about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/default.nix1
-rw-r--r--lib/deprecated.nix4
-rw-r--r--maintainers/maintainer-list.nix15
-rw-r--r--nixos/modules/installer/tools/nix-fallback-paths.nix8
-rw-r--r--nixos/modules/services/backup/borgbackup.nix3
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/docker-tools.nix1
-rw-r--r--nixos/tests/kerberos/default.nix8
-rw-r--r--nixos/tests/nexus.nix2
-rw-r--r--pkgs/applications/editors/emacs-modes/melpa-packages.nix6
-rw-r--r--pkgs/applications/editors/neovim/qt.nix4
-rw-r--r--pkgs/applications/editors/vscode/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/openshift/default.nix25
-rw-r--r--pkgs/applications/networking/gns3/server.nix64
-rw-r--r--pkgs/applications/networking/mailreaders/claws-mail/default.nix4
-rw-r--r--pkgs/applications/networking/omping/default.nix35
-rw-r--r--pkgs/applications/science/biology/bftools/default.nix41
-rw-r--r--pkgs/applications/science/electronics/ngspice/default.nix9
-rw-r--r--pkgs/applications/science/misc/root/5.nix7
-rw-r--r--pkgs/applications/science/misc/root/default.nix4
-rw-r--r--pkgs/applications/version-management/git-and-tools/grv/default.nix4
-rw-r--r--pkgs/applications/video/handbrake/default.nix85
-rw-r--r--pkgs/applications/video/obs-studio/default.nix6
-rw-r--r--pkgs/applications/video/qmediathekview/default.nix7
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix42
-rw-r--r--pkgs/applications/virtualization/docker/default.nix4
-rw-r--r--pkgs/build-support/docker/default.nix13
-rw-r--r--pkgs/build-support/docker/examples.nix1
-rw-r--r--pkgs/data/fonts/culmus/default.nix19
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-system-log/default.nix35
-rw-r--r--pkgs/desktops/gnome-3/default.nix4
-rw-r--r--pkgs/development/compilers/clasp/default.nix105
-rw-r--r--pkgs/development/compilers/dmd/default.nix64
-rw-r--r--pkgs/development/compilers/gcc-arm-embedded/8/default.nix39
-rw-r--r--pkgs/development/coq-modules/category-theory/default.nix2
-rw-r--r--pkgs/development/interpreters/clojure/default.nix4
-rw-r--r--pkgs/development/interpreters/php/default.nix8
-rw-r--r--pkgs/development/interpreters/tinyscheme/default.nix33
-rw-r--r--pkgs/development/libraries/boehm-gc/default.nix3
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix4
-rw-r--r--pkgs/development/libraries/git2/0.27.nix36
-rw-r--r--pkgs/development/libraries/git2/default.nix17
-rw-r--r--pkgs/development/libraries/gstreamer/ges/default.nix4
-rw-r--r--pkgs/development/libraries/gtk+/3.x.nix7
-rw-r--r--pkgs/development/libraries/libmediaart/default.nix4
-rw-r--r--pkgs/development/libraries/libngspice/default.nix9
-rw-r--r--pkgs/development/libraries/libnice/default.nix3
-rw-r--r--pkgs/development/libraries/mps/default.nix5
-rw-r--r--pkgs/development/libraries/nv-codec-headers/default.nix (renamed from pkgs/development/libraries/ffmpeg-full/nv-codec-headers.nix)8
-rw-r--r--pkgs/development/libraries/openwsman/default.nix6
-rw-r--r--pkgs/development/libraries/physics/hoppet/default.nix7
-rw-r--r--pkgs/development/libraries/termbox/default.nix13
-rw-r--r--pkgs/development/ocaml-modules/resource-pooling/default.nix35
-rw-r--r--pkgs/development/python-modules/aiohttp/default.nix26
-rw-r--r--pkgs/development/python-modules/cachy/default.nix33
-rw-r--r--pkgs/development/python-modules/cleo/default.nix30
-rw-r--r--pkgs/development/python-modules/clikit/default.nix30
-rw-r--r--pkgs/development/python-modules/fido2/default.nix11
-rw-r--r--pkgs/development/python-modules/google-i18n-address/default.nix22
-rw-r--r--pkgs/development/python-modules/hpack/default.nix5
-rw-r--r--pkgs/development/python-modules/mt-940/default.nix8
-rw-r--r--pkgs/development/python-modules/multidict/default.nix4
-rw-r--r--pkgs/development/python-modules/nipype/default.nix32
-rw-r--r--pkgs/development/python-modules/nipype/move-uneeded-requires.patch31
-rw-r--r--pkgs/development/python-modules/nipype/neurdflib.nix38
-rw-r--r--pkgs/development/python-modules/nipype/prov-version.patch21
-rw-r--r--pkgs/development/python-modules/pastel/default.nix26
-rw-r--r--pkgs/development/python-modules/piep/default.nix8
-rw-r--r--pkgs/development/python-modules/pika-pool/default.nix4
-rw-r--r--pkgs/development/python-modules/poetry/default.nix76
-rw-r--r--pkgs/development/python-modules/poetry/jsonschema.nix37
-rw-r--r--pkgs/development/python-modules/py3status/default.nix4
-rw-r--r--pkgs/development/python-modules/pycassa/default.nix15
-rw-r--r--pkgs/development/python-modules/pygit2/default.nix6
-rw-r--r--pkgs/development/python-modules/pylev/default.nix24
-rw-r--r--pkgs/development/python-modules/pyrsistent/default.nix9
-rw-r--r--pkgs/development/python-modules/pyrsistent/no-setup-requires-pytestrunner.patch15
-rw-r--r--pkgs/development/python-modules/scapy/default.nix4
-rw-r--r--pkgs/development/python-modules/thrift/default.nix3
-rw-r--r--pkgs/development/python-modules/tinycss/default.nix12
-rw-r--r--pkgs/development/python-modules/tomlkit/default.nix29
-rw-r--r--pkgs/development/python-modules/xml2rfc/default.nix19
-rw-r--r--pkgs/development/python-modules/xvfbwrapper/default.nix3
-rw-r--r--pkgs/development/tools/build-managers/bazel/default.nix53
-rw-r--r--pkgs/development/tools/build-managers/dub/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/leiningen/default.nix6
-rw-r--r--pkgs/development/tools/build-managers/scons/default.nix4
-rw-r--r--pkgs/development/tools/dtools/default.nix4
-rw-r--r--pkgs/development/tools/hcloud/default.nix4
-rw-r--r--pkgs/development/tools/hcloud/deps.nix24
-rw-r--r--pkgs/development/tools/icestorm/default.nix33
-rw-r--r--pkgs/development/tools/literate-programming/Literate/default.nix6
-rw-r--r--pkgs/development/tools/profiling/systemtap/default.nix4
-rw-r--r--pkgs/development/tools/repository-managers/nexus/default.nix6
-rw-r--r--pkgs/development/tools/rubocop/Gemfile.lock12
-rw-r--r--pkgs/development/tools/rubocop/gemset.nix30
-rw-r--r--pkgs/development/tools/rust/bindgen/default.nix6
-rw-r--r--pkgs/development/tools/rust/rustfmt/default.nix21
-rw-r--r--pkgs/development/tools/yarn/default.nix4
-rw-r--r--pkgs/games/openra/common.nix87
-rw-r--r--pkgs/games/openra/default.nix129
-rw-r--r--pkgs/games/openra/engine.nix60
-rw-r--r--pkgs/games/openra/engines.nix41
-rw-r--r--pkgs/games/openra/mkdirp.sh4
-rw-r--r--pkgs/games/openra/mod-launch-game.sh25
-rw-r--r--pkgs/games/openra/mod.nix104
-rw-r--r--pkgs/games/openra/mods.nix339
-rw-r--r--pkgs/games/openra/openra-mod.desktop11
-rw-r--r--pkgs/games/openra/packages.nix60
-rw-r--r--pkgs/misc/emulators/wine/sources.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/hardened-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix18
-rw-r--r--pkgs/os-specific/linux/kernel/randstruct-provide-seed.patch12
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/generic.nix2
-rw-r--r--pkgs/os-specific/linux/nvme-cli/default.nix4
-rw-r--r--pkgs/os-specific/linux/powertop/default.nix8
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix2
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix10
-rw-r--r--pkgs/servers/home-assistant/appdaemon.nix3
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix17
-rw-r--r--pkgs/servers/home-assistant/default.nix8
-rw-r--r--pkgs/servers/home-assistant/frontend.nix4
-rw-r--r--pkgs/servers/http/lighttpd/default.nix2
-rw-r--r--pkgs/servers/http/nginx/mainline.nix4
-rw-r--r--pkgs/servers/matrix-synapse/default.nix4
-rw-r--r--pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix9
-rw-r--r--pkgs/servers/monitoring/prometheus/node-exporter.nix6
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix2
-rw-r--r--pkgs/tools/misc/bonfire/default.nix3
-rw-r--r--pkgs/tools/misc/cht.sh/default.nix39
-rw-r--r--pkgs/tools/misc/hexyl/default.nix8
-rw-r--r--pkgs/tools/misc/neofetch/default.nix4
-rw-r--r--pkgs/tools/networking/ubridge/default.nix40
-rw-r--r--pkgs/tools/package-management/nix/default.nix10
-rw-r--r--pkgs/tools/package-management/nixops/generic.nix10
-rw-r--r--pkgs/tools/security/tor/default.nix8
-rw-r--r--pkgs/top-level/all-packages.nix37
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix16
139 files changed, 2283 insertions, 573 deletions
diff --git a/lib/default.nix b/lib/default.nix
index 025df167c6059..40116063bf248 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -132,6 +132,7 @@ let
       mergeAttrsWithFunc mergeAttrsConcatenateValues
       mergeAttrsNoOverride mergeAttrByFunc mergeAttrsByFuncDefaults
       mergeAttrsByFuncDefaultsClean mergeAttrBy
+      fakeSha256 fakeSha512
       nixType imap;
   });
 in lib
diff --git a/lib/deprecated.nix b/lib/deprecated.nix
index 5a3a97c476dca..15de504566128 100644
--- a/lib/deprecated.nix
+++ b/lib/deprecated.nix
@@ -270,4 +270,8 @@ rec {
      starting at zero.
   */
   imap = imap1;
+
+  # Fake hashes. Can be used as hash placeholders, when computing hash ahead isn't trivial
+  fakeSha256 = "0000000000000000000000000000000000000000000000000000000000000000";
+  fakeSha512 = "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d92e4fc038803..c1b2345b1d744 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -475,6 +475,11 @@
     github = "bandresen";
     name = "Benjamin Andresen";
   };
+  baracoder = {
+    email = "baracoder@googlemail.com";
+    github = "baracoder";
+    name = "Herman Fries";
+  };
   barrucadu = {
     email = "mike@barrucadu.co.uk";
     github = "barrucadu";
@@ -1953,6 +1958,11 @@
     github = "jakelogemann";
     name = "Jake Logemann";
   };
+  jakewaksbaum = {
+    email = "jake.waksbaum@gmail.com";
+    github = "jbaum98";
+    name = "Jake Waksbaum";
+  };
   jammerful = {
     email = "jammerful@gmail.com";
     github = "jammerful";
@@ -4356,6 +4366,11 @@
     github = "tazjin";
     name = "Vincent Ambo";
   };
+  tbenst = {
+    email = "nix@tylerbenster.com";
+    github = "tbenst";
+    name = "Tyler Benster";
+  };
   teh = {
     email = "tehunger@gmail.com";
     github = "teh";
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 1cfc8ff8612e0..5d431df4b114c 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,6 +1,6 @@
 {
-  x86_64-linux = "/nix/store/cdcia67siabmj6li7vyffgv2cry86fq8-nix-2.1.3";
-  i686-linux = "/nix/store/6q3xi6y5qnsv7d62b8n00hqfxi8rs2xs-nix-2.1.3";
-  aarch64-linux = "/nix/store/2v93d0vimlm28jg0ms6v1i6lc0fq13pn-nix-2.1.3";
-  x86_64-darwin = "/nix/store/dkjlfkrknmxbjmpfk3dg4q3nmb7m3zvk-nix-2.1.3";
+  x86_64-linux = "/nix/store/pid1yakjasch4pwl63nzbj22z9zf0q26-nix-2.2";
+  i686-linux = "/nix/store/qpkl0cxy0xh4h432lv2qsjrmhvx5x2vy-nix-2.2";
+  aarch64-linux = "/nix/store/0jg7h94x986d8cskg6gcfza9x67spdbp-nix-2.2";
+  x86_64-darwin = "/nix/store/a48whqkmxnsfhwbk6nay74iyc1cf0lr2-nix-2.2";
 }
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index bf41aee8fe0e9..2ad116a7872ad 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -191,10 +191,9 @@ in {
         options = {
 
