about summary refs log tree commit diff
path: root/pkgs/applications
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/applications')
-rw-r--r--pkgs/applications/audio/clementine/default.nix4
-rw-r--r--pkgs/applications/audio/dfasma/default.nix4
-rw-r--r--pkgs/applications/audio/iannix/default.nix4
-rw-r--r--pkgs/applications/audio/musikcube/default.nix56
-rw-r--r--pkgs/applications/audio/musikcube/dont-strip.patch14
-rw-r--r--pkgs/applications/audio/spotify-tui/default.nix6
-rw-r--r--pkgs/applications/audio/traverso/default.nix4
-rw-r--r--pkgs/applications/audio/x42-plugins/default.nix8
-rw-r--r--pkgs/applications/editors/emacs-modes/melpa-packages.nix120
-rw-r--r--pkgs/applications/editors/mindforger/default.nix4
-rw-r--r--pkgs/applications/editors/okteta/default.nix4
-rw-r--r--pkgs/applications/editors/typora/default.nix2
-rw-r--r--pkgs/applications/graphics/awesomebump/default.nix11
-rw-r--r--pkgs/applications/graphics/phototonic/default.nix4
-rw-r--r--pkgs/applications/graphics/qcomicbook/default.nix4
-rw-r--r--pkgs/applications/graphics/write_stylus/default.nix4
-rw-r--r--pkgs/applications/misc/bibletime/default.nix4
-rw-r--r--pkgs/applications/misc/candle/default.nix4
-rw-r--r--pkgs/applications/misc/fitnesstrax/default.nix43
-rw-r--r--pkgs/applications/misc/khal/default.nix7
-rw-r--r--pkgs/applications/misc/kitty/default.nix4
-rw-r--r--pkgs/applications/misc/lutris/default.nix5
-rw-r--r--pkgs/applications/misc/openbrf/default.nix4
-rw-r--r--pkgs/applications/misc/qt-box-editor/default.nix5
-rw-r--r--pkgs/applications/misc/valentina/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix94
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/common.nix361
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/default.nix205
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch26
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch61
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch17
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch11
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch74
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch13
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix93
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix6
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix42
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/update.nix271
-rwxr-xr-xpkgs/applications/networking/browsers/ungoogled-chromium/update.sh4
-rw-r--r--pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix18
-rw-r--r--pkgs/applications/networking/cluster/cni/plugins.nix2
-rw-r--r--pkgs/applications/networking/cluster/helm/default.nix4
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix6
-rw-r--r--pkgs/applications/networking/dnscontrol/deps.nix1236
-rw-r--r--pkgs/applications/networking/instant-messengers/rambox/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/ricochet/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/swift-im/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/tensor/default.nix4
-rw-r--r--pkgs/applications/networking/msmtp/default.nix7
-rw-r--r--pkgs/applications/networking/p2p/stig/default.nix24
-rw-r--r--pkgs/applications/networking/p2p/tixati/default.nix4
-rw-r--r--pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch84
-rw-r--r--pkgs/applications/office/elementary-planner/default.nix35
-rw-r--r--pkgs/applications/office/scribus/unstable.nix2
-rw-r--r--pkgs/applications/science/biology/quast/default.nix58
-rw-r--r--pkgs/applications/science/electronics/caneda/default.nix4
-rw-r--r--pkgs/applications/science/logic/verifast/default.nix2
-rw-r--r--pkgs/applications/science/misc/rink/default.nix2
-rw-r--r--pkgs/applications/science/misc/snakemake/default.nix2
-rw-r--r--pkgs/applications/science/robotics/mavproxy/default.nix4
-rw-r--r--pkgs/applications/version-management/arch/default.nix2
-rw-r--r--pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/gh/default.nix8
-rw-r--r--pkgs/applications/version-management/git-and-tools/git-gone/default.nix14
-rw-r--r--pkgs/applications/video/bomi/default.nix11
-rw-r--r--pkgs/applications/video/qmediathekview/default.nix4
-rw-r--r--pkgs/applications/video/qstopmotion/default.nix4
-rw-r--r--pkgs/applications/virtualization/aqemu/default.nix4
-rw-r--r--pkgs/applications/virtualization/cri-o/default.nix2
-rw-r--r--pkgs/applications/virtualization/crosvm/default.nix12
-rwxr-xr-xpkgs/applications/virtualization/crosvm/update.py2
-rw-r--r--pkgs/applications/virtualization/crosvm/upstream-info.json22
-rw-r--r--pkgs/applications/virtualization/podman/default.nix3
-rw-r--r--pkgs/applications/virtualization/virtualbox/default.nix14
-rw-r--r--pkgs/applications/virtualization/virtualbox/extpack.nix2
-rw-r--r--pkgs/applications/virtualization/virtualbox/guest-additions/default.nix2
-rwxr-xr-xpkgs/applications/virtualization/virtualbox/update.py85
-rwxr-xr-xpkgs/applications/virtualization/virtualbox/update.sh44
-rw-r--r--pkgs/applications/window-managers/sway/wrapper.nix2
81 files changed, 1817 insertions, 1551 deletions
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 4a32b099d15b..15d0f92b76aa 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -91,7 +91,7 @@ let
     '';
 
     meta = with stdenv.lib; {
-      homepage = "http://www.clementine-player.org";
+      homepage = "https://www.clementine-player.org";
       description = "A multiplatform music player";
       license = licenses.gpl3Plus;
       platforms = platforms.linux;
@@ -130,7 +130,7 @@ let
     '';
     enableParallelBuilding = true;
     meta = with stdenv.lib; {
-      homepage = "http://www.clementine-player.org";
+      homepage = "https://www.clementine-player.org";
       description = "Spotify integration for Clementine";
       # The blob itself is Apache-licensed, although libspotify is unfree.
       license = licenses.asl20;
diff --git a/pkgs/applications/audio/dfasma/default.nix b/pkgs/applications/audio/dfasma/default.nix
index 7965cbd83fdb..6df4679d1d5f 100644
--- a/pkgs/applications/audio/dfasma/default.nix
+++ b/pkgs/applications/audio/dfasma/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fftw, libsndfile, qtbase, qtmultimedia, qmake }:
+{ mkDerivation, stdenv, fetchFromGitHub, fftw, libsndfile, qtbase, qtmultimedia, qmake }:
 
 let
 
@@ -26,7 +26,7 @@ let
     };
   };
 
-in stdenv.mkDerivation rec {
+in mkDerivation rec {
   pname = "dfasma";
   version = "1.4.5";
 
diff --git a/pkgs/applications/audio/iannix/default.nix b/pkgs/applications/audio/iannix/default.nix
index 2d4a2e9265a3..fa779a7f0f4e 100644
--- a/pkgs/applications/audio/iannix/default.nix
+++ b/pkgs/applications/audio/iannix/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchFromGitHub, alsaLib, pkgconfig, qtbase, qtscript, qmake
+{ mkDerivation, stdenv, fetchFromGitHub, alsaLib, pkgconfig, qtbase, qtscript, qmake
 }:
 
-stdenv.mkDerivation {
+mkDerivation {
   pname = "iannix";
   version = "2016-01-31";
   src = fetchFromGitHub {
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
new file mode 100644
index 000000000000..0c076946b927
--- /dev/null
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -0,0 +1,56 @@
+{ cmake
+, pkg-config
+, alsaLib
+, boost
+, curl
+, fetchFromGitHub
+, ffmpeg
+, lame
+, libev
+, libmicrohttpd
+, ncurses
+, pulseaudio
+, stdenv
+, taglib
+, systemdSupport ? stdenv.isLinux, systemd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "musikcube";
+  version = "0.90.1";
+
+  src = fetchFromGitHub {
+    owner = "clangen";
+    repo = pname;
+    rev = version;
+    sha256 = "1ff2cgbllrl2pl5zfbf0cd9qbf6hqpwr395sa1k245ar4f1rfwpg";
+  };
+
+  # https://github.com/clangen/musikcube/issues/339
+  patches = [ ./dont-strip.patch ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+  buildInputs = [
+    alsaLib
+    boost
+    curl
+    ffmpeg
+    lame
+    libev
+    libmicrohttpd
+    ncurses
+    pulseaudio
+    taglib
+  ] ++ stdenv.lib.optional systemdSupport systemd;
+
+  meta = with stdenv.lib; {
+    description = "A fully functional terminal-based music player, library, and streaming audio server";
+    homepage = "https://musikcube.com/";
+    maintainers = [ maintainers.aanderse ];
+    license = licenses.bsd3;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/audio/musikcube/dont-strip.patch b/pkgs/applications/audio/musikcube/dont-strip.patch
new file mode 100644
index 000000000000..b7385dcddba9
--- /dev/null
+++ b/pkgs/applications/audio/musikcube/dont-strip.patch
@@ -0,0 +1,14 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index a3e02666..7c43c7e6 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -370,9 +370,3 @@ endif()
+ # they don't yet exist!
+ add_custom_target(postbuild ALL DEPENDS musikcube musikcubed)
+ add_custom_command(TARGET postbuild POST_BUILD COMMAND cmake .)
+-
+-# strip binaries in release mode
+-if (CMAKE_BUILD_TYPE MATCHES Release)
+-  message(STATUS "stripping binaries...")
+-  add_custom_command(TARGET postbuild POST_BUILD COMMAND "${CMAKE_SOURCE_DIR}/strip-nix.sh")
+-endif()
diff --git a/pkgs/applications/audio/spotify-tui/default.nix b/pkgs/applications/audio/spotify-tui/default.nix
index 5f9cf2720cda..d29e9e33568b 100644
--- a/pkgs/applications/audio/spotify-tui/default.nix
+++ b/pkgs/applications/audio/spotify-tui/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-tui";
-  version = "0.17.1";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "Rigellute";
     repo = "spotify-tui";
     rev = "v${version}";
-    sha256 = "1gsddjinxmglm05hhphclax08d9pig1f0wjjs3bbcq096fydxgfs";
+    sha256 = "15icg332iyacdn4ydr4nivblayg4xkcnjh4f0sjnhj4q173v8fq2";
   };
 
-  cargoSha256 = "1y398ypckk3gw1sfzf97xzwf5d5z3kxlcpn3bccmsfr59kvkf661";
+  cargoSha256 = "0rw8pj74k88rvcr18837g356lwsn2vdq384yma9df462xd2cw823";
 
   nativeBuildInputs = [ pkgconfig ] ++ stdenv.lib.optionals stdenv.isLinux [ python3 ];
   buildInputs = [ openssl ]
diff --git a/pkgs/applications/audio/traverso/default.nix b/pkgs/applications/audio/traverso/default.nix
index 504e6ae96447..63ba44bec35a 100644
--- a/pkgs/applications/audio/traverso/default.nix
+++ b/pkgs/applications/audio/traverso/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, cmake, pkgconfig
+{ mkDerivation, stdenv, fetchurl, cmake, pkgconfig
 , alsaLib, fftw, flac, lame, libjack2, libmad, libpulseaudio
 , libsamplerate, libsndfile, libvorbis, portaudio, qtbase, wavpack
 }:
-stdenv.mkDerivation {
+mkDerivation {
   pname = "traverso";
   version = "0.49.6";
 
diff --git a/pkgs/applications/audio/x42-plugins/default.nix b/pkgs/applications/audio/x42-plugins/default.nix
index 8ec53b0c66ad..20f87725f991 100644
--- a/pkgs/applications/audio/x42-plugins/default.nix
+++ b/pkgs/applications/audio/x42-plugins/default.nix
@@ -3,12 +3,12 @@
 , libGLU, lv2, gtk2, cairo, pango, fftwFloat, zita-convolver }:
 
 stdenv.mkDerivation rec {
-  version = "20200114";
+  version = "20200411";
   pname = "x42-plugins";
 
   src = fetchurl {
     url = "https://gareus.org/misc/x42-plugins/${pname}-${version}.tar.xz";
-    sha256 = "02f8wnsl9wg7pgf4sshr0hdjfjkwln870ffgjmb01nqk37v7hiyn";
+    sha256 = "0y6778l2zc80kvp31mqw3vkcyi7g613jxn3g3lxqfa31i617gh6j";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -26,8 +26,8 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     patchShebangs ./stepseq.lv2/gridgen.sh
-    patchShebangs ./matrixmixer.lv2/genttl.sh #TODO: remove at next update, see https://github.com/x42/matrixmixer.lv2/issues/2
-    patchShebangs ./matrixmixer.lv2/genhead.sh #TODO: remove at next update, see https://github.com/x42/matrixmixer.lv2/issues/2
+    patchShebangs ./matrixmixer.lv2/genttl.sh
+    patchShebangs ./matrixmixer.lv2/genhead.sh
     sed -i 's|/usr/include/zita-convolver.h|${zita-convolver}/include/zita-convolver.h|g' ./convoLV2/Makefile
   '';
 
diff --git a/pkgs/applications/editors/emacs-modes/melpa-packages.nix b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
index 5c9456b76a63..f5c77bd09fd0 100644
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@@ -164,12 +164,120 @@ env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPac
 
         ivy-rtags = fix-rtags super.ivy-rtags;
 
+        mandoku = super.mandoku.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        mandoku-tls = super.mandoku-tls.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
         magit = super.magit.overrideAttrs (attrs: {
           # searches for Git at build time
           nativeBuildInputs =
             (attrs.nativeBuildInputs or []) ++ [ external.git ];
         });
 
+        magit-circleci = super.magit-circleci.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-diff-flycheck = super.magit-diff-flycheck.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-find-file = super.magit-find-file.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-gh-pulls = super.magit-gh-pulls.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-imerge = super.magit-imerge.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-lfs = super.magit-lfs.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-org-todos = super.magit-org-todos.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-p4 = super.magit-p4.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-patch-changelog = super.magit-patch-changelog.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-rbr = super.magit-rbr.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-reviewboard = super.magit-reviewboard.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-stgit = super.magit-stgit.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-tbdiff = super.magit-tbdiff.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-topgit = super.magit-topgit.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-vcsh = super.magit-vcsh.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
+        magit-gerrit = super.magit-gerrit.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
         magit-annex = super.magit-annex.overrideAttrs (attrs: {
           # searches for Git at build time
           nativeBuildInputs =
@@ -206,12 +314,24 @@ env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPac
             (attrs.nativeBuildInputs or []) ++ [ external.git ];
         });
 
+        kapacitor = super.kapacitor.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
         kubernetes = super.kubernetes.overrideAttrs (attrs: {
           # searches for Git at build time
           nativeBuildInputs =
             (attrs.nativeBuildInputs or []) ++ [ external.git ];
         });
 
+        kubernetes-evil = super.kubernetes-evil.overrideAttrs (attrs: {
+          # searches for Git at build time
+          nativeBuildInputs =
+            (attrs.nativeBuildInputs or []) ++ [ external.git ];
+        });
+
         # upstream issue: missing file header
         mhc = super.mhc.override {
           inherit (self.melpaPackages) calfw;
diff --git a/pkgs/applications/editors/mindforger/default.nix b/pkgs/applications/editors/mindforger/default.nix
index 1397ea2d586d..82aa38c14499 100644
--- a/pkgs/applications/editors/mindforger/default.nix
+++ b/pkgs/applications/editors/mindforger/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, qmake, qtbase, qtwebkit }:
+{ mkDerivation, stdenv, fetchurl, qmake, qtbase, qtwebkit }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "mindforger";
   version = "1.48.2";
 
diff --git a/pkgs/applications/editors/okteta/default.nix b/pkgs/applications/editors/okteta/default.nix
index fa63ee90adc9..b9d92409198b 100644
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, extra-cmake-modules, kdoctools, qtscript, kconfig
+{ mkDerivation, stdenv, fetchurl, extra-cmake-modules, kdoctools, qtscript, kconfig
 , kinit, karchive, kcrash, kcmutils, kconfigwidgets, knewstuff, kparts
 , qca-qt5, shared-mime-info }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "okteta";
   version = "0.26.3";
 
diff --git a/pkgs/applications/editors/typora/default.nix b/pkgs/applications/editors/typora/default.nix
index bd183f97c126..583229eb8684 100644
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     description = "A minimal Markdown reading & writing app";
     homepage = "https://typora.io";
     license = licenses.unfree;
-    maintainers = with maintainers; [ jensbin worldofpeace ];
+    maintainers = with maintainers; [ jensbin ];
     platforms = [ "x86_64-linux"];
   };
 }
diff --git a/pkgs/applications/graphics/awesomebump/default.nix b/pkgs/applications/graphics/awesomebump/default.nix
index c02140e1905d..4d79f10a9e10 100644
--- a/pkgs/applications/graphics/awesomebump/default.nix
+++ b/pkgs/applications/graphics/awesomebump/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, qtbase, qmake, makeWrapper, qtscript, flex, bison, qtdeclarative }:
+{ mkDerivation, lib, fetchgit, qtbase, qmake, qtscript, flex, bison, qtdeclarative }:
 
 
 let
@@ -11,7 +11,7 @@ let
     fetchSubmodules = true;
   };
 
-  qtnproperty = stdenv.mkDerivation {
+  qtnproperty = mkDerivation {
     name = "qtnproperty";
     inherit src;
     sourceRoot = "AwesomeBump/Sources/utils/QtnProperty";
@@ -22,7 +22,7 @@ let
       install -D bin-linux/QtnPEG $out/bin/QtnPEG
     '';
   };
-in stdenv.mkDerivation {
+in mkDerivation {
   pname = "awesomebump";
   inherit version;
 
@@ -30,12 +30,13 @@ in stdenv.mkDerivation {
 
   buildInputs = [ qtbase qtscript qtdeclarative ];
 
-  nativeBuildInputs = [ qmake makeWrapper ];
+  nativeBuildInputs = [ qmake ];
 
   preBuild = ''
     ln -sf ${qtnproperty}/bin/QtnPEG Sources/utils/QtnProperty/bin-linux/QtnPEG
   '';
 
