about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CONTRIBUTING.md4
-rw-r--r--README.md4
-rw-r--r--doc/languages-frameworks/texlive.xml27
-rw-r--r--doc/stdenv/stdenv.xml10
-rw-r--r--lib/licenses.nix5
-rw-r--r--nixos/doc/manual/installation/upgrading.xml16
-rw-r--r--nixos/doc/manual/release-notes/rl-2003.xml2
-rw-r--r--nixos/modules/config/fonts/fontconfig.nix5
-rw-r--r--nixos/modules/config/networking.nix2
-rw-r--r--nixos/modules/hardware/opengl.nix26
-rw-r--r--nixos/modules/installer/tools/nixos-generate-config.pl8
-rw-r--r--nixos/modules/services/system/nscd.nix12
-rw-r--r--nixos/modules/services/web-apps/dokuwiki.nix508
-rw-r--r--nixos/modules/services/x11/gdk-pixbuf.nix4
-rw-r--r--nixos/modules/system/boot/systemd.nix14
-rw-r--r--nixos/modules/virtualisation/containers.nix18
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/containers-custom-pkgs.nix42
-rw-r--r--nixos/tests/dokuwiki.nix83
-rw-r--r--pkgs/applications/audio/gbsplay/default.nix6
-rw-r--r--pkgs/applications/audio/hydrogen/unstable.nix34
-rw-r--r--pkgs/applications/editors/emacs/default.nix7
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/misc/alacritty/default.nix6
-rw-r--r--pkgs/applications/misc/ausweisapp2/default.nix27
-rw-r--r--pkgs/applications/misc/birdtray/default.nix13
-rw-r--r--pkgs/applications/misc/lutris/chrootenv.nix2
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cni/default.nix9
-rw-r--r--pkgs/applications/networking/cluster/cni/plugins-deps.nix210
-rw-r--r--pkgs/applications/networking/cluster/cni/plugins.nix28
-rw-r--r--pkgs/applications/networking/ids/zeek/default.nix6
-rw-r--r--pkgs/applications/networking/lieer/default.nix (renamed from pkgs/applications/networking/gmailieer/default.nix)12
-rw-r--r--pkgs/applications/office/libreoffice/default.nix5
-rw-r--r--pkgs/applications/office/libreoffice/src-fresh/download.nix8
-rw-r--r--pkgs/applications/office/libreoffice/src-fresh/primary.nix10
-rw-r--r--pkgs/applications/science/electronics/verilator/default.nix4
-rw-r--r--pkgs/applications/science/logic/beluga/default.nix38
-rw-r--r--pkgs/applications/version-management/git-and-tools/git/default.nix2
-rw-r--r--pkgs/applications/video/kodi/default.nix74
-rw-r--r--pkgs/applications/video/plex-media-player/default.nix41
-rw-r--r--pkgs/applications/video/plex-media-player/deps.nix28
-rwxr-xr-xpkgs/applications/video/plex-media-player/update.sh71
-rw-r--r--pkgs/applications/virtualization/conmon/default.nix6
-rw-r--r--pkgs/applications/virtualization/qtemu/default.nix45
-rw-r--r--pkgs/build-support/alternatives/blas/default.nix2
-rw-r--r--pkgs/build-support/cc-wrapper/add-flags.sh5
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix15
-rw-r--r--pkgs/build-support/cc-wrapper/gnat-wrapper.sh165
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh4
-rw-r--r--pkgs/data/icons/hicolor-icon-theme/setup-hook.sh3
-rw-r--r--pkgs/data/themes/arc/default.nix1
-rw-r--r--pkgs/data/themes/yaru/default.nix1
-rw-r--r--pkgs/desktops/gnome-3/core/epiphany/default.nix1
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell/default.nix5
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-shell/fix-bash-completion.patch10
-rw-r--r--pkgs/development/compilers/gcc/6/default.nix11
-rw-r--r--pkgs/development/compilers/gcc/9/default.nix10
-rw-r--r--pkgs/development/compilers/gcc/builder.sh1
-rw-r--r--pkgs/development/compilers/gcc/common/configure-flags.nix5
-rw-r--r--pkgs/development/compilers/gcc/common/pre-configure.nix9
-rw-r--r--pkgs/development/compilers/gcc/gnat-cflags.patch35
-rw-r--r--pkgs/development/compilers/ghdl/default.nix40
-rw-r--r--pkgs/development/compilers/gnatboot/default.nix51
-rw-r--r--pkgs/development/compilers/ldc/binary.nix41
-rw-r--r--pkgs/development/compilers/ldc/bootstrap.nix10
-rw-r--r--pkgs/development/compilers/ldc/default.nix174
-rw-r--r--pkgs/development/compilers/ldc/generic.nix143
-rw-r--r--pkgs/development/interpreters/j/default.nix43
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/libraries/atk/default.nix4
-rw-r--r--pkgs/development/libraries/cairo/default.nix4
-rw-r--r--pkgs/development/libraries/chromaprint/default.nix4
-rw-r--r--pkgs/development/libraries/cracklib/default.nix3
-rw-r--r--pkgs/development/libraries/dconf/default.nix71
-rw-r--r--pkgs/development/libraries/flatbuffers/default.nix4
-rw-r--r--pkgs/development/libraries/fstrcmp/cross.patch24
-rw-r--r--pkgs/development/libraries/fstrcmp/default.nix6
-rw-r--r--pkgs/development/libraries/ftgl/default.nix2
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/default.nix4
-rw-r--r--pkgs/development/libraries/gdk-pixbuf/setup-hook.sh2
-rw-r--r--pkgs/development/libraries/glib-networking/default.nix4
-rw-r--r--pkgs/development/libraries/glib/setup-hook.sh3
-rw-r--r--pkgs/development/libraries/gobject-introspection/default.nix4
-rw-r--r--pkgs/development/libraries/gpgme/default.nix18
-rw-r--r--pkgs/development/libraries/gpgme/disable-python-tests.patch12
-rw-r--r--pkgs/development/libraries/gsm/default.nix4
-rw-r--r--pkgs/development/libraries/gstreamer/bad/default.nix2
-rw-r--r--pkgs/development/libraries/gstreamer/core/default.nix7
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix15
-rw-r--r--pkgs/development/libraries/libasyncns/default.nix5
-rw-r--r--pkgs/development/libraries/libcddb/default.nix5
-rw-r--r--pkgs/development/libraries/libcdio/default.nix4
-rw-r--r--pkgs/development/libraries/libcec/default.nix4
-rw-r--r--pkgs/development/libraries/libcrossguid/default.nix4
-rw-r--r--pkgs/development/libraries/libfido2/default.nix31
-rw-r--r--pkgs/development/libraries/libfido2/detect_apple_ld.patch11
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libjpeg-turbo/default.nix6
-rw-r--r--pkgs/development/libraries/libnetfilter_conntrack/default.nix4
-rw-r--r--pkgs/development/libraries/librsvg/default.nix4
-rw-r--r--pkgs/development/libraries/libsecret/default.nix4
-rw-r--r--pkgs/development/libraries/libtxc_dxtn/default.nix23
-rw-r--r--pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix25
-rw-r--r--pkgs/development/libraries/libunwind/default.nix4
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libvdpau/default.nix4
-rw-r--r--pkgs/development/libraries/libvisual/default.nix5
-rw-r--r--pkgs/development/libraries/libvpx/default.nix8
-rw-r--r--pkgs/development/libraries/libwacom/default.nix11
-rw-r--r--pkgs/development/libraries/libyaml/default.nix4
-rw-r--r--pkgs/development/libraries/mdds/default.nix4
-rw-r--r--pkgs/development/libraries/netcdf/default.nix4
-rw-r--r--pkgs/development/libraries/science/biology/elastix/default.nix11
-rw-r--r--pkgs/development/libraries/tinyxml/2.6.2.nix4
-rw-r--r--pkgs/development/libraries/vulkan-loader/default.nix4
-rw-r--r--pkgs/development/libraries/waylandpp/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/bistro/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/dune-build-info/default.nix17
-rw-r--r--pkgs/development/ocaml-modules/janestreet/0.13.nix503
-rw-r--r--pkgs/development/ocaml-modules/janestreet/async_ssl.nix17
-rw-r--r--pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix19
-rw-r--r--pkgs/development/ocaml-modules/linenoise/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/phylogenetics/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/rpclib/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/sedlex/2.nix6
-rw-r--r--pkgs/development/perl-modules/xml-parser-0001-HACK-Assumes-Expat-paths-are-good.patch45
-rw-r--r--pkgs/development/python-modules/apptools/default.nix9
-rw-r--r--pkgs/development/python-modules/envisage/default.nix29
-rw-r--r--pkgs/development/python-modules/howdoi/default.nix4
-rw-r--r--pkgs/development/python-modules/lektor/default.nix3
-rw-r--r--pkgs/development/python-modules/matplotlib/2.nix45
-rw-r--r--pkgs/development/python-modules/matplotlib/basedirlist.patch8
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix35
-rw-r--r--pkgs/development/python-modules/matplotlib/setup.cfg2
-rw-r--r--pkgs/development/python-modules/mayavi/default.nix32
-rw-r--r--pkgs/development/python-modules/pyface/default.nix4
-rw-r--r--pkgs/development/python-modules/pyopengl/default.nix2
-rw-r--r--pkgs/development/python-modules/python-dbusmock/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch30
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/waf/default.nix4
-rw-r--r--pkgs/development/tools/buildah/default.nix23
-rw-r--r--pkgs/development/tools/documentation/doxygen/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/dune/2.nix4
-rw-r--r--pkgs/development/tools/parsing/bison/default.nix4
-rw-r--r--pkgs/development/tools/parsing/byacc/default.nix4
-rw-r--r--pkgs/games/cataclysm-dda/default.nix18
-rw-r--r--pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch12
-rw-r--r--pkgs/misc/emulators/retroarch/default.nix10
-rw-r--r--pkgs/misc/emulators/wine/default.nix2
-rw-r--r--pkgs/misc/emulators/wine/staging.nix4
-rw-r--r--pkgs/os-specific/linux/alsa-plugins/default.nix4
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix24
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix25
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened-patches.json24
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.5.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.6.nix4
-rw-r--r--pkgs/os-specific/linux/plymouth/default.nix3
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch32
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Don-t-try-to-unmount-nix-or-nix-store.patch42
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Fix-NixOS-containers.patch34
-rw-r--r--pkgs/os-specific/linux/systemd/0006-Look-for-fsck-in-the-right-place.patch25
-rw-r--r--pkgs/os-specific/linux/systemd/0007-Add-some-NixOS-specific-unit-directories.patch107
-rw-r--r--pkgs/os-specific/linux/systemd/0009-Get-rid-of-a-useless-message-in-user-sessions.patch31
-rw-r--r--pkgs/os-specific/linux/systemd/0010-hostnamed-localed-timedated-disable-methods-that-cha.patch118
-rw-r--r--pkgs/os-specific/linux/systemd/0011-Fix-hwdb-paths.patch32
-rw-r--r--pkgs/os-specific/linux/systemd/0012-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch132
-rw-r--r--pkgs/os-specific/linux/systemd/0013-localectl-use-etc-X11-xkb-for-list-x11.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0016-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch26
-rw-r--r--pkgs/os-specific/linux/systemd/0018-Install-default-configuration-into-out-share-factory.patch317
-rw-r--r--pkgs/os-specific/linux/systemd/0019-inherit-systemd-environment-when-calling-generators.patch42
-rw-r--r--pkgs/os-specific/linux/systemd/0021-add-rootprefix-to-lookup-dir-paths.patch38
-rw-r--r--pkgs/os-specific/linux/systemd/0022-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0023-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch26
-rw-r--r--pkgs/os-specific/linux/systemd/0024-kmod-static-nodes.service-Update-ConditionFileNotEmpty.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0025-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch33
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix47
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix4
-rw-r--r--pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch68
-rw-r--r--pkgs/servers/dns/https-dns-proxy/default.nix34
-rw-r--r--pkgs/servers/samba/4.x.nix4
-rw-r--r--pkgs/servers/sql/postgresql/ext/timescaledb.nix4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix9
-rw-r--r--pkgs/shells/bash/bash-completion/0001-Revert-build-Do-cmake-pc-and-profile-variable-replac.patch86
-rw-r--r--pkgs/shells/bash/bash-completion/default.nix47
-rw-r--r--pkgs/stdenv/generic/setup.sh3
-rw-r--r--pkgs/tools/admin/procs/default.nix8
-rw-r--r--pkgs/tools/compression/gzip/default.nix9
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix4
-rw-r--r--pkgs/tools/graphics/mscgen/default.nix18
-rw-r--r--pkgs/tools/misc/dvtm/dvtm.nix5
-rw-r--r--pkgs/tools/misc/html-proofer/Gemfile.lock4
-rw-r--r--pkgs/tools/misc/html-proofer/gemset.nix8
-rw-r--r--pkgs/tools/misc/patdiff/default.nix2
-rw-r--r--pkgs/tools/misc/statserial/default.nix44
-rw-r--r--pkgs/tools/networking/modem-manager/default.nix4
-rw-r--r--pkgs/tools/networking/mu/default.nix19
-rw-r--r--pkgs/tools/networking/wifite2/default.nix4
-rw-r--r--pkgs/tools/security/age/default.nix8
-rw-r--r--pkgs/tools/security/gnome-keysign/default.nix2
-rw-r--r--pkgs/tools/security/gnupg/22.nix4
-rw-r--r--pkgs/tools/security/sn0int/default.nix32
-rw-r--r--pkgs/tools/system/kmon/default.nix6
-rw-r--r--pkgs/tools/system/plan9port/default.nix9
-rw-r--r--pkgs/tools/system/plan9port/tmpdir.patch41
-rw-r--r--pkgs/top-level/aliases.nix4
-rw-r--r--pkgs/top-level/all-packages.nix60
-rw-r--r--pkgs/top-level/ocaml-packages.nix19
-rw-r--r--pkgs/top-level/perl-packages.nix9
-rw-r--r--pkgs/top-level/python-packages.nix5
-rw-r--r--pkgs/top-level/unix-tools.nix4
213 files changed, 3949 insertions, 1511 deletions
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index a50a8a507de34..ae4f68dddc19c 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -53,9 +53,9 @@ For package version upgrades and such a one-line commit message is usually suffi
 To [backport a change into a release branch](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches):
 
 1. Take note of the commit in which the change was introduced into `master`.
-2. Check out the target _release branch_, e.g. `release-19.09`. Do not use a _channel branch_ like `nixos-19.09` or `nixpkgs-19.09`.
+2. Check out the target _release branch_, e.g. `release-20.03`. Do not use a _channel branch_ like `nixos-20.03` or `nixpkgs-20.03`.
 3. Use `git cherry-pick -x <original commit>`.
-4. Open your backport PR. Make sure to select the release branch (e.g. `release-19.09`) as the target branch of the PR, and link to the PR in which the original change was made to `master`.
+4. Open your backport PR. Make sure to select the release branch (e.g. `release-20.03`) as the target branch of the PR, and link to the PR in which the original change was made to `master`.
 
 ## Reviewing contributions
 
diff --git a/README.md b/README.md
index edcd8dc0a00c1..da38b227b56e7 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 19.09 release](https://hydra.nixos.org/jobset/nixos/release-19.09)
+* [Continuous package builds for the NixOS 20.03 release](https://hydra.nixos.org/jobset/nixos/release-20.03)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 19.09 release](https://hydra.nixos.org/job/nixos/release-19.09/tested#tabs-constituents)
+* [Tests for the NixOS 20.03 release](https://hydra.nixos.org/job/nixos/release-20.03/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are
diff --git a/doc/languages-frameworks/texlive.xml b/doc/languages-frameworks/texlive.xml
index 8fa8f963b2f6b..a581ec5911cb7 100644
--- a/doc/languages-frameworks/texlive.xml
+++ b/doc/languages-frameworks/texlive.xml
@@ -149,31 +149,4 @@ EOF
 ]]></programlisting>
   </para>
  </section>
-
- <section xml:id="sec-language-texlive-known-problems">
-  <title>Known problems</title>
-
-  <itemizedlist>
-   <listitem>
-    <para>
-     Some tools are still missing, e.g. luajittex;
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     some apps aren't packaged/tested yet (asymptote, biber, etc.);
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     feature/bug: when a package is rejected by <varname>pkgFilter</varname>, its dependencies are still propagated;
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     in case of any bugs or feature requests, file a github issue or better a pull request and /cc @vcunat.
-    </para>
-   </listitem>
-  </itemizedlist>
- </section>
 </section>
diff --git a/doc/stdenv/stdenv.xml b/doc/stdenv/stdenv.xml
index e4cbdd4abb57b..206203be1ce66 100644
--- a/doc/stdenv/stdenv.xml
+++ b/doc/stdenv/stdenv.xml
@@ -729,6 +729,16 @@ passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ]
     <title>Variables controlling the patch phase</title>
     <varlistentry>
      <term>
+      <varname>dontPatch</varname>
+     </term>
+     <listitem>
+      <para>
+       Set to true to skip the patch phase.
+      </para>
+     </listitem>
+    </varlistentry>
+    <varlistentry>
+     <term>
       <varname>patches</varname>
      </term>
      <listitem>
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 94bcd777f0d15..a4ac08bb20e93 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -271,6 +271,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) {
     fullName = "European Union Public License 1.1";
   };
 
+  eupl12 = spdx {
+    spdxId = "EUPL-1.2";
+    fullName = "European Union Public License 1.2";
+  };
+
   fdl12 = spdx {
     spdxId = "GFDL-1.2-only";
     fullName = "GNU Free Documentation License v1.2 only";
diff --git a/nixos/doc/manual/installation/upgrading.xml b/nixos/doc/manual/installation/upgrading.xml
index 92864cf2557a3..e5e02aa075264 100644
--- a/nixos/doc/manual/installation/upgrading.xml
+++ b/nixos/doc/manual/installation/upgrading.xml
@@ -14,7 +14,7 @@
     <para>
      <emphasis>Stable channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-19.09">nixos-19.09</literal>.
+    xlink:href="https://nixos.org/channels/nixos-20.03">nixos-20.03</literal>.
      These only get conservative bug fixes and package upgrades. For instance,
      a channel update may cause the Linux kernel on your system to be upgraded
      from 4.19.34 to 4.19.38 (a minor bug fix), but not from
@@ -38,7 +38,7 @@
     <para>
      <emphasis>Small channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-19.09-small">nixos-19.09-small</literal>
+    xlink:href="https://nixos.org/channels/nixos-20.03-small">nixos-20.03-small</literal>
      or
      <literal
     xlink:href="https://nixos.org/channels/nixos-unstable-small">nixos-unstable-small</literal>.
@@ -63,8 +63,8 @@
  <para>
   When you first install NixOS, you’re automatically subscribed to the NixOS
   channel that corresponds to your installation source. For instance, if you
-  installed from a 19.09 ISO, you will be subscribed to the
-  <literal>nixos-19.09</literal> channel. To see which NixOS channel you’re
+  installed from a 20.03 ISO, you will be subscribed to the
+  <literal>nixos-20.03</literal> channel. To see which NixOS channel you’re
   subscribed to, run the following as root:
 <screen>
 # nix-channel --list | grep nixos
@@ -75,13 +75,13 @@ nixos https://nixos.org/channels/nixos-unstable
 # nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
 </screen>
   (Be sure to include the <literal>nixos</literal> parameter at the end.) For
-  instance, to use the NixOS 19.09 stable channel:
+  instance, to use the NixOS 20.03 stable channel:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-19.09 nixos
+# nix-channel --add https://nixos.org/channels/nixos-20.03 nixos
 </screen>
   If you have a server, you may want to use the “small” channel instead:
 <screen>
-# nix-channel --add https://nixos.org/channels/nixos-19.09-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-20.03-small nixos
 </screen>
   And if you want to live on the bleeding edge:
 <screen>
@@ -132,7 +132,7 @@ nixos https://nixos.org/channels/nixos-unstable
    kernel, initrd or kernel modules.
    You can also specify a channel explicitly, e.g.
 <programlisting>
-<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-19.09;
+<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-20.03;
 </programlisting>
   </para>
  </section>
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml
index 8f97de24ab125..b0940391b56b3 100644
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@@ -3,7 +3,7 @@
          xmlns:xi="http://www.w3.org/2001/XInclude"
          version="5.0"
          xml:id="sec-release-20.03">
- <title>Release 20.03 (“Markhor”, 2020.03/??)</title>
+ <title>Release 20.03 (“Markhor”, 2020.04/20)</title>
 
  <section xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"
diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix
index 3bfa1893a8bac..6ac64b0ec9c6c 100644
--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@@ -45,6 +45,9 @@ let
 
   # generate the font cache setting file for a fontconfig version
   # use latest when no version is passed
+  # When cross-compiling, we can’t generate the cache, so we skip the
+  # <cachedir> part. fontconfig still works but is a little slower in
+  # looking things up.
   makeCacheConf = { version ? null }:
     let
       fcPackage = if version == null
@@ -60,11 +63,13 @@ let
       <fontconfig>
         <!-- Font directories -->
         ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
+        ${optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
         <!-- Pre-generated font caches -->
         <cachedir>${cache}</cachedir>
         ${optionalString (pkgs.stdenv.isx86_64 && cfg.cache32Bit) ''
           <cachedir>${cache32}</cachedir>
         ''}
+        ''}
       </fontconfig>
     '';
 
diff --git a/nixos/modules/config/networking.nix b/nixos/modules/config/networking.nix
index dd36696b94d23..03944de82497a 100644
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@@ -197,7 +197,7 @@ in
 
       } // optionalAttrs (pkgs.stdenv.hostPlatform.libc == "glibc") {
         # /etc/rpc: RPC program numbers.
-        rpc.source = pkgs.glibc.out + "/etc/rpc";
+        rpc.source = pkgs.stdenv.cc.libc.out + "/etc/rpc";
       };
 
       networking.proxy.envVars =
diff --git a/nixos/modules/hardware/opengl.nix b/nixos/modules/hardware/opengl.nix
index 28cddea8b79cf..061528f4b1b53 100644
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@@ -10,14 +10,6 @@ let
 
   videoDrivers = config.services.xserver.videoDrivers;
 
-  makePackage = p: pkgs.buildEnv {
-    name = "mesa-drivers+txc-${p.mesa.version}";
-    paths =
-      [ p.mesa.drivers
-        (if cfg.s3tcSupport then p.libtxc_dxtn else p.libtxc_dxtn_s2tc)
-      ];
-  };
-
   package = pkgs.buildEnv {
     name = "opengl-drivers";
     paths = [ cfg.package ] ++ cfg.extraPackages;
@@ -34,6 +26,9 @@ in
 
   imports = [
     (mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
+    (mkRemovedOptionModule [ "hardware" "opengl" "s3tcSupport" ] ''
+      S3TC support is now always enabled in Mesa.
+    '')
   ];
 
   options = {
@@ -74,17 +69,6 @@ in
         '';
       };
 
-      s3tcSupport = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Make S3TC(S3 Texture Compression) via libtxc_dxtn available
-          to OpenGL drivers instead of the patent-free S2TC replacement.
-
-          Using this library may require a patent license depending on your location.
-        '';
-      };
-
       package = mkOption {
         type = types.package;
         internal = true;
@@ -166,8 +150,8 @@ in
     environment.sessionVariables.LD_LIBRARY_PATH = mkIf cfg.setLdLibraryPath
       ([ "/run/opengl-driver/lib" ] ++ optional cfg.driSupport32Bit "/run/opengl-driver-32/lib");
 
-    hardware.opengl.package = mkDefault (makePackage pkgs);
-    hardware.opengl.package32 = mkDefault (makePackage pkgs.pkgsi686Linux);
+    hardware.opengl.package = mkDefault pkgs.mesa.drivers;
+    hardware.opengl.package32 = mkDefault pkgs.pkgsi686Linux.mesa.drivers;
 
     boot.extraModulePackages = optional (elem "virtualbox" videoDrivers) kernelPackages.virtualboxGuestAdditions;
   };
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index a32c19a4eba94..422c405054d57 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -180,7 +180,7 @@ sub pciCheck {
         ) )
     {
         # we need e.g. brcmfmac43602-pcie.bin
-        push @imports, "<nixpkgs/nixos/modules/hardware/network/broadcom-43xx.nix>";
+        push @imports, "(modulesPath + \"/hardware/network/broadcom-43xx.nix\")";
     }
 
     # Can't rely on $module here, since the module may not be loaded
@@ -279,7 +279,7 @@ if ($virt eq "oracle") {
 
 # Likewise for QEMU.
 if ($virt eq "qemu" || $virt eq "kvm" || $virt eq "bochs") {
-    push @imports, "<nixpkgs/nixos/modules/profiles/qemu-guest.nix>";
+    push @imports, "(modulesPath + \"/profiles/qemu-guest.nix\")";
 }
 
 # Also for Hyper-V.
@@ -296,7 +296,7 @@ if ($virt eq "systemd-nspawn") {
 
 # Provide firmware for devices that are not detected by this script,
 # unless we're in a VM/container.
-push @imports, "<nixpkgs/nixos/modules/installer/scan/not-detected.nix>"
+push @imports, "(modulesPath + \"/installer/scan/not-detected.nix\")"
     if $virt eq "none";
 
 
@@ -549,7 +549,7 @@ my $hwConfig = <<EOF;
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
 
 {
   imports =${\multiLineList("    ", @imports)};
diff --git a/nixos/modules/services/system/nscd.nix b/nixos/modules/services/system/nscd.nix
index e11f7e049d8fe..af26dd8470730 100644
--- a/nixos/modules/services/system/nscd.nix
+++ b/nixos/modules/services/system/nscd.nix
@@ -7,6 +7,10 @@ let
   nssModulesPath = config.system.nssModules.path;
   cfg = config.services.nscd;
 
+  nscd = if pkgs.stdenv.hostPlatform.libc == "glibc"
+         then pkgs.stdenv.cc.libc.bin
+         else pkgs.glibc.bin;
+
 in
 
 {
@@ -59,16 +63,16 @@ in
         # files. So prefix the ExecStart command with "!" to prevent systemd
         # from dropping privileges early. See ExecStart in systemd.service(5).
         serviceConfig =
-          { ExecStart = "!@${pkgs.glibc.bin}/sbin/nscd nscd";
+          { ExecStart = "!@${nscd}/sbin/nscd nscd";
             Type = "forking";
             DynamicUser = true;
             RuntimeDirectory = "nscd";
             PIDFile = "/run/nscd/nscd.pid";
             Restart = "always";
             ExecReload =
-              [ "${pkgs.glibc.bin}/sbin/nscd --invalidate passwd"
-                "${pkgs.glibc.bin}/sbin/nscd --invalidate group"
-                "${pkgs.glibc.bin}/sbin/nscd --invalidate hosts"
+              [ "${nscd}/sbin/nscd --invalidate passwd"
+                "${nscd}/sbin/nscd --invalidate group"
+                "${nscd}/sbin/nscd --invalidate hosts"
               ];
           };
       };
diff --git a/nixos/modules/services/web-apps/dokuwiki.nix b/nixos/modules/services/web-apps/dokuwiki.nix
index 07af7aa0dfec7..76e18266a273f 100644
--- a/nixos/modules/services/web-apps/dokuwiki.nix
+++ b/nixos/modules/services/web-apps/dokuwiki.nix
@@ -3,13 +3,14 @@
 let
 
   inherit (lib) mkEnableOption mkForce mkIf mkMerge mkOption optionalAttrs recursiveUpdate types;
+  inherit (lib) concatMapStringsSep flatten mapAttrs mapAttrs' mapAttrsToList nameValuePair concatMapStringSep;
 
-  cfg = config.services.dokuwiki;
+  eachSite = config.services.dokuwiki;
 
-  user = config.services.nginx.user;
+  user = "dokuwiki";
   group = config.services.nginx.group;
 
-  dokuwikiAclAuthConfig = pkgs.writeText "acl.auth.php" ''
+  dokuwikiAclAuthConfig = cfg: pkgs.writeText "acl.auth.php" ''
     # acl.auth.php
     # <?php exit()?>
     #
@@ -18,244 +19,353 @@ let
     ${toString cfg.acl}
   '';
 
-  dokuwikiLocalConfig = pkgs.writeText "local.php" ''
+  dokuwikiLocalConfig = cfg: pkgs.writeText "local.php" ''
     <?php
     $conf['savedir'] = '${cfg.stateDir}';
     $conf['superuser'] = '${toString cfg.superUser}';
     $conf['useacl'] = '${toString cfg.aclUse}';
+    $conf['disableactions'] = '${cfg.disableActions}';
     ${toString cfg.extraConfig}
   '';
 
-  dokuwikiPluginsLocalConfig = pkgs.writeText "plugins.local.php" ''
+  dokuwikiPluginsLocalConfig = cfg: pkgs.writeText "plugins.local.php" ''
     <?php
     ${cfg.pluginsConfig}
   '';
 
-in
-{
-  options.services.dokuwiki = {
-    enable = mkEnableOption "DokuWiki web application.";
+  pkg = hostName: cfg: pkgs.stdenv.mkDerivation rec {
+    pname = "dokuwiki-${hostName}";
+    version = src.version;
+    src = cfg.package;
 
-    hostName = mkOption {
-      type = types.str;
-      default = "localhost";
-      description = "FQDN for the instance.";
-    };
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
 
-    stateDir = mkOption {
-      type = types.path;
-      default = "/var/lib/dokuwiki/data";
-      description = "Location of the dokuwiki state directory.";
-    };
+      # symlink the dokuwiki config
+      ln -s ${dokuwikiLocalConfig cfg} $out/share/dokuwiki/local.php
 
-    acl = mkOption {
-      type = types.nullOr types.lines;
-      default = null;
-      example = "*               @ALL               8";
-      description = ''
-        Access Control Lists: see <link xlink:href="https://www.dokuwiki.org/acl"/>
-        Mutually exclusive with services.dokuwiki.aclFile
-        Set this to a value other than null to take precedence over aclFile option.
-      '';
-    };
+      # symlink plugins config
+      ln -s ${dokuwikiPluginsLocalConfig cfg} $out/share/dokuwiki/plugins.local.php
 
-    aclFile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        Location of the dokuwiki acl rules. Mutually exclusive with services.dokuwiki.acl
-        Mutually exclusive with services.dokuwiki.acl which is preferred.
-        Consult documentation <link xlink:href="https://www.dokuwiki.org/acl"/> for further instructions.
-        Example: <link xlink:href="https://github.com/splitbrain/dokuwiki/blob/master/conf/acl.auth.php.dist"/>
-      '';
-    };
+      # symlink acl
+      ln -s ${dokuwikiAclAuthConfig cfg} $out/share/dokuwiki/acl.auth.php
 
-    aclUse = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Necessary for users to log in into the system.
-        Also limits anonymous users. When disabled,
-        everyone is able to create and edit content.
-      '';
-    };
+      # symlink additional plugin(s) and templates(s)
+      ${concatMapStringsSep "\n" (template: "ln -s ${template} $out/share/dokuwiki/lib/tpl/${template.name}") cfg.templates}
+      ${concatMapStringsSep "\n" (plugin: "ln -s ${plugin} $out/share/dokuwiki/lib/plugins/${plugin.name}") cfg.plugins}
+    '';
+  };
 
-    pluginsConfig = mkOption {
-      type = types.lines;
-      default = ''
-        $plugins['authad'] = 0;
-        $plugins['authldap'] = 0;
-        $plugins['authmysql'] = 0;
-        $plugins['authpgsql'] = 0;
-      '';
-      description = ''
-        List of the dokuwiki (un)loaded plugins.
-      '';
-    };
+  siteOpts = { config, lib, name, ...}: {
+    options = {
+      enable = mkEnableOption "DokuWiki web application.";
 
-    superUser = mkOption {
-      type = types.nullOr types.str;
-      default = "@admin";
-      description = ''
-        You can set either a username, a list of usernames (“admin1,admin2”), 
-        or the name of a group by prepending an @ char to the groupname
-        Consult documentation <link xlink:href="https://www.dokuwiki.org/config:superuser"/> for further instructions.
-      '';
-    };
+      package = mkOption {
+        type = types.package;
+        default = pkgs.dokuwiki;
+        description = "Which dokuwiki package to use.";
+      };
+
+      hostName = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "FQDN for the instance.";
+      };
+
+      stateDir = mkOption {
+        type = types.path;
+        default = "/var/lib/dokuwiki/${name}/data";
+        description = "Location of the dokuwiki state directory.";
+      };
 
-    usersFile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        Location of the dokuwiki users file. List of users. Format:
-        login:passwordhash:Real Name:email:groups,comma,separated 
-        Create passwordHash easily by using:$ mkpasswd -5 password `pwgen 8 1`
-        Example: <link xlink:href="https://github.com/splitbrain/dokuwiki/blob/master/conf/users.auth.php.dist"/>
+      acl = mkOption {
+        type = types.nullOr types.lines;
+        default = null;
+        example = "*               @ALL               8";
+        description = ''
+          Access Control Lists: see <link xlink:href="https://www.dokuwiki.org/acl"/>
+          Mutually exclusive with services.dokuwiki.aclFile
+          Set this to a value other than null to take precedence over aclFile option.
+
+          Warning: Consider using aclFile instead if you do not
+          want to store the ACL in the world-readable Nix store.
         '';
-    };
+      };
 
-    extraConfig = mkOption {
-      type = types.nullOr types.lines;
-      default = null;
-      example = ''
-        $conf['title'] = 'My Wiki';
-        $conf['userewrite'] = 1;
-      '';
-      description = ''
-        DokuWiki configuration. Refer to
-        <link xlink:href="https://www.dokuwiki.org/config"/>
-        for details on supported values.
-      '';
-    };
+      aclFile = mkOption {
+        type = with types; nullOr str;
+        default = if (config.aclUse && config.acl == null) then "/var/lib/dokuwiki/${name}/users.auth.php" else null;
+        description = ''
+          Location of the dokuwiki acl rules. Mutually exclusive with services.dokuwiki.acl
+          Mutually exclusive with services.dokuwiki.acl which is preferred.
+          Consult documentation <link xlink:href="https://www.dokuwiki.org/acl"/> for further instructions.
+          Example: <link xlink:href="https://github.com/splitbrain/dokuwiki/blob/master/conf/acl.auth.php.dist"/>
+        '';
+        example = "/var/lib/dokuwiki/${name}/acl.auth.php";
+      };
 
-    poolConfig = mkOption {
-      type = with types; attrsOf (oneOf [ str int bool ]);
-      default = {
-        "pm" = "dynamic";
-        "pm.max_children" = 32;
-        "pm.start_servers" = 2;
-        "pm.min_spare_servers" = 2;
-        "pm.max_spare_servers" = 4;
-        "pm.max_requests" = 500;
+      aclUse = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Necessary for users to log in into the system.
+          Also limits anonymous users. When disabled,
+          everyone is able to create and edit content.
+        '';
       };
-      description = ''
-        Options for the dokuwiki PHP pool. See the documentation on <literal>php-fpm.conf</literal>
-        for details on configuration directives.
-      '';
-    };
 
-    nginx = mkOption {
-      type = types.submodule (
-        recursiveUpdate
-          (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
-          {
-            # Enable encryption by default,
-            options.forceSSL.default = true;
-            options.enableACME.default = true;
-          }
-      );
-      default = {forceSSL = true; enableACME = true;};
-      example = {
-        serverAliases = [
-          "wiki.\${config.networking.domain}"
-        ];
-        enableACME = false;
+      pluginsConfig = mkOption {
+        type = types.lines;
+        default = ''
+          $plugins['authad'] = 0;
+          $plugins['authldap'] = 0;
+          $plugins['authmysql'] = 0;
+          $plugins['authpgsql'] = 0;
+        '';
+        description = ''
+          List of the dokuwiki (un)loaded plugins.
+        '';
+      };
+
+      superUser = mkOption {
+        type = types.nullOr types.str;
+        default = "@admin";
+        description = ''
+          You can set either a username, a list of usernames (“admin1,admin2”),
+          or the name of a group by prepending an @ char to the groupname
+          Consult documentation <link xlink:href="https://www.dokuwiki.org/config:superuser"/> for further instructions.
+        '';
       };
-      description = ''
-        With this option, you can customize the nginx virtualHost which already has sensible defaults for DokuWiki.
-      '';
+
+      usersFile = mkOption {
+        type = with types; nullOr str;
+        default = if config.aclUse then "/var/lib/dokuwiki/${name}/users.auth.php" else null;
+        description = ''
+          Location of the dokuwiki users file. List of users. Format:
+          login:passwordhash:Real Name:email:groups,comma,separated
+          Create passwordHash easily by using:$ mkpasswd -5 password `pwgen 8 1`
+          Example: <link xlink:href="https://github.com/splitbrain/dokuwiki/blob/master/conf/users.auth.php.dist"/>
+          '';
+        example = "/var/lib/dokuwiki/${name}/users.auth.php";
+      };
+
+      disableActions = mkOption {
+        type = types.nullOr types.str;
+        default = "";
+        example = "search,register";
+        description = ''
+          Disable individual action modes. Refer to
+          <link xlink:href="https://www.dokuwiki.org/config:action_modes"/>
+          for details on supported values.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.nullOr types.lines;
+        default = null;
+        example = ''
+          $conf['title'] = 'My Wiki';
+          $conf['userewrite'] = 1;
+        '';
+        description = ''
+          DokuWiki configuration. Refer to
+          <link xlink:href="https://www.dokuwiki.org/config"/>
+          for details on supported values.
+        '';
+      };
+
+      plugins = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = ''
+              List of path(s) to respective plugin(s) which are copied from the 'plugin' directory.
+              <note><para>These plugins need to be packaged before use, see example.</para></note>
+        '';
+        example = ''
+              # Let's package the icalevents plugin
+              plugin-icalevents = pkgs.stdenv.mkDerivation {
+                name = "icalevents";
+                # Download the plugin from the dokuwiki site
+                src = pkgs.fetchurl {
+                  url = https://github.com/real-or-random/dokuwiki-plugin-icalevents/releases/download/2017-06-16/dokuwiki-plugin-icalevents-2017-06-16.zip;
+                  sha256 = "e40ed7dd6bbe7fe3363bbbecb4de481d5e42385b5a0f62f6a6ce6bf3a1f9dfa8";
+                };
+                sourceRoot = ".";
+                # We need unzip to build this package
+                buildInputs = [ pkgs.unzip ];
+                # Installing simply means copying all files to the output directory
+                installPhase = "mkdir -p $out; cp -R * $out/";
+              };
+
+              # And then pass this theme to the plugin list like this:
+              plugins = [ plugin-icalevents ];
+        '';
+      };
+
+      templates = mkOption {
+        type = types.listOf types.path;
+        default = [];
+        description = ''
+              List of path(s) to respective template(s) which are copied from the 'tpl' directory.
+              <note><para>These templates need to be packaged before use, see example.</para></note>
+        '';
+        example = ''
+              # Let's package the bootstrap3 theme
+              template-bootstrap3 = pkgs.stdenv.mkDerivation {
+                name = "bootstrap3";
+                # Download the theme from the dokuwiki site
+                src = pkgs.fetchurl {
+                  url = https://github.com/giterlizzi/dokuwiki-template-bootstrap3/archive/v2019-05-22.zip;
+                  sha256 = "4de5ff31d54dd61bbccaf092c9e74c1af3a4c53e07aa59f60457a8f00cfb23a6";
+                };
+                # We need unzip to build this package
+                buildInputs = [ pkgs.unzip ];
+                # Installing simply means copying all files to the output directory
+                installPhase = "mkdir -p $out; cp -R * $out/";
+              };
+
+              # And then pass this theme to the template list like this:
+              templates = [ template-bootstrap3 ];
+        '';
+      };
+
+      poolConfig = mkOption {
+        type = with types; attrsOf (oneOf [ str int bool ]);
+        default = {
+          "pm" = "dynamic";
+          "pm.max_children" = 32;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 2;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 500;
+        };
+        description = ''
+          Options for the dokuwiki PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+          for details on configuration directives.
+        '';
+      };
+
+      nginx = mkOption {
+        type = types.submodule (
+          recursiveUpdate
+            (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
+            {
+              # Enable encryption by default,
+              options.forceSSL.default = true;
+              options.enableACME.default = true;
+            }
+        );
+        default = {forceSSL = true; enableACME = true;};
+        example = {
+          serverAliases = [
+            "wiki.\${config.networking.domain}"
+          ];
+          enableACME = false;
+        };
+        description = ''
+          With this option, you can customize the nginx virtualHost which already has sensible defaults for DokuWiki.
+        '';
+      };
+    };
+  };
+in
+{
+  # interface
+  options = {
+    services.dokuwiki = mkOption {
+      type = types.attrsOf (types.submodule siteOpts);
+      default = {};
+      description = "Sepcification of one or more dokuwiki sites to service.";
     };
   };
 
   # implementation
 
-  config = mkIf cfg.enable {
-
-    warnings = mkIf (cfg.superUser == null) ["Not setting services.dokuwiki.superUser will impair your ability to administer DokuWiki"];
-
-    assertions = [ 
-      {
-        assertion = cfg.aclUse -> (cfg.acl != null || cfg.aclFile != null);
-        message = "Either services.dokuwiki.acl or services.dokuwiki.aclFile is mandatory when aclUse is true";
-      }
-      {
-        assertion = cfg.usersFile != null -> cfg.aclUse != false;
-        message = "services.dokuwiki.aclUse must be true when usersFile is not null";
-      }
-    ];
-
-    services.phpfpm.pools.dokuwiki = {
-      inherit user;
-      inherit group;
-      phpEnv = {        
-        DOKUWIKI_LOCAL_CONFIG = "${dokuwikiLocalConfig}";
-        DOKUWIKI_PLUGINS_LOCAL_CONFIG = "${dokuwikiPluginsLocalConfig}";
-      } //optionalAttrs (cfg.usersFile != null) {
-        DOKUWIKI_USERS_AUTH_CONFIG = "${cfg.usersFile}";
-      } //optionalAttrs (cfg.aclUse) {
-        DOKUWIKI_ACL_AUTH_CONFIG = if (cfg.acl != null) then "${dokuwikiAclAuthConfig}" else "${toString cfg.aclFile}";
-      };
-      
-      settings = {
-        "listen.mode" = "0660";
-        "listen.owner" = user;
-        "listen.group" = group;
-      } // cfg.poolConfig;
-    };
+  config = mkIf (eachSite != {}) {
+
+    warnings = mapAttrsToList (hostName: cfg: mkIf (cfg.superUser == null) "Not setting services.dokuwiki.${hostName} superUser will impair your ability to administer DokuWiki") eachSite;
+
+    assertions = flatten (mapAttrsToList (hostName: cfg:
+    [{
+      assertion = cfg.aclUse -> (cfg.acl != null || cfg.aclFile != null);
+      message = "Either services.dokuwiki.${hostName}.acl or services.dokuwiki.${hostName}.aclFile is mandatory if aclUse true";
+    }
+    {
+      assertion = cfg.usersFile != null -> cfg.aclUse != false;
+      message = "services.dokuwiki.${hostName}.aclUse must must be true if usersFile is not null";
+    }
+    ]) eachSite);
+
+    services.phpfpm.pools = mapAttrs' (hostName: cfg: (
+      nameValuePair "dokuwiki-${hostName}" {
+        inherit user;
+        inherit group;
+        phpEnv = {
+          DOKUWIKI_LOCAL_CONFIG = "${dokuwikiLocalConfig cfg}";
+          DOKUWIKI_PLUGINS_LOCAL_CONFIG = "${dokuwikiPluginsLocalConfig cfg}";
+        } // optionalAttrs (cfg.usersFile != null) {
+          DOKUWIKI_USERS_AUTH_CONFIG = "${cfg.usersFile}";
+        } //optionalAttrs (cfg.aclUse) {
+          DOKUWIKI_ACL_AUTH_CONFIG = if (cfg.acl != null) then "${dokuwikiAclAuthConfig cfg}" else "${toString cfg.aclFile}";
+        };
+
+        settings = {
+          "listen.mode" = "0660";
+          "listen.owner" = user;
+          "listen.group" = group;
+        } // cfg.poolConfig;
+      })) eachSite;
 
     services.nginx = {
       enable = true;
-      
-       virtualHosts = {
-        ${cfg.hostName} = mkMerge [ cfg.nginx {
-          root = mkForce "${pkgs.dokuwiki}/share/dokuwiki/";
-          extraConfig = "fastcgi_param HTTPS on;";
-
-          locations."~ /(conf/|bin/|inc/|install.php)" = {
-            extraConfig = "deny all;";
-          };
-
-          locations."~ ^/data/" = {
-            root = "${cfg.stateDir}";
-            extraConfig = "internal;";
-          };
-
-          locations."~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$" = {
-            extraConfig = "expires 365d;";
-          };
-
-          locations."/" = {
-            priority = 1;
-            index = "doku.php";
-            extraConfig = ''try_files $uri $uri/ @dokuwiki;'';
-          };
-
-          locations."@dokuwiki" = {
-            extraConfig = ''
+      virtualHosts = mapAttrs (hostName: cfg:  mkMerge [ cfg.nginx {
+        root = mkForce "${pkg hostName cfg}/share/dokuwiki";
+        extraConfig = "fastcgi_param HTTPS on;";
+
+        locations."~ /(conf/|bin/|inc/|install.php)" = {
+          extraConfig = "deny all;";
+        };
+
+        locations."~ ^/data/" = {
+          root = "${cfg.stateDir}";
+          extraConfig = "internal;";
+        };
+
+        locations."~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+          extraConfig = "expires 365d;";
+        };
+
+        locations."/" = {
+          priority = 1;
+          index = "doku.php";
+          extraConfig = ''try_files $uri $uri/ @dokuwiki;'';
+        };
+
+        locations."@dokuwiki" = {
+          extraConfig = ''
               # rewrites "doku.php/" out of the URLs if you set the userwrite setting to .htaccess in dokuwiki config page
               rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
               rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
               rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
               rewrite ^/(.*) /doku.php?id=$1&$args last;
-            '';
-          };
+          '';
+        };
 
