about summary refs log tree commit diff
path: root/pkgs/applications/networking
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/applications/networking')
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix94
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/common.nix361
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/default.nix205
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch26
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch61
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch17
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch11
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch74
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch13
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix93
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix6
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix42
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/update.nix271
-rwxr-xr-xpkgs/applications/networking/browsers/ungoogled-chromium/update.sh4
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix18
-rw-r--r--pkgs/applications/networking/cluster/cni/plugins.nix2
-rw-r--r--pkgs/applications/networking/cluster/helm/default.nix4
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix6
-rw-r--r--pkgs/applications/networking/dnscontrol/deps.nix1236
-rw-r--r--pkgs/applications/networking/instant-messengers/rambox/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/ricochet/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/swift-im/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/tensor/default.nix4
-rw-r--r--pkgs/applications/networking/msmtp/default.nix7
-rw-r--r--pkgs/applications/networking/p2p/stig/default.nix24
-rw-r--r--pkgs/applications/networking/p2p/tixati/default.nix4
28 files changed, 1334 insertions, 1267 deletions
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix
new file mode 100644
index 000000000000..87248013a9af
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix
@@ -0,0 +1,94 @@
+{ stdenv, mkChromiumDerivation, channel, enableWideVine }:
+
+with stdenv.lib;
+
+mkChromiumDerivation (base: rec {
+  name = "chromium-browser";
+  packageName = "chromium";
+  buildTargets = [ "mksnapshot" "chrome_sandbox" "chrome" ];
+
+  outputs = ["out" "sandbox"];
+
+  sandboxExecutableName = "__chromium-suid-sandbox";
+
+  installPhase = ''
+    mkdir -p "$libExecPath"
+    cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
+    cp -v "$buildPath/icudtl.dat" "$libExecPath/"
+    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
+    cp -v "$buildPath/chrome" "$libExecPath/$packageName"
+
+    # Swiftshader
+    # See https://stackoverflow.com/a/4264351/263061 for the find invocation.
+    if [ -n "$(find "$buildPath/swiftshader/" -maxdepth 1 -name '*.so' -print -quit)" ]; then
+      echo "Swiftshader files found; installing"
+      mkdir -p "$libExecPath/swiftshader"
+      cp -v "$buildPath/swiftshader/"*.so "$libExecPath/swiftshader/"
+    else
+      echo "Swiftshader files not found"
+    fi
+
+    mkdir -p "$sandbox/bin"
+    cp -v "$buildPath/chrome_sandbox" "$sandbox/bin/${sandboxExecutableName}"
+
+    mkdir -vp "$out/share/man/man1"
+    cp -v "$buildPath/chrome.1" "$out/share/man/man1/$packageName.1"
+
+    for icon_file in chrome/app/theme/chromium/product_logo_*[0-9].png; do
+      num_and_suffix="''${icon_file##*logo_}"
+      icon_size="''${num_and_suffix%.*}"
+      expr "$icon_size" : "^[0-9][0-9]*$" || continue
+      logo_output_prefix="$out/share/icons/hicolor"
+      logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
+      mkdir -vp "$logo_output_path"
+      cp -v "$icon_file" "$logo_output_path/$packageName.png"
+    done
+
+    # Install Desktop Entry
+    install -D chrome/installer/linux/common/desktop.template \
+      $out/share/applications/chromium-browser.desktop
+
+    substituteInPlace $out/share/applications/chromium-browser.desktop \
+      --replace "@@MENUNAME@@" "Chromium" \
+      --replace "@@PACKAGE@@" "chromium" \
+      --replace "Exec=/usr/bin/@@USR_BIN_SYMLINK_NAME@@" "Exec=chromium"
+
+    # Append more mime types to the end
+    sed -i '/^MimeType=/ s,$,x-scheme-handler/webcal;x-scheme-handler/mailto;x-scheme-handler/about;x-scheme-handler/unknown,' \
+      $out/share/applications/chromium-browser.desktop
+
+    # See https://github.com/NixOS/nixpkgs/issues/12433
+    sed -i \
+      -e '/\[Desktop Entry\]/a\' \
+      -e 'StartupWMClass=chromium-browser' \
+      $out/share/applications/chromium-browser.desktop
+  '';
+
+  passthru = { inherit sandboxExecutableName; };
+
+  requiredSystemFeatures = [ "big-parallel" ];
+
+  meta = {
+    description = "An open source web browser from Google, with dependencies on Google web services removed";
+    longDescription = ''
+      Chromium is an open source web browser from Google that aims to build a
+      safer, faster, and more stable way for all Internet users to experience
+      the web. It has a minimalist user interface and provides the vast majority
+      of source code for Google Chrome (which has some additional features).
+    '';
+    homepage = https://github.com/Eloston/ungoogled-chromium;
+    maintainers = with maintainers; [ squalus ];
+    # Overview of the maintainer roles:
+    # nixos-unstable:
+    # - TODO: Need a new maintainer for x86_64 [0]
+    # - @thefloweringash: aarch64
+    # - @primeos: Provisional maintainer (x86_64)
+    # Stable channel:
+    # - TODO (need someone to test backports [0])
+    # [0]: https://github.com/NixOS/nixpkgs/issues/78450
+    license = if enableWideVine then licenses.unfree else licenses.bsd3;
+    platforms = platforms.linux;
+    hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
+    timeout = 172800; # 48 hours
+  };
+})
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
new file mode 100644
index 000000000000..d07da2b3b07a
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@@ -0,0 +1,361 @@
+{ stdenv, llvmPackages, gnChromium, ninja, which, nodejs, fetchpatch, gnutar
+
+# default dependencies
+, bzip2, flac, speex, libopus
+, libevent, expat, libjpeg, snappy
+, libpng, libcap
+, xdg_utils, yasm, minizip, libwebp
+, libusb1, pciutils, nss, re2, zlib
+
+, python2Packages, perl, pkgconfig
+, nspr, systemd, kerberos
+, utillinux, alsaLib
+, bison, gperf
+, glib, gtk3, dbus-glib
+, glibc
+, libXScrnSaver, libXcursor, libXtst, libGLU, libGL
+, protobuf, speechd, libXdamage, cups
+, ffmpeg, libxslt, libxml2, at-spi2-core
+, jre
+
+# optional dependencies
+, libgcrypt ? null # gnomeSupport || cupsSupport
+, libva ? null # useVaapi
+, libdrm ? null, wayland ? null, mesa_drivers ? null, libxkbcommon ? null # useOzone
+
+# package customization
+, useVaapi ? false
+, useOzone ? false
+, gnomeSupport ? false, gnome ? null
+, gnomeKeyringSupport ? false, libgnome-keyring3 ? null
+, proprietaryCodecs ? true
+, cupsSupport ? true
+, pulseSupport ? false, libpulseaudio ? null
+, ungoogled-chromium
+, ungoogled ? false
+
+, upstream-info
+}:
+
+buildFun:
+
+with stdenv.lib;
+
+# see http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html
+
+let
+  # The additional attributes for creating derivations based on the chromium
+  # source tree.
+  extraAttrs = buildFun base;
+
+  githubPatch = commit: sha256: fetchpatch {
+    url = "https://github.com/chromium/chromium/commit/${commit}.patch";
+    inherit sha256;
+  };
+
+  mkGnFlags =
+    let
+      # Serialize Nix types into GN types according to this document:
+      # https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/language.md
+      mkGnString = value: "\"${escape ["\"" "$" "\\"] value}\"";
+      sanitize = value:
+        if value == true then "true"
+        else if value == false then "false"
+        else if isList value then "[${concatMapStringsSep ", " sanitize value}]"
+        else if isInt value then toString value
+        else if isString value then mkGnString value
+        else throw "Unsupported type for GN value `${value}'.";
+      toFlag = key: value: "${key}=${sanitize value}";
+    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
+
+  gnSystemLibraries = [
+    "flac" "libwebp" "libxslt" "yasm" "opus" "snappy" "libpng"
+    # "zlib" # version 77 reports unresolved dependency on //third_party/zlib:zlib_config
+    # "libjpeg" # fails with multiple undefined references to chromium_jpeg_*
+    # "re2" # fails with linker errors
+    # "ffmpeg" # https://crbug.com/731766
+    # "harfbuzz-ng" # in versions over 63 harfbuzz and freetype are being built together
+                    # so we can't build with one from system and other from source
+  ];
+
+  opusWithCustomModes = libopus.override {
+    withCustomModes = true;
+  };
+
+  defaultDependencies = [
+    bzip2 flac speex opusWithCustomModes
+    libevent expat libjpeg snappy
+    libpng libcap
+    xdg_utils yasm minizip libwebp
+    libusb1 re2 zlib
+    ffmpeg libxslt libxml2
+    # harfbuzz # in versions over 63 harfbuzz and freetype are being built together
+               # so we can't build with one from system and other from source
+  ];
+
+  # build paths and release info
+  packageName = extraAttrs.packageName or extraAttrs.name;
+  buildType = "Release";
+  buildPath = "out/${buildType}";
+  libExecPath = "$out/libexec/${packageName}";
+
+  versionRange = min-version: upto-version:
+    let inherit (upstream-info) version;
+        result = versionAtLeast version min-version && versionOlder version upto-version;
+        stable-version = (import ./upstream-info.nix).stable.version;
+    in if versionAtLeast stable-version upto-version
+       then warn "chromium: stable version ${stable-version} is newer than a patchset bounded at ${upto-version}. You can safely delete it."
+            result
+       else result;
+
+  ungoogler =
+    let versionEntry = (import ./ungoogled-src.nix)."${upstream-info.version}";
+    in ungoogled-chromium {
+      inherit (versionEntry) rev sha256;
+    };
+  base = rec {
+    name = "${packageName}-unwrapped-${version}";
+    inherit (upstream-info) channel version;
+    inherit packageName buildType buildPath;
+
+    src = upstream-info.main;
+
+    nativeBuildInputs = [
+      ninja which python2Packages.python perl pkgconfig
+      python2Packages.ply python2Packages.jinja2 nodejs
+      gnutar
+    ] ++ optional (versionAtLeast version "83") python2Packages.setuptools;
+
+    buildInputs = defaultDependencies ++ [
+      nspr nss systemd
+      utillinux alsaLib
+      bison gperf kerberos
+      glib gtk3 dbus-glib
+      libXScrnSaver libXcursor libXtst libGLU libGL
+      pciutils protobuf speechd libXdamage at-spi2-core
+      jre
+    ] ++ optional gnomeKeyringSupport libgnome-keyring3
+      ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
+      ++ optionals cupsSupport [ libgcrypt cups ]
+      ++ optional useVaapi libva
+      ++ optional pulseSupport libpulseaudio
+      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
+
+    patches = [
+      ./patches/nix_plugin_paths_68.patch
+      ./patches/remove-webp-include-69.patch
+      ./patches/no-build-timestamps.patch
+      ./patches/widevine-79.patch
+      ./patches/dont-use-ANGLE-by-default.patch
+      # Unfortunately, chromium regularly breaks on major updates and
+      # then needs various patches backported in order to be compiled with GCC.