           paths = mkOption {
-            type = with types; either path (listOf str);
+            type = with types; coercedTo str lib.singleton (listOf str);
             description = "Path(s) to back up.";
             example = "/home/user";
-            apply = x: if isList x then x else [ x ];
           };
 
           repo = mkOption {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 7bd7df9b177f1..9ee8ac2995bea 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -109,7 +109,7 @@ in
   ipv6 = handleTest ./ipv6.nix {};
   jenkins = handleTest ./jenkins.nix {};
   #kafka = handleTest ./kafka.nix {}; # broken since openjdk: 8u181 -> 8u192
-  kerberos = handleTest tests/kerberos/default.nix {};
+  kerberos = handleTest ./kerberos/default.nix {};
   kernel-latest = handleTest ./kernel-latest.nix {};
   kernel-lts = handleTest ./kernel-lts.nix {};
   keymap = handleTest ./keymap.nix {};
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index ecd14b274eb3d..58f106314ab3f 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -62,6 +62,7 @@ import ./make-test.nix ({ pkgs, ... }: {
       # Ensure Layered Docker images work
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.layered-image}'");
       $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.layered-image.imageName}");
+      $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.layered-image.imageName} cat extraCommands");
 
       # Ensure building an image on top of a layered Docker images work
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.layered-on-top}'");
diff --git a/nixos/tests/kerberos/default.nix b/nixos/tests/kerberos/default.nix
index ae8bdb8bbc82c..f2f1a438918c0 100644
--- a/nixos/tests/kerberos/default.nix
+++ b/nixos/tests/kerberos/default.nix
@@ -1,5 +1,7 @@
-{ system ? builtins.currentSystem }:
+{ system ? builtins.currentSystem
+, pkgs ? import ../../.. { inherit system; }
+}:
 {
-  mit = import ./mit.nix { inherit system; };
-  heimdal = import ./heimdal.nix { inherit system; };
+  mit = import ./mit.nix { inherit system pkgs; };
+  heimdal = import ./heimdal.nix { inherit system pkgs; };
 }
diff --git a/nixos/tests/nexus.nix b/nixos/tests/nexus.nix
index bf49d2247bd86..783c9f5c019ff 100644
--- a/nixos/tests/nexus.nix
+++ b/nixos/tests/nexus.nix
@@ -14,7 +14,7 @@ import ./make-test.nix ({ pkgs, ...} : {
     server =
       { ... }:
       { virtualisation.memorySize = 2047; # qemu-system-i386 has a 2047M limit
-        virtualisation.diskSize = 2048;
+        virtualisation.diskSize = 8192;
 
         services.nexus.enable = true;
       };
diff --git a/pkgs/applications/editors/emacs-modes/melpa-packages.nix b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
index b95a944e612ba..7c15316849684 100644
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@@ -89,6 +89,12 @@ self:
       # Expects bash to be at /bin/bash
       flycheck-rtags = markBroken super.flycheck-rtags;
 
+      forge = super.forge.overrideAttrs (attrs: {
+        # searches for Git at build time
+        nativeBuildInputs =
+          (attrs.nativeBuildInputs or []) ++ [ external.git ];
+      });
+
       # build timeout
       graphene = markBroken super.graphene;
 
diff --git a/pkgs/applications/editors/neovim/qt.nix b/pkgs/applications/editors/neovim/qt.nix
index d562557ae0055..3004bf544c42c 100644
--- a/pkgs/applications/editors/neovim/qt.nix
+++ b/pkgs/applications/editors/neovim/qt.nix
@@ -58,6 +58,10 @@ in
     '' else ''
       makeWrapper '${unwrapped}/bin/nvim-qt' "$out/bin/nvim-qt" \
         --prefix PATH : "${neovim}/bin"
+
+      # link .desktop file
+      mkdir -p "$out/share"
+      ln -s '${unwrapped}/share/applications' "$out/share/applications"
     '';
 
     preferLocalBuild = true;
diff --git a/pkgs/applications/editors/vscode/default.nix b/pkgs/applications/editors/vscode/default.nix
index 167a8fe7b706f..b38b357126fa1 100644
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@@ -12,9 +12,9 @@ let
   }.${stdenv.hostPlatform.system};
 
   sha256 = {
-    "i686-linux" = "1xadkgqfwsl53blm2f0kdvczwmag47585dswa1hpafzc8i86009b";
-    "x86_64-linux" = "0h77kc6z9c5bkkb8svjxjabnbbv0lb835kzd1c2yypamkhag9j4a";
-    "x86_64-darwin" = "1f8grgav5capd2mm1nx0416na8c6qjh91680cfvf1jh4pjihs6g4";
+    "i686-linux" = "1g73fay6fxlqhalkqq5m6rjbp68k9npk0rrxrkhdj8mw0cz74dpm";
+    "x86_64-linux" = "0mil8n5i2ajdyrgq862wq59ajy2122rvvn7m7mxq4ab92sk26rix";
+    "x86_64-darwin" = "07r52scs1sgafzxqal39r8vf9p9qqvwwx8f6z09gqcf6clr6k48q";
   }.${stdenv.hostPlatform.system};
 
   archive_fmt = if stdenv.hostPlatform.system == "x86_64-darwin" then "zip" else "tar.gz";
@@ -31,7 +31,7 @@ let
 in
   stdenv.mkDerivation rec {
     name = "vscode-${version}";
-    version = "1.30.1";
+    version = "1.30.2";
 
     src = fetchurl {
       name = "VSCode_${version}_${plat}.${archive_fmt}";
diff --git a/pkgs/applications/networking/cluster/openshift/default.nix b/pkgs/applications/networking/cluster/openshift/default.nix
index a34c728da168a..f730329d07251 100644
--- a/pkgs/applications/networking/cluster/openshift/default.nix
+++ b/pkgs/applications/networking/cluster/openshift/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, removeReferencesTo, which, go, go-bindata, makeWrapper, rsync, utillinux
+{ stdenv, lib, fetchFromGitHub, buildGoPackage, which, go-bindata, rsync, utillinux
 , coreutils, kerberos, clang
 , components ? [
   "cmd/oc"
@@ -20,7 +20,7 @@ let
   k8sgitcommit = "b1b2997";
   k8sgitMajor = "0";
   k8sgitMinor = "1";
-in stdenv.mkDerivation rec {
+in buildGoPackage rec {
   name = "openshift-origin-${version}";
   inherit version;
 
@@ -29,13 +29,13 @@ in stdenv.mkDerivation rec {
     repo = "origin";
     rev = "v${version}";
     sha256 = "06q4v2a1mm6c659ab0rzkqz6b66vx4avqfg0s9xckwhq420lzgka";
-};
+  };
+
+  goPackagePath = "github.com/openshift/origin";
 
   # go > 1.10
   # [FATAL] [14:44:02+0000] Please install Go version go or use PERMISSIVE_GO=y to bypass this check.
-  buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata kerberos clang ];
-
-  outputs = [ "out" ];
+  buildInputs = [ which rsync go-bindata kerberos clang ];
 
   patchPhase = ''
     patchShebangs ./hack
@@ -54,6 +54,7 @@ in stdenv.mkDerivation rec {
   '';
 
   buildPhase = ''
+    cd go/src/${goPackagePath}
     # Openshift build require this variables to be set
     # unless there is a .git folder which is not the case with fetchFromGitHub
     echo "OS_GIT_VERSION=v${version}" >> os-version-defs
@@ -71,14 +72,10 @@ in stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mkdir -p "$out/bin"
-    cp -a "_output/local/bin/$(go env GOOS)/$(go env GOARCH)/"* "$out/bin/"
-    install -D -t "$out/etc/bash_completion.d" contrib/completions/bash/*
-    install -D -t "$out/share/zsh/site-functions" contrib/completions/zsh/*
-  '';
-
-  preFixup = ''
-    find $out/bin -type f -exec remove-references-to -t ${go} '{}' +
+    mkdir -p $bin/bin
+    cp -a "_output/local/bin/$(go env GOOS)/$(go env GOARCH)/"* "$bin/bin/"
+    install -D -t "$bin/etc/bash_completion.d" contrib/completions/bash/*
+    install -D -t "$bin/share/zsh/site-functions" contrib/completions/zsh/*
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
index 24e641abc8268..4d3a8ca87e56f 100644
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@@ -1,63 +1,54 @@
 { stable, branch, version, sha256Hash }:
 
-{ stdenv, python36Packages, fetchFromGitHub, fetchurl }:
+{ stdenv, python36, fetchFromGitHub }:
 
 let
-  pythonPackages = python36Packages;
-  async-timeout = pythonPackages.async-timeout.overrideAttrs
-    (oldAttrs:
-      rec {
-        pname = "async-timeout";
+  python = python36.override {
+    packageOverrides = self: super: {
+      async-timeout = super.async-timeout.overridePythonAttrs (oldAttrs: rec {
         version = "2.0.1";
-        src = pythonPackages.fetchPypi {
-          inherit pname version;
+        src = oldAttrs.src.override {
+          inherit version;
           sha256 = "1l3kg062m02mph6rf9rdv8r5c5n356clxa6b6mrn0i77vk9g9kq0";
         };
       });
-  aiohttp = pythonPackages.aiohttp.overrideAttrs
-    (oldAttrs:
-      rec {
-        pname = "aiohttp";
+      aiohttp = super.aiohttp.overridePythonAttrs (oldAttrs: rec {
         version = "2.3.10";
-        src = pythonPackages.fetchPypi {
-          inherit pname version;
+        src = oldAttrs.src.override {
+          inherit version;
           sha256 = "8adda6583ba438a4c70693374e10b60168663ffa6564c5c75d3c7a9055290964";
         };
-        propagatedBuildInputs = [ async-timeout ]
-          ++ (with pythonPackages; [ attrs chardet multidict yarl idna-ssl ]);
+        propagatedBuildInputs = with self; [ async-timeout attrs chardet multidict yarl idna-ssl ];
+        doCheck = false;
       });
-  aiohttp-cors = pythonPackages.aiohttp-cors.overrideAttrs
-    (oldAttrs:
-      rec {
-        pname = "aiohttp-cors";
+      aiohttp-cors = super.aiohttp-cors.overridePythonAttrs (oldAttrs: rec {
         version = "0.5.3";
-        name = "${pname}-${version}";
-        src = pythonPackages.fetchPypi {
-          inherit pname version;
+        src = oldAttrs.src.override {
+          inherit version;
           sha256 = "11b51mhr7wjfiikvj3nc5s8c7miin2zdhl3yrzcga4mbpkj892in";
         };
-        propagatedBuildInputs = [ aiohttp ]
-          ++ stdenv.lib.optional
-               (pythonPackages.pythonOlder "3.5")
-               pythonPackages.typing;
+        propagatedBuildInputs = with self; [ aiohttp ]
+          ++ stdenv.lib.optional (pythonOlder "3.5") typing;
       });
-in pythonPackages.buildPythonPackage rec {
-  name = "${pname}-${version}";
+    };
+  };
+
+in python.pkgs.buildPythonPackage {
   pname = "gns3-server";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "GNS3";
-    repo = pname;
+    repo = "gns3-server";
     rev = "v${version}";
     sha256 = sha256Hash;
   };
 