-          locations."~ \.php$" = {
-            extraConfig = ''
+        locations."~ \.php$" = {
+          extraConfig = ''
               try_files $uri $uri/ /doku.php;
               include ${pkgs.nginx}/conf/fastcgi_params;
               fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
               fastcgi_param REDIRECT_STATUS 200;
-              fastcgi_pass unix:${config.services.phpfpm.pools.dokuwiki.socket};
+              fastcgi_pass unix:${config.services.phpfpm.pools."dokuwiki-${hostName}".socket};
               fastcgi_param HTTPS on;
-            '';
-          };
-        }];
-      };
-
+          '';
+        };
+      }]) eachSite;
     };
 
-    systemd.tmpfiles.rules = [
+    systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
       "d ${cfg.stateDir}/attic 0750 ${user} ${group} - -"
       "d ${cfg.stateDir}/cache 0750 ${user} ${group} - -"
       "d ${cfg.stateDir}/index 0750 ${user} ${group} - -"
@@ -266,7 +376,13 @@ in
       "d ${cfg.stateDir}/meta 0750 ${user} ${group} - -"
       "d ${cfg.stateDir}/pages 0750 ${user} ${group} - -"
       "d ${cfg.stateDir}/tmp 0750 ${user} ${group} - -"
-    ];
+    ] ++ lib.optional (cfg.aclFile != null) "C ${cfg.aclFile} 0640 ${user} ${group} - ${pkg hostName cfg}/share/dokuwiki/conf/acl.auth.php.dist"
+    ++ lib.optional (cfg.usersFile != null) "C ${cfg.usersFile} 0640 ${user} ${group} - ${pkg hostName cfg}/share/dokuwiki/conf/users.auth.php.dist"
+    ) eachSite);
 
+    users.users.${user} = {
+      group = group;
+      isSystemUser = true;
+    };
   };
 }
diff --git a/nixos/modules/services/x11/gdk-pixbuf.nix b/nixos/modules/services/x11/gdk-pixbuf.nix
index 9ad926369ec77..e6a24a2f1a308 100644
--- a/nixos/modules/services/x11/gdk-pixbuf.nix
+++ b/nixos/modules/services/x11/gdk-pixbuf.nix
@@ -19,7 +19,7 @@ let
           continue
         fi
         GDK_PIXBUF_MODULEDIR="$module_dir" \
-          ${pkgs.gdk-pixbuf.dev}/bin/gdk-pixbuf-query-loaders
+          ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} ${pkgs.gdk-pixbuf.dev}/bin/gdk-pixbuf-query-loaders
       done
     ) > "$out"
   '';
@@ -37,7 +37,7 @@ in
   # If there is any package configured in modulePackages, we generate the
   # loaders.cache based on that and set the environment variable
   # GDK_PIXBUF_MODULE_FILE to point to it.
-  config = mkIf (cfg.modulePackages != []) {
+  config = mkIf (cfg.modulePackages != [] || pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform) {
     environment.variables = {
       GDK_PIXBUF_MODULE_FILE = "${loadersCache}";
     };
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 7f207e6c7ef49..518d875841bd7 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -894,6 +894,13 @@ in
       "sysctl.d/50-coredump.conf".source = "${systemd}/example/sysctl.d/50-coredump.conf";
       "sysctl.d/50-default.conf".source = "${systemd}/example/sysctl.d/50-default.conf";
 
+      "tmpfiles.d/00-nixos.conf".text = ''
+        # This file is created automatically and should not be modified.
+        # Please change the option ‘systemd.tmpfiles.rules’ instead.
+
+        ${concatStringsSep "\n" cfg.tmpfiles.rules}
+      '';
+
       "tmpfiles.d/home.conf".source = "${systemd}/example/tmpfiles.d/home.conf";
       "tmpfiles.d/journal-nocow.conf".source = "${systemd}/example/tmpfiles.d/journal-nocow.conf";
       "tmpfiles.d/portables.conf".source = "${systemd}/example/tmpfiles.d/portables.conf";
@@ -906,13 +913,6 @@ in
       "tmpfiles.d/var.conf".source = "${systemd}/example/tmpfiles.d/var.conf";
       "tmpfiles.d/x11.conf".source = "${systemd}/example/tmpfiles.d/x11.conf";
 
-      "tmpfiles.d/nixos.conf".text = ''
-        # This file is created automatically and should not be modified.
-        # Please change the option ‘systemd.tmpfiles.rules’ instead.
-
-        ${concatStringsSep "\n" cfg.tmpfiles.rules}
-      '';
-
       "systemd/system-generators" = { source = hooks "generators" cfg.generators; };
       "systemd/system-shutdown" = { source = hooks "shutdown" cfg.shutdown; };
     });
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index dad211ef55bae..2db5c117aa7f3 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -463,10 +463,15 @@ in
                 A specification of the desired configuration of this
                 container, as a NixOS module.
               '';
-              type = lib.mkOptionType {
+              type = let
+                confPkgs = if config.pkgs == null then pkgs else config.pkgs;
+              in lib.mkOptionType {
                 name = "Toplevel NixOS config";
-                merge = loc: defs: (import ../../lib/eval-config.nix {
+                merge = loc: defs: (import (confPkgs.path + "/nixos/lib/eval-config.nix") {
                   inherit system;
+                  pkgs = confPkgs;
+                  baseModules = import (confPkgs.path + "/nixos/modules/module-list.nix");
+                  inherit (confPkgs) lib;
                   modules =
                     let
                       extraConfig = {
@@ -515,6 +520,15 @@ in
               '';
             };
 
+            pkgs = mkOption {
+              type = types.nullOr types.attrs;
+              default = null;
+              example = literalExample "pkgs";
+              description = ''
+                Customise which nixpkgs to use for this container.
+              '';
+            };
+
             ephemeral = mkOption {
               type = types.bool;
               default = false;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b0c9c7bc2258d..30229a3a5b2f4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -53,6 +53,7 @@ in
   consul = handleTest ./consul.nix {};
   cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
   containers-bridge = handleTest ./containers-bridge.nix {};
+  containers-custom-pkgs.nix = handleTest ./containers-custom-pkgs.nix {};
   containers-ephemeral = handleTest ./containers-ephemeral.nix {};
   containers-extra_veth = handleTest ./containers-extra_veth.nix {};
   containers-hosts = handleTest ./containers-hosts.nix {};
diff --git a/nixos/tests/containers-custom-pkgs.nix b/nixos/tests/containers-custom-pkgs.nix
new file mode 100644
index 0000000000000..397a4a905e6d9
--- /dev/null
+++ b/nixos/tests/containers-custom-pkgs.nix
@@ -0,0 +1,42 @@
+# Test for NixOS' container support.
+
+import ./make-test-python.nix ({ pkgs, lib, ...} : let
+
+  customPkgs = pkgs // {
+    hello = pkgs.hello.overrideAttrs(old: {
+      name = "custom-hello";
+    });
+  };
+
+in {
+  name = "containers-hosts";
+  meta = with lib.maintainers; {
+    maintainers = [ adisbladis ];
+  };
+
+  machine =
+    { ... }:
+    {
+      virtualisation.memorySize = 256;
+      virtualisation.vlans = [];
+
+      containers.simple = {
+        autoStart = true;
+        pkgs = customPkgs;
+        config = {pkgs, config, ... }: {
+          environment.systemPackages = [
+            pkgs.hello
+          ];
+        };
+      };
+
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target")
+    machine.succeed(
+        "test $(nixos-container run simple -- readlink -f /run/current-system/sw/bin/hello) = ${customPkgs.hello}/bin/hello"
+    )
+  '';
+})
diff --git a/nixos/tests/dokuwiki.nix b/nixos/tests/dokuwiki.nix
index 38bde10f47edc..2b907133ed5ad 100644
--- a/nixos/tests/dokuwiki.nix
+++ b/nixos/tests/dokuwiki.nix
@@ -1,29 +1,74 @@
-import ./make-test-python.nix ({ lib, ... }:
+import ./make-test-python.nix ({ pkgs, ... }:
 
-with lib;
+let
+  template-bootstrap3 = pkgs.stdenv.mkDerivation {
+    name = "bootstrap3";
+    # Download the theme from the dokuwiki site
+    src = pkgs.fetchurl {
+      url = https://github.com/giterlizzi/dokuwiki-template-bootstrap3/archive/v2019-05-22.zip;
+      sha256 = "4de5ff31d54dd61bbccaf092c9e74c1af3a4c53e07aa59f60457a8f00cfb23a6";
+    };
+    # We need unzip to build this package
+    buildInputs = [ pkgs.unzip ];
+    # Installing simply means copying all files to the output directory
+    installPhase = "mkdir -p $out; cp -R * $out/";
+  };
+
+
+  # Let's package the icalevents plugin
+  plugin-icalevents = pkgs.stdenv.mkDerivation {
+    name = "icalevents";
+    # Download the plugin from the dokuwiki site
+    src = pkgs.fetchurl {
+      url = https://github.com/real-or-random/dokuwiki-plugin-icalevents/releases/download/2017-06-16/dokuwiki-plugin-icalevents-2017-06-16.zip;
+      sha256 = "e40ed7dd6bbe7fe3363bbbecb4de481d5e42385b5a0f62f6a6ce6bf3a1f9dfa8";
+    };
+    # We need unzip to build this package
+    buildInputs = [ pkgs.unzip ];
+    sourceRoot = ".";
+    # Installing simply means copying all files to the output directory
+    installPhase = "mkdir -p $out; cp -R * $out/";
+  };
 
-{
+in {
   name = "dokuwiki";
-  meta.maintainers = with maintainers; [ maintainers."1000101" ];
-
-  nodes.machine =
-    { pkgs, ... }:
-    { services.dokuwiki = {
-        enable = true;
-        acl = " ";
-        superUser = null;
-        nginx = {
-          forceSSL = false;
-          enableACME = false;
-        };
-      }; 
+  meta.maintainers = with pkgs.lib.maintainers; [ "1000101" ];
+
+  machine = { ... }: {
+    services.dokuwiki."site1.local" = {
+      aclUse = false;
+      superUser = "admin";
+      nginx = {
+        forceSSL = false;
+        enableACME = false;
+      };
+    };
+    services.dokuwiki."site2.local" = {
+      aclUse = true;
+      superUser = "admin";
+      nginx = {
+        forceSSL = false;
+        enableACME = false;
+      };
+      templates = [ template-bootstrap3 ];
+      plugins = [ plugin-icalevents ];
     };
+    networking.hosts."127.0.0.1" = [ "site1.local" "site2.local" ];
+  };
 
   testScript = ''
-    machine.start()
-    machine.wait_for_unit("phpfpm-dokuwiki.service")
+    site_names = ["site1.local", "site2.local"]
+
+    start_all()
+
+    machine.wait_for_unit("phpfpm-dokuwiki-site1.local.service")
+    machine.wait_for_unit("phpfpm-dokuwiki-site2.local.service")
+
     machine.wait_for_unit("nginx.service")
+
     machine.wait_for_open_port(80)
-    machine.succeed("curl -sSfL http://localhost/ | grep 'DokuWiki'")
+
+    machine.succeed("curl -sSfL http://site1.local/ | grep 'DokuWiki'")
+    machine.succeed("curl -sSfL http://site2.local/ | grep 'DokuWiki'")
   '';
 })
diff --git a/pkgs/applications/audio/gbsplay/default.nix b/pkgs/applications/audio/gbsplay/default.nix
index 9ff9b8dc1145b..f89b8ed399b4e 100644
--- a/pkgs/applications/audio/gbsplay/default.nix
+++ b/pkgs/applications/audio/gbsplay/default.nix
@@ -11,13 +11,13 @@ stdenv.mkDerivation {
   };
 
   buildInputs = [ libpulseaudio ];
-  
-  configureFlagsArray =
+
+  configureFlags =
    [ "--without-test" "--without-contrib" "--disable-devdsp"
      "--enable-pulse" "--disable-alsa" "--disable-midi"
      "--disable-nas" "--disable-dsound" "--disable-i18n" ];
 
-  makeFlagsArray = [ "tests=" ];
+  makeFlags = [ "tests=" ];
 
   meta = with stdenv.lib; {
     description = "gameboy sound player";
diff --git a/pkgs/applications/audio/hydrogen/unstable.nix b/pkgs/applications/audio/hydrogen/unstable.nix
new file mode 100644
index 0000000000000..2f220f8d31aac
--- /dev/null
+++ b/pkgs/applications/audio/hydrogen/unstable.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, wrapQtAppsHook
+, alsaLib, ladspa-sdk, lash, libarchive, libjack2, liblo, libpulseaudio, libsndfile, lrdf
+, qtbase, qttools, qtxmlpatterns
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hydrogen";
+  version = "1.0.0-beta2";
+
+  src = fetchFromGitHub {
+    owner = "hydrogen-music";
+    repo = pname;
+    rev = version;
+    sha256 = "1s3jrdyjpm92flw9mkkxchnj0wz8nn1y1kifii8ws252iiqjya4a";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];
+  buildInputs = [
+    alsaLib ladspa-sdk lash libarchive libjack2 liblo libpulseaudio libsndfile lrdf
+    qtbase qttools qtxmlpatterns
+  ];
+
+  cmakeFlags = [
+    "-DWANT_DEBUG=OFF"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Advanced drum machine";
+    homepage = "http://www.hydrogen-music.org";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ goibhniu orivej ];
+  };
+}
diff --git a/pkgs/applications/editors/emacs/default.nix b/pkgs/applications/editors/emacs/default.nix
index 9d0fc45653859..fc00384c03ae7 100644
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, ncurses, xlibsWrapper, libXaw, libXpm
+{ stdenv, lib, fetchurl, fetchpatch, ncurses, xlibsWrapper, libXaw, libXpm
 , Xaw3d, libXcursor,  pkgconfig, gettext, libXft, dbus, libpng, libjpeg, libungif
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
 , alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
@@ -44,6 +44,11 @@ stdenv.mkDerivation rec {
   patches = [
     ./clean-env.patch
     ./tramp-detect-wrapped-gvfsd.patch
+    # unbreak macOS unexec
+    (fetchpatch {
+      url = https://github.com/emacs-mirror/emacs/commit/888ffd960c06d56a409a7ff15b1d930d25c56089.patch;
+      sha256 = "08q3ygdigqwky70r47rcgzlkc5jy82xiq8am5kwwy891wlpl7frw";
+    })
   ];
 
   postPatch = lib.optionalString srcRepo ''
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 03b7d57b49dcb..8bdc0c0753c06 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.0343";
+  version = "8.2.0510";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "063i52h8v7f87zamrw2ph057f0x2nzwf1s0izrm2psy41cyf4wa3";
+    sha256 = "16ggwf238pzzkn3ng6n09qz9cgdzha9vc0ghlcxhwilnjh12l7p9";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index b6248b8f6f131..c5d7b19618fde 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -104,6 +104,12 @@ rustPlatform.buildRustPackage rec {
     '' else ''
       install -D extra/linux/Alacritty.desktop -t $out/share/applications/
       install -D extra/logo/alacritty-term.svg $out/share/icons/hicolor/scalable/apps/Alacritty.svg
+
+      # patchelf generates an ELF that binutils' "strip" doesn't like:
+      #    strip: not enough room for program headers, try linking with -N
+      # As a workaround, strip manually before running patchelf.
+      strip -S $out/bin/alacritty
+
       patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/alacritty
     ''
   ) + ''
diff --git a/pkgs/applications/misc/ausweisapp2/default.nix b/pkgs/applications/misc/ausweisapp2/default.nix
new file mode 100644
index 0000000000000..953e12a033d0a
--- /dev/null
+++ b/pkgs/applications/misc/ausweisapp2/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, mkDerivation, fetchFromGitHub, cmake, pkgconfig, pcsclite, qtsvg, qttools, qtwebsockets
+, qtquickcontrols2, qtgraphicaleffects }:
+
+mkDerivation rec {
+  pname = "AusweisApp2";
+  version = "1.20.0";
+
+  src = fetchFromGitHub {
+    owner = "Governikus";
+    repo = "AusweisApp2";
+    rev = "${version}";
+    sha256 = "0qkwdaxhig4qjim7h20j6ln6w76ycppfc786nd8l69bd1qv46m40";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [ qtsvg qttools qtwebsockets qtquickcontrols2 qtgraphicaleffects pcsclite ];
+
+  meta = with stdenv.lib; {
+    description = "Authentication software for the German ID card";
+    downloadPage = "https://github.com/Governikus/AusweisApp2/releases";
+    homepage = "https://www.ausweisapp.bund.de/ausweisapp2/";
+    license = licenses.eupl12;
+    maintainers = with maintainers; [ b4dm4n ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/birdtray/default.nix b/pkgs/applications/misc/birdtray/default.nix
index 29522f75c2574..00707fc7ec58e 100644
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/applications/misc/birdtray/default.nix
@@ -7,29 +7,24 @@
   , qtbase
   , qttools
   , qtx11extras
-  , sqlite
 }:
 
 mkDerivation rec {
   pname = "birdtray";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "gyunaev";
     repo = pname;
-    rev = "RELEASE_${version}";
-    sha256 = "0wj2lq5bz1p0cf6yj43v3ifxschcrh5amwx30wqw2m4bb8syzjw1";
+    rev = version;
+    sha256 = "15d0gz889vf9b2a046m93s5kdi6lw2sqjd5gaxgjkjrs20x5vr18";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [
-    qtbase qtx11extras sqlite
+    qtbase qttools qtx11extras
   ];
 
-  installPhase = ''
-    install -Dm755 birdtray $out/bin/birdtray
-  '';
-
   meta = with lib; {
     description = "Mail system tray notification icon for Thunderbird";
     homepage = "https://github.com/gyunaev/birdtray";
diff --git a/pkgs/applications/misc/lutris/chrootenv.nix b/pkgs/applications/misc/lutris/chrootenv.nix
index 6f8d690779be5..2861991cc41c4 100644
--- a/pkgs/applications/misc/lutris/chrootenv.nix
+++ b/pkgs/applications/misc/lutris/chrootenv.nix
@@ -94,7 +94,7 @@ in buildFHSUserEnv {
     libsndfile libtheora libogg libvorbis libopus libGLU libpcap libpulseaudio
     libao libusb libevdev udev libgcrypt libxml2 libusb libpng libmpeg2 libv4l
     libjpeg libxkbcommon libass libcdio libjack2 libsamplerate libzip libmad libaio
-    libcap libtiff libva libgphoto2 libxslt libtxc_dxtn libsndfile giflib zlib glib
+    libcap libtiff libva libgphoto2 libxslt libsndfile giflib zlib glib
     alsaLib zziplib bash dbus keyutils zip cabextract freetype unzip coreutils
     readline gcc SDL SDL2 curl graphite2 gtk2 gtk3 udev ncurses wayland libglvnd
     vulkan-loader xdg_utils sqlite gnutls libbsd
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index bab24d014567f..151ce5edc3557 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -82,11 +82,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.5.123";
+  version = "1.7.92";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "1yv6hfjqzcd60b0bjpfbj8d4s2yf10swanxhbmnslcqp6ajb2nqr";
+    sha256 = "1f262xh88c83m6ixqxc69z8kvkl3qbjc6jnv2g8n0flw8s70hs7z";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/cluster/cni/default.nix b/pkgs/applications/networking/cluster/cni/default.nix
index 8e74f834eaf46..49d3aaa298de4 100644
--- a/pkgs/applications/networking/cluster/cni/default.nix
+++ b/pkgs/applications/networking/cluster/cni/default.nix
@@ -1,18 +1,19 @@
-{ stdenv, fetchFromGitHub, buildGoPackage }:
+{ lib, fetchFromGitHub, buildGoPackage }:
 
 buildGoPackage rec {
   pname = "cni";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15ad323dw44k82bfx9r8w5q2kn7jix60p9v4ciyzx2p5pip36wp8";
+    sha256 = "02qn1br8164d99978acalisy1sx294g1axnii4yh1wji0fc735xz";
   };
 
   goPackagePath = "github.com/containernetworking/cni";
-  meta = with stdenv.lib; {
+
+  meta = with lib; {
     description = "Container Network Interface - networking for Linux containers";
     license = licenses.asl20;
     homepage = "https://github.com/containernetworking/cni";
diff --git a/pkgs/applications/networking/cluster/cni/plugins-deps.nix b/pkgs/applications/networking/cluster/cni/plugins-deps.nix
deleted file mode 100644
index a6bbd333be43e..0000000000000
--- a/pkgs/applications/networking/cluster/cni/plugins-deps.nix
+++ /dev/null
@@ -1,210 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/Microsoft/go-winio";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Microsoft/go-winio";
-      rev = "v0.4.11";
-      sha256 = "14y1gryr3pb3zy09v2g8dh89m363rfd9sch0wgbabh531hfx72vn";
-    };
-  }
-  {
-    goPackagePath = "github.com/Microsoft/hcsshim";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Microsoft/hcsshim";
-      rev = "v0.7.4";
-      sha256 = "0hky9p6xvkkx2jfkd4fy2d6iaikvlzalyw67gypyqyxygf2hsshg";
-    };
-  }
-  {
-    goPackagePath = "github.com/alexflint/go-filemutex";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alexflint/go-filemutex";
-      rev = "72bdc8eae2ae";
-      sha256 = "082y6y9zv40q3kaqvsv6fyaw2fc42j0sn9z0dl9rbiz4szixj3c4";
-    };
-  }
-  {
-    goPackagePath = "github.com/buger/jsonparser";
-    fetch = {
-      type = "git";
-      url = "https://github.com/buger/jsonparser";
-      rev = "f4dd9f5a6b44";
-      sha256 = "12qa2n33s7yz88ywpr3k9kg3b4gm6rqgnv28iyikyxw8h5jascz5";
-    };
-  }
-  {
-    goPackagePath = "github.com/containernetworking/cni";
-    fetch = {
-      type = "git";
-      url = "https://github.com/containernetworking/cni";
-      rev = "v0.7.0";
-      sha256 = "15ad323dw44k82bfx9r8w5q2kn7jix60p9v4ciyzx2p5pip36wp8";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-iptables";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-iptables";
-      rev = "v0.4.1";
-      sha256 = "0id1npqw3rd5rrkslf6i9yy6lpmd7l5qcglln38g85ylq7inysyi";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-systemd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-systemd";
-      rev = "39ca1b05acc7";
-      sha256 = "1kzqrrzqspa5qm7kwslxl3m16lqzns23c24rv474ajzwmj3ixmx1";
-    };
-  }
-  {
-    goPackagePath = "github.com/d2g/dhcp4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/d2g/dhcp4";
-      rev = "f0e4d29ff023";
-      sha256 = "07gn9bjvnlfz2jv9wdq3gxxxm9lpwgrwk8z65072jdrz9rs9izpr";
-    };
-  }
-  {
-    goPackagePath = "github.com/d2g/dhcp4client";
-    fetch = {
-      type = "git";
-      url = "https://github.com/d2g/dhcp4client";
-      rev = "bed07e1bc5b8";
-      sha256 = "0kyjalv1kah7sk3i96abg71cgy5s9kzpff2zc7mwj69vicbj7mi3";
-    };
-  }
-  {
-    goPackagePath = "github.com/d2g/dhcp4server";
-    fetch = {
-      type = "git";
-      url = "https://github.com/d2g/dhcp4server";
-      rev = "477b11cea4dc";
-      sha256 = "010dpw6cxrsm6dm49w1q6qpz5xz3lbi5viz6wywxk49fxvnzmx9l";
-    };
-  }
-  {
-    goPackagePath = "github.com/godbus/dbus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/godbus/dbus";
-      rev = "885f9cc04c9c";
-      sha256 = "0wjpaj4vr5lvpnwc5faf3qizd7zd2v9yq0fm0558wap1hiyqb8x8";
-    };
-  }
-  {
-    goPackagePath = "github.com/j-keck/arping";
-    fetch = {
-      type = "git";
-      url = "https://github.com/j-keck/arping";
-      rev = "2cf9dc699c56";
-      sha256 = "1bid8mpx3j4546ni0a6q5xyz7hb854g95qnxqmg5jzs9vrcird3c";
-    };
-  }
-  {
-    goPackagePath = "github.com/juju/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/juju/errors";
-      rev = "22422dad46e1";
-      sha256 = "1766ys24y9qgngaqbx0g84lmh54b3369v8hk5fa1k8si2d34fxas";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-shellwords";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-shellwords";
-      rev = "v1.0.3";
-      sha256 = "1pg7pl25wvpl2dbpyrv9p1r7prnqimxlf6136vn0dfm54j2x4mnr";
-    };
-  }
-  {
-    goPackagePath = "github.com/onsi/ginkgo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/onsi/ginkgo";
-      rev = "7f8ab55aaf3b";
-      sha256 = "0nas6wqdym4jx42kw9wj80b58r69k9qhnvglz009lj34g5gba7rw";
-    };
-  }
-  {
-    goPackagePath = "github.com/onsi/gomega";
-    fetch = {
-      type = "git";
-      url = "https://github.com/onsi/gomega";
-      rev = "2152b45fa28a";
-      sha256 = "0amjlkawp84mmdqjgdamf93p1546cla6h4wwrx7hf5r862r2qcw2";
-    };
-  }
-  {
-    goPackagePath = "github.com/safchain/ethtool";
-    fetch = {
-      type = "git";
-      url = "https://github.com/safchain/ethtool";
-      rev = "42ed695e3de8";
-      sha256 = "0n5hkrzc1bh46nidcssx4539kvcmgj501v3kzh2pljpg27509daj";
-    };
-  }
-  {
-    goPackagePath = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev = "v1.0.6";
-      sha256 = "029irw2lsbqi944gdrbkwdw0m2794sqni4g21gsnmz142hbzds8c";
-    };
-  }
-  {
-    goPackagePath = "github.com/vishvananda/netlink";
-    fetch = {
-      type = "git";
-      url = "https://github.com/vishvananda/netlink";
-      rev = "023a6dafdcdf";
-      sha256 = "1i5q8r8rg7lxzvq2vhbf25lrkzdlgficfv0bxg9rf7cgg6z819sn";
-    };
-  }
-  {
-    goPackagePath = "github.com/vishvananda/netns";
-    fetch = {
-      type = "git";
-      url = "https://github.com/vishvananda/netns";
-      rev = "13995c7128cc";
-      sha256 = "1zk6w8158qi4niva5rijchbv9ixgmijsgqshh54wdaav4xrhjshn";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "7c1a557ab941";
-      sha256 = "1f1q9mby8m7ws3gbj90v0prhnf4g2sgf74azmw31kzwd6azlar3m";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "49bb7cea24b1";
-      sha256 = "111q4qm3hcjvzvyv9y5rz8ydnyg48rckcygxqy6gv63q618wz6gn";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "66b7b1311ac8";
-      sha256 = "00ny4r2bbj6rz939iy9g699acqydq7rfi6r6awn25w9i2dld9m13";
-    };
-  }
-]
diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
index 8988c7efc33f0..9c6eec1a3363b 100644
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -1,24 +1,22 @@
-{ stdenv, lib, fetchFromGitHub, go, removeReferencesTo, buildGoPackage }:
+{ lib, fetchFromGitHub, buildGoPackage }:
+
 buildGoPackage rec {
   pname = "cni-plugins";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    sha256 = "02kz6y3klhbriybsskn4hmldwli28cycnp2klsm2x0y9c73iczdp";
+    sha256 = "17c8pvpn0dpda6ah7irr9hhd8sk7mnm32zv72nc5pxg1xvfpaipi";
   };
 
-  goDeps = ./plugins-deps.nix;
   goPackagePath = "github.com/containernetworking/plugins";
+
   subPackages = [
-    "plugins/meta/bandwidth"
-    "plugins/meta/firewall"
-    "plugins/meta/flannel"
-    "plugins/meta/portmap"
-    "plugins/meta/sbr"
-    "plugins/meta/tuning"
+    "plugins/ipam/dhcp"
+    "plugins/ipam/host-local"
+    "plugins/ipam/static"
     "plugins/main/bridge"
     "plugins/main/host-device"
     "plugins/main/ipvlan"
@@ -26,10 +24,14 @@ buildGoPackage rec {
     "plugins/main/macvlan"
     "plugins/main/ptp"
     "plugins/main/vlan"
-    "plugins/ipam/dhcp"
-    "plugins/ipam/host-local"
-    "plugins/ipam/static"
+    "plugins/meta/bandwidth"
+    "plugins/meta/firewall"
+    "plugins/meta/flannel"
+    "plugins/meta/portmap"
+    "plugins/meta/sbr"
+    "plugins/meta/tuning"
   ];
+
   meta = with lib; {
     description = "Some standard networking plugins, maintained by the CNI team";
     homepage = "https://github.com/containernetworking/plugins";
diff --git a/pkgs/applications/networking/ids/zeek/default.nix b/pkgs/applications/networking/ids/zeek/default.nix
index 6faacf2e67e69..8fe856f9773f7 100644
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@@ -5,11 +5,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zeek";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchurl {
-    url = "https://old.zeek.org/downloads/zeek-${version}.tar.gz";
-    sha256 = "0siybzdp8w62jqk5vdi5fxwvj6cn4r6c2d4z2axd4rj5vhv5zvx2";
+    url = "https://download.zeek.org/zeek-${version}.tar.gz";
+    sha256 = "18aa4pfwav8m6vq7cr4bhfg243da54ak933rqbriljnhsrgp4n0q";
   };
 
   nativeBuildInputs = [ cmake flex bison file ];
diff --git a/pkgs/applications/networking/gmailieer/default.nix b/pkgs/applications/networking/lieer/default.nix
index 2acc838e4a4f0..fc5214f0d01fd 100644
--- a/pkgs/applications/networking/gmailieer/default.nix
+++ b/pkgs/applications/networking/lieer/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
-  name = "gmailieer-${version}";
-  version = "1.0";
+  pname = "lieer";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "gauteh";
-    repo = "gmailieer";
+    repo = "lieer";
     rev = "v${version}";
-    sha256 = "1zzylv8xbcrh34bz0s29dawzcyx39lai8y8wk0bl4x75v1jfynvf";
+    sha256 = "19jx3sm925nrzl26km1bxbp6y5gk1mzwadd79vip2jl70b3xk9f8";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -27,8 +27,8 @@ python3Packages.buildPythonApplication rec {
       tags in the notmuch database may be pushed back remotely to your
       GMail account.
     '';
-    homepage         = "https://github.com/gauteh/gmailieer";
-    repositories.git = "https://github.com/gauteh/gmailieer.git";
+    homepage         = "https://lieer.gaute.vetsj.com/";
+    repositories.git = "https://github.com/gauteh/lieer.git";
     license          = licenses.gpl3Plus;
     maintainers      = with maintainers; [ kaiha ];
   };
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 7625ba3bea82c..976fc0fcd2d74 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -62,6 +62,11 @@ in (stdenv.mkDerivation rec {
 
   patches = [
     ./xdg-open-brief.patch
+    (fetchpatch {
+      url = "https://git.pld-linux.org/gitweb.cgi?p=packages/libreoffice.git;a=blob_plain;f=poppler-0.86.patch;h=76b8356d5f22ef537a83b0f9b0debab591f152fe;hb=a2737a61353e305a9ee69640fb20d4582c218008";
+      name = "poppler-0.86.patch";
+      sha256 = "0q6k4l8imgp8ailcv0qx5l83afyw44hah24fi7gjrm9xgv5sbb8j";
+    })
   ];
 
   tarballPath = "external/tarballs";
diff --git a/pkgs/applications/office/libreoffice/src-fresh/download.nix b/pkgs/applications/office/libreoffice/src-fresh/download.nix
index bc329e5a8f89f..f4b14870eb791 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/download.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/download.nix
@@ -728,11 +728,11 @@
     md5name = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126-postgresql-9.2.24.tar.bz2";
   }
   {
-    name = "Python-3.7.6.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/Python-3.7.6.tar.xz";
-    sha256 = "55a2cce72049f0794e9a11a84862e9039af9183603b78bc60d89539f82cf533f";
+    name = "Python-3.7.7.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/Python-3.7.7.tar.xz";
+    sha256 = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136";
     md5 = "";
-    md5name = "55a2cce72049f0794e9a11a84862e9039af9183603b78bc60d89539f82cf533f-Python-3.7.6.tar.xz";
+    md5name = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136-Python-3.7.7.tar.xz";
   }
   {
     name = "QR-Code-generator-1.4.0.tar.gz";
diff --git a/pkgs/applications/office/libreoffice/src-fresh/primary.nix b/pkgs/applications/office/libreoffice/src-fresh/primary.nix
index fb21d1292d6d5..5b62b0df95449 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/primary.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/primary.nix
@@ -8,8 +8,8 @@ rec {
 
   major = "6";
   minor = "4";
-  patch = "1";
-  tweak = "1";
+  patch = "3";
+  tweak = "2";
 
   subdir = "${major}.${minor}.${patch}";
 
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "03fqpkilz4yi35l447hb9r8gjwj23l61bpdkwg21jm8blm8kkvyj";
+    sha256 = "1cmbrhha7mlflnlbpla8fix07cxcgkdb7krnrgs1bylf31y5855w";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "0a7arjlxxy7hjm1brxwd124bf1gkbl92bgygi3sbbhbsv07pjdcr";
+    sha256 = "06z9hz4m3kdcljjc6y5s18001axjibj9xiyakdndkl9pmnnhn9h3";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "1hfllrdyxrg5mgqry3dcrhjbdrd0d27k5mvv4sfj7nwjlmjh8rqq";
+    sha256 = "0mpgrwg8z1q38j03l6m1sdpcplyjd5nz1nqaa13vfkryj2lflw45";
   };
 }
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index 85f6ac42126db..dd6c5a09851e3 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "4.030";
+  version = "4.032";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${pname}-${version}.tgz";
-    sha256 = "07ldkf7xkr31n1dmx82bmzam8bvc1vsp32k76vd7yzn7r853qyky";
+    sha256 = "1l3rhgw7pk59dz7dyhcl0iygn6c9rv9bv131rfzg66asxfwbfq1s";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/logic/beluga/default.nix b/pkgs/applications/science/logic/beluga/default.nix
index 55cee9b7e17c1..44478a032b38a 100644
--- a/pkgs/applications/science/logic/beluga/default.nix
+++ b/pkgs/applications/science/logic/beluga/default.nix
@@ -1,34 +1,40 @@
-{ stdenv, fetchFromGitHub, ocamlPackages, omake }:
+{ lib, fetchFromGitHub, ocamlPackages, rsync }:
 
-stdenv.mkDerivation {
-  name = "beluga-20180403";
+ocamlPackages.buildDunePackage {
+  pname = "beluga";
+  version = "unstable-2020-03-11";
 
   src = fetchFromGitHub {
     owner  = "Beluga-lang";
     repo   = "Beluga";
-    rev    = "046aa59f008be70a7c4700b723bed0214ea8b687";
-    sha256 = "0m68y0r0wdw3mg2jks68bihaww7sg305zdfnic1rkndq2cxv0mld";
+    rev    = "6133b2f572219333f304bb4f77c177592324c55b";
+    sha256 = "0sy6mi50z3mvs5z7dx38piydapk89all81rh038x3559b5fsk68q";
   };
 
-  nativeBuildInputs = with ocamlPackages; [ findlib ocamlbuild omake ];
-  buildInputs = with ocamlPackages; [ ocaml ulex ocaml_extlib ];
+  useDune2 = true;
 
-  installPhase = ''
-    mkdir -p $out
-    cp -r bin $out/
+  buildInputs = with ocamlPackages; [
+    gen sedlex_2 ocaml_extlib dune-build-info linenoise
+  ];
 
-    mkdir -p $out/share/beluga
-    cp -r tools/ examples/ $out/share/beluga
+  postPatch = ''
+    patchShebangs ./TEST ./run_harpoon_test.sh
+  '';
+
+  checkPhase = "./TEST";
+  checkInputs = [ rsync ];
+  doCheck = true;
 
+  postInstall = ''
     mkdir -p $out/share/emacs/site-lisp/beluga/
     cp -r tools/beluga-mode.el $out/share/emacs/site-lisp/beluga
   '';
 
-  meta = {
+  meta = with lib; {
     description = "A functional language for reasoning about formal systems";
     homepage    = "http://complogic.cs.mcgill.ca/beluga/";
-    license     = stdenv.lib.licenses.gpl3Plus;
-    maintainers = [ stdenv.lib.maintainers.bcdarwin ];
-    platforms   = stdenv.lib.platforms.unix;
+    license     = licenses.gpl3Plus;
+    maintainers = [ maintainers.bcdarwin ];
+    platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
index ef6ebbe6813b9..54f0f744c04bc 100644
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -80,6 +80,8 @@ stdenv.mkDerivation {
   configureFlags = stdenv.lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "ac_cv_fread_reads_directories=yes"
     "ac_cv_snprintf_returns_bogus=no"
+    "ac_cv_iconv_omits_bom=no"
+    "ac_cv_prog_CURL_CONFIG=${curl.dev}/bin/curl-config"
   ];
 
   preBuild = ''
diff --git a/pkgs/applications/video/kodi/default.nix b/pkgs/applications/video/kodi/default.nix
index d13dd3201a322..6d02bcefb0846 100644
--- a/pkgs/applications/video/kodi/default.nix
+++ b/pkgs/applications/video/kodi/default.nix
@@ -4,22 +4,20 @@
 , boost, avahi, lame, autoreconfHook
 , gettext, pcre-cpp, yajl, fribidi, which
 , openssl, gperf, tinyxml2, taglib, libssh, swig, jre
-, libX11, xorgproto, libxml2
-, libXt, libXmu, libXext
-, libXinerama, libXrandr
-, libXtst, libXfixes, systemd
+, libxml2, systemd
 , alsaLib, libGLU, libGL, glew, fontconfig, freetype, ftgl
 , libjpeg, libpng, libtiff
 , libmpeg2, libsamplerate, libmad
 , libogg, libvorbis, flac, libxslt
 , lzo, libcdio, libmodplug, libass, libbluray
 , sqlite, libmysqlclient, nasm, gnutls, libva, libdrm
-, curl, bzip2, zip, unzip, glxinfo, xdpyinfo
+, curl, bzip2, zip, unzip, glxinfo
 , libcec, libcec_platform, dcadec, libuuid
 , libcrossguid, libmicrohttpd
-, bluez, doxygen, giflib, glib, harfbuzz, lcms2, libidn, libpthreadstubs, libtasn1, libXdmcp
+, bluez, doxygen, giflib, glib, harfbuzz, lcms2, libidn, libpthreadstubs, libtasn1
 , libplist, p11-kit, zlib, flatbuffers, fmt, fstrcmp, rapidjson
 , lirc
+, x11Support ? true, libX11, xorgproto, libXt, libXmu, libXext, libXinerama, libXrandr, libXtst, libXfixes, xdpyinfo, libXdmcp
 , dbusSupport ? true, dbus ? null
 , joystickSupport ? true, cwiid ? null
 , nfsSupport ? true, libnfs ? null
@@ -32,6 +30,7 @@
 , useWayland ? false, wayland ? null, wayland-protocols ? null
 , waylandpp ?  null, libxkbcommon ? null
 , useGbm ? false, mesa ? null, libinput ? null
+, buildPackages
 }:
 
 assert dbusSupport  -> dbus != null;
@@ -94,10 +93,18 @@ let
     sha256  = "1krsjlr949iy5l6ljxancza1yi6w1annxc5s6k283i9mb15qy8cy";
     preConfigure = ''
       cp ${kodi_src}/tools/depends/target/ffmpeg/{CMakeLists.txt,*.cmake} .
+      sed -i 's/ --cpu=''${CPU}//' CMakeLists.txt
+      sed -i 's/--strip=''${CMAKE_STRIP}/--strip=''${CMAKE_STRIP} --ranlib=''${CMAKE_RANLIB}/' CMakeLists.txt
     '';
-    buildInputs = [ gnutls libidn libtasn1 p11-kit zlib libva ]
+    cmakeFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      "-DCROSSCOMPILING=ON"
+      "-DCPU=${stdenv.hostPlatform.parsed.cpu.name}"
+      "-DOS=${stdenv.hostPlatform.parsed.kernel.name}"
+      "-DPKG_CONFIG_EXECUTABLE=pkgconfig"
+    ];
+    buildInputs = [ libidn libtasn1 p11-kit zlib libva ]
       ++ lib.optional  vdpauSupport    libvdpau;
-    nativeBuildInputs = [ cmake nasm pkgconfig ];
+    nativeBuildInputs = [ cmake nasm pkgconfig gnutls ];
   };
 
   # We can build these externally but FindLibDvd.cmake forces us to build it
@@ -152,29 +159,31 @@ in stdenv.mkDerivation {
 
     buildInputs = [
       gnutls libidn libtasn1 nasm p11-kit
-      libxml2 yasm python2Packages.python
+      libxml2 python2Packages.python
       boost libmicrohttpd
       gettext pcre-cpp yajl fribidi libva libdrm
-      openssl gperf tinyxml2 taglib libssh swig jre
-      libX11 xorgproto libXt libXmu libXext
-      libXinerama libXrandr libXtst libXfixes
-      alsaLib libGL libGLU glew fontconfig freetype ftgl
+      openssl gperf tinyxml2 taglib libssh
+      alsaLib libGL libGLU fontconfig freetype ftgl
       libjpeg libpng libtiff
       libmpeg2 libsamplerate libmad
       libogg libvorbis flac libxslt systemd
       lzo libcdio libmodplug libass libbluray
       sqlite libmysqlclient avahi lame
-      curl bzip2 zip unzip glxinfo xdpyinfo
+      curl bzip2 zip unzip glxinfo
       libcec libcec_platform dcadec libuuid
       libgcrypt libgpgerror libunistring
-      libcrossguid cwiid libplist
-      bluez giflib glib harfbuzz lcms2 libpthreadstubs libXdmcp
+      libcrossguid libplist
+      bluez giflib glib harfbuzz lcms2 libpthreadstubs
       ffmpeg flatbuffers fmt fstrcmp rapidjson
       lirc
       # libdvdcss libdvdnav libdvdread
     ]
+    ++ lib.optional x11Support [
+      libX11 xorgproto libXt libXmu libXext libXdmcp
+      libXinerama libXrandr libXtst libXfixes
+    ]
     ++ lib.optional  dbusSupport     dbus
-    ++ lib.optionals joystickSupport [ cwiid ]
+    ++ lib.optional joystickSupport cwiid
     ++ lib.optional  nfsSupport      libnfs
     ++ lib.optional  pulseSupport    libpulseaudio
     ++ lib.optional  rtmpSupport     rtmpdump
@@ -183,7 +192,7 @@ in stdenv.mkDerivation {
     ++ lib.optional  usbSupport      libusb
     ++ lib.optional  vdpauSupport    libvdpau
     ++ lib.optionals useWayland [
-      wayland waylandpp
+      wayland waylandpp wayland-protocols
       # Not sure why ".dev" is needed here, but CMake doesn't find libxkbcommon otherwise
       libxkbcommon.dev
     ]
@@ -200,8 +209,16 @@ in stdenv.mkDerivation {
       which
       pkgconfig gnumake
       autoconf automake libtool # still needed for some components. Check if that is the case with 19.0
+      jre yasm gettext python2Packages.python flatbuffers
+
+      # for TexturePacker
+      giflib zlib libpng libjpeg lzo
     ] ++ lib.optionals useWayland [ wayland-protocols ];
 