+  dontWrapQtApps = true;
   postInstall = ''
     d=$out/libexec/AwesomeBump
 
@@ -44,7 +45,7 @@ in stdenv.mkDerivation {
     cp -prd Bin/Configs Bin/Core $d/
 
     # AwesomeBump expects to find Core and Configs in its current directory.
-    makeWrapper $d/AwesomeBump $out/bin/AwesomeBump \
+    makeQtWrapper $d/AwesomeBump $out/bin/AwesomeBump \
         --run "cd $d"
   '';
 
diff --git a/pkgs/applications/graphics/phototonic/default.nix b/pkgs/applications/graphics/phototonic/default.nix
index 1c6c1b433547..7020bf6c83e6 100644
--- a/pkgs/applications/graphics/phototonic/default.nix
+++ b/pkgs/applications/graphics/phototonic/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, qtbase, qmake, exiv2 }:
+{ mkDerivation, stdenv, fetchFromGitHub, qtbase, qmake, exiv2 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "phototonic";
   version = "2.1";
 
diff --git a/pkgs/applications/graphics/qcomicbook/default.nix b/pkgs/applications/graphics/qcomicbook/default.nix
index 4f7e5b931f47..f9dc494b4b35 100644
--- a/pkgs/applications/graphics/qcomicbook/default.nix
+++ b/pkgs/applications/graphics/qcomicbook/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, pkgconfig, cmake, qtbase, qttools, qtx11extras, poppler }:
+{ mkDerivation, stdenv, fetchFromGitHub, pkgconfig, cmake, qtbase, qttools, qtx11extras, poppler }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "qcomicbook";
   version = "0.9.1";
 
diff --git a/pkgs/applications/graphics/write_stylus/default.nix b/pkgs/applications/graphics/write_stylus/default.nix
index b1bfbe3c4cf3..31fc40450265 100644
--- a/pkgs/applications/graphics/write_stylus/default.nix
+++ b/pkgs/applications/graphics/write_stylus/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, qtbase, qtsvg, libglvnd, fetchurl, makeDesktopItem }:
+{ mkDerivation, stdenv, lib, qtbase, qtsvg, libglvnd, fetchurl, makeDesktopItem }:
 let
   # taken from: https://www.iconfinder.com/icons/50835/edit_pencil_write_icon
   # license: Free for commercial use
@@ -7,7 +7,7 @@ let
     sha256 = "0abdya42yf9alxbsmc2nf8jwld50zfria6z3d4ncvp1zw2a9jhb8";
   };
 in
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "write_stylus";
   version = "209";
 
diff --git a/pkgs/applications/misc/bibletime/default.nix b/pkgs/applications/misc/bibletime/default.nix
index 9489bfa0016b..cfac79bef4bd 100644
--- a/pkgs/applications/misc/bibletime/default.nix
+++ b/pkgs/applications/misc/bibletime/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, cmake, pkgconfig, sword, boost, clucene_core
+{ mkDerivation, stdenv, fetchurl, cmake, pkgconfig, sword, boost, clucene_core
 , qtbase, qttools, qtsvg, qtwebkit
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
 
   version = "2.11.2";
 
diff --git a/pkgs/applications/misc/candle/default.nix b/pkgs/applications/misc/candle/default.nix
index a951046ce015..842ef2262d9f 100644
--- a/pkgs/applications/misc/candle/default.nix
+++ b/pkgs/applications/misc/candle/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, qtbase, qtserialport, qmake }:
+{ mkDerivation, stdenv, fetchFromGitHub, qtbase, qtserialport, qmake }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "candle";
   version = "1.1";
 
diff --git a/pkgs/applications/misc/fitnesstrax/default.nix b/pkgs/applications/misc/fitnesstrax/default.nix
new file mode 100644
index 000000000000..f0081c39102e
--- /dev/null
+++ b/pkgs/applications/misc/fitnesstrax/default.nix
@@ -0,0 +1,43 @@
+{ fetchFromGitHub
+, glib
+, gtk3
+, lib
+, rustPlatform
+, wrapGAppsHook
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fitnesstrax";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "luminescent-dreams";
+    repo = "fitnesstrax";
+    rev = "${pname}-${version}";
+    sha256 = "1k6zhnbs0ggx7q0ig2abcnzprsgrychlpvsh6d36dw6mr8zpfkp7";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+  ];
+
+  cargoSha256 = "1xgyyxd2kz21xan0pk7rbxiym90s7m2qrzg2ddilcszva60bxdd9";
+
+  postInstall = ''
+    mkdir -p $out/share/glib-2.0/schemas
+    cp -r $src/share/* $out/share/
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';
+
+  meta = with lib; {
+    description = "Privacy-first fitness tracking";
+    homepage = "https://github.com/luminescent-dreams/fitnesstrax";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ savannidgerinel ];
+  };
+}
diff --git a/pkgs/applications/misc/khal/default.nix b/pkgs/applications/misc/khal/default.nix
index ae9576e6cbc7..323fc501c842 100644
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@@ -41,6 +41,13 @@ with python3.pkgs; buildPythonApplication rec {
   checkInputs = [ pytest glibcLocales ];
   LC_ALL = "en_US.UTF-8";
 
+  postPatch = ''
+    sed -i \
+      -e "s/Invalid value for \"ics\"/Invalid value for \\\'ics\\\'/" \
+      -e "s/Invalid value for \"\[ICS\]\"/Invalid value for \\\'\[ICS\]\\\'/" \
+      tests/cli_test.py
+  '';
+
   postInstall = ''
     # zsh completion
     install -D misc/__khal $out/share/zsh/site-functions/__khal
diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
index d16822279206..90dd04c9d680 100644
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@@ -20,14 +20,14 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.17.2";
+  version = "0.17.3";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "v${version}";
-    sha256 = "0xiwz89ynhh8aj0c9jbqfsxf129hnzs0gz4bzcparnjisq2sh3cq";
+    sha256 = "1nx8gjavq8kc656ayh3wign1f68b46jbnmy8zyks25wg0p9gid8l";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/misc/lutris/default.nix b/pkgs/applications/misc/lutris/default.nix
index 297596b8e39c..2ff2a82dd4fb 100644
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@@ -1,5 +1,5 @@
 { buildPythonApplication, lib, fetchFromGitHub, fetchpatch
-, wrapGAppsHook, gobject-introspection, gnome-desktop, libnotify, libgnome-keyring, pango
+, wrapGAppsHook, gobject-introspection, glib-networking, gnome-desktop, libnotify, libgnome-keyring, pango
 , gdk-pixbuf, atk, webkitgtk, gst_all_1
 , dbus-python, evdev, pyyaml, pygobject3, requests, pillow
 , xrandr, pciutils, psmisc, glxinfo, vulkan-tools, xboxdrv, pulseaudio, p7zip, xgamma
@@ -40,8 +40,9 @@ in buildPythonApplication rec {
     sha256 = "1g093g0difnkjmnm91p20issdsxn9ri4c56zzddj5wfrbmhwdfag";
   };
 
+  nativeBuildInputs = [ wrapGAppsHook ];
   buildInputs = [
-    wrapGAppsHook gobject-introspection gnome-desktop libnotify libgnome-keyring pango
+    gobject-introspection glib-networking gnome-desktop libnotify libgnome-keyring pango
     gdk-pixbuf atk webkitgtk
   ] ++ gstDeps;
 
diff --git a/pkgs/applications/misc/openbrf/default.nix b/pkgs/applications/misc/openbrf/default.nix
index 6140343fae75..8e990b6dffba 100644
--- a/pkgs/applications/misc/openbrf/default.nix
+++ b/pkgs/applications/misc/openbrf/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchFromGitHub, qtbase, vcg, glew, qmake, libGLU, libGL }:
+{ mkDerivation, stdenv, fetchFromGitHub, qtbase, vcg, glew, qmake, libGLU, libGL }:
 
 
-stdenv.mkDerivation {
+mkDerivation {
   name = "openbrf-unstable-2016-01-09";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/misc/qt-box-editor/default.nix b/pkgs/applications/misc/qt-box-editor/default.nix
index c65e5377eb3b..852f0d30f9a5 100644
--- a/pkgs/applications/misc/qt-box-editor/default.nix
+++ b/pkgs/applications/misc/qt-box-editor/default.nix
@@ -1,4 +1,5 @@
-{ stdenv
+{ mkDerivation
+, stdenv
 , fetchFromGitHub
 , qtbase
 , qtsvg
@@ -7,7 +8,7 @@
 , tesseract
 }:
 
-stdenv.mkDerivation {
+mkDerivation {
   pname = "qt-box-editor";
   version = "unstable-2019-07-12";
 
diff --git a/pkgs/applications/misc/valentina/default.nix b/pkgs/applications/misc/valentina/default.nix
index 6a1dd06de32c..e9e8cfed796a 100644
--- a/pkgs/applications/misc/valentina/default.nix
+++ b/pkgs/applications/misc/valentina/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchhg
+{ mkDerivation, stdenv, fetchhg
 , qmake, qttools
 , qtbase, qtsvg, qtxmlpatterns
 , poppler_utils
@@ -6,7 +6,7 @@
 
 with stdenv.lib;
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "valentina";
   version = "0.6.1";
 