+      # Good sources for such patches and other hints:
+      # - https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
+      # - https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
+      # - https://github.com/chromium/chromium/search?q=GCC&s=committer-date&type=Commits
+      #
+      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
+      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
+    ] ++ optionals (useVaapi) ([
+      # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
+      ./patches/vaapi-fix.patch
+    ] ++ optionals (versionRange "81" "82") [
+      (githubPatch "5b2ff215473e0526b5b24aeff4ad90d369b21c75" "0n00vh8wfpn2ay5fqsxcsx0zadnv7mihm72bcvnrfzh75nzbg902")
+      (githubPatch "98e343ab369e4262511b5fce547728e3e5eefba8" "00wwp653jk0k0yvix00vr7ymgck9dj7fxjwx4nc67ynn84dh6064")
+    ]);
+
+    postPatch = ''
+      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
+      substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
+        --replace \
+          'return sandbox_binary;' \
+          'return base::FilePath(GetDevelSandboxPath());'
+
+      substituteInPlace services/audio/audio_sandbox_hook_linux.cc \
+        --replace \
+          '/usr/share/alsa/' \
+          '${alsaLib}/share/alsa/' \
+        --replace \
+          '/usr/lib/x86_64-linux-gnu/gconv/' \
+          '${glibc}/lib/gconv/' \
+        --replace \
+          '/usr/share/locale/' \
+          '${glibc}/share/locale/'
+
+      sed -i -e 's@"\(#!\)\?.*xdg-@"\1${xdg_utils}/bin/xdg-@' \
+        chrome/browser/shell_integration_linux.cc
+
+      sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${systemd.lib}/lib/\1!' \
+        device/udev_linux/udev?_loader.cc
+
+      sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
+        gpu/config/gpu_info_collector_linux.cc
+
+      sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \
+        chrome/browser/ui/webui/engagement/site_engagement_ui.cc
+
+      sed -i -e '/#include/ {
+        i #include <algorithm>
+        :l; n; bl
+      }' gpu/config/gpu_control_list.cc
+
+      # Allow to put extensions into the system-path.
+      sed -i -e 's,/usr,/run/current-system/sw,' chrome/common/chrome_paths.cc
+
+      patchShebangs .
+      # use our own nodejs
+      mkdir -p third_party/node/linux/node-linux-x64/bin
+      ln -s $(which node) third_party/node/linux/node-linux-x64/bin/node
+
+      # remove unused third-party
+      # in third_party/crashpad third_party/zlib contains just a header-adapter
+      for lib in ${toString gnSystemLibraries}; do
+        find -type f -path "*third_party/$lib/*"     \
+            \! -path "*third_party/crashpad/crashpad/third_party/zlib/*"  \
+            \! -path "*third_party/$lib/chromium/*"  \
+            \! -path "*third_party/$lib/google/*"    \
+            \! -path "*base/third_party/icu/*"       \
+            \! -path "*base/third_party/libevent/*"  \
+            \! -regex '.*\.\(gn\|gni\|isolate\|py\)' \
+            -delete
+      done
+    '' + optionalString stdenv.isAarch64 ''
+      substituteInPlace build/toolchain/linux/BUILD.gn \
+        --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+    '' + optionalString stdenv.cc.isClang ''
+      mkdir -p third_party/llvm-build/Release+Asserts/bin
+      ln -s ${stdenv.cc}/bin/clang              third_party/llvm-build/Release+Asserts/bin/clang
+      ln -s ${stdenv.cc}/bin/clang++            third_party/llvm-build/Release+Asserts/bin/clang++
+      ln -s ${llvmPackages.llvm}/bin/llvm-ar    third_party/llvm-build/Release+Asserts/bin/llvm-ar
+    '' + optionalString ungoogled ''
+      ${ungoogler}/utils/prune_binaries.py . ${ungoogler}/pruning.list || echo "some errors"
+      ${ungoogler}/utils/patches.py . ${ungoogler}/patches
+      ${ungoogler}/utils/domain_substitution.py apply -r ${ungoogler}/domain_regex.list -f ${ungoogler}/domain_substitution.list -c ./ungoogled-domsubcache.tar.gz .
+    '';
+
+    gnFlags = mkGnFlags ({
+      linux_use_bundled_binutils = false;
+      use_lld = false;
+      use_gold = true;
+      gold_path = "${stdenv.cc}/bin";
+      is_debug = false;
+
+      proprietary_codecs = false;
+      use_sysroot = false;
+      use_gnome_keyring = gnomeKeyringSupport;
+      use_gio = gnomeSupport;
+      # ninja: error: '../../native_client/toolchain/linux_x86/pnacl_newlib/bin/x86_64-nacl-objcopy',
+      # needed by 'nacl_irt_x86_64.nexe', missing and no known rule to make it
+      enable_nacl = false;
+      # Enabling the Widevine component here doesn't affect whether we can
+      # redistribute the chromium package; the Widevine component is either
+      # added later in the wrapped -wv build or downloaded from Google.
+      enable_widevine = true;
+      use_cups = cupsSupport;
+
+      treat_warnings_as_errors = false;
+      is_clang = stdenv.cc.isClang;
+      clang_use_chrome_plugins = false;
+      blink_symbol_level = 0;
+      fieldtrial_testing_like_official_build = true;
+
+      # Google API keys, see:
+      #   http://www.chromium.org/developers/how-tos/api-keys
+      # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
+      # please get your own set of keys.
+      google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
+      google_default_client_id = "404761575300.apps.googleusercontent.com";
+      google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
+    } // optionalAttrs proprietaryCodecs {
+      # enable support for the H.264 codec
+      proprietary_codecs = true;
+      enable_hangout_services_extension = true;
+      ffmpeg_branding = "Chrome";
+    } // optionalAttrs useVaapi {
+      use_vaapi = true;
+    } // optionalAttrs pulseSupport {
+      use_pulseaudio = true;
+      link_pulseaudio = true;
+    } // optionalAttrs useOzone {
+      use_ozone = true;
+      ozone_platform_gbm = false;
+      use_xkbcommon = true;
+      use_glib = true;
+      use_gtk = true;
+      use_system_libwayland = true;
+      use_system_minigbm = true;
+      use_system_libdrm = true;
+      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
+    } // optionalAttrs ungoogled {
+      closure_compile = false;
+      enable_hangout_services_extension = false;
+      enable_mdns = false;
+      enable_nacl_nonsfi = false;
+      enable_one_click_signin = false;
+      enable_reading_list = false;
+      enable_remoting = false;
+      enable_reporting = false;
+      enable_service_discovery = false;
+      exclude_unwind_tables = true;
+      google_api_key = "";
+      google_default_client_id = "";
+      google_default_client_secret = "";
+      optimize_webui = false;
+      safe_browsing_mode = 0;
+      use_official_google_api_keys = false;
+      use_unofficial_version_number = false;
+    } // (extraAttrs.gnFlags or {}));
+
+    configurePhase = ''
+      runHook preConfigure
+
+      # This is to ensure expansion of $out.
+      libExecPath="${libExecPath}"
+      python build/linux/unbundle/replace_gn_files.py \
+        --system-libraries ${toString gnSystemLibraries}
+      ${gnChromium}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
+
+      # Fail if `gn gen` contains a WARNING.
+      grep -o WARNING gn-gen-outputs.txt && echo "Found gn WARNING, exiting nix build" && exit 1
+
+      runHook postConfigure
+    '';
+
+    # Don't spam warnings about unknown warning options. This is useful because
+    # our Clang is always older than Chromium's and the build logs have a size
+    # of approx. 25 MB without this option (and this saves e.g. 66 %).
+    NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
+
+    buildPhase = let
+      # Build paralelism: on Hydra the build was frequently running into memory
+      # exhaustion, and even other users might be running into similar issues.
+      # -j is halved to avoid memory problems, and -l is slightly increased
+      # so that the build gets slight preference before others
+      # (it will often be on "critical path" and at risk of timing out)
+      buildCommand = target: ''
+        ninja -C "${buildPath}"  \
+          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
+          "${target}"
+        (
+          source chrome/installer/linux/common/installer.include
+          PACKAGE=$packageName
+          MENUNAME="Chromium"
+          process_template chrome/app/resources/manpage.1.in "${buildPath}/chrome.1"
+        )
+      '';
+      targets = extraAttrs.buildTargets or [];
+      commands = map buildCommand targets;
+    in concatStringsSep "\n" commands;
+
+    postFixup = ''
+      # Make sure that libGLESv2 is found by dlopen (if using EGL).
+      chromiumBinary="$libExecPath/$packageName"
+      origRpath="$(patchelf --print-rpath "$chromiumBinary")"
+      patchelf --set-rpath "${libGL}/lib:$origRpath" "$chromiumBinary"
+    '';
+  };
+
+# Remove some extraAttrs we supplied to the base attributes already.
+in stdenv.mkDerivation (base // removeAttrs extraAttrs [
+  "name" "gnFlags" "buildTargets"
+])
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
new file mode 100644
index 000000000000..f172e7c09ce2
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
@@ -0,0 +1,205 @@
+{ newScope, config, stdenv, llvmPackages_9, llvmPackages_10
+, makeWrapper, ed
+, glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
+, libva ? null
+, gcc, nspr, nss, patchelfUnstable, runCommand
+, lib
+
+# package customization
+, channel ? "stable"
+, gnomeSupport ? false, gnome ? null
+, gnomeKeyringSupport ? false
+, proprietaryCodecs ? true
+, enablePepperFlash ? false
+, enableWideVine ? false
+, ungoogled ? true
+, useVaapi ? false # test video on radeon, before enabling this
+, useOzone ? false
+, cupsSupport ? true
+, pulseSupport ? config.pulseaudio or stdenv.isLinux
+, commandLineArgs ? ""
+}:
+
+let
+  llvmPackages = if channel == "dev"
+    then llvmPackages_10
+    else llvmPackages_9;
+  stdenv = llvmPackages.stdenv;
+
+  callPackage = newScope chromium;
+
+  chromium = {
+    inherit stdenv llvmPackages;
+
+    upstream-info = (callPackage ./update.nix {}).getChannel channel;
+
+    mkChromiumDerivation = callPackage ./common.nix ({
+      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useVaapi useOzone ungoogled;
+      gnChromium = gn;
+    } // lib.optionalAttrs (channel == "dev") {
+      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
+      gnChromium = gn.overrideAttrs (oldAttrs: {
+        version = "2020-03-23";
+        src = fetchgit {
+          url = "https://gn.googlesource.com/gn";
+          rev = "5ed3c9cc67b090d5e311e4bd2aba072173e82db9";
+          sha256 = "00y2d35wvqmx9glaqhfb62wdgbfpwr77v0934nnvh9ks71vnsjqy";
+        };
+      });
+    });
+
+    browser = callPackage ./browser.nix { inherit channel enableWideVine; };
+
+    plugins = callPackage ./plugins.nix {
+      inherit enablePepperFlash;
+    };
+
+    ungoogled-chromium = callPackage ./ungoogled.nix {};
+  };
+
+  mkrpath = p: "${lib.makeSearchPathOutput "lib" "lib64" p}:${lib.makeLibraryPath p}";
+  widevineCdm = let upstream-info = chromium.upstream-info; in stdenv.mkDerivation {
+    name = "chrome-widevine-cdm";
+
+    # The .deb file for Google Chrome
+    src = upstream-info.binary;
+
+    nativeBuildInputs = [ patchelfUnstable ];
+
+    phases = [ "unpackPhase" "patchPhase" "installPhase" "checkPhase" ];
+
+    unpackCmd = let
+      widevineCdmPath =
+        if upstream-info.channel == "stable" then
+          "./opt/google/chrome/WidevineCdm"
+        else if upstream-info.channel == "beta" then
+          "./opt/google/chrome-beta/WidevineCdm"
+        else if upstream-info.channel == "dev" then
+          "./opt/google/chrome-unstable/WidevineCdm"
+        else
+          throw "Unknown chromium channel.";
+    in ''
+      # Extract just WidevineCdm from upstream's .deb file
+      ar p "$src" data.tar.xz | tar xJ "${widevineCdmPath}"
+
+      # Move things around so that we don't have to reference a particular
+      # chrome-* directory later.
+      mv "${widevineCdmPath}" ./
+
+      # unpackCmd wants a single output directory; let it take WidevineCdm/
+      rm -rf opt
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    PATCH_RPATH = mkrpath [ gcc.cc glib nspr nss ];
+
+    patchPhase = ''
+      patchelf --set-rpath "$PATCH_RPATH" _platform_specific/linux_x64/libwidevinecdm.so
+    '';
+
+    installPhase = ''
+      mkdir -p $out/WidevineCdm
+      cp -a * $out/WidevineCdm/
+    '';
+
+    meta = {
+      platforms = [ "x86_64-linux" ];
+      license = lib.licenses.unfree;
+    };
+  };
+
+  suffix = if channel != "stable" then "-" + channel else "";
+
+  sandboxExecutableName = chromium.browser.passthru.sandboxExecutableName;
+
+  version = chromium.browser.version;
+
+  # We want users to be able to enableWideVine without rebuilding all of
+  # chromium, so we have a separate derivation here that copies chromium
+  # and adds the unfree WidevineCdm.