-  propagatedBuildInputs = [ aiohttp-cors ]
-    ++ (with pythonPackages; [
-      yarl aiohttp multidict
-      jinja2 psutil zipstream raven jsonschema typing
-      (pythonPackages.callPackage ../../../development/python-modules/prompt_toolkit/1.nix {})
-    ]);
+  propagatedBuildInputs = with python.pkgs; [
+    aiohttp-cors yarl aiohttp multidict
+    jinja2 psutil zipstream raven jsonschema typing
+    (python.pkgs.callPackage ../../../development/python-modules/prompt_toolkit/1.nix {})
+  ];
 
   # Requires network access
   doCheck = false;
@@ -65,6 +56,7 @@ in pythonPackages.buildPythonPackage rec {
   postInstall = ''
     rm $out/bin/gns3loopback # For Windows only
   '';
+
   meta = with stdenv.lib; {
     description = "Graphical Network Simulator 3 server (${branch} release)";
     longDescription = ''
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index a783cb2af3f89..47a104b252c3f 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -31,11 +31,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "claws-mail-${version}";
-  version = "3.17.2";
+  version = "3.17.3";
 
   src = fetchurl {
     url = "http://www.claws-mail.org/download.php?file=releases/claws-mail-${version}.tar.xz";
-    sha256 = "1hb17kpvfl8f1y49zan0wvf4awapxg13bqbqwrbhq2n4xp445kr5";
+    sha256 = "1wnj6c9cbmhphs2l6wfvndkk2g08rmxw0sl2c8k1k008dxd1ykjh";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/networking/omping/default.nix b/pkgs/applications/networking/omping/default.nix
new file mode 100644
index 0000000000000..1e127c1b1ec22
--- /dev/null
+++ b/pkgs/applications/networking/omping/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, fetchpatch }:
+
+stdenv.mkDerivation rec {
+  name = "omping-${version}";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner  = "troglobit";
+    repo   = "omping";
+    rev    = version;
+    sha256 = "1f0vsbnhxp7bbgdnfqshryx3nhz2sqdnxdj068s0nmzsh53ckbf7";
+  };
+
+  patches = [
+    # This can go in 0.0.6+
+    (fetchpatch {
+      url    = "https://github.com/troglobit/omping/commit/08a31ec1a6eb4e8f88c301ef679c3b6f9893f333.patch";
+      sha256 = "1xafyvd46bq53w2zvjw8bdw7vjqbrcrr21cyh6d0zfcn4gif1k0f";
+      name   = "fix_manpage_install.patch";
+    })
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Open Multicast Ping (omping) is a tool for testing IPv4/IPv6 multicast connectivity on a LAN.";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    inherit (src.meta) homepage;
+  };
+}
diff --git a/pkgs/applications/science/biology/bftools/default.nix b/pkgs/applications/science/biology/bftools/default.nix
new file mode 100644
index 0000000000000..24a6e052df9ef
--- /dev/null
+++ b/pkgs/applications/science/biology/bftools/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, lib, makeWrapper, fetchzip, jre }:
+
+stdenv.mkDerivation rec {
+  name = "bftools-${version}";
+  version = "5.9.2";
+
+  src = fetchzip {
+    url = "http://downloads.openmicroscopy.org/bio-formats/${version}/artifacts/bftools.zip";
+    sha256 = "08lmbg3kfxh17q6548il0i2h3f9a6ch8r0r067p14dajhzfpjyqj";
+  };
+
+  installPhase = ''
+    find . -maxdepth 1 -perm -111 -type f -not -name "*.sh" \
+      -exec install -vD {} "$out"/bin/{} \;
+
+    mkdir $out/libexec
+    mkdir -p $out/share/java
+
+    cp ./*.sh $out/libexec
+    cp ./*.jar $out/share/java
+
+    for file in $out/bin/*; do
+      substituteInPlace $file --replace "\$BF_DIR" $out/libexec
+    done
+    substituteInPlace $out/libexec/bf.sh --replace "\$BF_JAR_DIR" $out/share/java
+  '';
+
+  postFixup = ''
+    wrapProgram $out/libexec/bf.sh --prefix PATH : "${lib.makeBinPath [ jre ]}"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  meta = with stdenv.lib; {
+    description = "A bundle of scripts for using Bio-Formats on the command line with bioformats_package.jar already included";
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    homepage = https://www.openmicroscopy.org/bio-formats/;
+    maintainers = [ maintainers.tbenst ];
+  };
+}
diff --git a/pkgs/applications/science/electronics/ngspice/default.nix b/pkgs/applications/science/electronics/ngspice/default.nix
index 4777c89e876b5..194804a21a673 100644
--- a/pkgs/applications/science/electronics/ngspice/default.nix
+++ b/pkgs/applications/science/electronics/ngspice/default.nix
@@ -1,12 +1,13 @@
 {stdenv, fetchurl, bison, flex
 , readline, libX11, libICE, libXaw, libXmu, libXext, libXt, fftw }:
 
-stdenv.mkDerivation {
-  name = "ngspice-29";
+stdenv.mkDerivation rec {
+  name = "ngspice-${version}";
+  version = "30";
 
   src = fetchurl {
-    url = "mirror://sourceforge/ngspice/ngspice-29.tar.gz";
-    sha256 = "0jjwz73naq7l9yhwdqbpnrfckywp2ffkppivxjv8w92zq7xhyvcd";
+    url = "mirror://sourceforge/ngspice/ngspice-${version}.tar.gz";
+    sha256 = "15v0jdfy2a2zxp8dmy04fdp7w7a4vwvffcwa688r81b86wphxzh8";
   };
 
   nativeBuildInputs = [ flex bison ];
diff --git a/pkgs/applications/science/misc/root/5.nix b/pkgs/applications/science/misc/root/5.nix
index 7f43dfb328a88..1f0fc663647aa 100644
--- a/pkgs/applications/science/misc/root/5.nix
+++ b/pkgs/applications/science/misc/root/5.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, cmake, pcre, pkgconfig, python2
 , libX11, libXpm, libXft, libXext, libGLU_combined, zlib, libxml2, lzma, gsl_1
-, Cocoa, OpenGL, noSplash ? false }:
+, Cocoa, OpenGL, cf-private, noSplash ? false }:
 
 stdenv.mkDerivation rec {
   name = "root-${version}";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake pcre python2 zlib libxml2 lzma gsl_1 ]
     ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU_combined ]
-    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
+    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL cf-private ]
     ;
 
   patches = [
@@ -73,5 +73,8 @@ stdenv.mkDerivation rec {
     description = "A data analysis framework";
     platforms = platforms.unix;
     maintainers = with maintainers; [ veprbl ];
+    # needs to be adapted to work with modern glibc
+    # it works on darwin by impurely picking up system's libc headers
+    broken = stdenv.isLinux;
   };
 }
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 2ec1ded68a269..8b9573ce4e8ba 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, cmake, pcre, pkgconfig, python2
 , libX11, libXpm, libXft, libXext, libGLU_combined, zlib, libxml2, lz4, lzma, gsl, xxHash
-, Cocoa, OpenGL, noSplash ? false }:
+, Cocoa, OpenGL, cf-private, noSplash ? false }:
 
 stdenv.mkDerivation rec {
   name = "root-${version}";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake pcre python2 zlib libxml2 lz4 lzma gsl xxHash ]
     ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU_combined ]
-    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
+    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL cf-private ]
     ;
 
   patches = [
diff --git a/pkgs/applications/version-management/git-and-tools/grv/default.nix b/pkgs/applications/version-management/git-and-tools/grv/default.nix
index c70f69965291a..1119c9a5b4c8d 100644
--- a/pkgs/applications/version-management/git-and-tools/grv/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/grv/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2, ncurses, pkgconfig, readline }:
+{ stdenv, buildGo19Package, fetchFromGitHub, curl, libgit2_0_27, ncurses, pkgconfig, readline }:
 let
   version = "0.3.1";
 in
 buildGo19Package {
   name = "grv-${version}";
 
-  buildInputs = [ ncurses readline curl libgit2 ];
+  buildInputs = [ ncurses readline curl libgit2_0_27 ];
   nativeBuildInputs = [ pkgconfig ];
 
   goPackagePath = "github.com/rgburke/grv";
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index abd4973bbdf29..07474c5e52c59 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -1,72 +1,64 @@
 # Upstream distributes HandBrake with bundle of according versions of libraries and patches to them.
 #
-# Derivation patches HandBrake to use our closure.
+# Derivation patches HandBrake to use Nix closure dependencies.
 #
 
-{ stdenv, lib, fetchurl,
-  python2, pkgconfig, yasm, zlib,
-  autoconf, automake, libtool, m4, jansson,
-  libass, libiconv, libsamplerate, fribidi, libxml2, bzip2,
-  libogg, libopus, libtheora, libvorbis, libdvdcss, a52dec,
-  lame, libdvdread, libdvdnav, libbluray,
-  mp4v2, mpeg2dec, x264, x265, libmkv,
-  fontconfig, freetype, hicolor-icon-theme,
-  glib, gtk3, intltool, libnotify,
-  gst_all_1, dbus-glib, udev, libgudev, libvpx,
-  useGtk ? true, wrapGAppsHook ? null, libappindicator-gtk3 ? null,
-  useFfmpeg ? false, libav_12 ? null, ffmpeg ? null,
+{ stdenv, lib, fetchurl, callPackage,
+  # Main build tools
+  python2, pkgconfig, autoconf, automake, cmake, nasm, libtool, m4,
+  # Processing, video codecs, containers
+  ffmpeg-full, nv-codec-headers, libogg, x264, x265, libvpx, libtheora,
+  # Codecs, audio
+  libopus, lame, libvorbis, a52dec, speex, libsamplerate,
+  # Text processing
+  libiconv, fribidi, fontconfig, freetype, libass, jansson, libxml2,
+  # Optical media
+  libdvdread, libdvdnav, libdvdcss, libbluray,
+  useGtk ? true, wrapGAppsHook ? null,
+                 intltool ? null,
+                 glib ? null,
+                 gtk3 ? null,
+                 libappindicator-gtk3 ? null,
+                 libnotify ? null,
+                 gst_all_1 ? null,
+                 dbus-glib ? null,
+                 udev ? null,
+                 libgudev ? null,
+                 hicolor-icon-theme ? null,
   useFdk ? false, fdk_aac ? null
 }:
 
 stdenv.mkDerivation rec {
-  # TODO: Release 1.2.0 would switch LibAV to FFmpeg.
-  version = "1.1.2";
+  version = "1.2.0";
   name = "handbrake-${version}";
 
   src = fetchurl {
     url = ''https://download2.handbrake.fr/${version}/HandBrake-${version}-source.tar.bz2'';
-    sha256 = "0bny0hwlr55g2c69rsamv0xvwmfh1s4a582b9vq20xv5ly84m6ms";
+    sha256 = "03clkknaq3mz84p85cvr21gsy9b8vv2g4vvyfz44hz8la253jfqi";
   };
 