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix
new file mode 100644
index 000000000000..87248013a9af
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix
@@ -0,0 +1,94 @@
+{ stdenv, mkChromiumDerivation, channel, enableWideVine }:
+
+with stdenv.lib;
+
+mkChromiumDerivation (base: rec {
+  name = "chromium-browser";
+  packageName = "chromium";
+  buildTargets = [ "mksnapshot" "chrome_sandbox" "chrome" ];
+
+  outputs = ["out" "sandbox"];
+
+  sandboxExecutableName = "__chromium-suid-sandbox";
+
+  installPhase = ''
+    mkdir -p "$libExecPath"
+    cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
+    cp -v "$buildPath/icudtl.dat" "$libExecPath/"
+    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
+    cp -v "$buildPath/chrome" "$libExecPath/$packageName"
+
+    # Swiftshader
+    # See https://stackoverflow.com/a/4264351/263061 for the find invocation.
+    if [ -n "$(find "$buildPath/swiftshader/" -maxdepth 1 -name '*.so' -print -quit)" ]; then
+      echo "Swiftshader files found; installing"
+      mkdir -p "$libExecPath/swiftshader"
+      cp -v "$buildPath/swiftshader/"*.so "$libExecPath/swiftshader/"
+    else
+      echo "Swiftshader files not found"
+    fi
+
+    mkdir -p "$sandbox/bin"
+    cp -v "$buildPath/chrome_sandbox" "$sandbox/bin/${sandboxExecutableName}"
+
+    mkdir -vp "$out/share/man/man1"
+    cp -v "$buildPath/chrome.1" "$out/share/man/man1/$packageName.1"
+
+    for icon_file in chrome/app/theme/chromium/product_logo_*[0-9].png; do
+      num_and_suffix="''${icon_file##*logo_}"
+      icon_size="''${num_and_suffix%.*}"
+      expr "$icon_size" : "^[0-9][0-9]*$" || continue
+      logo_output_prefix="$out/share/icons/hicolor"
+      logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
+      mkdir -vp "$logo_output_path"
+      cp -v "$icon_file" "$logo_output_path/$packageName.png"
+    done
+
+    # Install Desktop Entry
+    install -D chrome/installer/linux/common/desktop.template \
+      $out/share/applications/chromium-browser.desktop
+
+    substituteInPlace $out/share/applications/chromium-browser.desktop \
+      --replace "@@MENUNAME@@" "Chromium" \
+      --replace "@@PACKAGE@@" "chromium" \
+      --replace "Exec=/usr/bin/@@USR_BIN_SYMLINK_NAME@@" "Exec=chromium"
+
+    # Append more mime types to the end
+    sed -i '/^MimeType=/ s,$,x-scheme-handler/webcal;x-scheme-handler/mailto;x-scheme-handler/about;x-scheme-handler/unknown,' \
+      $out/share/applications/chromium-browser.desktop
+
+    # See https://github.com/NixOS/nixpkgs/issues/12433
+    sed -i \
+      -e '/\[Desktop Entry\]/a\' \
+      -e 'StartupWMClass=chromium-browser' \
+      $out/share/applications/chromium-browser.desktop
+  '';
+
+  passthru = { inherit sandboxExecutableName; };
+
+  requiredSystemFeatures = [ "big-parallel" ];
+
+  meta = {
+    description = "An open source web browser from Google, with dependencies on Google web services removed";
+    longDescription = ''
+      Chromium is an open source web browser from Google that aims to build a
+      safer, faster, and more stable way for all Internet users to experience
+      the web. It has a minimalist user interface and provides the vast majority
+      of source code for Google Chrome (which has some additional features).
+    '';
+    homepage = https://github.com/Eloston/ungoogled-chromium;
+    maintainers = with maintainers; [ squalus ];
+    # Overview of the maintainer roles:
+    # nixos-unstable:
+    # - TODO: Need a new maintainer for x86_64 [0]
+    # - @thefloweringash: aarch64
+    # - @primeos: Provisional maintainer (x86_64)
+    # Stable channel:
+    # - TODO (need someone to test backports [0])
+    # [0]: https://github.com/NixOS/nixpkgs/issues/78450
+    license = if enableWideVine then licenses.unfree else licenses.bsd3;
+    platforms = platforms.linux;
+    hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
+    timeout = 172800; # 48 hours
+  };
+})
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
new file mode 100644
index 000000000000..d07da2b3b07a
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@@ -0,0 +1,361 @@
+{ stdenv, llvmPackages, gnChromium, ninja, which, nodejs, fetchpatch, gnutar
+
+# default dependencies
+, bzip2, flac, speex, libopus
+, libevent, expat, libjpeg, snappy
+, libpng, libcap
+, xdg_utils, yasm, minizip, libwebp
+, libusb1, pciutils, nss, re2, zlib
+
+, python2Packages, perl, pkgconfig
+, nspr, systemd, kerberos
+, utillinux, alsaLib
+, bison, gperf
+, glib, gtk3, dbus-glib
+, glibc
+, libXScrnSaver, libXcursor, libXtst, libGLU, libGL
+, protobuf, speechd, libXdamage, cups
+, ffmpeg, libxslt, libxml2, at-spi2-core
+, jre
+
+# optional dependencies
+, libgcrypt ? null # gnomeSupport || cupsSupport
+, libva ? null # useVaapi
+, libdrm ? null, wayland ? null, mesa_drivers ? null, libxkbcommon ? null # useOzone
+
+# package customization
+, useVaapi ? false
+, useOzone ? false
+, gnomeSupport ? false, gnome ? null
+, gnomeKeyringSupport ? false, libgnome-keyring3 ? null
+, proprietaryCodecs ? true
+, cupsSupport ? true
+, pulseSupport ? false, libpulseaudio ? null
+, ungoogled-chromium
+, ungoogled ? false
+
+, upstream-info
+}:
+
+buildFun:
+
+with stdenv.lib;
+
+# see http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html
+
+let
+  # The additional attributes for creating derivations based on the chromium
+  # source tree.
+  extraAttrs = buildFun base;
+
+  githubPatch = commit: sha256: fetchpatch {
+    url = "https://github.com/chromium/chromium/commit/${commit}.patch";
+    inherit sha256;
+  };
+
+  mkGnFlags =
+    let
+      # Serialize Nix types into GN types according to this document:
+      # https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/language.md
+      mkGnString = value: "\"${escape ["\"" "$" "\\"] value}\"";
+      sanitize = value:
+        if value == true then "true"
+        else if value == false then "false"
+        else if isList value then "[${concatMapStringsSep ", " sanitize value}]"
+        else if isInt value then toString value
+        else if isString value then mkGnString value
+        else throw "Unsupported type for GN value `${value}'.";
+      toFlag = key: value: "${key}=${sanitize value}";
+    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
+
+  gnSystemLibraries = [
+    "flac" "libwebp" "libxslt" "yasm" "opus" "snappy" "libpng"
+    # "zlib" # version 77 reports unresolved dependency on //third_party/zlib:zlib_config
+    # "libjpeg" # fails with multiple undefined references to chromium_jpeg_*
+    # "re2" # fails with linker errors
+    # "ffmpeg" # https://crbug.com/731766
+    # "harfbuzz-ng" # in versions over 63 harfbuzz and freetype are being built together
+                    # so we can't build with one from system and other from source
+  ];
+
+  opusWithCustomModes = libopus.override {
+    withCustomModes = true;
+  };
+
+  defaultDependencies = [
+    bzip2 flac speex opusWithCustomModes
+    libevent expat libjpeg snappy
+    libpng libcap
+    xdg_utils yasm minizip libwebp
+    libusb1 re2 zlib
+    ffmpeg libxslt libxml2
+    # harfbuzz # in versions over 63 harfbuzz and freetype are being built together
+               # so we can't build with one from system and other from source
+  ];
+
+  # build paths and release info
+  packageName = extraAttrs.packageName or extraAttrs.name;
+  buildType = "Release";
+  buildPath = "out/${buildType}";
+  libExecPath = "$out/libexec/${packageName}";
+
+  versionRange = min-version: upto-version:
+    let inherit (upstream-info) version;
+        result = versionAtLeast version min-version && versionOlder version upto-version;
+        stable-version = (import ./upstream-info.nix).stable.version;
+    in if versionAtLeast stable-version upto-version
+       then warn "chromium: stable version ${stable-version} is newer than a patchset bounded at ${upto-version}. You can safely delete it."
+            result
+       else result;
+
+  ungoogler =
+    let versionEntry = (import ./ungoogled-src.nix)."${upstream-info.version}";
+    in ungoogled-chromium {
+      inherit (versionEntry) rev sha256;
+    };
+  base = rec {
+    name = "${packageName}-unwrapped-${version}";
+    inherit (upstream-info) channel version;
+    inherit packageName buildType buildPath;
+
+    src = upstream-info.main;
+
+    nativeBuildInputs = [
+      ninja which python2Packages.python perl pkgconfig
+      python2Packages.ply python2Packages.jinja2 nodejs
+      gnutar
+    ] ++ optional (versionAtLeast version "83") python2Packages.setuptools;
+
+    buildInputs = defaultDependencies ++ [
+      nspr nss systemd
+      utillinux alsaLib
+      bison gperf kerberos
+      glib gtk3 dbus-glib
+      libXScrnSaver libXcursor libXtst libGLU libGL
+      pciutils protobuf speechd libXdamage at-spi2-core
+      jre
+    ] ++ optional gnomeKeyringSupport libgnome-keyring3
+      ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
+      ++ optionals cupsSupport [ libgcrypt cups ]
+      ++ optional useVaapi libva
+      ++ optional pulseSupport libpulseaudio
+      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
+
+    patches = [
+      ./patches/nix_plugin_paths_68.patch
+      ./patches/remove-webp-include-69.patch
+      ./patches/no-build-timestamps.patch
+      ./patches/widevine-79.patch
+      ./patches/dont-use-ANGLE-by-default.patch
+      # Unfortunately, chromium regularly breaks on major updates and
+      # then needs various patches backported in order to be compiled with GCC.
+      # Good sources for such patches and other hints:
+      # - https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
+      # - https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
+      # - https://github.com/chromium/chromium/search?q=GCC&s=committer-date&type=Commits
+      #
+      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
+      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
+    ] ++ optionals (useVaapi) ([
+      # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi
+      ./patches/vaapi-fix.patch
+    ] ++ optionals (versionRange "81" "82") [
+      (githubPatch "5b2ff215473e0526b5b24aeff4ad90d369b21c75" "0n00vh8wfpn2ay5fqsxcsx0zadnv7mihm72bcvnrfzh75nzbg902")
+      (githubPatch "98e343ab369e4262511b5fce547728e3e5eefba8" "00wwp653jk0k0yvix00vr7ymgck9dj7fxjwx4nc67ynn84dh6064")
+    ]);
+
+    postPatch = ''
+      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
+      substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
+        --replace \
+          'return sandbox_binary;' \
+          'return base::FilePath(GetDevelSandboxPath());'
+
+      substituteInPlace services/audio/audio_sandbox_hook_linux.cc \
+        --replace \
+          '/usr/share/alsa/' \
+          '${alsaLib}/share/alsa/' \
+        --replace \
+          '/usr/lib/x86_64-linux-gnu/gconv/' \
+          '${glibc}/lib/gconv/' \
+        --replace \
+          '/usr/share/locale/' \
+          '${glibc}/share/locale/'
+
+      sed -i -e 's@"\(#!\)\?.*xdg-@"\1${xdg_utils}/bin/xdg-@' \
+        chrome/browser/shell_integration_linux.cc
+
+      sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${systemd.lib}/lib/\1!' \
+        device/udev_linux/udev?_loader.cc
+
+      sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
+        gpu/config/gpu_info_collector_linux.cc
+
+      sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \
+        chrome/browser/ui/webui/engagement/site_engagement_ui.cc
+
+      sed -i -e '/#include/ {
+        i #include <algorithm>
+        :l; n; bl
+      }' gpu/config/gpu_control_list.cc
+
+      # Allow to put extensions into the system-path.
+      sed -i -e 's,/usr,/run/current-system/sw,' chrome/common/chrome_paths.cc
+
+      patchShebangs .
+      # use our own nodejs
+      mkdir -p third_party/node/linux/node-linux-x64/bin
+      ln -s $(which node) third_party/node/linux/node-linux-x64/bin/node
+
+      # remove unused third-party
+      # in third_party/crashpad third_party/zlib contains just a header-adapter
+      for lib in ${toString gnSystemLibraries}; do
+        find -type f -path "*third_party/$lib/*"     \
+            \! -path "*third_party/crashpad/crashpad/third_party/zlib/*"  \
+            \! -path "*third_party/$lib/chromium/*"  \
+            \! -path "*third_party/$lib/google/*"    \
+            \! -path "*base/third_party/icu/*"       \
+            \! -path "*base/third_party/libevent/*"  \
+            \! -regex '.*\.\(gn\|gni\|isolate\|py\)' \
+            -delete
+      done
+    '' + optionalString stdenv.isAarch64 ''
+      substituteInPlace build/toolchain/linux/BUILD.gn \
+        --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+    '' + optionalString stdenv.cc.isClang ''
+      mkdir -p third_party/llvm-build/Release+Asserts/bin
+      ln -s ${stdenv.cc}/bin/clang              third_party/llvm-build/Release+Asserts/bin/clang
+      ln -s ${stdenv.cc}/bin/clang++            third_party/llvm-build/Release+Asserts/bin/clang++
+      ln -s ${llvmPackages.llvm}/bin/llvm-ar    third_party/llvm-build/Release+Asserts/bin/llvm-ar
+    '' + optionalString ungoogled ''
+      ${ungoogler}/utils/prune_binaries.py . ${ungoogler}/pruning.list || echo "some errors"
+      ${ungoogler}/utils/patches.py . ${ungoogler}/patches
+      ${ungoogler}/utils/domain_substitution.py apply -r ${ungoogler}/domain_regex.list -f ${ungoogler}/domain_substitution.list -c ./ungoogled-domsubcache.tar.gz .
+    '';
+
+    gnFlags = mkGnFlags ({
+      linux_use_bundled_binutils = false;
+      use_lld = false;
+      use_gold = true;
+      gold_path = "${stdenv.cc}/bin";
+      is_debug = false;
+
+      proprietary_codecs = false;
+      use_sysroot = false;
+      use_gnome_keyring = gnomeKeyringSupport;
+      use_gio = gnomeSupport;
+      # ninja: error: '../../native_client/toolchain/linux_x86/pnacl_newlib/bin/x86_64-nacl-objcopy',
+      # needed by 'nacl_irt_x86_64.nexe', missing and no known rule to make it
+      enable_nacl = false;
+      # Enabling the Widevine component here doesn't affect whether we can
+      # redistribute the chromium package; the Widevine component is either
+      # added later in the wrapped -wv build or downloaded from Google.
+      enable_widevine = true;
+      use_cups = cupsSupport;
+
+      treat_warnings_as_errors = false;
+      is_clang = stdenv.cc.isClang;
+      clang_use_chrome_plugins = false;
+      blink_symbol_level = 0;
+      fieldtrial_testing_like_official_build = true;
+
+      # Google API keys, see:
+      #   http://www.chromium.org/developers/how-tos/api-keys
+      # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
+      # please get your own set of keys.
+      google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
+      google_default_client_id = "404761575300.apps.googleusercontent.com";
+      google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
+    } // optionalAttrs proprietaryCodecs {
+      # enable support for the H.264 codec
+      proprietary_codecs = true;
+      enable_hangout_services_extension = true;
+      ffmpeg_branding = "Chrome";
+    } // optionalAttrs useVaapi {
+      use_vaapi = true;
+    } // optionalAttrs pulseSupport {
+      use_pulseaudio = true;
+      link_pulseaudio = true;
+    } // optionalAttrs useOzone {
+      use_ozone = true;
+      ozone_platform_gbm = false;
+      use_xkbcommon = true;
+      use_glib = true;
+      use_gtk = true;
+      use_system_libwayland = true;
+      use_system_minigbm = true;
+      use_system_libdrm = true;
+      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
+    } // optionalAttrs ungoogled {
+      closure_compile = false;
+      enable_hangout_services_extension = false;
+      enable_mdns = false;
+      enable_nacl_nonsfi = false;
+      enable_one_click_signin = false;
+      enable_reading_list = false;
+      enable_remoting = false;
+      enable_reporting = false;
+      enable_service_discovery = false;
+      exclude_unwind_tables = true;
+      google_api_key = "";
+      google_default_client_id = "";
+      google_default_client_secret = "";
+      optimize_webui = false;
+      safe_browsing_mode = 0;
+      use_official_google_api_keys = false;
+      use_unofficial_version_number = false;
+    } // (extraAttrs.gnFlags or {}));
+
+    configurePhase = ''
+      runHook preConfigure
+
+      # This is to ensure expansion of $out.
+      libExecPath="${libExecPath}"
+      python build/linux/unbundle/replace_gn_files.py \
+        --system-libraries ${toString gnSystemLibraries}
+      ${gnChromium}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
+
+      # Fail if `gn gen` contains a WARNING.
+      grep -o WARNING gn-gen-outputs.txt && echo "Found gn WARNING, exiting nix build" && exit 1
+
+      runHook postConfigure
+    '';
+
+    # Don't spam warnings about unknown warning options. This is useful because
+    # our Clang is always older than Chromium's and the build logs have a size
+    # of approx. 25 MB without this option (and this saves e.g. 66 %).
+    NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option";
+
+    buildPhase = let
+      # Build paralelism: on Hydra the build was frequently running into memory
+      # exhaustion, and even other users might be running into similar issues.
+      # -j is halved to avoid memory problems, and -l is slightly increased
+      # so that the build gets slight preference before others
+      # (it will often be on "critical path" and at risk of timing out)