+  chromiumWV = let browser = chromium.browser; in if enableWideVine then
+    runCommand (browser.name + "-wv") { version = browser.version; }
+      ''
+        mkdir -p $out
+        cp -a ${browser}/* $out/
+        chmod u+w $out/libexec/chromium
+        cp -a ${widevineCdm}/WidevineCdm $out/libexec/chromium/
+      ''
+    else browser;
+in stdenv.mkDerivation {
+  name = "chromium${suffix}-${version}";
+  inherit version;
+
+  buildInputs = [
+    makeWrapper ed
+
+    # needed for GSETTINGS_SCHEMAS_PATH
+    gsettings-desktop-schemas glib gtk3
+
+    # needed for XDG_ICON_DIRS
+    gnome3.adwaita-icon-theme
+  ];
+
+  outputs = ["out" "sandbox"];
+
+  buildCommand = let
+    browserBinary = "${chromiumWV}/libexec/chromium/chromium";
+    getWrapperFlags = plugin: "$(< \"${plugin}/nix-support/wrapper-flags\")";
+    libPath = stdenv.lib.makeLibraryPath ([]
+      ++ stdenv.lib.optional useVaapi libva
+    );
+
+  in with stdenv.lib; ''
+    mkdir -p "$out/bin"
+
+    eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
+      --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)} \
+      ${concatMapStringsSep " " getWrapperFlags chromium.plugins.enabled}
+
+    ed -v -s "$out/bin/chromium" << EOF
+    2i
+
+    if [ -x "/run/wrappers/bin/${sandboxExecutableName}" ]
+    then
+      export CHROME_DEVEL_SANDBOX="/run/wrappers/bin/${sandboxExecutableName}"
+    else
+      export CHROME_DEVEL_SANDBOX="$sandbox/bin/${sandboxExecutableName}"
+    fi
+
+  '' + lib.optionalString (libPath != "") ''
+    # To avoid loading .so files from cwd, LD_LIBRARY_PATH here must not
+    # contain an empty section before or after a colon.
+    export LD_LIBRARY_PATH="\$LD_LIBRARY_PATH\''${LD_LIBRARY_PATH:+:}${libPath}"
+  '' + ''
+
+    # libredirect causes chromium to deadlock on startup
+    export LD_PRELOAD="\$(echo -n "\$LD_PRELOAD" | tr ':' '\n' | grep -v /lib/libredirect\\\\.so$ | tr '\n' ':')"
+
+    export XDG_DATA_DIRS=$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH\''${XDG_DATA_DIRS:+:}\$XDG_DATA_DIRS
+
+    .
+    w
+    EOF
+
+    ln -sv "${chromium.browser.sandbox}" "$sandbox"
+
+    ln -s "$out/bin/chromium" "$out/bin/chromium-browser"
+
+    mkdir -p "$out/share"
+    for f in '${chromium.browser}'/share/*; do # hello emacs */
+      ln -s -t "$out/share/" "$f"
+    done
+  '';
+
+  inherit (chromium.browser) packageName;
+  meta = chromium.browser.meta;
+  passthru = {
+    inherit (chromium) upstream-info browser;
+    mkDerivation = chromium.mkChromiumDerivation;
+    inherit sandboxExecutableName;
+  };
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch
new file mode 100644
index 000000000000..9f14a304eb34
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch
@@ -0,0 +1,26 @@
+A field trial currently enables the passthrough command decoder, which causes
+gl_factory.cc to try kGLImplementationEGLANGLE first, which causes Chromium to fail
+to load libGLESv2.so on NixOS.  It somehow does not try kGLImplementationDesktopGL,
+and so there is no GL support at all.
+
+Revert to using the validating command decoder, which prevents gl_factory.cc
+from touching allowed_impls, allowing it to successfully use kGLImplementationDesktopGL.
+
+diff --git a/ui/gl/gl_utils.cc b/ui/gl/gl_utils.cc
+index 697cbed5fe2d..8419bdb21a2f 100644
+--- a/ui/gl/gl_utils.cc
++++ b/ui/gl/gl_utils.cc
+@@ -71,9 +71,10 @@ bool UsePassthroughCommandDecoder(const base::CommandLine* command_line) {
+   } else if (switch_value == kCmdDecoderValidatingName) {
+     return false;
+   } else {
+-    // Unrecognized or missing switch, use the default.
+-    return base::FeatureList::IsEnabled(
+-        features::kDefaultPassthroughCommandDecoder);
++    // Ignore the field trial that enables it; disable it until
++    // gl_factory.cc kGLImplementationEGLANGLE issues are sorted
++    // out on NixOS.
++    return false;
+   }
+ }
+ }
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch
new file mode 100644
index 000000000000..da6a4c92b460
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch
@@ -0,0 +1,61 @@
+diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
+index f4e119d..d9775bd 100644
+--- a/chrome/common/chrome_paths.cc
++++ b/chrome/common/chrome_paths.cc
+@@ -68,21 +68,14 @@ static base::LazyInstance<base::FilePath>
+     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
+ 
+ // Gets the path for internal plugins.
+-bool GetInternalPluginsDirectory(base::FilePath* result) {
+-#if defined(OS_MACOSX)
+-  // If called from Chrome, get internal plugins from a subdirectory of the
+-  // framework.
+-  if (base::mac::AmIBundled()) {
+-    *result = chrome::GetFrameworkBundlePath();
+-    DCHECK(!result->empty());
+-    *result = result->Append("Internet Plug-Ins");
+-    return true;
+-  }
+-  // In tests, just look in the module directory (below).
+-#endif
+-
+-  // The rest of the world expects plugins in the module directory.
+-  return base::PathService::Get(base::DIR_MODULE, result);
++bool GetInternalPluginsDirectory(base::FilePath* result,
++                                 const std::string& ident) {
++  std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident;
++  const char* value = getenv(full_env.c_str());
++  if (value == NULL)
++      return base::PathService::Get(base::DIR_MODULE, result);
++  else
++      *result = base::FilePath(value);
+ }
+ 
+ // Gets the path for bundled implementations of components. Note that these
+@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) {
+       create_dir = true;
+       break;
+     case chrome::DIR_INTERNAL_PLUGINS:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "ALL"))
+         return false;
+       break;
+     case chrome::DIR_COMPONENTS:
+@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) {
+         return false;
+       break;
+     case chrome::DIR_PEPPER_FLASH_PLUGIN:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH"))
+         return false;
+       cur = cur.Append(kPepperFlashBaseDirectory);
+       break;
+@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
+         cur = cur.DirName();
+       }
+ #else
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "PNACL"))
+         return false;
+ #endif
+       cur = cur.Append(FILE_PATH_LITERAL("pnacl"));
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch
new file mode 100644
index 000000000000..6b788f43d29c
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch
@@ -0,0 +1,17 @@
+--- chromium-70.0.3538.67/build/compute_build_timestamp.py.orig	2018-11-02 16:00:34.368933077 +0200
++++ chromium-70.0.3538.67/build/compute_build_timestamp.py	2018-11-08 04:06:21.658105129 +0200
+@@ -94,6 +94,14 @@
+       'build_type', help='The type of build', choices=('official', 'default'))
+   args = argument_parser.parse_args()
+ 
++  # I don't trust LASTCHANGE magic, and I definelly want something deterministic here
++  SOURCE_DATE_EPOCH = os.getenv("SOURCE_DATE_EPOCH", None)
++  if SOURCE_DATE_EPOCH is not None:
++    print(SOURCE_DATE_EPOCH)
++    return 0
++  else:
++    raise RuntimeError("SOURCE_DATE_EPOCH not set")
++
+   # The mtime of the revision in build/util/LASTCHANGE is stored in a file
+   # next to it. Read it, to get a deterministic time close to "now".
+   # That date is then modified as described at the top of the file so that
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch
new file mode 100644
index 000000000000..07572cf7ee94
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch
@@ -0,0 +1,11 @@
+--- a/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
++++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
+@@ -13,7 +13,7 @@
+
+ #include "jpeglib.h"  // for JPEG_MAX_DIMENSION
+
+-#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
++#define WEBP_MAX_DIMENSION 16383
+
+ namespace blink {
+
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch
new file mode 100644
index 000000000000..b5372d1a2556
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch
@@ -0,0 +1,74 @@
+--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
++++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
+@@ -641,6 +641,7 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
+   // |vpp_vaapi_wrapper_| for VaapiPicture to DownloadFromSurface() the VA's
+   // internal decoded frame.
+   if (buffer_allocation_mode_ != BufferAllocationMode::kNone &&
++      buffer_allocation_mode_ != BufferAllocationMode::kWrapVdpau &&
+       !vpp_vaapi_wrapper_) {
+     vpp_vaapi_wrapper_ = VaapiWrapper::Create(
+         VaapiWrapper::kVideoProcess, VAProfileNone,
+@@ -665,7 +666,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
+     PictureBuffer buffer = buffers[i];
+     buffer.set_size(requested_pic_size_);
+     std::unique_ptr<VaapiPicture> picture = vaapi_picture_factory_->Create(
+-        (buffer_allocation_mode_ == BufferAllocationMode::kNone)
++        ((buffer_allocation_mode_ == BufferAllocationMode::kNone) ||
++         (buffer_allocation_mode_ == BufferAllocationMode::kWrapVdpau))
+             ? vaapi_wrapper_
+             : vpp_vaapi_wrapper_,
+         make_context_current_cb_, bind_image_cb_, buffer);
+@@ -1093,6 +1095,12 @@ VaapiVideoDecodeAccelerator::GetSupportedProfiles() {
+
+ VaapiVideoDecodeAccelerator::BufferAllocationMode
+ VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
++  // NVIDIA blobs use VDPAU
++  if (VaapiWrapper::GetImplementationType() == VAImplementation::kNVIDIAVDPAU) {
++    LOG(INFO) << "VA-API driver on VDPAU backend";
++    return BufferAllocationMode::kWrapVdpau;
++  }
++
+   // TODO(crbug.com/912295): Enable a better BufferAllocationMode for IMPORT
+   // |output_mode_| as well.
+   if (output_mode_ == VideoDecodeAccelerator::Config::OutputMode::IMPORT)
+@@ -1105,7 +1113,7 @@ VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
+   // depends on the bitstream and sometimes it's not enough to cover the amount
+   // of frames needed by the client pipeline (see b/133733739).
+   // TODO(crbug.com/911754): Enable for VP9 Profile 2.
+-  if (IsGeminiLakeOrLater() &&
++  if (false && IsGeminiLakeOrLater() &&
+       (profile_ == VP9PROFILE_PROFILE0 || profile_ == VP8PROFILE_ANY)) {
+     // Add one to the reference frames for the one being currently egressed, and
+     // an extra allocation for both |client_| and |decoder_|, see
+--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
++++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
+@@ -204,6 +204,7 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
+     // Using |client_|s provided PictureBuffers and as many internally
+     // allocated.
