpVersion = "0.94.1";
-  modDirVersion = "4.14.70";
+{ stdenv, buildPackages, fetchFromGitHub, perl, buildLinux, structuredExtraConfig ? {}, ... } @ args:
+let
+  mptcpVersion = "0.94.3";
+  modDirVersion = "4.14.105";
+in
+buildLinux ({
   version = "${modDirVersion}-mptcp_v${mptcpVersion}";
-  # autoModules= true;
+  inherit modDirVersion;
 
   extraMeta = {
     branch = "4.4";
@@ -15,32 +16,34 @@ buildLinux (rec {
     owner = "multipath-tcp";
     repo = "mptcp";
     rev = "v${mptcpVersion}";
-    sha256 = "13mi672jr1x463kzig1hi9cpdi8x6nqdfd4bqlrjn8zca48f4ln4";
+    sha256 = "1pic86icrlmxajw4hkqyljha8a3k4w9kb5z74xj4yiyapmk9wprm";
   };
 
-  extraConfig = ''
-    IPV6 y
-    MPTCP y
-    IP_MULTIPLE_TABLES y
+  structuredExtraConfig = with import ../../../../lib/kernel.nix { inherit (stdenv) lib; version = null; };
+    stdenv.lib.mkMerge [ {
+    IPV6               = yes;
+    MPTCP              = yes;
+    IP_MULTIPLE_TABLES = yes;
 
     # Enable advanced path-managers...
-    MPTCP_PM_ADVANCED y
-    MPTCP_FULLMESH y
-    MPTCP_NDIFFPORTS y
+    MPTCP_PM_ADVANCED = yes;
+    MPTCP_FULLMESH = yes;
+    MPTCP_NDIFFPORTS = yes;
     # ... but use none by default.
     # The default is safer if source policy routing is not setup.
-    DEFAULT_DUMMY y
-    DEFAULT_MPTCP_PM default
+    DEFAULT_DUMMY = yes;
+    DEFAULT_MPTCP_PM.freeform = "default";
 
     # MPTCP scheduler selection.
-    MPTCP_SCHED_ADVANCED y
-    DEFAULT_MPTCP_SCHED default
+    MPTCP_SCHED_ADVANCED = yes;
+    DEFAULT_MPTCP_SCHED.freeform = "default";
 
     # Smarter TCP congestion controllers
-    TCP_CONG_LIA m
-    TCP_CONG_OLIA m
-    TCP_CONG_WVEGAS m
-    TCP_CONG_BALIA m
-
-  '' + (args.extraConfig or "");
+    TCP_CONG_LIA = module;
+    TCP_CONG_OLIA = module;
+    TCP_CONG_WVEGAS = module;
+    TCP_CONG_BALIA = module;
+  }
+  structuredExtraConfig
+  ];
 } // args)
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
index 375a71789bee..fde9e560c46f 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "5.0-rc8";
-  modDirVersion = "5.0.0-rc8";
-  extraMeta.branch = "5.0";
+  version = "5.1-rc3";
+  modDirVersion = "5.1.0-rc3";
+  extraMeta.branch = "5.1";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1i58jljwc2y58ggahmh5643h3nckf3k00d0qnni4s9z1xw3w143p";
+    sha256 = "1nc5h0rfd40wfp8ld0d6n90haxp4xqcapwkg4vgn2m0c6dcspl2n";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/nixpkgs/pkgs/os-specific/linux/libatasmart/default.nix b/nixpkgs/pkgs/os-specific/linux/libatasmart/default.nix
index 3c8c71bdde57..018f8c624350 100644
--- a/nixpkgs/pkgs/os-specific/linux/libatasmart/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libatasmart/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, udev }:
+{ stdenv, fetchurl, pkgconfig, udev, buildPackages }:
 
 stdenv.mkDerivation rec {
   name = "libatasmart-0.19";
@@ -8,6 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "138gvgdwk6h4ljrjsr09pxk1nrki4b155hqdzyr8mlk3bwsfmw31";
   };
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ udev ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix b/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix
index edba8b090df8..5dab4b34f466 100644
--- a/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libratbag/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "libratbag-${version}";
-  version = "0.9.904";
+  version = "0.9.905";
 