+      buildCommand = target: ''
+        ninja -C "${buildPath}"  \
+          -j$(( ($NIX_BUILD_CORES+1) / 2 )) -l$(( $NIX_BUILD_CORES+1 )) \
+          "${target}"
+        (
+          source chrome/installer/linux/common/installer.include
+          PACKAGE=$packageName
+          MENUNAME="Chromium"
+          process_template chrome/app/resources/manpage.1.in "${buildPath}/chrome.1"
+        )
+      '';
+      targets = extraAttrs.buildTargets or [];
+      commands = map buildCommand targets;
+    in concatStringsSep "\n" commands;
+
+    postFixup = ''
+      # Make sure that libGLESv2 is found by dlopen (if using EGL).
+      chromiumBinary="$libExecPath/$packageName"
+      origRpath="$(patchelf --print-rpath "$chromiumBinary")"
+      patchelf --set-rpath "${libGL}/lib:$origRpath" "$chromiumBinary"
+    '';
+  };
+
+# Remove some extraAttrs we supplied to the base attributes already.
+in stdenv.mkDerivation (base // removeAttrs extraAttrs [
+  "name" "gnFlags" "buildTargets"
+])
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
new file mode 100644
index 000000000000..f172e7c09ce2
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
@@ -0,0 +1,205 @@
+{ newScope, config, stdenv, llvmPackages_9, llvmPackages_10
+, makeWrapper, ed
+, glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
+, libva ? null
+, gcc, nspr, nss, patchelfUnstable, runCommand
+, lib
+
+# package customization
+, channel ? "stable"
+, gnomeSupport ? false, gnome ? null
+, gnomeKeyringSupport ? false
+, proprietaryCodecs ? true
+, enablePepperFlash ? false
+, enableWideVine ? false
+, ungoogled ? true
+, useVaapi ? false # test video on radeon, before enabling this
+, useOzone ? false
+, cupsSupport ? true
+, pulseSupport ? config.pulseaudio or stdenv.isLinux
+, commandLineArgs ? ""
+}:
+
+let
+  llvmPackages = if channel == "dev"
+    then llvmPackages_10
+    else llvmPackages_9;
+  stdenv = llvmPackages.stdenv;
+
+  callPackage = newScope chromium;
+
+  chromium = {
+    inherit stdenv llvmPackages;
+
+    upstream-info = (callPackage ./update.nix {}).getChannel channel;
+
+    mkChromiumDerivation = callPackage ./common.nix ({
+      inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useVaapi useOzone ungoogled;
+      gnChromium = gn;
+    } // lib.optionalAttrs (channel == "dev") {
+      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
+      gnChromium = gn.overrideAttrs (oldAttrs: {
+        version = "2020-03-23";
+        src = fetchgit {
+          url = "https://gn.googlesource.com/gn";
+          rev = "5ed3c9cc67b090d5e311e4bd2aba072173e82db9";
+          sha256 = "00y2d35wvqmx9glaqhfb62wdgbfpwr77v0934nnvh9ks71vnsjqy";
+        };
+      });
+    });
+
+    browser = callPackage ./browser.nix { inherit channel enableWideVine; };
+
+    plugins = callPackage ./plugins.nix {
+      inherit enablePepperFlash;
+    };
+
+    ungoogled-chromium = callPackage ./ungoogled.nix {};
+  };
+
+  mkrpath = p: "${lib.makeSearchPathOutput "lib" "lib64" p}:${lib.makeLibraryPath p}";
+  widevineCdm = let upstream-info = chromium.upstream-info; in stdenv.mkDerivation {
+    name = "chrome-widevine-cdm";
+
+    # The .deb file for Google Chrome
+    src = upstream-info.binary;
+
+    nativeBuildInputs = [ patchelfUnstable ];
+
+    phases = [ "unpackPhase" "patchPhase" "installPhase" "checkPhase" ];
+
+    unpackCmd = let
+      widevineCdmPath =
+        if upstream-info.channel == "stable" then
+          "./opt/google/chrome/WidevineCdm"
+        else if upstream-info.channel == "beta" then
+          "./opt/google/chrome-beta/WidevineCdm"
+        else if upstream-info.channel == "dev" then
+          "./opt/google/chrome-unstable/WidevineCdm"
+        else
+          throw "Unknown chromium channel.";
+    in ''
+      # Extract just WidevineCdm from upstream's .deb file
+      ar p "$src" data.tar.xz | tar xJ "${widevineCdmPath}"
+
+      # Move things around so that we don't have to reference a particular
+      # chrome-* directory later.
+      mv "${widevineCdmPath}" ./
+
+      # unpackCmd wants a single output directory; let it take WidevineCdm/
+      rm -rf opt
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    PATCH_RPATH = mkrpath [ gcc.cc glib nspr nss ];
+
+    patchPhase = ''
+      patchelf --set-rpath "$PATCH_RPATH" _platform_specific/linux_x64/libwidevinecdm.so
+    '';
+
+    installPhase = ''
+      mkdir -p $out/WidevineCdm
+      cp -a * $out/WidevineCdm/
+    '';
+
+    meta = {
+      platforms = [ "x86_64-linux" ];
+      license = lib.licenses.unfree;
+    };
+  };
+
+  suffix = if channel != "stable" then "-" + channel else "";
+
+  sandboxExecutableName = chromium.browser.passthru.sandboxExecutableName;
+
+  version = chromium.browser.version;
+
+  # We want users to be able to enableWideVine without rebuilding all of
+  # chromium, so we have a separate derivation here that copies chromium
+  # and adds the unfree WidevineCdm.
+  chromiumWV = let browser = chromium.browser; in if enableWideVine then
+    runCommand (browser.name + "-wv") { version = browser.version; }
+      ''
+        mkdir -p $out
+        cp -a ${browser}/* $out/
+        chmod u+w $out/libexec/chromium
+        cp -a ${widevineCdm}/WidevineCdm $out/libexec/chromium/
+      ''
+    else browser;
+in stdenv.mkDerivation {
+  name = "chromium${suffix}-${version}";
+  inherit version;
+
+  buildInputs = [
+    makeWrapper ed
+
+    # needed for GSETTINGS_SCHEMAS_PATH
+    gsettings-desktop-schemas glib gtk3
+
+    # needed for XDG_ICON_DIRS
+    gnome3.adwaita-icon-theme
+  ];
+
+  outputs = ["out" "sandbox"];
+
+  buildCommand = let
+    browserBinary = "${chromiumWV}/libexec/chromium/chromium";
+    getWrapperFlags = plugin: "$(< \"${plugin}/nix-support/wrapper-flags\")";
+    libPath = stdenv.lib.makeLibraryPath ([]
+      ++ stdenv.lib.optional useVaapi libva
+    );
+
+  in with stdenv.lib; ''
+    mkdir -p "$out/bin"
+
+    eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
+      --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)} \
+      ${concatMapStringsSep " " getWrapperFlags chromium.plugins.enabled}
+
+    ed -v -s "$out/bin/chromium" << EOF
+    2i
+
+    if [ -x "/run/wrappers/bin/${sandboxExecutableName}" ]
+    then
+      export CHROME_DEVEL_SANDBOX="/run/wrappers/bin/${sandboxExecutableName}"
+    else
+      export CHROME_DEVEL_SANDBOX="$sandbox/bin/${sandboxExecutableName}"
+    fi
+
+  '' + lib.optionalString (libPath != "") ''
+    # To avoid loading .so files from cwd, LD_LIBRARY_PATH here must not
+    # contain an empty section before or after a colon.
+    export LD_LIBRARY_PATH="\$LD_LIBRARY_PATH\''${LD_LIBRARY_PATH:+:}${libPath}"
+  '' + ''
+
+    # libredirect causes chromium to deadlock on startup
+    export LD_PRELOAD="\$(echo -n "\$LD_PRELOAD" | tr ':' '\n' | grep -v /lib/libredirect\\\\.so$ | tr '\n' ':')"
+
+    export XDG_DATA_DIRS=$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH\''${XDG_DATA_DIRS:+:}\$XDG_DATA_DIRS
+
+    .
+    w
+    EOF
+
+    ln -sv "${chromium.browser.sandbox}" "$sandbox"
+
+    ln -s "$out/bin/chromium" "$out/bin/chromium-browser"
+
+    mkdir -p "$out/share"
+    for f in '${chromium.browser}'/share/*; do # hello emacs */
+      ln -s -t "$out/share/" "$f"
+    done
+  '';
+
+  inherit (chromium.browser) packageName;
+  meta = chromium.browser.meta;
+  passthru = {
+    inherit (chromium) upstream-info browser;
+    mkDerivation = chromium.mkChromiumDerivation;
+    inherit sandboxExecutableName;
+  };
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch
new file mode 100644
index 000000000000..9f14a304eb34
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch
@@ -0,0 +1,26 @@
+A field trial currently enables the passthrough command decoder, which causes
+gl_factory.cc to try kGLImplementationEGLANGLE first, which causes Chromium to fail
+to load libGLESv2.so on NixOS.  It somehow does not try kGLImplementationDesktopGL,
+and so there is no GL support at all.
+
+Revert to using the validating command decoder, which prevents gl_factory.cc
+from touching allowed_impls, allowing it to successfully use kGLImplementationDesktopGL.
+
+diff --git a/ui/gl/gl_utils.cc b/ui/gl/gl_utils.cc
+index 697cbed5fe2d..8419bdb21a2f 100644
+--- a/ui/gl/gl_utils.cc
++++ b/ui/gl/gl_utils.cc
+@@ -71,9 +71,10 @@ bool UsePassthroughCommandDecoder(const base::CommandLine* command_line) {
+   } else if (switch_value == kCmdDecoderValidatingName) {
+     return false;
+   } else {
+-    // Unrecognized or missing switch, use the default.
+-    return base::FeatureList::IsEnabled(
+-        features::kDefaultPassthroughCommandDecoder);
++    // Ignore the field trial that enables it; disable it until
++    // gl_factory.cc kGLImplementationEGLANGLE issues are sorted
++    // out on NixOS.
++    return false;
+   }
+ }
+ }
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch
new file mode 100644
index 000000000000..da6a4c92b460
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch
@@ -0,0 +1,61 @@
+diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
+index f4e119d..d9775bd 100644
+--- a/chrome/common/chrome_paths.cc
++++ b/chrome/common/chrome_paths.cc
+@@ -68,21 +68,14 @@ static base::LazyInstance<base::FilePath>
+     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
+ 
+ // Gets the path for internal plugins.
+-bool GetInternalPluginsDirectory(base::FilePath* result) {
+-#if defined(OS_MACOSX)
+-  // If called from Chrome, get internal plugins from a subdirectory of the
+-  // framework.
+-  if (base::mac::AmIBundled()) {
+-    *result = chrome::GetFrameworkBundlePath();
+-    DCHECK(!result->empty());
+-    *result = result->Append("Internet Plug-Ins");
+-    return true;
+-  }
+-  // In tests, just look in the module directory (below).
+-#endif
+-
+-  // The rest of the world expects plugins in the module directory.
+-  return base::PathService::Get(base::DIR_MODULE, result);
++bool GetInternalPluginsDirectory(base::FilePath* result,
++                                 const std::string& ident) {
++  std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident;
++  const char* value = getenv(full_env.c_str());
++  if (value == NULL)
++      return base::PathService::Get(base::DIR_MODULE, result);
++  else
++      *result = base::FilePath(value);
+ }
+ 
+ // Gets the path for bundled implementations of components. Note that these
+@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) {
+       create_dir = true;
+       break;
+     case chrome::DIR_INTERNAL_PLUGINS:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "ALL"))
+         return false;
+       break;
+     case chrome::DIR_COMPONENTS:
+@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) {
+         return false;
+       break;
+     case chrome::DIR_PEPPER_FLASH_PLUGIN:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH"))
+         return false;
+       cur = cur.Append(kPepperFlashBaseDirectory);
+       break;
+@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
+         cur = cur.DirName();
+       }
+ #else
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "PNACL"))
+         return false;
+ #endif
+       cur = cur.Append(FILE_PATH_LITERAL("pnacl"));
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch
new file mode 100644
index 000000000000..6b788f43d29c
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/no-build-timestamps.patch
@@ -0,0 +1,17 @@
+--- chromium-70.0.3538.67/build/compute_build_timestamp.py.orig	2018-11-02 16:00:34.368933077 +0200
++++ chromium-70.0.3538.67/build/compute_build_timestamp.py	2018-11-08 04:06:21.658105129 +0200
+@@ -94,6 +94,14 @@
+       'build_type', help='The type of build', choices=('official', 'default'))
+   args = argument_parser.parse_args()
+ 
++  # I don't trust LASTCHANGE magic, and I definelly want something deterministic here
++  SOURCE_DATE_EPOCH = os.getenv("SOURCE_DATE_EPOCH", None)
++  if SOURCE_DATE_EPOCH is not None:
++    print(SOURCE_DATE_EPOCH)
++    return 0
++  else:
++    raise RuntimeError("SOURCE_DATE_EPOCH not set")
++
+   # The mtime of the revision in build/util/LASTCHANGE is stored in a file
+   # next to it. Read it, to get a deterministic time close to "now".
+   # That date is then modified as described at the top of the file so that
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch
new file mode 100644
index 000000000000..07572cf7ee94
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch
@@ -0,0 +1,11 @@
+--- a/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
++++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
+@@ -13,7 +13,7 @@
+
+ #include "jpeglib.h"  // for JPEG_MAX_DIMENSION
+
+-#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
++#define WEBP_MAX_DIMENSION 16383
+
+ namespace blink {
+
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch
new file mode 100644
index 000000000000..b5372d1a2556
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/vaapi-fix.patch
@@ -0,0 +1,74 @@
+--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
++++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
+@@ -641,6 +641,7 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
+   // |vpp_vaapi_wrapper_| for VaapiPicture to DownloadFromSurface() the VA's
+   // internal decoded frame.
+   if (buffer_allocation_mode_ != BufferAllocationMode::kNone &&
++      buffer_allocation_mode_ != BufferAllocationMode::kWrapVdpau &&
+       !vpp_vaapi_wrapper_) {
+     vpp_vaapi_wrapper_ = VaapiWrapper::Create(
+         VaapiWrapper::kVideoProcess, VAProfileNone,
+@@ -665,7 +666,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
+     PictureBuffer buffer = buffers[i];
+     buffer.set_size(requested_pic_size_);
+     std::unique_ptr<VaapiPicture> picture = vaapi_picture_factory_->Create(
+-        (buffer_allocation_mode_ == BufferAllocationMode::kNone)
++        ((buffer_allocation_mode_ == BufferAllocationMode::kNone) ||
++         (buffer_allocation_mode_ == BufferAllocationMode::kWrapVdpau))
+             ? vaapi_wrapper_
+             : vpp_vaapi_wrapper_,
+         make_context_current_cb_, bind_image_cb_, buffer);
+@@ -1093,6 +1095,12 @@ VaapiVideoDecodeAccelerator::GetSupportedProfiles() {
+
+ VaapiVideoDecodeAccelerator::BufferAllocationMode
+ VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
++  // NVIDIA blobs use VDPAU
++  if (VaapiWrapper::GetImplementationType() == VAImplementation::kNVIDIAVDPAU) {
++    LOG(INFO) << "VA-API driver on VDPAU backend";
++    return BufferAllocationMode::kWrapVdpau;
++  }
++
+   // TODO(crbug.com/912295): Enable a better BufferAllocationMode for IMPORT
+   // |output_mode_| as well.
+   if (output_mode_ == VideoDecodeAccelerator::Config::OutputMode::IMPORT)
+@@ -1105,7 +1113,7 @@ VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
+   // depends on the bitstream and sometimes it's not enough to cover the amount
+   // of frames needed by the client pipeline (see b/133733739).
+   // TODO(crbug.com/911754): Enable for VP9 Profile 2.
+-  if (IsGeminiLakeOrLater() &&
++  if (false && IsGeminiLakeOrLater() &&
+       (profile_ == VP9PROFILE_PROFILE0 || profile_ == VP8PROFILE_ANY)) {
+     // Add one to the reference frames for the one being currently egressed, and
+     // an extra allocation for both |client_| and |decoder_|, see
+--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
++++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
+@@ -204,6 +204,7 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
+     // Using |client_|s provided PictureBuffers and as many internally
+     // allocated.
+     kNormal,
++    kWrapVdpau,
+   };
+
+   // Decides the concrete buffer allocation mode, depending on the hardware
+--- a/media/gpu/vaapi/vaapi_wrapper.cc
++++ b/media/gpu/vaapi/vaapi_wrapper.cc
+@@ -131,6 +131,9 @@ media::VAImplementation VendorStringToImplementationType(
+   } else if (base::StartsWith(va_vendor_string, "Intel iHD driver",
+                               base::CompareCase::SENSITIVE)) {
+     return media::VAImplementation::kIntelIHD;
++  } else if (base::StartsWith(va_vendor_string, "Splitted-Desktop Systems VDPAU",
++                              base::CompareCase::SENSITIVE)) {
++    return media::VAImplementation::kNVIDIAVDPAU;
+   }
+   return media::VAImplementation::kOther;
+ }
+--- a/media/gpu/vaapi/vaapi_wrapper.h
++++ b/media/gpu/vaapi/vaapi_wrapper.h
+@@ -79,6 +79,7 @@ enum class VAImplementation {
+   kIntelIHD,
+   kOther,
+   kInvalid,
++  kNVIDIAVDPAU,
+ };
+
+ // This class handles VA-API calls and ensures proper locking of VA-API calls
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch
new file mode 100644
index 000000000000..32f0ae2fb5e6
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/widevine-79.patch
@@ -0,0 +1,13 @@
+diff --git a/third_party/widevine/cdm/BUILD.gn b/third_party/widevine/cdm/BUILD.gn
+index ed0e2f5208b..5b431a030d5 100644
+--- a/third_party/widevine/cdm/BUILD.gn
++++ b/third_party/widevine/cdm/BUILD.gn
+@@ -14,7 +14,7 @@ buildflag_header("buildflags") {
+ 
+   flags = [
+     "ENABLE_WIDEVINE=$enable_widevine",
+-    "BUNDLE_WIDEVINE_CDM=$bundle_widevine_cdm",
++    "BUNDLE_WIDEVINE_CDM=true",
+     "ENABLE_WIDEVINE_CDM_COMPONENT=$enable_widevine_cdm_component",
+   ]
+ }
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix
new file mode 100644
index 000000000000..434bd77b6d18
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/plugins.nix
@@ -0,0 +1,93 @@
+{ stdenv, gcc
+, jshon
+, glib
+, nspr
+, nss
+, fetchzip
+, patchelfUnstable
+, enablePepperFlash ? false