+     kNormal,
++    kWrapVdpau,
+   };
+
+   // Decides the concrete buffer allocation mode, depending on the hardware
+--- a/media/gpu/vaapi/vaapi_wrapper.cc
++++ b/media/gpu/vaapi/vaapi_wrapper.cc
+@@ -131,6 +131,9 @@ media::VAImplementation VendorStringToImplementationType(
+   } else if (base::StartsWith(va_vendor_string, "Intel iHD driver",
+                               base::CompareCase::SENSITIVE)) {
+     return media::VAImplementation::kIntelIHD;
++  } else if (base::StartsWith(va_vendor_string, "Splitted-Desktop Systems VDPAU",
++                              base::CompareCase::SENSITIVE)) {
++    return media::VAImplementation::kNVIDIAVDPAU;
+   }
+   return media::VAImplementation::kOther;
+ }
+--- a/media/gpu/vaapi/vaapi_wrapper.h
++++ b/media/gpu/vaapi/vaapi_wrapper.h
+@@ -79,6 +79,7 @@ enum class VAImplementation {
+   kIntelIHD,
+   kOther,
+   kInvalid,
++  kNVIDIAVDPAU,
+ };
+
+ // This class handles VA-API calls and ensures proper locking of VA-API calls
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch
new file mode 100644
index 000000000000..32f0ae2fb5e6
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch
@@ -0,0 +1,13 @@
+diff --git a/third_party/widevine/cdm/BUILD.gn b/third_party/widevine/cdm/BUILD.gn
+index ed0e2f5208b..5b431a030d5 100644
+--- a/third_party/widevine/cdm/BUILD.gn
++++ b/third_party/widevine/cdm/BUILD.gn
+@@ -14,7 +14,7 @@ buildflag_header("buildflags") {
+ 
+   flags = [
+     "ENABLE_WIDEVINE=$enable_widevine",
+-    "BUNDLE_WIDEVINE_CDM=$bundle_widevine_cdm",
++    "BUNDLE_WIDEVINE_CDM=true",
+     "ENABLE_WIDEVINE_CDM_COMPONENT=$enable_widevine_cdm_component",
+   ]
+ }
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix
new file mode 100644
index 000000000000..434bd77b6d18
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix
@@ -0,0 +1,93 @@
+{ stdenv, gcc
+, jshon
+, glib
+, nspr
+, nss
+, fetchzip
+, patchelfUnstable
+, enablePepperFlash ? false
+
+, upstream-info
+}:
+
+with stdenv.lib;
+
+let
+  mkrpath = p: "${makeSearchPathOutput "lib" "lib64" p}:${makeLibraryPath p}";
+
+  # Generate a shell fragment that emits flags appended to the
+  # final makeWrapper call for wrapping the browser's main binary.
+  #
+  # Note that this is shell-escaped so that only the variable specified
+  # by the "output" attribute is substituted.
+  mkPluginInfo = { output ? "out", allowedVars ? [ output ]
+                 , flags ? [], envVars ? {}
+                 }: let
+    shSearch = ["'"] ++ map (var: "@${var}@") allowedVars;
+    shReplace = ["'\\''"] ++ map (var: "'\"\${${var}}\"'") allowedVars;
+    # We need to triple-escape "val":
+    #  * First because makeWrapper doesn't do any quoting of its arguments by
+    #    itself.
+    #  * Second because it's passed to the makeWrapper call separated by IFS but
+    #    not by the _real_ arguments, for example the Widevine plugin flags
+    #    contain spaces, so they would end up as separate arguments.
+    #  * Third in order to be correctly quoted for the "echo" call below.
+    shEsc = val: "'${replaceStrings ["'"] ["'\\''"] val}'";
+    mkSh = val: "'${replaceStrings shSearch shReplace (shEsc val)}'";
+    mkFlag = flag: ["--add-flags" (shEsc flag)];
+    mkEnvVar = key: val: ["--set" (shEsc key) (shEsc val)];
+    envList = mapAttrsToList mkEnvVar envVars;
+    quoted = map mkSh (flatten ((map mkFlag flags) ++ envList));
+  in ''
+    mkdir -p "''$${output}/nix-support"
+    echo ${toString quoted} > "''$${output}/nix-support/wrapper-flags"
+  '';
+
+  flash = stdenv.mkDerivation rec {
+    pname = "flashplayer-ppapi";
+    version = "32.0.0.344";
+
+    src = fetchzip {
+      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
+      sha256 = "05ijlgsby9zxx0qs6f3vav1z0p6xr1cg6idl4akxvfmsl6hn6hkq";
+      stripRoot = false;
+    };
+
+    patchPhase = ''
+      chmod +x libpepflashplayer.so
+      patchelf --set-rpath "${mkrpath [ gcc.cc ]}" libpepflashplayer.so
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    installPhase = ''
+      flashVersion="$(
+        "${jshon}/bin/jshon" -F manifest.json -e version -u
+      )"
+
+      install -vD libpepflashplayer.so "$out/lib/libpepflashplayer.so"
+
+      ${mkPluginInfo {
+        allowedVars = [ "out" "flashVersion" ];
+        flags = [
+          "--ppapi-flash-path=@out@/lib/libpepflashplayer.so"
+          "--ppapi-flash-version=@flashVersion@"
+        ];
+      }}
+    '';
+
+    dontStrip = true;
+
+    meta = {
+      license = stdenv.lib.licenses.unfree;
+      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      platforms = platforms.x86_64;
+    };
+  };
+
+in {
+  enabled = optional enablePepperFlash flash;
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
new file mode 100644
index 000000000000..9b5c76f53429
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
@@ -0,0 +1,6 @@
+{
+  "81.0.4044.92" = {
+    rev = "81.0.4044.92-2";
+    sha256 = "071a33idn2zcix6z8skn7y85mhb9w5s0bh0fvrjm269y7cmjrh3l";
+  };
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix
new file mode 100644
index 000000000000..17418c90af49
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix
@@ -0,0 +1,42 @@
+{ stdenv
+, fetchFromGitHub
+, python3Packages
+, makeWrapper
+, patch
+}:
+{ rev
+, sha256
+}:
+
+stdenv.mkDerivation rec {
+  name = "ungoogled-chromium-${version}";
+
+  version = rev;
+
+  src = fetchFromGitHub {
+    owner = "Eloston";
+    repo = "ungoogled-chromium";
+    inherit rev sha256;
+  };
+
+  dontBuild = true;
+
+  buildInputs = [
+    python3Packages.python
+    patch
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  patchPhase = ''
+    sed -i '/chromium-widevine/d' patches/series
+  '';
+
+  installPhase = ''
+    mkdir $out
+    cp -R * $out/
+    wrapProgram $out/utils/patches.py --add-flags "apply" --prefix PATH : "${patch}/bin"
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix
new file mode 100644
index 000000000000..6dff17c69ddb
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix
@@ -0,0 +1,271 @@
+let maybePkgs = import ../../../../../. {}; in
+
+{ stdenv     ? maybePkgs.stdenv
+, runCommand ? maybePkgs.runCommand
+, fetchurl   ? maybePkgs.fetchurl
+, writeText  ? maybePkgs.writeText
+, curl       ? maybePkgs.curl
+, cacert     ? maybePkgs.cacert
+, nix        ? maybePkgs.nix
+}:
+
+let
+  inherit (stdenv) lib;
+
+  sources = if builtins.pathExists ./upstream-info.nix
+            then import ./upstream-info.nix
+            else {};
+
+  bucketURL = "https://commondatastorage.googleapis.com/"
+            + "chromium-browser-official";
+
+  mkVerURL = version: "${bucketURL}/chromium-${version}.tar.xz";
+
+  debURL = "https://dl.google.com/linux/chrome/deb/pool/main/g";
+
+  getDebURL = channelName: version: arch: mirror: let
+    packageSuffix = if channelName == "dev" then "unstable" else channelName;
+    packageName = "google-chrome-${packageSuffix}";
+  in "${mirror}/${packageName}/${packageName}_${version}-1_${arch}.deb";
+
+  # Untrusted mirrors, don't try to update from them!
+  debMirrors = [
+    "http://95.31.35.30/chrome/pool/main/g"
+    "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
+    "http://repo.fdzh.org/chrome/deb/pool/main/g"
+  ];
+
+in {
+  getChannel = channel: let
+    chanAttrs = builtins.getAttr channel sources;
+  in {
+    inherit channel;
+    inherit (chanAttrs) version;
+
+    main = fetchurl {
+      url = mkVerURL chanAttrs.version;
+      inherit (chanAttrs) sha256;
+    };
+
+    binary = fetchurl (let
+      mkUrls = arch: let
+        mkURLForMirror = getDebURL channel chanAttrs.version arch;
+      in map mkURLForMirror ([ debURL ] ++ debMirrors);
+    in if stdenv.is64bit && chanAttrs ? sha256bin64 then {
+      urls = mkUrls "amd64";
+      sha256 = chanAttrs.sha256bin64;
+    } else if !stdenv.is64bit && chanAttrs ? sha256bin32 then {
+      urls = mkUrls "i386";
+      sha256 = chanAttrs.sha256bin32;
+    } else throw "No Chrome plugins are available for your architecture.");
+  };
+
+  update = let
+    csv2nix = name: src: import (runCommand "${name}.nix" {
+      src = builtins.fetchurl src;
+    } ''
+      esc() { echo "\"$(echo "$1" | sed -e 's/"\\$/\\&/')\""; } # ohai emacs "
+      IFS=, read -r -a headings <<< "$(head -n1 "$src")"
+      echo "[" > "$out"
+      tail -n +2 "$src" | while IFS=, read -r -a line; do
+        echo "  {"
+        for idx in "''${!headings[@]}"; do
+          echo "    $(esc "''${headings[idx]}") = $(esc ''${line[$idx]});"
+        done
+        echo "  }"
+      done >> "$out"
+      echo "]" >> "$out"
+    '');
+
+    channels = lib.fold lib.recursiveUpdate {} (map (attrs: {
+      ${attrs.os}.${attrs.channel} = attrs // {
+        history = let
+          drvName = "omahaproxy-${attrs.os}.${attrs.channel}-info";
+          history = csv2nix drvName "http://omahaproxy.appspot.com/history";
+          cond = h: attrs.os == h.os && attrs.channel == h.channel
+                 && lib.versionOlder h.version attrs.current_version;
+          # Note that this is a *reverse* sort!
+          sorter = a: b: lib.versionOlder b.version a.version;
+          sorted = builtins.sort sorter (lib.filter cond history);
+        in map (lib.flip removeAttrs ["os" "channel"]) sorted;
+        version = attrs.current_version;
+      };
+    }) (csv2nix "omahaproxy-info" "http://omahaproxy.appspot.com/all?csv=1"));
+
+    /*
+      XXX: This is essentially the same as:
+
+        builtins.tryEval (builtins.fetchurl url)
+
+      ... except that tryEval on fetchurl isn't working and doesn't catch
+      errors for fetchurl, so we go for a different approach.
+
+      We only have fixed-output derivations that can have networking access, so
+      we abuse SHA1 and its weaknesses to forge a fixed-output derivation which
+      is not so fixed, because it emits different contents that have the same
+      SHA1 hash.
+
+      Using this method, we can distinguish whether the URL is available or
+      whether it's not based on the actual content.
+
+      So let's use tryEval as soon as it's working with fetchurl in Nix.