   src = fetchFromGitHub {
     owner  = "libratbag";
     repo   = "libratbag";
     rev    = "v${version}";
-    sha256 = "0d2gw4bviy6zf1q9a18chlsbqylhppbby336fznh6nkpdl3jckfd";
+    sha256 = "0bh1nf9sv7wka0vh5bz9krf2cfxz0rr64hrpdm7imsb6cn39k01y";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/logitech-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/logitech-udev-rules/default.nix
new file mode 100644
index 000000000000..c215d9401940
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/logitech-udev-rules/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, solaar }:
+
+# ltunifi and solaar both provide udev rules but solaar's rules are more
+# up-to-date so we simply use that instead of having to maintain our own rules
+
+stdenv.mkDerivation rec {
+  name = "logitech-udev-rules-${version}";
+  inherit (solaar) version;
+
+  buildCommand = ''
+    install -Dm644 -t $out/etc/udev/rules.d ${solaar.src}/rules.d/*.rules
+  '';
+
+  meta = with stdenv.lib; {
+    description = "udev rules for Logitech devices";
+    inherit (solaar.meta) homepage license platforms;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/mcelog/default.nix b/nixpkgs/pkgs/os-specific/linux/mcelog/default.nix
index c0e8e1292330..394dbf63f170 100644
--- a/nixpkgs/pkgs/os-specific/linux/mcelog/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "161";
+  version = "162";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "1bqz53xgvwab3r487ihri3nvk7nsgjykdv8m993983vxsi2bgjmz";
+    sha256 = "1zxj545wslp92npll0411grc49l53cgp8dqqn3zb4vcxrvfc4vh9";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix b/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
index cbcab06f56ad..2af0e60b9c1a 100644
--- a/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
+++ b/nixpkgs/pkgs/os-specific/linux/microcode/intel.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchurl, libarchive, iucode-tool }:
+{ stdenv, fetchFromGitHub, libarchive, iucode-tool }:
 
 stdenv.mkDerivation rec {
-  name = "microcode-intel-${version}";
-  version = "20180807a";
-
-  src = fetchurl {
-    url = "https://downloadmirror.intel.com/28087/eng/microcode-${version}.tgz";
-    sha256 = "0dw1akgzdqk95pwmc8gfdmv7kabw9pn4c67f076bcbn4krliias6";
+  pname = "microcode-intel";
+  version = "20190312";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "Intel-Linux-Processor-Microcode-Data-Files";
+    rev = "microcode-${version}";
+    sha256 = "0n381dai2mv9indsbbr4nfbmp4y4qhshgflr095fyvq5a8acw94m";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
 
-  sourceRoot = ".";
-
   installPhase = ''
     runHook preInstall
 
diff --git a/nixpkgs/pkgs/os-specific/linux/netatop/default.nix b/nixpkgs/pkgs/os-specific/linux/netatop/default.nix
index 8dbacc46154f..718cf4815baf 100644
--- a/nixpkgs/pkgs/os-specific/linux/netatop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/netatop/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, kernel, zlib }:
 
 let
-  version = "1.0";
+  version = "2.0";
 in
 
 stdenv.mkDerivation {
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://www.atoptool.nl/download/netatop-${version}.tar.gz";
-    sha256 = "1l7xs3hnfbk6h5gdrw1ikfa0fvfpb5vd447xhwfllvicblqyip8b";
+    sha256 = "03n248p1l3ps7gj2hdlcbrb1fsw1zcmgzypj4j4l4rynjjh7qvf6";
   };
 
   buildInputs = [ zlib ];
@@ -38,6 +38,5 @@ stdenv.mkDerivation {
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [viric];
-    broken = !stdenv.lib.versionOlder kernel.version "4.13";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/powertop/default.nix b/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
index 54fdfb354d1f..691b216073fd 100644
--- a/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
@@ -20,7 +20,10 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/cgit/aports/plain/main/powertop/strerror_r.patch?id=3b9214d436f1611f297b01f72469d66bfe729d6e";
       sha256 = "1kzddhcrb0n2iah4lhgxwwy4mkhq09ch25jjngyq6pdj6pmfkpfw";
     }
-  );
+  ) ++ [
+    # Fix vertical scrolling, see: https://lists.01.org/pipermail/powertop/2019-March/002046.html
+    ./fix-vertical-scrolling.patch
+  ];
 
   postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
diff --git a/nixpkgs/pkgs/os-specific/linux/powertop/fix-vertical-scrolling.patch b/nixpkgs/pkgs/os-specific/linux/powertop/fix-vertical-scrolling.patch
new file mode 100644
index 000000000000..b9b3fdbaf343
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/powertop/fix-vertical-scrolling.patch
@@ -0,0 +1,13 @@
+diff --git a/src/display.cpp b/src/display.cpp
+index 07227c5..7b3a7a2 100644
+--- a/src/display.cpp
++++ b/src/display.cpp
+@@ -244,7 +244,7 @@ void cursor_down(void)
+ 	w = tab_windows[tab_names[current_tab]];
+ 	if (w) {
+ 		if (w->ypad_pos < 1000) {
+-			if (tab_names[current_tab] == "Tunables" || "WakeUp") {
++			if (tab_names[current_tab] == "Tunables" || tab_names[current_tab] == "WakeUp") {
+ 		                if ((w->cursor_pos + 7) >= LINES) { 
+ 					prefresh(w->win, ++w->ypad_pos, w->xpad_pos, 
+ 						1, 0, LINES - 3, COLS - 1);
diff --git a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
index ea52fbf08e78..192e1d61e43e 100644
--- a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
@@ -3,7 +3,7 @@
 } :
 
 let
-  version = "22.1";
+  version = "23";
 
 in stdenv.mkDerivation {
   name = "rdma-core-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "04772rsn5a0gr4yss63fk35zfl05hz2l27q9yva922i8qq38f90a";
+    sha256 = "1n0v075ndczwrc87b70vxhx42nv1p953cqycmgnz334790zg002g";
   };
 
   nativeBuildInputs = [ cmake pkgconfig pandoc ];
diff --git a/nixpkgs/pkgs/os-specific/linux/setools/default.nix b/nixpkgs/pkgs/os-specific/linux/setools/default.nix
index 89375563ae67..039d875060a2 100644
--- a/nixpkgs/pkgs/os-specific/linux/setools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/setools/default.nix
@@ -17,8 +17,8 @@ buildPythonApplication rec {
     sha256 = "0iyj35fff93cprjkzbkg9dn5xz8dg5h2kjx3476fl625nxxskndn";
   };
 
-  nativeBuildInputs = [ bison flex ];
-  buildInputs = [ libsepol swig ];
+  nativeBuildInputs = [ bison flex swig ];
+  buildInputs = [ libsepol ];
   propagatedBuildInputs = [ enum34 libselinux networkx ]
     ++ optionals withGraphics [ pyqt5 ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
index 79a79ac34a0f..fdde2bedf552 100644
--- a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
@@ -12,21 +12,13 @@ let
 in
 stdenv.mkDerivation rec {
   name = "sssd-${version}";
-  version = "1.16.3";
+  version = "1.16.4";
 
   src = fetchurl {
     url = "https://fedorahosted.org/released/sssd/${name}.tar.gz";
-    sha256 = "1i2fq37w0k71xwqcq1i4l3nglmwybc4694xbrccrih33qsh1fpgf";
+    sha256 = "0ngr7cgimyjc6flqkm7psxagp1m4jlzpqkn28pliifbmdg6i5ckb";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "duplicate-case-value.diff";
-      url = "https://github.com/SSSD/sssd/commit/1ee12b05570fcfb8.diff";
-      sha256 = "01y8i8cfs2gydn84097cl5fynx0db8b0vr345gh57ypp84in3ixw";
-    })
-  ];
-
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
   NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index 2f873f34b885..d54972c055be 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -34,10 +34,12 @@ in stdenv.mkDerivation rec {
       # Upstream's maintenance branches are still too intrusive:
       # https://github.com/systemd/systemd-stable/tree/v239-stable
       patches-deb = fetchurl {
-        # When the URL disappears, it typically means that Debian has new patches
-        # (probably security) and updating to new tarball will apply them as well.
+        # This URL should point to a stable location that does not easily
+        # disappear.  In the past we were using `mirror://debian` but that
+        # eventually causes the files to disappear.  While that was a good sign
+        # for us to update our patch collection it does break reproducibility.
         name = "systemd-debian-patches.tar.xz";
-        url = mirror://debian/pool/main/s/systemd/systemd_239-12~bpo9+1.debian.tar.xz;
+        url = http://snapshot.debian.org/archive/debian/20190301T035241Z/pool/main/s/systemd/systemd_239-12%7Ebpo9%2B1.debian.tar.xz;
         sha256 = "0v9f62gyfiw5icdrdlcvjcipsqrsm49w6n8bqp9nb8s2ih6rsfhg";
       };
       # Note that we skip debian-specific patches, i.e. ./debian/patches/debian/*