+
+, upstream-info
+}:
+
+with stdenv.lib;
+
+let
+  mkrpath = p: "${makeSearchPathOutput "lib" "lib64" p}:${makeLibraryPath p}";
+
+  # Generate a shell fragment that emits flags appended to the
+  # final makeWrapper call for wrapping the browser's main binary.
+  #
+  # Note that this is shell-escaped so that only the variable specified
+  # by the "output" attribute is substituted.
+  mkPluginInfo = { output ? "out", allowedVars ? [ output ]
+                 , flags ? [], envVars ? {}
+                 }: let
+    shSearch = ["'"] ++ map (var: "@${var}@") allowedVars;
+    shReplace = ["'\\''"] ++ map (var: "'\"\${${var}}\"'") allowedVars;
+    # We need to triple-escape "val":
+    #  * First because makeWrapper doesn't do any quoting of its arguments by
+    #    itself.
+    #  * Second because it's passed to the makeWrapper call separated by IFS but
+    #    not by the _real_ arguments, for example the Widevine plugin flags
+    #    contain spaces, so they would end up as separate arguments.
+    #  * Third in order to be correctly quoted for the "echo" call below.
+    shEsc = val: "'${replaceStrings ["'"] ["'\\''"] val}'";
+    mkSh = val: "'${replaceStrings shSearch shReplace (shEsc val)}'";
+    mkFlag = flag: ["--add-flags" (shEsc flag)];
+    mkEnvVar = key: val: ["--set" (shEsc key) (shEsc val)];
+    envList = mapAttrsToList mkEnvVar envVars;
+    quoted = map mkSh (flatten ((map mkFlag flags) ++ envList));
+  in ''
+    mkdir -p "''$${output}/nix-support"
+    echo ${toString quoted} > "''$${output}/nix-support/wrapper-flags"
+  '';
+
+  flash = stdenv.mkDerivation rec {
+    pname = "flashplayer-ppapi";
+    version = "32.0.0.344";
+
+    src = fetchzip {
+      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
+      sha256 = "05ijlgsby9zxx0qs6f3vav1z0p6xr1cg6idl4akxvfmsl6hn6hkq";
+      stripRoot = false;
+    };
+
+    patchPhase = ''
+      chmod +x libpepflashplayer.so
+      patchelf --set-rpath "${mkrpath [ gcc.cc ]}" libpepflashplayer.so
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    installPhase = ''
+      flashVersion="$(
+        "${jshon}/bin/jshon" -F manifest.json -e version -u
+      )"
+
+      install -vD libpepflashplayer.so "$out/lib/libpepflashplayer.so"
+
+      ${mkPluginInfo {
+        allowedVars = [ "out" "flashVersion" ];
+        flags = [
+          "--ppapi-flash-path=@out@/lib/libpepflashplayer.so"
+          "--ppapi-flash-version=@flashVersion@"
+        ];
+      }}
+    '';
+
+    dontStrip = true;
+
+    meta = {
+      license = stdenv.lib.licenses.unfree;
+      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      platforms = platforms.x86_64;
+    };
+  };
+
+in {
+  enabled = optional enablePepperFlash flash;
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
new file mode 100644
index 000000000000..9b5c76f53429
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
@@ -0,0 +1,6 @@
+{
+  "81.0.4044.92" = {
+    rev = "81.0.4044.92-2";
+    sha256 = "071a33idn2zcix6z8skn7y85mhb9w5s0bh0fvrjm269y7cmjrh3l";
+  };
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix
new file mode 100644
index 000000000000..17418c90af49
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled.nix
@@ -0,0 +1,42 @@
+{ stdenv
+, fetchFromGitHub
+, python3Packages
+, makeWrapper
+, patch
+}:
+{ rev
+, sha256
+}:
+
+stdenv.mkDerivation rec {
+  name = "ungoogled-chromium-${version}";
+
+  version = rev;
+
+  src = fetchFromGitHub {
+    owner = "Eloston";
+    repo = "ungoogled-chromium";
+    inherit rev sha256;
+  };
+
+  dontBuild = true;
+
+  buildInputs = [
+    python3Packages.python
+    patch
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  patchPhase = ''
+    sed -i '/chromium-widevine/d' patches/series
+  '';
+
+  installPhase = ''
+    mkdir $out
+    cp -R * $out/
+    wrapProgram $out/utils/patches.py --add-flags "apply" --prefix PATH : "${patch}/bin"
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix
new file mode 100644
index 000000000000..6dff17c69ddb
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/update.nix
@@ -0,0 +1,271 @@
+let maybePkgs = import ../../../../../. {}; in
+
+{ stdenv     ? maybePkgs.stdenv
+, runCommand ? maybePkgs.runCommand
+, fetchurl   ? maybePkgs.fetchurl
+, writeText  ? maybePkgs.writeText
+, curl       ? maybePkgs.curl
+, cacert     ? maybePkgs.cacert
+, nix        ? maybePkgs.nix
+}:
+
+let
+  inherit (stdenv) lib;
+
+  sources = if builtins.pathExists ./upstream-info.nix
+            then import ./upstream-info.nix
+            else {};
+
+  bucketURL = "https://commondatastorage.googleapis.com/"
+            + "chromium-browser-official";
+
+  mkVerURL = version: "${bucketURL}/chromium-${version}.tar.xz";
+
+  debURL = "https://dl.google.com/linux/chrome/deb/pool/main/g";
+
+  getDebURL = channelName: version: arch: mirror: let
+    packageSuffix = if channelName == "dev" then "unstable" else channelName;
+    packageName = "google-chrome-${packageSuffix}";
+  in "${mirror}/${packageName}/${packageName}_${version}-1_${arch}.deb";
+
+  # Untrusted mirrors, don't try to update from them!
+  debMirrors = [
+    "http://95.31.35.30/chrome/pool/main/g"
+    "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
+    "http://repo.fdzh.org/chrome/deb/pool/main/g"
+  ];
+
+in {
+  getChannel = channel: let
+    chanAttrs = builtins.getAttr channel sources;
+  in {
+    inherit channel;
+    inherit (chanAttrs) version;
+
+    main = fetchurl {
+      url = mkVerURL chanAttrs.version;
+      inherit (chanAttrs) sha256;
+    };
+
+    binary = fetchurl (let
+      mkUrls = arch: let
+        mkURLForMirror = getDebURL channel chanAttrs.version arch;
+      in map mkURLForMirror ([ debURL ] ++ debMirrors);
+    in if stdenv.is64bit && chanAttrs ? sha256bin64 then {
+      urls = mkUrls "amd64";
+      sha256 = chanAttrs.sha256bin64;
+    } else if !stdenv.is64bit && chanAttrs ? sha256bin32 then {
+      urls = mkUrls "i386";
+      sha256 = chanAttrs.sha256bin32;
+    } else throw "No Chrome plugins are available for your architecture.");
+  };
+
+  update = let
+    csv2nix = name: src: import (runCommand "${name}.nix" {
+      src = builtins.fetchurl src;
+    } ''
+      esc() { echo "\"$(echo "$1" | sed -e 's/"\\$/\\&/')\""; } # ohai emacs "
+      IFS=, read -r -a headings <<< "$(head -n1 "$src")"
+      echo "[" > "$out"
+      tail -n +2 "$src" | while IFS=, read -r -a line; do
+        echo "  {"
+        for idx in "''${!headings[@]}"; do
+          echo "    $(esc "''${headings[idx]}") = $(esc ''${line[$idx]});"
+        done
+        echo "  }"
+      done >> "$out"
+      echo "]" >> "$out"
+    '');
+
+    channels = lib.fold lib.recursiveUpdate {} (map (attrs: {
+      ${attrs.os}.${attrs.channel} = attrs // {
+        history = let
+          drvName = "omahaproxy-${attrs.os}.${attrs.channel}-info";
+          history = csv2nix drvName "http://omahaproxy.appspot.com/history";
+          cond = h: attrs.os == h.os && attrs.channel == h.channel
+                 && lib.versionOlder h.version attrs.current_version;
+          # Note that this is a *reverse* sort!
+          sorter = a: b: lib.versionOlder b.version a.version;
+          sorted = builtins.sort sorter (lib.filter cond history);
+        in map (lib.flip removeAttrs ["os" "channel"]) sorted;
+        version = attrs.current_version;
+      };
+    }) (csv2nix "omahaproxy-info" "http://omahaproxy.appspot.com/all?csv=1"));
+
+    /*
+      XXX: This is essentially the same as:
+
+        builtins.tryEval (builtins.fetchurl url)
+
+      ... except that tryEval on fetchurl isn't working and doesn't catch
+      errors for fetchurl, so we go for a different approach.
+
+      We only have fixed-output derivations that can have networking access, so
+      we abuse SHA1 and its weaknesses to forge a fixed-output derivation which
+      is not so fixed, because it emits different contents that have the same
+      SHA1 hash.
+
+      Using this method, we can distinguish whether the URL is available or
+      whether it's not based on the actual content.
+
+      So let's use tryEval as soon as it's working with fetchurl in Nix.
+    */
+    tryFetch = url: let
+      # SHA1 hash collisions from https://shattered.io/static/shattered.pdf:
+      collisions = runCommand "sha1-collisions" {
+        outputs = [ "out" "good" "bad" ];
+        base64 = ''
+          QlpoOTFBWSZTWbL5V5MABl///////9Pv///v////+/////HDdK739/677r+W3/75rUNr4
+          Aa/AAAAAAACgEVTRtQDQAaA0AAyGmjTQGmgAAANGgAaMIAYgGgAABo0AAAAAADQAIAGQ0
+          MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk
+          0AaMQ0DQAGIANGgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIAN
+          GgAAGRoNGQMRpo0GIGgBoGQAAIAGQ0MgDIGmjQA0DRk0AaMQ0DQAGIANGgAAGRoNGQMRp
+          o0GIGgBoGQAABVTUExEZATTICnkxNR+p6E09JppoyamjGhkm0ammIyaekbUejU9JiGnqZ
+          qaaDxJ6m0JkZMQ2oaYmJ6gxqMyE2TUzJqfItligtJQJfYbl9Zy9QjQuB5mHQRdSSXCCTH
+          MgmSDYmdOoOmLTBJWiCpOhMQYpQlOYpJjn+wQUJSTCEpOMekaFaaNB6glCC0hKEJdHr6B
+          mUIHeph7YxS8WJYyGwgWnMTFJBDFSxSCCYljiEk7HZgJzJVDHJxMgY6tCEIIWgsKSlSZ0
+          S8GckoIIF+551Ro4RCw260VCEpWJSlpWx/PMrLyVoyhWMAneDilBcUIeZ1j6NCkus0qUC
+          Wnahhk5KT4GpWMh3vm2nJWjTL9Qg+84iExBJhNKpbV9tvEN265t3fu/TKkt4rXFTsV+Nc
+          upJXhOhOhJMQQktrqt4K8mSh9M2DAO2X7uXGVL9YQxUtzQmS7uBndL7M6R7vX869VxqPu
+          renSuHYNq1yTXOfNWLwgvKlRlFYqLCs6OChDp0HuTzCWscmGudLyqUuwVGG75nmyZhKpJ
+          yOE/pOZyHyrZxGM51DYIN+Jc8yVJgAykxKCEtW55MlfudLg3KG6TtozalunXrroSxUpVL
+          StWrWLFihMnVpkyZOrQnUrE6xq1CGtJlbAb5ShMbV1CZgqlKC0wCFCpMmUKSEkvFLaZC8
+          wHOCVAlvzaJQ/T+XLb5Dh5TNM67p6KZ4e4ZSGyVENx2O27LzrTIteAreTkMZpW95GS0CE
+          JYhMc4nToTJ0wQhKEyddaLb/rTqmgJSlkpnALxMhlNmuKEpkEkqhKUoEq3SoKUpIQcDgW
+          lC0rYahMmLuPQ0fHqZaF4v2W8IoJ2EhMhYmSw7qql27WJS+G4rUplToFi2rSv0NSrVvDU
+          pltQ8Lv6F8pXyxmFBSxiLSxglNC4uvXVKmAtusXy4YXGX1ixedEvXF1aX6t8adYnYCpC6
+          rW1ZzdZYlCCxKEv8vpbqdSsXl8v1jCQv0KEPxPTa/5rtWSF1dSgg4z4KjfIMNtgwWoWLE
+          sRhKxsSA9ji7V5LRPwtumeQ8V57UtFSPIUmtQdOQfseI2Ly1DMtk4Jl8n927w34zrWG6P
+          i4jzC82js/46Rt2IZoadWxOtMInS2xYmcu8mOw9PLYxQ4bdfFw3ZPf/g2pzSwZDhGrZAl
+          9lqky0W+yeanadC037xk496t0Dq3ctfmqmjgie8ln9k6Q0K1krb3dK9el4Xsu44LpGcen
+          r2eQZ1s1IhOhnE56WnXf0BLWn9Xz15fMkzi4kpVxiTKGEpffErEEMvEeMZhUl6yD1SdeJ
+          YbxzGNM3ak2TAaglLZlDCVnoM6wV5DRrycwF8Zh/fRsdmhkMfAO1duwknrsFwrzePWeMw
+          l107DWzymxdQwiSXx/lncnn75jL9mUzw2bUDqj20LTgtawxK2SlQg1CCZDQMgSpEqLjRM
+          sykM9zbSIUqil0zNk7Nu+b5J0DKZlhl9CtpGKgX5uyp0idoJ3we9bSrY7PupnUL5eWiDp
+          V5mmnNUhOnYi8xyClkLbNmAXyoWk7GaVrM2umkbpqHDzDymiKjetgzTocWNsJ2E0zPcfh
+          t46J4ipaXGCfF7fuO0a70c82bvqo3HceIcRlshgu73seO8BqlLIap2z5jTOY+T2ucCnBt
+          Atva3aHdchJg9AJ5YdKHz7LoA3VKmeqxAlFyEnQLBxB2PAhAZ8KvmuR6ELXws1Qr13Nd1
+          i4nsp189jqvaNzt+0nEnIaniuP1+/UOZdyfoZh57ku8sYHKdvfW/jYSUks+0rK+qtte+p
+          y8jWL9cOJ0fV8rrH/t+85/p1z2N67p/ZsZ3JmdyliL7lrNxZUlx0MVIl6PxXOUuGOeArW
+          3vuEvJ2beoh7SGyZKHKbR2bBWO1d49JDIcVM6lQtu9UO8ec8pOnXmkcponBPLNM2CwZ9k
+          NC/4ct6rQkPkQHMcV/8XckU4UJCy+VeTA==
+        '';
+      } ''
+        echo "$base64" | base64 -d | tar xj
+        mv good.pdf "$good"
+        mv bad.pdf "$bad"
+        touch "$out"
+      '';
+
+      cacheVal = let
+        urlHash = builtins.hashString "sha256" url;
+        timeSlice = builtins.currentTime / 600;
+      in "${urlHash}-${toString timeSlice}";
+
+    in {
+      success = import (runCommand "check-success" {
+        result = stdenv.mkDerivation {
+          name = "tryfetch-${cacheVal}";
+          inherit url;
+
+          outputHash = "d00bbe65d80f6d53d5c15da7c6b4f0a655c5a86a";
+          outputHashMode = "flat";
+          outputHashAlgo = "sha1";
+
+          nativeBuildInputs = [ curl ];
+          preferLocalBuild = true;
+
+          inherit (collisions) good bad;
+
+          buildCommand = ''
+            if SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt" \
+               curl -s -L -f -I "$url" > /dev/null; then
+              cp "$good" "$out"
+            else
+              cp "$bad" "$out"
+            fi
+          '';
+
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+        };
+        inherit (collisions) good;
+      } ''
+        if cmp -s "$result" "$good"; then
+          echo true > "$out"
+        else
+          echo false > "$out"
+        fi
+      '');
+      value = builtins.fetchurl url;
+    };
+
+    fetchLatest = channel: let
+      result = tryFetch (mkVerURL channel.version);
+    in if result.success then result.value else fetchLatest (channel // {
+      version = if channel.history != []
+                then (lib.head channel.history).version
+                else throw "Unfortunately there's no older version than " +
+                           "${channel.version} available for channel " +
+                           "${channel.channel} on ${channel.os}.";
+      history = lib.tail channel.history;
+    });
+
+    getHash = path: import (runCommand "gethash.nix" {
+      inherit path;
+      nativeBuildInputs = [ nix ];
+    } ''
+      sha256="$(nix-hash --flat --base32 --type sha256 "$path")"
+      echo "\"$sha256\"" > "$out"
+    '');
+
+    isLatest = channel: version: let
+      ourVersion = sources.${channel}.version or null;
+    in if ourVersion == null then false
+       else lib.versionOlder version sources.${channel}.version
+         || version == sources.${channel}.version;
+
+    # We only support GNU/Linux right now.
+    linuxChannels = let
+      genLatest = channelName: channel: let
+        newUpstream = {
+          inherit (channel) version;
+          sha256 = getHash (fetchLatest channel);
+        };
+        keepOld = let
+          oldChannel = sources.${channelName};
+        in {
+          inherit (oldChannel) version sha256;
+        } // lib.optionalAttrs (oldChannel ? sha256bin32) {
+          inherit (oldChannel) sha256bin32;
+        } // lib.optionalAttrs (oldChannel ? sha256bin64) {
+          inherit (oldChannel) sha256bin64;
+        };
+      in if isLatest channelName channel.version then keepOld else newUpstream;
+    in lib.mapAttrs genLatest channels.linux;
+
+    getLinuxFlash = channelName: channel: let
+      inherit (channel) version;
+      fetchArch = arch: tryFetch (getDebURL channelName version arch debURL);
+      packages = lib.genAttrs ["i386" "amd64"] fetchArch;
+      isNew = arch: attr: !(builtins.hasAttr attr channel)
+                       && packages.${arch}.success;
+    in channel // lib.optionalAttrs (isNew "i386" "sha256bin32") {
+      sha256bin32 = getHash (packages.i386.value);
+    } // lib.optionalAttrs (isNew "amd64" "sha256bin64") {
+      sha256bin64 = getHash (packages.amd64.value);
+    };
+
+    newChannels = lib.mapAttrs getLinuxFlash linuxChannels;
+
+    dumpAttrs = indent: attrs: let
+      mkVal = val: if lib.isAttrs val then dumpAttrs (indent + 1) val
+                   else "\"${lib.escape ["$" "\\" "\""] (toString val)}\"";
+      mkIndent = level: lib.concatStrings (builtins.genList (_: "  ") level);
+      mkAttr = key: val: "${mkIndent (indent + 1)}${key} = ${mkVal val};\n";
+      attrLines = lib.mapAttrsToList mkAttr attrs;
+    in "{\n" + (lib.concatStrings attrLines) + (mkIndent indent) + "}";
+  in writeText "chromium-new-upstream-info.nix" ''
+    # This file is autogenerated from update.sh in the same directory.
+    ${dumpAttrs 0 newChannels}
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh b/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh
new file mode 100755
index 000000000000..ea67a62c107a
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/update.sh
@@ -0,0 +1,4 @@
+#!/bin/sh -e
+cd "$(dirname "$0")"
+sp="$(nix-build --builders "" -Q --no-out-link update.nix -A update)"
+cat "$sp" > upstream-info.nix
diff --git a/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix b/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix
new file mode 100644
index 000000000000..c5f9d60122dc
--- /dev/null
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.nix
@@ -0,0 +1,18 @@
+# This file is autogenerated from update.sh in the same directory.
+{
+  beta = {
+    sha256 = "0i0szd749ihb08rxnsmsbxq75b6x952wpk94jwc0ncv6gb83zkx2";
+    sha256bin64 = "1y70kmfz9nv507b0zdda7zfk2ac9qh9m2gq00aphdmzd0al7skj8";
+    version = "81.0.4044.92";
+  };
+  dev = {
+    sha256 = "1rydvjmv62zj95sf0fgsyipqz2hphbxm60y8q0813wq9ym35d4yy";
+    sha256bin64 = "1m6740lw7xjjp1lplwp9ii4d3l7dfa9jrv5bysm4ar5pb9kywrai";
+    version = "83.0.4100.3";
+  };
+  stable = {
+    sha256 = "0i0szd749ihb08rxnsmsbxq75b6x952wpk94jwc0ncv6gb83zkx2";
+    sha256bin64 = "1ig899cpahw1xfhdff5xj6w4k8jja5smxvrcbw6b0jcjmawdrf72";
+    version = "81.0.4044.92";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index 9c6eec1a3363..d457ddd98bfe 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -37,6 +37,6 @@ buildGoPackage rec {
     homepage = "https://github.com/containernetworking/plugins";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan saschagrunert ];
+    maintainers = with maintainers; [ cstrahan ] ++ teams.podman.members;
   };
 }
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index aee162ba6f22..0eac175a1707 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helm";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "0pg5cwgyfb4isy2fn233kj3bdn0i8qqp90yzix0khs5maalpnrk1";
+    sha256 = "1j6pr1a9ff32bnjq9rncllmfpraip5r2fj3zsljw5jq68x5wamdc";
   };
   modSha256 = "0618zzi4x37ahsrazsr82anghhfva8yaryzb3p5d737p3ixbiyv8";
 