-  patched_libav_12 = libav_12.overrideAttrs (super: {
-    patches = (super.patches or []) ++ [(
-      # NOTE: 2018-04-26: HandBrake compilation (1.1.0) requires
-      # a patch of LibAV (12.3) from HandBrake team. This patch
-      # not went LibAV upstream.
-      fetchurl {
-        url = ''https://raw.githubusercontent.com/HandBrake/HandBrake/9e1f245708a157231c427c0ef9b91729d59a30e1/contrib/ffmpeg/A21-mp4-sdtp.patch'';
-        sha256 = "14grzyvb1qbb90k31ibabnwmwnrc48ml6h2z0rjamdv83q45jq4g";
-      })
-      # NOTE: 2018-11-11: Transcoding to MP4 can fail with:
-      #
-      # Tag avc1/0x31637661 incompatible with output codec id '28'
-      # muxavformat: avformat_write_header failed!
-      #
-      # Fix using Handbrake patch that is not upstream in libav.
-      (
-      fetchurl {
-        url = ''https://raw.githubusercontent.com/HandBrake/HandBrake/df6c26fa261423237ee2bec0bf784c32cbfda3fa/contrib/ffmpeg/A20-avc3-hvc1-override.patch'';
-        sha256 = "1vijd7bmkzp3sb6zhpcpdni8fz4h13wgglnml6cz9f44j41w2c3v";
-      })
-    ];
-  });
-
   nativeBuildInputs = [
-    python2 pkgconfig yasm autoconf automake libtool m4
+    python2 pkgconfig autoconf automake cmake nasm libtool m4
   ] ++ lib.optionals useGtk [ intltool wrapGAppsHook ];
 
   buildInputs = [
-    fribidi fontconfig freetype jansson zlib
-    libass libiconv libsamplerate libxml2 bzip2
-    libogg libopus libtheora libvorbis libdvdcss a52dec libmkv
-    lame libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264 x265 libvpx
+    ffmpeg-full libogg libtheora x264 x265 libvpx
+    libopus lame libvorbis a52dec speex libsamplerate
+    libiconv fribidi fontconfig freetype libass jansson libxml2
+    libdvdread libdvdnav libdvdcss libbluray
   ] ++ lib.optionals useGtk [
     glib gtk3 libappindicator-gtk3 libnotify
     gst_all_1.gstreamer gst_all_1.gst-plugins-base dbus-glib udev
     libgudev hicolor-icon-theme
-  ] ++ (if useFfmpeg then [ ffmpeg ] else [ patched_libav_12 ])
-  ++ lib.optional useFdk fdk_aac;
+  ] ++ lib.optional useFdk fdk_aac
+  # NOTE: 2018-12-27: Handbrake supports nv-codec-headers for Linux only,
+  # look at ./make/configure.py search "enable_nvenc"
+    ++ lib.optional stdenv.isLinux nv-codec-headers;
 
+  # NOTE: 2018-12-25: v1.2.0 now requires cmake dep
+  # (default distribution bundles&builds 3rd party libs),
+  # don't trigger cmake build
+  dontUseCmakeConfigure = true;
   enableParallelBuilding = true;
 
   preConfigure = ''
@@ -87,6 +79,7 @@ stdenv.mkDerivation rec {
     (if useFdk then "--enable-fdk-aac"            else "")
   ];
 
+  # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
   NIX_LDFLAGS = [
     "-lx265"
   ];
diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index c98acda9eea06..579d5566f134e 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -21,6 +21,11 @@
 , vlc
 , mbedtls
 
+, scriptingSupport ? true
+, luajit
+, swig
+, python3
+
 , alsaSupport ? false
 , alsaLib
 , pulseaudioSupport ? false
@@ -68,6 +73,7 @@ in stdenv.mkDerivation rec {
                   makeWrapper
                   mbedtls
                 ]
+                ++ optional scriptingSupport [ luajit swig python3 ]
                 ++ optional alsaSupport alsaLib
                 ++ optional pulseaudioSupport libpulseaudio;
 
diff --git a/pkgs/applications/video/qmediathekview/default.nix b/pkgs/applications/video/qmediathekview/default.nix
index 13f93800f6e24..1600666884627 100644
--- a/pkgs/applications/video/qmediathekview/default.nix
+++ b/pkgs/applications/video/qmediathekview/default.nix
@@ -2,14 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "QMediathekView";
-  version = "2017-04-16";
-  name = "${pname}-${version}";
+  version = "2019-01-06";
 
   src = fetchFromGitHub {
     owner = "adamreichold";
     repo = pname;
-    rev = "8c69892b95bf6825bd06a8c594168a98fe7cb2d1";
-    sha256 = "1wca1w4iywd3hmiwcqx6fv79p3x5n1cgbw2liw3hs24ch3z54ckm";
+    rev = "e098aaec552ec4e367078bf19953a08067316b4b";
+    sha256 = "0i9hac9alaajbra3lx23m0iiq6ww4is00lpbzg5x70agjrwj0nd6";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index d9056c4111d18..8babf2acd7e92 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -1,9 +1,8 @@
-{ stdenv, lib, fetchFromGitHub, removeReferencesTo
-, go, btrfs-progs }:
+{ stdenv, lib, fetchFromGitHub, buildGoPackage, btrfs-progs, go-md2man, utillinux }:
 
 with lib;
 
-stdenv.mkDerivation rec {
+buildGoPackage rec {
   name = "containerd-${version}";
   version = "1.2.1";
 
@@ -14,34 +13,37 @@ stdenv.mkDerivation rec {
     sha256 = "16zn6p1ky3yrgn53z8h9wza53ch91fj47wj5xgz6w4c57j30f66p";
   };
 
+  goPackagePath = "github.com/containerd/containerd";
+  outputs = [ "bin" "out" "man" ];
+
   hardeningDisable = [ "fortify" ];
 
-  buildInputs = [ removeReferencesTo go btrfs-progs ];
+  buildInputs = [ btrfs-progs go-md2man utillinux ];
   buildFlags = "VERSION=v${version}";
 
   BUILDTAGS = []
     ++ optional (btrfs-progs == null) "no_btrfs";
 
-  preConfigure = ''
-    # Extract the source
-    cd "$NIX_BUILD_TOP"
-    mkdir -p "go/src/github.com/containerd"
-    mv "$sourceRoot" "go/src/github.com/containerd/containerd"
-    export GOPATH=$NIX_BUILD_TOP/go:$GOPATH
-'';
-
-  preBuild = ''
-    cd go/src/github.com/containerd/containerd
+  buildPhase = ''
+    cd go/src/${goPackagePath}
     patchShebangs .
+    make binaries
   '';
 
   installPhase = ''
-    mkdir -p $out/bin
-    cp bin/* $out/bin
-  '';
-
-  preFixup = ''
-    find $out -type f -exec remove-references-to -t ${go} '{}' +
+    for b in bin/*; do
+      install -Dm555 $b $bin/$b
+    done
+
+    make man
+    manRoot="$man/share/man"
+    mkdir -p "$manRoot"
+    for manFile in man/*; do
+      manName="$(basename "$manFile")" # "docker-build.1"
+      number="$(echo $manName | rev | cut -d'.' -f1 | rev)"
+      mkdir -p "$manRoot/man$number"
+      gzip -c "$manFile" > "$manRoot/man$number/$manName.gz"
+    done
   '';
 
   meta = {
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 729ba9eae185d..28c43debcabe2 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -28,7 +28,7 @@ rec {
       patches = [];
     });
 
-    docker-containerd = (containerd.override { inherit go; }).overrideAttrs (oldAttrs: rec {
+    docker-containerd = containerd.overrideAttrs (oldAttrs: rec {
       name = "docker-containerd-${version}";
       inherit version;
       src = fetchFromGitHub {
@@ -39,8 +39,6 @@ rec {
       };
 
       hardeningDisable = [ "fortify" ];
-
-      buildInputs = [ removeReferencesTo go btrfs-progs ];
     });
 
     docker-tini = tini.overrideAttrs  (oldAttrs: rec {
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 731dd1ea99292..b3a4b774b1215 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -316,14 +316,21 @@ rec {
     # Files to add to the layer.
     contents,
     baseJson,
+    extraCommands,
     uid ? 0, gid ? 0,
   }:
     runCommand "${name}-customisation-layer" {
       buildInputs = [ jshon rsync tarsum ];
+      inherit extraCommands;
     }
     ''
       cp -r ${contents}/ ./layer
 
+      if [[ -n $extraCommands ]]; then
+        chmod ug+w layer
+        (cd layer; eval "$extraCommands")
+      fi
+
       # Tar up the layer and throw it into 'layer.tar'.
       echo "Packing layer..."
       mkdir $out
@@ -494,6 +501,8 @@ rec {
     # Time of creation of the image. Passing "now" will make the
     # created date be the time of building.
     created ? "1970-01-01T00:00:01Z",
+    # Optional bash script to run on the files prior to fixturizing the layer.
+    extraCommands ? "", uid ? 0, gid ? 0,
     # Docker's lowest maximum layer limit is 42-layers for an old
     # version of the AUFS graph driver. We pick 24 to ensure there is
     # plenty of room for extension. I believe the actual maximum is
@@ -501,8 +510,6 @@ rec {
     maxLayers ? 24
   }:
     let
-      uid = 0;
-      gid = 0;
       baseName = baseNameOf name;
       contentsEnv = symlinkJoin { name = "bulk-layers"; paths = (if builtins.isList contents then contents else [ contents ]); };
 
@@ -531,7 +538,7 @@ rec {
           name = baseName;
           contents = contentsEnv;
           baseJson = configJson;
-          inherit uid gid;
+          inherit uid gid extraCommands;
         };
       result = runCommand "docker-image-${baseName}.tar.gz" {
         buildInputs = [ jshon pigz coreutils findutils jq ];
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index a5a65fb2a4092..d78e35c56625b 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -155,6 +155,7 @@ rec {
   layered-image = pkgs.dockerTools.buildLayeredImage {
     name = "layered-image";
     tag = "latest";
+    extraCommands = ''echo "(extraCommand)" > extraCommands'';
     config.Cmd = [ "${pkgs.hello}/bin/hello" ];
     contents = [ pkgs.hello pkgs.bash pkgs.coreutils ];
   };
diff --git a/pkgs/data/fonts/culmus/default.nix b/pkgs/data/fonts/culmus/default.nix
index ee41d9b88fbdf..4ef5a4445583c 100644
--- a/pkgs/data/fonts/culmus/default.nix
+++ b/pkgs/data/fonts/culmus/default.nix
@@ -2,19 +2,24 @@
 
 let
   version = "0.133";
-in fetchzip {
+in stdenv.mkDerivation {
   name = "culmus-${version}";
 