+    depsBuildBuild = [
+      buildPackages.stdenv.cc
+    ];
+
     cmakeFlags = [
       "-Dlibdvdcss_URL=${libdvdcss.src}"
       "-Dlibdvdnav_URL=${libdvdnav.src}"
@@ -210,9 +227,14 @@ in stdenv.mkDerivation {
       "-DENABLE_EVENTCLIENTS=ON"
       "-DENABLE_INTERNAL_CROSSGUID=OFF"
       "-DENABLE_OPTICAL=ON"
+      "-DLIRC_DEVICE=/run/lirc/lircd"
+      "-DSWIG_EXECUTABLE=${buildPackages.swig}/bin/swig"
+      "-DFLATBUFFERS_FLATC_EXECUTABLE=${buildPackages.flatbuffers}/bin/flatc"
+      "-DPYTHON_EXECUTABLE=${buildPackages.python2Packages.python}/bin/python"
     ] ++ lib.optional useWayland [
       "-DCORE_PLATFORM_NAME=wayland"
       "-DWAYLAND_RENDER_SYSTEM=gl"
+      "-DWAYLANDPP_SCANNER=${buildPackages.waylandpp}/bin/wayland-scanner++"
     ] ++ lib.optional useGbm [
       "-DCORE_PLATFORM_NAME=gbm"
       "-DGBM_RENDER_SYSTEM=gles"
@@ -224,6 +246,16 @@ in stdenv.mkDerivation {
     # I'm guessing there is a thing waiting to time out
     doCheck = false;
 
+    # Need these tools on the build system when cross compiling,
+    # hacky, but have found no other way.
+    preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+      CXX=c++ LD=ld make -C tools/depends/native/JsonSchemaBuilder
+      cmakeFlags+=" -DWITH_JSONSCHEMABUILDER=$PWD/tools/depends/native/JsonSchemaBuilder/bin"
+
+      CXX=c++ LD=ld make EXTRA_CONFIGURE= -C tools/depends/native/TexturePacker
+      cmakeFlags+=" -DWITH_TEXTUREPACKER=$PWD/tools/depends/native/TexturePacker/bin"
+    '';
+
     postPatch = ''
       substituteInPlace xbmc/platform/linux/LinuxTimezone.cpp \
         --replace 'usr/share/zoneinfo' 'etc/zoneinfo'
@@ -232,9 +264,11 @@ in stdenv.mkDerivation {
     postInstall = ''
       for p in $(ls $out/bin/) ; do
         wrapProgram $out/bin/$p \
-          --prefix PATH            ":" "${lib.makeBinPath [ python2Packages.python glxinfo xdpyinfo ]}" \
+          --prefix PATH            ":" "${lib.makeBinPath ([ python2Packages.python glxinfo ] ++ lib.optional x11Support xdpyinfo)}" \
           --prefix LD_LIBRARY_PATH ":" "${lib.makeLibraryPath
-              ([ curl systemd libmad libvdpau libcec libcec_platform rtmpdump libass ] ++ lib.optional nfsSupport libnfs)}"
+              ([ curl systemd libmad libvdpau libcec libcec_platform libass ]
+                 ++ lib.optional nfsSupport libnfs
+                 ++ lib.optional rtmpSupport rtmpdump)}"
       done
 
       substituteInPlace $out/share/xsessions/kodi.desktop \
diff --git a/pkgs/applications/video/plex-media-player/default.nix b/pkgs/applications/video/plex-media-player/default.nix
index 8b7aa3b551cc0..d08a4a8524288 100644
--- a/pkgs/applications/video/plex-media-player/default.nix
+++ b/pkgs/applications/video/plex-media-player/default.nix
@@ -5,45 +5,20 @@ let
   # During compilation, a CMake bundle is downloaded from `artifacts.plex.tv`,
   # which then downloads a handful of web client-related files. To enable
   # sandboxed builds, we manually download them and save them so these files
-  # are fetched ahead-of-time instead of during the CMake build. Whenever
-  # plex-media-player is updated, the versions for these files are changed,
-  # so the build IDs (and SHAs) below will need to be updated!
-  depSrcs = rec {
-    webClientBuildId = "141-4af71961b12c68";
-    webClientDesktopBuildId = "3.104.2-1b12c68";
-    webClientTvBuildId = "4.3.0-4af7196";
-
-    webClient = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/buildid.cmake";
-      sha256 = "0fpkd1s49dbiqqlijxbillqd71a78p8y2sc23mwp0lvcmxrg265p";
-    };
-    webClientDesktopHash = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz.sha1";
-      sha256 = "0sb0j44lwqz9zbm98nba4x6c1jxdzvs36ynwfg527avkxxna0f8f";
-    };
-    webClientDesktop = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz";
-      sha256 = "0dxa0ka0igfsryzda4r5clwdl47ah78nmlmgj9d5pgsvyvzjp87z";
-    };
-    webClientTvHash = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz.sha1";
-      sha256 = "086w1bavk2aqsyhv9zi5fynk31zf61sl91r6gjrdrz656wfk5bxa";
-    };
-    webClientTv = fetchurl {
-      url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz";
-      sha256 = "12vbgsfnj0j2y5jd73dpi08hqsr9888sma41nvd4ydsd7qblm455";
-    };
-  };
+  # are fetched ahead-of-time instead of during the CMake build. To update
+  # plex-media-player use the update.sh script, so the versions and hashes
+  # for these files are are also updated!
+  depSrcs = import ./deps.nix { inherit fetchurl; };
 in mkDerivation rec {
   pname = "plex-media-player";
-  version = "2.40.0.1007";
-  vsnHash = "5482132c";
+  version = "2.55.0.1069";
+  vsnHash = "2369bed9";
 
   src = fetchFromGitHub {
     owner = "plexinc";
     repo = "plex-media-player";
     rev = "v${version}-${vsnHash}";
-    sha256 = "0ibdh5g8x32iy74q97jfsmxd08wnyrzs3gfiwjfgc10vaa1qdhli";
+    sha256 = "1jq4592sgaia0xy2h7n3vh5i7c84sdh4l64fdc774r4i0bmg66qi";
   };
 
   nativeBuildInputs = [ pkgconfig cmake python3 ];
@@ -61,6 +36,8 @@ in mkDerivation rec {
 
   cmakeFlags = [ "-DCMAKE_BUILD_TYPE=RelWithDebInfo" "-DQTROOT=${qtbase}" ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = with stdenv.lib; {
     description = "Streaming media player for Plex";
     license = licenses.gpl2;
diff --git a/pkgs/applications/video/plex-media-player/deps.nix b/pkgs/applications/video/plex-media-player/deps.nix
new file mode 100644
index 0000000000000..26b57532615aa
--- /dev/null
+++ b/pkgs/applications/video/plex-media-player/deps.nix
@@ -0,0 +1,28 @@
+{ fetchurl }:
+
+rec {
+  webClientBuildId = "180-afec74de50e175";
+  webClientDesktopBuildId = "4.29.2-e50e175";
+  webClientTvBuildId = "4.29.3-afec74d";
+
+  webClient = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/buildid.cmake";
+    sha256 = "0rabrg3lk9vgpswk8npa54hzqf2v8ghqqnysxpwn12wrp1pc2rr9";
+  };
+  webClientDesktopHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz.sha1";
+    sha256 = "02b5yq4yc411qlg2dkw5j9lrr3cn2y4d27sin0skf6qza180473g";
+  };
+  webClientDesktop = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz";
+    sha256 = "0l3xv48kr2rx878a40zrgwif2ga2ikv6fdcbq9pylycnmm41pxmh";
+  };
+  webClientTvHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz.sha1";
+    sha256 = "0wq115y2xrgwqrzr43nhkq8ba237z20yfp426ki2kdypsq8fjqka";
+  };
+  webClientTv = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz";
+    sha256 = "1wax1qslm226l2w53m2fnl849jw349qhg3rjghx7vip5pmb43vw9";
+  };
+}
diff --git a/pkgs/applications/video/plex-media-player/update.sh b/pkgs/applications/video/plex-media-player/update.sh
new file mode 100755
index 0000000000000..a8493a16c9897
--- /dev/null
+++ b/pkgs/applications/video/plex-media-player/update.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts nix-prefetch-scripts jq
+
+set -xeuo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+
+oldVersion="$(nix-instantiate --eval -E "with import $nixpkgs {}; plex-media-player.version or (builtins.parseDrvName plex-media-player.name).version" | tr -d '"')"
+latestTag="$(curl -s https://api.github.com/repos/plexinc/plex-media-player/tags  | jq -r '.[] | .name' | sort --version-sort | tail -1)"
+latestVersion="$(expr $latestTag : 'v\(.*\)-.*')"
+latestHash="$(expr $latestTag : 'v.*-\(.*\)')"
+
+if [ ! "$oldVersion" = "$latestVersion" ]; then
+  # update default.nix with the new version and hash
+  expectedHash=$(nix-prefetch-git --url https://github.com/plexinc/plex-media-player.git --rev $latestTag --quiet | jq -r '.sha256')
+  update-source-version plex-media-player --version-key=vsnHash "${latestHash}" 0000
+  update-source-version plex-media-player "${latestVersion}" $expectedHash
+
+  # extract the webClientBuildId from the source folder
+  src="$(nix-build --no-out-link $nixpkgs -A plex-media-player.src)"
+  webClientBuildId="$(grep 'set(WEB_CLIENT_BUILD_ID' $src/CMakeModules/WebClient.cmake | cut -d' ' -f2 | tr -d ')')"
+
+  # retreive the included cmake file and hash
+  { read -r webClientBuildIdHash; read -r webClientBuildIdPath; } < \
+    <(nix-prefetch-url --print-path "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/buildid.cmake")
+  webClientDesktopBuildId="$(grep 'set(DESKTOP_VERSION' $webClientBuildIdPath | cut -d' ' -f2 | tr -d ')')"
+  webClientTvBuildId="$(grep 'set(TV_VERSION' $webClientBuildIdPath | cut -d' ' -f2 | tr -d ')')"
+
+  # get the hashes for the other files
+  webClientDesktopHash="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz.sha1")"
+  webClientDesktop="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-desktop-${webClientDesktopBuildId}.tar.xz")"
+  webClientTvHash="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz.sha1")"
+  webClientTv="$(nix-prefetch-url "https://artifacts.plex.tv/web-client-pmp/${webClientBuildId}/web-client-tv-${webClientTvBuildId}.tar.xz")"
+
+  # update deps.nix
+  cat > $nixpkgs/pkgs/applications/video/plex-media-player/deps.nix <<EOF
+{ fetchurl }:
+
+rec {
+  webClientBuildId = "${webClientBuildId}";
+  webClientDesktopBuildId = "${webClientDesktopBuildId}";
+  webClientTvBuildId = "${webClientTvBuildId}";
+
+  webClient = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/buildid.cmake";
+    sha256 = "${webClientBuildIdHash}";
+  };
+  webClientDesktopHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-desktop-\${webClientDesktopBuildId}.tar.xz.sha1";
+    sha256 = "${webClientDesktopHash}";
+  };
+  webClientDesktop = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-desktop-\${webClientDesktopBuildId}.tar.xz";
+    sha256 = "${webClientDesktop}";
+  };
+  webClientTvHash = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-tv-\${webClientTvBuildId}.tar.xz.sha1";
+    sha256 = "${webClientTvHash}";
+  };
+  webClientTv = fetchurl {
+    url = "https://artifacts.plex.tv/web-client-pmp/\${webClientBuildId}/web-client-tv-\${webClientTvBuildId}.tar.xz";
+    sha256 = "${webClientTv}";
+  };
+}
+EOF
+
+  git add "$nixpkgs"/pkgs/applications/video/plex-media-player/{default,deps}.nix
+  git commit -m "plex-media-player: ${oldVersion} -> ${latestVersion}"
+else
+  echo "plex-media-player is already up-to-date"
+fi
diff --git a/pkgs/applications/virtualization/conmon/default.nix b/pkgs/applications/virtualization/conmon/default.nix
index b09911cf6e502..bfe9f1d34865f 100644
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@@ -18,10 +18,10 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ glib systemd ] ++
-    stdenv.lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
+  buildInputs = [ glib systemd ]
+  ++ stdenv.lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
 
-  installPhase = "install -Dm755 bin/${pname} $out/bin/${pname}";
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/containers/conmon";
diff --git a/pkgs/applications/virtualization/qtemu/default.nix b/pkgs/applications/virtualization/qtemu/default.nix
new file mode 100644
index 0000000000000..29f0004be830b
--- /dev/null
+++ b/pkgs/applications/virtualization/qtemu/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, mkDerivation, fetchFromGitLab, pkgconfig, qmake, qtbase, qemu, makeWrapper }:
+
+mkDerivation rec {
+  pname = "qtemu";
+  version = "2.1";
+
+  src = fetchFromGitLab {
+    owner = "qtemu";
+    repo = "gui";
+    rev = version;
+    sha256 = "1555178mkfw0gwmw8bsxmg4339j2ifp0yb4b2f39nxh9hwshg07j";
+  };
+
+  nativeBuildInputs = [
+    qmake
+    pkgconfig
+  ];
+
+  buildInputs = [
+    qtbase
+    qemu
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # upstream lacks an install method
+    install -D -t $out/share/applications qtemu.desktop
+    install -D -t $out/share/pixmaps qtemu.png
+    install -D -t $out/bin qtemu
+
+    # make sure that the qemu-* executables are found
+    wrapProgram $out/bin/qtemu --prefix PATH : ${stdenv.lib.makeBinPath [ qemu ]}
+
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Qt-based front-end for QEMU emulator";
+    homepage = "https://qtemu.org";
+    license = licenses.gpl2;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/build-support/alternatives/blas/default.nix b/pkgs/build-support/alternatives/blas/default.nix
index b1dadf23c0781..36708ce8841a4 100644
--- a/pkgs/build-support/alternatives/blas/default.nix
+++ b/pkgs/build-support/alternatives/blas/default.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation {
   patchelf --set-rpath "$(patchelf --print-rpath $out/lib/libblas${canonicalExtension}):${lib.getLib blasProvider}/lib" $out/lib/libblas${canonicalExtension}
 '' else if stdenv.hostPlatform.isDarwin then ''
   install_name_tool \
-    -id libblas${canonicalExtension}
+    -id libblas${canonicalExtension} \
     -add_rpath ${lib.getLib blasProvider}/lib \
     $out/lib/libblas${canonicalExtension}
 '' else "") + ''
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 1358b167f6ecc..323ea5bfd7722 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -10,6 +10,7 @@ var_templates_list=(
     NIX+CFLAGS_LINK
     NIX+CXXSTDLIB_COMPILE
     NIX+CXXSTDLIB_LINK
+    NIX+GNATFLAGS_COMPILE
 )
 var_templates_bool=(
     NIX+ENFORCE_NO_NATIVE
@@ -40,6 +41,10 @@ if [ -e @out@/nix-support/cc-cflags ]; then
     NIX_@infixSalt@_CFLAGS_COMPILE="$(< @out@/nix-support/cc-cflags) $NIX_@infixSalt@_CFLAGS_COMPILE"
 fi
 
+if [ -e @out@/nix-support/gnat-cflags ]; then
+    NIX_@infixSalt@_GNATFLAGS_COMPILE="$(< @out@/nix-support/gnat-cflags) $NIX_@infixSalt@_GNATFLAGS_COMPILE"
+fi
+
 if [ -e @out@/nix-support/cc-ldflags ]; then
     NIX_@infixSalt@_LDFLAGS+=" $(< @out@/nix-support/cc-ldflags)"
 fi
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index f6248335052cb..1b7c5750727af 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -199,6 +199,12 @@ stdenv.mkDerivation {
       fi
     ''
 
+    + optionalString cc.langAda or false ''
+      wrap ${targetPrefix}gnatmake ${./gnat-wrapper.sh} $ccPath/${targetPrefix}gnatmake
+      wrap ${targetPrefix}gnatbind ${./gnat-wrapper.sh} $ccPath/${targetPrefix}gnatbind
+      wrap ${targetPrefix}gnatlink ${./gnat-wrapper.sh} $ccPath/${targetPrefix}gnatlink
+    ''
+
     + optionalString cc.langFortran or false ''
       wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
       ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
@@ -283,6 +289,13 @@ stdenv.mkDerivation {
       ccLDFlags+=" -L${cc_solib}/lib"
       ccCFlags+=" -B${cc_solib}/lib"
 
+    '' + optionalString cc.langAda or false ''
+      basePath=$(echo $cc/lib/*/*/*)
+      ccCFlags+=" -B$basePath -I$basePath/adainclude"
+      gnatCFlags="-I$basePath/adainclude -I$basePath/adalib"
+
+      echo "$gnatCFlags" > $out/nix-support/gnat-cflags
+    '' + ''
       echo "$ccLDFlags" > $out/nix-support/cc-ldflags
       echo "$ccCFlags" > $out/nix-support/cc-cflags
     '' + optionalString (targetPlatform.isDarwin && (libcxx != null) && (cc.isClang or false)) ''
@@ -351,6 +364,8 @@ stdenv.mkDerivation {
       hardening_unsupported_flags+=" stackprotector fortify pie pic"
     '' + optionalString targetPlatform.isNetBSD ''
       hardening_unsupported_flags+=" stackprotector fortify"
+    '' + optionalString cc.langAda or false ''
+      hardening_unsupported_flags+=" stackprotector strictoverflow"
     ''
 
     + optionalString targetPlatform.isWasm ''
diff --git a/pkgs/build-support/cc-wrapper/gnat-wrapper.sh b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
new file mode 100644
index 0000000000000..15b53d76c6307
--- /dev/null
+++ b/pkgs/build-support/cc-wrapper/gnat-wrapper.sh
@@ -0,0 +1,165 @@
+#! @shell@
+set -eu -o pipefail +o posix
+shopt -s nullglob
+
+if (( "${NIX_DEBUG:-0}" >= 7 )); then
+    set -x
+fi
+
+path_backup="$PATH"
+
+# That @-vars are substituted separately from bash evaluation makes
+# shellcheck think this, and others like it, are useless conditionals.
+# shellcheck disable=SC2157
+if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
+    PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
+fi
+
+source @out@/nix-support/utils.bash
+
+# Flirting with a layer violation here.
+if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+    source @bintools@/nix-support/add-flags.sh
+fi
+
+# Put this one second so libc ldflags take priority.
+if [ -z "${NIX_CC_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
+    source @out@/nix-support/add-flags.sh
+fi
+
+
+# Parse command line options and set several variables.
+# For instance, figure out if linker flags should be passed.
+# GCC prints annoying warnings when they are not needed.
+dontLink=0
+nonFlagArgs=0
+# shellcheck disable=SC2193
+
+expandResponseParams "$@"
+declare -i n=0
+nParams=${#params[@]}
+while (( "$n" < "$nParams" )); do
+    p=${params[n]}
+    p2=${params[n+1]:-} # handle `p` being last one
+    if [ "$p" = -c ]; then
+        dontLink=1
+    elif [ "$p" = -S ]; then
+        dontLink=1
+    elif [ "$p" = -E ]; then
+        dontLink=1
+    elif [ "$p" = -E ]; then
+        dontLink=1
+    elif [ "$p" = -M ]; then
+        dontLink=1
+    elif [ "$p" = -MM ]; then
+        dontLink=1
+    elif [[ "$p" = -x && "$p2" = *-header ]]; then
+        dontLink=1
+    elif [[ "$p" != -?* ]]; then
+        # A dash alone signifies standard input; it is not a flag
+        nonFlagArgs=1
+    fi
+    n+=1
+done
+
+# If we pass a flag like -Wl, then gcc will call the linker unless it
+# can figure out that it has to do something else (e.g., because of a
+# "-c" flag).  So if no non-flag arguments are given, don't pass any
+# linker flags.  This catches cases like "gcc" (should just print
+# "gcc: no input files") and "gcc -v" (should print the version).
+if [ "$nonFlagArgs" = 0 ]; then
+    dontLink=1
+fi
+
+# Optionally filter out paths not refering to the store.
+if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "$NIX_STORE" ]]; then
+    rest=()
+    nParams=${#params[@]}
+    declare -i n=0
+    while (( "$n" < "$nParams" )); do
+        p=${params[n]}
+        p2=${params[n+1]:-} # handle `p` being last one
+        if [ "${p:0:3}" = -L/ ] && badPath "${p:2}"; then
+            skip "${p:2}"
+        elif [ "$p" = -L ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "${p:0:3}" = -I/ ] && badPath "${p:2}"; then
+            skip "${p:2}"
+        elif [ "$p" = -I ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "${p:0:4}" = -aI/ ] && badPath "${p:3}"; then
+            skip "${p:3}"
+        elif [ "$p" = -aI ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "${p:0:4}" = -aO/ ] && badPath "${p:3}"; then
+            skip "${p:3}"
+        elif [ "$p" = -aO ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        elif [ "$p" = -isystem ] && badPath "$p2"; then
+            n+=1; skip "$p2"
+        else
+            rest+=("$p")
+        fi
+        n+=1
+    done
+    # Old bash empty array hack
+    params=(${rest+"${rest[@]}"})
+fi
+
+
+# Clear march/mtune=native -- they bring impurity.
+if [ "$NIX_@infixSalt@_ENFORCE_NO_NATIVE" = 1 ]; then
+    rest=()
+    # Old bash empty array hack
+    for p in ${params+"${params[@]}"}; do
+        if [[ "$p" = -m*=native ]]; then
+            skip "$p"
+        else
+            rest+=("$p")
+        fi
+    done
+    # Old bash empty array hack
+    params=(${rest+"${rest[@]}"})
+fi
+
+if [ "$(basename $0)x" = "gnatmakex" ]; then
+    extraBefore=("--GNATBIND=@out@/bin/gnatbind" "--GNATLINK=@out@/bin/gnatlink")
+    extraAfter=($NIX_@infixSalt@_GNATFLAGS_COMPILE)
+fi
+
+if [ "$(basename $0)x" = "gnatbindx" ]; then
+    extraBefore=()
+    extraAfter=($NIX_@infixSalt@_GNATFLAGS_COMPILE)
+fi
+
+if [ "$(basename $0)x" = "gnatlinkx" ]; then
+    extraBefore=()
+    extraAfter=("--GCC=@out@/bin/gcc")
+fi
+
+# As a very special hack, if the arguments are just `-v', then don't
+# add anything.  This is to prevent `gcc -v' (which normally prints
+# out the version number and returns exit code 0) from printing out
+# `No input files specified' and returning exit code 1.
+if [ "$*" = -v ]; then
+    extraAfter=()
+    extraBefore=()
+fi
+
+# Optionally print debug info.
+if (( "${NIX_DEBUG:-0}" >= 1 )); then
+    # Old bash workaround, see ld-wrapper for explanation.
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" ${extraBefore+"${extraBefore[@]}"}  >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" ${params+"${params[@]}"} >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
+fi
+
+PATH="$path_backup"
+# Old bash workaround, see above.
+exec @prog@ \
+    ${extraBefore+"${extraBefore[@]}"} \
+    ${params+"${params[@]}"} \
+    ${extraAfter+"${extraAfter[@]}"}
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 52c50091d08cb..72970623ed796 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -15,7 +15,7 @@ isExecutable() {
     # *or* there is an INTERP section. This also catches position-independent
     # executables, as they typically have an INTERP section but their ELF type
     # is DYN.
-    isExeResult="$(LANG=C readelf -h -l "$1" 2> /dev/null \
+    isExeResult="$(LANG=C $READELF -h -l "$1" 2> /dev/null \
         | grep '^ *Type: *EXEC\>\|^ *INTERP\>')"
     # not using grep -q, because it can cause Broken pipe
     [ -n "$isExeResult" ]
@@ -207,7 +207,7 @@ autoPatchelf() {
     # outside of this function.
     while IFS= read -r -d $'\0' file; do
       isELF "$file" || continue
-      segmentHeaders="$(LANG=C readelf -l "$file")"
+      segmentHeaders="$(LANG=C $READELF -l "$file")"
       # Skip if the ELF file doesn't have segment headers (eg. object files).
       # not using grep -q, because it can cause Broken pipe
       [ -n "$(echo "$segmentHeaders" | grep '^Program Headers:')" ] || continue
diff --git a/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh b/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh
index 9a6b5f405caba..0fd9bf85d8310 100644
--- a/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh
+++ b/pkgs/data/icons/hicolor-icon-theme/setup-hook.sh
@@ -10,8 +10,7 @@ hicolorIconThemeHook() {
 }
 
 # I think this is meant to be a runtime dep
-addEnvHooks "${hostOffset:?}" hicolorIconThemeHook
-
+addEnvHooks "${targetOffset:?}" hicolorIconThemeHook
 
 # Make symbolic links of parent icon themes that are inherited in the
 # icon themes installed by the package.
diff --git a/pkgs/data/themes/arc/default.nix b/pkgs/data/themes/arc/default.nix
index c08d4c5778611..53e81b323dc13 100644
--- a/pkgs/data/themes/arc/default.nix
+++ b/pkgs/data/themes/arc/default.nix
@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl3;
     maintainers = with maintainers; [ simonvandel romildo ];
     platforms   = platforms.linux;
+    broken = true; # since libsass 3.6.3
   };
 }
diff --git a/pkgs/data/themes/yaru/default.nix b/pkgs/data/themes/yaru/default.nix
index bc9e4de5a6724..a14dbbf61bcf3 100644
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ cc-by-sa-40 gpl3 ];
     platforms = platforms.linux;
     maintainers = [ maintainers.jD91mZM2 ];
+    broken = true; # since libsass 3.6.3
   };
 }
diff --git a/pkgs/desktops/gnome-3/core/epiphany/default.nix b/pkgs/desktops/gnome-3/core/epiphany/default.nix
index 5ede0184d219d..c41f5d79eb71b 100644
--- a/pkgs/desktops/gnome-3/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/core/epiphany/default.nix
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
     python3
     wrapGAppsHook
     buildPackages.glib
+    buildPackages.gtk3
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
index 864dd45aad202..46a50c34556b7 100644
--- a/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-shell/default.nix
@@ -65,7 +65,10 @@ in stdenv.mkDerivation rec {
 
     # Install bash-completions to correct prefix.
     # https://gitlab.gnome.org/GNOME/gnome-shell/merge_requests/1194
-    ./fix-bash-completion.patch
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-shell/commit/9f1ad5d86ddbabaa840eb2860279d53f4e635453.patch";
+      sha256 = "f8MDFbfg9D7ORF84Ld9GIvf0xRCYuSszo3QLMji2VaE=";
+    })
 
     # Use absolute path for libshew installation to make our patched gobject-introspection
     # aware of the location to hardcode in the generated GIR file.
diff --git a/pkgs/desktops/gnome-3/core/gnome-shell/fix-bash-completion.patch b/pkgs/desktops/gnome-3/core/gnome-shell/fix-bash-completion.patch
deleted file mode 100644
index 08f674c23773f..0000000000000
--- a/pkgs/desktops/gnome-3/core/gnome-shell/fix-bash-completion.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/subprojects/extensions-tool/meson.build
-+++ a/subprojects/extensions-tool/meson.build
-@@ -39,6 +39,6 @@ subdir('src')
- 
- if bash_completion.found()
-   install_data('completion/bash/gnome-extensions',
--    install_dir: bash_completion.get_pkgconfig_variable('completionsdir')
-+    install_dir: bash_completion.get_pkgconfig_variable('completionsdir', define_variable: ['prefix', prefix])
-   )
- endif
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 1adffa8174e55..c04e424b2faa4 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -1,5 +1,6 @@
 { stdenv, targetPackages, fetchurl, fetchpatch, fetchFromGitHub, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
+, langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langJava ? false
@@ -15,6 +16,7 @@
 , libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null, boehmgc ? null
+, gnatboot ? null
 , zip ? null, unzip ? null, pkgconfig ? null
 , gtk2 ? null, libart_lgpl ? null
 , libX11 ? null, libXt ? null, libSM ? null, libICE ? null, libXtst ? null
@@ -48,6 +50,8 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 # The go frontend is written in c++
 assert langGo -> langCC;
 
+assert langAda -> gnatboot != null;
+
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;
 
@@ -63,6 +67,7 @@ let majorVersion = "6";
       [ ../use-source-date-epoch.patch ]
       ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
+      ++ optional langAda ../gnat-cflags.patch
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
       ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
@@ -200,6 +205,7 @@ stdenv.mkDerivation ({
     # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
     # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
     ++ (optional hostPlatform.isDarwin gnused)
+    ++ (optional langAda gnatboot)
     ;
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@@ -208,7 +214,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
-    inherit version hostPlatform langJava langGo;
+    inherit version hostPlatform gnatboot langJava langAda langGo;
   };
 
   dontDisableStatic = true;
@@ -234,6 +240,7 @@ stdenv.mkDerivation ({
       langCC
       langFortran
       langJava javaAwtGtk javaAntlr javaEcj
+      langAda
       langGo
       langObjC
       langObjCpp
@@ -292,7 +299,7 @@ stdenv.mkDerivation ({
     ;
 
   passthru = {
-    inherit langC langCC langObjC langObjCpp langFortran langGo version;
+    inherit langC langCC langObjC langObjCpp langFortran langAda langGo version;
     isGNU = true;
   };
 
diff --git a/pkgs/development/compilers/gcc/9/default.nix b/pkgs/development/compilers/gcc/9/default.nix
index a6ba8c9c0f641..5785782a6718c 100644
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@@ -1,5 +1,6 @@
 { stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
 , langC ? true, langCC ? true, langFortran ? false
+, langAda ? false
 , langObjC ? stdenv.targetPlatform.isDarwin
 , langObjCpp ? stdenv.targetPlatform.isDarwin
 , langGo ? false
@@ -13,6 +14,7 @@
 , libelf                      # optional, for link-time optimizations (LTO)
 , isl ? null # optional, for the Graphite optimization framework.
 , zlib ? null
+, gnatboot ? null
 , enableMultilib ? false
 , enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
 , name ? "gcc"
@@ -35,6 +37,7 @@ assert stdenv.hostPlatform.isDarwin -> gnused != null;
 
 # The go frontend is written in c++
 assert langGo -> langCC;
+assert langAda -> gnatboot != null;
 
 # threadsCross is just for MinGW
 assert threadsCross != null -> stdenv.targetPlatform.isWindows;
@@ -54,6 +57,7 @@ let majorVersion = "9";
         url = "https://git.busybox.net/buildroot/plain/package/gcc/${version}/0900-remove-selftests.patch?id=11271540bfe6adafbc133caf6b5b902a816f5f02";
         sha256 = ""; # TODO: uncomment and check hash when available.
       }) */
+      ++ optional langAda ../gnat-cflags.patch
       ++ optional langFortran ../gfortran-driving.patch
       ++ optional (targetPlatform.libc == "musl" && targetPlatform.isPower) ../ppc-musl.patch
       ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
@@ -160,6 +164,7 @@ stdenv.mkDerivation ({
     # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
     # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
     ++ (optional hostPlatform.isDarwin gnused)
+    ++ (optional langAda gnatboot)
     ;
 
   depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
@@ -168,7 +173,7 @@ stdenv.mkDerivation ({
 
   preConfigure = import ../common/pre-configure.nix {
     inherit (stdenv) lib;
-    inherit version hostPlatform langGo;
+    inherit version hostPlatform gnatboot langAda langGo;
   };
 
   dontDisableStatic = true;
@@ -193,6 +198,7 @@ stdenv.mkDerivation ({
       langC
       langCC
       langFortran
+      langAda
       langGo
       langObjC
       langObjCpp
@@ -236,7 +242,7 @@ stdenv.mkDerivation ({
     ;
 
   passthru = {
-    inherit langC langCC langObjC langObjCpp langFortran langGo version;
+    inherit langC langCC langObjC langObjCpp langAda langFortran langGo version;
     isGNU = true;
   };
 
diff --git a/pkgs/development/compilers/gcc/builder.sh b/pkgs/development/compilers/gcc/builder.sh
index 22a21e5b25c65..8d03e0104646d 100644
--- a/pkgs/development/compilers/gcc/builder.sh
+++ b/pkgs/development/compilers/gcc/builder.sh
@@ -216,6 +216,7 @@ postInstall() {
     moveToOutput "${targetConfig+$targetConfig/}lib/lib*.so*" "$lib"
     moveToOutput "${targetConfig+$targetConfig/}lib/lib*.la"  "$lib"
     moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dylib" "$lib"
+    moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dll.a" "$lib"
     moveToOutput "share/gcc-*/python" "$lib"
 
     for i in "$lib/${targetConfig}"/lib/*.{la,py}; do
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index aa0fcb5062894..c78a281489515 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -16,6 +16,7 @@
 , langCC
 , langFortran
 , langJava ? false, javaAwtGtk ? false, javaAntlr ? null, javaEcj ? null
+, langAda ? false
 , langGo
 , langObjC
 , langObjCpp
@@ -115,6 +116,7 @@ let
           ++ lib.optional langCC       "c++"
           ++ lib.optional langFortran  "fortran"
           ++ lib.optional langJava     "java"
+          ++ lib.optional langAda      "ada"
           ++ lib.optional langGo       "go"
           ++ lib.optional langObjC     "objc"
           ++ lib.optional langObjCpp   "obj-c++"
@@ -140,6 +142,9 @@ let
       "--enable-cloog-backend=isl"
     ]
 
+    # Ada options
+    ++ lib.optional langAda "--enable-libada"
+
     # Java options
     ++ lib.optionals langJava [
       "--with-ecj-jar=${javaEcj}"
diff --git a/pkgs/development/compilers/gcc/common/pre-configure.nix b/pkgs/development/compilers/gcc/common/pre-configure.nix
index 4c86d37e2434f..85b854e19b9a0 100644
--- a/pkgs/development/compilers/gcc/common/pre-configure.nix
+++ b/pkgs/development/compilers/gcc/common/pre-configure.nix
@@ -1,6 +1,11 @@
-{ lib, version, hostPlatform, langJava ? false, langGo }:
+{ lib, version, hostPlatform
+, gnatboot ? null
+, langAda ? false
+, langJava ? false
+, langGo }:
 
 assert langJava -> lib.versionOlder version "7";
+assert langAda -> gnatboot != null;
 
 lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
   export NIX_LDFLAGS=`echo $NIX_LDFLAGS | sed -e s~$prefix/lib~$prefix/lib/amd64~g`
@@ -9,4 +14,6 @@ lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
   export CFLAGS_FOR_TARGET="-Wl,-rpath,$prefix/lib/amd64 $CFLAGS_FOR_TARGET"
 '' + lib.optionalString (lib.versionOlder version "7" && (langJava || langGo)) ''
   export lib=$out;
+'' + lib.optionalString langAda ''
+  export PATH=${gnatboot}/bin:$PATH
 ''
diff --git a/pkgs/development/compilers/gcc/gnat-cflags.patch b/pkgs/development/compilers/gcc/gnat-cflags.patch
new file mode 100644
index 0000000000000..a16266bbf39c2
--- /dev/null
+++ b/pkgs/development/compilers/gcc/gnat-cflags.patch
@@ -0,0 +1,35 @@
+diff --git a/gcc/ada/gcc-interface/Makefile.in b/gcc/ada/gcc-interface/Makefile.in
+index 4e74252bd74..0d848b5b4e3 100644
+--- a/gcc/ada/gcc-interface/Makefile.in
++++ b/gcc/ada/gcc-interface/Makefile.in
+@@ -111,7 +111,7 @@ NO_OMIT_ADAFLAGS = -fno-omit-frame-pointer
+ NO_SIBLING_ADAFLAGS = -fno-optimize-sibling-calls
+ NO_REORDER_ADAFLAGS = -fno-toplevel-reorder
+ GNATLIBFLAGS = -W -Wall -gnatpg -nostdinc
+-GNATLIBCFLAGS = -g -O2
++GNATLIBCFLAGS = -g -O2 $(CFLAGS_FOR_TARGET)
+ # Pretend that _Unwind_GetIPInfo is available for the target by default.  This
+ # should be autodetected during the configuration of libada and passed down to
+ # here, but we need something for --disable-libada and hope for the best.
+@@ -198,7 +198,7 @@ RTSDIR = rts$(subst /,_,$(MULTISUBDIR))
+ # Link flags used to build gnat tools.  By default we prefer to statically
+ # link with libgcc to avoid a dependency on shared libgcc (which is tricky
+ # to deal with as it may conflict with the libgcc provided by the system).
+-GCC_LINK_FLAGS=-static-libstdc++ -static-libgcc
++GCC_LINK_FLAGS=-static-libstdc++ -static-libgcc $(CFLAGS_FOR_TARGET)
+
+ # End of variables for you to override.
+
+diff --git a/libada/Makefile.in b/libada/Makefile.in
+index 522b9207326..ca866c74471 100644
+--- a/libada/Makefile.in
++++ b/libada/Makefile.in
+@@ -59,7 +59,7 @@ LDFLAGS=
+ CFLAGS=-g
+ PICFLAG = @PICFLAG@
+ GNATLIBFLAGS= -W -Wall -gnatpg -nostdinc
+-GNATLIBCFLAGS= -g -O2
++GNATLIBCFLAGS= -g -O2 $(CFLAGS)
+ GNATLIBCFLAGS_FOR_C = -W -Wall $(GNATLIBCFLAGS) $(CFLAGS_FOR_TARGET) \
+        -fexceptions -DIN_RTS @have_getipinfo@ @have_capability@
+
diff --git a/pkgs/development/compilers/ghdl/default.nix b/pkgs/development/compilers/ghdl/default.nix
new file mode 100644
index 0000000000000..6d1fae3373407
--- /dev/null
+++ b/pkgs/development/compilers/ghdl/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub, gnat, zlib, llvm, lib
+, backend ? "mcode" }:
+
+assert backend == "mcode" || backend == "llvm";
+
+stdenv.mkDerivation rec {
+  pname = "ghdl-${backend}";
+  version = "0.37";
+
+  src = fetchFromGitHub {
+    owner = "ghdl";
+    repo = "ghdl";
+    rev = "v${version}";
+    sha256 = "0b53yl4im33c1cd4mdyc4ks9cmrpixym17gzchfmplrl22w3l17y";
+  };
+
+  LIBRARY_PATH = "${stdenv.cc.libc}/lib";
+
+  buildInputs = [ gnat zlib ];
+
+  preConfigure = ''
+    # If llvm 7.0 works, 7.x releases should work too.
+    sed -i 's/check_version 7.0/check_version 7/g' configure
+  '';
+
+  configureFlags = lib.optional (backend == "llvm")
+    "--with-llvm-config=${llvm}/bin/llvm-config";
+
+  hardeningDisable = [ "format" ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/ghdl/ghdl";
+    description = "VHDL 2008/93/87 simulator";
+    maintainers = with maintainers; [ lucus16 ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/development/compilers/gnatboot/default.nix b/pkgs/development/compilers/gnatboot/default.nix
new file mode 100644
index 0000000000000..cb643d6123a6d
--- /dev/null
+++ b/pkgs/development/compilers/gnatboot/default.nix
@@ -0,0 +1,51 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  pname = "gentoo-gnatboot";
+  version = "4.1";
+
+  src = if stdenv.system == "i686-linux" then
+    fetchurl {
+      url = mirror://gentoo/distfiles/gnatboot-4.1-i386.tar.bz2;
+      sha256 = "0665zk71598204bf521vw68i5y6ccqarq9fcxsqp7ccgycb4lysr";
+    }
+  else if stdenv.system == "x86_64-linux" then
+    fetchurl {
+      url = mirror://gentoo/distfiles/gnatboot-4.1-amd64.tar.bz2;
+      sha256 = "1li4d52lmbnfs6llcshlbqyik2q2q4bvpir0f7n38nagp0h6j0d4";
+    }
+  else
+    throw "Platform not supported";
+
+  dontStrip = 1;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R * $out
+
+    set +e
+    for a in $out/bin/* ; do
+      patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+        --set-rpath $(cat $NIX_CC/nix-support/orig-libc)/lib:$(cat $NIX_CC/nix-support/orig-cc)/lib64:$(cat $NIX_CC/nix-support/orig-cc)/lib $a
+    done
+    set -e
+
+    mv $out/bin/gnatgcc_2wrap $out/bin/gnatgcc
+    ln -s $out/bin/gnatgcc $out/bin/gcc
+  '';
+
+  passthru = {
+    langC = true; # TRICK for gcc-wrapper to wrap it
+    langCC = false;
+    langFortran = false;
+    langAda = true;
+  };
+
+  meta = with stdenv.lib; {
+    homepage = "https://gentoo.org";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.lucus16 ];
+
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/compilers/ldc/binary.nix b/pkgs/development/compilers/ldc/binary.nix
new file mode 100644
index 0000000000000..56d40be86194b
--- /dev/null
+++ b/pkgs/development/compilers/ldc/binary.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, curl, tzdata, autoPatchelfHook, fixDarwinDylibNames, libxml2
+, version, hashes }:
+with stdenv;
+let
+  OS = if hostPlatform.isDarwin then "osx" else hostPlatform.parsed.kernel.name;
+  ARCH = toString hostPlatform.parsed.cpu.name;
+in mkDerivation {
+  pname = "ldc-bootstrap";
+  inherit version;
+
+  src = fetchurl rec {
+    name = "ldc2-${version}-${OS}-${ARCH}.tar.xz";
+    url = "https://github.com/ldc-developers/ldc/releases/download/v${version}/${name}";
+    sha256 = hashes."${OS}-${ARCH}" or (throw "missing bootstrap sha256 for ${OS}-${ARCH}");
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ fixDarwinDylibNames autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxml2 stdenv.cc.cc ];
+
+  propagatedBuildInputs = [ curl tzdata ];
+
+  installPhase = ''
+    mkdir -p $out
+
+    mv bin etc import lib LICENSE README $out/
+  '';
+
+  meta = with lib; {
+    inherit version;
+    description = "The LLVM-based D Compiler";
+    homepage = "https://github.com/ldc-developers/ldc";
+    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
+    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
+    maintainers = with maintainers; [ ThomasMader lionello ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
+  };
+}
diff --git a/pkgs/development/compilers/ldc/bootstrap.nix b/pkgs/development/compilers/ldc/bootstrap.nix
new file mode 100644
index 0000000000000..fde4c84268489
--- /dev/null
+++ b/pkgs/development/compilers/ldc/bootstrap.nix
@@ -0,0 +1,10 @@
+{ callPackage }:
+callPackage ./binary.nix {
+  version = "1.19.0";
+  hashes = {
+    # Get these from `nix-prefetch-url https://github.com/ldc-developers/ldc/releases/download/v1.19.0/ldc2-1.19.0-osx-x86_64.tar.xz` etc..
+    osx-x86_64 = "1bp3xkh9zp64dzq8isanib1gacb3nfbl70qv15qygwk1zan6zgy7";
+    linux-x86_64 = "146grr2lwarfk13wgkpyb77xb6b3as1is2rf4s2hipqjmc8biy1h";
+    linux-aarch64  = "1fv6jshfvi15m7masgxq1hgp216qjd5amizrqdf26vhrq3a08li3";
+  };
+}
diff --git a/pkgs/development/compilers/ldc/default.nix b/pkgs/development/compilers/ldc/default.nix
index 19fe2981c8334..5a4baabcf8d87 100644
--- a/pkgs/development/compilers/ldc/default.nix
+++ b/pkgs/development/compilers/ldc/default.nix
@@ -1,173 +1,5 @@
-{ stdenv, fetchurl, cmake, ninja, llvm_5, llvm_8, curl, tzdata
-, libconfig, lit, gdb, unzip, darwin, bash
-, callPackage, makeWrapper, runCommand, targetPackages
-, bootstrapVersion ? false
-, version ? "1.17.0"
-, ldcSha256 ? "1aag5jfrng6p4ms0fs90hjbv9bcj3hj8h52r68c3cm6racdajbva"
-}:
-
-let
-  bootstrapLdc = if !bootstrapVersion then
-    # LDC 0.17.x is the last version which doesn't need a working D compiler to
-    # build so we use that version to bootstrap the actual build.
-    callPackage ./default.nix {
-      bootstrapVersion = true;
-      version = "0.17.6";
-      ldcSha256 = "0qf5kbxddgmg3kqzi0kf4bgv8vdrnv16y07hcpm0cwv9mc3qr2w6";
-    }
-  else
-    "";
-
-  pathConfig = runCommand "ldc-lib-paths" {} ''
-    mkdir $out
-    echo ${tzdata}/share/zoneinfo/ > $out/TZDatabaseDirFile
-    echo ${curl.out}/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} > $out/LibcurlPathFile
-  '';
-in
-
-stdenv.mkDerivation rec {
-  pname = "ldc";
-  inherit version;
-
-  enableParallelBuilding = true;
-
-  src = fetchurl {
-    url = "https://github.com/ldc-developers/ldc/releases/download/v${version}/ldc-${version}-src.tar.gz";
-    sha256 = ldcSha256;
-  };
-
-  # https://issues.dlang.org/show_bug.cgi?id=19553
-  hardeningDisable = [ "fortify" ];
-
-  postUnpack = ''
-    patchShebangs .
-  ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion) ''
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/fail_compilation/mixin_gc.d
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/xtest46_gc.d
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/testptrref_gc.d
-
-      # test depends on current year
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/compilable/ddocYear.d
-  ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion && stdenv.hostPlatform.isDarwin) ''
-      # https://github.com/NixOS/nixpkgs/issues/34817
-      rm -r ldc-${version}-src/tests/plugins/addFuncEntryCall
-  '';
-
-  postPatch = ''
-      # Setting SHELL=$SHELL when dmd testsuite is run doesn't work on Linux somehow
-      substituteInPlace tests/d2/dmd-testsuite/Makefile --replace "SHELL=/bin/bash" "SHELL=${bash}/bin/bash"
-    ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion && stdenv.hostPlatform.isLinux) ''
-      substituteInPlace runtime/phobos/std/socket.d --replace "assert(ih.addrList[0] == 0x7F_00_00_01);" ""
-  ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion && stdenv.hostPlatform.isDarwin) ''
-      substituteInPlace runtime/phobos/std/socket.d --replace "foreach (name; names)" "names = []; foreach (name; names)"
-  ''
-
-  + stdenv.lib.optionalString (bootstrapVersion && stdenv.hostPlatform.isDarwin) ''
-      # Was not able to compile on darwin due to "__inline_isnanl"
-      # being undefined.
-      # TODO Remove with version > 0.17.6
-      substituteInPlace dmd2/root/port.c --replace __inline_isnanl __inline_isnan
-  '';
-
-  nativeBuildInputs = [ cmake ninja makeWrapper unzip ]
-    ++ stdenv.lib.optionals (!bootstrapVersion) [
-      bootstrapLdc lit lit.python
-    ]
-    ++ stdenv.lib.optional (!bootstrapVersion && stdenv.hostPlatform.isDarwin)
-      # https://github.com/NixOS/nixpkgs/issues/57120
-      # https://github.com/NixOS/nixpkgs/pull/59197#issuecomment-481972515
-      llvm_5
-    ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin)
-      llvm_8
-    ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin)
-      # https://github.com/NixOS/nixpkgs/pull/36378#issuecomment-385034818
-      gdb
-    ++ stdenv.lib.optionals (bootstrapVersion) [
-      libconfig llvm_5
-    ]
-    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin
-      darwin.apple_sdk.frameworks.Foundation;
-
-
-  buildInputs = [ curl tzdata ];
-
-  cmakeFlags = stdenv.lib.optionals (!bootstrapVersion) [
-    "-DD_FLAGS=-d-version=TZDatabaseDir;-d-version=LibcurlPath;-J${pathConfig}"
-    "-DCMAKE_BUILD_TYPE=Release"
-  ];
-
-  postConfigure = ''
-    export DMD=$PWD/bin/ldmd2
-  '';
-
-  makeFlags = [ "DMD=$DMD" ];
-
-  fixNames = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin  ''
-    fixDarwinDylibNames() {
-      local flags=()
-
-      for fn in "$@"; do
-        flags+=(-change "$(basename "$fn")" "$fn")
-      done
-
-      for fn in "$@"; do
-        if [ -L "$fn" ]; then continue; fi
-        echo "$fn: fixing dylib"
-        install_name_tool -id "$fn" "''${flags[@]}" "$fn"
-      done
-    }
-
-    fixDarwinDylibNames $(find "$(pwd)/lib" -name "*.dylib")
-    export DYLD_LIBRARY_PATH=$(pwd)/lib
-  '';
-
-  # https://github.com/ldc-developers/ldc/issues/2497#issuecomment-459633746
-  additionalExceptions = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin
-    "|druntime-test-shared";
-
-  doCheck = !bootstrapVersion;
-
-  checkPhase = stdenv.lib.optionalString doCheck ''
-    # Build default lib test runners
-    ninja -j$NIX_BUILD_CORES all-test-runners
-
-    ${fixNames}
-
-    # Run dmd testsuite
-    export DMD_TESTSUITE_MAKE_ARGS="-j$NIX_BUILD_CORES DMD=$DMD CC=$CXX"
-    ctest -V -R "dmd-testsuite"
-
-    # Build and run LDC D unittests.
-    ctest --output-on-failure -R "ldc2-unittest"
-
-    # Run LIT testsuite.
-    ctest -V -R "lit-tests"
-
-    # Run default lib unittests
-    ctest -j$NIX_BUILD_CORES --output-on-failure -E "ldc2-unittest|lit-tests|dmd-testsuite${additionalExceptions}"
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/ldc2 \
-        --prefix PATH ":" "${targetPackages.stdenv.cc}/bin" \
-        --set-default CC "${targetPackages.stdenv.cc}/bin/cc"
-   '';
-
-  meta = with stdenv.lib; {
-    description = "The LLVM-based D compiler";
-    homepage = "https://github.com/ldc-developers/ldc";
-    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
-    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
-    maintainers = with maintainers; [ ThomasMader ];
-    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
-  };
+import ./generic.nix {
+  version = "1.20.1";
+  ldcSha256 = "1bqsgab22v02pc3c9gcyf15y7aimadv24d68icaw5lpgnvzxy89b";
 }
 