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index 3f0a83d015da..e8500872d52c 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -6,8 +6,6 @@ buildGoPackage rec {
 
   goPackagePath = "github.com/StackExchange/dnscontrol";
 
-  goDeps = ./deps.nix;
-
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
@@ -15,9 +13,7 @@ buildGoPackage rec {
     sha256 = "1j8i4k7bqkqmi6dmc9fxfab49a7qigig72rlbga902lw336p6cc7";
   };
 
-  postInstall = ''
-    rm $bin/bin/{build,convertzone,generate,validate}
-  '';
+  subPackages = [ "." ];
 
   meta = with stdenv.lib; {
     description = "Synchronize your DNS to multiple providers from a simple DSL";
diff --git a/pkgs/applications/networking/dnscontrol/deps.nix b/pkgs/applications/networking/dnscontrol/deps.nix
deleted file mode 100644
index 55cb5daa18f8..000000000000
--- a/pkgs/applications/networking/dnscontrol/deps.nix
+++ /dev/null
@@ -1,1236 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "cloud.google.com/go";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/gocloud";
-      rev = "335e9e09b93e";
-      sha256 = "1aiglr6d2369nf3s9ig1kc0nixsivcmh7p1fyzkcf6n6ql0p2zsm";
-    };
-  }
-  {
-    goPackagePath = "github.com/Azure/azure-sdk-for-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Azure/azure-sdk-for-go";
-      rev = "v39.1.0";
-      sha256 = "1s0j7gh3d3p157py7v6525c6zs07hdiry97dhg4c8z7ww35wxhj7";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/xgb";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/xgb";
-      rev = "27f122750802";
-      sha256 = "18lp2x8f5bljvlz0r7xn744f0c9rywjsb9ifiszqqdcpwhsa0kvj";
-    };
-  }
-  {
-    goPackagePath = "github.com/DisposaBoy/JsonConfigReader";
-    fetch = {
-      type = "git";
-      url = "https://github.com/DisposaBoy/JsonConfigReader";
-      rev = "5ea4d0ddac55";
-      sha256 = "022wzrkf0rni9yb15439w81kj0kb4667zx6n2zq07ysw7lk6ahqz";
-    };
-  }
-  {
-    goPackagePath = "github.com/TomOnTime/utfutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/TomOnTime/utfutil";
-      rev = "09c41003ee1d";
-      sha256 = "01d6w8migw5px19jg0mm7qhsa1ydcz9wvl838nsclfw63x5sy70i";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/kingpin";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/kingpin";
-      rev = "v2.2.6";
-      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/template";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/template";
-      rev = "fb15b899a751";
-      sha256 = "1vlasv4dgycydh5wx6jdcvz40zdv90zz1h7836z7lhsi2ymvii26";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/units";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/units";
-      rev = "f65c72e2690d";
-      sha256 = "04jyqm7m3m01ppfy1f9xk4qvrwvs78q9zml6llyf2b3v5k6b2bbc";
-    };
-  }
-  {
-    goPackagePath = "github.com/andreyvit/diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/andreyvit/diff";
-      rev = "c7f18ee00883";
-      sha256 = "1s4qjkxig5yqahpzfl4xqh4kzi9mymdpkzq6kj3f4dr5dl3hlynr";
-    };
-  }
-  {
-    goPackagePath = "github.com/armon/go-metrics";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/go-metrics";
-      rev = "f0300d1749da";
-      sha256 = "13l7c35ps0r27vxfil2w0xhhc7w5rh00awvlmn4cz0a937b9ffpv";
-    };
-  }
-  {
-    goPackagePath = "github.com/armon/go-radix";
-    fetch = {
-      type = "git";
-      url = "https://github.com/armon/go-radix";
-      rev = "7fddfc383310";
-      sha256 = "0y8chspn14n9xpsfb9gxnnf819rfpriaz64v81p7873a42kkhxb4";
-    };
-  }
-  {
-    goPackagePath = "github.com/aws/aws-sdk-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/aws/aws-sdk-go";
-      rev = "v1.29.21";
-      sha256 = "0q97abz6cjj1gf3gfd52gjx39grfhlcjax8306zw9038a8v0nadc";
-    };
-  }
-  {
-    goPackagePath = "github.com/bgentry/speakeasy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/bgentry/speakeasy";
-      rev = "v0.1.0";
-      sha256 = "02dfrj0wyphd3db9zn2mixqxwiz1ivnyc5xc7gkz58l5l27nzp8s";
-    };
-  }
-  {
-    goPackagePath = "github.com/billputer/go-namecheap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/billputer/go-namecheap";
-      rev = "0c7adb0710f8";
-      sha256 = "09jkymml6f0nvz7md7s4ayj75xdms77ziz9rkw4kvj7jhv36302p";
-    };
-  }
-  {
-    goPackagePath = "github.com/cenkalti/backoff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cenkalti/backoff";
-      rev = "v2.1.1";
-      sha256 = "1mf4lsl3rbb8kk42x0mrhzzy4ikqy0jf6nxpzhkr02rdgwh6rjk8";
-    };
-  }
-  {
-    goPackagePath = "github.com/census-instrumentation/opencensus-proto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-proto";
-      rev = "v0.2.1";
-      sha256 = "19fcx3sc99i5dsklny6r073z5j20vlwn2xqm6di1q3b1xwchzqfj";
-    };
-  }
-  {
-    goPackagePath = "github.com/client9/misspell";
-    fetch = {
-      type = "git";
-      url = "https://github.com/client9/misspell";
-      rev = "v0.3.4";
-      sha256 = "1vwf33wsc4la25zk9nylpbp9px3svlmldkm0bha4hp56jws4q9cs";
-    };
-  }
-  {
-    goPackagePath = "github.com/cpuguy83/go-md2man";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "v2.0.0";
-      sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
-    };
-  }
-  {
-    goPackagePath = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev = "v1.1.1";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath = "github.com/digitalocean/godo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/digitalocean/godo";
-      rev = "v1.30.0";
-      sha256 = "0z38lg1zd57b5ymxdxhz5rs5rynpzhqmbvm0marhh0v7v9bbk0rx";
-    };
-  }
-  {
-    goPackagePath = "github.com/dimchansky/utfbom";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dimchansky/utfbom";
-      rev = "v1.1.0";
-      sha256 = "06s61wwd32fad1p8qn5blqjd5791avzb13fnqflkkg993adw49ww";
-    };
-  }
-  {
-    goPackagePath = "github.com/dnsimple/dnsimple-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dnsimple/dnsimple-go";
-      rev = "v0.31.0";
-      sha256 = "0i074r3m0bqggmplswymgj6yfzbsrcqw8gn6py9x8g3kyl4si0x0";
-    };
-  }
-  {
-    goPackagePath = "github.com/envoyproxy/go-control-plane";
-    fetch = {
-      type = "git";
-      url = "https://github.com/envoyproxy/go-control-plane";
-      rev = "5f8ba28d4473";
-      sha256 = "1f1s764rd41vd9vgk3r14h1m6fz6pdvxj6fd83q58gxifbc4q5w4";
-    };
-  }
-  {
-    goPackagePath = "github.com/envoyproxy/protoc-gen-validate";
-    fetch = {
-      type = "git";
-      url = "https://github.com/envoyproxy/protoc-gen-validate";
-      rev = "v0.1.0";
-      sha256 = "0kxd3wwh3xwqk0r684hsy281xq4y71cd11d4q2hspcjbnlbwh7cy";
-    };
-  }
-  {
-    goPackagePath = "github.com/exoscale/egoscale";
-    fetch = {
-      type = "git";
-      url = "https://github.com/exoscale/egoscale";
-      rev = "v0.23.0";
-      sha256 = "0dgc08sdvy2cj7yygrlnyp6v9m829h4v0pm3vdsj9yx3bps5v7iy";
-    };
-  }
-  {
-    goPackagePath = "github.com/fatih/color";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/color";
-      rev = "v1.7.0";
-      sha256 = "0v8msvg38r8d1iiq2i5r4xyfx0invhc941kjrsg5gzwvagv55inv";
-    };
-  }
-  {
-    goPackagePath = "github.com/fatih/structs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/structs";
-      rev = "v1.1.0";
-      sha256 = "1wrhb8wp8zpzggl61lapb627lw8yv281abvr6vqakmf569nswa9q";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-acme/lego";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-acme/lego";
-      rev = "v2.7.2";
-      sha256 = "1137l22jrwk8hvdzjbmfkvd9nllp6sznzy66ngmcsc0ybp19hcry";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-ldap/ldap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-ldap/ldap";
-      rev = "v3.0.2";
-      sha256 = "1srb1nkcbs0v1hcdz6j4zhg000h763j83jlklsiwanvbp48y4lhz";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-sql-driver/mysql";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-sql-driver/mysql";
-      rev = "v1.5.0";
-      sha256 = "11x0m9yf3kdnf6981182r824psgxwfaqhn3x3in4yiidp0w0hk3v";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-test/deep";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-test/deep";
-      rev = "042da051cf31";
-      sha256 = "08bya0s7m15f5qm1kn2r42g1r4lpq0svpaqr0zaac4hmaxj7vnid";
-    };
-  }
-  {
-    goPackagePath = "github.com/gobwas/glob";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gobwas/glob";
-      rev = "e7a84e9525fe";
-      sha256 = "1v6vjklq06wqddv46ihajahaj1slv0imgaivlxr8bsx59i90js5q";
-    };
-  }
-  {
-    goPackagePath = "github.com/gofrs/uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gofrs/uuid";
-      rev = "v3.2.0";
-      sha256 = "1q63mp7bznhfgyw133c0wc0hpcj1cq9bcf7w1f8r6inkcrils1fz";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/glog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/glog";
-      rev = "23def4e6c14b";
-      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/mock";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/mock";
-      rev = "v1.3.1";
-      sha256 = "1wnfa8njxdym1qb664dmfnkpm4pmqy22hqjlqpwaaiqhglb5g9d1";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.3.3";
-      sha256 = "1cyyr52yhj3fzrily3rmsbqyj8va4ld75lmry0857m39rgpv8sy1";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/snappy";
-      rev = "v0.0.1";
-      sha256 = "0gp3kkzlm3wh37kgkhbqxq3zx07iqbgis5w9mf4d64h6vjq760is";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/btree";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/btree";
-      rev = "v1.0.0";
-      sha256 = "0ba430m9fbnagacp57krgidsyrgp3ycw5r7dj71brgp5r52g82p6";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-cmp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-cmp";
-      rev = "v0.4.0";
-      sha256 = "1x5pvl3fb5sbyng7i34431xycnhmx8xx94gq2n19g6p0vz68z2v2";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-github";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-github";
-      rev = "v17.0.0";
-      sha256 = "1kvw95l77a5n5rgal9n1xjh58zxb3a40ij1j722b1h4z8yg9jhg4";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-querystring";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-querystring";
-      rev = "c8c88dbee036";
-      sha256 = "1yckg2052mz7ps1m68wri6kyb5n4g0vx2yf7s0xs9gdqvvscp57l";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/martian";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/martian";
-      rev = "v2.1.0";
-      sha256 = "197hil6vrjk50b9wvwyzf61csid83whsjj6ik8mc9r2lryxlyyrp";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/pprof";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/pprof";
-      rev = "54271f7e092f";
-      sha256 = "14x4ydifz23rzaylggvwbm3dwlv1bc6s0bclmkxck9nbjbqw89vy";
-    };
-  }
-  {
-    goPackagePath = "github.com/googleapis/gax-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/gax-go";
-      rev = "v2.0.5";
-      sha256 = "1lxawwngv6miaqd25s3ba0didfzylbwisd2nz7r4gmbmin6jsjrx";
-    };
-  }
-  {
-    goPackagePath = "github.com/gopherjs/gopherjs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gopherjs/gopherjs";
-      rev = "0766667cb4d1";
-      sha256 = "13pfc9sxiwjky2lm1xb3i3lcisn8p6mgjk2d927l7r92ysph8dmw";
-    };
-  }
-  {
-    goPackagePath = "github.com/gopherjs/jquery";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gopherjs/jquery";
-      rev = "73f4c7416038";
-      sha256 = "1xhl0k52v3djalnd02a0ph572f85i1szj2x4q3lglkq40j7racd2";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/errwrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/errwrap";
-      rev = "v1.0.0";
-      sha256 = "0slfb6w3b61xz04r32bi0a1bygc82rjzhqkxj2si2074wynqnr1c";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-cleanhttp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-cleanhttp";
-      rev = "v0.5.1";
-      sha256 = "07kx3fhryqmaw3czacmm11qwx63js2q8cfq967vphk7xg9q377kk";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-hclog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-hclog";
-      rev = "v0.9.2";
-      sha256 = "0pakba7rdkjgq50r79sbbpavymbyib77cy613wl734mpi30ywrxm";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-immutable-radix";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-immutable-radix";
-      rev = "v1.0.0";
-      sha256 = "1v3nmsnk1s8bzpclrhirz7iq0g5xxbw9q5gvrg9ss6w9crs72qr6";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-multierror";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-multierror";
-      rev = "v1.0.0";
-      sha256 = "00nyn8llqzbfm8aflr9kwsvpzi4kv8v45c141v88xskxp5xf6z49";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-plugin";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-plugin";
-      rev = "v1.0.1";
-      sha256 = "0aama8vdyrfzjdhxc1l4cwhmgydl989lywhq3pg3slzjg6r00rda";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-retryablehttp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-retryablehttp";
-      rev = "v0.6.3";
-      sha256 = "1vnhr7yry71jldmmj5gxhq49crhi9vrmqc2i41mycpnva2zd8a0i";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-rootcerts";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-rootcerts";
-      rev = "v1.0.1";
-      sha256 = "0ca5h7vlvrghf24dzh8l6w5px293n173qxfkjxb9kgsl6hsrsl3y";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-sockaddr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-sockaddr";
-      rev = "v1.0.2";
-      sha256 = "0y106nhd3s63lj7h7k21iq0br97h0z9qjrvx028zqcsq9407k9is";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-uuid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-uuid";
-      rev = "v1.0.1";
-      sha256 = "0jvb88m0rq41bwgirsadgw7mnayl27av3gd2vqa3xvxp3fy0hp5k";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-version";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-version";
-      rev = "v1.1.0";
-      sha256 = "1ykh3jl5zj5a4irkgp5mq936bqkznmf9lp23qk741vh4r5874vi8";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/golang-lru";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/golang-lru";
-      rev = "v0.5.1";
-      sha256 = "13f870cvk161bzjj6x41l45r5x9i1z9r2ymwmvm7768kg08zznpy";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/hcl";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/hcl";
-      rev = "v1.0.0";
-      sha256 = "0q6ml0qqs0yil76mpn4mdx4lp94id8vbv575qm60jzl1ijcl5i66";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/yamux";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/yamux";
-      rev = "2f1d1f20f75d";
-      sha256 = "1fga3p6j2g24ip9qjfwn3nqjr00m4nnjz92app7ms3sz7vgq2a7s";
-    };
-  }
-  {
-    goPackagePath = "github.com/hexonet/go-sdk";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hexonet/go-sdk";
-      rev = "v2.2.3";
-      sha256 = "0mgkfrc7qlm4xf1v7kb29p7wq6rmaaha9zv8kwa27r8hjx6qnb8c";
-    };
-  }
-  {
-    goPackagePath = "github.com/jarcoal/httpmock";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jarcoal/httpmock";
-      rev = "v1.0.4";
-      sha256 = "1x04i9hhvdxi9xmyf0vbi5azlh7rr4blsq7fbhps8i2gdpga612y";
-    };
-  }
-  {
-    goPackagePath = "github.com/jmespath/go-jmespath";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jmespath/go-jmespath";
-      rev = "2437e8417af5";
-      sha256 = "1hwcbr7nrlfshwr4hrac8ch8gvfpf07qi72bpqmqi272c67ma89v";
-    };
-  }
-  {
-    goPackagePath = "github.com/jstemmer/go-junit-report";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jstemmer/go-junit-report";
-      rev = "af01ea7f8024";
-      sha256 = "1lp3n94ris12hac02wi31f3whs88lcrzwgdg43a5j6cafg9p1d0s";
-    };
-  }
-  {
-    goPackagePath = "github.com/jtolds/gls";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jtolds/gls";
-      rev = "v4.20.0";
-      sha256 = "1k7xd2q2ysv2xsh373qs801v6f359240kx0vrl0ydh7731lngvk6";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pretty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pretty";
-      rev = "v0.1.0";
-      sha256 = "18m4pwg2abd0j9cn5v3k2ksk9ig4vlwxmlw9rrglanziv9l967qp";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pty";
-      rev = "v1.1.1";
-      sha256 = "0383f0mb9kqjvncqrfpidsf8y6ns5zlrc91c6a74xpyxjwvzl2y6";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/text";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/text";
-      rev = "v0.1.0";
-      sha256 = "1gm5bsl01apvc84bw06hasawyqm4q84vx1pm32wr9jnd7a8vjgj1";
-    };
-  }
-  {
-    goPackagePath = "github.com/malexdev/utfutil";
-    fetch = {
-      type = "git";
-      url = "https://github.com/malexdev/utfutil";
-      rev = "00c8d4a8e7a8";
-      sha256 = "01d6w8migw5px19jg0mm7qhsa1ydcz9wvl838nsclfw63x5sy70i";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev = "v0.0.9";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.3";
-      sha256 = "06w45aqz2a6yrk25axbly2k5wmsccv8cspb94bfmz4izvw8h927n";
-    };
-  }
-  {
-    goPackagePath = "github.com/miekg/dns";
-    fetch = {
-      type = "git";
-      url = "https://github.com/miekg/dns";
-      rev = "v1.1.27";
-      sha256 = "0fpd9alvhzrkb1c31n4lrxlpv1nlhy51w1yg39xxb3mjmrb7lby1";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/cli";
-      rev = "v1.0.0";
-      sha256 = "1i9kmr7rcf10d2hji8h4247hmc0nbairv7a0q51393aw2h1bnwg2";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/copystructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/copystructure";
-      rev = "v1.0.0";
-      sha256 = "05njg92w1088v4yl0js0zdrpfq6k37i9j14mxkr3p90p5yd9rrrr";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-homedir";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-homedir";
-      rev = "v1.1.0";
-      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-testing-interface";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-testing-interface";
-      rev = "v1.0.0";
-      sha256 = "1dl2js8di858bawg7dadlf1qjpkl2g3apziihjyf5imri3znyfpw";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/go-wordwrap";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/go-wordwrap";
-      rev = "v1.0.0";
-      sha256 = "1jffbwcr3nnq6c12c5856bwzv2nxjzqk3jwgvxkwi1xhpd2by0bf";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/mapstructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/mapstructure";
-      rev = "v1.1.2";
-      sha256 = "03bpv28jz9zhn4947saqwi328ydj7f6g6pf1m2d4m5zdh5jlfkrr";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/reflectwalk";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/reflectwalk";
-      rev = "v1.0.0";
-      sha256 = "0wzkp0fdx22n8f7y9y37dgmnlrlfsv9zjdb48cbx7rsqsbnny7l0";
-    };
-  }
-  {
-    goPackagePath = "github.com/mjibson/esc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mjibson/esc";
-      rev = "v0.2.0";
-      sha256 = "0ci3bdm01prm114plcwkgzbqn825lh0zc1iqaw3jicjay5sh0bis";
-    };
-  }
-  {
-    goPackagePath = "github.com/namedotcom/go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/namedotcom/go";
-      rev = "08470befbe04";
-      sha256 = "00ai7fd74sn4alqmpqsiyczirli50b7m059b6zzg1izy9g4cdd4g";
-    };
-  }
-  {
-    goPackagePath = "github.com/oklog/run";
-    fetch = {
-      type = "git";
-      url = "https://github.com/oklog/run";
-      rev = "v1.0.0";
-      sha256 = "1pbjza4claaj95fpqvvfrysvs10y7dm0pl6qr5lzh6qy1vnhmcgw";
-    };
-  }
-  {
-    goPackagePath = "github.com/ovh/go-ovh";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ovh/go-ovh";
-      rev = "ba5adb4cf014";
-      sha256 = "1rwxib0pn2ni6nfn2sijvb6cd424n95gnqhs21q6mz08n9hnzspy";
-    };
-  }
-  {
-    goPackagePath = "github.com/pascaldekloe/goe";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pascaldekloe/goe";
-      rev = "v0.1.0";
-      sha256 = "1dqd3mfb4z2vmv6pg6fhgvfc53vhndk24wcl9lj1rz02n6m279fq";
-    };
-  }
-  {
-    goPackagePath = "github.com/philhug/opensrs-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/philhug/opensrs-go";
-      rev = "9dfa7433020d";
-      sha256 = "1bjw3llpx5n1srylw08310ch14sz1pw5mban1yakax8606q3dqdf";
-    };
-  }
-  {
-    goPackagePath = "github.com/pierrec/lz4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pierrec/lz4";
-      rev = "v2.0.5";
-      sha256 = "0y5rh7z01zycd59nnjpkqq0ydyjmcg9j1xw15q1i600l9j9g617p";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.9.1";
-      sha256 = "1761pybhc2kqr6v5fm8faj08x9bql8427yqg6vnfv6nhrasx1mwq";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/posener/complete";
-    fetch = {
-      type = "git";
-      url = "https://github.com/posener/complete";
-      rev = "v1.1.1";
-      sha256 = "1nbdiybjizbaxbf5q0xwbq0cjqw4bl6jggvsjzrpif0w86fcjda2";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev = "14fe0d1b01d4";
-      sha256 = "0zdmk6rbbx39cvfz0r59v2jg5sg9yd02b4pds5n5llgvivi99550";
-    };
-  }
-  {
-    goPackagePath = "github.com/renier/xmlrpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/renier/xmlrpc";
-      rev = "ce4a1a486c03";
-      sha256 = "0byvacdwhagva53r2frzqws3f5j7qzigmxzxahpcv300i8pm9i50";
-    };
-  }
-  {
-    goPackagePath = "github.com/robertkrimen/otto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/robertkrimen/otto";
-      rev = "c382bd3c16ff";
-      sha256 = "043y6l647snsz71mdy84s2d3kn22aj6rbqd6c1vd8absvamqhlxa";
-    };
-  }
-  {
-    goPackagePath = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v2.0.1";
-      sha256 = "0nlz7isdd4rgnwzs68499hlwicxz34j2k2a0b8jy0y7ycd2bcr5j";
-    };
-  }
-  {
-    goPackagePath = "github.com/ryanuber/columnize";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ryanuber/columnize";
-      rev = "v2.1.0";
-      sha256 = "0m9jhagb1k44zfcdai76xdf9vpi3bqdl7p078ffyibmz0z9jfap6";
-    };
-  }
-  {
-    goPackagePath = "github.com/ryanuber/go-glob";
-    fetch = {
-      type = "git";
-      url = "https://github.com/ryanuber/go-glob";
-      rev = "v1.0.0";
-      sha256 = "0mhrjy0iba3jr6bsgy7q50zjr42ar1njn1sb2fvihlkhxgb2ahv2";
-    };
-  }
-  {
-    goPackagePath = "github.com/sergi/go-diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sergi/go-diff";
-      rev = "v1.1.0";
-      sha256 = "0ir8ali2vx0j7pipmlfd6k8c973akyy2nmbjrf008fm800zcp7z2";
-    };
-  }
-  {
-    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev = "v1.0.0";
-      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
-    };
-  }
-  {
-    goPackagePath = "github.com/smartystreets/assertions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smartystreets/assertions";
-      rev = "b2de0cb4f26d";
-      sha256 = "1i7ldgavgl35c7gk25p7bvdr282ckng090zr4ch9mk1705akx09y";
-    };
-  }
-  {
-    goPackagePath = "github.com/smartystreets/goconvey";
-    fetch = {
-      type = "git";
-      url = "https://github.com/smartystreets/goconvey";
-      rev = "68dc04aab96a";
-      sha256 = "1kas5v95fzhr88hg4rjy0vp03y4pzvy3pwwgkfz2yhn5nlj29nk6";
-    };
-  }
-  {
-    goPackagePath = "github.com/softlayer/softlayer-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/softlayer/softlayer-go";
-      rev = "5e1c8cccc730";
-      sha256 = "0jsi0f60gx92qm1n2lcz65v425bbqf59dsr0dw4x1wmychp25mk7";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/objx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/objx";
-      rev = "v0.1.0";
-      sha256 = "19ynspzjdynbi85xw06mh8ad5j0qa1vryvxjgvbnyrr8rbm4vd8w";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev = "v1.5.1";
-      sha256 = "09r89m1wy4cjv2nps1ykp00qjpi0531r07q3s34hr7m6njk4srkl";
-    };
-  }
-  {
-    goPackagePath = "github.com/tdewolff/minify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tdewolff/minify";
-      rev = "v2.3.6";
-      sha256 = "0p4v4ab49lm5y438k5aks06fpiagbjw2j2x7i8jaa273mkgicrbb";
-    };
-  }
-  {
-    goPackagePath = "github.com/tdewolff/parse";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tdewolff/parse";
-      rev = "v2.3.4";
-      sha256 = "00hclphbjgc5vjrqgnclp72v8c45k35vmj84d2a0f7bw8cc88zcd";
-    };
-  }
-  {
-    goPackagePath = "github.com/tdewolff/test";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tdewolff/test";
-      rev = "v1.0.6";
-      sha256 = "12glhjb4cwp6yxwd17rwa6b4gxna3lm01bgc7yn9di58chc7lyh3";
-    };
-  }
-  {
-    goPackagePath = "github.com/tiramiseb/go-gandi";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tiramiseb/go-gandi";
-      rev = "e1cf2e430b3a";
-      sha256 = "1m6wzif0dgssh5hzffwqg39789k9nwvj8xaq0d492f0fr14w0nng";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev = "v2.1.1";
-      sha256 = "0znf7pim7xsl8x6pcgi9vm0px48xrqfkw6ysn4yv6xc2569zpjs1";
-    };
-  }
-  {
-    goPackagePath = "github.com/vultr/govultr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/vultr/govultr";
-      rev = "v0.2.0";
-      sha256 = "09103hb2rx93d6vyr54bqdai35d6l5q3klk09k53aqrijp8pycfz";
-    };
-  }
-  {
-    goPackagePath = "go.opencensus.io";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-go";
-      rev = "v0.22.0";
-      sha256 = "05jr8gkr2w34i5wwki4zhl5ch0qrgi7cdgag5iy5gpxplhbrvbg9";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "2aa609cf4a9d";
-      sha256 = "1yvis6fqbsd7f356aqyi18f76vnwj3bry6mxqnkvshq4cwrf92il";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/exp";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/exp";
-      rev = "efd6b22b2522";
-      sha256 = "0ysahwb7p6y09izks4ca8nk2w414gmjxzz44l5rmadlvk3k66cgp";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/image";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/image";
-      rev = "0694c2d4d067";
-      sha256 = "0v4rs4xpi7agbdzjw713mp7gzij8z89058s0yfj3276mzlns3zk4";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/lint";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/lint";
-      rev = "959b441ac422";
-      sha256 = "1mgcv5f00pkzsbwnq2y7vqvd1b4lr5a3s47cphh2qv4indfk7pck";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/mobile";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/mobile";
-      rev = "d3739f865fa6";
-      sha256 = "079ck2dyikacnph9s5mf0hrjnqlk6lc8q64dwnyw45w3xbbc50mg";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/mod";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/mod";
-      rev = "v0.2.0";
-      sha256 = "1fp6885dclq77mh73v7i54v2b9llpv4di193zc8vmsbbkkc483cl";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "0de0cce0169b";
-      sha256 = "1db7s5kbzyh2zd5lpv05n7hp8wbwdvgk0wpiwrlnig94mkr0y5aq";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/oauth2";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/oauth2";
-      rev = "bf48bf16ab8d";
-      sha256 = "1sirdib60zwmh93kf9qrx51r8544k1p9rs5mk0797wibz3m4mrdg";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "cd5d95a43a6e";
-      sha256 = "1nqkyz2y1qvqcma52ijh02s8aiqmkfb95j08f6zcjhbga3ds6hds";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "cb0a6d8edb6c";
-      sha256 = "0xkrf2k6nn1qh64ckrc4rmf1vhkzs0p7f1rnhv4v4pz9mvgh3v6w";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "v0.3.2";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/time";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/time";
-      rev = "9d24e82272b4";
-      sha256 = "1f5nkr4vys2vbd8wrwyiq2f5wcaahhpxmia85d1gshcbqjqf8dkb";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "20ab64c0d93f";
-      sha256 = "1gfhw6daabjy771b3c0k0yga18ja50845n648mgagsa441dxvlch";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/xerrors";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/xerrors";
-      rev = "9bdfabe68543";
-      sha256 = "1yjfi1bk9xb81lqn85nnm13zz725wazvrx3b50hx19qmwg7a4b0c";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/api";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/google-api-go-client";
-      rev = "v0.20.0";
-      sha256 = "13syr1x33k6mrn5w6l4sgdbzn368w3m60vf6kk2j10fwa45125rg";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev = "v1.6.5";
-      sha256 = "05hbq4cs7bqw0zl17bx8rzdkszid3nyl92100scg3jjrg70dhm7w";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/genproto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-genproto";
-      rev = "24fa4b261c55";
-      sha256 = "109zhaqlfd8zkbr1hk6zqbs6vcxfrk64scjwh2nswph05gr0m84d";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/grpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc/grpc-go";
-      rev = "v1.27.0";
-      sha256 = "1ijrmgrxyabfn51nm3p9l81iaasq5fg237wnr6mdc4dzsfcg8kd7";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/asn1-ber.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/asn1-ber.v1";
-      rev = "f715ec2f112d";
-      sha256 = "00ixms8x3lrhywbvq5v2sagcqsxa1pcnlk17dp5lnwckv3xg4psb";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "41f04d3bba15";
-      sha256 = "0vfk9czmlxmp6wndq8k17rhnjxal764mxfhrccza7nwlia760pjy";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/ini.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/ini.v1";
-      rev = "v1.42.0";
-      sha256 = "18ywm8zyv091j1pp5mvx8szl7928chk8lw02br6jy568d7rk4xal";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/ns1/ns1-go.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/ns1/ns1-go.v2";
-      rev = "c563826f4cbe";
-      sha256 = "0swpsy0bdkwqlb7i0fgxs55sdfsy7pbnh6a09crhbw5xldvswq5k";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/sourcemap.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/sourcemap.v1";
-      rev = "v1.0.5";
-      sha256 = "08rf2dl13hbnm3fq2cm0nnsspy9fhf922ln23cz5463cv7h62as4";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/square/go-jose.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/square/go-jose.v2";
-      rev = "v2.3.1";
-      sha256 = "11r93g9xrcjqj7qvq8sbd5hy5rnbpmim0vdsp6rbav8gl7wimaa3";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.8";
-      sha256 = "1inf7svydzscwv9fcjd2rm61a4xjk6jkswknybmns2n58shimapw";
-    };
-  }
-  {
-    goPackagePath = "honnef.co/go/tools";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dominikh/go-tools";
-      rev = "ea95bdfd59fc";
-      sha256 = "1763nw7pwpzkvzfnm63dgzcgbq9hwmq5l1nffchnhh77vgkaq4ic";
-    };
-  }
-  {
-    goPackagePath = "rsc.io/binaryregexp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rsc/binaryregexp";
-      rev = "v0.2.0";
-      sha256 = "1kar0myy85waw418zslviwx8846zj0m9cmqkxjx0fvgjdi70nc4b";
-    };
-  }
-]
diff --git a/pkgs/applications/networking/instant-messengers/rambox/default.nix b/pkgs/applications/networking/instant-messengers/rambox/default.nix
index 1237892ef64c..74a644d189d4 100644
--- a/pkgs/applications/networking/instant-messengers/rambox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/default.nix
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Free and Open Source messaging and emailing app that combines common web applications into one";
-    homepage = "http://rambox.pro";
+    homepage = "https://rambox.pro";
     license = licenses.mit;
     maintainers = with maintainers; [ gnidorah ma27 ];
     platforms = ["i686-linux" "x86_64-linux"];
diff --git a/pkgs/applications/networking/instant-messengers/ricochet/default.nix b/pkgs/applications/networking/instant-messengers/ricochet/default.nix
index 01295697ad3a..de46c891d1fa 100644
--- a/pkgs/applications/networking/instant-messengers/ricochet/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ricochet/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, pkgconfig, makeDesktopItem
+{ mkDerivation, stdenv, fetchurl, pkgconfig, makeDesktopItem
 , qtbase, qttools, qtmultimedia, qtquick1, qtquickcontrols
 , openssl, protobuf, qmake
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "ricochet";
   version = "1.1.4";
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 7295f6c48ad6..c39b199235d1 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.33.1"; # Please backport all updates to the stable channel.
+  version = "1.33.3"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0p9ak0cmk9b77dzbw4y2xmxqg211y62n7ckggwf7bcg48wzj0jy7";
+    sha256 = "1brw1hidmrznb55cb794yvgzin7sf3cxnffivmag4vf2a2vcvf4y";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/swift-im/default.nix b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
index ce59d5746190..953ce2809c43 100644
--- a/pkgs/applications/networking/instant-messengers/swift-im/default.nix
+++ b/pkgs/applications/networking/instant-messengers/swift-im/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, pkgconfig, qttools, scons
+{ mkDerivation, stdenv, fetchurl, pkgconfig, qttools, scons
 , GConf, avahi, boost, hunspell, libXScrnSaver, libedit, libidn, libnatpmp, libxml2
 , lua, miniupnpc, openssl, qtbase, qtmultimedia, qtsvg, qtwebkit, qtx11extras, zlib
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "swift-im";
   version = "4.0.2";
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index 60fd95a14761..6f4099c1d8d5 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -19,12 +19,12 @@ with lib;
 
 mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.0.1";
+  version = "2.1.0";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "0g3jw4can9gmp48s3b8s1w8n9xi54i142y74fszxf9jyq5drzlff";
+    sha256 = "0l5917w90z9pg1al1hzcycb4yxv03vc88jg958ifl9nlvz1arll6";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/tensor/default.nix b/pkgs/applications/networking/instant-messengers/tensor/default.nix
index dcb2c720bc62..1ea249a8b51b 100644
--- a/pkgs/applications/networking/instant-messengers/tensor/default.nix
+++ b/pkgs/applications/networking/instant-messengers/tensor/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchgit, qtbase, qtquickcontrols, qmake, makeDesktopItem }:
+{ mkDerivation, stdenv, fetchgit, qtbase, qtquickcontrols, qmake, makeDesktopItem }:
 