+    */
+    tryFetch = url: let
+      # SHA1 hash collisions from https://shattered.io/static/shattered.pdf:
+      collisions = runCommand "sha1-collisions" {
+        outputs = [ "out" "good" "bad" ];
+        base64 = ''
+          QlpoOTFBWSZTWbL5V5MABl///////9Pv///v////+/////HDdK739/677r+W3/75rUNr4
+          Aa/AAAAAAACgEVTRtQDQAaA0AAyGmjTQGmgAAANGgAaMIAYgGgAABo0AAAAAADQAIAGQ0
+          MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk
+          0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIAN
+          GgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRp
+          o0GIGgBoGQAABVTUExEZATTICnkxNR+p6E09JppoyamjGhkm0ammIyaekbUejU9JiGnqZ
+          qaaDxJ6m0JkZMQ2oaYmJ6gxqMyE2TUzJqfItligtJQJfYbl9Zy9QjQuB5mHQRdSSXCCTH
+          MgmSDYmdOoOmLTBJWiCpOhMQYpQlOYpJjn+wQUJSTCEpOMekaFaaNB6glCC0hKEJdHr6B
+          mUIHeph7YxS8WJYyGwgWnMTFJBDFSxSCCYljiEk7HZgJzJVDHJxMgY6tCEIIWgsKSlSZ0
+          S8GckoIIF+551Ro4RCw260VCEpWJSlpWx/PMrLyVoyhWMAneDilBcUIeZ1j6NCkus0qUC
+          Wnahhk5KT4GpWMh3vm2nJWjTL9Qg+84iExBJhNKpbV9tvEN265t3fu/TKkt4rXFTsV+Nc
+          upJXhOhOhJMQQktrqt4K8mSh9M2DAO2X7uXGVL9YQxUtzQmS7uBndL7M6R7vX869VxqPu
+          renSuHYNq1yTXOfNWLwgvKlRlFYqLCs6OChDp0HuTzCWscmGudLyqUuwVGG75nmyZhKpJ
+          yOE/pOZyHyrZxGM51DYIN+Jc8yVJgAykxKCEtW55MlfudLg3KG6TtozalunXrroSxUpVL
+          StWrWLFihMnVpkyZOrQnUrE6xq1CGtJlbAb5ShMbV1CZgqlKC0wCFCpMmUKSEkvFLaZC8
+          wHOCVAlvzaJQ/T+XLb5Dh5TNM67p6KZ4e4ZSGyVENx2O27LzrTIteAreTkMZpW95GS0CE
+          JYhMc4nToTJ0wQhKEyddaLb/rTqmgJSlkpnALxMhlNmuKEpkEkqhKUoEq3SoKUpIQcDgW
+          lC0rYahMmLuPQ0fHqZaF4v2W8IoJ2EhMhYmSw7qql27WJS+G4rUplToFi2rSv0NSrVvDU
+          pltQ8Lv6F8pXyxmFBSxiLSxglNC4uvXVKmAtusXy4YXGX1ixedEvXF1aX6t8adYnYCpC6
+          rW1ZzdZYlCCxKEv8vpbqdSsXl8v1jCQv0KEPxPTa/5rtWSF1dSgg4z4KjfIMNtgwWoWLE
+          sRhKxsSA9ji7V5LRPwtumeQ8V57UtFSPIUmtQdOQfseI2Ly1DMtk4Jl8n927w34zrWG6P
+          i4jzC82js/46Rt2IZoadWxOtMInS2xYmcu8mOw9PLYxQ4bdfFw3ZPf/g2pzSwZDhGrZAl
+          9lqky0W+yeanadC037xk496t0Dq3ctfmqmjgie8ln9k6Q0K1krb3dK9el4Xsu44LpGcen
+          r2eQZ1s1IhOhnE56WnXf0BLWn9Xz15fMkzi4kpVxiTKGEpffErEEMvEeMZhUl6yD1SdeJ
+          YbxzGNM3ak2TAaglLZlDCVnoM6wV5DRrycwF8Zh/fRsdmhkMfAO1duwknrsFwrzePWeMw
+          l107DWzymxdQwiSXx/lncnn75jL9mUzw2bUDqj20LTgtawxK2SlQg1CCZDQMgSpEqLjRM
+          sykM9zbSIUqil0zNk7Nu+b5J0DKZlhl9CtpGKgX5uyp0idoJ3we9bSrY7PupnUL5eWiDp
+          V5mmnNUhOnYi8xyClkLbNmAXyoWk7GaVrM2umkbpqHDzDymiKjetgzTocWNsJ2E0zPcfh
+          t46J4ipaXGCfF7fuO0a70c82bvqo3HceIcRlshgu73seO8BqlLIap2z5jTOY+T2ucCnBt
+          Atva3aHdchJg9AJ5YdKHz7LoA3VKmeqxAlFyEnQLBxB2PAhAZ8KvmuR6ELXws1Qr13Nd1
+          i4nsp189jqvaNzt+0nEnIaniuP1+/UOZdyfoZh57ku8sYHKdvfW/jYSUks+0rK+qtte+p
+          y8jWL9cOJ0fV8rrH/t+85/p1z2N67p/ZsZ3JmdyliL7lrNxZUlx0MVIl6PxXOUuGOeArW
+          3vuEvJ2beoh7SGyZKHKbR2bBWO1d49JDIcVM6lQtu9UO8ec8pOnXmkcponBPLNM2CwZ9k
+          NC/4ct6rQkPkQHMcV/8XckU4UJCy+VeTA==
+        '';
+      } ''
+        echo "$base64" | base64 -d | tar xj
+        mv good.pdf "$good"
+        mv bad.pdf "$bad"
+        touch "$out"
+      '';
+
+      cacheVal = let
+        urlHash = builtins.hashString "sha256" url;
+        timeSlice = builtins.currentTime / 600;
+      in "${urlHash}-${toString timeSlice}";
+
+    in {
+      success = import (runCommand "check-success" {
+        result = stdenv.mkDerivation {
+          name = "tryfetch-${cacheVal}";
+          inherit url;
+
+          outputHash = "d00bbe65d80f6d53d5c15da7c6b4f0a655c5a86a";
+          outputHashMode = "flat";
+          outputHashAlgo = "sha1";
+
+          nativeBuildInputs = [ curl ];
+          preferLocalBuild = true;
+
+          inherit (collisions) good bad;
+
+          buildCommand = ''
+            if SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt" \
+               curl -s -L -f -I "$url" > /dev/null; then
+              cp "$good" "$out"
+            else
+              cp "$bad" "$out"
+            fi
+          '';
+
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+        };
+        inherit (collisions) good;
+      } ''
+        if cmp -s "$result" "$good"; then
+          echo true > "$out"
+        else
+          echo false > "$out"
+        fi
+      '');
+      value = builtins.fetchurl url;
+    };
+
+    fetchLatest = channel: let
+      result = tryFetch (mkVerURL channel.version);
+    in if result.success then result.value else fetchLatest (channel // {
+      version = if channel.history != []
+                then (lib.head channel.history).version
+                else throw "Unfortunately there's no older version than " +
+                           "${channel.version} available for channel " +
+                           "${channel.channel} on ${channel.os}.";
+      history = lib.tail channel.history;
+    });
+
+    getHash = path: import (runCommand "gethash.nix" {
+      inherit path;
+      nativeBuildInputs = [ nix ];
+    } ''
+      sha256="$(nix-hash --flat --base32 --type sha256 "$path")"
+      echo "\"$sha256\"" > "$out"
+    '');
+
+    isLatest = channel: version: let
+      ourVersion = sources.${channel}.version or null;
+    in if ourVersion == null then false
+       else lib.versionOlder version sources.${channel}.version
+         || version == sources.${channel}.version;
+
+    # We only support GNU/Linux right now.
+    linuxChannels = let
+      genLatest = channelName: channel: let
+        newUpstream = {
+          inherit (channel) version;
+          sha256 = getHash (fetchLatest channel);
+        };
+        keepOld = let
+          oldChannel = sources.${channelName};
+        in {
+          inherit (oldChannel) version sha256;
+        } // lib.optionalAttrs (oldChannel ? sha256bin32) {
+          inherit (oldChannel) sha256bin32;
+        } // lib.optionalAttrs (oldChannel ? sha256bin64) {
+          inherit (oldChannel) sha256bin64;
+        };
+      in if isLatest channelName channel.version then keepOld else newUpstream;
+    in lib.mapAttrs genLatest channels.linux;
+
+    getLinuxFlash = channelName: channel: let
+      inherit (channel) version;
+      fetchArch = arch: tryFetch (getDebURL channelName version arch debURL);
+      packages = lib.genAttrs ["i386" "amd64"] fetchArch;
+      isNew = arch: attr: !(builtins.hasAttr attr channel)
+                       && packages.${arch}.success;
+    in channel // lib.optionalAttrs (isNew "i386" "sha256bin32") {
+      sha256bin32 = getHash (packages.i386.value);
+    } // lib.optionalAttrs (isNew "amd64" "sha256bin64") {
+      sha256bin64 = getHash (packages.amd64.value);
+    };
+
+    newChannels = lib.mapAttrs getLinuxFlash linuxChannels;
+
+    dumpAttrs = indent: attrs: let
+      mkVal = val: if lib.isAttrs val then dumpAttrs (indent + 1) val
+                   else "\"${lib.escape ["$" "\\" "\""] (toString val)}\"";
+      mkIndent = level: lib.concatStrings (builtins.genList (_: "  ") level);
+      mkAttr = key: val: "${mkIndent (indent + 1)}${key} = ${mkVal val};\n";
+      attrLines = lib.mapAttrsToList mkAttr attrs;
+    in "{\n" + (lib.concatStrings attrLines) + (mkIndent indent) + "}";
+  in writeText "chromium-new-upstream-info.nix" ''
+    # This file is autogenerated from update.sh in the same directory.
+    ${dumpAttrs 0 newChannels}
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh b/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh
new file mode 100755
index 000000000000..ea67a62c107a
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh
@@ -0,0 +1,4 @@
+#!/bin/sh -e
+cd "$(dirname "$0")"
+sp="$(nix-build --builders "" -Q --no-out-link update.nix -A update)"
+cat "$sp" > upstream-info.nix
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix
new file mode 100644
index 000000000000..c5f9d60122dc
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix
@@ -0,0 +1,18 @@
+# This file is autogenerated from update.sh in the same directory.