diff --git a/pkgs/development/compilers/ldc/generic.nix b/pkgs/development/compilers/ldc/generic.nix
new file mode 100644
index 0000000000000..c93d423945cbd
--- /dev/null
+++ b/pkgs/development/compilers/ldc/generic.nix
@@ -0,0 +1,143 @@
+{ version, ldcSha256 }:
+{ stdenv, fetchurl, cmake, ninja, llvm_5, llvm_8, curl, tzdata
+, libconfig, lit, gdb, unzip, darwin, bash
+, callPackage, makeWrapper, runCommand, targetPackages
+, ldcBootstrap ? callPackage ./bootstrap.nix { }
+}:
+
+let
+  pathConfig = runCommand "ldc-lib-paths" {} ''
+    mkdir $out
+    echo ${tzdata}/share/zoneinfo/ > $out/TZDatabaseDirFile
+    echo ${curl.out}/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} > $out/LibcurlPathFile
+  '';
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "ldc";
+  inherit version;
+
+  enableParallelBuilding = true;
+
+  src = fetchurl {
+    url = "https://github.com/ldc-developers/ldc/releases/download/v${version}/ldc-${version}-src.tar.gz";
+    sha256 = ldcSha256;
+  };
+
+  # https://issues.dlang.org/show_bug.cgi?id=19553
+  hardeningDisable = [ "fortify" ];
+
+  postUnpack = ''
+    patchShebangs .
+  ''
+  + ''
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/fail_compilation/mixin_gc.d
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/xtest46_gc.d
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/testptrref_gc.d
+
+      # test depends on current year
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/compilable/ddocYear.d
+  ''
+  + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # https://github.com/NixOS/nixpkgs/issues/34817
+      rm -r ldc-${version}-src/tests/plugins/addFuncEntryCall
+  '';
+
+  postPatch = ''
+    # Setting SHELL=$SHELL when dmd testsuite is run doesn't work on Linux somehow
+    substituteInPlace tests/d2/dmd-testsuite/Makefile --replace "SHELL=/bin/bash" "SHELL=${bash}/bin/bash"
+  ''
+  + stdenv.lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace runtime/phobos/std/socket.d --replace "assert(ih.addrList[0] == 0x7F_00_00_01);" ""
+  ''
+  + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace runtime/phobos/std/socket.d --replace "foreach (name; names)" "names = []; foreach (name; names)"
+  '';
+
+  nativeBuildInputs = [
+    cmake ninja makeWrapper unzip ldcBootstrap lit lit.python
+  ]
+  ++ stdenv.lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.apple_sdk.frameworks.Foundation
+    # https://github.com/NixOS/nixpkgs/issues/57120
+    # https://github.com/NixOS/nixpkgs/pull/59197#issuecomment-481972515
+    llvm_5
+  ]
+  ++ stdenv.lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    llvm_8
+    # https://github.com/NixOS/nixpkgs/pull/36378#issuecomment-385034818
+    gdb
+  ];
+
+  buildInputs = [ curl tzdata ];
+
+  cmakeFlags = [
+    "-DD_FLAGS=-d-version=TZDatabaseDir;-d-version=LibcurlPath;-J${pathConfig}"
+    "-DCMAKE_BUILD_TYPE=Release"
+  ];
+
+  postConfigure = ''
+    export DMD=$PWD/bin/ldmd2
+  '';
+
+  makeFlags = [ "DMD=$DMD" ];
+
+  fixNames = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin  ''
+    fixDarwinDylibNames() {
+      local flags=()
+
+      for fn in "$@"; do
+        flags+=(-change "$(basename "$fn")" "$fn")
+      done
+
+      for fn in "$@"; do
+        if [ -L "$fn" ]; then continue; fi
+        echo "$fn: fixing dylib"
+        install_name_tool -id "$fn" "''${flags[@]}" "$fn"
+      done
+    }
+
+    fixDarwinDylibNames $(find "$(pwd)/lib" -name "*.dylib")
+    export DYLD_LIBRARY_PATH=$(pwd)/lib
+  '';
+
+  # https://github.com/ldc-developers/ldc/issues/2497#issuecomment-459633746
+  additionalExceptions = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin
+    "|druntime-test-shared";
+
+  checkPhase = ''
+    # Build default lib test runners
+    ninja -j$NIX_BUILD_CORES all-test-runners
+
+    ${fixNames}
+
+    # Run dmd testsuite
+    export DMD_TESTSUITE_MAKE_ARGS="-j$NIX_BUILD_CORES DMD=$DMD"
+    ctest -V -R "dmd-testsuite"
+
+    # Build and run LDC D unittests.
+    ctest --output-on-failure -R "ldc2-unittest"
+
+    # Run LIT testsuite.
+    ctest -V -R "lit-tests"
+
+    # Run default lib unittests
+    ctest -j$NIX_BUILD_CORES --output-on-failure -E "ldc2-unittest|lit-tests|dmd-testsuite${additionalExceptions}"
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/ldc2 \
+        --prefix PATH ":" "${targetPackages.stdenv.cc}/bin" \
+        --set-default CC "${targetPackages.stdenv.cc}/bin/cc"
+   '';
+
+  meta = with stdenv.lib; {
+    description = "The LLVM-based D compiler";
+    homepage = "https://github.com/ldc-developers/ldc";
+    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
+    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
+    maintainers = with maintainers; [ ThomasMader lionello ];
+    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/development/interpreters/j/default.nix b/pkgs/development/interpreters/j/default.nix
index f7500c169e6db..c3d5221d42a7a 100644
--- a/pkgs/development/interpreters/j/default.nix
+++ b/pkgs/development/interpreters/j/default.nix
@@ -2,13 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "j";
-  version = "807";
-  jtype = "release";
+  version = "901";
+  jtype = "release-e";
   src = fetchFromGitHub {
     owner = "jsoftware";
     repo = "jsource";
     rev = "j${version}-${jtype}";
-    sha256 = "1qciw2yg9x996zglvj2461qby038x89xcmfb3qyrh3myn8m1nq2n";
+    sha256 = "13ky37rrl6mc66fckrdnrw64gmvq1qlv6skzd513lab4d0wigshw";
+    name = "jsource";
   };
 
   buildInputs = [ readline libedit bc ];
@@ -26,57 +27,33 @@ stdenv.mkDerivation rec {
     export HOME=$TMPDIR
     export JLIB=$SOURCE_DIR/jlibrary
 
-    export jbld=$HOME/bld
-    export jplatform=${platform}
-    export jmake=$SOURCE_DIR/make
-    export jgit=$SOURCE_DIR
-    export JBIN=$jbld/j${bits}/bin
-    mkdir -p $JBIN
-
     echo $OUT_DIR
 
-    cd make
+    cd make2
 
     patchShebangs .
-    sed -i jvars.sh -e "
-      s@~/git/jsource@$SOURCE_DIR@;
-      s@~/jbld@$HOME@;
-      "
-
     sed -i $JLIB/bin/profile.ijs -e "s@'/usr/share/j/.*'@'$out/share/j'@;"
 
-    # For future versions, watch
-    # https://github.com/jsoftware/jsource/pull/4
-    cp ./jvars.sh $HOME
+    ./build_all.sh
 
-    echo '
-      #define jversion   "${version}"
-      #define jplatform  "${platform}"
-      #define jtype      "${jtype}"         // release,beta,...
-      #define jlicense   "GPL3"
-      #define jbuilder   "nixpkgs"  // website or email
-      ' > ../jsrc/jversion.h
-
-    ./build_jconsole.sh j${bits}
-    ./build_libj.sh j${bits}
+    cp $SOURCE_DIR/bin/${platform}/j${bits}*/* "$JLIB/bin"
   '';
 
   checkPhase = ''
-    echo 'i. 5' | $JBIN/jconsole | fgrep "0 1 2 3 4"
+
+    echo 'i. 5' | $JLIB/bin/jconsole | fgrep "0 1 2 3 4"
 
     # Now run the real tests
     cd $SOURCE_DIR/test
     for f in *.ijs
     do
       echo $f
-      $JBIN/jconsole < $f > /dev/null || echo FAIL && echo PASS
+      $JLIB/bin/jconsole < $f > /dev/null || echo FAIL && echo PASS
     done
   '';
 
   installPhase = ''
     mkdir -p "$out"
-    cp -r $JBIN "$out/bin"
-    rm $out/bin/*.txt # Remove logs from the bin folder
 
     mkdir -p "$out/share/j"
     cp -r $JLIB/{addons,system} "$out/share/j"
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 099632b1e8539..5dc3b224720ab 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -57,10 +57,10 @@ in {
     sourceVersion = {
       major = "2";
       minor = "7";
-      patch = "17";
+      patch = "18";
       suffix = "";
     };
-    sha256 = "0hds28cg226m8j8sr394nm9yc4gxhvlv109w0avsf2mxrlrz0hsd";
+    sha256 = "0hzgxl94hnflis0d6m4szjx0b52gah7wpmcg5g00q7am6xwhwb5n";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/libraries/atk/default.nix b/pkgs/development/libraries/atk/default.nix
index 400ddd5125953..b54ba5313011d 100644
--- a/pkgs/development/libraries/atk/default.nix
+++ b/pkgs/development/libraries/atk/default.nix
@@ -4,7 +4,7 @@
 
 let
   pname = "atk";
-  version = "2.35.1";
+  version = "2.36.0";
 in
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "111qajn7kxwmh40drc8i6jc3hnril2rp63n207q92pl47zx614xy";
+    sha256 = "1217cmmykjgkkim0zr1lv5j13733m4w5vipmy4ivw0ll6rz28xpv";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index e5e2eba1118a0..628046a574118 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -61,7 +61,7 @@ in stdenv.mkDerivation rec {
     ++ optional glSupport libGL
     ; # TODO: maybe liblzo but what would it be for here?
 
-  configureFlags = if stdenv.isDarwin then [
+  configureFlags = (if stdenv.isDarwin then [
     "--disable-dependency-tracking"
     "--enable-quartz"
     "--enable-quartz-font"
@@ -71,7 +71,7 @@ in stdenv.mkDerivation rec {
     ++ optional xcbSupport "--enable-xcb"
     ++ optional glSupport "--enable-gl"
     ++ optional pdfSupport "--enable-pdf"
-  );
+  )) ++ optional (!x11Support) "--disable-xlib";
 
   preConfigure =
   # On FreeBSD, `-ldl' doesn't exist.
diff --git a/pkgs/development/libraries/chromaprint/default.nix b/pkgs/development/libraries/chromaprint/default.nix
index 475108de59620..4702d67a01f2c 100644
--- a/pkgs/development/libraries/chromaprint/default.nix
+++ b/pkgs/development/libraries/chromaprint/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "chromaprint";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://github.com/acoustid/chromaprint/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "10kz8lncal4s2rp2rqpgc6xyjp0jzcrihgkx7chf127vfs5n067a";
+    sha256 = "0sknmyl5254rc55bvkhfwpl4dfvz45xglk1rq8zq5crmwq058fjp";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/cracklib/default.nix b/pkgs/development/libraries/cracklib/default.nix
index 4f3270d677a76..c10a69d72f942 100644
--- a/pkgs/development/libraries/cracklib/default.nix
+++ b/pkgs/development/libraries/cracklib/default.nix
@@ -18,10 +18,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.cracklib;
   buildInputs = [ zlib gettext ];
 
-  postPatch = ''
+  postPatch = stdenv.lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
     chmod +x util/cracklib-format
     patchShebangs util
 
+  '' + ''
     ln -vs ${toString wordlists} dicts/
   '';
 
diff --git a/pkgs/development/libraries/dconf/default.nix b/pkgs/development/libraries/dconf/default.nix
index d4e303b67af70..1612b0986006a 100644
--- a/pkgs/development/libraries/dconf/default.nix
+++ b/pkgs/development/libraries/dconf/default.nix
@@ -1,28 +1,61 @@
-{ stdenv, fetchurl, meson, ninja, python3, vala, libxslt, pkgconfig, glib, bash-completion, dbus, gnome3
-, libxml2, gtk-doc, docbook_xsl, docbook_xml_dtd_42 }:
+{ stdenv
+, fetchurl
+, fetchpatch
+, meson
+, ninja
+, python3
+, vala
+, libxslt
+, pkg-config
+, glib
+, bash-completion
+, dbus
+, gnome3
+, libxml2
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_42
+}:
 
-let
-  pname = "dconf";
-in
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  pname = "dconf";
   version = "0.36.0";
 
+  outputs = [ "out" "lib" "dev" "devdoc" ];
+
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
     sha256 = "0bfs069pjv6lhp7xrzmrhz3876ay2ryqxzc6mlva1hhz34ibprlz";
   };
 
-  postPatch = ''
-    chmod +x meson_post_install.py tests/test-dconf.py
-    patchShebangs meson_post_install.py
-    patchShebangs tests/test-dconf.py
-  '';
+  patches = [
+    # Fix bash-completion installation
+    # https://gitlab.gnome.org/GNOME/dconf/merge_requests/58
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/dconf/commit/b3c9423c6151f3c28e526083ea2f04987a780fdf.patch";
+      sha256 = "zrIPKmgEpa1iIGUKv03+z+GNwJwgdf2hDATgP3i8qk0=";
+    })
+  ];
 
-  outputs = [ "out" "lib" "dev" "devdoc" ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    vala
+    pkg-config
+    python3
+    libxslt
+    libxml2
+    glib
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_42
+  ];
 
-  nativeBuildInputs = [ meson ninja vala pkgconfig python3 libxslt libxml2 glib gtk-doc docbook_xsl docbook_xml_dtd_42 ];
-  buildInputs = [ glib bash-completion dbus ];
+  buildInputs = [
+    glib
+    bash-completion
+    dbus
+  ];
 
   mesonFlags = [
     "--sysconfdir=/etc"
@@ -31,6 +64,12 @@ stdenv.mkDerivation rec {
 
   doCheck = !stdenv.isAarch32 && !stdenv.isAarch64 && !stdenv.isDarwin;
 
+  postPatch = ''
+    chmod +x meson_post_install.py tests/test-dconf.py
+    patchShebangs meson_post_install.py
+    patchShebangs tests/test-dconf.py
+  '';
+
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = pname;
@@ -40,7 +79,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://wiki.gnome.org/Projects/dconf";
     license = licenses.lgpl21Plus;
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
     maintainers = teams.gnome.members;
   };
 }
diff --git a/pkgs/development/libraries/flatbuffers/default.nix b/pkgs/development/libraries/flatbuffers/default.nix
index fecd54e0ef5c8..825e052ad873c 100644
--- a/pkgs/development/libraries/flatbuffers/default.nix
+++ b/pkgs/development/libraries/flatbuffers/default.nix
@@ -18,7 +18,9 @@ stdenv.mkDerivation (rec {
   nativeBuildInputs = [ cmake ];
   enableParallelBuilding = true;
 
-  doCheck = true;
+  cmakeFlags = [ "-DFLATBUFFERS_BUILD_TESTS=${if doCheck then "ON" else "OFF"}" ];
+
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
   checkTarget = "test";
 
   meta = {
diff --git a/pkgs/development/libraries/fstrcmp/cross.patch b/pkgs/development/libraries/fstrcmp/cross.patch
new file mode 100644
index 0000000000000..f794e3b91da6f
--- /dev/null
+++ b/pkgs/development/libraries/fstrcmp/cross.patch
@@ -0,0 +1,24 @@
+diff '--color=auto' -ur fstrcmp-0.7-D001-old/configure.ac fstrcmp-0.7.D001/configure.ac
+--- fstrcmp-0.7-D001-old/configure.ac	2014-03-04 19:13:45.000000000 -0500
++++ fstrcmp-0.7.D001/configure.ac	2020-04-02 13:57:52.805154634 -0400
+@@ -32,6 +32,8 @@
+ AC_OBJEXT
+ AC_EXEEXT
+ 
++LT_INIT
++
+ dnl @synopsis AC_ADD_CFLAGS
+ dnl
+ dnl Add the given option to CFLAGS, if it doesn't break the compiler
+diff '--color=auto' -ur fstrcmp-0.7-D001-old/Makefile.in fstrcmp-0.7.D001/Makefile.in
+--- fstrcmp-0.7-D001-old/Makefile.in	2014-03-04 19:13:45.000000000 -0500
++++ fstrcmp-0.7.D001/Makefile.in	2020-04-02 13:57:12.355269595 -0400
+@@ -37,6 +37,8 @@
+ srcdir = @srcdir@
+ VPATH = @srcdir@
+ 
++top_builddir = $(srcdir)
++
+ #
+ # the name of the install program to use
+ #
diff --git a/pkgs/development/libraries/fstrcmp/default.nix b/pkgs/development/libraries/fstrcmp/default.nix
index 732cd68551b82..46b579d4abd83 100644
--- a/pkgs/development/libraries/fstrcmp/default.nix
+++ b/pkgs/development/libraries/fstrcmp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, libtool, ghostscript, groff }:
+{ stdenv, fetchzip, libtool, ghostscript, groff, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "fstrcmp";
@@ -9,9 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0yg3y3k0wz50gmhgigfi2dx725w1gc8snb95ih7vpcnj6kabgz9a";
   };
 
+  patches = [ ./cross.patch ];
+
   outputs = [ "out" "dev" "doc" "man" "devman" ];
 
-  nativeBuildInputs = [ libtool ghostscript groff ];
+  nativeBuildInputs = [ libtool ghostscript groff autoreconfHook ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/ftgl/default.nix b/pkgs/development/libraries/ftgl/default.nix
index 21be623314fb8..a0ce9db815bc9 100644
--- a/pkgs/development/libraries/ftgl/default.nix
+++ b/pkgs/development/libraries/ftgl/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation {
       [ libGL libGLU ])
     ;
 
+  configureFlags = [ "--with-ft-prefix=${stdenv.lib.getDev freetype}" ];
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index b45b578eac0e4..82fbbc967efc0 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     meson ninja pkgconfig gettext python3 libxml2 libxslt docbook_xsl docbook_xml_dtd_43
-    gtk-doc gobject-introspection makeWrapper
+    gtk-doc gobject-introspection makeWrapper glib
   ]
     ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
@@ -68,7 +68,7 @@ in stdenv.mkDerivation rec {
     + ''
       moveToOutput "bin" "$dev"
       moveToOutput "bin/gdk-pixbuf-thumbnailer" "$out"
-
+    '' + stdenv.lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
       # We need to install 'loaders.cache' in lib/gdk-pixbuf-2.0/2.10.0/
       $dev/bin/gdk-pixbuf-query-loaders --update-cache
     '';
diff --git a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
index 06958be321313..bdfd00009dc5d 100644
--- a/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
+++ b/pkgs/development/libraries/gdk-pixbuf/setup-hook.sh
@@ -14,4 +14,4 @@ findGdkPixbufLoaders() {
 
 }
 
-addEnvHooks "$hostOffset" findGdkPixbufLoaders
+addEnvHooks "$targetOffset" findGdkPixbufLoaders
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index f635b789e16b7..9689bf98b31c1 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "glib-networking";
-  version = "2.64.0";
+  version = "2.64.1";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1fm1462v7z556qivlwflvc3qpz36jwpzqxxvsihh45j7aka2gnjw";
+    sha256 = "0wmg5n2h0r1rcdmp4w48akqlsbpjrjrj6p59g5ylc5yqyzg4dhx4";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh
index 5d9c330b62eb9..8ead5510ec4f0 100644
--- a/pkgs/development/libraries/glib/setup-hook.sh
+++ b/pkgs/development/libraries/glib/setup-hook.sh
@@ -1,4 +1,3 @@
-
 make_glib_find_gsettings_schemas() {
     # For packages that need gschemas of other packages (e.g. empathy)
     for maybe_dir in "$1"/share/gsettings-schemas/*; do
@@ -7,7 +6,7 @@ make_glib_find_gsettings_schemas() {
         fi
     done
 }
-addEnvHooks "$hostOffset" make_glib_find_gsettings_schemas
+addEnvHooks "$targetOffset" make_glib_find_gsettings_schemas
 
 # Install gschemas, if any, in a package-specific directory
 glibPreInstallPhase() {
diff --git a/pkgs/development/libraries/gobject-introspection/default.nix b/pkgs/development/libraries/gobject-introspection/default.nix
index 31e6d7b76c70d..0d514c3fd7d8d 100644
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -10,11 +10,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "gobject-introspection";
-  version = "1.64.0";
+  version = "1.64.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "10pwykfnk7pw8k9k8iz3p72phxvyrh5q4d7gr3ysv08w15immh7a";
+    sha256 = "19vz7vp10h0zj3f491yk72dp89bix6rgkzxg4qcm4d6151ksxgl0";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/development/libraries/gpgme/default.nix b/pkgs/development/libraries/gpgme/default.nix
index 6a31515be3f8e..39bb8d7571a06 100644
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, fetchpatch, libgpgerror, gnupg, pkgconfig, glib, pth, libassuan
+{ stdenv, fetchurl, fetchpatch
+, autoreconfHook, libgpgerror, gnupg, pkgconfig, glib, pth, libassuan
 , file, which, ncurses
 , texinfo
 , buildPackages
@@ -33,7 +34,14 @@ stdenv.mkDerivation rec {
       url = "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=patch;h=c4cf527ea227edb468a84bf9b8ce996807bd6992";
       sha256 = "pKL1tvUw7PB2w4FHSt2up4SvpFiprBH6TLdgKxYFC3g=";
     })
-  ];
+    # https://lists.gnupg.org/pipermail/gnupg-devel/2020-April/034591.html
+    (fetchpatch {
+      name = "0001-Fix-python-tests-on-non-Linux.patch";
+      url = "https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20200415/f7be62d1/attachment.obj";
+      sha256 = "00d4sxq63601lzdp2ha1i8fvybh7dzih4531jh8bx07fab3sw65g";
+    })
+    # Disable python tests on Darwin as they use gpg (see configureFlags below)
+  ] ++ lib.optional stdenv.isDarwin ./disable-python-tests.patch;
 
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev"; # gpgme-config; not so sure about gpgme-tool
@@ -42,15 +50,11 @@ stdenv.mkDerivation rec {
     [ libgpgerror glib libassuan pth ]
     ++ lib.optional (qtbase != null) qtbase;
 
-  nativeBuildInputs = [ file pkgconfig gnupg texinfo ]
+  nativeBuildInputs = [ pkgconfig gnupg texinfo autoreconfHook ]
   ++ lib.optionals pythonSupport [ python swig2 which ncurses ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  postPatch =''
-    substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
-  '';
-
   configureFlags = [
     "--enable-fixed-path=${gnupg}/bin"
     "--with-libgpg-error-prefix=${libgpgerror.dev}"
diff --git a/pkgs/development/libraries/gpgme/disable-python-tests.patch b/pkgs/development/libraries/gpgme/disable-python-tests.patch
new file mode 100644
index 0000000000000..285af14fcc3ec
--- /dev/null
+++ b/pkgs/development/libraries/gpgme/disable-python-tests.patch
@@ -0,0 +1,12 @@
+diff -Naur --strip-trailing-cr gpgme-1.13.1.org/lang/python/Makefile.am gpgme-1.13.1/lang/python/Makefile.am
+--- gpgme-1.13.1.org/lang/python/Makefile.am	2019-06-04 07:27:49.000000000 +0100
++++ gpgme-1.13.1/lang/python/Makefile.am	2020-04-15 14:27:34.810172944 +0100
+@@ -23,7 +23,7 @@
+ 	gpgme.i \
+ 	helpers.c helpers.h private.h
+ 
+-SUBDIRS = . tests examples doc src
++SUBDIRS = . examples doc src
+ 
+ .PHONY: prepare
+ prepare: copystamp
diff --git a/pkgs/development/libraries/gsm/default.nix b/pkgs/development/libraries/gsm/default.nix
index e3edbcac1cf48..30cffa89938d9 100644
--- a/pkgs/development/libraries/gsm/default.nix
+++ b/pkgs/development/libraries/gsm/default.nix
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gsm";
-  version = "1.0.18";
+  version = "1.0.19";
 
   src = fetchurl {
     url = "http://www.quut.com/gsm/${pname}-${version}.tar.gz";
-    sha256 = "041amvpz8cvxykl3pwqldrzxligmmzcg8ncdnxbg32rlqf3q1xh4";
+    sha256 = "1xkha9ss5g5qnfaybi8il0mcvp8knwg9plgh8404vh58d0pna0s9";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index ae5fd7531325f..d9bf86e0cf3fb 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -10,7 +10,7 @@
 , gst-plugins-base
 , orc
 , gobject-introspection
-, enableZbar ? true
+, enableZbar ? false
 , faacSupport ? false
 , faac ? null
 , faad2
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 67a0aa9f3f890..88bf77a638cc1 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -37,6 +37,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./fix_pkgconfig_includedir.patch
+
+    # Fix build with bash-completion 2.10
+    # https://gitlab.freedesktop.org/gstreamer/gstreamer/merge_requests/436
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/commit/dd2ec3681e2d38e13e01477efa36e851650690fb.patch";
+      sha256 = "CMYQF2MTsC5A0btMpLVLemkwsMtEbzhDXVE3u49xHB4=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 812f4faa2341e..c4e6af5d62a01 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -73,6 +73,21 @@ stdenv.mkDerivation rec {
 
     # https://gitlab.gnome.org/GNOME/gtk/merge_requests/1002
     ./patches/01-build-Fix-path-handling-in-pkgconfig.patch
+
+    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1634
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/79732da1ed8cb167440fb047c72cfc0d888a187b.patch";
+      sha256 = "1ynrx81dkwjfqhvg80q28qbb6jabg4x73fkbrnligzgkzimfjpx3";
+    })
+    # https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1633
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/12fc9a45efcbb546eb7de13c5c4d3183f2f5a3b8.patch";
+      sha256 = "00zrm77qk39p1hgn207az82cgvqiyp6is7dk0ssjxkc34403r78v";
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/5a52af20cba76474e631b2a7548963bcad22d66d.patch";
+      sha256 = "0sbzzwa0si1w83m5abyf312f4w445wwlms53m5hb7kdgkjbhaa3f";
+    })
   ] ++ optionals stdenv.isDarwin [
     # X11 module requires <gio/gdesktopappinfo.h> which is not installed on Darwin
     # let’s drop that dependency in similar way to how other parts of the library do it
diff --git a/pkgs/development/libraries/libasyncns/default.nix b/pkgs/development/libraries/libasyncns/default.nix
index d8b4f1d7df254..9a91551c3a43a 100644
--- a/pkgs/development/libraries/libasyncns/default.nix
+++ b/pkgs/development/libraries/libasyncns/default.nix
@@ -8,6 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "0x5b6lcic4cd7q0bx00x93kvpyzl7n2abbgvqbrlzrfb8vknc6jg";
   };
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   meta = with stdenv.lib; {
     homepage = "http://0pointer.de/lennart/projects/libasyncns/";
     description = "A C library for Linux/Unix for executing name service queries asynchronously";
diff --git a/pkgs/development/libraries/libcddb/default.nix b/pkgs/development/libraries/libcddb/default.nix
index 26a69fe9fc761..2b837ff1ce1ac 100644
--- a/pkgs/development/libraries/libcddb/default.nix
+++ b/pkgs/development/libraries/libcddb/default.nix
@@ -10,6 +10,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin libiconv;
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   doCheck = false; # fails 3 of 5 tests with locale errors
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libcdio/default.nix b/pkgs/development/libraries/libcdio/default.nix
index e4522bf00be82..b0b7b55a19db7 100644
--- a/pkgs/development/libraries/libcdio/default.nix
+++ b/pkgs/development/libraries/libcdio/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     patchShebangs .
   '';
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libcddb ncurses help2man ]
+  nativeBuildInputs = [ pkgconfig help2man ];
+  buildInputs = [ libcddb ncurses ]
     ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Carbon IOKit ];
 
   doCheck = !stdenv.isDarwin;
diff --git a/pkgs/development/libraries/libcec/default.nix b/pkgs/development/libraries/libcec/default.nix
index 2ea55db22477c..09ebac93869b9 100644
--- a/pkgs/development/libraries/libcec/default.nix
+++ b/pkgs/development/libraries/libcec/default.nix
@@ -11,8 +11,8 @@ stdenv.mkDerivation {
     sha256 = "02j09y06csaic4m0fyb4dr9l3hl15nxbbniwq0i1qlccpxjak0j3";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake udev libcec_platform ] ++
+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [ udev libcec_platform ] ++
     stdenv.lib.optional (libraspberrypi != null) libraspberrypi;
 
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=1" ];
diff --git a/pkgs/development/libraries/libcrossguid/default.nix b/pkgs/development/libraries/libcrossguid/default.nix
index 0d0f06aac37ba..8e2be72987cfd 100644
--- a/pkgs/development/libraries/libcrossguid/default.nix
+++ b/pkgs/development/libraries/libcrossguid/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ libuuid ];
 
   buildPhase = ''
-    g++ -c guid.cpp -o guid.o $CXXFLAGS -std=c++11 -DGUID_LIBUUID
-    ar rvs libcrossguid.a guid.o
+    $CXX -c guid.cpp -o guid.o $CXXFLAGS -std=c++11 -DGUID_LIBUUID
+    $AR rvs libcrossguid.a guid.o
   '';
   installPhase = ''
     mkdir -p $out/{lib,include}
diff --git a/pkgs/development/libraries/libfido2/default.nix b/pkgs/development/libraries/libfido2/default.nix
index 94f0540ab055b..30ecdda3da2c8 100644
--- a/pkgs/development/libraries/libfido2/default.nix
+++ b/pkgs/development/libraries/libfido2/default.nix
@@ -3,45 +3,28 @@
 , fetchpatch
 , cmake
 , pkgconfig
+, hidapi
 , libcbor
 , openssl
 , udev
-, IOKit }:
+}:
 
 stdenv.mkDerivation rec {
   pname = "libfido2";
-  version = "1.3.1";
+  version = "1.4.0";
   src = fetchurl {
     url = "https://developers.yubico.com/${pname}/Releases/${pname}-${version}.tar.gz";
-    sha256 = "0hdgxbmjbnm9kjwc07nrl2zy87qclvb3rzvdwr5iw35n2qhf4dds";
+    sha256 = "0v1a3n0qljmrp8y9pmnmbsdsy79l3z84qmhyjx50xdsbgnz1z4md";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
-  buildInputs = [ libcbor openssl ]
-    ++ stdenv.lib.optionals stdenv.isLinux [ udev ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];
-
-  patches = [
-    # fix build on darwin
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/916ebd18a89e4028de203d603726805339be7a5b.patch";
-      sha256 = "07f0xpxnq02cccmqcric87b6pms7k7ssvdw722zr970a6qs8p6i7";
-    })
-    # allow attestation using any supported algorithm
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/f7a9471fa0588cb91cbefffb13c1e4d06c2179b7.patch";
-      sha256 = "02qbw9bqy3sixvwig6az7v3vimgznxnfikn9p1jczm3d7mn8asw2";
-    })
-    # fix EdDSA attestation signature verification bug
-    (fetchpatch {
-      url = "https://github.com/Yubico/libfido2/commit/95126eea52294419515e6540dfd7220f35664c48.patch";
-      sha256 = "076mwpl9xndjhy359jdv2drrwyq7wd3pampkn28mn1rlwxfgf0d0";
-    })
-  ];
+  buildInputs = [ hidapi libcbor openssl ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ udev ];
 
   cmakeFlags = [
     "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
+    "-DUSE_HIDAPI=1"
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
diff --git a/pkgs/development/libraries/libfido2/detect_apple_ld.patch b/pkgs/development/libraries/libfido2/detect_apple_ld.patch
deleted file mode 100644
index de972e0f35864..0000000000000
--- a/pkgs/development/libraries/libfido2/detect_apple_ld.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/CMakeLists.txt	2020-02-19 17:21:59.000000000 +0000
-+++ b/CMakeLists.txt	2020-02-23 15:57:34.241115306 +0000
-@@ -296,7 +296,7 @@
- endif()
- 
- # export list
--if(CMAKE_C_COMPILER_ID STREQUAL "AppleClang")
-+if(APPLE AND CMAKE_C_COMPILER_ID STREQUAL "Clang" OR CMAKE_C_COMPILER_ID STREQUAL "AppleClang")	
- 	# clang + lld
- 	string(CONCAT CMAKE_SHARED_LINKER_FLAGS ${CMAKE_SHARED_LINKER_FLAGS}
- 	    " -exported_symbols_list ${CMAKE_CURRENT_SOURCE_DIR}/src/export.llvm")
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index ad0ca188eb9e1..8e3558fe1b167 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "libinput";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${pname}-${version}.tar.xz";
-    sha256 = "0kb9i1xav8hmrl6g0qdq7jii589i9sjjrbh43fsc5284smyl44jv";
+    sha256 = "1ha5qyak1ka5npy5i6hzqfpii8samkj389mkppj4wdsfv536i2ww";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libjpeg-turbo/default.nix b/pkgs/development/libraries/libjpeg-turbo/default.nix
index 0f71d941d38d5..c7290e147c380 100644
--- a/pkgs/development/libraries/libjpeg-turbo/default.nix
+++ b/pkgs/development/libraries/libjpeg-turbo/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   pname = "libjpeg-turbo";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1ds16bnj17v6hzd43w8pzijz3imd9am4hw75ir0fxm240m8dwij2";
+    sha256 = "01ill8bgjyk582wipx7sh7gj2nidylpbzvwhx0wkcm6mxx3qbp9k";
   };
 
   patches =
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     homepage = "http://libjpeg-turbo.virtualgl.org/";
     description = "A faster (using SIMD) libjpeg implementation";
     license = licenses.ijg; # and some parts under other BSD-style licenses
-    maintainers = [ maintainers.vcunat ];
+    maintainers = with maintainers; [ vcunat colemickens ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/libnetfilter_conntrack/default.nix b/pkgs/development/libraries/libnetfilter_conntrack/default.nix
index c93400e474ac9..851357f6404f4 100644
--- a/pkgs/development/libraries/libnetfilter_conntrack/default.nix
+++ b/pkgs/development/libraries/libnetfilter_conntrack/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libnetfilter_conntrack";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/libnetfilter_conntrack/files/${pname}-${version}.tar.bz2";
-    sha256 = "1dl9z50yny04xi5pymlykwmy6hcfc9p4nd7m47697zwxw98m6s1k";
+    sha256 = "1ky1mqgnplw2h9jf0kn0a69d94jkydhbiipng9l2hdcj13h3pl8c";
   };
 
   buildInputs = [ libmnl ];
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index a63b773e3bb5f..ba8ef8e6a852d 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -4,14 +4,14 @@
 
 let
   pname = "librsvg";
-  version = "2.48.0";
+  version = "2.48.2";
 in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "19ndf9l99wcrmkwcrk20vd1ggrwgldksfz1kkj786ljcrxv8nd2a";
+    sha256 = "1jmxd03fs8vkwycxpmx69kdfmgq52g64bhv82gmj3kjgw2h5h9i7";
   };
 
   outputs = [ "out" "dev" "installedTests" ];
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index 8bac2e711e5a6..2dbff9614a7c2 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libsecret";
-  version = "0.20.1";
+  version = "0.20.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0ir4ynpf8b64xss1azvsi5x6697lik7hkf3z0xxa2qv2xja3xxsp";
+    sha256 = "1hzz34gmsxxf1jm1b7qin390rkwbg8sx198xdkwxqp3q6cw19sc1";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libtxc_dxtn/default.nix b/pkgs/development/libraries/libtxc_dxtn/default.nix
deleted file mode 100644
index 4e65e457110fc..0000000000000
--- a/pkgs/development/libraries/libtxc_dxtn/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
-
-let version = "1.0.1"; in
-
-stdenv.mkDerivation rec {
-  pname = "libtxc_dxtn";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://people.freedesktop.org/~cbrill/libtxc_dxtn/${pname}-${version}.tar.bz2";
-    sha256 = "0q5fjaknl7s0z206dd8nzk9bdh8g4p23bz7784zrllnarl90saa5";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGL libGLU ];
-
-  meta = with stdenv.lib; {
-    homepage = "http://dri.freedesktop.org/wiki/S3TC";
-    repositories.git = "git://people.freedesktop.org/~mareko/libtxc_dxtn";
-    license = licenses.mit;
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix b/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
deleted file mode 100644
index bb69c0dec0a0a..0000000000000
--- a/pkgs/development/libraries/libtxc_dxtn_s2tc/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ stdenv, fetchurl, autoreconfHook, libGL, libGLU }:
-
-let version = "1.0"; in
-
-stdenv.mkDerivation {
-  pname = "libtxc_dxtn_s2tc";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://github.com/divVerent/s2tc/archive/v${version}.tar.gz";
-    sha256 = "0ibfdib277fhbqvxzan0bmglwnsl1y1rw2g8skvz82l1sfmmn752";
-  };
-
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libGL libGLU ];
-
-  meta = {
-    description = "A patent-free S3TC compatible implementation";
-    homepage = "https://github.com/divVerent/s2tc";
-    repositories.git = "https://github.com/divVerent/s2tc.git";
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.cpages ];
-  };
-}
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index d6367fbd19852..0f0143b9c1f42 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "mirror://savannah/libunwind/${pname}-${version}.tar.gz";
-    sha256 = "1y0l08k6ak1mqbfj6accf9s5686kljwgsl4vcqpxzk5n74wpm6a3";
+    sha256 = "0dc46flppifrv2z0mrdqi60165ghxm1wk0g47vcbyzjdplqwjnfz";
   };
 
   patches = [ ./backtrace-only-with-glibc.patch ];
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 1c8e78a3a3728..be374eaf89576 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -2,6 +2,7 @@
 , libXext, libdrm, libXfixes, wayland, libffi, libX11
 , libGL, mesa
 , minimal ? false, libva-minimal
+, buildPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +19,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "dev" "out" ];
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig wayland ];
 
   buildInputs = [ libdrm ]
     ++ lib.optionals (!minimal) [ libva-minimal libX11 libXext libXfixes wayland libffi libGL ];
@@ -29,6 +30,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     # Add FHS paths for non-NixOS applications.
     "--with-drivers-path=${mesa.drivers.driverLink}/lib/dri:/usr/lib/dri:/usr/lib32/dri"
+    "ac_cv_path_WAYLAND_SCANNER=${buildPackages.wayland}/bin/wayland-scanner"
   ] ++ lib.optionals (!minimal) [ "--enable-glx" ];
 
   installFlags = [
diff --git a/pkgs/development/libraries/libvdpau/default.nix b/pkgs/development/libraries/libvdpau/default.nix
index 7b1602523a038..cbb312e0f0d81 100644
--- a/pkgs/development/libraries/libvdpau/default.nix
+++ b/pkgs/development/libraries/libvdpau/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libvdpau";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/vdpau/libvdpau/-/archive/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "b5a52eeac9417edbc396f26c40591ba5df0cd18285f68d84614ef8f06196e50e";
+    sha256 = "0c1zsfr6ypzwv8g9z50kdahpb7pirarq4z8avqqyyma5b9684n22";
   };
   patches = [ ./installdir.patch ];
 
diff --git a/pkgs/development/libraries/libvisual/default.nix b/pkgs/development/libraries/libvisual/default.nix
index 8880daed88ea2..8fe53acc24568 100644
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
   meta = {
     description = "An abstraction library for audio visualisations";
     homepage = "https://sourceforge.net/projects/libvisual/";
diff --git a/pkgs/development/libraries/libvpx/default.nix b/pkgs/development/libraries/libvpx/default.nix
index ca3ec9856c2c2..007df403ff735 100644
--- a/pkgs/development/libraries/libvpx/default.nix
+++ b/pkgs/development/libraries/libvpx/default.nix
@@ -135,16 +135,10 @@ stdenv.mkDerivation rec {
                     experimentalFpMbStatsSupport ||
                     experimentalEmulateHardwareSupport) "experimental")
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    #"--extra-cflags="
-    #"--extra-cxxflags="
-    #"--prefix="
-    #"--libc="
-    #"--libdir="
-    "--enable-external-build"
     # libvpx darwin targets include darwin version (ie. ARCH-darwinXX-gcc, XX being the darwin version)
     # See all_platforms: https://github.com/webmproject/libvpx/blob/master/configure
     # Darwin versions: 10.4=8, 10.5=9, 10.6=10, 10.7=11, 10.8=12, 10.9=13, 10.10=14
-    "--force-target=${stdenv.hostPlatform.config}${
+    "--force-target=${stdenv.hostPlatform.parsed.cpu.name}-${stdenv.hostPlatform.parsed.kernel.name}${
             if stdenv.hostPlatform.isDarwin then
               if      stdenv.hostPlatform.osxMinVersion == "10.10" then "14"
               else if stdenv.hostPlatform.osxMinVersion == "10.9"  then "13"
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 0b350c15026f6..c33317550b5fb 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, meson, ninja, glib, pkgconfig, udev, libgudev }:
+{ stdenv, fetchFromGitHub, meson, ninja, glib, pkgconfig, udev, libgudev, doxygen }:
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.1";
+  version = "1.3";
 
   outputs = [ "out" "dev" ];
 