 # we now have libqmatrixclient so a future version of tensor that supports it
 # should use that
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "tensor-git";
   version = "2017-02-21";
 
diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/applications/networking/msmtp/default.nix
index f78b085b6c64..0117ab978cc0 100644
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoreconfHook, pkgconfig, texinfo
+{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, pkgconfig, texinfo
 , netcat-gnu, gnutls, gsasl, libidn2, Security
 , withKeyring ? true, libsecret ? null
 , systemd ? null }:
@@ -16,8 +16,13 @@ in stdenv.mkDerivation rec {
     sha256 = "1rarck61mz3mwg0l30vjj6j9fq6gc7gic0r1c1ppwpq2izj57jzc";
   };
 
+  # the 2nd patch should go when 1.8.9 is released
   patches = [
     ./paths.patch
+    (fetchpatch {
+      url = "https://github.com/marlam/msmtp-mirror/commit/c78f24347ec996c7a3830b48403bf3736afca071.patch";
+      sha256 = "0d4sc2f5838jriv65wahpgvwckkzqhdk3hs660fyg80si2i0l1bx";
+    })
   ];
 
   buildInputs = [ gnutls gsasl libidn2 ]
diff --git a/pkgs/applications/networking/p2p/stig/default.nix b/pkgs/applications/networking/p2p/stig/default.nix
index 325dc653e5b4..6b1a7ace902a 100644
--- a/pkgs/applications/networking/p2p/stig/default.nix
+++ b/pkgs/applications/networking/p2p/stig/default.nix
@@ -1,9 +1,9 @@
 { lib
 , fetchFromGitHub
-, python3
+, python3Packages
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "stig";
   # This project has a different concept for pre release / alpha,
   # Read the project's README for details: https://github.com/rndusr/stig#stig
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
       --replace "urwidtrees>=1.0.3dev0" "urwidtrees"
   '';
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3Packages; [
     urwid
     urwidtrees
     aiohttp
@@ -38,17 +38,23 @@ python3.pkgs.buildPythonApplication rec {
     setproctitle
   ];
 
-  checkInputs = with python3.pkgs; [
+  checkInputs = with python3Packages; [
     asynctest
-    pytest
+    pytestCheckHook
   ];
 
-  # test_string__month_day_hour_minute_second fails on darwin
-  checkPhase = ''
-    LC_ALL=en_US.utf8 pytest tests \
-      --deselect=tests/client_test/ttypes_test.py::TestTimestamp::test_string__month_day_hour_minute_second
+  dontUseSetuptoolsCheck = true;
+
+  preCheck = ''
+    export LC_ALL=C
   '';
 
+  pytestFlagsArray = [
+    "tests"
+    # test_string__month_day_hour_minute_second fails on darwin
+    "--deselect=tests/client_test/ttypes_test.py::TestTimestamp::test_string__month_day_hour_minute_second"
+  ];
+
   meta = with lib; {
     description = "TUI and CLI for the BitTorrent client Transmission";
     homepage = "https://github.com/rndusr/stig";
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
index 8691335d1290..151d652de526 100644
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tixati";
-  version = "2.67";
+  version = "2.72";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "0510wkwmwrlv61958zd5nsc4lr0l0lka3jf4pq3dyiyfsf4k20rq";
+    sha256 = "04si7xwbpvljdbngmzlfvkn51wih3aqcb5g6r76wdh3pfpppskhr";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch b/pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch
deleted file mode 100644
index ede3bc7a6ad3..000000000000
--- a/pkgs/applications/office/elementary-planner/0001-Revert-Add-patch.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From a6d8bd67416c848f9bf52f4746bda34216ae9993 Mon Sep 17 00:00:00 2001
-From: worldofpeace <worldofpeace@protonmail.ch>
-Date: Sun, 19 Apr 2020 12:48:59 -0400
-Subject: [PATCH] Revert "Add patch"
-
-This reverts commit c44127936b785afda0e914da4c1dc1e66a0ac97b.
----
- src/Application.vala | 49 --------------------------------------------
- 1 file changed, 49 deletions(-)
-
-diff --git a/src/Application.vala b/src/Application.vala
-index 43d52fbc..82a9ebe5 100644
---- a/src/Application.vala
-+++ b/src/Application.vala
-@@ -127,66 +127,17 @@ public class Planner : Gtk.Application {
- 
-         utils.apply_theme_changed ();
- 
--        // Set Theme and Icon
-         Gtk.Settings.get_default ().set_property ("gtk-icon-theme-name", "elementary");
-         Gtk.Settings.get_default ().set_property ("gtk-theme-name", "elementary");
- 
--        // Path Theme
--        var command = new Granite.Services.SimpleCommand (".", "echo $DESKTOP_SESSION");
--        command.run ();
--        command.output_changed.connect ((text) => {
--            print ("DESKTOP_SESSION: %s\n".printf (text));
--        });
--
--        if (get_os_info ("PRETTY_NAME") == null || get_os_info ("PRETTY_NAME").index_of ("elementary") == -1) {
--            string CSS = """
--                window decoration {
--                    box-shadow: none;
--                    margin: 1px;
--                }
--            """;
--
--            var _provider = new Gtk.CssProvider ();
--            _provider.load_from_data (CSS, CSS.length);
--
--            Gtk.StyleContext.add_provider_for_screen (
--                Gdk.Screen.get_default (), _provider,
--                Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION
--            );
--        }
--
-         // Set shortcut
-         string quick_add_shortcut = settings.get_string ("quick-add-shortcut");
-         if (quick_add_shortcut == "") {
-             quick_add_shortcut = "<Primary>Tab";
-             settings.set_string ("quick-add-shortcut", quick_add_shortcut);
-         }
--
-         utils.set_quick_add_shortcut (quick_add_shortcut);
-     }
--    
--    public string get_os_info (string field) {
--        string return_value = "";
--        var file = File.new_for_path ("/etc/os-release");
--        try {
--            var osrel = new Gee.HashMap<string, string> ();
--            var dis = new DataInputStream (file.read ());
--            string line;
--            // Read lines until end of file (null) is reached
--            while ((line = dis.read_line (null)) != null) {
--                var osrel_component = line.split ("=", 2);
--                if (osrel_component.length == 2) {
--                    osrel[osrel_component[0]] = osrel_component[1].replace ("\"", "");
--                }
--            }
--
--            return_value = osrel[field];
--        } catch (Error e) {
--            warning ("Couldn't read os-release file, assuming elementary OS");
--        }
--        
--        return return_value;
--    }
- 
-     public override int command_line (ApplicationCommandLine command_line) {
-         bool silence_mode = false;
--- 
-2.25.1
-
diff --git a/pkgs/applications/office/elementary-planner/default.nix b/pkgs/applications/office/elementary-planner/default.nix
index b01c34d5a0ed..3e3765ca77f6 100644
--- a/pkgs/applications/office/elementary-planner/default.nix
+++ b/pkgs/applications/office/elementary-planner/default.nix
@@ -1,6 +1,12 @@
-{ stdenv, fetchFromGitHub, fetchpatch
-, meson, ninja, pkgconfig, desktop-file-utils
-, python3, vala, wrapGAppsHook
+{ stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkgconfig
+, desktop-file-utils
+, python3
+, vala
+, wrapGAppsHook
 , evolution-data-server
 , libical
 , libgee
@@ -15,25 +21,15 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-planner";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planner";
     rev = version;
-    sha256 = "1kjk1zafx71zmax3whzpx6mzl037wlxri30bl2k9y9rg3fd09arr";
+    sha256 = "1jc668hg26vb1q50abm6k566v9qimgs9skkwmlgi5h37vxm3ai1x";
   };
 
-  patches = [
-    # Revert a patch the works around some stylesheet issues:
-    # https://github.com/alainm23/planner/issues/268
-    # https://github.com/alainm23/planner/issues/303
-    # The don't seem to be a problem with Pantheon on NixOS
-    # and for some reason produce the opposite effect with
-    # pantheon's stylesheet.
-    ./0001-Revert-Add-patch.patch
-  ];
-
   nativeBuildInputs = [
     desktop-file-utils
     meson
@@ -63,8 +59,15 @@ stdenv.mkDerivation rec {
     patchShebangs build-aux/meson/post_install.py
   '';
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # the theme is hardcoded
+      --prefix XDG_DATA_DIRS : "${pantheon.elementary-gtk-theme}/share"
+    )
+  '';
+
   meta = with stdenv.lib; {
-    description = "Task and project manager designed to elementary OS";
+    description = "Task manager with Todoist support designed for GNU/Linux 🚀️";
     homepage = "https://planner-todo.web.app";
     license = licenses.gpl3;
     maintainers = with maintainers; [ dtzWill ] ++ pantheon.maintainers;
diff --git a/pkgs/applications/office/scribus/unstable.nix b/pkgs/applications/office/scribus/unstable.nix
index d6084c0f37e7..aa0c2dee9790 100644
--- a/pkgs/applications/office/scribus/unstable.nix
+++ b/pkgs/applications/office/scribus/unstable.nix
@@ -116,7 +116,7 @@ mkDerivation rec {
     ];
     platforms = platforms.linux;
     description = "Desktop Publishing (DTP) and Layout program for Linux";
-    homepage = "http://www.scribus.net";
+    homepage = "https://www.scribus.net";
     # There are a lot of licenses... https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
     license = with licenses; [
       bsd3
diff --git a/pkgs/applications/science/biology/quast/default.nix b/pkgs/applications/science/biology/quast/default.nix
new file mode 100644
index 000000000000..e3c3ea23c2c0
--- /dev/null
+++ b/pkgs/applications/science/biology/quast/default.nix
@@ -0,0 +1,58 @@
+{ stdenv, fetchurl, python3Packages, zlib, bash, coreutils }:
+
+let
+  pythonPackages = python3Packages;
+  inherit (pythonPackages) python;
+in
+
+pythonPackages.buildPythonApplication rec {
+  pname = "quast";
+  version = "5.0.2";
+
+  src = fetchurl {
+    url = "https://github.com/ablab/quast/releases/download/${pname}_${version}/${pname}-${version}.tar.gz";
+    sha256 = "13ml8qywbb4cc7wf2x7z5mz1rjqg51ab8wkizwcg4f6c40zgif6d";
+  };
+
+  pythonPath = with pythonPackages; [ simplejson joblib setuptools matplotlib ];
+
+  nativeBuildInputs = [ coreutils ];
+
+  buildInputs = [ zlib ] ++ pythonPath;
+
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    substituteInPlace quast_libs/bedtools/Makefile \
+      --replace "/bin/bash" "${bash}/bin/bash"
+    mkdir -p "$out/${python.sitePackages}"
+    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
+    ${python.interpreter} setup.py install \
+      --install-lib=$out/${python.sitePackages} \
+      --prefix="$out"
+  '';
+
+   postFixup = ''
+   for file in $(find $out -type f -type f -perm /0111); do
+       old_rpath=$(patchelf --print-rpath $file) && \
+       patchelf --set-rpath $old_rpath:${stdenv.cc.cc.lib}/lib $file || true
+   done
+   # Link to the master program
+   ln -s $out/bin/quast.py $out/bin/quast
+  '';
+
+  dontPatchELF = true;
+
+  # Tests need to download data files, so manual run after packaging is needed
+  doCheck = false;
+
+  meta = with stdenv.lib ; {
+    description = "Evaluates genome assemblies by computing various metrics";
+    homepage = "https://github.com/ablab/quast";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/science/electronics/caneda/default.nix b/pkgs/applications/science/electronics/caneda/default.nix
index 6f832013e8ca..c90ceac6788f 100644
--- a/pkgs/applications/science/electronics/caneda/default.nix
+++ b/pkgs/applications/science/electronics/caneda/default.nix
@@ -1,6 +1,6 @@
-{stdenv, fetchFromGitHub, cmake, qtbase, qttools, qtsvg, qwt }:
+{ mkDerivation, stdenv, fetchFromGitHub, cmake, qtbase, qttools, qtsvg, qwt }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "caneda";
   version = "0.3.1";
 
diff --git a/pkgs/applications/science/logic/verifast/default.nix b/pkgs/applications/science/logic/verifast/default.nix
index c5e8078eff2a..49618d2586b1 100644
--- a/pkgs/applications/science/logic/verifast/default.nix
+++ b/pkgs/applications/science/logic/verifast/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Verification for C and Java programs via separation logic";
     homepage    = "http://people.cs.kuleuven.be/~bart.jacobs/verifast/";
-    license     = stdenv.lib.licenses.msrla;
+    license     = stdenv.lib.licenses.mit;
     platforms   = [ "x86_64-linux" ];
     maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
   };
diff --git a/pkgs/applications/science/misc/rink/default.nix b/pkgs/applications/science/misc/rink/default.nix
index 839fc8f95463..5d592c233b62 100644
--- a/pkgs/applications/science/misc/rink/default.nix
+++ b/pkgs/applications/science/misc/rink/default.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with stdenv.lib; {
     description = "Unit-aware calculator";
-    homepage = "http://rink.tiffnix.com";
+    homepage = "https://rink.tiffnix.com";
     license = with licenses; [ mpl20 gpl3 ];
     maintainers = with maintainers; [ sb0 filalex77 ];
   };
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 34bdaf6bacf8..e54dc785b08e 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -28,7 +28,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json
 
   meta = with stdenv.lib; {
-    homepage = "http://snakemake.bitbucket.io";
+    homepage = "https://snakemake.bitbucket.io";
     license = licenses.mit;
     description = "Python-based execution environment for make-like workflows";
     longDescription = ''
diff --git a/pkgs/applications/science/robotics/mavproxy/default.nix b/pkgs/applications/science/robotics/mavproxy/default.nix
index 0348d0153099..c354dad80428 100644
--- a/pkgs/applications/science/robotics/mavproxy/default.nix
+++ b/pkgs/applications/science/robotics/mavproxy/default.nix
@@ -3,11 +3,11 @@
 
 buildPythonApplication rec {
   pname = "MAVProxy";
-  version = "1.8.18";
+  version = "1.8.19";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1fi4m3591wws5cq43q8aljf91mzs6i9yhn9rimhpfrskbyf9knvm";
+    sha256 = "1rbq2nm01212rp5xbl8p8kjl2mpgfppkwjsq3lnfw1v6g0m4359h";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/version-management/arch/default.nix b/pkgs/applications/version-management/arch/default.nix
index 2108afc51062..d41040f49a06 100644
--- a/pkgs/applications/version-management/arch/default.nix
+++ b/pkgs/applications/version-management/arch/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "tla-1.3.5";
   
   src = fetchurl {
-    url = "ftp://ftp.gnu.org/old-gnu/gnu-arch/" + name + ".tar.gz";
+    url = "https://ftp.gnu.org/old-gnu/gnu-arch/" + name + ".tar.gz";
     sha256 = "01mfzj1i6p4s8191cgd5850hds1zls88hkf9rb6qx1vqjv585aj0";
   };
 
diff --git a/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix b/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix
index ae064cb7b5ed..c073edaee7d8 100644
--- a/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "diff-so-fancy";
-  version = "1.2.7";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "so-fancy";
     repo = "diff-so-fancy";
     rev = "v${version}";
-    sha256 = "0y5cp236gi6h7llzai5d27086l4zz58mz1zs01r97xnnmjs9vw21";
+    sha256 = "0aavxahzha2mms4vdwysk79pa6wzswpfwgsq2hwaxnaf66maahfl";
   };
 
   # Perl is needed here for patchShebangs
diff --git a/pkgs/applications/version-management/git-and-tools/gh/default.nix b/pkgs/applications/version-management/git-and-tools/gh/default.nix
index acd09f0d0c0d..597e0672073b 100644
--- a/pkgs/applications/version-management/git-and-tools/gh/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gh/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "0.6.4";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "0na8zfvcmdy968i47x6qd1jwfaphy5h18ff7ym5sxyia9a27yhf8";
+    sha256 = "054mag8jgxkvx2f95ha10n45v4xv5lms69w76g95z18m62qhjcyl";
   };
 
-  modSha256 = "102v30wr9wmd6n20qdvgs5mp2s639pwbqqd71r8q52f42p694bi1";
+  modSha256 = "0v33x9bnwjfg4425vralnsb4i22c0g1rcmaga9911v0i7d51k0fn";
 
   buildFlagsArray = [
-    "-ldflags=-X github.com/cli/cli/command.Version=${version}"
+    "-ldflags=-s -w -X github.com/cli/cli/command.Version=${version}"
   ];
 
   subPackages = [ "cmd/gh" ];
diff --git a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
index aaf22c940cb1..32350fa538db 100644
--- a/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-gone/default.nix
@@ -1,23 +1,27 @@
-{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, makeWrapper, openssl, git, libiconv, Security }:
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, makeWrapper, openssl, git, libiconv, Security, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-gone";
-  version = "0.3.0";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "lunaryorn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "05wlng563p9iy0ky3z23a4jakcix887fb45r7j2mk0fp5ykdjmzh";
+    sha256 = "0zc4cb1dg30np5yc4ymkr894qs2bk0r123i302md00niayk4njyd";
   };
 
-  cargoSha256 = "1scp9rzn59akxsf9p48j1zq6clbwdyasnyi4j28nj03ghvdv2i33";
+  cargoSha256 = "1d892889ml7sqyxzmjipq5fvizb4abqhmmn450qm7yam9fn5q5wf";
 