+{
+  beta = {
+    sha256 = "0i0szd749ihb08rxnsmsbxq75b6x952wpk94jwc0ncv6gb83zkx2";
+    sha256bin64 = "1y70kmfz9nv507b0zdda7zfk2ac9qh9m2gq00aphdmzd0al7skj8";
+    version = "81.0.4044.92";
+  };
+  dev = {
+    sha256 = "1rydvjmv62zj95sf0fgsyipqz2hphbxm60y8q0813wq9ym35d4yy";
+    sha256bin64 = "1m6740lw7xjjp1lplwp9ii4d3l7dfa9jrv5bysm4ar5pb9kywrai";
+    version = "83.0.4100.3";
+  };
+  stable = {
+    sha256 = "0i0szd749ihb08rxnsmsbxq75b6x952wpk94jwc0ncv6gb83zkx2";
+    sha256bin64 = "1ig899cpahw1xfhdff5xj6w4k8jja5smxvrcbw6b0jcjmawdrf72";
+    version = "81.0.4044.92";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index 9c6eec1a3363..d457ddd98bfe 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -37,6 +37,6 @@ buildGoPackage rec {
     homepage = "https://github.com/containernetworking/plugins";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan saschagrunert ];
+    maintainers = with maintainers; [ cstrahan ] ++ teams.podman.members;
   };
 }
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index aee162ba6f22..0eac175a1707 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helm";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "0pg5cwgyfb4isy2fn233kj3bdn0i8qqp90yzix0khs5maalpnrk1";
+    sha256 = "1j6pr1a9ff32bnjq9rncllmfpraip5r2fj3zsljw5jq68x5wamdc";
   };
   modSha256 = "0618zzi4x37ahsrazsr82anghhfva8yaryzb3p5d737p3ixbiyv8";
 
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index 3f0a83d015da..e8500872d52c 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -6,8 +6,6 @@ buildGoPackage rec {
 
   goPackagePath = "github.com/StackExchange/dnscontrol";
 
-  goDeps = ./deps.nix;
-
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
@@ -15,9 +13,7 @@ buildGoPackage rec {
     sha256 = "1j8i4k7bqkqmi6dmc9fxfab49a7qigig72rlbga902lw336p6cc7";
   };
 
-  postInstall = ''
-    rm $bin/bin/{build,convertzone,generate,validate}
-  '';
+  subPackages = [ "." ];
 
   meta = with stdenv.lib; {
     description = "Synchronize your DNS to multiple providers from a simple DSL";
diff --git a/pkgs/applications/networking/dnscontrol/deps.nix b/pkgs/applications/networking/dnscontrol/deps.nix
deleted file mode 100644
index 55cb5daa18f8..000000000000
--- a/pkgs/applications/networking/dnscontrol/deps.nix
+++ /dev/null
@@ -1,1236 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "cloud.google.com/go";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/gocloud";
-      rev = "335e9e09b93e";
-      sha256 = "1aiglr6d2369nf3s9ig1kc0nixsivcmh7p1fyzkcf6n6ql0p2zsm";
-    };
-  }
-  {
-    goPackagePath = "github.com/Azure/azure-sdk-for-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/azure-sdk-for-go";
-      rev = "v39.1.0";
-      sha256 = "1s0j7gh3d3p157py7v6525c6zs07hdiry97dhg4c8z7ww35wxhj7";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/xgb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/xgb";
-      rev = "27f122750802";
-      sha256 = "18lp2x8f5bljvlz0r7xn744f0c9rywjsb9ifiszqqdcpwhsa0kvj";
-    };
-  }
-  {
-    goPackagePath = "github.com/DisposaBoy/JsonConfigReader";
-    fetch = {
-      type = "git";
-      url = "https://github.com/DisposaBoy/JsonConfigReader";
-      rev = "5ea4d0ddac55";
-      sha256 = "022wzrkf0rni9yb15439w81kj0kb4667zx6n2zq07ysw7lk6ahqz";
-    };
-  }
-  {
-    goPackagePath = "github.com/TomOnTime/utfutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/TomOnTime/utfutil";
-      rev = "09c41003ee1d";
-      sha256 = "01d6w8migw5px19jg0mm7qhsa1ydcz9wvl838nsclfw63x5sy70i";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/kingpin";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/kingpin";
-      rev = "v2.2.6";
-      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/template";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/template";
-      rev = "fb15b899a751";
-      sha256 = "1vlasv4dgycydh5wx6jdcvz40zdv90zz1h7836z7lhsi2ymvii26";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/units";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/units";
-      rev = "f65c72e2690d";
-      sha256 = "04jyqm7m3m01ppfy1f9xk4qvrwvs78q9zml6llyf2b3v5k6b2bbc";
-    };
-  }
-  {
-    goPackagePath = "github.com/andreyvit/diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/andreyvit/diff";
-      rev = "c7f18ee00883";
-      sha256 = "1s4qjkxig5yqahpzfl4xqh4kzi9mymdpkzq6kj3f4dr5dl3hlynr";
-    };
-  }
-  {
-    goPackagePath = "github.com/armon/go-metrics";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/go-metrics";
-      rev = "f0300d1749da";
-      sha256 = "13l7c35ps0r27vxfil2w0xhhc7w5rh00awvlmn4cz0a937b9ffpv";
-    };
-  }
-  {
-    goPackagePath = "github.com/armon/go-radix";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/go-radix";
-      rev = "7fddfc383310";
-      sha256 = "0y8chspn14n9xpsfb9gxnnf819rfpriaz64v81p7873a42kkhxb4";
-    };
-  }
-  {
-    goPackagePath = "github.com/aws/aws-sdk-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aws/aws-sdk-go";
-      rev = "v1.29.21";
-      sha256 = "0q97abz6cjj1gf3gfd52gjx39grfhlcjax8306zw9038a8v0nadc";
-    };
-  }
-  {
-    goPackagePath = "github.com/bgentry/speakeasy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/bgentry/speakeasy";
-      rev = "v0.1.0";
-      sha256 = "02dfrj0wyphd3db9zn2mixqxwiz1ivnyc5xc7gkz58l5l27nzp8s";
-    };
-  }
-  {
-    goPackagePath = "github.com/billputer/go-namecheap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/billputer/go-namecheap";
-      rev = "0c7adb0710f8";
-      sha256 = "09jkymml6f0nvz7md7s4ayj75xdms77ziz9rkw4kvj7jhv36302p";
-    };
-  }
-  {
-    goPackagePath = "github.com/cenkalti/backoff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cenkalti/backoff";
-      rev = "v2.1.1";
-      sha256 = "1mf4lsl3rbb8kk42x0mrhzzy4ikqy0jf6nxpzhkr02rdgwh6rjk8";
-    };
-  }
-  {
-    goPackagePath = "github.com/census-instrumentation/opencensus-proto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-proto";
-      rev = "v0.2.1";
-      sha256 = "19fcx3sc99i5dsklny6r073z5j20vlwn2xqm6di1q3b1xwchzqfj";
-    };
-  }
-  {
-    goPackagePath = "github.com/client9/misspell";
-    fetch = {
-      type = "git";
-      url = "https://github.com/client9/misspell";
-      rev = "v0.3.4";
-      sha256 = "1vwf33wsc4la25zk9nylpbp9px3svlmldkm0bha4hp56jws4q9cs";
-    };
-  }
-  {
-    goPackagePath = "github.com/cpuguy83/go-md2man";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "v2.0.0";
-      sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
-    };
-  }
-  {
-    goPackagePath = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev = "v1.1.1";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath = "github.com/digitalocean/godo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/digitalocean/godo";
-      rev = "v1.30.0";
-      sha256 = "0z38lg1zd57b5ymxdxhz5rs5rynpzhqmbvm0marhh0v7v9bbk0rx";
-    };
-  }
-  {
-    goPackagePath = "github.com/dimchansky/utfbom";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dimchansky/utfbom";
-      rev = "v1.1.0";
-      sha256 = "06s61wwd32fad1p8qn5blqjd5791avzb13fnqflkkg993adw49ww";
-    };
-  }
-  {
-    goPackagePath = "github.com/dnsimple/dnsimple-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dnsimple/dnsimple-go";
-      rev = "v0.31.0";
-      sha256 = "0i074r3m0bqggmplswymgj6yfzbsrcqw8gn6py9x8g3kyl4si0x0";
-    };
-  }
-  {
-    goPackagePath = "github.com/envoyproxy/go-control-plane";
-    fetch = {
-      type = "git";
-      url = "https://github.com/envoyproxy/go-control-plane";
-      rev = "5f8ba28d4473";
-      sha256 = "1f1s764rd41vd9vgk3r14h1m6fz6pdvxj6fd83q58gxifbc4q5w4";
-    };
-  }
-  {
-    goPackagePath = "github.com/envoyproxy/protoc-gen-validate";
-    fetch = {
-      type = "git";
-      url = "https://github.com/envoyproxy/protoc-gen-validate";
-      rev = "v0.1.0";
-      sha256 = "0kxd3wwh3xwqk0r684hsy281xq4y71cd11d4q2hspcjbnlbwh7cy";
-    };
-  }
-  {
-    goPackagePath = "github.com/exoscale/egoscale";
-    fetch = {
-      type = "git";
-      url = "https://github.com/exoscale/egoscale";
-      rev = "v0.23.0";
-      sha256 = "0dgc08sdvy2cj7yygrlnyp6v9m829h4v0pm3vdsj9yx3bps5v7iy";
-    };
-  }
-  {
-    goPackagePath = "github.com/fatih/color";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/color";
-      rev = "v1.7.0";
-      sha256 = "0v8msvg38r8d1iiq2i5r4xyfx0invhc941kjrsg5gzwvagv55inv";
-    };
-  }
-  {
-    goPackagePath = "github.com/fatih/structs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/structs";
-      rev = "v1.1.0";
-      sha256 = "1wrhb8wp8zpzggl61lapb627lw8yv281abvr6vqakmf569nswa9q";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-acme/lego";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-acme/lego";
-      rev = "v2.7.2";
-      sha256 = "1137l22jrwk8hvdzjbmfkvd9nllp6sznzy66ngmcsc0ybp19hcry";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-ldap/ldap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-ldap/ldap";
-      rev = "v3.0.2";
-      sha256 = "1srb1nkcbs0v1hcdz6j4zhg000h763j83jlklsiwanvbp48y4lhz";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev = "v1.5.0";
-      sha256 = "11x0m9yf3kdnf6981182r824psgxwfaqhn3x3in4yiidp0w0hk3v";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-test/deep";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-test/deep";
-      rev = "042da051cf31";
-      sha256 = "08bya0s7m15f5qm1kn2r42g1r4lpq0svpaqr0zaac4hmaxj7vnid";
-    };
-  }
-  {
-    goPackagePath = "github.com/gobwas/glob";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gobwas/glob";
-      rev = "e7a84e9525fe";
-      sha256 = "1v6vjklq06wqddv46ihajahaj1slv0imgaivlxr8bsx59i90js5q";
-    };
-  }
-  {
-    goPackagePath = "github.com/gofrs/uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gofrs/uuid";
-      rev = "v3.2.0";
-      sha256 = "1q63mp7bznhfgyw133c0wc0hpcj1cq9bcf7w1f8r6inkcrils1fz";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/glog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/glog";
-      rev = "23def4e6c14b";
-      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/mock";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/mock";
-      rev = "v1.3.1";
-      sha256 = "1wnfa8njxdym1qb664dmfnkpm4pmqy22hqjlqpwaaiqhglb5g9d1";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.3.3";
-      sha256 = "1cyyr52yhj3fzrily3rmsbqyj8va4ld75lmry0857m39rgpv8sy1";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/snappy";
-      rev = "v0.0.1";
-      sha256 = "0gp3kkzlm3wh37kgkhbqxq3zx07iqbgis5w9mf4d64h6vjq760is";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/btree";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/btree";
-      rev = "v1.0.0";
-      sha256 = "0ba430m9fbnagacp57krgidsyrgp3ycw5r7dj71brgp5r52g82p6";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-cmp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-cmp";
-      rev = "v0.4.0";
-      sha256 = "1x5pvl3fb5sbyng7i34431xycnhmx8xx94gq2n19g6p0vz68z2v2";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-github";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-github";
-      rev = "v17.0.0";
-      sha256 = "1kvw95l77a5n5rgal9n1xjh58zxb3a40ij1j722b1h4z8yg9jhg4";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-querystring";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-querystring";
-      rev = "c8c88dbee036";
-      sha256 = "1yckg2052mz7ps1m68wri6kyb5n4g0vx2yf7s0xs9gdqvvscp57l";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/martian";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/martian";
-      rev = "v2.1.0";
-      sha256 = "197hil6vrjk50b9wvwyzf61csid83whsjj6ik8mc9r2lryxlyyrp";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/pprof";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/pprof";
-      rev = "54271f7e092f";
-      sha256 = "14x4ydifz23rzaylggvwbm3dwlv1bc6s0bclmkxck9nbjbqw89vy";
-    };
-  }
-  {
-    goPackagePath = "github.com/googleapis/gax-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/gax-go";
-      rev = "v2.0.5";
-      sha256 = "1lxawwngv6miaqd25s3ba0didfzylbwisd2nz7r4gmbmin6jsjrx";
-    };
-  }
-  {
-    goPackagePath = "github.com/gopherjs/gopherjs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gopherjs/gopherjs";
-      rev = "0766667cb4d1";
-      sha256 = "13pfc9sxiwjky2lm1xb3i3lcisn8p6mgjk2d927l7r92ysph8dmw";
-    };
-  }
-  {