@@ -10,12 +10,12 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "037vnyfg7nim6h3f4m04w6a9pr6hi04df14qpys580kf5xnf87nz";
+    sha256 = "12g8jb67wj6sgg9ar2w8kkw1m1431rn9nd0j64qkrd3vy9g4l0hk";
   };
 
-  nativeBuildInputs = [ pkgconfig meson ninja ];
+  nativeBuildInputs = [ pkgconfig meson ninja doxygen ];
 
-  mesonFlags = [ "-Dtests=false" ];
+  mesonFlags = [ "-Dtests=disabled" ];
 
   buildInputs = [ glib udev libgudev ];
 
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     homepage = "https://linuxwacom.github.io/";
     description = "Libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
+    maintainers = teams.freedesktop.members;
     license = licenses.mit;
   };
 }
diff --git a/pkgs/development/libraries/libyaml/default.nix b/pkgs/development/libraries/libyaml/default.nix
index c555341f9931e..2f6c8909a595a 100644
--- a/pkgs/development/libraries/libyaml/default.nix
+++ b/pkgs/development/libraries/libyaml/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libyaml";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "yaml";
     repo = "libyaml";
     rev = version;
-    sha256 = "0839nqcmxjzfgjn39j7740pnlsgmvngpkamiw1lfy1qlcqyc3r4v";
+    sha256 = "0a7n575rmm1xkz0sn455rzapm1w9mgqjk29hbmzp53zddqkphvsm";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/mdds/default.nix b/pkgs/development/libraries/mdds/default.nix
index ce7aeb910d002..a65e6b2153d76 100644
--- a/pkgs/development/libraries/mdds/default.nix
+++ b/pkgs/development/libraries/mdds/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mdds";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://kohei.us/files/${pname}/src/${pname}-${version}.tar.bz2";
-    sha256 = "03b8i43pw4m767mm0cnbi77x7qhpkzpi9b1f6dpp4cmyszmnsk8l";
+    sha256 = "0zg0v9rfs92ff1gpnb06gzbxbnd9nqdar5fk8dnkmy0jpnf5qn7i";
   };
 
   postInstall = ''
diff --git a/pkgs/development/libraries/netcdf/default.nix b/pkgs/development/libraries/netcdf/default.nix
index 59d6888e2de0a..2e16f58d9fb5a 100644
--- a/pkgs/development/libraries/netcdf/default.nix
+++ b/pkgs/development/libraries/netcdf/default.nix
@@ -10,11 +10,11 @@ let
   mpi = hdf5.mpi;
 in stdenv.mkDerivation rec {
   pname = "netcdf";
-  version = "4.7.3";
+  version = "4.7.4";
 
   src = fetchurl {
     url = "https://www.unidata.ucar.edu/downloads/netcdf/ftp/${pname}-c-${version}.tar.gz";
-    sha256 = "12s4w2s96p51hlsa81lw92w56rdx8i3mk21pz2ydwcamw579z34f";
+    sha256 = "1a2fpp15a2rl1m50gcvvzd9y6bavl6vjf9zzf63sz5gdmq06yiqf";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/science/biology/elastix/default.nix b/pkgs/development/libraries/science/biology/elastix/default.nix
index e88e79cdcf419..e5565aae29b1f 100644
--- a/pkgs/development/libraries/science/biology/elastix/default.nix
+++ b/pkgs/development/libraries/science/biology/elastix/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, itk, python }:
+{ stdenv, fetchFromGitHub, cmake, itk, python3 }:
 
 stdenv.mkDerivation rec {
   pname    = "elastix";
@@ -10,9 +10,16 @@ stdenv.mkDerivation rec {
     rev    = version;
     sha256 = "1zrl7rz4lwsx88b2shnl985f3a97lmp4ksbd437h9y0hfjq8l0lj";
   };
-  nativeBuildInputs = [ cmake python ];
+
+  nativeBuildInputs = [ cmake python3 ];
   buildInputs = [ itk ];
 
+  doCheck = true;
+
+  preCheck = "
+    export LD_LIBRARY_PATH=$(pwd)/bin
+  ";
+
   meta = with stdenv.lib; {
     homepage = "http://elastix.isi.uu.nl/";
     description = "Image registration toolkit based on ITK";
diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index 664030bc1bcca..9c909d5e14d6c 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -23,14 +23,14 @@ in stdenv.mkDerivation {
     ./2.6.2-cxx.patch
   ];
 
-  preConfigure = "export LD=${if stdenv.isDarwin then "clang++" else "g++"}";
+  preConfigure = "export LD=${stdenv.cc.targetPrefix}c++";
 
   hardeningDisable = [ "format" ];
 
   NIX_CFLAGS_COMPILE =
     stdenv.lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
   buildPhase = ''
     # use STL (xbmc requires it)
     sed '1i#define TIXML_USE_STL 1' -i tinyxml.h
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 53f492bf8b04f..e650a28c61e59 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "12n4mxc6db89258k8i47ql1zna7k94lkwv7lpxg39nm8ypa1ywrv";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake python3 xlibsWrapper libxcb libXrandr libXext wayland ];
+  nativeBuildInputs = [ pkgconfig cmake ];
+  buildInputs = [ python3 xlibsWrapper libxcb libXrandr libXext wayland ];
   enableParallelBuilding = true;
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/waylandpp/default.nix b/pkgs/development/libraries/waylandpp/default.nix
index 06faec558c019..59fac7bfe4a12 100644
--- a/pkgs/development/libraries/waylandpp/default.nix
+++ b/pkgs/development/libraries/waylandpp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, pugixml, wayland, libGL }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, pugixml, wayland, libGL, libffi, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "waylandpp";
@@ -11,8 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "16h57hzd688664qcyznzhjp3hxipdkzgv46x82yhkww24av8b55n";
   };
 
+  cmakeFlags = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "-DWAYLAND_SCANNERPP=${buildPackages.waylandpp}/bin/wayland-scanner++";
+
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ pugixml wayland libGL ];
+  buildInputs = [ pugixml wayland libGL libffi ];
 
   meta = with stdenv.lib; {
     description = "Wayland C++ binding";
diff --git a/pkgs/development/ocaml-modules/bistro/default.nix b/pkgs/development/ocaml-modules/bistro/default.nix
index b141244f8c5b9..9603f283ee4fa 100644
--- a/pkgs/development/ocaml-modules/bistro/default.nix
+++ b/pkgs/development/ocaml-modules/bistro/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildDunePackage
+{ lib, fetchFromGitHub, fetchpatch, buildDunePackage
 , base64, bos, core, lwt_react, ocamlgraph, rresult, tyxml
 }:
 
@@ -12,6 +12,12 @@ buildDunePackage rec {
     sha256 = "114gq48cpj2mvycypa9lfyqqb26wa2gkdfwkcqhnx7m6sdwv9a38";
   };
 
+  # The following patch adds support for core.v0.13
+  patches = [(fetchpatch {
+    url = "https://github.com/pveber/bistro/commit/0931db43a146ad7829dff5120161a775f732a878.patch";
+    sha256 = "06y0sxbbab1mssc1xfjjv12lpv4rny5iqv9qkdqyzrvzpl1bdvnd";
+  })];
+
   propagatedBuildInputs = [ base64 bos core lwt_react ocamlgraph rresult tyxml ];
 
   minimumOCamlVersion = "4.07";
diff --git a/pkgs/development/ocaml-modules/dune-build-info/default.nix b/pkgs/development/ocaml-modules/dune-build-info/default.nix
new file mode 100644
index 0000000000000..3c828ebdcdb94
--- /dev/null
+++ b/pkgs/development/ocaml-modules/dune-build-info/default.nix
@@ -0,0 +1,17 @@
+{ lib, buildDunePackage, dune_2 }:
+
+buildDunePackage rec {
+  pname = "dune-build-info";
+  inherit (dune_2) src version;
+
+  useDune2 = true;
+
+  dontAddPrefix = true;
+
+  meta = with lib; {
+    inherit (dune_2.meta) homepage;
+    description = "Embed build information inside executables";
+    maintainers = [ maintainers.bcdarwin ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/janestreet/0.13.nix b/pkgs/development/ocaml-modules/janestreet/0.13.nix
new file mode 100644
index 0000000000000..4682a744d6f5d
--- /dev/null
+++ b/pkgs/development/ocaml-modules/janestreet/0.13.nix
@@ -0,0 +1,503 @@
+{ janePackage
+, ctypes
+, num
+, octavius
+, ppxlib
+, re
+, openssl
+}:
+
+rec {
+
+  ocaml-compiler-libs = janePackage {
+    pname = "ocaml-compiler-libs";
+    version = "0.12.1";
+    hash = "0hpk54fcsfcjp536fgwr80mjjf88hjk58q7jwnyrhk2ljd8xzgiv";
+    meta.description = "OCaml compiler libraries repackaged";
+  };
+
+  sexplib0 = janePackage {
+    pname = "sexplib0";
+    hash = "1b1bk0xs1hqa12qs5y4h1yl3mq6xml4ya2570dyhdn1j0fbw4g3y";
+    meta.description = "Library containing the definition of S-expressions and some base converters";
+  };
+
+  base = janePackage {
+    pname = "base";
+    version = "0.13.1";
+    hash = "08a5aymcgr5svvm8v0v20msd5cad64m6maakfbhz4172g7kd9jzw";
+    meta.description = "Full standard library replacement for OCaml";
+    propagatedBuildInputs = [ sexplib0 ];
+  };
+
+  stdio = janePackage {
+    pname = "stdio";
+    hash = "1hkj9vh8n8p3n5pvx7053xis1pfmqd8p7shjyp1n555xzimfxzgh";
+    meta.description = "Standard IO library for OCaml";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_sexp_conv = janePackage {
+    pname = "ppx_sexp_conv";
+    hash = "0jkhwmkrfq3ss6bv6i3m871alcr4xpngs6ci6bmzv3yfl7s8bwdf";
+    meta.description = "[@@deriving] plugin to generate S-expression conversion functions";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_here = janePackage {
+    pname = "ppx_here";
+    hash = "1ahidrrjsyi0al06bhv5h6aqmdk7ryz8dybfhqjsn1zp9q056q35";
+    meta.description = "Expands [%here] into its location";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_compare = janePackage {
+    pname = "ppx_compare";
+    hash = "14pnqa47gsvq93z1b8wb5pyq8zw90aaw71j4pwlyid4s86px454j";
+    meta.description = "Generation of comparison functions from types";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_cold = janePackage {
+    pname = "ppx_cold";
+    hash = "0wnfwsgbzk4i5aqjlcaqp6lkvrq5345vazryvx2klbbrd4759h9f";
+    meta.description = "Expands [@cold] into [@inline never][@specialise never][@local never]";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_assert = janePackage {
+    pname = "ppx_assert";
+    hash = "08dada2xcp3w5mir90z56qrdyd317lygml4qlfssj897534bwiqr";
+    meta.description = "Assert-like extension nodes that raise useful errors on failure";
+    propagatedBuildInputs = [ ppx_cold ppx_compare ppx_here ppx_sexp_conv ];
+  };
+
+  ppx_inline_test = janePackage {
+    pname = "ppx_inline_test";
+    hash = "135qzbhqy33lmigbq1rakr9i3y59y3pczh4laanqjyss9b9kfs60";
+    meta.description = "Syntax extension for writing in-line tests in ocaml code";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_custom_printf = janePackage {
+    pname = "ppx_custom_printf";
+    hash = "0kvfkdk4wg2z8x705bajvl1f8wiyy3aya203wdzc9425h73nqm5p";
+    meta.description = "Printf-style format-strings for user-defined string conversion";
+    propagatedBuildInputs = [ ppx_sexp_conv ];
+  };
+
+  fieldslib = janePackage {
+    pname = "fieldslib";
+    hash = "0nsl0i9vjk73pr70ksxqa65rd5v84jzdaazryfdy6i4a5sfg7bxa";
+    meta.description = "Syntax extension to define first class values representing record fields, to get and set record fields, iterate and fold over all fields of a record and create new record values";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_fields_conv = janePackage {
+    pname = "ppx_fields_conv";
+    hash = "0biw0fgphj522bj9wgjk263i2w92vnpaabzr5zn0grihp4yqy8w4";
+    meta.description = "Generation of accessor and iteration functions for ocaml records";
+    propagatedBuildInputs = [ fieldslib ppxlib ];
+  };
+
+  variantslib = janePackage {
+    pname = "variantslib";
+    hash = "04nps65v1n0nv9n1c1kj5k9jyqsfsxb6h2w3vf6cibhjr5m7z8xc";
+    meta.description = "Part of Jane Street's Core library";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_variants_conv = janePackage {
+    pname = "ppx_variants_conv";
+    hash = "1ssinizz11bws06qzjky486cj1zrflij1f7hi16d02j40qmyjz7b";
+    meta.description = "Generation of accessor and iteration functions for ocaml variant types";
+    propagatedBuildInputs = [ variantslib ppxlib ];
+  };
+
+  ppx_expect = janePackage {
+    pname = "ppx_expect";
+    hash = "1hhcga960wjvhcx5pk7rcywl1p9n2ycvqa294n24m8dhzqia6i47";
+    meta.description = "Cram like framework for OCaml";
+    propagatedBuildInputs = [ ppx_assert ppx_custom_printf ppx_fields_conv ppx_inline_test ppx_variants_conv re ];
+  };
+
+  ppx_enumerate = janePackage {
+    pname = "ppx_enumerate";
+    hash = "0hsg6f2nra1mb35jdgym5rf7spm642bs6qqifbikm9hg8f7z3ql4";
+    meta.description = "Generate a list containing all values of a finite type";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_hash = janePackage {
+    pname = "ppx_hash";
+    hash = "1f7mfyx4wgk67hchi57w3142m61ka3vgy1969cbkwr3akv6ifly2";
+    meta.description = "A ppx rewriter that generates hash functions from type expressions and definitions";
+    propagatedBuildInputs = [ ppx_compare ppx_sexp_conv ];
+  };
+
+  ppx_js_style = janePackage {
+    pname = "ppx_js_style";
+    hash = "1zlhcn0an5k9xjymk5z5m2vqi8zajy6nvcbl5sdn19pjl3zv645x";
+    meta.description = "Code style checker for Jane Street Packages";
+    propagatedBuildInputs = [ octavius ppxlib ];
+  };
+
+  ppx_base = janePackage {
+    pname = "ppx_base";
+    hash = "0dkqc85x7bgbb6lgx9rghvj1q4dpdgy9qgjl88ywi4c8l9rgnnkz";
+    meta.description = "Base set of ppx rewriters";
+    propagatedBuildInputs = [ ppx_cold ppx_enumerate ppx_hash ppx_js_style ];
+  };
+
+  ppx_bench = janePackage {
+    pname = "ppx_bench";
+    hash = "0snmy05d3jgihmppixx3dzamkykijqa2v43vpd7q4z8dpnip620g";
+    meta.description = "Syntax extension for writing in-line benchmarks in ocaml code";
+    propagatedBuildInputs = [ ppx_inline_test ];
+  };
+
+  ppx_sexp_message = janePackage {
+    pname = "ppx_sexp_message";
+    hash = "03jhx3ajcv22iwxkg1jf1jjvd14gyrwi1yc6c5ryqi5ha0fywfw6";
+    meta.description = "A ppx rewriter for easy construction of s-expressions";
+    propagatedBuildInputs = [ ppx_here ppx_sexp_conv ];
+  };
+
+  splittable_random = janePackage {
+    pname = "splittable_random";
+    hash = "1kgcd6k31vsd7638g8ip77bp1b7vzgkbvgvij4jm2igl09132r85";
+    meta.description = "PRNG that can be split into independent streams";
+    propagatedBuildInputs = [ base ppx_assert ppx_bench ppx_sexp_message ];
+  };
+
+  ppx_let = janePackage {
+    pname = "ppx_let";
+    hash = "0qplsvbv10h7kwf6dhhgvi001gfphv1v66s83zjr5zbypyaarg5y";
+    meta.description = "Monadic let-bindings";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  base_quickcheck = janePackage {
+    pname = "base_quickcheck";
+    hash = "0ik8llm01m2xap4gia0vpsh7yq311hph7a2kf5109ag4988s8p0w";
+    meta.description = "Randomized testing framework, designed for compatibility with Base";
+    propagatedBuildInputs = [ ppx_base ppx_fields_conv ppx_let splittable_random ];
+  };
+
+  ppx_stable = janePackage {
+    pname = "ppx_stable";
+    hash = "0h7ls1bs0bsd8c4na4aj0nawwhvfy50ybm7sza7yz3qli9jammjk";
+    meta.description = "Stable types conversions generator";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  bin_prot = janePackage {
+    pname = "bin_prot";
+    hash = "1nnr21rljlfglmhiji27d7c1d6gg5fk4cc5rl3750m98w28mfdjw";
+    meta.description = "A binary protocol generator";
+    propagatedBuildInputs = [ ppx_compare ppx_custom_printf ppx_fields_conv ppx_variants_conv ];
+  };
+
+  ppx_bin_prot = janePackage {
+    pname = "ppx_bin_prot";
+    hash = "14nfjgqisdqqg8wg4qzvc859zil82y0qpr8fm4nhq05mgxp37iyc";
+    meta.description = "Generation of bin_prot readers and writers from types";
+    propagatedBuildInputs = [ bin_prot ppx_here ];
+  };
+
+  ppx_fail = janePackage {
+    pname = "ppx_fail";
+    hash = "165mikjg4a1lahq3n9q9y2h36jbln5g3l2hapx17irvf0l0c3vn5";
+    meta.description = "Add location to calls to failwiths";
+    propagatedBuildInputs = [ ppx_here ];
+  };
+
+  jst-config = janePackage {
+    pname = "jst-config";
+    hash = "15lj6f83hz555xhjy9aayl3adqwgl1blcjnja693a1ybi3ca8w0y";
+    meta.description = "Compile-time configuration for Jane Street libraries";
+    buildInputs = [ ppx_assert ];
+  };
+
+  ppx_optcomp = janePackage {
+    pname = "ppx_optcomp";
+    hash = "13db395swqf7v87pgl9qiyj4igmvj57hpl8blx3kkrzj6ddh38a8";
+    meta.description = "Optional compilation for OCaml";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  jane-street-headers = janePackage {
+    pname = "jane-street-headers";
+    hash = "1qjg2ari0xn40dlbk0h9xkwr37k97ldkxpkv792fbl6wc2jlv3x5";
+    meta.description = "Jane Street C header files";
+  };
+
+  time_now = janePackage {
+    pname = "time_now";
+    hash = "1if234kz1ssmv22c0vh1cwhbivab6yy3xvy37ny1q4k5ibjc3v0n";
+    meta.description = "Reports the current time";
+    buildInputs = [ jst-config ppx_optcomp ];
+    propagatedBuildInputs = [ jane-street-headers base ppx_base ];
+  };
+
+  ppx_module_timer = janePackage {
+    pname = "ppx_module_timer";
+    hash = "13kv5fzwf41wsaksj41hnvcpx8pnbmzcainlq6f5shj9671hpnhb";
+    meta.description = "Ppx rewriter that records top-level module startup times";
+    propagatedBuildInputs = [ time_now ];
+  };
+
+  ppx_optional = janePackage {
+    pname = "ppx_optional";
+    hash = "1nwb9jvmszxddj9wxgv9g02qhr10yymm2q1w1gjfqd97m2m1mx4n";
+    meta.description = "Pattern matching on flat options";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_pipebang = janePackage {
+    pname = "ppx_pipebang";
+    hash = "0ybj0flsi95pf13ayzz1lcrqhqvkv1lm2dz6y8w49f12583496mc";
+    meta.description = "A ppx rewriter that inlines reverse application operators `|>` and `|!`";
+    propagatedBuildInputs = [ ppxlib ];
+  };
+
+  ppx_sexp_value = janePackage {
+    pname = "ppx_sexp_value";
+    hash = "18k5015awv9yjl44cvdmp3pn894cgsxmn5s7picxapm9675xqcg9";
+    meta.description = "A ppx rewriter that simplifies building s-expressions from ocaml values";
+    propagatedBuildInputs = [ ppx_here ppx_sexp_conv ];
+  };
+
+  typerep = janePackage {
+    pname = "typerep";
+    hash = "116hlifww2cqq1i9vwpl7ziwkc1na7p9icqi9srpdxnvn8ibcsas";
+    meta.description = "Typerep is a library for runtime types";
+    propagatedBuildInputs = [ base ];
+  };
+
+  ppx_typerep_conv = janePackage {
+    pname = "ppx_typerep_conv";
+    hash = "1jlmga9i79inr412l19n4vvmgafzp1bznqxwhy42x309wblbhxx9";
+    meta.description = "Generation of runtime types from type declarations";
+    propagatedBuildInputs = [ ppxlib typerep ];
+  };
+
+  ppx_jane = janePackage {
+    pname = "ppx_jane";
+    hash = "1a86rvnry8lvjhsg2k73f5bgz7l2962k5i49yzmzn8w66kj0yz60";
+    meta.description = "Standard Jane Street ppx rewriters";
+    propagatedBuildInputs = [ base_quickcheck ppx_bench ppx_bin_prot ppx_expect ppx_fail ppx_module_timer ppx_optcomp ppx_optional ppx_pipebang ppx_sexp_value ppx_stable ppx_typerep_conv ];
+  };
+
+  base_bigstring = janePackage {
+    pname = "base_bigstring";
+    hash = "1i3zr8bn71l442vl5rrvjpwphx20frp2vaw1qc05d348j76sxfp7";
+    meta.description = "String type based on [Bigarray], for use in I/O and C-bindings";
+    propagatedBuildInputs = [ ppx_jane ];
+  };
+
+  parsexp = janePackage {
+    pname = "parsexp";
+    hash = "0fsxy5lpsvfadj8m2337j8iprs294dfikqxjcas7si74nskx6l38";
+    meta.description = "S-expression parsing library";
+    propagatedBuildInputs = [ base sexplib0 ];
+  };
+
+  sexplib = janePackage {
+    pname = "sexplib";
+    hash = "059ypcyirw00x6dqa33x49930pwxcr3i72qz5pf220js2ai2nzhn";
+    meta.description = "Library for serializing OCaml values to and from S-expressions";
+    propagatedBuildInputs = [ num parsexp ];
+  };
+
+  core_kernel = janePackage {
+    version = "0.13.1";
+    pname = "core_kernel";
+    hash = "1ynyz6jkf23q0cwbn6kv06mgyjd644qxb0qkrydq0cglcaa4kjhp";
+    meta.description = "System-independent part of Core";
+    buildInputs = [ jst-config ];
+    propagatedBuildInputs = [ base_bigstring sexplib ];
+  };
+
+  spawn = janePackage {
+    pname = "spawn";
+    hash = "1w003k1kw1lmyiqlk58gkxx8rac7dchiqlz6ah7aj7bh49b36ppf";
+    meta.description = "Spawning sub-processes";
+    buildInputs = [ ppx_expect ];
+  };
+
+  core = janePackage {
+    pname = "core";
+    hash = "1i5z9myl6i7axd8dz4b71gdsz9la6k07ib9njr4bn12yn0y76b1m";
+    meta.description = "System-independent part of Core";
+    buildInputs = [ jst-config ];
+    propagatedBuildInputs = [ core_kernel spawn ];
+  };
+
+  async_kernel = janePackage {
+    pname = "async_kernel";
+    hash = "1rrbyy3pyh31qwv0jiarhpgdyq2z2gx6axmaplgpxshk4qx6gsld";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ core_kernel ];
+  };
+
+  protocol_version_header = janePackage {
+    pname = "protocol_version_header";
+    hash = "19wscd81jlj355f9din1sg21m3af456a0id2a37bx38r390wrghc";
+    meta.description = "Protocol versioning";
+    propagatedBuildInputs = [ core_kernel ];
+  };
+
+  async_rpc_kernel = janePackage {
+    pname = "async_rpc_kernel";
+    hash = "1k3f2psyd1xcf7nkk0q1fq57yyhfqbzyynsz821n7mrnm37simac";
+    meta.description = "Platform-independent core of Async RPC library";
+    propagatedBuildInputs = [ async_kernel protocol_version_header ];
+  };
+
+  async_unix = janePackage {
+    pname = "async_unix";
+    hash = "0n3jz3qjlphyhkqgnbjbwf2fqxaksws82dx1mk4m4wnw3275gdi5";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ async_kernel core ];
+  };
+
+  async_extra = janePackage {
+    pname = "async_extra";
+    hash = "06q1farx7dwi4h490xi1azq7ym57ih2d23sq17g2jfvw889kf4n1";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ async_rpc_kernel async_unix ];
+  };
+
+  textutils = janePackage {
+    pname = "textutils";
+    hash = "1wnyqj9dzfgl0kddmdl4n9rkl16hwy432dd2i4ksvk2z5g9kkb0d";
+    meta.description = "Text output utilities";
+    propagatedBuildInputs = [ core ];
+  };
+
+  async = janePackage {
+    pname = "async";
+    hash = "002j9yxpw0ghi12a84163vaqa3n9h8j35f4i72nbxnilxwvy95sr";
+    meta.description = "Monadic concurrency library";
+    propagatedBuildInputs = [ async_rpc_kernel async_unix textutils ];
+  };
+
+  async_find = janePackage {
+    pname = "async_find";
+    hash = "0l8cfhyrx2rb2avdcfx5m70aj6rx2d57qxqvfycad5afqz4xx2n9";
+    meta.description = "Directory traversal with Async";
+    propagatedBuildInputs = [ async ];
+  };
+
+  re2 = janePackage {
+    pname = "re2";
+    hash = "0hmizznlzilynn5kh6149bbpkfw2l0xi7zi1y1fxfww2ma3wpim0";
+    meta.description = "OCaml bindings for RE2, Google's regular expression library";
+    propagatedBuildInputs = [ core_kernel ];
+    prePatch = ''
+      substituteInPlace src/re2_c/dune --replace 'CXX=g++' 'CXX=c++'
+      substituteInPlace src/dune --replace '(cxx_flags (:standard \ -pedantic) (-I re2_c/libre2))' '(cxx_flags (:standard \ -pedantic) (-I re2_c/libre2) (-x c++))'
+    '';
+  };
+
+  shell = janePackage {
+    pname = "shell";
+    hash = "190ymhm0z9b7hngbcpg88wwrfxwfcdh339d7rd2xhmrhi4z99r18";
+    meta.description = "Yet another implementation of fork&exec and related functionality";
+    buildInputs = [ jst-config ];
+    propagatedBuildInputs = [ re2 textutils ];
+  };
+
+  async_shell = janePackage {
+    pname = "async_shell";
+    hash = "0bfxyvdmyv23zfr49pb4c3bgfkjr4s3nb3z07xrw6szia3j1kp4j";
+    meta.description = "Shell helpers for Async";
+    propagatedBuildInputs = [ async shell ];
+  };
+
+  core_bench = janePackage {
+    pname = "core_bench";
+    hash = "1nk0i3z8rqrljbf4bc7ljp71g0a4361nh85s2ang0lgxri74zacm";
+    meta.description = "Benchmarking library";
+    propagatedBuildInputs = [ textutils ];
+  };
+
+  core_extended = janePackage {
+    pname = "core_extended";
+    hash = "0zh1wwkg5cxkz633dl9zbbl65aksvzb5mss1q8f7w6i1sv3n0135";
+    meta.description = "Extra components that are not as closely vetted or as stable as Core";
+    propagatedBuildInputs = [ core ];
+  };
+
+  sexp_pretty = janePackage {
+    pname = "sexp_pretty";
+    hash = "1a59xc9frmvi7n0i32dzs8gpf5ral80xkwv97a13zv5cyg8l6216";
+    meta.description = "S-expression pretty-printer";
+    propagatedBuildInputs = [ ppx_base re sexplib ];
+  };
+
+  expect_test_helpers_kernel = janePackage {
+    pname = "expect_test_helpers_kernel";
+    hash = "11m0i7mj6b1cmqnwhmsrqdc814s0lk3sip8rh97k75grngazmjvn";
+    meta.description = "Helpers for writing expectation tests";
+    buildInputs = [ ppx_jane ];
+    propagatedBuildInputs = [ core_kernel sexp_pretty ];
+  };
+
+  expect_test_helpers = janePackage {
+    pname = "expect_test_helpers";
+    hash = "0sw9yam8d9hdam8p194q0hgc4i26vvwj5qi2cba1jxfhdzhy8jdd";
+    meta.description = "Async helpers for writing expectation tests";
+    propagatedBuildInputs = [ async expect_test_helpers_kernel ];
+  };
+
+  patience_diff = janePackage {
+    pname = "patience_diff";
+    hash = "012rlbnw21yq2lsbfk3f7l4m4qq3jdx238146z36v54vnhhs6r2r";
+    meta.description = "Diff library using Bram Cohen's patience diff algorithm";
+    propagatedBuildInputs = [ core_kernel ];
+  };
+
+  ecaml = janePackage {
+    pname = "ecaml";
+    hash = "0jmmsi1m7d4cl5mnw6v9h4ng29anwxy73a6qfi28lgpzafn452bc";
+    meta.description = "Library for writing Emacs plugin in OCaml";
+    propagatedBuildInputs = [ async expect_test_helpers_kernel ];
+  };
+
+  ### Packages at version 0.11, with dependencies at version 0.12
+
+  configurator = janePackage {
+    pname = "configurator";
+    version = "0.11.0";
+    hash = "0h686630cscav7pil8c3w0gbh6rj4b41dvbnwmicmlkc746q5bfk";
+    propagatedBuildInputs = [ stdio ];
+    meta.description = "Helper library for gathering system configuration";
+  };
+
+  ppx_core = janePackage {
+    pname = "ppx_core";
+    version = "0.11.0";
+    hash = "11hgm9mxig4cm3c827f6dns9mjv3pf8g6skf10x0gw9xnp1dmzmx";
+    propagatedBuildInputs = [ ppxlib ];
+    meta.description = "Deprecated (see ppxlib)";
+  };
+
+  ppx_driver = janePackage {
+    pname = "ppx_driver";
+    version = "0.11.0";
+    hash = "00kfx6js2kxk57k4v7hiqvwk7h35whgjihnxf75m82rnaf4yzvfi";
+    propagatedBuildInputs = [ ppxlib ];
+    meta.description = "Deprecated (see ppxlib)";
+  };
+
+  ppx_type_conv = janePackage {
+    pname = "ppx_type_conv";
+    version = "0.11.0";
+    hash = "04dbrglqqhkas25cpjz8xhjcbpk141c35qggzw66bn69izczfmaf";
+    propagatedBuildInputs = [ ppxlib ];
+    meta.description = "Deprecated (see ppxlib)";
+  };
+
+}
diff --git a/pkgs/development/ocaml-modules/janestreet/async_ssl.nix b/pkgs/development/ocaml-modules/janestreet/async_ssl.nix
deleted file mode 100644
index c13f9a34fb769..0000000000000
--- a/pkgs/development/ocaml-modules/janestreet/async_ssl.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ stdenv, buildOcamlJane, async, comparelib, core, ctypes
-, openssl, fieldslib, herelib, pipebang, sexplib, ocaml_oasis
-}:
-
-buildOcamlJane {
-  name = "async_ssl";
-  version = "113.33.07";
-  hash = "0bhzpnmlx6dy4fli3i7ipjwqbsdi7fq171jrila5dr3ciy3841xs";
-  propagatedBuildInputs = [ ctypes async comparelib core fieldslib
-                            herelib pipebang sexplib openssl ocaml_oasis ];
-  meta = with stdenv.lib; {
-    homepage = "https://github.com/janestreet/async_ssl";
-    description = "Async wrappers for ssl";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ericbmerritt ];
-  };
-}
diff --git a/pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix b/pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix
new file mode 100644
index 0000000000000..b92bcead95c3e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/janestreet/janePackage_0_13.nix
@@ -0,0 +1,19 @@
+{ lib, fetchFromGitHub, buildDunePackage, defaultVersion ? "0.13.0" }:
+
+{ pname, version ? defaultVersion, hash, ...}@args:
+
+buildDunePackage (args // {
+  inherit version;
+
+  minimumOCamlVersion = "4.08";
+
+  src = fetchFromGitHub {
+    owner = "janestreet";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = hash;
+  };
+
+  meta.license = lib.licenses.mit;
+  meta.homepage = "https://github.com/janestreet/${pname}";
+})
diff --git a/pkgs/development/ocaml-modules/linenoise/default.nix b/pkgs/development/ocaml-modules/linenoise/default.nix
index b6b9b4163ff94..0ad277f4a07f6 100644
--- a/pkgs/development/ocaml-modules/linenoise/default.nix
+++ b/pkgs/development/ocaml-modules/linenoise/default.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "linenoise";
-  version = "1.1.0";
+  version = "1.3.0";
 
   minimumOCamlVersion = "4.02";
 
@@ -10,7 +10,7 @@ buildDunePackage rec {
     owner = "fxfactorial";
     repo = "ocaml-${pname}";
     rev = "v${version}";
-    sha256 = "1h6rqfgmhmd7p5z8yhk6zkbrk4yzw1v2fgwas2b7g3hqs6y0xj0q";
+    sha256 = "0m9mm1arsawi5w5aqm57z41sy1wfxvhfgbdiw7hzy631i391144g";
   };
 
   propagatedBuildInputs = [ result ];
diff --git a/pkgs/development/ocaml-modules/phylogenetics/default.nix b/pkgs/development/ocaml-modules/phylogenetics/default.nix
index 916be9b3d3863..1873a4e0c583b 100644
--- a/pkgs/development/ocaml-modules/phylogenetics/default.nix
+++ b/pkgs/development/ocaml-modules/phylogenetics/default.nix
@@ -3,15 +3,15 @@
 
 buildDunePackage rec {
   pname = "phylogenetics";
-  version = "unstable-2020-01-05";
+  version = "unstable-2020-01-25";
 
   useDune2 = true;
 
   src = fetchFromGitHub {
     owner  = "biocaml";
     repo   = pname;
-    rev    = "b55ef7d7322bd822be26d21339945d45487fb547";
-    sha256 = "0hzfjhs5w3a7hlzxs739k5ik3k1xn3dzyzziid765s74f638n4hj";
+    rev    = "752a7d0324709ba919ef43630a270afd45d6b734";
+    sha256 = "1zsxpl1yjbw6y6n1q7qk3h0l7c0lxhh8yp8bkxlwnpzlkqq28ycg";
   };
 
   minimumOCamlVersion = "4.08";  # e.g., uses Float.min
diff --git a/pkgs/development/ocaml-modules/rpclib/default.nix b/pkgs/development/ocaml-modules/rpclib/default.nix
index a4134f592b36f..9216a489248b9 100644
--- a/pkgs/development/ocaml-modules/rpclib/default.nix
+++ b/pkgs/development/ocaml-modules/rpclib/default.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "rpclib";
-  version = "6.0.0";
+  version = "7.0.0";
 
   minimumOCamlVersion = "4.04";
 
@@ -10,7 +10,7 @@ buildDunePackage rec {
     owner = "mirage";
     repo = "ocaml-rpc";
     rev = "v${version}";
-    sha256 = "0bmr20sj7kybjjlwd42irj0f5zlnxcw7mxa1mdgxkki9bmhsqr51";
+    sha256 = "0d8nb272mjxkq5ddn65cy9gjpa8yvd0v3jv3wp5xfh9gj29wd2jj";
   };
 
   buildInputs = [ alcotest cmdliner yojson ];
diff --git a/pkgs/development/ocaml-modules/sedlex/2.nix b/pkgs/development/ocaml-modules/sedlex/2.nix
index 7b751ba03037d..b1a892d5b804a 100644
--- a/pkgs/development/ocaml-modules/sedlex/2.nix
+++ b/pkgs/development/ocaml-modules/sedlex/2.nix
@@ -38,9 +38,9 @@ buildDunePackage rec {
     sha256 = "05f6qa8x3vhpdz1fcnpqk37fpnyyq13icqsk2gww5idjnh6kng26";
   };
 
-  buildInputs = [ ppx_tools_versioned ocaml-migrate-parsetree ];
-
-  propagatedBuildInputs = [ gen uchar ];
+  propagatedBuildInputs = [
+    gen uchar ocaml-migrate-parsetree ppx_tools_versioned
+  ];
 
   preBuild = ''
     ln -s ${DerivedCoreProperties} src/generator/data/DerivedCoreProperties.txt
diff --git a/pkgs/development/perl-modules/xml-parser-0001-HACK-Assumes-Expat-paths-are-good.patch b/pkgs/development/perl-modules/xml-parser-0001-HACK-Assumes-Expat-paths-are-good.patch
new file mode 100644
index 0000000000000..add6d9df3b7f4
--- /dev/null
+++ b/pkgs/development/perl-modules/xml-parser-0001-HACK-Assumes-Expat-paths-are-good.patch
@@ -0,0 +1,45 @@
+From e996904128653c67b04ddbdb1e10cef158098957 Mon Sep 17 00:00:00 2001
+From: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Date: Fri, 6 Dec 2019 23:00:51 -0500
+Subject: [PATCH] [HACK]: Assumes Expat paths are good.
+
+The `check_lib` check fails with the cross-compilation build platform's
+Perl, since apparently `mktemp` is missing...
+
+Even then, side-stepping the issue, it seems it is not actually enough
+to work, as the compilation fails.
+---
+ Makefile.PL | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/Makefile.PL b/Makefile.PL
+index 505d1df..fc38b76 100644
+--- a/Makefile.PL
++++ b/Makefile.PL
+@@ -29,12 +29,17 @@ foreach (@ARGV) {
+ @ARGV = @replacement_args;
+ 
+ unless (
+-    check_lib(    # fill in what you prompted the user for here
+-        lib     => [qw(expat)],
+-        header  => ['expat.h'],
+-        incpath => $expat_incpath,
+-        ( $expat_libpath ? ( libpath => $expat_libpath ) : () ),
+-    )
++    #check_lib(    # fill in what you prompted the user for here
++    #    lib     => [qw(expat)],
++    #    header  => ['expat.h'],
++    #    incpath => $expat_incpath,
++    #    ( $expat_libpath ? ( libpath => $expat_libpath ) : () ),
++    #)
++    # The check_lib implementation fails horribly with cross-compilation.
++    # We are giving known good paths to expat.
++    # And in all cases, the previous behaviour of not actually failing
++    # seemed to work just fine :/.
++    false
+ ) {
+     warn <<'Expat_Not_Installed;';
+ 
+-- 
+2.23.0
+
diff --git a/pkgs/development/python-modules/apptools/default.nix b/pkgs/development/python-modules/apptools/default.nix
index 9e06abd9a71ec..47144fc07aa06 100644
--- a/pkgs/development/python-modules/apptools/default.nix
+++ b/pkgs/development/python-modules/apptools/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchPypi, buildPythonPackage
+{ lib, fetchPypi, buildPythonPackage, fetchpatch
 , configobj, six, traitsui
 , nose, tables, pandas
 }:
@@ -12,6 +12,13 @@ buildPythonPackage rec {
     sha256 = "10h52ibhr2aw076pivqxiajr9rpcr1mancg6xlpxzckcm3if02i6";
   };
 
+  # PyTables issue; should be merged in next post-4.5.0 release (#117)
+  patches = [ (fetchpatch {
+      url = "https://github.com/enthought/apptools/commit/3734289d1a0ebd8513fa67f75288add31ed0113c.patch";
+      sha256 = "001012q1ib5cbib3nq1alh9ckzj588bfrywr8brkd1f6y1pgvngk";
+    })
+  ];
+
   propagatedBuildInputs = [ configobj six traitsui ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/envisage/default.nix b/pkgs/development/python-modules/envisage/default.nix
index ba3e6a0c636dd..397e573a252f5 100644
--- a/pkgs/development/python-modules/envisage/default.nix
+++ b/pkgs/development/python-modules/envisage/default.nix
@@ -1,15 +1,18 @@
-{ stdenv, fetchPypi, buildPythonPackage
+{ lib, fetchPypi, fetchpatch, isPy27
+, buildPythonPackage
 , traits, apptools
-, ipykernel
+, python, ipykernel, ipython
 }:
 
 buildPythonPackage rec {
   pname = "envisage";
-  version = "4.7.2";
+  version = "4.9.2";
+
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0jb5nw0w9x97jij0hd3d7kfzcj58r1cqmplmdy56bj11dyc4wyc9";
+    sha256 = "1srjmkhnz84nz5jd72vdsnc4fn7dd9jr8nyf3hzk6yx1dsn815gd";
   };
 
   propagatedBuildInputs = [ traits apptools ];
@@ -18,16 +21,26 @@ buildPythonPackage rec {
     export HOME=$PWD/HOME
   '';
 
+  # fix a test failure; should be merged in next release
+  patches = [ (fetchpatch {
+    url = "https://github.com/enthought/envisage/pull/248/commits/7b6d2dd615d5cb7455b200eb8f37e030bbf4df9e.patch";
+    sha256 = "0a3dmbpxwsn1bkjcjv9v7b751rcmppj6hc9wcgiayg4l9r2nrvyh";
+  }) ];
+
   checkInputs = [
-    ipykernel
+    ipykernel ipython
   ];
 
-  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -m unittest
+    runHook postCheck
+  '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Framework for building applications whose functionalities can be extended by adding 'plug-ins'";
     homepage = "https://github.com/enthought/envisage";
-    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
+    maintainers = with lib.maintainers; [ knedlsepp ];
     license = licenses.bsdOriginal;
   };
 }
diff --git a/pkgs/development/python-modules/howdoi/default.nix b/pkgs/development/python-modules/howdoi/default.nix
index 9b1fb75b46180..c98192e9b0ab1 100644
--- a/pkgs/development/python-modules/howdoi/default.nix
+++ b/pkgs/development/python-modules/howdoi/default.nix
@@ -5,6 +5,8 @@
 , requests-cache
 , pygments
 , pyquery
+, cachelib
+, appdirs
 }:
 
 buildPythonPackage rec {
@@ -16,7 +18,7 @@ buildPythonPackage rec {
     sha256 = "3b322668606d29d8a841c3b28c0574851f512b55c33a7ceb982b6a98d82fa3e3";
   };
 