-  url = "mirror://sourceforge/culmus/culmus/${version}/culmus-${version}.tar.gz";
+  src = fetchzip {
+    url = "mirror://sourceforge/culmus/culmus/${version}/culmus-${version}.tar.gz";
+    sha256 = "0q80j3vixn364sc23hcy6098rkgy0kb4p91lky6224am1dwn2qmr";
+  };
 
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
-    mkdir -p $out/share/fonts/truetype
+  installPhase = ''
+    mkdir -p $out/share/fonts/{truetype,type1}
+    cp -v *.pfa $out/share/fonts/type1/
+    cp -v *.afm $out/share/fonts/type1/
+    cp -v fonts.scale-type1 $out/share/fonts/type1/fonts.scale
     cp -v *.ttf $out/share/fonts/truetype/
+    cp -v *.otf $out/share/fonts/truetype/
+    cp -v fonts.scale-ttf $out/share/fonts/truetype/fonts.scale
   '';
 
-  sha256 = "1jxg2wf4kwasp5cia00nki2lrcdnhsyh4yy7d05l0a9bim5hq2lr";
-
   meta = {
     description = "Culmus Hebrew fonts";
     longDescription = "The Culmus project aims at providing the Hebrew-speaking GNU/Linux and Unix community with a basic collection of Hebrew fonts for X Windows.";
diff --git a/pkgs/desktops/gnome-3/core/gnome-system-log/default.nix b/pkgs/desktops/gnome-3/core/gnome-system-log/default.nix
deleted file mode 100644
index f31fbc3d3f4fd..0000000000000
--- a/pkgs/desktops/gnome-3/core/gnome-system-log/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ stdenv, intltool, fetchurl, pkgconfig
-, gtk3, glib, wrapGAppsHook
-, itstool, gnome3, libxml2 }:
-
-let
-  pname = "gnome-system-log";
-  version = "3.9.90";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "9eeb51982d347aa7b33703031e2c1d8084201374665425cd62199649b29a5411";
-  };
-
-  doCheck = true;
-
-  nativeBuildInputs = [ pkgconfig intltool itstool wrapGAppsHook libxml2 ];
-  buildInputs = [ gtk3 glib gnome3.gsettings-desktop-schemas gnome3.defaultIconTheme ];
-
-  passthru = {
-    updateScript = gnome3.updateScript {
-      packageName = pname;
-      attrPath = "gnome3.${pname}";
-      versionPolicy = "none";
-    };
-  };
-
-  meta = with stdenv.lib; {
-    description = "Graphical, menu-driven viewer that you can use to view and monitor your system logs";
-    maintainers = gnome3.maintainers;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/desktops/gnome-3/default.nix b/pkgs/desktops/gnome-3/default.nix
index e79ca7c3af86b..75c474faea0d8 100644
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@@ -19,7 +19,7 @@ lib.makeScope pkgs.newScope (self: with self; {
   optionalPackages = with gnome3; [ baobab eog epiphany evince
     gucharmap nautilus totem vino yelp gnome-bluetooth
     gnome-calculator gnome-contacts gnome-font-viewer gnome-screenshot
-    gnome-system-log gnome-system-monitor simple-scan
+    gnome-system-monitor simple-scan
     gnome-terminal gnome-user-docs evolution file-roller gedit
     gnome-clocks gnome-music gnome-tweaks gnome-photos
     nautilus-sendto dconf-editor vinagre gnome-weather gnome-logs
@@ -126,8 +126,6 @@ lib.makeScope pkgs.newScope (self: with self; {
 
   gnome-software = callPackage ./core/gnome-software { };
 
-  gnome-system-log = callPackage ./core/gnome-system-log { };
-
   gnome-system-monitor = callPackage ./core/gnome-system-monitor { };
 
   gnome-terminal = callPackage ./core/gnome-terminal { };
diff --git a/pkgs/development/compilers/clasp/default.nix b/pkgs/development/compilers/clasp/default.nix
index 349482fbde97b..a1e29951ddb58 100644
--- a/pkgs/development/compilers/clasp/default.nix
+++ b/pkgs/development/compilers/clasp/default.nix
@@ -1,54 +1,131 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, fetchFromGitLab
 , llvmPackages
-, cmake, boehmgc, gmp, zlib, ncurses, boost
+, cmake, boehmgc, gmp, zlib, ncurses, boost, libelf
 , python, git, sbcl
 , wafHook
 }:
+let
+  sicl = fetchFromGitHub {
+    owner = "Bike";
+    repo = "SICL";
+    rev = "78052fb5f02a3814eb7295f3dcac09f21f98702b";
+    sha256 = "0wnmp40310ls6q9gkr5ysfkj2qirq26ljjicnkqifc53mm0ghz4i";
+  };
+  cst = fetchFromGitHub {
+    owner = "robert-strandh";
+    repo = "Concrete-Syntax-Tree";
+    rev = "8d8c5abf8f1690cb2b765241d81c2eb86d60d77e";
+    sha256 = "1rs8a5nbfffdyli126sccd0z1a8h5axp222b4pgwvgfxsb9w7g3s";
+  };
+  c2mop = fetchFromGitHub {
+    owner = "pcostanza";
+    repo = "closer-mop";
+    rev = "d4d1c7aa6aba9b4ac8b7bb78ff4902a52126633f";
+    sha256 = "1amcv0f3vbsq0aqhai7ki5bi367giway1pbfxyc47r7q3hq5hw3c";
+  };
+  acclimation = fetchFromGitHub {
+    owner = "robert-strandh";
+    repo = "Acclimation";
+    rev = "dd15c86b0866fc5d8b474be0da15c58a3c04c45c";
+    sha256 = "0ql224qs3zgflvdhfbca621v3byhhqfb71kzy70bslyczxv1bsh2";
+  };
+  eclector = fetchFromGitHub {
+    owner = "robert-strandh";
+    repo = "Eclector";
+    rev = "287ce817c0478668bd389051d2cc6b26ddc62ec9";
+    sha256 = "0v7mgkq49ddyx5vvsradcp772y5l7cv9xrll3280hyginpm8w6q3";
+  };
+  alexandria = fetchFromGitHub {
+    owner = "clasp-developers";
+    repo = "alexandria";
+    rev = "e5c54bc30b0887c237bde2827036d17315f88737";
+    sha256 = "14h7a9fwimiw9gqxjm2h47d95bfhrm7b81f6si7x8vy18d78fn4g";
+  };
+  mps = fetchFromGitHub {
+    owner = "Ravenbrook";
+    repo = "mps";
+    rev = "b8a05a3846430bc36c8200f24d248c8293801503";
+    sha256 = "1q2xqdw832jrp0w9yhgr8xihria01j4z132ac16lr9ssqznkprv6";
+  };
+  asdf = fetchFromGitLab {
+    domain = "gitlab.common-lisp.net";
+    owner = "asdf";
+    repo = "asdf";
+    rev = "3.3.1.2";
+    sha256 = "0ljr2vc0cb2wrijcyjmp9hcaj2bdhh05ci3zf4f43hdq6i2fgg6g";
+  };
+in
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
   pname = "clasp";
-  version = "0.4.99.20170801";
+  version = "0.8.99.20181128";
 
   src = fetchFromGitHub {
     owner = "drmeister";
     repo = "clasp";
-    rev = "525ce1cffff39311e3e7df6d0b71fa267779bdf5";
-    sha256 = "1jqya04wybgxnski341p5sycy2gysxad0s5q8d59z0f6ckj3v8k1";
+    rev = "2f2b52ccb750048460562b5987a7eaf7a1aa4445";
+    sha256 = "0ra55vdnk59lygwzlxr5cg16vb9c45fmg59wahaxclwm461w7fwz";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ cmake python git sbcl wafHook ];
+  nativeBuildInputs = [ cmake python git sbcl wafHook ] ++
+    (with llvmPackages; [ llvm clang ]);
 
-  buildInputs = with llvmPackages; (
-    builtins.map (x: stdenv.lib.overrideDerivation x
-         (x: {NIX_CFLAGS_COMPILE= (x.NIX_CFLAGS_COMPILE or "") + " -frtti"; }))
-      [ llvm clang clang-unwrapped clang ]) ++
+  buildInputs = with llvmPackages;
+  (
+   builtins.map (x: stdenv.lib.overrideDerivation x
+           (x: {NIX_CFLAGS_COMPILE= (x.NIX_CFLAGS_COMPILE or "") + " -frtti"; }))
+   [ llvm clang clang-unwrapped clang ]) ++
   [
     gmp zlib ncurses
-    boost boehmgc
+    boost boehmgc libelf
     (boost.override {enableStatic = true; enableShared = false;})
     (stdenv.lib.overrideDerivation boehmgc
       (x: {configureFlags = (x.configureFlags or []) ++ ["--enable-static"];}))
   ];
 
-  NIX_CFLAGS_COMPILE = " -frtti ";
+  NIX_CXXSTDLIB_COMPILE = " -frtti ";
 
   postPatch = ''
     echo "
-      INSTALL_PATH_PREFIX = '$out'
+      PREFIX = '$out'
     " | sed -e 's/^ *//' > wscript.config
+
+    mkdir -p src/lisp/kernel/contrib/sicl
+    mkdir -p src/lisp/kernel/contrib/Concrete-Syntax-Tree
+    mkdir -p src/lisp/kernel/contrib/closer-mop
+    mkdir -p src/lisp/kernel/contrib/Acclimation
+    mkdir -p src/lisp/kernel/contrib/Eclector
+    mkdir -p src/lisp/kernel/contrib/alexandria
+    mkdir -p src/mps
+    mkdir -p src/lisp/modules/asdf
+
+    cp -rfT "${sicl}" src/lisp/kernel/contrib/sicl
+    cp -rfT "${cst}" src/lisp/kernel/contrib/Concrete-Syntax-Tree
+    cp -rfT "${c2mop}" src/lisp/kernel/contrib/closer-mop
+    cp -rfT "${acclimation}" src/lisp/kernel/contrib/Acclimation
+    cp -rfT "${eclector}" src/lisp/kernel/contrib/Eclector
+    cp -rfT "${alexandria}" src/lisp/kernel/contrib/alexandria
+    cp -rfT "${mps}" src/mps
+    cp -rfT "${asdf}" src/lisp/modules/asdf
+
+    chmod -R u+rwX src
+    ( cd src/lisp/modules/asdf; make )
   '';
 
   buildTargets = "build_cboehm";
   installTargets = "install_cboehm";
 