-  nativeBuildInputs = [ pkgconfig makeWrapper ];
+  nativeBuildInputs = [ pkgconfig makeWrapper installShellFiles ];
 
   buildInputs = [ openssl ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
 
+  postInstall = ''
+    installManPage git-gone.1
+  '';
+
   postFixup = ''
     wrapProgram $out/bin/git-gone --prefix PATH : "${stdenv.lib.makeBinPath [ git ]}"
   '';
diff --git a/pkgs/applications/video/bomi/default.nix b/pkgs/applications/video/bomi/default.nix
index 7ba37936c686..d812ac488742 100644
--- a/pkgs/applications/video/bomi/default.nix
+++ b/pkgs/applications/video/bomi/default.nix
@@ -1,7 +1,7 @@
-{ config, stdenv, fetchFromGitHub
+{ mkDerivation, config, stdenv, fetchFromGitHub
 , fetchpatch, pkgconfig, perl, python, which
 , libX11, libxcb, libGLU, libGL
-, qtbase, qtdeclarative, qtquickcontrols, qttools, qtx11extras, qmake, makeWrapper
+, qtbase, qtdeclarative, qtquickcontrols, qttools, qtx11extras, qmake
 , libchardet
 , ffmpeg
 
@@ -29,7 +29,7 @@ assert pulseSupport -> libpulseaudio != null;
 assert cddaSupport -> libcdda != null;
 assert youtubeSupport -> youtube-dl != null;
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "bomi";
   version = "0.9.11";
 
@@ -90,8 +90,9 @@ stdenv.mkDerivation rec {
     patchShebangs build-mpv
   '';
 
+  dontWrapQtApps = true;
   postInstall = ''
-    wrapProgram $out/bin/bomi \
+    wrapQtApp $out/bin/bomi \
       ${optionalString youtubeSupport "--prefix PATH ':' '${youtube-dl}/bin'"}
   '';
 
@@ -105,7 +106,7 @@ stdenv.mkDerivation rec {
                    ++ optional cddaSupport "--enable-cdda"
                    ;
 
-  nativeBuildInputs = [ makeWrapper pkgconfig perl python which qttools qmake ];
+  nativeBuildInputs = [ pkgconfig perl python which qttools qmake ];
 
   meta = with stdenv.lib; {
     description = "Powerful and easy-to-use multimedia player";
diff --git a/pkgs/applications/video/qmediathekview/default.nix b/pkgs/applications/video/qmediathekview/default.nix
index 160066688462..7556727a80d3 100644
--- a/pkgs/applications/video/qmediathekview/default.nix
+++ b/pkgs/applications/video/qmediathekview/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, qtbase, qttools, xz, boost, qmake, pkgconfig }:
+{ mkDerivation, stdenv, fetchFromGitHub, qtbase, qttools, xz, boost, qmake, pkgconfig }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "QMediathekView";
   version = "2019-01-06";
 
diff --git a/pkgs/applications/video/qstopmotion/default.nix b/pkgs/applications/video/qstopmotion/default.nix
index e2243797a3bc..4a6d2a05a670 100644
--- a/pkgs/applications/video/qstopmotion/default.nix
+++ b/pkgs/applications/video/qstopmotion/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, qt5, ffmpeg, guvcview, cmake, ninja, libxml2
+{ mkDerivation, stdenv, fetchurl, qt5, ffmpeg, guvcview, cmake, ninja, libxml2
 , gettext, pkgconfig, libgphoto2, gphoto2, v4l-utils, libv4l, pcre
 , qwt, extra-cmake-modules }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "qstopmotion";
   version = "2.4.1";
 
diff --git a/pkgs/applications/virtualization/aqemu/default.nix b/pkgs/applications/virtualization/aqemu/default.nix
index f98b8eefd78a..9177f2645028 100644
--- a/pkgs/applications/virtualization/aqemu/default.nix
+++ b/pkgs/applications/virtualization/aqemu/default.nix
@@ -1,7 +1,7 @@
-{ cmake, fetchFromGitHub, libvncserver, qemu, qtbase, stdenv
+{ mkDerivation, cmake, fetchFromGitHub, libvncserver, qemu, qtbase, stdenv
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "aqemu";
   version = "0.9.2";
 
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index 3ee467cd290d..74a316ef52a1 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -57,7 +57,7 @@ in buildGoPackage rec {
     description = ''Open Container Initiative-based implementation of the
                     Kubernetes Container Runtime Interface'';
     license = licenses.asl20;
-    maintainers = with maintainers; [ saschagrunert ];
+    maintainers = with maintainers; [ ] ++ teams.podman.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix
index 28614efa7f3b..38ce277bf3ff 100644
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, rustPlatform, fetchgit, runCommand, symlinkJoin
-, pkgconfig, minijail, dtc, libusb1, libcap
+{ stdenv, lib, rustPlatform, fetchgit, runCommand, symlinkJoin
+, pkgconfig, minijail, dtc, libusb1, libcap, linux
 }:
 
 let
@@ -53,7 +53,7 @@ in
       ./default-seccomp-policy-dir.diff
     ];
 
-    cargoSha256 = "1s9nfgfqk140hg08i0xzylnrgrx84dqss0vnvhxnydwy9q03nk7r";
+    cargoSha256 = "0lhivwvdihslwp81i3sa5q88p5hr83bzkvklrcgf6x73arwk8kdz";
 
     nativeBuildInputs = [ pkgconfig ];
 
@@ -73,13 +73,17 @@ in
       cp seccomp/${arch}/* $out/share/policy/
     '';
 
+    CROSVM_CARGO_TEST_KERNEL_BINARY =
+      lib.optionalString (stdenv.buildPlatform == stdenv.hostPlatform)
+        "${linux}/${stdenv.hostPlatform.platform.kernelTarget}";
+
     passthru = {
       inherit adhdSrc;
       src = crosvmSrc;
       updateScript = ./update.py;
     };
 
-    meta = with stdenv.lib; {
+    meta = with lib; {
       description = "A secure virtual machine monitor for KVM";
       homepage = "https://chromium.googlesource.com/chromiumos/platform/crosvm/";
       maintainers = with maintainers; [ qyliss ];
diff --git a/pkgs/applications/virtualization/crosvm/update.py b/pkgs/applications/virtualization/crosvm/update.py
index 280d6ec18119..29e68b9f5790 100755
--- a/pkgs/applications/virtualization/crosvm/update.py
+++ b/pkgs/applications/virtualization/crosvm/update.py
@@ -17,7 +17,7 @@ components = ['chromiumos/platform/crosvm', 'chromiumos/third_party/adhd']
 
 git_root = 'https://chromium.googlesource.com/'
 manifest_versions = f'{git_root}chromiumos/manifest-versions'
-buildspecs_url = f'{manifest_versions}/+/refs/heads/master/paladin/buildspecs/'
+buildspecs_url = f'{manifest_versions}/+/refs/heads/master/full/buildspecs/'
 
 # CrOS version numbers look like this:
 # [<chrome-major-version>.]<tip-build>.<branch-build>.<branch-branch-build>
diff --git a/pkgs/applications/virtualization/crosvm/upstream-info.json b/pkgs/applications/virtualization/crosvm/upstream-info.json
index 690eca38bffb..bb9cc8841b4a 100644
--- a/pkgs/applications/virtualization/crosvm/upstream-info.json
+++ b/pkgs/applications/virtualization/crosvm/upstream-info.json
@@ -1,19 +1,23 @@
 {
-  "version": "79.12607.0.0-rc4",
+  "version": "81.12871.0.0-rc1",
   "components": {
     "chromiumos/platform/crosvm": {
       "url": "https://chromium.googlesource.com/chromiumos/platform/crosvm",
-      "rev": "cfb7db44eb9e5a0bca9a22bfb985252ef74ab251",
-      "date": "2019-10-17T23:22:08+00:00",
-      "sha256": "0gm1ggyzh9qfizm36jmh71c3anygxj1840cm94h71kzg9kiw0330",
-      "fetchSubmodules": false
+      "rev": "8b8c01e1ad31718932491e4aee63f56109a138e2",
+      "date": "2020-01-25T02:28:10+00:00",
+      "sha256": "1qmf1k06pwynh15c3nr9m6v90z2pkk930xniwvlvbvnazrk4rllg",
+      "fetchSubmodules": false,
+      "deepClone": false,
+      "leaveDotGit": false
     },
     "chromiumos/third_party/adhd": {
       "url": "https://chromium.googlesource.com/chromiumos/third_party/adhd",
-      "rev": "a8df1c52bde3bfd2aebc1d7adcd6f195eb212cb1",
-      "date": "2019-10-17T18:53:18+00:00",
-      "sha256": "1hyvnvwr5ka9zw4h7hhl6fpsfl2acp3zy4wr5qrw8s1cn8ljr9vy",
-      "fetchSubmodules": false
+      "rev": "f361d5b02623274723bff251dafa1e2a2887b013",
+      "date": "2020-01-23T18:37:46+00:00",
+      "sha256": "1p8iwjwgmcgmzri03ik2jaid8l0ch0bzn6z9z64dix1hlrvrlliw",
+      "fetchSubmodules": false,
+      "deepClone": false,
+      "leaveDotGit": false
     }
   }
 }
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 5108c272a1c2..2c1ad0b42970 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -9,6 +9,7 @@
 , libseccomp
 , systemd
 , go-md2man
+, nixosTests
 }:
 
 buildGoPackage rec {
@@ -45,6 +46,8 @@ buildGoPackage rec {
     MANDIR=$man/share/man make install.man
   '';
 
+  passthru.tests.podman = nixosTests.podman;
+
   meta = with stdenv.lib; {
     homepage = "https://podman.io/";
     description = "A program for managing pods, containers and container images";
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 9d784d88a4f5..df7b81a43c8a 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -19,10 +19,9 @@ with stdenv.lib;
 let
   python = python3;
   buildType = "release";
-  # Remember to change the extpackRev and version in extpack.nix and
-  # guest-additions/default.nix as well.
-  main = "59f8f5774473f593e3eb5940e2a337e0674bcd9854164b2578fd43f896260c99";
-  version = "6.1.4";
+  # Use maintainers/scripts/update.nix to update the version and all related hashes or
+  # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
+  version = "6.1.6";
 
   iasl' = iasl.overrideAttrs (old: rec {
     inherit (old) pname;
@@ -39,7 +38,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.virtualbox.org/virtualbox/${version}/VirtualBox-${version}.tar.bz2";
-    sha256 = main;
+    sha256 = "b031c30d770f28c5f884071ad933e8c1f83e65b93aaba03a4012077c1d90a54f";
   };
 
   outputs = [ "out" "modsrc" ];
@@ -108,6 +107,10 @@ in stdenv.mkDerivation {
   postPatch = ''
     sed -i -e 's|/sbin/ifconfig|${nettools}/bin/ifconfig|' \
       src/VBox/HostDrivers/adpctl/VBoxNetAdpCtl.cpp
+  '' + optionalString headless ''
+    # Fix compile error in version 6.1.6
+    substituteInPlace src/VBox/HostServices/SharedClipboard/VBoxSharedClipboardSvc-x11-stubs.cpp \
+      --replace PSHCLFORMATDATA PSHCLFORMATS
   '';
 
   # first line: ugly hack, and it isn't yet clear why it's a problem
@@ -216,6 +219,7 @@ in stdenv.mkDerivation {
   passthru = {
     inherit version;       # for guest additions
     inherit extensionPack; # for inclusion in profile to prevent gc
+    updateScript = ./update.sh;
   };
 
   meta = {
diff --git a/pkgs/applications/virtualization/virtualbox/extpack.nix b/pkgs/applications/virtualization/virtualbox/extpack.nix
index d50d3b59e24b..c9918b1cedf4 100644
--- a/pkgs/applications/virtualization/virtualbox/extpack.nix
+++ b/pkgs/applications/virtualization/virtualbox/extpack.nix
@@ -12,7 +12,7 @@ fetchurl rec {
     # Manually sha256sum the extensionPack file, must be hex!
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
-    let value = "3b73798d776ff223ea8025b1a45001762f8d4e5bcd1ea61449773c1249935800";
+    let value = "80b96b4b51a502141f6a8981f1493ade08a00762622c39e48319e5b122119bf3";
     in assert (builtins.stringLength value) == 64; value;
 
   meta = {
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index fdb393a94ebe..4275bc0542e8 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -26,7 +26,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://download.virtualbox.org/virtualbox/${version}/VBoxGuestAdditions_${version}.iso";
-    sha256 = "e2846a7576cce1b92a7c0744f41eaac750248d6e31dfca5c45d5766648b394c7";
+    sha256 = "bcde4691dea7de93b65a10a43dda2b8f52e570f820992ad281c9bb5c8dede181";
   };
 
   KERN_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
diff --git a/pkgs/applications/virtualization/virtualbox/update.py b/pkgs/applications/virtualization/virtualbox/update.py
deleted file mode 100755
index 6e8bfd5c8250..000000000000
--- a/pkgs/applications/virtualization/virtualbox/update.py
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p python3
-
-import os
-import re
-import json
-import urllib.request
-
-from distutils.version import LooseVersion
-
-UPSTREAM_INFO_FILE = os.path.join(
-    os.path.dirname(os.path.abspath(__file__)),
-    "upstream-info.json"
-)
-
-
-def fetch_latest_version():
-    url = "http://download.virtualbox.org/virtualbox/LATEST.TXT"
-    return urllib.request.urlopen(url).read().strip().decode()
-
-
-def load_upstream_info():
-    try:
-        with open(UPSTREAM_INFO_FILE, 'r') as fp:
-            return json.load(fp)
-    except FileNotFoundError:
-        return {'version': "0"}
-
-
-def save_upstream_info(contents):
-    remark = "Generated using update.py from the same directory."
-    contents['__NOTE'] = remark
-    data = json.dumps(contents, indent=2, sort_keys=True)
-    with open(UPSTREAM_INFO_FILE, 'w') as fp:
-        fp.write(data + "\n")
-
-
-def fetch_file_table(version):
-    url = "http://download.virtualbox.org/virtualbox/{}/SHA256SUMS"
-    url = url.format(version)
-    result = {}
-    for line in urllib.request.urlopen(url):
-        sha, name = line.rstrip().split()
-        result[name.lstrip(b'*').decode()] = sha.decode()
-    return result
-
-
-def update_to_version(version):
-    extpack_start = 'Oracle_VM_VirtualBox_Extension_Pack-'
-    version_re = version.replace('.', '\\.')
-    attribute_map = {
-        'extpack': r'^' + extpack_start + r'[^-]+-[^.]+.vbox-extpack$',
-        'extpackRev': r'^' + extpack_start + r'[^-]+-([^.]+).vbox-extpack$',
-        'main': r'^VirtualBox-' + version_re + r'.tar.bz2$',
-        'guest': r'^VBoxGuestAdditions_' + version_re + r'.iso$',
-    }
-    table = fetch_file_table(version)
-    new_attrs = {'version': version}
-    for attr, searchexpr in attribute_map.items():
-        result = [re.search(searchexpr, key) for key in table.keys()]
-        filtered = filter(lambda m: m is not None, result)
-        found = [m.groups()[0] if len(m.groups()) > 0 else table[m.group(0)]
-                 for m in filtered if m is not None]
-
-        if len(found) == 0:
-            msg = "No package found for attribute {}".format(attr)
-            raise AssertionError(msg)
-        elif len(found) != 1:
-            msg = "More than one package found for attribute {}: ".format(attr)
-            msg += ', '.join(found)
-            raise AssertionError(msg)
-        else:
-            new_attrs[attr] = found[0]
-    return new_attrs
-
-
-info = load_upstream_info()
-latest = fetch_latest_version()
-if LooseVersion(info['version']) < LooseVersion(latest):
-    print("Updating to version {}...".format(latest), end="", flush=True)
-    new_attrs = update_to_version(latest)
-    save_upstream_info(new_attrs)
-    print(" done.")
-else:
-    print("Version {} is already the latest one.".format(info['version']))
diff --git a/pkgs/applications/virtualization/virtualbox/update.sh b/pkgs/applications/virtualization/virtualbox/update.sh
new file mode 100755
index 000000000000..fcd02ae8a27b
--- /dev/null
+++ b/pkgs/applications/virtualization/virtualbox/update.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts nix-prefetch-scripts jq
+
+set -xeuo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+
+attr=virtualbox
+oldVersion="$(nix-instantiate --eval -E "with import $nixpkgs {}; $attr.version or (builtins.parseDrvName $attr.name).version" | tr -d '"')"
+latestVersion="$(curl -sS https://download.virtualbox.org/virtualbox/LATEST.TXT)"
+
+function fileShaSum() {
+  echo "$1" | grep -w $2 | cut -f1 -d' '
+}
+function oldHash() {
+  nix-instantiate --eval --strict -A "$1.drvAttrs.outputHash" | tr -d '"'
+}
+function nixFile() {
+  nix-instantiate --eval --strict -A "${1}.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/'
+}
+
+if [ ! "$oldVersion" = "$latestVersion" ]; then
+  shaSums=$(curl -sS https://download.virtualbox.org/virtualbox/$latestVersion/SHA256SUMS)
+
+  virtualBoxShaSum=$(fileShaSum "$shaSums" "VirtualBox-$latestVersion.tar.bz2")
+  extpackShaSum=$(fileShaSum "$shaSums" "Oracle_VM_VirtualBox_Extension_Pack-$latestVersion.vbox-extpack")
+  guestAdditionsShaSum=$(fileShaSum "$shaSums" "*VBoxGuestAdditions_$latestVersion.iso")
+
+  virtualboxNixFile=$(nixFile ${attr})
+  extpackNixFile=$(nixFile ${attr}Extpack)
+  guestAdditionsNixFile=$(nixFile linuxPackages.${attr}GuestAdditions)
+
+  extpackOldShaSum=$(oldHash ${attr}Extpack)
+  guestAdditionsOldShaSum=$(oldHash linuxPackages.${attr}GuestAdditions.src)
+
+  update-source-version $attr $latestVersion $virtualBoxShaSum
+  sed -i -e 's|value = "'$extpackOldShaSum'"|value = "'$extpackShaSum'"|' $extpackNixFile
+  sed -i -e 's|sha256 = "'$guestAdditionsOldShaSum'"|sha256 = "'$guestAdditionsShaSum'"|' $guestAdditionsNixFile
+
+  git add $virtualboxNixFile $extpackNixFile $guestAdditionsNixFile
+  git commit -m "$attr: ${oldVersion} -> ${latestVersion}"
+else
+  echo "$attr is already up-to-date"
+fi
diff --git a/pkgs/applications/window-managers/sway/wrapper.nix b/pkgs/applications/window-managers/sway/wrapper.nix
index 7c59b8b7cde4..3e12e3fcc55f 100644
--- a/pkgs/applications/window-managers/sway/wrapper.nix
+++ b/pkgs/applications/window-managers/sway/wrapper.nix
@@ -14,8 +14,8 @@ let
   baseWrapper = writeShellScriptBin "sway" ''
      set -o errexit
      if [ ! "$_SWAY_WRAPPER_ALREADY_EXECUTED" ]; then
-       export _SWAY_WRAPPER_ALREADY_EXECUTED=1
        ${extraSessionCommands}
+       export _SWAY_WRAPPER_ALREADY_EXECUTED=1
      fi
      if [ "$DBUS_SESSION_BUS_ADDRESS" ]; then
        export DBUS_SESSION_BUS_ADDRESS