-  propagatedBuildInputs = [ six requests-cache pygments pyquery ];
+  propagatedBuildInputs = [ six requests-cache pygments pyquery cachelib appdirs ];
 
   preCheck = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/development/python-modules/lektor/default.nix b/pkgs/development/python-modules/lektor/default.nix
index 0fe3a11ae2612..844e28aa07884 100644
--- a/pkgs/development/python-modules/lektor/default.nix
+++ b/pkgs/development/python-modules/lektor/default.nix
@@ -19,6 +19,7 @@
 , pytest-click
 , isPy27
 , functools32
+, setuptools
 }:
 
 buildPythonPackage rec {
@@ -34,7 +35,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     click watchdog exifread requests mistune inifile Babel jinja2
-    flask pyopenssl ndg-httpsclient
+    flask pyopenssl ndg-httpsclient setuptools
   ] ++ lib.optionals isPy27 [ functools32 ];
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/matplotlib/2.nix b/pkgs/development/python-modules/matplotlib/2.nix
index 8ea530489e249..dd25860795baf 100644
--- a/pkgs/development/python-modules/matplotlib/2.nix
+++ b/pkgs/development/python-modules/matplotlib/2.nix
@@ -7,7 +7,6 @@
 # darwin has its own "MacOSX" backend
 , enableTk ? !stdenv.isDarwin, tcl ? null, tk ? null, tkinter ? null, libX11 ? null
 , enableQt ? false, pyqt4
-, libcxx
 , Cocoa
 , pythonOlder
 }:
@@ -29,13 +28,20 @@ buildPythonPackage rec {
     sha256 = "7355bf757ecacd5f0ac9dd9523c8e1a1103faadf8d33c22664178e17533f8ce5";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
+  patches = [
+    # https://github.com/matplotlib/matplotlib/pull/12478
+    (fetchpatch {
+      name = "numpy-1.16-compat.patch";
+      url = "https://github.com/matplotlib/matplotlib/commit/2980184d092382a40ab21f95b79582ffae6e19d6.patch";
+      sha256 = "1c0wj28zy8s5h6qiavx9zzbhlmhjwpzbc3fyyw9039mbnqk0spg2";
+    })
+  ];
 
   XDG_RUNTIME_DIR = "/tmp";
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ python which sphinx stdenv ]
+  buildInputs = [ which sphinx ]
     ++ stdenv.lib.optional enableGhostscript ghostscript
     ++ stdenv.lib.optional stdenv.isDarwin [ Cocoa ];
 
@@ -48,16 +54,10 @@ buildPythonPackage rec {
     ++ stdenv.lib.optionals enableQt [ pyqt4 ]
     ++ stdenv.lib.optionals python.isPy2 [ functools32 subprocess32 ];
 
-  patches = [
-    ./basedirlist.patch
-
-    # https://github.com/matplotlib/matplotlib/pull/12478
-    (fetchpatch {
-      name = "numpy-1.16-compat.patch";
-      url = "https://github.com/matplotlib/matplotlib/commit/2980184d092382a40ab21f95b79582ffae6e19d6.patch";
-      sha256 = "1c0wj28zy8s5h6qiavx9zzbhlmhjwpzbc3fyyw9039mbnqk0spg2";
-    })
-  ];
+  setup_cfg = ./setup.cfg;
+  preBuild = ''
+    cp "$setup_cfg" ./setup.cfg
+  '';
 
   # Matplotlib tries to find Tcl/Tk by opening a Tk window and asking the
   # corresponding interpreter object for its library paths. This fails if
@@ -73,27 +73,14 @@ buildPythonPackage rec {
     stdenv.lib.optionalString enableTk
       "sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py";
 
-  checkPhase = ''
-    ${python.interpreter} tests.py
-  '';
-
-  # Test data is not included in the distribution (the `tests` folder
-  # is missing)
+  # Matplotlib needs to be built against a specific version of freetype in
+  # order for all of the tests to pass.
   doCheck = false;
 
-  prePatch = ''
-    # Failing test: ERROR: matplotlib.tests.test_style.test_use_url
-    sed -i 's/test_use_url/fails/' lib/matplotlib/tests/test_style.py
-    # Failing test: ERROR: test suite for <class 'matplotlib.sphinxext.tests.test_tinypages.TestTinyPages'>
-    sed -i 's/TestTinyPages/fails/' lib/matplotlib/sphinxext/tests/test_tinypages.py
-    # Transient errors
-    sed -i 's/test_invisible_Line_rendering/noop/' lib/matplotlib/tests/test_lines.py
-  '';
-
   meta = with stdenv.lib; {
     description = "Python plotting library, making publication quality plots";
     homepage    = "https://matplotlib.org/";
-    maintainers = with maintainers; [ lovek323 ];
+    maintainers = with maintainers; [ lovek323 veprbl ];
   };
 
 }
diff --git a/pkgs/development/python-modules/matplotlib/basedirlist.patch b/pkgs/development/python-modules/matplotlib/basedirlist.patch
deleted file mode 100644
index 0a84a05bbaeae..0000000000000
--- a/pkgs/development/python-modules/matplotlib/basedirlist.patch
+++ /dev/null
@@ -1,8 +0,0 @@
-diff --git a/setup.cfg b/setup.cfg
-new file mode 100644
-index 0000000..6f81985
---- /dev/null
-+++ b/setup.cfg
-@@ -0,0 +1,2 @@
-+[directories]
-+basedirlist = .
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 658388eabae4a..03afcfe75ae3b 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -6,7 +6,6 @@
 # darwin has its own "MacOSX" backend
 , enableTk ? !stdenv.isDarwin, tcl ? null, tk ? null, tkinter ? null, libX11 ? null
 , enableQt ? false, pyqt5 ? null
-, libcxx
 , Cocoa
 , pythonOlder
 }:
@@ -20,36 +19,35 @@ assert enableTk -> (tcl != null)
 assert enableQt -> pyqt5 != null;
 
 buildPythonPackage rec {
-  version = "3.1.3";
+  version = "3.2.1";
   pname = "matplotlib";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "db3121f12fb9b99f105d1413aebaeb3d943f269f3d262b45586d12765866f0c6";
+    sha256 = "ffe2f9cdcea1086fc414e82f42271ecf1976700b8edd16ca9d376189c6d93aee";
   };
 
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";
-
   XDG_RUNTIME_DIR = "/tmp";
 
   nativeBuildInputs = [ pkgconfig ];
 
-  buildInputs = [ python which sphinx stdenv ]
+  buildInputs = [ which sphinx ]
     ++ stdenv.lib.optional enableGhostscript ghostscript
     ++ stdenv.lib.optional stdenv.isDarwin [ Cocoa ];
 
   propagatedBuildInputs =
     [ cycler dateutil numpy pyparsing tornado freetype kiwisolver
       libpng mock pytz ]
-    ++ stdenv.lib.optional (pythonOlder "3.3") backports_functools_lru_cache
     ++ stdenv.lib.optionals enableGtk3 [ cairo pycairo gtk3 gobject-introspection pygobject3 ]
     ++ stdenv.lib.optionals enableTk [ tcl tk tkinter libX11 ]
     ++ stdenv.lib.optionals enableQt [ pyqt5 ];
 
-  patches =
-    [ ./basedirlist.patch ];
+  setup_cfg = ./setup.cfg;
+  preBuild = ''
+    cp "$setup_cfg" ./setup.cfg
+  '';
 
   # Matplotlib tries to find Tcl/Tk by opening a Tk window and asking the
   # corresponding interpreter object for its library paths. This fails if
@@ -65,27 +63,14 @@ buildPythonPackage rec {
     stdenv.lib.optionalString enableTk
       "sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py";
 
-  checkPhase = ''
-    ${python.interpreter} tests.py
-  '';
-
-  # Test data is not included in the distribution (the `tests` folder
-  # is missing)
+  # Matplotlib needs to be built against a specific version of freetype in
+  # order for all of the tests to pass.
   doCheck = false;
 
-  prePatch = ''
-    # Failing test: ERROR: matplotlib.tests.test_style.test_use_url
-    sed -i 's/test_use_url/fails/' lib/matplotlib/tests/test_style.py
-    # Failing test: ERROR: test suite for <class 'matplotlib.sphinxext.tests.test_tinypages.TestTinyPages'>
-    sed -i 's/TestTinyPages/fails/' lib/matplotlib/sphinxext/tests/test_tinypages.py
-    # Transient errors
-    sed -i 's/test_invisible_Line_rendering/noop/' lib/matplotlib/tests/test_lines.py
-  '';
-
   meta = with stdenv.lib; {
     description = "Python plotting library, making publication quality plots";
     homepage    = "https://matplotlib.org/";
-    maintainers = with maintainers; [ lovek323 ];
+    maintainers = with maintainers; [ lovek323 veprbl ];
   };
 
 }
diff --git a/pkgs/development/python-modules/matplotlib/setup.cfg b/pkgs/development/python-modules/matplotlib/setup.cfg
new file mode 100644
index 0000000000000..6f81985efa446
--- /dev/null
+++ b/pkgs/development/python-modules/matplotlib/setup.cfg
@@ -0,0 +1,2 @@
+[directories]
+basedirlist = .
diff --git a/pkgs/development/python-modules/mayavi/default.nix b/pkgs/development/python-modules/mayavi/default.nix
index ffdf974758370..2fd536609076a 100644
--- a/pkgs/development/python-modules/mayavi/default.nix
+++ b/pkgs/development/python-modules/mayavi/default.nix
@@ -1,37 +1,45 @@
-{ stdenv, fetchPypi, buildPythonPackage
-, wxPython, pygments, numpy, vtk, traitsui, envisage, apptools
-, nose, mock
-, isPy3k
+{ lib, buildPythonPackage, isPy27, fetchPypi, wrapQtAppsHook
+, pyface, pygments, numpy, vtk, traitsui, envisage, apptools, pyqt5
 }:
 
 buildPythonPackage rec {
   pname = "mayavi";
   version = "4.7.1";
 
+  disabled = isPy27;
+
   src = fetchPypi {
     inherit pname version;
     extension = "tar.bz2";
     sha256 = "095p7mds6kqqrp7xqv24iygr3mw85rm7x41wb5y4yc3gi1pznldy";
   };
 
-  # Discovery of 'vtk' in setuptools is not working properly, due to a missing
-  # .egg-info in the vtk package. It does however import and run just fine.
   postPatch = ''
+    # Discovery of 'vtk' in setuptools is not working properly, due to a missing
+    # .egg-info in the vtk package. It does however import and run just fine.
     substituteInPlace mayavi/__init__.py --replace "'vtk'" ""
-  '';
 
-  propagatedBuildInputs = [ wxPython pygments numpy vtk traitsui envisage apptools ];
+    # building the docs fails with the usual Qt xcb error, so skip:
+    substituteInPlace setup.py \
+      --replace "build.build.run(self)" "build.build.run(self); return"
+  '';
 
-  checkInputs = [ nose mock ];
+  nativeBuildInputs = [ wrapQtAppsHook ];
 
-  disabled = isPy3k; # TODO: This would need pyqt5 instead of wxPython
+  propagatedBuildInputs = [
+    pyface pygments numpy vtk traitsui envisage apptools pyqt5
+  ];
 
   doCheck = false; # Needs X server
 
-  meta = with stdenv.lib; {
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
     description = "3D visualization of scientific data in Python";
     homepage = "https://github.com/enthought/mayavi";
-    maintainers = with stdenv.lib.maintainers; [ knedlsepp ];
+    maintainers = with maintainers; [ knedlsepp ];
     license = licenses.bsdOriginal;
   };
 }
diff --git a/pkgs/development/python-modules/pyface/default.nix b/pkgs/development/python-modules/pyface/default.nix
index db8b05e8d6838..db0ee541e09ce 100644
--- a/pkgs/development/python-modules/pyface/default.nix
+++ b/pkgs/development/python-modules/pyface/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchPypi, buildPythonPackage
-, setuptools, six, traits, wxPython
+, setuptools, six, traits
 }:
 
 buildPythonPackage rec {
@@ -11,7 +11,7 @@ buildPythonPackage rec {
     sha256 = "1g2g3za64rfffbivlihbf5njrqbv63ln62rv9d8fi1gcrgaw6akw";
   };
 
-  propagatedBuildInputs = [ setuptools six traits wxPython ];
+  propagatedBuildInputs = [ setuptools six traits ];
 
   doCheck = false; # Needs X server
 
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index fddc27ee1913b..2a3b90733c46f 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     sha256 = "0bdf5ed600df30c8830455702338902528717c0af85ac5914f1dc5aa0bfa6eee";
   };
 
-  propagatedBuildInputs = [ pkgs.libGLU pkgs.libGL pkgs.freeglut pillow ];
+  propagatedBuildInputs = [ pillow ];
 
   patchPhase = let
     ext = stdenv.hostPlatform.extensions.sharedLibrary; in ''
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index 3d6a4a7aee03c..d643603a0679e 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -44,12 +44,12 @@ buildPythonPackage rec {
 
   checkInputs = [
     nose dbus dbus-python which pycodestyle pyflakes
-    pygobject3 bluez bluez.test networkmanager
+    pygobject3 bluez (lib.getOutput "test" bluez) networkmanager
   ];
 
   checkPhase = ''
     runHook preCheck
-    export PATH="$PATH:${bluez.test}/test";
+    export PATH="$PATH:${lib.getOutput "test" bluez}/test";
     nosetests -v
     runHook postCheck
   '';
diff --git a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
index 591927c152852..bd81efd520852 100644
--- a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
+++ b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
@@ -1,25 +1,19 @@
 --- a/mesonbuild/coredata.py
 +++ b/mesonbuild/coredata.py
-@@ -375,18 +375,13 @@
-         '''
-         if option.endswith('dir') and os.path.isabs(value) and \
+@@ -483,7 +483,6 @@ class CoreData:
+             return value
+         if option.endswith('dir') and value.is_absolute() and \
             option not in builtin_dir_noprefix_options:
 -            # Value must be a subdir of the prefix
              # commonpath will always return a path in the native format, so we
              # must use pathlib.PurePath to do the same conversion before
              # comparing.
--            if os.path.commonpath([value, prefix]) != str(PurePath(prefix)):
--                m = 'The value of the {!r} option is {!r} which must be a ' \
--                    'subdir of the prefix {!r}.\nNote that if you pass a ' \
--                    'relative path, it is assumed to be a subdir of prefix.'
--                raise MesonException(m.format(option, value, prefix))
--            # Convert path to be relative to prefix
--            skip = len(prefix) + 1
--            value = value[skip:]
-+            if os.path.commonpath([value, prefix]) == str(PurePath(prefix)):
-+                # Convert path to be relative to prefix
-+                skip = len(prefix) + 1
-+                value = value[skip:]
-         return value
- 
-     def init_builtins(self):
+@@ -495,7 +494,7 @@ class CoreData:
+             try:
+                 value = value.relative_to(prefix)
+             except ValueError:
+-                raise MesonException(msg.format(option, value, prefix))
++                pass
+             if '..' in str(value):
+                 raise MesonException(msg.format(option, value, prefix))
+         return value.as_posix()
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 3ac8e641eb651..15b0a5ffcd0d0 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -19,11 +19,11 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "meson";
-  version = "0.53.2";
+  version = "0.54.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "Po+DDzMYQ5fC6wtlHsUCrbY97LKJeL3ISzVY1xKEwh8=";
+    sha256 = "3eVybXeBEqy9Sme7NjOrLuddM9HoeaYoOntKRMM2PCc=";
   };
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/waf/default.nix b/pkgs/development/tools/build-managers/waf/default.nix
index f3e49e7bc8670..49aae7c30140f 100644
--- a/pkgs/development/tools/build-managers/waf/default.nix
+++ b/pkgs/development/tools/build-managers/waf/default.nix
@@ -8,13 +8,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "waf";
-  version = "2.0.19";
+  version = "2.0.20";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "${pname}-${version}";
-    sha256 = "1ydmx20blr776qnmnqp0whyiy81a3glln49m9fva2cmampmandpb";
+    sha256 = "1xbd1lmchq9pdrplkr2db28xqafyw753qbhnrfn8pxdg3inxxqvq";
   };
 
   buildInputs = [ python ensureNewerSourcesForZipFilesHook ];
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index 7fbb21ffb120a..84b2863130820 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -1,5 +1,14 @@
-{ stdenv, buildGoPackage, fetchFromGitHub
-, gpgme, libgpgerror, lvm2, btrfs-progs, pkg-config, libselinux, libseccomp
+{ stdenv
+, buildGoPackage
+, fetchFromGitHub
+, installShellFiles
+, pkg-config
+, gpgme
+, libgpgerror
+, lvm2
+, btrfs-progs
+, libselinux
+, libseccomp
 }:
 
 buildGoPackage rec {
@@ -7,9 +16,9 @@ buildGoPackage rec {
   version = "1.14.8";
 
   src = fetchFromGitHub {
-    owner  = "containers";
-    repo   = "buildah";
-    rev    = "v${version}";
+    owner = "containers";
+    repo = "buildah";
+    rev = "v${version}";
     sha256 = "187cvb3i5cwm7cwxmzpl2ca7900yb6v6b6cybyz5mnd5ccy5ff1q";
   };
 
@@ -18,7 +27,7 @@ buildGoPackage rec {
   goPackagePath = "github.com/containers/buildah";
   excludedPackages = [ "tests" ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ gpgme libgpgerror lvm2 btrfs-progs libselinux libseccomp ];
 
   patches = [ ./disable-go-module-mode.patch ];
@@ -27,7 +36,7 @@ buildGoPackage rec {
     pushd go/src/${goPackagePath}
     make GIT_COMMIT="unknown"
     install -Dm755 buildah $bin/bin/buildah
-    install -Dm444 contrib/completions/bash/buildah $bin/share/bash-completion/completions/buildah
+    installShellCompletion --bash contrib/completions/bash/buildah
   '';
 
   postBuild = ''
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index d7ad57d847c03..a8e5f17991611 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
 
-  name = "doxygen-1.8.17";
+  name = "doxygen-1.8.18";
 
   src = fetchurl {
     urls = [
       "mirror://sourceforge/doxygen/${name}.src.tar.gz" # faster, with https, etc.
       "http://doxygen.nl/files/${name}.src.tar.gz"
     ];
-    sha256 = "16dmv0gm1x8rvbm82fmjvi213q8fxqxinm75pcf595flya59ific";
+    sha256 = "0mh6s1ri1fs5yb27m0avnjsbcxpchgb9aaprq4bd3lj6vjg3s5qq";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/ocaml/dune/2.nix b/pkgs/development/tools/ocaml/dune/2.nix
index 510dd183f00d6..37f277686702c 100644
--- a/pkgs/development/tools/ocaml/dune/2.nix
+++ b/pkgs/development/tools/ocaml/dune/2.nix
@@ -6,11 +6,11 @@ else
 
 stdenv.mkDerivation rec {
   pname = "dune";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchurl {
     url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-    sha256 = "1nnpg0fvmp4vf5mk203xk83pkkm953pgip3yhs1x2g8pkcdndhcw";
+    sha256 = "0az5ih18wadsp3ljagvws1i7vf0vpg24h75ariy0v3i0gyld6xwg";
   };
 
   buildInputs = [ ocaml findlib ];
diff --git a/pkgs/development/tools/parsing/bison/default.nix b/pkgs/development/tools/parsing/bison/default.nix
index 0fbf6a49b2f53..c9758fe21e31f 100644
--- a/pkgs/development/tools/parsing/bison/default.nix
+++ b/pkgs/development/tools/parsing/bison/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bison";
-  version = "3.5.2";
+  version = "3.5.4";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1ylls1ba8y62q78vnzawy4ajpjkk5580crgi8krvfk8g13fvdnxl";
+    sha256 = "0a2cbrqh7mgx2dwf5qm10v68iakv1i0dqh9di4x5aqxsz96ibpf0";
   };
 
   nativeBuildInputs = [ m4 perl ] ++ stdenv.lib.optional stdenv.isSunOS help2man;
diff --git a/pkgs/development/tools/parsing/byacc/default.nix b/pkgs/development/tools/parsing/byacc/default.nix
index 9cef29e90bb0f..be526085b757c 100644
--- a/pkgs/development/tools/parsing/byacc/default.nix
+++ b/pkgs/development/tools/parsing/byacc/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "byacc";
-  version = "20191125";
+  version = "20200330";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/byacc/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/byacc/${pname}-${version}.tgz"
     ];
-    sha256 = "1phw8410ly3msv03dmjfi8xkmrl1lrrk928fp1489amg6sz2w707";
+    sha256 = "1c0zyn6v286i09jlc8gx6jyaa5438qyy985rqsd76kb8ibfy56g0";
   };
 
   configureFlags = [
diff --git a/pkgs/games/cataclysm-dda/default.nix b/pkgs/games/cataclysm-dda/default.nix
index ced19bffb31a0..ad1a9c409d572 100644
--- a/pkgs/games/cataclysm-dda/default.nix
+++ b/pkgs/games/cataclysm-dda/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, lua, CoreFoundation
+{ stdenv, callPackage, CoreFoundation
 , tiles ? true, Cocoa
 , debug ? false
 }:
@@ -9,28 +9,16 @@ let
 in
 
 stdenv.mkDerivation (common // rec {
-  version = "0.D";
+  version = "0.E";
   name = "cataclysm-dda-${version}";
 
   src = fetchFromCleverRaven {
     rev = version;
-    sha256 = "00zzhx1mh1qjq668cga5nbrxp2qk6b82j5ak65skhgnlr6ii4ysc";
+    sha256 = "0pbi0fw37zimzdklfj58s1ql0wlqq7dy6idkcsib3hn910ajaxan";
   };
 
-  buildInputs = common.buildInputs ++ [ lua ];
-
   patches = [ ./patches/fix_locale_dir.patch ];
 
-  postPatch = common.postPatch + ''
-    substituteInPlace lua/autoexec.lua --replace "/usr/share" "$out/share"
-  '';
-
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=deprecated-copy";
-
-  makeFlags = common.makeFlags ++ [
-    "LUA=1"
-  ];
-
   meta = with stdenv.lib.maintainers; common.meta // {
     maintainers = common.meta.maintainers ++ [ skeidel ];
   };
diff --git a/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch b/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch
index 60a3dc457453a..5bfff892d2af0 100644
--- a/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch
+++ b/pkgs/games/cataclysm-dda/patches/fix_locale_dir.patch
@@ -1,15 +1,13 @@
-diff --git a/src/translations.cpp b/src/translations.cpp
-index 2585b7ec56..7bb005823c 100644
 --- a/src/translations.cpp
 +++ b/src/translations.cpp
-@@ -195,14 +195,12 @@ void set_language()
+@@ -212,14 +212,12 @@ void set_language()
      auto env = getenv( "LANGUAGE" );
-     locale_dir = std::string( FILENAMES["base_path"] + "lang/mo/" + ( env ? env : "none" ) +
+     locale_dir = std::string( PATH_INFO::base_path() + "lang/mo/" + ( env ? env : "none" ) +
                                "/LC_MESSAGES/cataclysm-dda.mo" );
--#elif (defined __linux__ || (defined MACOSX && !defined TILES))
+-#elif (defined(__linux__) || (defined(MACOSX) && !defined(TILES)))
 +#else
-     if( !FILENAMES["base_path"].empty() ) {
-         locale_dir = FILENAMES["base_path"] + "share/locale";
+     if( !PATH_INFO::base_path().empty() ) {
+         locale_dir = PATH_INFO::base_path() + "share/locale";
      } else {
          locale_dir = "lang/mo";
      }
diff --git a/pkgs/misc/emulators/retroarch/default.nix b/pkgs/misc/emulators/retroarch/default.nix
index a91e2de859341..28a641ec97015 100644
--- a/pkgs/misc/emulators/retroarch/default.nix
+++ b/pkgs/misc/emulators/retroarch/default.nix
@@ -15,6 +15,8 @@
 , enableNvidiaCgToolkit ? false, nvidia_cg_toolkit ? null
 , withVulkan ? stdenv.isLinux, vulkan-loader ? null
 , fetchurl
+, wayland
+, libxkbcommon
 }:
 
 with stdenv.lib;
@@ -30,7 +32,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
   };
 
-  nativeBuildInputs = [ pkgconfig ]
+  nativeBuildInputs = [ pkgconfig wayland ]
                       ++ optional withVulkan makeWrapper;
 
   buildInputs = [ ffmpeg freetype libxml2 libGLU libGL python3 SDL2 which ]
@@ -38,7 +40,11 @@ stdenv.mkDerivation rec {
                 ++ optional withVulkan vulkan-loader
                 ++ optionals stdenv.isDarwin [ libobjc AppKit Foundation ]
                 ++ optionals stdenv.isLinux [ alsaLib libdrm libpulseaudio libv4l libX11
-                                              libXdmcp libXext libXxf86vm mesa udev ];
+                                              libXdmcp libXext libXxf86vm mesa udev
+                                              wayland libxkbcommon ];
+
+  # we use prefix-less pkg-config
+  PKG_CONF_PATH = "pkg-config";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/misc/emulators/wine/default.nix b/pkgs/misc/emulators/wine/default.nix
index 727eb2700671e..368e2845ca406 100644
--- a/pkgs/misc/emulators/wine/default.nix
+++ b/pkgs/misc/emulators/wine/default.nix
@@ -9,7 +9,6 @@
 { lib, stdenv, callPackage,
   wineRelease ? "stable",
   wineBuild ? if stdenv.hostPlatform.system == "x86_64-linux" then "wineWow" else "wine32",
-  libtxc_dxtn_Name ? "libtxc_dxtn_s2tc",
   pngSupport ? false,
   jpegSupport ? false,
   tiffSupport ? false,
@@ -63,7 +62,6 @@ let wine-build = build: release:
 
 in if wineRelease == "staging" then
   callPackage ./staging.nix {
-    inherit libtxc_dxtn_Name;
     wineUnstable = wine-build wineBuild "unstable";
   }
 else
diff --git a/pkgs/misc/emulators/wine/staging.nix b/pkgs/misc/emulators/wine/staging.nix
index df979c68a47fe..5c2469f8f44e0 100644
--- a/pkgs/misc/emulators/wine/staging.nix
+++ b/pkgs/misc/emulators/wine/staging.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, wineUnstable, libtxc_dxtn_Name }:
+{ stdenv, callPackage, wineUnstable }:
 
 with callPackage ./util.nix {};
 
@@ -8,7 +8,7 @@ let patch = (callPackage ./sources.nix {}).staging;
 in assert stdenv.lib.getVersion wineUnstable == patch.version;
 
 stdenv.lib.overrideDerivation wineUnstable (self: {
-  buildInputs = build-inputs [ "perl" "utillinux" "autoconf" libtxc_dxtn_Name ] self.buildInputs;
+  buildInputs = build-inputs [ "perl" "utillinux" "autoconf" ] self.buildInputs;
 
   name = "${self.name}-staging";
 
diff --git a/pkgs/os-specific/linux/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-plugins/default.nix
index b524d7906da42..a69d86c5c4d6c 100644
--- a/pkgs/os-specific/linux/alsa-plugins/default.nix
+++ b/pkgs/os-specific/linux/alsa-plugins/default.nix
@@ -9,9 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0z9k3ssbfk2ky2w13avgyf202j1drsz9sv3834bp33cj1i2hc3qw";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
+
   # ToDo: a52, etc.?
   buildInputs =
-    [ pkgconfig alsaLib libogg ]
+    [ alsaLib libogg ]
     ++ lib.optional (libpulseaudio != null) libpulseaudio
     ++ lib.optional (libjack2 != null) libjack2;
 
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 78d88d941e87b..401ab39bca369 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -11,9 +11,13 @@
 , readline
 , systemd
 , udev
-}:
-
-stdenv.mkDerivation rec {
+}: let
+  pythonPath = with python3.pkgs; [
+    dbus-python
+    pygobject3
+    recursivePthLoader
+  ];
+in stdenv.mkDerivation rec {
   pname = "bluez";
   version = "5.54";
 
@@ -22,12 +26,6 @@ stdenv.mkDerivation rec {
     sha256 = "1p2ncvjz6alr9n3l5wvq2arqgc7xjs6dqyar1l9jp0z8cfgapkb8";
   };
 
-  pythonPath = with python3.pkgs; [
-    dbus-python
-    pygobject3
-    recursivePthLoader
-  ];
-
   buildInputs = [
     alsaLib
     dbus
@@ -44,7 +42,7 @@ stdenv.mkDerivation rec {
     python3.pkgs.wrapPython
   ];
 
-  outputs = [ "out" "dev" "test" ];
+  outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
 
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
@@ -79,7 +77,7 @@ stdenv.mkDerivation rec {
 
   doCheck = stdenv.hostPlatform.isx86_64;
 
-  postInstall = ''
+  postInstall = lib.optionalString doCheck ''
     mkdir -p $test/{bin,test}
     cp -a test $test
     pushd $test/test
@@ -94,8 +92,8 @@ stdenv.mkDerivation rec {
       ln -s ../test/$a $test/bin/bluez-$a
     done
     popd
-    wrapPythonProgramsIn $test/test "$test/test $pythonPath"
-
+    wrapPythonProgramsIn $test/test "$test/test ${toString pythonPath}"
+  '' + ''
     # for bluez4 compatibility for NixOS
     mkdir $out/sbin
     ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 5fcf362bc8b08..46312a637dab3 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,29 +1,27 @@
-{ fetchurl, stdenv, flex, bash, bison, db, iptables, pkgconfig, libelf, libmnl }:
+{ stdenv, fetchurl
+, buildPackages, bison, flex, pkg-config
+, db, iptables, libelf, libmnl
+}:
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.5.0";
+  version = "5.6.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0ywg70f98wgfai35jl47xzpjp45a6n7crja4vc8ql85cbi1l7ids";
+    sha256 = "14j6n1bc09xhq8lxs40vfsx8bb8lx12a07ga4rsxl8vfrqjhwnqv";
   };
 
   preConfigure = ''
-    patchShebangs ./configure
+    # Don't try to create /var/lib/arpd:
     sed -e '/ARPDDIR/d' -i Makefile
-    # Don't build netem tools--they're not installed and require HOSTCC
-    substituteInPlace Makefile --replace " netem " " "
   '';
 
   outputs = [ "out" "dev" ];
 
   makeFlags = [
-    "DESTDIR="
-    "LIBDIR=$(out)/lib"
+    "PREFIX=$(out)"
     "SBINDIR=$(out)/sbin"
-    "MANDIR=$(out)/share/man"
-    "BASH_COMPDIR=$(out)/share/bash-completion/completions"
     "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
     "HDRDIR=$(dev)/include/iproute2"
   ];
@@ -36,15 +34,12 @@ stdenv.mkDerivation rec {
     "CONFDIR=$(out)/etc/iproute2"
   ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
+  nativeBuildInputs = [ bison flex pkg-config ];
   buildInputs = [ db iptables libelf libmnl ];
-  nativeBuildInputs = [ bison flex pkgconfig ];
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    PATH=${bash}/bin:$PATH patchShebangs $out/sbin
-  '';
-
   meta = with stdenv.lib; {
     homepage = "https://wiki.linuxfoundation.org/networking/iproute2";
     description = "A collection of utilities for controlling TCP/IP networking and traffic control in Linux";
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 34e142e90db27..0a58ed87e6cee 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -122,6 +122,7 @@ let
       XDP_SOCKETS        = whenAtLeast "4.19" yes;
       XDP_SOCKETS_DIAG   = whenAtLeast "4.19" yes;
       WAN                = yes;
+      TCP_CONG_CUBIC     = yes; # This is the default congestion control algorithm since 2.6.19
       # Required by systemd per-cgroup firewalling
       CGROUP_BPF                  = option yes;
       CGROUP_NET_PRIO             = yes; # Required by systemd
@@ -177,6 +178,10 @@ let
       NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
                                               (whenAtLeast "5.3" module) ];
 
+      # needed for `dropwatch`
+      # Builtin-only since https://github.com/torvalds/linux/commit/f4b6bcc7002f0e3a3428bac33cf1945abff95450
+      NET_DROP_MONITOR = yes;
+
       # needed for ss
       INET_DIAG         = yes;
       INET_TCP_DIAG     = module;
diff --git a/pkgs/os-specific/linux/kernel/hardened-patches.json b/pkgs/os-specific/linux/kernel/hardened-patches.json
index 24c44dd1ed1f3..97fbbb405e3e9 100644
--- a/pkgs/os-specific/linux/kernel/hardened-patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened-patches.json
@@ -5,23 +5,23 @@
         "version_suffix": "a"
     },
     "4.19.116": {
-        "sha256": "1f54g0xw708kxha07nsb979h5vwxjrkbwa5h04zny2kq702x1h13",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.115.a/linux-hardened-4.19.115.a.patch",
-        "version_suffix": "NixOS-a"
+        "sha256": "00y4i905gzs9w9kckrn1frh2vw32fsndz03g2psl1gk17snc3q7c",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.116.a/linux-hardened-4.19.116.a.patch",
+        "version_suffix": "a"
     },
     "5.4.33": {
-        "sha256": "154iz7i9l0hihjrmfk6rjh7hhqwyhsdjr2c74m3dhadrlm5hwy89",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.32.a/linux-hardened-5.4.32.a.patch",
-        "version_suffix": "NixOS-a"
+        "sha256": "1hjfvhyvz5kyvx25809brhsvfv9mjv9q1mw6ydb71gfwhw6q8d8b",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.33.a/linux-hardened-5.4.33.a.patch",
+        "version_suffix": "a"
     },
-    "5.5.17": {
-        "sha256": "1lms090kkk4vlvfssqsm7r3j88hlf8smrnpcgq24v9rq9pbr0fyw",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.5.17.a/linux-hardened-5.5.17.a.patch",
+    "5.5.18": {
+        "sha256": "0v7vla784sf1fk6d8qa5x8hkyhjb1jkw4lxxcgvvlqbmxl8md8ld",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.5.18.a/linux-hardened-5.5.18.a.patch",
         "version_suffix": "a"
     },
-    "5.6.4": {
-        "sha256": "05wkzh7927n71x4cl69mclc44grqpnx6i65hli470q1rg1qrk26n",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.4.a/linux-hardened-5.6.4.a.patch",
+    "5.6.5": {
+        "sha256": "19cdpygm5zx3szxl456lfjg5sffqcmn18470wv7prm8rf6liqdj3",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.6.5.a/linux-hardened-5.6.5.a.patch",
         "version_suffix": "a"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-5.5.nix b/pkgs/os-specific/linux/kernel/linux-5.5.nix
index c4fbe1aea5e91..ecb92b5bfe7d3 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.5.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5.17";
+  version = "5.5.18";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "06aqhlysa7zdj6c69hyii3hfqlfa9751ivga38rbqw1lr2gbbnj0";
+    sha256 = "01iiiq4dsyyc5y6b52wax9as6dzhdi172vd1423sc1yp4rrk8178";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.6.nix b/pkgs/os-specific/linux/kernel/linux-5.6.nix
index 950c60ac26816..d3334293dc199 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.6.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.6.4";
+  version = "5.6.5";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "14cxbc9xi4s3xwx4yb1yd4z0kidsk3d443skf5sgmdhcalg79wax";
+    sha256 = "1rjjkcmzsj9azggh960qnk2x44ns475b8nbd4nxazrz1rgdx76zp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/plymouth/default.nix b/pkgs/os-specific/linux/plymouth/default.nix
index b4c4909cac509..7a6c227f401f7 100644
--- a/pkgs/os-specific/linux/plymouth/default.nix
+++ b/pkgs/os-specific/linux/plymouth/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libxslt, docbook_xsl
-, gtk3, udev, systemd
+, gtk3, udev, systemd, lib
 }:
 
 stdenv.mkDerivation rec {
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
     "--enable-pango"
     "--enable-gdm-transition"
     "--enable-gtk"
+    "ac_cv_path_SYSTEMD_ASK_PASSWORD_AGENT=${lib.getBin systemd}/bin/systemd-tty-ask-password-agent"
   ];
 