+  CLASP_SRC_DONTTOUCH = "true";
+
   meta = {
     inherit version;
     description = ''A Common Lisp implementation based on LLVM with C++ integration'';
     license = stdenv.lib.licenses.lgpl21Plus ;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
+    # Large, long to build, a private build of clang is needed, a prerelease.
+    hydraPlatforms = [];
     homepage = "https://github.com/drmeister/clasp";
-    broken = true; # 2018-09-08, no successful build since 2018-01-03
   };
 }
diff --git a/pkgs/development/compilers/dmd/default.nix b/pkgs/development/compilers/dmd/default.nix
index 8d68a6d4d3f9f..875472a2fb6da 100644
--- a/pkgs/development/compilers/dmd/default.nix
+++ b/pkgs/development/compilers/dmd/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchFromGitHub
 , makeWrapper, unzip, which
-, curl, tzdata, gdb, darwin
+, curl, tzdata, gdb, darwin, git
 , callPackage, targetPackages, ldc
-, version ? "2.083.1"
-, dmdSha256 ? "0b52yq7slgbrawb22kib9bk2x9xjiy6axwz1317fck5axl093d90"
-, druntimeSha256 ? "1hm9p59ih21yv8x7cqjhkyy94677q4f8wk9fs9i1rybx8x19njyn"
-, phobosSha256 ? "1zmz0f1wj0dgxy2cy63ljjc1sl2sgb7ij8bamlxw9nxrchwi3l43"
+, version ? "2.084.0"
+, dmdSha256 ? "1v61spdamncl8c1bzjc19b03p4jl0ih5zq9b7cqsy9ix7qaxmikf"
+, druntimeSha256 ? "0vp414j6s11l9s54v81np49mv60ywmd7nnk41idkbwrq0nz4sfrq"
+, phobosSha256 ? "1wp7z1x299b0w9ny1ah2wrfhrs05vc4bk51csgw9774l3dqcnv53"
 }:
 
 let
@@ -42,50 +42,22 @@ let
 
     sourceRoot = ".";
 
+    # https://issues.dlang.org/show_bug.cgi?id=19553
+    hardeningDisable = [ "fortify" ];
+
     postUnpack = ''
         patchShebangs .
-
-        # Remove cppa test for now because it doesn't work.
-        rm dmd/test/runnable/cppa.d
-        rm dmd/test/runnable/extra-files/cppb.cpp
-    ''
-
-    + stdenv.lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-        rm dmd/test/runnable/test16096.sh
-    '';
-
-    # Compile with PIC to prevent colliding modules with binutils 2.28.
-    # https://issues.dlang.org/show_bug.cgi?id=17375
-    usePIC = "-fPIC";
-
-    phobosPatches = ''
-        # Ugly hack so the dlopen call has a chance to succeed.
-        # https://issues.dlang.org/show_bug.cgi?id=15391
-        substituteInPlace phobos/std/net/curl.d \
-            --replace libcurl.so ${curl.out}/lib/libcurl.so
-
-        # phobos uses curl, so we need to patch the path to the lib.
-        substituteInPlace phobos/posix.mak \
-            --replace "-soname=libcurl.so.4" "-soname=${curl.out}/lib/libcurl.so.4"
-
     '';
 
     postPatch = ''
-        substituteInPlace druntime/test/common.mak \
-            --replace "DFLAGS:=" "DFLAGS:=${usePIC} "
-
-        substituteInPlace dmd/src/posix.mak \
-            --replace "DFLAGS :=" "DFLAGS += -link-defaultlib-shared=false"
-    ''
+        substituteInPlace dmd/test/compilable/extra-files/ddocYear.html \
+            --replace "2018" "__YEAR__"
 
-    + phobosPatches
-
-    + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
-        substituteInPlace dmd/posix.mak \
-            --replace MACOSX_DEPLOYMENT_TARGET MACOSX_DEPLOYMENT_TARGET_
+        substituteInPlace dmd/test/runnable/test16096.sh \
+            --replace "{EXT}" "{EXE}"
     '';
 
-    nativeBuildInputs = [ ldc makeWrapper unzip which gdb ]
+    nativeBuildInputs = [ ldc makeWrapper unzip which gdb git ]
 
     ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
       Foundation
@@ -109,7 +81,8 @@ let
         make -j$NIX_BUILD_CORES -f posix.mak BUILD=release ENABLE_RELEASE=1 PIC=1 INSTALL_DIR=$out DMD=${pathToDmd}
         cd ../phobos
         echo ${tzdata}/share/zoneinfo/ > TZDatabaseDirFile
-        make -j$NIX_BUILD_CORES -f posix.mak BUILD=release ENABLE_RELEASE=1 PIC=1 INSTALL_DIR=$out DMD=${pathToDmd} DFLAGS="-version=TZDatabaseDir -J$(pwd)"
+        echo ${curl.out}/lib/libcurl.so > LibcurlPathFile
+        make -j$NIX_BUILD_CORES -f posix.mak BUILD=release ENABLE_RELEASE=1 PIC=1 INSTALL_DIR=$out DMD=${pathToDmd} DFLAGS="-version=TZDatabaseDir -version=LibcurlPath -J$(pwd)"
         cd ..
     '';
 
@@ -119,7 +92,7 @@ let
 
     checkPhase = ''
         cd dmd
-        make -j$NIX_BUILD_CORES -C test -f Makefile PIC=1 DMD=${pathToDmd} BUILD=release SHARED=0 SHELL=$SHELL
+        make -j$NIX_BUILD_CORES -C test -f Makefile PIC=1 CC=$CXX DMD=${pathToDmd} BUILD=release SHARED=0 SHELL=$SHELL
         cd ../druntime
         make -j$NIX_BUILD_CORES -f posix.mak unittest PIC=1 DMD=${pathToDmd} BUILD=release
         cd ..
@@ -194,15 +167,14 @@ let
 
       sourceRoot = ".";
 
-      postPatch = dmdBuild.phobosPatches;
-
       nativeBuildInputs = dmdBuild.nativeBuildInputs;
       buildInputs = dmdBuild.buildInputs;
 
       buildPhase = ''
           cd phobos
           echo ${tzdata}/share/zoneinfo/ > TZDatabaseDirFile
-          make -j$NIX_BUILD_CORES -f posix.mak unittest BUILD=release ENABLE_RELEASE=1 PIC=1 DMD=${dmdBuild}/bin/dmd DFLAGS="-version=TZDatabaseDir -J$(pwd)"
+          echo ${curl.out}/lib/libcurl.so > LibcurlPathFile
+          make -j$NIX_BUILD_CORES -f posix.mak unittest BUILD=release ENABLE_RELEASE=1 PIC=1 DMD=${dmdBuild}/bin/dmd DFLAGS="-version=TZDatabaseDir -version=LibcurlPath -J$(pwd)"
       '';
 
       installPhase = ''
diff --git a/pkgs/development/compilers/gcc-arm-embedded/8/default.nix b/pkgs/development/compilers/gcc-arm-embedded/8/default.nix
new file mode 100644
index 0000000000000..4e0caf1836109
--- /dev/null
+++ b/pkgs/development/compilers/gcc-arm-embedded/8/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, lib, fetchurl, ncurses5, python27 }:
+
+with lib;
+
+stdenv.mkDerivation rec {
+  name = "gcc-arm-embedded-${version}";
+  version = "8-2018-q4-major";
+  subdir = "8-2018q4";
+
+  urlString = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${subdir}/gcc-arm-none-eabi-${version}-linux.tar.bz2";
+
+  src = fetchurl { url=urlString; sha256="fb31fbdfe08406ece43eef5df623c0b2deb8b53e405e2c878300f7a1f303ee52"; };
+
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r * $out
+  '';
+
+  dontPatchELF = true;
+  dontStrip = true;
+
+  preFixup = ''
+    find $out -type f | while read f; do
+      patchelf $f > /dev/null 2>&1 || continue
+      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
+      patchelf --set-rpath ${stdenv.lib.makeLibraryPath [ "$out" stdenv.cc.cc ncurses5 python27 ]} "$f" || true
+    done
+  '';
+
+  meta = {
+    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors (Cortex-M0/M0+/M3/M4/M7, Cortex-R4/R5/R7/R8)";
+    homepage = https://developer.arm.com/open-source/gnu-toolchain/gnu-rm;
+    license = with licenses; [ bsd2 gpl2 gpl3 lgpl21 lgpl3 mit ];
+    maintainers = with maintainers; [ prusnak ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/coq-modules/category-theory/default.nix b/pkgs/development/coq-modules/category-theory/default.nix
index 94ed294569238..59f2295e21531 100644
--- a/pkgs/development/coq-modules/category-theory/default.nix
+++ b/pkgs/development/coq-modules/category-theory/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ coq ] ++ (with coq.ocamlPackages; [ ocaml camlp5 findlib ]);
   propagatedBuildInputs = [ ssreflect equations ];
 
-  enableParallelBuilding = false;
+  buildFlags = [ "JOBS=$(NIX_BUILD_CORES)" ];
 
   installPhase = ''
     make -f Makefile.coq COQLIB=$out/lib/coq/${coq.coq-version}/ install
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 001f7c9abee04..6018d92bbcab2 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "clojure-${version}";
-  version = "1.10.0.403";
+  version = "1.10.0.411";
 
   src = fetchurl {
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "0jsyd0vr1qfqs0dz560hyfya553jhr4m4msf5x0n610yzvbqym4c";
+    sha256 = "00bhn6w9iwhgmyx89lk97q19phpm9vh45m3m1pi7d31gldb6v0zh";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 2757b9bd4bab0..d890b1862d3bf 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -263,12 +263,10 @@ in {
   };
 
   php73 = generic {
-    version = "7.3.0";
-    sha256 = "0rvwx37dsmxivgrf4wfc1y778iln498c6a40biy9k6lnr6p7s9ks";
+    version = "7.3.1";
+    sha256 = "13iqfkz9rmx9vy106lvw1nbk88qgwdkvxam0l5s14r7jsw62pvxg";
 
-    # https://bugs.php.net/bug.php?id=71041
     # https://bugs.php.net/bug.php?id=76826
-    extraPatches = [ ./fix-bug-71041.patch ]
-      ++ optional stdenv.isDarwin ./php73-darwin-isfinite.patch;
+    extraPatches = optional stdenv.isDarwin ./php73-darwin-isfinite.patch;
   };
 }
diff --git a/pkgs/development/interpreters/tinyscheme/default.nix b/pkgs/development/interpreters/tinyscheme/default.nix
new file mode 100644
index 0000000000000..f2c5fd938cec3
--- /dev/null
+++ b/pkgs/development/interpreters/tinyscheme/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "tinyscheme-${version}";
+  version = "1.41";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/tinyscheme/${name}.tar.gz";
+    sha256 = "168rk4zrlhsknbvldq2jsgabpwlqkx6la44gkqmijmf7jhs11h7a";
+  };
+
+  patchPhase = ''
+    substituteInPlace scheme.c --replace "init.scm" "$out/lib/init.scm"
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/lib
+    cp init.scm $out/lib
+    cp scheme $out/bin/tinyscheme
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Lightweight Scheme implementation";
+    longDescription = ''
+      TinyScheme is a lightweight Scheme interpreter that implements as large a
+      subset of R5RS as was possible without getting very large and complicated.
+    '';
+    homepage = http://tinyscheme.sourceforge.net/;
+    license = licenses.bsdOriginal;
+    maintainers = [ maintainers.ebzzry ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index 5c57f21a2286c..cdf72830797b8 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -25,7 +25,8 @@ stdenv.mkDerivation rec {
   '';
 
   patches = [ (fetchpatch {
-    url = "https://gitweb.gentoo.org/proj/musl.git/plain/dev-libs/boehm-gc/files/boehm-gc-7.6.0-sys_select.patch";
+    name = "boehm-gc-7.6.0-sys_select.patch";
+    url = "https://gitweb.gentoo.org/proj/musl.git/plain/dev-libs/boehm-gc/files/boehm-gc-7.6.0-sys_select.patch?id=85b6a600996bdd71162b357e9ba93d8559342432";
     sha256 = "1gydwlklvci30f5dpp5ccw2p2qpph5y41r55wx9idamjlq66fbb3";
   }) ] ++
     # https://github.com/ivmai/bdwgc/pull/208
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index 4c1ad34f6da37..2cfa4b1d3cd67 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -96,7 +96,7 @@
 , libxcbshapeExtlib ? true # X11 grabbing shape rendering
 , libXv ? null # Xlib support
 , lzma ? null # xz-utils
-, nvenc ? false, nvidia-video-sdk ? null # NVIDIA NVENC support
+, nvenc ? false, nvidia-video-sdk ? null, nv-codec-headers ? null # NVIDIA NVENC support
 , callPackage # needed for NVENC to access external ffmpeg nvidia headers
 , openal ? null # OpenAL 1.1 capture support
 #, opencl ? null # OpenCL code
@@ -176,8 +176,6 @@
 let
   inherit (stdenv) isCygwin isFreeBSD isLinux;
   inherit (stdenv.lib) optional optionals optionalString enableFeature;
-
-  nv-codec-headers = callPackage ./nv-codec-headers.nix { };
 in
 