-    goPackagePath = "github.com/gopherjs/jquery";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gopherjs/jquery";
-      rev = "73f4c7416038";
-      sha256 = "1xhl0k52v3djalnd02a0ph572f85i1szj2x4q3lglkq40j7racd2";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/errwrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/errwrap";
-      rev = "v1.0.0";
-      sha256 = "0slfb6w3b61xz04r32bi0a1bygc82rjzhqkxj2si2074wynqnr1c";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-cleanhttp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-cleanhttp";
-      rev = "v0.5.1";
-      sha256 = "07kx3fhryqmaw3czacmm11qwx63js2q8cfq967vphk7xg9q377kk";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-hclog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-hclog";
-      rev = "v0.9.2";
-      sha256 = "0pakba7rdkjgq50r79sbbpavymbyib77cy613wl734mpi30ywrxm";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-immutable-radix";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-immutable-radix";
-      rev = "v1.0.0";
-      sha256 = "1v3nmsnk1s8bzpclrhirz7iq0g5xxbw9q5gvrg9ss6w9crs72qr6";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-multierror";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-multierror";
-      rev = "v1.0.0";
-      sha256 = "00nyn8llqzbfm8aflr9kwsvpzi4kv8v45c141v88xskxp5xf6z49";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-plugin";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-plugin";
-      rev = "v1.0.1";
-      sha256 = "0aama8vdyrfzjdhxc1l4cwhmgydl989lywhq3pg3slzjg6r00rda";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-retryablehttp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-retryablehttp";
-      rev = "v0.6.3";
-      sha256 = "1vnhr7yry71jldmmj5gxhq49crhi9vrmqc2i41mycpnva2zd8a0i";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-rootcerts";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-rootcerts";
-      rev = "v1.0.1";
-      sha256 = "0ca5h7vlvrghf24dzh8l6w5px293n173qxfkjxb9kgsl6hsrsl3y";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-sockaddr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-sockaddr";
-      rev = "v1.0.2";
-      sha256 = "0y106nhd3s63lj7h7k21iq0br97h0z9qjrvx028zqcsq9407k9is";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-uuid";
-      rev = "v1.0.1";
-      sha256 = "0jvb88m0rq41bwgirsadgw7mnayl27av3gd2vqa3xvxp3fy0hp5k";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-version";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-version";
-      rev = "v1.1.0";
-      sha256 = "1ykh3jl5zj5a4irkgp5mq936bqkznmf9lp23qk741vh4r5874vi8";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/golang-lru";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/golang-lru";
-      rev = "v0.5.1";
-      sha256 = "13f870cvk161bzjj6x41l45r5x9i1z9r2ymwmvm7768kg08zznpy";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/hcl";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/hcl";
-      rev = "v1.0.0";
-      sha256 = "0q6ml0qqs0yil76mpn4mdx4lp94id8vbv575qm60jzl1ijcl5i66";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/yamux";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/yamux";
-      rev = "2f1d1f20f75d";
-      sha256 = "1fga3p6j2g24ip9qjfwn3nqjr00m4nnjz92app7ms3sz7vgq2a7s";
-    };
-  }
-  {
-    goPackagePath = "github.com/hexonet/go-sdk";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hexonet/go-sdk";
-      rev = "v2.2.3";
-      sha256 = "0mgkfrc7qlm4xf1v7kb29p7wq6rmaaha9zv8kwa27r8hjx6qnb8c";
-    };
-  }
-  {
-    goPackagePath = "github.com/jarcoal/httpmock";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jarcoal/httpmock";
-      rev = "v1.0.4";
-      sha256 = "1x04i9hhvdxi9xmyf0vbi5azlh7rr4blsq7fbhps8i2gdpga612y";
-    };
-  }
-  {
-    goPackagePath = "github.com/jmespath/go-jmespath";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jmespath/go-jmespath";
-      rev = "2437e8417af5";
-      sha256 = "1hwcbr7nrlfshwr4hrac8ch8gvfpf07qi72bpqmqi272c67ma89v";
-    };
-  }
-  {
-    goPackagePath = "github.com/jstemmer/go-junit-report";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jstemmer/go-junit-report";
-      rev = "af01ea7f8024";
-      sha256 = "1lp3n94ris12hac02wi31f3whs88lcrzwgdg43a5j6cafg9p1d0s";
-    };
-  }
-  {
-    goPackagePath = "github.com/jtolds/gls";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jtolds/gls";
-      rev = "v4.20.0";
-      sha256 = "1k7xd2q2ysv2xsh373qs801v6f359240kx0vrl0ydh7731lngvk6";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pretty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pretty";
-      rev = "v0.1.0";
-      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pty";
-      rev = "v1.1.1";
-      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/text";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/text";
-      rev = "v0.1.0";
-      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
-    };
-  }
-  {
-    goPackagePath = "github.com/malexdev/utfutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/malexdev/utfutil";
-      rev = "00c8d4a8e7a8";
-      sha256 = "01d6w8migw5px19jg0mm7qhsa1ydcz9wvl838nsclfw63x5sy70i";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev = "v0.0.9";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.3";
-      sha256 = "06w45aqz2a6yrk25axbly2k5wmsccv8cspb94bfmz4izvw8h927n";
-    };
-  }
-  {
-    goPackagePath = "github.com/miekg/dns";
-    fetch = {
-      type = "git";
-      url = "https://github.com/miekg/dns";
-      rev = "v1.1.27";
-      sha256 = "0fpd9alvhzrkb1c31n4lrxlpv1nlhy51w1yg39xxb3mjmrb7lby1";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/cli";
-      rev = "v1.0.0";
-      sha256 = "1i9kmr7rcf10d2hji8h4247hmc0nbairv7a0q51393aw2h1bnwg2";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/copystructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/copystructure";
-      rev = "v1.0.0";
-      sha256 = "05njg92w1088v4yl0js0zdrpfq6k37i9j14mxkr3p90p5yd9rrrr";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-homedir";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-homedir";
-      rev = "v1.1.0";
-      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-testing-interface";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-testing-interface";
-      rev = "v1.0.0";
-      sha256 = "1dl2js8di858bawg7dadlf1qjpkl2g3apziihjyf5imri3znyfpw";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-wordwrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-wordwrap";
-      rev = "v1.0.0";
-      sha256 = "1jffbwcr3nnq6c12c5856bwzv2nxjzqk3jwgvxkwi1xhpd2by0bf";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/mapstructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/mapstructure";
-      rev = "v1.1.2";
-      sha256 = "03bpv28jz9zhn4947saqwi328ydj7f6g6pf1m2d4m5zdh5jlfkrr";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/reflectwalk";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/reflectwalk";
-      rev = "v1.0.0";
-      sha256 = "0wzkp0fdx22n8f7y9y37dgmnlrlfsv9zjdb48cbx7rsqsbnny7l0";
-    };
-  }
-  {
-    goPackagePath = "github.com/mjibson/esc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mjibson/esc";
-      rev = "v0.2.0";
-      sha256 = "0ci3bdm01prm114plcwkgzbqn825lh0zc1iqaw3jicjay5sh0bis";
-    };
-  }
-  {
-    goPackagePath = "github.com/namedotcom/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/namedotcom/go";
-      rev = "08470befbe04";
-      sha256 = "00ai7fd74sn4alqmpqsiyczirli50b7m059b6zzg1izy9g4cdd4g";
-    };
-  }
-  {
-    goPackagePath = "github.com/oklog/run";
-    fetch = {
-      type = "git";
-      url = "https://github.com/oklog/run";
-      rev = "v1.0.0";
-      sha256 = "1pbjza4claaj95fpqvvfrysvs10y7dm0pl6qr5lzh6qy1vnhmcgw";
-    };
-  }
-  {
-    goPackagePath = "github.com/ovh/go-ovh";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ovh/go-ovh";
-      rev = "ba5adb4cf014";
-      sha256 = "1rwxib0pn2ni6nfn2sijvb6cd424n95gnqhs21q6mz08n9hnzspy";
-    };
-  }
-  {
-    goPackagePath = "github.com/pascaldekloe/goe";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pascaldekloe/goe";
-      rev = "v0.1.0";
-      sha256 = "1dqd3mfb4z2vmv6pg6fhgvfc53vhndk24wcl9lj1rz02n6m279fq";
-    };
-  }
-  {
-    goPackagePath = "github.com/philhug/opensrs-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/philhug/opensrs-go";
-      rev = "9dfa7433020d";
-      sha256 = "1bjw3llpx5n1srylw08310ch14sz1pw5mban1yakax8606q3dqdf";
-    };
-  }
-  {
-    goPackagePath = "github.com/pierrec/lz4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pierrec/lz4";
-      rev = "v2.0.5";
-      sha256 = "0y5rh7z01zycd59nnjpkqq0ydyjmcg9j1xw15q1i600l9j9g617p";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.9.1";
-      sha256 = "1761pybhc2kqr6v5fm8faj08x9bql8427yqg6vnfv6nhrasx1mwq";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/posener/complete";
-    fetch = {
-      type = "git";
-      url = "https://github.com/posener/complete";
-      rev = "v1.1.1";
-      sha256 = "1nbdiybjizbaxbf5q0xwbq0cjqw4bl6jggvsjzrpif0w86fcjda2";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev = "14fe0d1b01d4";
-      sha256 = "0zdmk6rbbx39cvfz0r59v2jg5sg9yd02b4pds5n5llgvivi99550";
-    };
-  }
-  {
-    goPackagePath = "github.com/renier/xmlrpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/renier/xmlrpc";
-      rev = "ce4a1a486c03";
-      sha256 = "0byvacdwhagva53r2frzqws3f5j7qzigmxzxahpcv300i8pm9i50";
-    };
-  }
-  {
-    goPackagePath = "github.com/robertkrimen/otto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/robertkrimen/otto";
-      rev = "c382bd3c16ff";
-      sha256 = "043y6l647snsz71mdy84s2d3kn22aj6rbqd6c1vd8absvamqhlxa";
-    };
-  }
-  {
-    goPackagePath = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v2.0.1";
-      sha256 = "0nlz7isdd4rgnwzs68499hlwicxz34j2k2a0b8jy0y7ycd2bcr5j";
-    };
-  }
-  {
-    goPackagePath = "github.com/ryanuber/columnize";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ryanuber/columnize";
-      rev = "v2.1.0";
-      sha256 = "0m9jhagb1k44zfcdai76xdf9vpi3bqdl7p078ffyibmz0z9jfap6";
-    };
-  }
-  {
-    goPackagePath = "github.com/ryanuber/go-glob";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ryanuber/go-glob";
-      rev = "v1.0.0";
-      sha256 = "0mhrjy0iba3jr6bsgy7q50zjr42ar1njn1sb2fvihlkhxgb2ahv2";
-    };
-  }
-  {
-    goPackagePath = "github.com/sergi/go-diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sergi/go-diff";
-      rev = "v1.1.0";
-      sha256 = "0ir8ali2vx0j7pipmlfd6k8c973akyy2nmbjrf008fm800zcp7z2";
-    };
-  }
-  {
-    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev = "v1.0.0";
-      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
-    };
-  }
-  {
-    goPackagePath = "github.com/smartystreets/assertions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smartystreets/assertions";
-      rev = "b2de0cb4f26d";
-      sha256 = "1i7ldgavgl35c7gk25p7bvdr282ckng090zr4ch9mk1705akx09y";
-    };
-  }
-  {
-    goPackagePath = "github.com/smartystreets/goconvey";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smartystreets/goconvey";
-      rev = "68dc04aab96a";
-      sha256 = "1kas5v95fzhr88hg4rjy0vp03y4pzvy3pwwgkfz2yhn5nlj29nk6";
-    };
-  }
-  {
-    goPackagePath = "github.com/softlayer/softlayer-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/softlayer/softlayer-go";
-      rev = "5e1c8cccc730";
-      sha256 = "0jsi0f60gx92qm1n2lcz65v425bbqf59dsr0dw4x1wmychp25mk7";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/objx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/objx";
-      rev = "v0.1.0";
-      sha256 = "19ynspzjdynbi85xw06mh8ad5j0qa1vryvxjgvbnyrr8rbm4vd8w";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev = "v1.5.1";
-      sha256 = "09r89m1wy4cjv2nps1ykp00qjpi0531r07q3s34hr7m6njk4srkl";
-    };
-  }
-  {
-    goPackagePath = "github.com/tdewolff/minify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tdewolff/minify";
-      rev = "v2.3.6";
-      sha256 = "0p4v4ab49lm5y438k5aks06fpiagbjw2j2x7i8jaa273mkgicrbb";
-    };
-  }
-  {
-    goPackagePath = "github.com/tdewolff/parse";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tdewolff/parse";
-      rev = "v2.3.4";
-      sha256 = "00hclphbjgc5vjrqgnclp72v8c45k35vmj84d2a0f7bw8cc88zcd";
-    };
-  }
-  {
-    goPackagePath = "github.com/tdewolff/test";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tdewolff/test";