   configurePlatforms = [ "host" ];
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
new file mode 100644
index 0000000000000..5418a6d9d914a
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -0,0 +1,32 @@
+From a6c9317a905ef478b8e0d3dad263990feb5d11cb Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Tue, 8 Jan 2013 15:46:30 +0100
+Subject: [PATCH 01/27] Start device units for uninitialised encrypted devices
+
+This is necessary because the NixOS service that initialises the
+filesystem depends on the appearance of the device unit.  Also, this
+makes more sense to me: the device is ready; it's the filesystem
+that's not, but taking care of that is the responsibility of the mount
+unit.  (However, this ignores the fsck unit, so it's not perfect...)
+---
+ rules.d/99-systemd.rules.in | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
+index c34b606216..3ab8c1c3fe 100644
+--- a/rules.d/99-systemd.rules.in
++++ b/rules.d/99-systemd.rules.in
+@@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
+ SUBSYSTEM=="block", TAG+="systemd"
+ SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
+ 
+-# Ignore encrypted devices with no identified superblock on it, since
+-# we are probably still calling mke2fs or mkswap on it.
+-SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
+-
+ # add symlink to GPT root disk
+ SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
+ SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0003-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0003-Don-t-try-to-unmount-nix-or-nix-store.patch
new file mode 100644
index 0000000000000..75110faf92382
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0003-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -0,0 +1,42 @@
+From fd9c882581877eef8ba1b34a9502a1ff546b3833 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Fri, 12 Apr 2013 13:16:57 +0200
+Subject: [PATCH 03/27] Don't try to unmount /nix or /nix/store
+
+They'll still be remounted read-only.
+
+https://github.com/NixOS/nixos/issues/126
+---
+ src/core/mount.c      | 4 +++-
+ src/shutdown/umount.c | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/mount.c b/src/core/mount.c
+index a0dfa6a1a7..4ca6adcdc6 100644
+--- a/src/core/mount.c
++++ b/src/core/mount.c
+@@ -414,6 +414,8 @@ static bool mount_is_extrinsic(Mount *m) {
+ 
+         if (PATH_IN_SET(m->where,  /* Don't bother with the OS data itself */
+                         "/",       /* (strictly speaking redundant: should already be covered by the perpetual flag check above) */
++                        "/nix",
++                        "/nix/store",
+                         "/usr",
+                         "/etc"))
+                 return true;
+diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
+index 2d07d3d6c1..8b112f464e 100644
+--- a/src/shutdown/umount.c
++++ b/src/shutdown/umount.c
+@@ -373,6 +373,8 @@ static int delete_dm(dev_t devnum) {
+ 
+ static bool nonunmountable_path(const char *path) {
+         return path_equal(path, "/")
++                || path_equal(path, "/nix")
++                || path_equal(path, "/nix/store")
+ #if ! HAVE_SPLIT_USR
+                 || path_equal(path, "/usr")
+ #endif
+-- 
+2.25.1
+
diff --git a/pkgs/os-specific/linux/systemd/0004-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0004-Fix-NixOS-containers.patch
new file mode 100644
index 0000000000000..ffb139b71e148
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0004-Fix-NixOS-containers.patch
@@ -0,0 +1,34 @@
+From 58c4a7b4e9d9c34b92deded6aea814738821059d Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Wed, 16 Apr 2014 10:59:28 +0200
+Subject: [PATCH 04/27] Fix NixOS containers
+
+In NixOS containers, the init script is bind-mounted into the
+container, so checking early whether it exists will fail.
+---
+ src/nspawn/nspawn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
+index 5d9290b1cf..26615901c3 100644
+--- a/src/nspawn/nspawn.c
++++ b/src/nspawn/nspawn.c
+@@ -4924,6 +4924,7 @@ static int run(int argc, char *argv[]) {
+                                 goto finish;
+                         }
+                 } else {
++#if 0
+                         const char *p, *q;
+ 
+                         if (arg_pivot_root_new)
+@@ -4938,6 +4939,7 @@ static int run(int argc, char *argv[]) {
+                                 r = -EINVAL;
+                                 goto finish;
+                         }
++#endif
+                 }
+ 
+         } else {
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0006-Look-for-fsck-in-the-right-place.patch b/pkgs/os-specific/linux/systemd/0006-Look-for-fsck-in-the-right-place.patch
new file mode 100644
index 0000000000000..5972b646867be
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0006-Look-for-fsck-in-the-right-place.patch
@@ -0,0 +1,25 @@
+From c841ffab8fb6174b51382b9d4334f78c74018730 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Thu, 1 May 2014 14:10:10 +0200
+Subject: [PATCH 06/27] Look for fsck in the right place
+
+---
+ src/fsck/fsck.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
+index 55e6544d31..3626aadda7 100644
+--- a/src/fsck/fsck.c
++++ b/src/fsck/fsck.c
+@@ -371,7 +371,7 @@ static int run(int argc, char *argv[]) {
+                 } else
+                         dash_c[0] = 0;
+ 
+-                cmdline[i++] = "/sbin/fsck";
++                cmdline[i++] = "/run/current-system/sw/bin/fsck";
+                 cmdline[i++] =  arg_repair;
+                 cmdline[i++] = "-T";
+ 
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0007-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0007-Add-some-NixOS-specific-unit-directories.patch
new file mode 100644
index 0000000000000..7d537197fae7d
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0007-Add-some-NixOS-specific-unit-directories.patch
@@ -0,0 +1,107 @@
+From 8c0be07ccbad35d0c1106015057996aa55b9a1f9 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Fri, 19 Dec 2014 14:46:17 +0100
+Subject: [PATCH 07/27] Add some NixOS-specific unit directories
+
+Look in /nix/var/nix/profiles/default/lib/systemd for units provided
+by packages in the default (system-wide) profile, and in
+/etc/systemd-mutable/system for persistent, mutable units (not
+recommended).
+
+Also, remove /usr and /lib as these don't exist on NixOS.
+---
+ src/core/systemd.pc.in   |  4 ++--
+ src/shared/path-lookup.c | 18 +++++-------------
+ 2 files changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
+index 5d1ddd7620..21b977d6fc 100644
+--- a/src/core/systemd.pc.in
++++ b/src/core/systemd.pc.in
+@@ -17,8 +17,8 @@ systemduserunitdir=${prefix}/lib/systemd/user
+ systemduserpresetdir=${prefix}/lib/systemd/user-preset
+ systemdsystemconfdir=${sysconfdir}/systemd/system
+ systemduserconfdir=${sysconfdir}/systemd/user
+-systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemdsystemunitdir}:/usr/lib/systemd/system:/lib/systemd/system
+-systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemduserunitdir}:/usr/lib/systemd/user:/usr/share/systemd/user
++systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/system:${systemdsystemunitdir}
++systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/user:${systemduserunitdir}
+ systemdsystemgeneratordir=${rootprefix}/lib/systemd/system-generators
+ systemdusergeneratordir=${prefix}/lib/systemd/user-generators
+ systemdsleepdir=${rootprefix}/lib/systemd/system-sleep
+diff --git a/src/shared/path-lookup.c b/src/shared/path-lookup.c
+index 6bf0ff0316..2b6324ad8c 100644
+--- a/src/shared/path-lookup.c
++++ b/src/shared/path-lookup.c
+@@ -99,17 +99,14 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
+ }
+ 
+ static const char* const user_data_unit_paths[] = {
+-        "/usr/local/lib/systemd/user",
+-        "/usr/local/share/systemd/user",
+         USER_DATA_UNIT_PATH,
+-        "/usr/lib/systemd/user",
+-        "/usr/share/systemd/user",
+         NULL
+ };
+ 
+ static const char* const user_config_unit_paths[] = {
+         USER_CONFIG_UNIT_PATH,
+         "/etc/systemd/user",
++        "/etc/systemd-mutable/user",
+         NULL
+ };
+ 
+@@ -604,15 +601,14 @@ int lookup_paths_init(
+                                         persistent_config,
+                                         SYSTEM_CONFIG_UNIT_PATH,
+                                         "/etc/systemd/system",
++                                        "/etc/systemd-mutable/system",
++                                        "/nix/var/nix/profiles/default/lib/systemd/system",
+                                         STRV_IFNOTNULL(persistent_attached),
+                                         runtime_config,
+                                         "/run/systemd/system",
+                                         STRV_IFNOTNULL(runtime_attached),
+                                         STRV_IFNOTNULL(generator),
+-                                        "/usr/local/lib/systemd/system",
+                                         SYSTEM_DATA_UNIT_PATH,
+-                                        "/usr/lib/systemd/system",
+-                                        STRV_IFNOTNULL(flags & LOOKUP_PATHS_SPLIT_USR ? "/lib/systemd/system" : NULL),
+                                         STRV_IFNOTNULL(generator_late));
+                         break;
+ 
+@@ -628,14 +624,12 @@ int lookup_paths_init(
+                                         persistent_config,
+                                         USER_CONFIG_UNIT_PATH,
+                                         "/etc/systemd/user",
++                                        "/etc/systemd-mutable/user",
++                                        "/nix/var/nix/profiles/default/lib/systemd/user",
+                                         runtime_config,
+                                         "/run/systemd/user",
+                                         STRV_IFNOTNULL(generator),
+-                                        "/usr/local/share/systemd/user",
+-                                        "/usr/share/systemd/user",
+-                                        "/usr/local/lib/systemd/user",
+                                         USER_DATA_UNIT_PATH,
+-                                        "/usr/lib/systemd/user",
+                                         STRV_IFNOTNULL(generator_late));
+                         break;
+ 
+@@ -824,14 +818,12 @@ char **generator_binary_paths(UnitFileScope scope) {
+         case UNIT_FILE_SYSTEM:
+                 return strv_new("/run/systemd/system-generators",
+                                 "/etc/systemd/system-generators",
+-                                "/usr/local/lib/systemd/system-generators",
+                                 SYSTEM_GENERATOR_PATH);
+ 
+         case UNIT_FILE_GLOBAL:
+         case UNIT_FILE_USER:
+                 return strv_new("/run/systemd/user-generators",
+                                 "/etc/systemd/user-generators",
+-                                "/usr/local/lib/systemd/user-generators",
+                                 USER_GENERATOR_PATH);
+ 
+         default:
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0009-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0009-Get-rid-of-a-useless-message-in-user-sessions.patch
new file mode 100644
index 0000000000000..c15b8a2a9e19d
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0009-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -0,0 +1,31 @@
+From 99c86daa5244d45a19f75f6ce92bd4255edef420 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Mon, 11 May 2015 15:39:38 +0200
+Subject: [PATCH 09/27] Get rid of a useless message in user sessions
+
+Namely lots of variants of
+
+  Unit nix-var-nix-db.mount is bound to inactive unit dev-disk-by\x2dlabel-nixos.device. Stopping, too.
+
+in containers.
+---
+ src/core/unit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/unit.c b/src/core/unit.c
+index a1dc76aa6a..07670af8e2 100644
+--- a/src/core/unit.c
++++ b/src/core/unit.c
+@@ -2045,7 +2045,8 @@ static void unit_check_binds_to(Unit *u) {
+         }
+ 
+         assert(other);
+-        log_unit_info(u, "Unit is bound to inactive unit %s. Stopping, too.", other->id);
++        if (u->type != UNIT_MOUNT || detect_container() <= 0)
++                log_unit_info(u, "Unit is bound to inactive unit %s. Stopping, too.", other->id);
+ 
+         /* A unit we need to run is gone. Sniff. Let's stop this. */
+         r = manager_add_job(u->manager, JOB_STOP, u, JOB_FAIL, NULL, &error, NULL);
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0010-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0010-hostnamed-localed-timedated-disable-methods-that-cha.patch
new file mode 100644
index 0000000000000..635da4634a8f0
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0010-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -0,0 +1,118 @@
+From cec1430f72edfedb951fe34e87765ef422ea9843 Mon Sep 17 00:00:00 2001
+From: Gabriel Ebner <gebner@gebner.org>
+Date: Sun, 6 Dec 2015 14:26:36 +0100
+Subject: [PATCH 10/27] hostnamed, localed, timedated: disable methods that
+ change system settings.
+
+---
+ src/hostname/hostnamed.c |  9 +++++++++
+ src/locale/localed.c     |  9 +++++++++
+ src/timedate/timedated.c | 10 ++++++++++
+ 3 files changed, 28 insertions(+)
+
+diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
+index 9e4f4fb59e..141b8acc08 100644
+--- a/src/hostname/hostnamed.c
++++ b/src/hostname/hostnamed.c
+@@ -423,6 +423,9 @@ static int method_set_hostname(sd_bus_message *m, void *userdata, sd_bus_error *
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         if (isempty(name))
+                 name = c->data[PROP_STATIC_HOSTNAME];
+ 
+@@ -479,6 +482,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         name = empty_to_null(name);
+ 
+         if (streq_ptr(name, c->data[PROP_STATIC_HOSTNAME]))
+@@ -536,6 +542,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         name = empty_to_null(name);
+ 
+         if (streq_ptr(name, c->data[prop]))
+diff --git a/src/locale/localed.c b/src/locale/localed.c
+index 8d0eec96a5..0b1c1d664e 100644
+--- a/src/locale/localed.c
++++ b/src/locale/localed.c
+@@ -276,6 +276,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         /* If single locale without variable name is provided, then we assume it is LANG=. */
+         if (strv_length(l) == 1 && !strchr(*l, '=')) {
+                 if (!locale_is_valid(*l))
+@@ -411,6 +414,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         keymap = empty_to_null(keymap);
+         keymap_toggle = empty_to_null(keymap_toggle);
+ 
+@@ -587,6 +593,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         layout = empty_to_null(layout);
+         model = empty_to_null(model);
+         variant = empty_to_null(variant);
+diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
+index 6c94b23de4..fa20d22cde 100644
+--- a/src/timedate/timedated.c
++++ b/src/timedate/timedated.c
+@@ -653,6 +653,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+         if (r < 0)
+                 return r;
+ 
++        if (getenv("NIXOS_STATIC_TIMEZONE"))
++                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++                    "Changing timezone via systemd is not supported when it is set in NixOS configuration.");
++
+         if (!timezone_is_valid(z, LOG_DEBUG))
+                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
+ 
+@@ -732,6 +736,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         if (lrtc == c->local_rtc)
+                 return sd_bus_reply_method_return(m, NULL);
+ 
+@@ -924,6 +931,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+         if (r < 0)
+                 return r;
+ 
++        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
++            "Changing system settings via systemd is not supported on NixOS.");
++
+         r = context_update_ntp_status(c, bus, m);
+         if (r < 0)
+                 return r;
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0011-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0011-Fix-hwdb-paths.patch
new file mode 100644
index 0000000000000..624811f5ea322
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0011-Fix-hwdb-paths.patch
@@ -0,0 +1,32 @@
+From 0f434c6baee63eff913f36aee839df3718a75d4a Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 7 Jul 2016 02:47:13 +0300
+Subject: [PATCH 11/27] Fix hwdb paths
+
+Patch by vcunat.
+---
+ src/libsystemd/sd-hwdb/sd-hwdb.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/src/libsystemd/sd-hwdb/sd-hwdb.c b/src/libsystemd/sd-hwdb/sd-hwdb.c
+index 58124abd21..d80e408b8c 100644
+--- a/src/libsystemd/sd-hwdb/sd-hwdb.c
++++ b/src/libsystemd/sd-hwdb/sd-hwdb.c
+@@ -298,13 +298,8 @@ static int trie_search_f(sd_hwdb *hwdb, const char *search) {
+ }
+ 
+ static const char hwdb_bin_paths[] =
+-        "/etc/systemd/hwdb/hwdb.bin\0"
+         "/etc/udev/hwdb.bin\0"
+-        "/usr/lib/systemd/hwdb/hwdb.bin\0"
+-#if HAVE_SPLIT_USR
+-        "/lib/systemd/hwdb/hwdb.bin\0"
+-#endif
+-        UDEVLIBEXECDIR "/hwdb.bin\0";
++        ;
+ 
+ _public_ int sd_hwdb_new(sd_hwdb **ret) {
+         _cleanup_(sd_hwdb_unrefp) sd_hwdb *hwdb = NULL;
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0012-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0012-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
new file mode 100644
index 0000000000000..ad76fda7d95af
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0012-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -0,0 +1,132 @@
+From 78479b75c9f9342646223b3db6b4b0744817dc24 Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Tue, 11 Oct 2016 13:12:08 +0300
+Subject: [PATCH] Change /usr/share/zoneinfo to /etc/zoneinfo
+
+NixOS uses this path.
+---
+ man/localtime.xml         | 4 ++--
+ src/basic/time-util.c     | 6 +++---
+ src/firstboot/firstboot.c | 2 +-
+ src/nspawn/nspawn.c       | 4 ++--
+ src/timedate/timedated.c  | 8 ++++----
+ 5 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/man/localtime.xml b/man/localtime.xml
+index 0f1652ee2e..71c4f95c2e 100644
+--- a/man/localtime.xml
++++ b/man/localtime.xml
+@@ -20,7 +20,7 @@
+   </refnamediv>
+ 
+   <refsynopsisdiv>
+-    <para><filename>/etc/localtime</filename> -&gt; <filename>../usr/share/zoneinfo/…</filename></para>
++    <para><filename>/etc/localtime</filename> -&gt; <filename>zoneinfo/…</filename></para>
+   </refsynopsisdiv>
+ 
+   <refsect1>
+@@ -30,7 +30,7 @@
+     system-wide timezone of the local system that is used by
+     applications for presentation to the user. It should be an
+     absolute or relative symbolic link pointing to
+-    <filename>/usr/share/zoneinfo/</filename>, followed by a timezone
++    <filename>/etc/zoneinfo/</filename>, followed by a timezone
+     identifier such as <literal>Europe/Berlin</literal> or
+     <literal>Etc/UTC</literal>. The resulting link should lead to the
+     corresponding binary
+diff --git a/src/basic/time-util.c b/src/basic/time-util.c
+index 105584e2e7..5238f69931 100644
+--- a/src/basic/time-util.c
++++ b/src/basic/time-util.c
+@@ -1217,7 +1217,7 @@ int get_timezones(char ***ret) {
+         n_allocated = 2;
+         n_zones = 1;
+ 
+-        f = fopen("/usr/share/zoneinfo/zone1970.tab", "re");
++        f = fopen("/etc/zoneinfo/zone1970.tab", "re");
+         if (f) {
+                 for (;;) {
+                         _cleanup_free_ char *line = NULL;
+@@ -1312,7 +1312,7 @@ bool timezone_is_valid(const char *name, int log_level) {
+         if (p - name >= PATH_MAX)
+                 return false;
+ 
+-        t = strjoina("/usr/share/zoneinfo/", name);
++        t = strjoina("/etc/zoneinfo/", name);
+ 
+         fd = open(t, O_RDONLY|O_CLOEXEC);
+         if (fd < 0) {
+@@ -1410,7 +1410,7 @@ int get_timezone(char **ret) {
+         if (r < 0)
+                 return r; /* returns EINVAL if not a symlink */
+ 
+-        e = PATH_STARTSWITH_SET(t, "/usr/share/zoneinfo/", "../usr/share/zoneinfo/");
++        e = PATH_STARTSWITH_SET(t, "/etc/zoneinfo/", "../etc/zoneinfo/");
+         if (!e)
+                 return -EINVAL;
+ 
+diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
+index 528e6452cf..c712ca9072 100644
+--- a/src/firstboot/firstboot.c
++++ b/src/firstboot/firstboot.c
+@@ -443,7 +443,7 @@ static int process_timezone(void) {
+         if (isempty(arg_timezone))
+                 return 0;
+ 
+-        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
++        e = strjoina("zoneinfo/", arg_timezone);
+ 
+         (void) mkdir_parents(etc_localtime, 0755);
+         if (symlink(e, etc_localtime) < 0)
+diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
+index 873a76596f..a024b10f32 100644
+--- a/src/nspawn/nspawn.c
++++ b/src/nspawn/nspawn.c
+@@ -1642,8 +1642,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
+ static const char *timezone_from_path(const char *path) {
+         return PATH_STARTSWITH_SET(
+                         path,
+-                        "../usr/share/zoneinfo/",
+-                        "/usr/share/zoneinfo/");
++                        "../etc/zoneinfo/",
++                        "/etc/zoneinfo/");
+ }
+ 
+ static bool etc_writable(void) {
+diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
+index 5e2fb50d83..02eb2ca11d 100644
+--- a/src/timedate/timedated.c
++++ b/src/timedate/timedated.c
+@@ -264,7 +264,7 @@ static int context_read_data(Context *c) {
+ 
+         r = get_timezone(&t);
+         if (r == -EINVAL)
+-                log_warning_errno(r, "/etc/localtime should be a symbolic link to a time zone data file in /usr/share/zoneinfo/.");
++                log_warning_errno(r, "/etc/localtime should be a symbolic link to a time zone data file in /etc/zoneinfo/.");
+         else if (r < 0)
+                 log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
+ 
+@@ -288,7 +288,7 @@ static int context_write_data_timezone(Context *c) {
+ 
+         if (isempty(c->zone) || streq(c->zone, "UTC")) {
+ 
+-                if (access("/usr/share/zoneinfo/UTC", F_OK) < 0) {
++                if (access("/etc/zoneinfo/UTC", F_OK) < 0) {
+ 
+                         if (unlink("/etc/localtime") < 0 && errno != ENOENT)
+                                 return -errno;
+@@ -296,9 +296,9 @@ static int context_write_data_timezone(Context *c) {
+                         return 0;
+                 }
+ 
+-                source = "../usr/share/zoneinfo/UTC";
++                source = "../etc/zoneinfo/UTC";
+         } else {
+-                p = path_join("../usr/share/zoneinfo", c->zone);
++                p = path_join("../etc/zoneinfo", c->zone);
+                 if (!p)
+                         return -ENOMEM;
+ 
+-- 
+2.25.1
+
diff --git a/pkgs/os-specific/linux/systemd/0013-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0013-localectl-use-etc-X11-xkb-for-list-x11.patch
new file mode 100644
index 0000000000000..309ae70881aec
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0013-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -0,0 +1,27 @@
+From 5365ffbfba2de03628e8bbb6cc0bc022272436a1 Mon Sep 17 00:00:00 2001
+From: Imuli <i@imu.li>
+Date: Wed, 19 Oct 2016 08:46:47 -0400
+Subject: [PATCH 13/27] localectl: use /etc/X11/xkb for list-x11-*
+
+NixOS has an option to link the xkb data files to /etc/X11, but not to
+/usr/share/X11.
+---
+ src/locale/localectl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/locale/localectl.c b/src/locale/localectl.c
+index 9fb5152110..9554c2cf76 100644
+--- a/src/locale/localectl.c
++++ b/src/locale/localectl.c
+@@ -287,7 +287,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+         } state = NONE, look_for;
+         int r;
+ 
+-        f = fopen("/usr/share/X11/xkb/rules/base.lst", "re");
++        f = fopen("/etc/X11/xkb/rules/base.lst", "re");
+         if (!f)
+                 return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
+ 
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0016-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0016-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
new file mode 100644
index 0000000000000..ed1187473be04
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0016-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -0,0 +1,26 @@
+From 1408762890aba25e58598d1e4dfa17ed2b75de26 Mon Sep 17 00:00:00 2001
+From: Franz Pletz <fpletz@fnordicwalking.de>
+Date: Sun, 11 Feb 2018 04:37:44 +0100
+Subject: [PATCH 16/27] build: don't create statedir and don't touch prefixdir
+
+---
+ meson.build | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 8ccc947e37..263cc7189a 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2944,9 +2944,6 @@ install_data('LICENSE.GPL2',
+              'src/libsystemd/sd-bus/GVARIANT-SERIALIZATION',
+              install_dir : docdir)
+ 
+-meson.add_install_script('sh', '-c', mkdir_p.format(systemdstatedir))
+-meson.add_install_script('sh', '-c', 'touch $DESTDIR@0@'.format(prefixdir))
+-
+ ############################################################
+ 
+ meson_check_help = find_program('tools/meson-check-help.sh')
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0018-Install-default-configuration-into-out-share-factory.patch b/pkgs/os-specific/linux/systemd/0018-Install-default-configuration-into-out-share-factory.patch
new file mode 100644
index 0000000000000..3911d1b0181ad
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0018-Install-default-configuration-into-out-share-factory.patch
@@ -0,0 +1,317 @@
+From a087cb535b2d3c7a5d989b5aabc0a257369e9f9d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Mon, 26 Feb 2018 14:25:57 +0000
+Subject: [PATCH 18/27] Install default configuration into $out/share/factory
+
+By default systemd should read all its configuration from /etc. Therefor
+we rely on -Dsysconfdir=/etc in meson as default value. Unfortunately
+this would also lead to installation of systemd's own configuration
+files to `/etc` whereas we are limited to /nix/store. To counter that
+this commit introduces two new configuration variables `factoryconfdir`
+and `factorypkgconfdir` to install systemd's own configuration into nix
+store again, while having executables looking up files in /etc.
+---
+ hwdb.d/meson.build               |  2 +-
+ meson.build                    | 11 +++++++----
+ network/meson.build            |  2 +-
+ src/core/meson.build           | 10 +++++-----
+ src/coredump/meson.build       |  2 +-
+ src/journal-remote/meson.build |  4 ++--
+ src/journal/meson.build        |  2 +-
+ src/kernel-install/meson.build |  2 +-
+ src/login/meson.build          |  2 +-
+ src/network/meson.build        |  2 +-
+ src/pstore/meson.build         |  2 +-
+ src/resolve/meson.build        |  2 +-
+ src/timesync/meson.build       |  2 +-
+ src/udev/meson.build           |  4 ++--
+ sysctl.d/meson.build           |  2 +-
+ tmpfiles.d/meson.build         |  2 +-
+ units/meson.build              |  3 ++-
+ 17 files changed, 30 insertions(+), 26 deletions(-)
+
+diff --git a/hwdb.d/meson.build b/hwdb.d/meson.build
+index badf39f555..8fd9c7639f 100644
+--- a/hwdb.d/meson.build
++++ b/hwdb.d/meson.build
+@@ -26,7 +26,7 @@ if conf.get('ENABLE_HWDB') == 1
+                      install_dir : udevhwdbdir)
+ 
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'udev/hwdb.d')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'udev/hwdb.d')))
+ 
+         meson.add_install_script('sh', '-c',
+                                  'test -n "$DESTDIR" || @0@/systemd-hwdb update'
+                                  .format(rootbindir))
+ endif
+ 
+ ############################################################
+diff --git a/meson.build b/meson.build
+index 263cc7189a..7a67078208 100644
+--- a/meson.build
++++ b/meson.build
+@@ -151,6 +151,9 @@ udevhwdbdir = join_paths(udevlibexecdir, 'hwdb.d')
+ catalogdir = join_paths(prefixdir, 'lib/systemd/catalog')
+ kernelinstalldir = join_paths(prefixdir, 'lib/kernel/install.d')
+ factorydir = join_paths(datadir, 'factory')
++factoryconfdir = join_paths(datadir, 'factory/etc')
++factorypkgconfdir = join_paths(datadir, 'factory/etc/systemd')
++factoryxinitrcdir = join_paths(datadir, 'factory/etc/X11/xinit/xinitrc.d')
+ bootlibdir = join_paths(prefixdir, 'lib/systemd/boot/efi')
+ testsdir = join_paths(prefixdir, 'lib/systemd/tests')
+ systemdstatedir = join_paths(localstatedir, 'lib/systemd')
+@@ -2287,7 +2290,7 @@ if conf.get('ENABLE_BINFMT') == 1
+         meson.add_install_script('sh', '-c',
+                                  mkdir_p.format(binfmtdir))
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'binfmt.d')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'binfmt.d')))
+ endif
+ 
+ if conf.get('ENABLE_VCONSOLE') == 1
+@@ -2373,7 +2376,7 @@ executable('systemd-sleep',
+            install_dir : rootlibexecdir)
+ 
+ install_data('src/sleep/sleep.conf',
+-             install_dir : pkgsysconfdir)
++             install_dir : factorypkgconfdir)
+ 
+ exe = executable('systemd-sysctl',
+                  'src/sysctl/sysctl.c',
+@@ -2685,7 +2688,7 @@ if conf.get('HAVE_KMOD') == 1
+         meson.add_install_script('sh', '-c',
+                                  mkdir_p.format(modulesloaddir))
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'modules-load.d')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'modules-load.d')))
+ endif
+ 
+ exe = executable('systemd-nspawn',
+@@ -2927,7 +2930,7 @@ install_subdir('factory/etc',
+                install_dir : factorydir)
+ 
+ install_data('xorg/50-systemd-user.sh',
+-             install_dir : xinitrcdir)
++             install_dir : factoryxinitrcdir)
+ install_data('modprobe.d/systemd.conf',
+              install_dir : modprobedir)
+ install_data('LICENSE.GPL2',
+diff --git a/network/meson.build b/network/meson.build
+index 59d4be1a17..72da2c16a2 100644
+--- a/network/meson.build
++++ b/network/meson.build
+@@ -7,7 +7,7 @@ if conf.get('ENABLE_NETWORKD') == 1
+                      install_dir : networkdir)
+ 
+         meson.add_install_script('sh', '-c',
+-                                 mkdir_p.format(join_paths(sysconfdir, 'systemd/network')))
++                                 mkdir_p.format(join_paths(factoryconfdir, 'systemd/network')))
+ endif
+ 
+ install_data('99-default.link',
+diff --git a/src/core/meson.build b/src/core/meson.build
+index df3aa5c6c1..305f67a80a 100644
+--- a/src/core/meson.build
++++ b/src/core/meson.build
+@@ -179,8 +179,8 @@ libcore = static_library(
+ systemd_sources = files('main.c')
+ 
+ in_files = [['macros.systemd',   rpmmacrosdir],
+-            ['system.conf',      pkgsysconfdir],
+-            ['user.conf',        pkgsysconfdir],
++            ['system.conf',      factorypkgconfdir],
++            ['user.conf',        factorypkgconfdir],
+             ['systemd.pc',       pkgconfigdatadir],
+             ['triggers.systemd', '']]
+ 
+@@ -210,6 +210,6 @@ meson.add_install_script('sh', '-c', mkdir_p.format(systemsleepdir))
+ meson.add_install_script('sh', '-c', mkdir_p.format(systemgeneratordir))
+ meson.add_install_script('sh', '-c', mkdir_p.format(usergeneratordir))
+ 
+-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'system')))
+-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'user')))
+-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(sysconfdir, 'xdg/systemd')))
++meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'system')))
++meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'user')))
++meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'xdg/systemd')))
+diff --git a/src/coredump/meson.build b/src/coredump/meson.build
+index 7fa5942697..34c865dfa0 100644
+--- a/src/coredump/meson.build
++++ b/src/coredump/meson.build
+@@ -15,7 +15,7 @@ coredumpctl_sources = files('coredumpctl.c')
+ 
+ if conf.get('ENABLE_COREDUMP') == 1
+         install_data('coredump.conf',
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ endif
+ 
+ tests += [
+diff --git a/src/journal-remote/meson.build b/src/journal-remote/meson.build
+index 87b8ba6495..daff8ec967 100644
+--- a/src/journal-remote/meson.build
++++ b/src/journal-remote/meson.build
+@@ -49,7 +49,7 @@ if conf.get('ENABLE_REMOTE') ==1 and conf.get('HAVE_LIBCURL') == 1
+                 output : 'journal-upload.conf',
+                 configuration : substs)
+         install_data(journal_upload_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ endif
+ 
+ if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
+@@ -58,7 +58,7 @@ if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
+                 output : 'journal-remote.conf',
+                 configuration : substs)
+         install_data(journal_remote_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         install_data('browse.html',
+                      install_dir : join_paths(pkgdatadir, 'gatewayd'))
+diff --git a/src/journal/meson.build b/src/journal/meson.build
+index 5796f77cac..75d975c260 100644
+--- a/src/journal/meson.build
++++ b/src/journal/meson.build
+@@ -109,7 +109,7 @@ if conf.get('HAVE_QRENCODE') == 1
+ endif
+ 
+ install_data('journald.conf',
+-             install_dir : pkgsysconfdir)
++             install_dir : factorypkgconfdir)
+ 
+ if get_option('create-log-dirs')
+         meson.add_install_script(
+diff --git a/src/kernel-install/meson.build b/src/kernel-install/meson.build
+index 261c3aaae4..dbc5e23513 100644
+--- a/src/kernel-install/meson.build
++++ b/src/kernel-install/meson.build
+@@ -11,4 +11,4 @@ install_data('00-entry-directory.install',
+              install_dir : kernelinstalldir)
+ 
+ meson.add_install_script('sh', '-c',
+-                         mkdir_p.format(join_paths(sysconfdir, 'kernel/install.d')))
++                         mkdir_p.format(join_paths(factoryconfdir, 'kernel/install.d')))
+diff --git a/src/login/meson.build b/src/login/meson.build
+index 0a7d3d5440..ff90149c1c 100644
+--- a/src/login/meson.build
++++ b/src/login/meson.build
+@@ -75,7 +75,7 @@ if conf.get('ENABLE_LOGIND') == 1
+                 output : 'logind.conf',
+                 configuration : substs)
+         install_data(logind_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         install_data('org.freedesktop.login1.conf',
+                      install_dir : dbuspolicydir)
+diff --git a/src/network/meson.build b/src/network/meson.build
+index 6bed37a170..35f15bcaf1 100644
+--- a/src/network/meson.build
++++ b/src/network/meson.build
+@@ -168,7 +168,7 @@ if conf.get('ENABLE_NETWORKD') == 1
+         endif
+ 
+         install_data('networkd.conf',
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         fuzzers += [
+     [['src/network/fuzz-netdev-parser.c',
+diff --git a/src/pstore/meson.build b/src/pstore/meson.build
+index adbac24b54..e9dc88dfa2 100644
+--- a/src/pstore/meson.build
++++ b/src/pstore/meson.build
+@@ -6,5 +6,5 @@ systemd_pstore_sources = files('''
+ 
+ if conf.get('ENABLE_PSTORE') == 1
+         install_data('pstore.conf',
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ endif
+diff --git a/src/resolve/meson.build b/src/resolve/meson.build
+index 92b67b6333..ac5b9a0b0a 100644
+--- a/src/resolve/meson.build
++++ b/src/resolve/meson.build
+@@ -168,7 +168,7 @@ if conf.get('ENABLE_RESOLVE') == 1
+                 output : 'resolved.conf',
+                 configuration : substs)
+         install_data(resolved_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+ 
+         install_data('resolv.conf',
+                      install_dir : rootlibexecdir)
+diff --git a/src/timesync/meson.build b/src/timesync/meson.build
+index e5c118c8db..19235df9ca 100644
+--- a/src/timesync/meson.build
++++ b/src/timesync/meson.build
+@@ -27,7 +27,7 @@ if conf.get('ENABLE_TIMESYNCD') == 1
+                 output : 'timesyncd.conf',
+                 configuration : substs)
+         install_data(timesyncd_conf,
+-                     install_dir : pkgsysconfdir)
++                     install_dir : factorypkgconfdir)
+         install_data('org.freedesktop.timesync1.conf',
+                      install_dir : dbuspolicydir)
+         install_data('org.freedesktop.timesync1.service',
+diff --git a/src/udev/meson.build b/src/udev/meson.build
+index 511fe428b9..32333efea6 100644
+--- a/src/udev/meson.build
++++ b/src/udev/meson.build
+@@ -186,7 +186,7 @@ foreach prog : [['ata_id/ata_id.c'],
+ endforeach
+ 
+ install_data('udev.conf',
+-             install_dir : join_paths(sysconfdir, 'udev'))
++             install_dir : join_paths(factoryconfdir, 'udev'))
+ 
+ configure_file(
+         input : 'udev.pc.in',
+@@ -195,7 +195,7 @@ configure_file(
+         install_dir : pkgconfigdatadir == 'no' ? '' : pkgconfigdatadir)
+ 
+ meson.add_install_script('sh', '-c',
+-                         mkdir_p.format(join_paths(sysconfdir, 'udev/rules.d')))
++                         mkdir_p.format(join_paths(factoryconfdir, 'udev/rules.d')))
+ 
+ fuzzers += [
+         [['src/udev/net/fuzz-link-parser.c',
+diff --git a/sysctl.d/meson.build b/sysctl.d/meson.build
+index 3f072e3db7..bd9f843eba 100644
+--- a/sysctl.d/meson.build
++++ b/sysctl.d/meson.build
+@@ -27,4 +27,4 @@ foreach file : in_files
+ endforeach
+ 
+ meson.add_install_script('sh', '-c',
+-                         mkdir_p.format(join_paths(sysconfdir, 'sysctl.d')))
++                         mkdir_p.format(join_paths(factoryconfdir, 'sysctl.d')))
+diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build
+index e77f46d06b..04d2ef621d 100644
+--- a/tmpfiles.d/meson.build
++++ b/tmpfiles.d/meson.build
+@@ -57,5 +57,5 @@ endforeach
+ if enable_tmpfiles
+         meson.add_install_script(
+                 'sh', '-c',
+-                mkdir_p.format(join_paths(sysconfdir, 'tmpfiles.d')))
++                mkdir_p.format(join_paths(factoryconfdir, 'tmpfiles.d')))
+ endif
+diff --git a/units/meson.build b/units/meson.build
+index 476991edba..3d9dc6e1c8 100644
+--- a/units/meson.build
++++ b/units/meson.build
+@@ -308,7 +308,7 @@ install_data('user-.slice.d/10-defaults.conf',
+ 
+ meson.add_install_script(meson_make_symlink,
+                          join_paths(pkgsysconfdir, 'user'),
+-                         join_paths(sysconfdir, 'xdg/systemd/user'))
++                         join_paths(factorypkgconfdir, 'xdg/systemd/user'))
+ meson.add_install_script(meson_make_symlink,
+                          join_paths(dbussystemservicedir, 'org.freedesktop.systemd1.service'),
+                          join_paths(dbussessionservicedir, 'org.freedesktop.systemd1.service'))
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0019-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0019-inherit-systemd-environment-when-calling-generators.patch
new file mode 100644
index 0000000000000..f4f1e6d37b5ed
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0019-inherit-systemd-environment-when-calling-generators.patch
@@ -0,0 +1,42 @@
+From 3eb1716dd80c245a2883da04156af79fb9097519 Mon Sep 17 00:00:00 2001
+From: Andreas Rammhold <andreas@rammhold.de>
+Date: Fri, 2 Nov 2018 21:15:42 +0100
+Subject: [PATCH 19/27] inherit systemd environment when calling generators.
+
+Systemd generators need access to the environment configured in
+stage-2-init.sh since it schedules fsck and mkfs executions based on
+being able to find an appropriate binary for the target filesystem.
+
+With this commit I am altering the systemd behaviour since upstream
+tries to gather environments with that they call
+"environment-generators" and then seems to pass that on to all the other
+executables that are being called from managers.
+---
+ src/core/manager.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index d9114bb0c5..22c3b6ff76 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -3868,9 +3868,14 @@ static int manager_run_generators(Manager *m) {
+         argv[4] = NULL;
+ 
+         RUN_WITH_UMASK(0022)
+-                (void) execute_directories((const char* const*) paths, DEFAULT_TIMEOUT_USEC, NULL, NULL,
+-                                           (char**) argv, m->transient_environment, EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS);
+-
++                (void) execute_directories((const char* const*) paths, DEFAULT_TIMEOUT_USEC,
++                                    // On NixOS we must propagate PATH to generators so they are
++                                    // able to find binaries such as `fsck.${fstype}` and
++                                    // `mkfs.${fstype}`. That is why the last argument of the
++                                    // function (envp) is set to NULL. This propagates systemd's
++                                    // environment (e.g. PATH) that was setup
++                                    // before calling systemd from stage-2-init.sh.
++                                    NULL, NULL, (char**) argv, /* NixOS: use inherited env */ NULL, EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS);
+         r = 0;
+ 
+ finish:
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0021-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0021-add-rootprefix-to-lookup-dir-paths.patch
new file mode 100644
index 0000000000000..39bbe7e9dacd2
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0021-add-rootprefix-to-lookup-dir-paths.patch
@@ -0,0 +1,38 @@
+From 8d1618a97ad08078815f409f03b45aff3ae6bd0a Mon Sep 17 00:00:00 2001
+From: Andreas Rammhold <andreas@rammhold.de>
+Date: Thu, 9 May 2019 11:15:22 +0200
+Subject: [PATCH 21/27] add rootprefix to lookup dir paths
+
+systemd does not longer use the UDEVLIBEXEC directory as root for
+discovery default udev rules. By adding `$out/lib` to the lookup paths
+we should again be able to discover the udev rules amongst other default
+files that I might have missed.
+---
+ src/basic/def.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/basic/def.h b/src/basic/def.h
+index 2af0b763f0..17959b07e8 100644
+--- a/src/basic/def.h
++++ b/src/basic/def.h
+@@ -39,13 +39,15 @@
+         "/run/" n "\0"                          \
+         "/usr/local/lib/" n "\0"                \
+         "/usr/lib/" n "\0"                      \
+-        _CONF_PATHS_SPLIT_USR_NULSTR(n)
++        _CONF_PATHS_SPLIT_USR_NULSTR(n)         \
++        ROOTPREFIX "/lib/" n "\0"
+ 
+ #define CONF_PATHS_USR(n)                       \
+         "/etc/" n,                              \
+         "/run/" n,                              \
+         "/usr/local/lib/" n,                    \
+-        "/usr/lib/" n
++        "/usr/lib/" n,                          \
++        ROOTPREFIX "/lib/" n
+ 
+ #define CONF_PATHS(n)                           \
+         CONF_PATHS_USR(n)                       \
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0022-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0022-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
new file mode 100644
index 0000000000000..9f0ea25489030
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0022-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -0,0 +1,27 @@
+From 859c16c52cdd61ec99d256bf5b35637d59e5dac9 Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 25 Jul 2019 20:45:55 +0300
+Subject: [PATCH 22/27] systemd-shutdown: execute scripts in
+ /etc/systemd/system-shutdown
+
+This is needed for NixOS to use such scripts as systemd directory is immutable.
+---
+ src/shutdown/shutdown.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
+index 0eb17989d0..93e619c58a 100644
+--- a/src/shutdown/shutdown.c
++++ b/src/shutdown/shutdown.c
+@@ -299,7 +299,7 @@ int main(int argc, char *argv[]) {
+         _cleanup_free_ char *cgroup = NULL;
+         char *arguments[3], *watchdog_device;
+         int cmd, r, umount_log_level = LOG_INFO;
+-        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, NULL};
++        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, "/etc/systemd/system-shutdown", NULL};
+ 
+         /* The log target defaults to console, but the original systemd process will pass its log target in through a
+          * command line argument, which will override this default. Also, ensure we'll never log to the journal or
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0023-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0023-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
new file mode 100644
index 0000000000000..e8aa5cf227148
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0023-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -0,0 +1,26 @@
+From 9be689d5243d0c78bec7b285774c58749da08c9c Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 25 Jul 2019 20:46:58 +0300
+Subject: [PATCH 23/27] systemd-sleep: execute scripts in
+ /etc/systemd/system-sleep
+
+This is needed for NixOS to use such scripts as systemd directory is immutable.
+---
+ src/sleep/sleep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
+index b9fe96635d..f1c3ca06a3 100644
+--- a/src/sleep/sleep.c
++++ b/src/sleep/sleep.c
+@@ -191,6 +191,7 @@ static int execute(char **modes, char **states) {
+         };
+         static const char* const dirs[] = {
+                 SYSTEM_SLEEP_PATH,
++                "/etc/systemd/system-sleep",
+                 NULL
+         };
+ 
+-- 
+2.24.1
+
diff --git a/pkgs/os-specific/linux/systemd/0024-kmod-static-nodes.service-Update-ConditionFileNotEmpty.patch b/pkgs/os-specific/linux/systemd/0024-kmod-static-nodes.service-Update-ConditionFileNotEmpty.patch
new file mode 100644
index 0000000000000..df16b52660bf1
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0024-kmod-static-nodes.service-Update-ConditionFileNotEmpty.patch
@@ -0,0 +1,27 @@
+From 7db89c2236158461c99fe5c5da7ddb7feab825cf Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Sat, 7 Mar 2020 22:40:27 +0100
+Subject: [PATCH] kmod-static-nodes.service: Update ConditionFileNotEmpty
+
+On NixOS, kernel modules of the currently booted systems are located at
+/run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
+---
+ units/kmod-static-nodes.service.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
+index 0971edf9ec..87105a87b9 100644
+--- a/units/kmod-static-nodes.service.in
++++ b/units/kmod-static-nodes.service.in
+@@ -12,7 +12,7 @@ Description=Create list of static device nodes for the current kernel
+ DefaultDependencies=no
+ Before=sysinit.target systemd-tmpfiles-setup-dev.service
+ ConditionCapability=CAP_SYS_MODULE
+-ConditionFileNotEmpty=/lib/modules/%v/modules.devname
++ConditionFileNotEmpty=/run/booted-system/kernel-modules/lib/modules/%v/modules.devname
+ 
+ [Service]
+ Type=oneshot
+-- 
+2.25.1
+
diff --git a/pkgs/os-specific/linux/systemd/0025-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0025-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
new file mode 100644
index 0000000000000..10bf54708f0d0
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0025-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -0,0 +1,33 @@
+From 0939ac4be7ced099670979f26adf8a579173ce4b Mon Sep 17 00:00:00 2001
+From: Florian Klink <flokli@flokli.de>
+Date: Sun, 8 Mar 2020 01:05:54 +0100
+Subject: [PATCH] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+
+This will be the $PATH used to lookup ExecStart= etc. options, which
+systemd itself uses extensively.
+---
+ src/basic/path-util.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/basic/path-util.h b/src/basic/path-util.h
+index 111d85d445..cfd92aeb73 100644
+--- a/src/basic/path-util.h
++++ b/src/basic/path-util.h
+@@ -24,11 +24,11 @@
+ #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
+ #endif
+ 
+-#define DEFAULT_PATH_NORMAL PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
+-#define DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
++#define DEFAULT_PATH_NORMAL "@defaultPathNormal@"
++#define DEFAULT_PATH_NORMAL_NULSTR "@defaultPathNormal@\0"
+ #define DEFAULT_PATH_SPLIT_USR DEFAULT_PATH_NORMAL ":" PATH_SBIN_BIN("/")
+ #define DEFAULT_PATH_SPLIT_USR_NULSTR DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/")
+-#define DEFAULT_PATH_COMPAT PATH_SPLIT_SBIN_BIN("/usr/local/") ":" PATH_SPLIT_SBIN_BIN("/usr/") ":" PATH_SPLIT_SBIN_BIN("/")
++#define DEFAULT_PATH_COMPAT DEFAULT_PATH_NORMAL
+ 
+ #if HAVE_SPLIT_USR
+ #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
+-- 
+2.25.1
+
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 1dd2f30b9bfcd..5728431b0598b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -7,6 +7,7 @@
 , gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
 , ninja, meson, python3Packages, glibcLocales
 , patchelf
+, substituteAll
 , getent
 , buildPackages
 , perl
@@ -23,25 +24,50 @@ let gnupg-minimal = gnupg.override {
   pinentry = null;
   adns = null;
   gnutls = null;
-  libusb = null;
+  libusb1 = null;
   openldap = null;
   readline = null;
   zlib = null;
   bzip2 = null;
 };
 in stdenv.mkDerivation {
-  version = "243.7";
+  version = "245.3";
   pname = "systemd";
 
   # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
   # Also fresh patches should be cherry-picked from that tree to our current one.
   src = fetchFromGitHub {
-    owner = "nixos";
-    repo = "systemd";
-    rev = "e7d881488292fc8bdf96acd12767eca1bd65adae";
-    sha256 = "0haj3iff3y13pm4w5dbqj1drp5wryqfad58jbbmnb6zdgis56h8f";
+    owner = "systemd";
+    repo = "systemd-stable";
+    rev = "0f5047b7d393cfba37f91e25cae559a0bc910582";
+    sha256 = "0wyh14gbvvpgdmk1mjgpxr9i4pv1i9n7pnwpa0gvjh6hq948fyn2";
   };
 
+  patches = [
+    ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+    ./0003-Don-t-try-to-unmount-nix-or-nix-store.patch
+    ./0004-Fix-NixOS-containers.patch
+    ./0006-Look-for-fsck-in-the-right-place.patch
+    ./0007-Add-some-NixOS-specific-unit-directories.patch
+    ./0009-Get-rid-of-a-useless-message-in-user-sessions.patch
+    ./0010-hostnamed-localed-timedated-disable-methods-that-cha.patch
+    ./0011-Fix-hwdb-paths.patch
+    ./0012-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0013-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0016-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+    ./0018-Install-default-configuration-into-out-share-factory.patch
+    ./0019-inherit-systemd-environment-when-calling-generators.patch
+    ./0021-add-rootprefix-to-lookup-dir-paths.patch
+    ./0022-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0023-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0024-kmod-static-nodes.service-Update-ConditionFileNotEmpty.patch
+    ./0025-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
+  '';
+
   outputs = [ "out" "lib" "man" "dev" ];
 
   nativeBuildInputs =
@@ -83,8 +109,10 @@ in stdenv.mkDerivation {
     "-Dtests=false"
     "-Dimportd=true"
     "-Dlz4=true"
+    "-Dhomed=false"
     "-Dhostnamed=true"
     "-Dnetworkd=true"
+    "-Dportabled=false"
     "-Dsysusers=false"
     "-Dtimedated=true"
     "-Dtimesyncd=true"
@@ -195,6 +223,11 @@ in stdenv.mkDerivation {
 
   doCheck = false; # fails a bunch of tests
 
+  # trigger the test -n "$DESTDIR" || mutate in upstreams build system
+  preInstall = ''
+    export DESTDIR=/
+  '';
+
   postInstall = ''
     # sysinit.target: Don't depend on
     # systemd-tmpfiles-setup.service. This interferes with NixOps's
@@ -263,6 +296,6 @@ in stdenv.mkDerivation {
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     priority = 10;
-    maintainers = with maintainers; [ andir eelco flokli mic92 ];
+    maintainers = with maintainers; [ andir eelco flokli ];
   };
 }
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index f0cc6fd5a9b1e..aa23a162a9291 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "util-linux";
-  version = "2.33.2";
+  version = "2.35.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "15yf2dh4jd1kg6066hydlgdhhs2j3na13qld8yx30qngqvmfh6v3";
+    sha256 = "1yfpy6bkab4jw61mpx48gfy24yrqp4a7arvpis8csrkk53fkxpnr";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
index 5f38861bf68b7..52c970a18f3da 100644
--- a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
+++ b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
@@ -2,26 +2,68 @@ Search $PATH for the shutdown binary instead of hard-coding /sbin/shutdown,
 which isn't valid on NixOS (and a compatibility link on most other modern
 distros anyway).
 