 /*
diff --git a/pkgs/development/libraries/git2/0.27.nix b/pkgs/development/libraries/git2/0.27.nix
new file mode 100644
index 0000000000000..93948a1b0d676
--- /dev/null
+++ b/pkgs/development/libraries/git2/0.27.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
+, zlib, libssh2, openssl, http-parser, curl
+, libiconv, Security
+}:
+
+stdenv.mkDerivation rec {
+  version = "0.27.7";
+  name = "libgit2-${version}";
+
+  src = fetchFromGitHub {
+    owner = "libgit2";
+    repo = "libgit2";
+    rev = "v${version}";
+    sha256 = "1q3mp7xjpbmdsnk4sdzf2askbb4pgbxcmr1h7y7zk2738dndwkha";
+  };
+
+  cmakeFlags = [ "-DTHREADSAFE=ON" ];
+
+  nativeBuildInputs = [ cmake python pkgconfig ];
+
+  buildInputs = [ zlib libssh2 openssl http-parser curl ]
+    ++ stdenv.lib.optional stdenv.isDarwin Security;
+
+  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
+
+  enableParallelBuilding = true;
+
+  doCheck = false; # hangs. or very expensive?
+
+  meta = {
+    description = "The Git linkable library";
+    homepage = https://libgit2.github.com/;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = with stdenv.lib.platforms; all;
+  };
+}
diff --git a/pkgs/development/libraries/git2/default.nix b/pkgs/development/libraries/git2/default.nix
index ec610d1e56563..358fc31fc80f5 100644
--- a/pkgs/development/libraries/git2/default.nix
+++ b/pkgs/development/libraries/git2/default.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, python
-, zlib, libssh2, openssl, http-parser, curl
+{ stdenv, fetchFromGitHub, pkgconfig, cmake
+, zlib, python, libssh2, openssl, curl, http-parser
 , libiconv, Security
 }:
 
-stdenv.mkDerivation rec {
-  pname = "libgit2";
-  version = "0.27.7";
+stdenv.mkDerivation (rec {
+  name = "libgit2-${version}";
+  version = "0.26.6";
   # keep the version in sync with pythonPackages.pygit2 and libgit2-glib
 
   src = fetchFromGitHub {
     owner = "libgit2";
     repo = "libgit2";
     rev = "v${version}";
-    sha256 = "1q3mp7xjpbmdsnk4sdzf2askbb4pgbxcmr1h7y7zk2738dndwkha";
+    sha256 = "17pjvprmdrx4h6bb1hhc98w9qi6ki7yl57f090n9kbhswxqfs7s3";
   };
 
   cmakeFlags = [ "-DTHREADSAFE=ON" ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib libssh2 openssl http-parser curl ]
     ++ stdenv.lib.optional stdenv.isDarwin Security;
 
-  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
+  propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) [ libiconv ];
 
   enableParallelBuilding = true;
 
@@ -34,4 +34,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = with platforms; all;
   };
-}
+} // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
+})
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 6e1f2f4a2c55d..fb7a37a4f4480 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -32,4 +32,8 @@ stdenv.mkDerivation rec {
     })
     ./fix_pkgconfig_includedir.patch
   ];
+
+  postPatch = ''
+    sed -i -r -e 's/p(bad|good) = .*/p\1 = pbase/' tests/check/meson.build
+  '';
 }
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 5c6cd2c7eda05..01133b92ee13c 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -35,11 +35,16 @@ stdenv.mkDerivation rec {
       url = "https://bug757142.bugzilla-attachments.gnome.org/attachment.cgi?id=344123";
       sha256 = "0g6fhqcv8spfy3mfmxpyji93k8d4p4q4fz1v9a1c1cgcwkz41d7p";
     })
-    # https://gitlab.gnome.org/GNOME/gtk/issues/1521
+    # 3.24.2: https://gitlab.gnome.org/GNOME/gtk/issues/1521
     (fetchpatch {
       url = https://gitlab.gnome.org/GNOME/gtk/commit/2905fc861acda3d134a198e56ef2f6c962ad3061.patch;
       sha256 = "0y8ljny59kgdhrcfpimi2r082bax60d5kflw1qj9k1mnzjcvjjwl";
     })
+    # 3.24.2: https://gitlab.gnome.org/GNOME/gtk/issues/1523
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gtk/commit/e3a1593a0984cc0156ec1892a46af8f256a64878.patch;
+      sha256 = "0akvp1r8xlzf5amk9gmk7b5sabr1wbmg3ak15rppsid7nf9f5dqf";
+    })
   ];
 
   buildInputs = [ libxkbcommon epoxy json-glib isocodes ]
diff --git a/pkgs/development/libraries/libmediaart/default.nix b/pkgs/development/libraries/libmediaart/default.nix
index 48bd959009a17..64d2cc7577c39 100644
--- a/pkgs/development/libraries/libmediaart/default.nix
+++ b/pkgs/development/libraries/libmediaart/default.nix
@@ -14,7 +14,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkgconfig vala gtk-doc docbook_xsl docbook_xml_dtd_412 gobject-introspection ];
   buildInputs = [ glib gdk_pixbuf ];
 
-  doCheck = true;
+  # FIXME: Turn on again when https://github.com/NixOS/nixpkgs/issues/53701
+  # is fixed on master.
+  doCheck = false;
 
   passthru = {
     updateScript = gnome3.updateScript {
diff --git a/pkgs/development/libraries/libngspice/default.nix b/pkgs/development/libraries/libngspice/default.nix
index 87382bd1ae21f..c6348b7b2e67d 100644
--- a/pkgs/development/libraries/libngspice/default.nix
+++ b/pkgs/development/libraries/libngspice/default.nix
@@ -2,12 +2,13 @@
 
 # Note that this does not provide the ngspice command-line utility. For that see
 # the ngspice derivation.
-stdenv.mkDerivation {
-  name = "libngspice-29";
+stdenv.mkDerivation rec {
+  name = "libngspice-${version}";
+  version = "30";
 
   src = fetchurl {
-    url = "mirror://sourceforge/ngspice/ngspice-29.tar.gz";
-    sha256 = "0jjwz73naq7l9yhwdqbpnrfckywp2ffkppivxjv8w92zq7xhyvcd";
+    url = "mirror://sourceforge/ngspice/ngspice-${version}.tar.gz";
+    sha256 = "15v0jdfy2a2zxp8dmy04fdp7w7a4vwvffcwa688r81b86wphxzh8";
   };
 
   nativeBuildInputs = [ flex bison ];
diff --git a/pkgs/development/libraries/libnice/default.nix b/pkgs/development/libraries/libnice/default.nix
index b78c8a8bbe13c..e71bcd0e36802 100644
--- a/pkgs/development/libraries/libnice/default.nix
+++ b/pkgs/development/libraries/libnice/default.nix
@@ -47,7 +47,8 @@ stdenv.mkDerivation rec {
     "-Dintrospection=enabled"
   ];
 
-  doCheck = true;
+  # TODO; see #53293 etc.
+  #doCheck = true;
 
   meta = with stdenv.lib; {
     homepage = https://nice.freedesktop.org/wiki/;
diff --git a/pkgs/development/libraries/mps/default.nix b/pkgs/development/libraries/mps/default.nix
index aac9dc7f727a1..1430a3dfca156 100644
--- a/pkgs/development/libraries/mps/default.nix
+++ b/pkgs/development/libraries/mps/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "mps-${version}";
-  version = "1.116.0";
+  version = "1.117.0";
 
   src = fetchurl {
     url    = "https://www.ravenbrook.com/project/mps/release/${version}/mps-kit-${version}.tar.gz";
-    sha256 = "1k7vnanpgawnj84x2xs6md57pfib9p7c3acngqzkl3c2aqw8qay0";
+    sha256 = "04ix4l7lk6nxxk9sawpnxbybvqb82lks5606ym10bc1qbc2kqdcz";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
   # needed for 1.116.0 to build with gcc7
   NIX_CFLAGS_COMPILE = [
     "-Wno-implicit-fallthrough"
+    "-Wno-error=clobbered"
   ];
 
 
diff --git a/pkgs/development/libraries/ffmpeg-full/nv-codec-headers.nix b/pkgs/development/libraries/nv-codec-headers/default.nix
index 03599c91bf04f..07ec502cd12a3 100644
--- a/pkgs/development/libraries/ffmpeg-full/nv-codec-headers.nix
+++ b/pkgs/development/libraries/nv-codec-headers/default.nix
@@ -2,18 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "nv-codec-headers-${version}";
-  version = "n8.1.24.2";
+  version = "8.2.15.6";
 
   src = fetchgit {
     url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
-    rev = "${version}";
-    sha256 = "122i3f6whiz5yp44dhk73ifr1973z8vvfbg4216vb782bl8b5bam";
+    rev = "n${version}";
+    sha256 = "0216ww8byjxz639kagyw0mr9vxxwj89xdnj448d579vjr54jychv";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
-    description = "ffmpeg nvidia headers for NVENC";
+    description = "FFmpeg version of headers for NVENC";
     homepage = http://ffmpeg.org/;
     license = stdenv.lib.licenses.gpl3Plus;
     maintainers = [ stdenv.lib.maintainers.MP2E ];
diff --git a/pkgs/development/libraries/openwsman/default.nix b/pkgs/development/libraries/openwsman/default.nix
index 2122a7b23f1b8..a986b71bc1dd1 100644
--- a/pkgs/development/libraries/openwsman/default.nix
+++ b/pkgs/development/libraries/openwsman/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "openwsman-${version}";
-  version = "2.6.5";
+  version = "2.6.9";
 
   src = fetchFromGitHub {
     owner  = "Openwsman";
     repo   = "openwsman";
     rev    = "v${version}";
-    sha256 = "1r0zslgpcr4m20car4s3hsccy10xcb39qhpw3dhpjv42xsvvs5xv";
+    sha256 = "19s5h551ppxmi2kljf8z58jjc6yrpczbxdrl4hh2l4jxv7iphk5i";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DCMAKE_BUILD_RUBY_GEM=no"
+    "-DBUILD_PYTHON=no"
+    "-DBUILD_PYTHON3=yes"
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/physics/hoppet/default.nix b/pkgs/development/libraries/physics/hoppet/default.nix
index 55714afbdce95..9c379f6a3474a 100644
--- a/pkgs/development/libraries/physics/hoppet/default.nix
+++ b/pkgs/development/libraries/physics/hoppet/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gfortran }:
+{ stdenv, fetchurl, gfortran, perl }:
 
 stdenv.mkDerivation rec {
   name = "hoppet-${version}";
@@ -10,9 +10,14 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ gfortran ];
+  nativeBuildInputs = [ perl ];
 
   enableParallelBuilding = true;
 