-      rev = "v1.0.6";
-      sha256 = "12glhjb4cwp6yxwd17rwa6b4gxna3lm01bgc7yn9di58chc7lyh3";
-    };
-  }
-  {
-    goPackagePath = "github.com/tiramiseb/go-gandi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tiramiseb/go-gandi";
-      rev = "e1cf2e430b3a";
-      sha256 = "1m6wzif0dgssh5hzffwqg39789k9nwvj8xaq0d492f0fr14w0nng";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev = "v2.1.1";
-      sha256 = "0znf7pim7xsl8x6pcgi9vm0px48xrqfkw6ysn4yv6xc2569zpjs1";
-    };
-  }
-  {
-    goPackagePath = "github.com/vultr/govultr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/vultr/govultr";
-      rev = "v0.2.0";
-      sha256 = "09103hb2rx93d6vyr54bqdai35d6l5q3klk09k53aqrijp8pycfz";
-    };
-  }
-  {
-    goPackagePath = "go.opencensus.io";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-go";
-      rev = "v0.22.0";
-      sha256 = "05jr8gkr2w34i5wwki4zhl5ch0qrgi7cdgag5iy5gpxplhbrvbg9";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "2aa609cf4a9d";
-      sha256 = "1yvis6fqbsd7f356aqyi18f76vnwj3bry6mxqnkvshq4cwrf92il";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/exp";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/exp";
-      rev = "efd6b22b2522";
-      sha256 = "0ysahwb7p6y09izks4ca8nk2w414gmjxzz44l5rmadlvk3k66cgp";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/image";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/image";
-      rev = "0694c2d4d067";
-      sha256 = "0v4rs4xpi7agbdzjw713mp7gzij8z89058s0yfj3276mzlns3zk4";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/lint";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/lint";
-      rev = "959b441ac422";
-      sha256 = "1mgcv5f00pkzsbwnq2y7vqvd1b4lr5a3s47cphh2qv4indfk7pck";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/mobile";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/mobile";
-      rev = "d3739f865fa6";
-      sha256 = "079ck2dyikacnph9s5mf0hrjnqlk6lc8q64dwnyw45w3xbbc50mg";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/mod";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/mod";
-      rev = "v0.2.0";
-      sha256 = "1fp6885dclq77mh73v7i54v2b9llpv4di193zc8vmsbbkkc483cl";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "0de0cce0169b";
-      sha256 = "1db7s5kbzyh2zd5lpv05n7hp8wbwdvgk0wpiwrlnig94mkr0y5aq";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/oauth2";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/oauth2";
-      rev = "bf48bf16ab8d";
-      sha256 = "1sirdib60zwmh93kf9qrx51r8544k1p9rs5mk0797wibz3m4mrdg";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "cd5d95a43a6e";
-      sha256 = "1nqkyz2y1qvqcma52ijh02s8aiqmkfb95j08f6zcjhbga3ds6hds";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "cb0a6d8edb6c";
-      sha256 = "0xkrf2k6nn1qh64ckrc4rmf1vhkzs0p7f1rnhv4v4pz9mvgh3v6w";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "v0.3.2";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/time";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/time";
-      rev = "9d24e82272b4";
-      sha256 = "1f5nkr4vys2vbd8wrwyiq2f5wcaahhpxmia85d1gshcbqjqf8dkb";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "20ab64c0d93f";
-      sha256 = "1gfhw6daabjy771b3c0k0yga18ja50845n648mgagsa441dxvlch";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/xerrors";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/xerrors";
-      rev = "9bdfabe68543";
-      sha256 = "1yjfi1bk9xb81lqn85nnm13zz725wazvrx3b50hx19qmwg7a4b0c";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/api";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/google-api-go-client";
-      rev = "v0.20.0";
-      sha256 = "13syr1x33k6mrn5w6l4sgdbzn368w3m60vf6kk2j10fwa45125rg";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev = "v1.6.5";
-      sha256 = "05hbq4cs7bqw0zl17bx8rzdkszid3nyl92100scg3jjrg70dhm7w";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/genproto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-genproto";
-      rev = "24fa4b261c55";
-      sha256 = "109zhaqlfd8zkbr1hk6zqbs6vcxfrk64scjwh2nswph05gr0m84d";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/grpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc/grpc-go";
-      rev = "v1.27.0";
-      sha256 = "1ijrmgrxyabfn51nm3p9l81iaasq5fg237wnr6mdc4dzsfcg8kd7";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/asn1-ber.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/asn1-ber.v1";
-      rev = "f715ec2f112d";
-      sha256 = "00ixms8x3lrhywbvq5v2sagcqsxa1pcnlk17dp5lnwckv3xg4psb";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "41f04d3bba15";
-      sha256 = "0vfk9czmlxmp6wndq8k17rhnjxal764mxfhrccza7nwlia760pjy";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/ini.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/ini.v1";
-      rev = "v1.42.0";
-      sha256 = "18ywm8zyv091j1pp5mvx8szl7928chk8lw02br6jy568d7rk4xal";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/ns1/ns1-go.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/ns1/ns1-go.v2";
-      rev = "c563826f4cbe";
-      sha256 = "0swpsy0bdkwqlb7i0fgxs55sdfsy7pbnh6a09crhbw5xldvswq5k";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/sourcemap.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/sourcemap.v1";
-      rev = "v1.0.5";
-      sha256 = "08rf2dl13hbnm3fq2cm0nnsspy9fhf922ln23cz5463cv7h62as4";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/square/go-jose.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/square/go-jose.v2";
-      rev = "v2.3.1";
-      sha256 = "11r93g9xrcjqj7qvq8sbd5hy5rnbpmim0vdsp6rbav8gl7wimaa3";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.8";
-      sha256 = "1inf7svydzscwv9fcjd2rm61a4xjk6jkswknybmns2n58shimapw";
-    };
-  }
-  {
-    goPackagePath = "honnef.co/go/tools";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dominikh/go-tools";
-      rev = "ea95bdfd59fc";
-      sha256 = "1763nw7pwpzkvzfnm63dgzcgbq9hwmq5l1nffchnhh77vgkaq4ic";
-    };
-  }
-  {
-    goPackagePath = "rsc.io/binaryregexp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rsc/binaryregexp";
-      rev = "v0.2.0";
-      sha256 = "1kar0myy85waw418zslviwx8846zj0m9cmqkxjx0fvgjdi70nc4b";
-    };
-  }
-]
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index 1237892ef64c..74a644d189d4 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Free and Open Source messaging and emailing app that combines common web applications into one";
-    homepage = "http://rambox.pro";
+    homepage = "https://rambox.pro";
     license = licenses.mit;
     maintainers = with maintainers; [ gnidorah ma27 ];
     platforms = ["i686-linux" "x86_64-linux"];
diff --git a/pkgs/applications/networking/instant-messengers/ricochet/default.nix b/pkgs/applications/networking/instant-messengers/ricochet/default.nix
index 01295697ad3a..de46c891d1fa 100644
--- a/pkgs/applications/networking/instant-messengers/ricochet/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ricochet/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, pkgconfig, makeDesktopItem
+{ mkDerivation, stdenv, fetchurl, pkgconfig, makeDesktopItem
 , qtbase, qttools, qtmultimedia, qtquick1, qtquickcontrols
 , openssl, protobuf, qmake
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "ricochet";
   version = "1.1.4";
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 7295f6c48ad6..c39b199235d1 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.33.1"; # Please backport all updates to the stable channel.
+  version = "1.33.3"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0p9ak0cmk9b77dzbw4y2xmxqg211y62n7ckggwf7bcg48wzj0jy7";
+    sha256 = "1brw1hidmrznb55cb794yvgzin7sf3cxnffivmag4vf2a2vcvf4y";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/swift-im/default.nix b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
index ce59d5746190..953ce2809c43 100644
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, pkgconfig, qttools, scons
+{ mkDerivation, stdenv, fetchurl, pkgconfig, qttools, scons
 , GConf, avahi, boost, hunspell, libXScrnSaver, libedit, libidn, libnatpmp, libxml2
 , lua, miniupnpc, openssl, qtbase, qtmultimedia, qtsvg, qtwebkit, qtx11extras, zlib
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "swift-im";
   version = "4.0.2";
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 60fd95a14761..6f4099c1d8d5 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -19,12 +19,12 @@ with lib;
 
 mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.0.1";
+  version = "2.1.0";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "0g3jw4can9gmp48s3b8s1w8n9xi54i142y74fszxf9jyq5drzlff";
+    sha256 = "0l5917w90z9pg1al1hzcycb4yxv03vc88jg958ifl9nlvz1arll6";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/tensor/default.nix b/pkgs/applications/networking/instant-messengers/tensor/default.nix
index dcb2c720bc62..1ea249a8b51b 100644
--- a/pkgs/applications/networking/instant-messengers/tensor/default.nix
+++ b/pkgs/applications/networking/instant-messengers/tensor/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchgit, qtbase, qtquickcontrols, qmake, makeDesktopItem }:
+{ mkDerivation, stdenv, fetchgit, qtbase, qtquickcontrols, qmake, makeDesktopItem }:
 
 # we now have libqmatrixclient so a future version of tensor that supports it
 # should use that
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "tensor-git";
   version = "2017-02-21";
 
diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/applications/networking/msmtp/default.nix
index f78b085b6c64..0117ab978cc0 100644
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoreconfHook, pkgconfig, texinfo
+{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, pkgconfig, texinfo
 , netcat-gnu, gnutls, gsasl, libidn2, Security
 , withKeyring ? true, libsecret ? null
 , systemd ? null }:
@@ -16,8 +16,13 @@ in stdenv.mkDerivation rec {
     sha256 = "1rarck61mz3mwg0l30vjj6j9fq6gc7gic0r1c1ppwpq2izj57jzc";
   };
 
+  # the 2nd patch should go when 1.8.9 is released
   patches = [
     ./paths.patch
+    (fetchpatch {
+      url = "https://github.com/marlam/msmtp-mirror/commit/c78f24347ec996c7a3830b48403bf3736afca071.patch";
+      sha256 = "0d4sc2f5838jriv65wahpgvwckkzqhdk3hs660fyg80si2i0l1bx";
+    })
   ];
 
   buildInputs = [ gnutls gsasl libidn2 ]
diff --git a/pkgs/applications/networking/p2p/stig/default.nix b/pkgs/applications/networking/p2p/stig/default.nix
index 325dc653e5b4..6b1a7ace902a 100644
--- a/pkgs/applications/networking/p2p/stig/default.nix
+++ b/pkgs/applications/networking/p2p/stig/default.nix
@@ -1,9 +1,9 @@
 { lib
 , fetchFromGitHub
-, python3
+, python3Packages
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "stig";
   # This project has a different concept for pre release / alpha,
   # Read the project's README for details: https://github.com/rndusr/stig#stig
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
       --replace "urwidtrees>=1.0.3dev0" "urwidtrees"
   '';
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3Packages; [
     urwid
     urwidtrees
     aiohttp
@@ -38,17 +38,23 @@ python3.pkgs.buildPythonApplication rec {
     setproctitle
   ];
 
-  checkInputs = with python3.pkgs; [
+  checkInputs = with python3Packages; [
     asynctest
-    pytest
+    pytestCheckHook
   ];
 
-  # test_string__month_day_hour_minute_second fails on darwin
-  checkPhase = ''
-    LC_ALL=en_US.utf8 pytest tests \
-      --deselect=tests/client_test/ttypes_test.py::TestTimestamp::test_string__month_day_hour_minute_second
+  dontUseSetuptoolsCheck = true;
+
+  preCheck = ''
+    export LC_ALL=C
   '';
 
+  pytestFlagsArray = [
+    "tests"
+    # test_string__month_day_hour_minute_second fails on darwin
+    "--deselect=tests/client_test/ttypes_test.py::TestTimestamp::test_string__month_day_hour_minute_second"
+  ];
+
   meta = with lib; {
     description = "TUI and CLI for the BitTorrent client Transmission";
     homepage = "https://github.com/rndusr/stig";
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
index 8691335d1290..151d652de526 100644
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tixati";
-  version = "2.67";
+  version = "2.72";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "0510wkwmwrlv61958zd5nsc4lr0l0lka3jf4pq3dyiyfsf4k20rq";
+    sha256 = "04si7xwbpvljdbngmzlfvkn51wih3aqcb5g6r76wdh3pfpppskhr";
   };
 
   installPhase = ''