-  -- nckx <github@tobias.gr>
 --- a/include/pathnames.h
 +++ b/include/pathnames.h
-@@ -53,7 +53,7 @@
+@@ -50,8 +50,8 @@
  #ifndef _PATH_LOGIN
- #define _PATH_LOGIN		"/bin/login"
+ # define _PATH_LOGIN		"/bin/login"
  #endif
 -#define _PATH_SHUTDOWN		"/sbin/shutdown"
-+#define _PATH_SHUTDOWN   "shutdown"
-
+-#define _PATH_POWEROFF		"/sbin/poweroff"
++#define _PATH_SHUTDOWN		"shutdown"
++#define _PATH_POWEROFF		"poweroff"
+ 
  #define _PATH_TERMCOLORS_DIRNAME "terminal-colors.d"
  #define _PATH_TERMCOLORS_DIR	"/etc/" _PATH_TERMCOLORS_DIRNAME
 --- a/sys-utils/rtcwake.c
 +++ b/sys-utils/rtcwake.c
-@@ -575,7 +575,7 @@ int main(int argc, char **argv)
- 		arg[i++] = "now";
- 		arg[i]   = NULL;
- 		if (!ctl.dryrun) {
--			execv(arg[0], arg);
+@@ -587,29 +587,29 @@ int main(int argc, char **argv)
+ 		char *arg[5];
+ 		int i = 0;
+ 
+-		if (!access(_PATH_SHUTDOWN, X_OK)) {
+-			arg[i++] = _PATH_SHUTDOWN;
+-			arg[i++] = "-h";
+-			arg[i++] = "-P";
+-			arg[i++] = "now";
+-			arg[i]   = NULL;
+-		} else if (!access(_PATH_POWEROFF, X_OK)) {
+-			arg[i++] = _PATH_POWEROFF;
+-			arg[i]   = NULL;
+-		} else {
+-			arg[i] 	 = NULL;
+-		}
++		arg[i++] = _PATH_SHUTDOWN;
++		arg[i++] = "-h";
++		arg[i++] = "-P";
++		arg[i++] = "now";
++		arg[i]   = NULL;
+ 
+-		if (arg[0]) {
+-			if (ctl.verbose)
+-				printf(_("suspend mode: off; executing %s\n"),
+-						arg[0]);
+-			if (!ctl.dryrun) {
+-				execv(arg[0], arg);
++		if (ctl.verbose)
++			printf(_("suspend mode: off; executing %s\n"),
++					arg[0]);
++
++		if (!ctl.dryrun) {
++			execvp(arg[0], arg);
++			if (ctl.verbose) {
+ 				warn(_("failed to execute %s"), arg[0]);
+-				rc = EX_EXEC_ENOENT;
++				// Reuse translations.
++				printf(_("suspend mode: off; executing %s\n"),
++						_PATH_POWEROFF);
+ 			}
+-		} else {
++
++			i = 0;
++			arg[i++] = _PATH_POWEROFF;
++			arg[i]   = NULL;
 +			execvp(arg[0], arg);
- 			warn(_("failed to execute %s"), _PATH_SHUTDOWN);
- 			rc = EXIT_FAILURE;
- 		}
+ 			/* Failed to find shutdown command */
+ 			warn(_("failed to find shutdown command"));
+ 			rc = EX_EXEC_ENOENT;
diff --git a/pkgs/servers/dns/https-dns-proxy/default.nix b/pkgs/servers/dns/https-dns-proxy/default.nix
new file mode 100644
index 0000000000000..6f2cb5048034d
--- /dev/null
+++ b/pkgs/servers/dns/https-dns-proxy/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, cmake, gtest, c-ares, curl, libev }:
+
+stdenv.mkDerivation rec {
+  pname = "https-dns-proxy";
+  # there are no stable releases (yet?)
+  version = "unstable-20200419";
+
+  src = fetchFromGitHub {
+    owner = "aarond10";
+    repo = "https_dns_proxy";
+    rev = "79fc7b085e3b1ad64c8332f7115dfe2bf5f1f3e4";
+    sha256 = "1cdfswfjby4alp6gy7yyjm76kfyclh5ax0zadnqs2pyigg9plh0b";
+  };
+
+  nativeBuildInputs = [ cmake gtest ];
+
+  buildInputs = [ c-ares curl libev ];
+
+  installPhase = ''
+    install -Dm555 -t $out/bin https_dns_proxy
+    install -Dm444 -t $out/share/doc/${pname} ../{LICENSE,README}.*
+  '';
+
+  # upstream wants to add tests and the gtest framework is in place, so be ready
+  # for when that happens despite there being none as of right now
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "DNS to DNS over HTTPS (DoH) proxy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 1d6951bb8c1c1..44c9676fc7777 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -42,11 +42,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.12.0";
+  version = "4.12.1";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    sha256 = "1zk5jqnkifkfi6ssn02bh2ih7vyw2nsr0angsd6kyg3xaq5bgh3f";
+    sha256 = "0xbdf9651lm4b5g60ly40nc7r8gssvnvq7m3pdma99mdcs5vcz01";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 606eaeb65ac7d..cda9244e192f9 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "timescaledb";
-  version = "1.6.1";
+  version = "1.7.0";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ postgresql openssl ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner  = "timescale";
     repo   = "timescaledb";
     rev    = "refs/tags/${version}";
-    sha256 = "0k03aqpc1faqlpw46wazv0dy0xja57cv1sr1zwmizw3j3p3s0zdq";
+    sha256 = "0n234ard9sldpbdqvbq2i48xyiyj8ljirsbspsax11f8yzy9ziac";
   };
 
   cmakeFlags = [ "-DSEND_TELEMETRY_DEFAULT=OFF" "-DREGRESS_CHECKS=OFF" ];
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index e398b9b5d652f..c6fe55ad9f750 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -256,6 +256,15 @@ self: super:
 
   libXres = super.libXres.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "devdoc" ];
+    buildInputs = with self; attrs.buildInputs ++ [ utilmacros ];
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
+  });
+
+  libXScrnSaver = super.libXScrnSaver.overrideAttrs (attrs: {
+    buildInputs = with self; attrs.buildInputs ++ [ utilmacros ];
+    configureFlags = attrs.configureFlags or []
+      ++ malloc0ReturnsNullCrossFlag;
   });
 
   libXv = super.libXv.overrideAttrs (attrs: {
diff --git a/pkgs/shells/bash/bash-completion/0001-Revert-build-Do-cmake-pc-and-profile-variable-replac.patch b/pkgs/shells/bash/bash-completion/0001-Revert-build-Do-cmake-pc-and-profile-variable-replac.patch
deleted file mode 100644
index c0d94a1a76d9b..0000000000000
--- a/pkgs/shells/bash/bash-completion/0001-Revert-build-Do-cmake-pc-and-profile-variable-replac.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 398f44b4ed545fc1b6c13a057bf0900001f7958b Mon Sep 17 00:00:00 2001
-From: Frederik Rietdijk <fridh@fridh.nl>
-Date: Tue, 22 Oct 2019 15:07:05 +0200
-Subject: [PATCH] Revert "build: Do cmake, pc, and profile variable
- replacements in Makefile"
-
-This reverts commit 81ba2c7e7dfbaefbafa1e8615727c9612e5fb314.
----
- Makefile.am                     | 12 ++++++++----
- bash-completion-config.cmake.in |  4 ++--
- bash-completion.pc.in           |  4 ++--
- configure.ac                    |  3 +++
- 4 files changed, 15 insertions(+), 8 deletions(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 8f441185..53979529 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -23,8 +23,7 @@ cmakeconfig_DATA = bash-completion-config.cmake \
- 		-e 's|@VERSION[@]|$(VERSION)|' \
- 		<$(srcdir)/$@.in >$@
- 
--CLEANFILES = bash_completion.sh bash-completion.pc \
--	bash-completion-config.cmake bash-completion-config-version.cmake
-+CLEANFILES = bash_completion.sh bash-completion.pc
- 
- EXTRA_DIST = CHANGES $(pkgdata_DATA) bash_completion.sh.in .dir-locals.el \
- 	.editorconfig README.md CONTRIBUTING.md pyproject.toml .perltidyrc \
-@@ -34,6 +33,11 @@ EXTRA_DIST = CHANGES $(pkgdata_DATA) bash_completion.sh.in .dir-locals.el \
- install-data-hook:
- 	tmpfile=`mktemp $${TMPDIR:-/tmp}/bash_completion.XXXXXX` && \
- 	$(SED) -e 's|-/etc/bash_completion\.d|-$(compatdir)|' \
--	    $(DESTDIR)$(pkgdatadir)/bash_completion >$$tmpfile && \
--	cat $$tmpfile >$(DESTDIR)$(pkgdatadir)/bash_completion && \
-+	    $(DESTDIR)$(pkgdatadir)/bash_completion > $$tmpfile && \
-+	cat $$tmpfile > $(DESTDIR)$(pkgdatadir)/bash_completion && \
-+	$(SED) -e 's|\$${prefix}|$(prefix)|' \
-+	    $(DESTDIR)$(datadir)/cmake/$(PACKAGE)/bash-completion-config.cmake \
-+	         > $$tmpfile && \
-+	cat $$tmpfile > \
-+	    $(DESTDIR)$(datadir)/cmake/$(PACKAGE)/bash-completion-config.cmake && \
- 	rm $$tmpfile
-diff --git a/bash-completion-config.cmake.in b/bash-completion-config.cmake.in
-index d907b76c..ccc6e052 100644
---- a/bash-completion-config.cmake.in
-+++ b/bash-completion-config.cmake.in
-@@ -5,7 +5,7 @@ set (BASH_COMPLETION_VERSION "@VERSION@")
- 
- set (BASH_COMPLETION_PREFIX "@prefix@")
- set (BASH_COMPLETION_COMPATDIR "@compatdir@")
--set (BASH_COMPLETION_COMPLETIONSDIR "@pkgdatadir@/completions")
--set (BASH_COMPLETION_HELPERSDIR "@pkgdatadir@/helpers")
-+set (BASH_COMPLETION_COMPLETIONSDIR "@datarootdir@/@PACKAGE@/completions")
-+set (BASH_COMPLETION_HELPERSDIR "@datarootdir@/@PACKAGE@/helpers")
- 
- set (BASH_COMPLETION_FOUND "TRUE")
-diff --git a/bash-completion.pc.in b/bash-completion.pc.in
-index ea03fd75..bde217db 100644
---- a/bash-completion.pc.in
-+++ b/bash-completion.pc.in
-@@ -1,7 +1,7 @@
- prefix=@prefix@
- compatdir=@compatdir@
--completionsdir=@pkgdatadir@/completions
--helpersdir=@pkgdatadir@/helpers
-+completionsdir=@datarootdir@/@PACKAGE@/completions
-+helpersdir=@datarootdir@/@PACKAGE@/helpers
- 
- Name: bash-completion
- Description: programmable completion for the bash shell
-diff --git a/configure.ac b/configure.ac
-index 1f3b37e8..a216d9b7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -13,5 +13,8 @@ helpers/Makefile
- test/Makefile
- test/t/Makefile
- test/t/unit/Makefile
-+bash-completion.pc
-+bash-completion-config.cmake
-+bash-completion-config-version.cmake
- ])
- AC_OUTPUT
--- 
-2.21.0
-
diff --git a/pkgs/shells/bash/bash-completion/default.nix b/pkgs/shells/bash/bash-completion/default.nix
index 8efada3413aad..c223985c2fb8c 100644
--- a/pkgs/shells/bash/bash-completion/default.nix
+++ b/pkgs/shells/bash/bash-completion/default.nix
@@ -1,49 +1,58 @@
 { stdenv, fetchFromGitHub
 , fetchpatch
 , autoreconfHook
+, perl
+, ps
 , python3Packages
 , bashInteractive
 }:
 
 stdenv.mkDerivation rec {
   pname = "bash-completion";
-  # TODO: Remove musl patch below upon next release!
-  version = "2.9";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "scop";
     repo = "bash-completion";
     rev = version;
-    sha256 = "1813r4jxfa2zgzm2ppjhrq62flfmxai8433pklxcrl4fp5wwx9yv";
+    sha256 = "047yjryy9d6hp18wkigbfrw9r0sm31inlsp8l28fhxg8ii032sgq";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
 
   doCheck = !stdenv.isDarwin;
   checkInputs = [
+    # perl is assumed by perldoc completion
+    perl
+    # ps assumed to exist by gdb, killall, pgrep, pidof,
+    # pkill, pwdx, renice, and reptyr completions
+    ps
     python3Packages.pexpect
     python3Packages.pytest
     bashInteractive
   ];
 
-  patches = [
-    ./0001-Revert-build-Do-cmake-pc-and-profile-variable-replac.patch
-    # TODO: Remove when https://github.com/scop/bash-completion/commit/2cdac1b9f24df62a1fa80c1824ee8524c9b02393
-    #       is availabe in a release in nixpkgs. see https://github.com/scop/bash-completion/issues/312.
-    # Fixes a test failure with musl.
-    (fetchpatch {
-     url = "https://github.com/scop/bash-completion/commit/2cdac1b9f24df62a1fa80c1824ee8524c9b02393.patch";
-     name = "bash-completion-musl-test_iconv-skip-option-completion-if-help-fails";
-     sha256 = "1l53d62zf01k625nzw3vcrxky93h7bzdpchgk4argxalrn17ckvb";
-    })
-  ];
-
-  # ignore ip_addresses because it tries to touch network
-  # ignore test_ls because impure logic
+  # - ignore test_gcc on ARM because it assumes -march=native
+  # - ignore test_chsh because it assumes /etc/shells exists
+  # - ignore test_ether_wake, test_ifdown, test_ifstat, test_ifup,
+  #   test_iperf, test_iperf3, test_nethogs and ip_addresses
+  #   because they try to touch network
+  # - ignore test_ls because impure logic
+  # - ignore test_screen because it assumes vt terminals exist
   checkPhase = ''
     pytest . \
+      ${stdenv.lib.optionalString (stdenv.hostPlatform.isAarch64) "--ignore=test/t/test_gcc.py"} \
+      --ignore=test/t/test_chsh.py \
+      --ignore=test/t/test_ether_wake.py \
+      --ignore=test/t/test_ifdown.py \
+      --ignore=test/t/test_ifstat.py \
+      --ignore=test/t/test_ifup.py \
+      --ignore=test/t/test_iperf.py \
+      --ignore=test/t/test_iperf3.py \
+      --ignore=test/t/test_nethogs.py \
       --ignore=test/t/unit/test_unit_ip_addresses.py \
-      --ignore=test/t/test_ls.py
+      --ignore=test/t/test_ls.py \
+      --ignore=test/t/test_screen.py
   '';
 
   prePatch = stdenv.lib.optionalString stdenv.isDarwin ''
@@ -55,6 +64,6 @@ stdenv.mkDerivation rec {
     description = "Programmable completion for the bash shell";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = [ maintainers.peti ];
+    maintainers = [ maintainers.peti maintainers.xfix ];
   };
 }
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 5b8fdde579612..839757945a2bc 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -779,7 +779,7 @@ substituteAllInPlace() {
 # the environment used for building.
 dumpVars() {
     if [ "${noDumpEnvVars:-0}" != 1 ]; then
-        export > "$NIX_BUILD_TOP/env-vars" || true
+        export >| "$NIX_BUILD_TOP/env-vars" || true
     fi
 }
 
@@ -1266,6 +1266,7 @@ genericBuild() {
 
     for curPhase in $phases; do
         if [[ "$curPhase" = unpackPhase && -n "${dontUnpack:-}" ]]; then continue; fi
+        if [[ "$curPhase" = patchPhase && -n "${dontPatch:-}" ]]; then continue; fi
         if [[ "$curPhase" = configurePhase && -n "${dontConfigure:-}" ]]; then continue; fi
         if [[ "$curPhase" = buildPhase && -n "${dontBuild:-}" ]]; then continue; fi
         if [[ "$curPhase" = checkPhase && -z "${doCheck:-}" ]]; then continue; fi
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index db6f27a3010fa..180764bd8c9b8 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "procs";
-  version = "0.9.20";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00qqn8nwv791bs88n302hy67dpas5hcacnkakn7law567klnzxfz";
+    sha256 = "1bgsxvb9wxi4sz8jfamhdwaq9f2q2k7c3cdkk60k86mkmas8ibxz";
   };
 
-  cargoSha256 = "09ib1nlqhzq3mc5wc16mgqbyr652asrwdpbwaax54fm1gd334prl";
+  cargoSha256 = "0zf41clf3rqxmal894gqp9fn9bnas99wna13fc43fxdlvh92v4yh";
 
   buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
 
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     description = "A modern replacement for ps written in Rust";
     homepage = "https://github.com/dalance/procs";
     license = licenses.mit;
-    maintainers = with maintainers;  [ dalance filalex77 ];
+    maintainers = with maintainers; [ dalance filalex77 ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 10cfa08686002..65760a0b6ccd2 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -17,6 +17,15 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "SHELL=/bin/sh" "GREP=grep" ];
 
+  # Many gzip executables are shell scripts that depend upon other gzip
+  # executables being in $PATH.  Rather than try to re-write all the
+  # internal cross-references, just add $out/bin to PATH at the top of
+  # all the executables that are shell scripts.
+  preFixup = ''
+    sed -i '1{;/#!\/bin\/sh/aPATH="'$out'/bin:$PATH"
+    }' $out/bin/*
+  '';
+
   meta = {
     homepage = "https://www.gnu.org/software/gzip/";
     description = "GNU zip compression program";
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 9b4bf4799676c..5c73ee945c795 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "5.4.1";
+  version = "5.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    sha256 = "0scxg9p6z0wss92gmv5a8yxdmr8x449kb5v3bfnvs26n92r7zq7k";
+    sha256 = "0srg276yccfmqz0skmmga3vbqx4wiqsk1l6h86n6ryhxa9viqcm1";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/mscgen/default.nix b/pkgs/tools/graphics/mscgen/default.nix
index 29f0f22473556..f6bec5983c2af 100644
--- a/pkgs/tools/graphics/mscgen/default.nix
+++ b/pkgs/tools/graphics/mscgen/default.nix
@@ -1,4 +1,15 @@
-{ stdenv, fetchurl, flex, bison, gd, libpng, libjpeg, freetype, zlib, libwebp, runtimeShell }:
+{ stdenv
+, bison
+, fetchurl
+, flex
+, gd
+, libjpeg
+, libpng
+, libwebp
+, pkg-config
+, runtimeShell
+, zlib
+}:
 
 let
   version = "0.20";
@@ -12,13 +23,16 @@ stdenv.mkDerivation {
     sha256 = "3c3481ae0599e1c2d30b7ed54ab45249127533ab2f20e768a0ae58d8551ddc23";
   };
 
-  buildInputs = [ flex bison gd libjpeg libpng freetype zlib libwebp ];
+  nativeBuildInputs = [ bison flex pkg-config ];
+  buildInputs = [ gd libjpeg libpng libwebp zlib ];
 
   doCheck = true;
   preCheck = ''
     sed -i -e "s|#!/bin/bash|#!${runtimeShell}|" test/renderercheck.sh
   '';
 
+  outputs = [ "out" "man" ];
+
   meta = {
     homepage = "http://www.mcternan.me.uk/mscgen/";
     description = "Convert Message Sequence Chart descriptions into PNG, SVG, or EPS images";
diff --git a/pkgs/tools/misc/dvtm/dvtm.nix b/pkgs/tools/misc/dvtm/dvtm.nix
index 61af9fac1778a..5bb8efb5540c6 100644
--- a/pkgs/tools/misc/dvtm/dvtm.nix
+++ b/pkgs/tools/misc/dvtm/dvtm.nix
@@ -9,6 +9,7 @@ stdenv.mkDerivation {
     cp ${builtins.toFile "config.h" customConfig} ./config.h
   '';
 
+  nativeBuildInputs = [ ncurses ];
   buildInputs = [ ncurses ];
 
   prePatch = ''
@@ -16,9 +17,7 @@ stdenv.mkDerivation {
       --replace /usr/share/terminfo $out/share/terminfo
   '';
 
-  installPhase = ''
-    make PREFIX=$out install
-  '';
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "Dynamic virtual terminal manager";
diff --git a/pkgs/tools/misc/html-proofer/Gemfile.lock b/pkgs/tools/misc/html-proofer/Gemfile.lock
index c3ff0fd210fe9..0ba32818d21b4 100644
--- a/pkgs/tools/misc/html-proofer/Gemfile.lock
+++ b/pkgs/tools/misc/html-proofer/Gemfile.lock
@@ -6,7 +6,7 @@ GEM
     ethon (0.12.0)
       ffi (>= 1.3.0)
     ffi (1.12.2)
-    html-proofer (3.15.2)
+    html-proofer (3.15.3)
       addressable (~> 2.3)
       mercenary (~> 0.3)
       nokogumbo (~> 2.0)
@@ -21,7 +21,7 @@ GEM
     nokogumbo (2.0.2)
       nokogiri (~> 1.8, >= 1.8.4)
     parallel (1.19.1)
-    public_suffix (4.0.3)
+    public_suffix (4.0.4)
     rainbow (3.0.0)
     typhoeus (1.3.1)
       ethon (>= 0.9.0)
diff --git a/pkgs/tools/misc/html-proofer/gemset.nix b/pkgs/tools/misc/html-proofer/gemset.nix
index 2e3b3a10b3b89..c5836bc74ba00 100644
--- a/pkgs/tools/misc/html-proofer/gemset.nix
+++ b/pkgs/tools/misc/html-proofer/gemset.nix
@@ -37,10 +37,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1b7wx2hnwnml3y10x6yxybl3hy973n2ifq3hbqh0jd72bqs615wp";
+      sha256 = "18afz6rz72j8hnfgzhyr21wh1rfy1x41iyhbcgaq0r1bd7ng1vni";
       type = "gem";
     };
-    version = "3.15.2";
+    version = "3.15.3";
   };
   mercenary = {
     groups = ["default"];
@@ -99,10 +99,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1c6kq6s13idl2036b5lch8r7390f8w82cal8hcp4ml76fm2vdac7";
+      sha256 = "1l1kqw75asziwmzrig8rywxswxz8l91sc3pvns02ffsqac1a3wiz";
       type = "gem";
     };
-    version = "4.0.3";
+    version = "4.0.4";
   };
   rainbow = {
     groups = ["default"];
diff --git a/pkgs/tools/misc/patdiff/default.nix b/pkgs/tools/misc/patdiff/default.nix
index 1c5e5b0447414..e0b54e56081dd 100644
--- a/pkgs/tools/misc/patdiff/default.nix
+++ b/pkgs/tools/misc/patdiff/default.nix
@@ -4,7 +4,7 @@ with ocamlPackages;
 
 janePackage {
   pname = "patdiff";
-  hash = "04krzn6rj2r81z55pms5ayk6bxhlxrm006cbhy0m6rc69a0h00lh";
+  hash = "1yqvxdmkgcwgx3npgncpdqwkpdxiqr1q41wci7589s8z7xi5nwyz";
   buildInputs = [ core_extended expect_test_helpers patience_diff ocaml_pcre shell ];
   meta = {
     description = "File Diff using the Patience Diff algorithm";
diff --git a/pkgs/tools/misc/statserial/default.nix b/pkgs/tools/misc/statserial/default.nix
new file mode 100644
index 0000000000000..66ae899b9c5a3
--- /dev/null
+++ b/pkgs/tools/misc/statserial/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchurl, ncurses, glibc }:
+
+stdenv.mkDerivation rec {
+  pname = "statserial";
+  version = "1.1";
+
+  src = fetchurl {
+    url = "http://www.ibiblio.org/pub/Linux/system/serial/${pname}-${version}.tar.gz";
+    sha256 = "0rrrmxfba5yn836zlgmr8g9xnrpash7cjs7lk2m44ac50vakpks0";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace '-lcurses' '-lncurses'
+
+    substituteInPlace Makefile \
+      --replace 'LDFLAGS = -s -N' '#LDFLAGS = -s -N'
+  '';
+
+  buildInputs = [ ncurses glibc stdenv ];
+
+  installPhase = ''
+  mkdir -p $out/bin
+  cp statserial $out/bin
+
+  mkdir -p $out/share/man/man1
+  cp statserial.1 $out/share/man/man1
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://sites.google.com/site/tranter/software";
+    description = "Display serial port modem status lines.";
+    license = licenses.gpl2;
+
+    longDescription =
+      '' Statserial displays a table of the signals on a standard 9-pin or
+      25-pin serial port, and indicates the status of the handshaking lines. It
+      can be useful for debugging problems with serial ports or modems.
+      '';
+
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ rps ];
+  };
+}
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index badfddd6d50c2..7329d78c2c832 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,12 +3,12 @@
 
 stdenv.mkDerivation rec {
   pname = "modem-manager";
-  version = "1.12.6";
+  version = "1.12.8";
 
   package = "ModemManager";
   src = fetchurl {
     url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
-    sha256 = "0k32rjh06p3q9yq054gxya6c7n39bilhi4s23p2hb02iwlz3bcrf";
+    sha256 = "1zrsf57bn9rmaa2qvavr1aisci76vwlx0viqpwmkw3ds2l33vdb8";
   };
 
   nativeBuildInputs = [ vala gobject-introspection gettext pkgconfig ];
diff --git a/pkgs/tools/networking/mu/default.nix b/pkgs/tools/networking/mu/default.nix
index 2e6a401350cdc..ae1ca3f776113 100644
--- a/pkgs/tools/networking/mu/default.nix
+++ b/pkgs/tools/networking/mu/default.nix
@@ -5,20 +5,15 @@
 
 stdenv.mkDerivation rec {
   pname = "mu";
-  version = "1.2";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner  = "djcb";
     repo   = "mu";
     rev    = version;
-    sha256 = "0yhjlj0z23jw3cf2wfnl98y8q6gikvmhkb8vdm87bd7jw0bdnrfz";
+    sha256 = "0q2ik7fj5k9i76js4ijyxbgrwqff437lass0sd5if2r40rqh0as0";
   };
 
-  # test-utils coredumps so don't run those
-  postPatch = ''
-    sed -i -e '/test-utils/d' lib/parser/Makefile.am
-  '';
-
   buildInputs = [
     sqlite xapian glib gmime3 texinfo emacs guile libsoup icu
   ] ++ stdenv.lib.optionals withMug [ gtk3 webkitgtk ];
@@ -27,19 +22,17 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  preConfigure = "./autogen.sh";
+
   preBuild = ''
     # Fix mu4e-builddir (set it to $out)
     substituteInPlace mu4e/mu4e-meta.el.in \
       --replace "@abs_top_builddir@" "$out"
-
-    # We install msg2pdf to bin/msg2pdf, fix its location in elisp
-    substituteInPlace mu4e/mu4e-actions.el \
-      --replace "/toys/msg2pdf/" "/bin/"
   '';
 
-  # Install mug and msg2pdf
+  # Install mug
   postInstall = stdenv.lib.optionalString withMug ''
-    for f in msg2pdf mug ; do
+    for f in mug ; do
       install -m755 toys/$f/$f $out/bin/$f
     done
   '';
diff --git a/pkgs/tools/networking/wifite2/default.nix b/pkgs/tools/networking/wifite2/default.nix
index 8ff0c6d84ab5d..505e461e48062 100644
--- a/pkgs/tools/networking/wifite2/default.nix
+++ b/pkgs/tools/networking/wifite2/default.nix
@@ -3,14 +3,14 @@
 , hcxdumptool, pyrit, which }:
 
 python3.pkgs.buildPythonApplication rec {
-  version = "2.5.2";
+  version = "2.5.3";
   pname = "wifite2";
 
   src = fetchFromGitHub {
     owner = "kimocoder";
     repo = "wifite2";
     rev = version;
-    sha256 = "0hsb59d86szn27s3hynpzkp49rmw4g692vrl67nal7rfcdvpp8hb";
+    sha256 = "080hbjpbgdnzr6jkmg5cb8dvzxm57zpi4c9x0y92yy472vqll3ax";
   };
 
   patches = [
diff --git a/pkgs/tools/security/age/default.nix b/pkgs/tools/security/age/default.nix
index bde597ba9f30f..c8b4f069f7955 100644
--- a/pkgs/tools/security/age/default.nix
+++ b/pkgs/tools/security/age/default.nix
@@ -2,9 +2,9 @@
 
 buildGoModule rec {
   pname = "age";
-  version = "1.0.0-beta2";
+  version = "unstable-2020-03-25";
   goPackagePath = "github.com/FiloSottile/age";
-  modSha256 = "0kwdwhkxgqjd8h1p7pm4h4xidp2vk840h1j4qya4qz8bjf9vskl9";
+  modSha256 = "00yhn1894ni8bvkqm1vr0rqkky52pkhvdzbi2sqx3czlgb5ibw3h";
 
   subPackages = [
     "cmd/age"
@@ -14,8 +14,8 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "age";
-    rev = "v${version}";
-    sha256 = "1n1ww8yjw0mg00dvnfmggww9kwp1hls0a85iv6vx9k89mzv8mdrq";
+    rev = "f0f8092d60bb96737fa096c29ec6d8adb5810390";
+    sha256 = "079kfc8d1pr39hr4qnx48kviyzwg4p8m4pz0bdkypns4aq8ppbfk";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/security/gnome-keysign/default.nix b/pkgs/tools/security/gnome-keysign/default.nix
index c2f6da9812f72..d430a689524a6 100644
--- a/pkgs/tools/security/gnome-keysign/default.nix
+++ b/pkgs/tools/security/gnome-keysign/default.nix
@@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication rec {
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     (gst_all_1.gst-plugins-good.override { gtkSupport = true; })
-    gst_all_1.gst-plugins-bad # for zbar plug-in
+    (gst_all_1.gst-plugins-bad.override { enableZbar = true; }) # for zbar plug-in
   ];
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index f87e985c95ae6..7c095cffa3116 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -4,7 +4,7 @@
 # Each of the dependencies below are optional.
 # Gnupg can be built without them at the cost of reduced functionality.
 , guiSupport ? true, enableMinimal ? false
-, adns ? null , bzip2 ? null , gnutls ? null , libusb ? null , openldap ? null
+, adns ? null , bzip2 ? null , gnutls ? null , libusb1 ? null , openldap ? null
 , pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ?
 null
 }:
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig texinfo ];
   buildInputs = [
     libgcrypt libassuan libksba libiconv npth gettext
-    readline libusb gnutls adns openldap zlib bzip2 sqlite
+    readline libusb1 gnutls adns openldap zlib bzip2 sqlite
   ];
 
   patches = [
diff --git a/pkgs/tools/security/sn0int/default.nix b/pkgs/tools/security/sn0int/default.nix
new file mode 100644
index 0000000000000..9e9cbe2bb3a53
--- /dev/null
+++ b/pkgs/tools/security/sn0int/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, rustPlatform,
+  libsodium, libseccomp, sqlite, pkgconfig }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "sn0int";
+  version = "0.18.2";
+
+  src = fetchFromGitHub {
+    owner = "kpcyrd";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0b21b0ryq03zrhqailg2iajirn30l358aj3k44lfnravr4h9zwkj";
+  };
+
+  cargoSha256 = "1pvn0sc325b5fh29m2l6cack4qfssa4lp3zhyb1qzkb3fmw3lgcy";
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ libsodium libseccomp sqlite ];
+
+  # One of the dependencies (chrootable-https) tries to read "/etc/resolv.conf"
+  # in "checkPhase", hence fails in sandbox of "nix".
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Semi-automatic OSINT framework and package manager";
+    homepage = "https://github.com/kpcyrd/sn0int";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ xrelkd ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/system/kmon/default.nix b/pkgs/tools/system/kmon/default.nix
index c1e511fa0c2ca..1a4cdb9acdfe7 100644
--- a/pkgs/tools/system/kmon/default.nix
+++ b/pkgs/tools/system/kmon/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kmon";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0kmkcs13cccmjjfbl25bs3m54zcjcs38fiv84q0vy09a4dnx3gn8";
+    sha256 = "0lpwp5fzlf037bn03x1dldw8nfa5pyqi4qsqbscwn42idvs94mhx";
   };
 
-  cargoSha256 = "0l1yq9k6lyk0ww1nzk93axylgrwipkmmqh9r6fq4a31wjlblrkkb";
+  cargoSha256 = "1g5k6dkv0zznh8q359n7sg9wf0gcix6m36pg9ql8wi5hnlsvg1s1";
 
   nativeBuildInputs = [ python3 ];
 
diff --git a/pkgs/tools/system/plan9port/default.nix b/pkgs/tools/system/plan9port/default.nix
index db206fa0b3383..54e88f5d06994 100644
--- a/pkgs/tools/system/plan9port/default.nix
+++ b/pkgs/tools/system/plan9port/default.nix
@@ -11,17 +11,16 @@
 
 stdenv.mkDerivation {
   pname = "plan9port";
-  version = "2019-02-25";
+  version = "2020-01-08";
 
   src =  fetchFromGitHub {
     owner = "9fans";
     repo = "plan9port";
-    rev = "047fd921744f39a82a86d9370e03f7af511e6e84";
-    sha256 = "1lp17948q7vpl8rc2bf5a45bc8jqyj0s3zffmks9r25ai42vgb43";
+    rev = "cc3d97d52a72d7eaceb5b636bcdf81c3e19f7a2e";
+    sha256 = "0gb55kj0gzx1kdhiwcrbr7xcgz1im21dyxgxhfhh6d0q9rw0c17g";
   };
 
   patches = [
-    ./tmpdir.patch
     ./darwin-sw_vers.patch
     ./darwin-cfframework.patch
   ];
@@ -90,7 +89,7 @@ stdenv.mkDerivation {
     license = licenses.lpl-102;
     maintainers = with maintainers; [ AndersonTorres bbarker
                                       ftrvxmtrx kovirobi ];
-    platforms = platforms.unix;
+    platforms = remove "aarch64-linux" platforms.unix;
   };
 }
 # TODO: investigate the mouse chording support patch
diff --git a/pkgs/tools/system/plan9port/tmpdir.patch b/pkgs/tools/system/plan9port/tmpdir.patch
deleted file mode 100644
index e8200a177a274..0000000000000
--- a/pkgs/tools/system/plan9port/tmpdir.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From c762625549ff367b54bcd8281d1ce248a69b4401 Mon Sep 17 00:00:00 2001
-From: Jason Felice <jason.m.felice@gmail.com>
-Date: Mon, 1 Jul 2019 15:01:21 -0400
-Subject: [PATCH] Use $TMPDIR if available
-
-NixOS sandboxed builds (at least on Mac) don't have access to /tmp,
-and this should be better POSIX.
----
- bin/9c | 2 +-
- bin/9l | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/bin/9c b/bin/9c
-index 3ffb716c..88c47887 100755
---- a/bin/9c
-+++ b/bin/9c
-@@ -133,7 +133,7 @@ case "$tag" in
- esac
- 
- # N.B. Must use temp file to avoid pipe; pipe loses status.
--xtmp=/tmp/9c.$$.$USER.out
-+xtmp=${TMPDIR-/tmp}/9c.$$.$USER.out
- $cc -DPLAN9PORT -I$PLAN9/include $cflags "$@" 2>$xtmp
- status=$?
- quiet $xtmp
-diff --git a/bin/9l b/bin/9l
-index 6195815f..717a540a 100755
---- a/bin/9l
-+++ b/bin/9l
-@@ -346,7 +346,7 @@ then
- 	echo $ld -L$PLAN9/lib "$@" $libsl $extralibs $frameworks
- fi
- 
--xtmp=/tmp/9l.$$.$USER.out
-+xtmp="${TMPDIR-/tmp}/9l.$$.$USER.out"
- xxout() {
- 	sed 's/.*: In function `[^:]*: *//' $xtmp | egrep . | 
- 	egrep -v 'is (often|almost always) misused|is dangerous, better use|text-based stub' 
--- 
-2.21.0
-
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8d289c0101bfe..4b2b36eb352c8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -152,6 +152,7 @@ mapAliases ({
   gettextWithExpat = gettext; # 2016-02-19
   git-hub = gitAndTools.git-hub; # added 2016-04-29
   glib_networking = glib-networking; # added 2018-02-25
+  gmailieer = lieer; # added 2020-04-19
   gnome-mpv = celluloid; # added 2019-08-22
   gnome15 = throw "gnome15 has been removed from nixpkgs, as it's unmaintained and depends on deprecated libraries."; # added 2019-12-10
   gmic_krita_qt = gmic-qt-krita; # added 2019-09-07
@@ -215,6 +216,7 @@ mapAliases ({
   keymon = throw "keymon has been removed from nixpkgs, as it's abandoned and archived."; # 2019-12-10
   kvm = qemu_kvm; # added 2018-04-25
   latinmodern-math = lmmath;
+  ldc2 = ldc; # added 2020-04-18
   letsencrypt = certbot; # added 2016-05-16
   libaudit = audit; # added 2018-04-25
   libcanberra_gtk2 = libcanberra-gtk2; # added 2018-02-25
@@ -244,6 +246,8 @@ mapAliases ({
   librecad2 = librecad;  # backwards compatibility alias, added 2015-10
   libsysfs = sysfsutils; # added 2018-04-25
   libtidy = html-tidy;  # added 2014-12-21
+  libtxc_dxtn = throw "removed 2020-03-16, now integrated in Mesa";
+  libtxc_dxtn_s2tc = throw "removed 2020-03-16, now integrated in Mesa";
   libudev = udev; # added 2018-04-25
   libsexy = throw "libsexy has been removed from nixpkgs, as it's abandoned and no package needed it."; # 2019-12-10
   links = links2; # added 2016-01-31
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9d9de2aa011e7..34111cd69ec59 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2143,6 +2143,8 @@ in
 
   stagit = callPackage ../development/tools/stagit { };
 
+  statserial = callPackage ../tools/misc/statserial { };
+
   step-ca = callPackage ../tools/security/step-ca { };
 
   step-cli = callPackage ../tools/security/step-cli { };
@@ -6629,6 +6631,8 @@ in
 
   smugline = python3Packages.smugline;
 
+  sn0int = callPackage ../tools/security/sn0int { };
+
   snabb = callPackage ../tools/networking/snabb { } ;
 
   snapcast = callPackage ../applications/audio/snapcast { };
@@ -8400,6 +8404,28 @@ in
     inherit (gnome2) libart_lgpl;
   });
 
+  gnat = gnat9;
+
+  gnat6 = wrapCC (gcc6.cc.override {
+    name = "gnat";
+    langC = true;
+    langCC = false;
+    langAda = true;
+    profiledCompiler = false;
+    inherit gnatboot;
+  });
+
+  gnat9 = wrapCC (gcc9.cc.override {
+    name = "gnat";
+    langC = true;
+    langCC = false;
+    langAda = true;
+    profiledCompiler = false;
+    gnatboot = gnat6;
+  });
+
+  gnatboot = wrapCC (callPackage ../development/compilers/gnatboot { });
+
   gnu-smalltalk = callPackage ../development/compilers/gnu-smalltalk { };
 
   gccgo = gccgo6;
@@ -8411,6 +8437,16 @@ in
     profiledCompiler = false;
   });
 
+  ghdl = ghdl-mcode;
+
+  ghdl-mcode = callPackage ../development/compilers/ghdl {
+    backend = "mcode";
+  };
+
+  ghdl-llvm = callPackage ../development/compilers/ghdl {
+    backend = "llvm";
+  };
+
   gcl = callPackage ../development/compilers/gcl {
     gmp = gmp4;
   };
@@ -12648,9 +12684,7 @@ in
 
   libfakekey = callPackage ../development/libraries/libfakekey { };
 
-  libfido2 = callPackage ../development/libraries/libfido2 {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  libfido2 = callPackage ../development/libraries/libfido2 { };
 
   libfilezilla = callPackage ../development/libraries/libfilezilla { };
 
@@ -12995,6 +13029,7 @@ in
   libjcat = callPackage ../development/libraries/libjcat { };
 
   libjpeg_original = callPackage ../development/libraries/libjpeg { };
+  # also known as libturbojpeg
   libjpeg_turbo = callPackage ../development/libraries/libjpeg-turbo { };
   libjpeg_drop = callPackage ../development/libraries/libjpeg-drop { };
   libjpeg = libjpeg_turbo;
@@ -13276,10 +13311,6 @@ in
 
   libtsm = callPackage ../development/libraries/libtsm { };
 
-  libtxc_dxtn = callPackage ../development/libraries/libtxc_dxtn { };
-
-  libtxc_dxtn_s2tc = callPackage ../development/libraries/libtxc_dxtn_s2tc { };
-
   libgeotiff = callPackage ../development/libraries/libgeotiff { };
 
   libu2f-host = callPackage ../development/libraries/libu2f-host { };
@@ -15527,6 +15558,8 @@ in
 
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };
 
+  https-dns-proxy = callPackage ../servers/dns/https-dns-proxy { };
+
   hydron = callPackage ../servers/hydron { };
 
   icingaweb2 = callPackage ../servers/icingaweb2 { };
@@ -16473,8 +16506,6 @@ in
 
   gfxtablet = callPackage ../os-specific/linux/gfxtablet {};
 
-  gmailieer = callPackage ../applications/networking/gmailieer {};
-
   gmailctl = callPackage ../applications/networking/gmailctl {};
 
   gpm = callPackage ../servers/gpm {
@@ -16581,6 +16612,8 @@ in
 
   libnl = callPackage ../os-specific/linux/libnl { };
 
+  lieer = callPackage ../applications/networking/lieer {};
+
   linuxConsoleTools = callPackage ../os-specific/linux/consoletools { };
 
   openelec-dvb-firmware = callPackage ../os-specific/linux/firmware/openelec-dvb-firmware { };
@@ -18542,6 +18575,8 @@ in
 
   aesop = callPackage ../applications/office/aesop { };
 
+  AusweisApp2 = libsForQt5.callPackage ../applications/misc/ausweisapp2 { };
+
   avidemux = libsForQt5.callPackage ../applications/video/avidemux { };
 
   avrdudess = callPackage ../applications/misc/avrdudess { };
@@ -19856,6 +19891,7 @@ in
   hugo = callPackage ../applications/misc/hugo { };
 
   hydrogen = callPackage ../applications/audio/hydrogen { };
+  hydrogen-unstable = qt5.callPackage ../applications/audio/hydrogen/unstable.nix { };
 
   hydroxide = callPackage ../applications/networking/hydroxide { };
 
@@ -21439,6 +21475,8 @@ in
 
   qtchan = libsForQt5.callPackage ../applications/networking/browsers/qtchan { };
 
+  qtemu = libsForQt5.callPackage ../applications/virtualization/qtemu { };
+
   qtox = libsForQt5.callPackage ../applications/networking/instant-messengers/qtox { };
 
   qtpass = libsForQt5.callPackage ../applications/misc/qtpass { };
@@ -25841,7 +25879,9 @@ in
 
   sanoid = callPackage ../tools/backup/sanoid { };
 
-  satysfi = callPackage ../tools/typesetting/satysfi { };
+  satysfi = callPackage ../tools/typesetting/satysfi {
+    ocamlPackages = ocaml-ng.ocamlPackages_4_07;
+  };
 
   sc-controller = pythonPackages.callPackage ../misc/drivers/sc-controller {
     inherit libusb1; # Shadow python.pkgs.libusb1.
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index b976d36c73094..b5d8abade0909 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -234,6 +234,8 @@ let
 
     dune_2 = callPackage ../development/tools/ocaml/dune/2.nix { };
 
+    dune-build-info = callPackage ../development/ocaml-modules/dune-build-info { };
+
     dune-configurator = callPackage ../development/ocaml-modules/dune-configurator { };
 
     dune-private-libs = callPackage ../development/ocaml-modules/dune-private-libs { };
@@ -978,12 +980,20 @@ let
     # Jane Street
 
     janePackage =
-      if lib.versionOlder "4.07" ocaml.version
+      if lib.versionOlder "4.08" ocaml.version
+      then callPackage ../development/ocaml-modules/janestreet/janePackage_0_13.nix {}
+      else if lib.versionOlder "4.07" ocaml.version
       then callPackage ../development/ocaml-modules/janestreet/janePackage_0_12.nix {}
       else callPackage ../development/ocaml-modules/janestreet/janePackage.nix {};
 
     janeStreet =
-    if lib.versionOlder "4.07" ocaml.version
+    if lib.versionOlder "4.08" ocaml.version
+    then import ../development/ocaml-modules/janestreet/0.13.nix {
+      inherit ctypes janePackage num octavius re;
+      inherit (pkgs) openssl;
+      ppxlib = ppxlib.override { version = "0.12.0"; };
+    }
+    else if lib.versionOlder "4.07" ocaml.version
     then import ../development/ocaml-modules/janestreet/0.12.nix {
       inherit ctypes janePackage num octavius ppxlib re;
       inherit (pkgs) openssl;
@@ -1232,11 +1242,6 @@ let
       then callPackage ../development/ocaml-modules/janestreet/async.nix {}
       else async_p4;
 
-    async_ssl =
-      if lib.versionOlder "4.03" ocaml.version
-      then janeStreet.async_ssl
-      else callPackage ../development/ocaml-modules/janestreet/async_ssl.nix { };
-
     # Apps / from all-packages
 
     ocamlnat = callPackage  ../development/ocaml-modules/ocamlnat { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d3e9ca144fc34..27b7f852707d7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -21094,12 +21094,13 @@ let
 
   XMLParser = buildPerlPackage {
     pname = "XML-Parser";
-    version = "2.44";
+    version = "2.46";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TODDR/XML-Parser-2.44.tar.gz";
-      sha256 = "05ij0g6bfn27iaggxf8nl5rhlwx6f6p6xmdav6rjcly3x5zd1s8s";
+      url = "mirror://cpan/authors/id/T/TO/TODDR/XML-Parser-2.46.tar.gz";
+      sha256 = "0pai3ik47q7rgnix9644c673fwydz52gqkxr9kxwq765j4j36cfk";
     };
-    patchPhase = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    patches = [ ../development/perl-modules/xml-parser-0001-HACK-Assumes-Expat-paths-are-good.patch ];
+    postPatch = stdenv.lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
       substituteInPlace Expat/Makefile.PL --replace 'use English;' '#'
     '' + stdenv.lib.optionalString stdenv.isCygwin ''
       sed -i"" -e "s@my \$compiler = File::Spec->catfile(\$path, \$cc\[0\]) \. \$Config{_exe};@my \$compiler = File::Spec->catfile(\$path, \$cc\[0\]) \. (\$^O eq 'cygwin' ? \"\" : \$Config{_exe});@" inc/Devel/CheckLib.pm
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6a8c5a3d56a84..cb5cbb5375a7d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4378,7 +4378,10 @@ in {
 
   maya = callPackage ../development/python-modules/maya { };
 
-  mayavi = callPackage ../development/python-modules/mayavi { };
+  mayavi = pkgs.libsForQt5.callPackage ../development/python-modules/mayavi {
+    inherit buildPythonPackage isPy27 fetchPypi;
+    inherit (self) pyface pygments numpy vtk traitsui envisage apptools pyqt5;
+  };
 
   mccabe = callPackage ../development/python-modules/mccabe { };
 
diff --git a/pkgs/top-level/unix-tools.nix b/pkgs/top-level/unix-tools.nix
index 56bab2fe41166..cdad9de61f41b 100644
--- a/pkgs/top-level/unix-tools.nix
+++ b/pkgs/top-level/unix-tools.nix
@@ -66,12 +66,12 @@ let
       linux = pkgs.utillinux;
     };
     getconf = {
-      linux = if stdenv.hostPlatform.libc == "glibc" then pkgs.glibc
+      linux = if stdenv.hostPlatform.libc == "glibc" then pkgs.stdenv.cc.libc
               else pkgs.netbsd.getconf;
       darwin = pkgs.darwin.system_cmds;
     };
     getent = {
-      linux = if stdenv.hostPlatform.libc == "glibc" then pkgs.glibc
+      linux = if stdenv.hostPlatform.libc == "glibc" then pkgs.stdenv.cc.libc
               else pkgs.netbsd.getent;
       darwin = pkgs.netbsd.getent;
     };