+  preConfigure = ''
+    patchShebangs .
+  '';
+
   meta = with stdenv.lib; {
     description = "Higher Order Perturbative Parton Evolution Toolkit";
     license     = licenses.gpl2;
diff --git a/pkgs/development/libraries/termbox/default.nix b/pkgs/development/libraries/termbox/default.nix
index 469a6a4c96f9a..eefc976a62b01 100644
--- a/pkgs/development/libraries/termbox/default.nix
+++ b/pkgs/development/libraries/termbox/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python3, wafHook }:
+{ stdenv, fetchFromGitHub, python3, wafHook, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "termbox-${version}";
@@ -9,7 +9,18 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     sha256 = "08yqxzb8fny8806p7x8a6f3phhlbfqdd7dhkv25calswj7w1ssvs";
   };
+
+  # patch which updates the `waf` version used to build
+  # to make the package buildable on Python 3.7
+  patches = [
+    (fetchpatch {
+      url = https://github.com/nsf/termbox/commit/6fe63ac3ad63dc2c3ac45b770541cc8b7a1d2db7.patch;
+      sha256 = "1s5747v51sdwvpsg6k9y1j60yn9f63qnylkgy8zrsifjzzd5fzl6";
+    })
+  ];
+
   nativeBuildInputs = [ python3 wafHook ];
+
   meta = with stdenv.lib; {
     description = "Library for writing text-based user interfaces";
     license = licenses.mit;
diff --git a/pkgs/development/ocaml-modules/resource-pooling/default.nix b/pkgs/development/ocaml-modules/resource-pooling/default.nix
new file mode 100644
index 0000000000000..71f2d51060cfe
--- /dev/null
+++ b/pkgs/development/ocaml-modules/resource-pooling/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, lwt_log }:
+
+let pname = "resource-pooling"; in
+
+if !stdenv.lib.versionAtLeast ocaml.version "4.06"
+then throw "${pname} is not available for OCaml ${ocaml.version}"
+else
+
+stdenv.mkDerivation rec {
+  version = "0.5.2";
+  name = "ocaml${ocaml.version}-${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "ocsigen";
+    repo = pname;
+    rev = version;
+    sha256 = "00rz1i61w2dy108hzv38rblnsv6b56b5a1mk5h3zddpivcljp2dh";
+  };
+
+  buildInputs = [ ocaml findlib ocamlbuild ];
+  propagatedBuildInputs = [ lwt_log ];
+
+  configurePhase = "ocaml setup.ml -configure --prefix $out";
+  buildPhase = "ocaml setup.ml -build";
+  createFindlibDestdir = true;
+  installPhase = "ocaml setup.ml -install";
+
+  meta = {
+    inherit (src.meta) homepage;
+    inherit (ocaml.meta) platforms;
+    description = "A library for pooling resources like connections, threads, or similar";
+    license = stdenv.lib.licenses.mit;
+    maintainers = [ stdenv.lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 14fca8dfe82f8..558530e5a85ae 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -8,33 +8,37 @@
 , async-timeout
 , yarl
 , idna-ssl
+, typing-extensions
+, pytestrunner
 , pytest
 , gunicorn
-, pytest-mock
-, async_generator
-, pytestrunner
 , pytest-timeout
+, async_generator
+, pytest_xdist
+, pytestcov
+, pytest-mock
+, trustme
+, brotlipy
 }:
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.4.4";
+  version = "3.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ykm6kdjkrg556j0zd7dx2l1rsrbh0d9g27ivr6dmaahz9pyrbsi";
+    sha256 = "7967b760d0e96eb7ac6b20a9143112ce5c03a00b4f74d8a5ee66c8e88e6b6800";
   };
 
   disabled = pythonOlder "3.5";
 
-  checkInputs = [ pytest gunicorn pytest-mock async_generator pytestrunner pytest-timeout ];
+  checkInputs = [
+    pytestrunner pytest gunicorn pytest-timeout async_generator pytest_xdist
+    pytest-mock pytestcov trustme brotlipy
+  ];
 
   propagatedBuildInputs = [ attrs chardet multidict async-timeout yarl ]
-    ++ lib.optional (pythonOlder "3.7") idna-ssl;
-
-
-  # Several test failures. Need to be looked into.
-  doCheck = false;
+    ++ lib.optionals (pythonOlder "3.7") [ idna-ssl typing-extensions ];
 
   meta = with lib; {
     description = "Asynchronous HTTP Client/Server for Python and asyncio";
diff --git a/pkgs/development/python-modules/cachy/default.nix b/pkgs/development/python-modules/cachy/default.nix
new file mode 100644
index 0000000000000..029a18644846c
--- /dev/null
+++ b/pkgs/development/python-modules/cachy/default.nix
@@ -0,0 +1,33 @@
+{ lib, buildPythonPackage, fetchPypi
+, redis
+, memcached
+, msgpack-python
+}:
+
+buildPythonPackage rec {
+  pname = "cachy";
+  version = "0.2.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0v6mjyhgx6j7ya20bk69cr3gdzdkdf6psay0h090rscclgji65dp";
+  };
+
+  propagatedBuildInputs = [
+    redis
+    memcached
+    msgpack-python
+  ];
+
+  # The Pypi tarball doesn't include tests, and the GitHub source isn't
+  # buildable until we bootstrap poetry, see
+  # https://github.com/NixOS/nixpkgs/pull/53599#discussion_r245855665
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = https://github.com/sdispater/cachy;
+    description = "Cachy provides a simple yet effective caching library";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/cleo/default.nix b/pkgs/development/python-modules/cleo/default.nix
new file mode 100644
index 0000000000000..31a33b73c2bcd
--- /dev/null
+++ b/pkgs/development/python-modules/cleo/default.nix
@@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchPypi
+, pylev, pastel, clikit }:
+
+buildPythonPackage rec {
+  pname = "cleo";
+  version = "0.7.2";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "091nzpfp5incd2fzqych78rvyx4i3djr50cnizbjzr3dc7g00l3s";
+  };
+
+  propagatedBuildInputs = [
+    pylev
+    pastel
+    clikit
+  ];
+
+  # The Pypi tarball doesn't include tests, and the GitHub source isn't
+  # buildable until we bootstrap poetry, see
+  # https://github.com/NixOS/nixpkgs/pull/53599#discussion_r245855665
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = https://github.com/sdispater/cleo;
+    description = "Allows you to create beautiful and testable command-line interfaces";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/clikit/default.nix b/pkgs/development/python-modules/clikit/default.nix
new file mode 100644
index 0000000000000..0d5247c02e055
--- /dev/null
+++ b/pkgs/development/python-modules/clikit/default.nix
@@ -0,0 +1,30 @@
+{ lib, buildPythonPackage, fetchPypi
+, isPy27, isPy34
+, pylev, pastel, typing, enum34 }:
+
+buildPythonPackage rec {
+  pname = "clikit";
+  version = "0.2.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0zr1s0xhk62p9a6zcp5whvsb27lddyk8gx03k9l8q18jp7y3igbv";
+  };
+
+  propagatedBuildInputs = [
+    pylev pastel
+  ] ++ lib.optional (isPy27 || isPy34) typing
+    ++ lib.optional isPy27 enum34;
+
+  # The Pypi tarball doesn't include tests, and the GitHub source isn't
+  # buildable until we bootstrap poetry, see
+  # https://github.com/NixOS/nixpkgs/pull/53599#discussion_r245855665
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = https://github.com/sdispater/clikit;
+    description = "A group of utilities to build beautiful and testable command line interfaces";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/fido2/default.nix b/pkgs/development/python-modules/fido2/default.nix
index 26cb12db7219a..96ba82f6d9805 100644
--- a/pkgs/development/python-modules/fido2/default.nix
+++ b/pkgs/development/python-modules/fido2/default.nix
@@ -1,4 +1,7 @@
-{ lib, buildPythonPackage, fetchPypi, six, cryptography }:
+{ lib, buildPythonPackage, fetchPypi
+, six, cryptography
+, mock, pyfakefs
+}:
 
 buildPythonPackage rec {
   pname = "fido2";
@@ -9,12 +12,10 @@ buildPythonPackage rec {
     sha256 = "1pl8d2pr6jzqj4y9qiaddhjgnl92kikjxy0bgzm2jshkzzic8mp3";
   };
 
-  # The pypi package does not include tests
-  # Check https://github.com/Yubico/python-fido2/pull/8
-  doCheck = false;
-
   propagatedBuildInputs = [ six cryptography ];
 
+  checkInputs = [ mock pyfakefs ];
+
   meta = with lib; {
     description = "Provides library functionality for FIDO 2.0, including communication with a device over USB.";
     homepage = https://github.com/Yubico/python-fido2;
diff --git a/pkgs/development/python-modules/google-i18n-address/default.nix b/pkgs/development/python-modules/google-i18n-address/default.nix
new file mode 100644
index 0000000000000..720d8695c2cf2
--- /dev/null
+++ b/pkgs/development/python-modules/google-i18n-address/default.nix
@@ -0,0 +1,22 @@
+{ buildPythonPackage, fetchPypi, lib, requests, pytest, pytestcov, mock }:
+
+buildPythonPackage rec {
+  pname = "google-i18n-address";
+  version = "2.3.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0f1j1lp9bmllkzhciw0lxi7ipm8w461n0p97mz9714br0cs9glm1";
+  };
+
+  propagatedBuildInputs = [ requests ];
+
+  checkInputs = [ pytest pytestcov mock ];
+
+  meta = with lib; {
+    description = "Google's i18n address data packaged for Python";
+    homepage = https://pypi.org/project/google-i18n-address/;
+    maintainers = with maintainers; [ ma27 ];
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/hpack/default.nix b/pkgs/development/python-modules/hpack/default.nix
index a10882417fc0b..7e7db13aaec16 100644
--- a/pkgs/development/python-modules/hpack/default.nix
+++ b/pkgs/development/python-modules/hpack/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, glibcLocales
 }:
 
 buildPythonPackage rec {
@@ -12,6 +13,10 @@ buildPythonPackage rec {
     sha256 = "8eec9c1f4bfae3408a3f30500261f7e6a65912dc138526ea054f9ad98892e9d2";
   };
 
+  buildInputs = [ glibcLocales ];
+
+  LANG = "en_US.UTF-8";
+
   meta = with stdenv.lib; {
     description = "Pure-Python HPACK header compression";
     homepage = "http://hyper.rtfd.org";
diff --git a/pkgs/development/python-modules/mt-940/default.nix b/pkgs/development/python-modules/mt-940/default.nix
index 5c323068dddb0..d097224e52dae 100644
--- a/pkgs/development/python-modules/mt-940/default.nix
+++ b/pkgs/development/python-modules/mt-940/default.nix
@@ -3,14 +3,15 @@
 }:
 
 buildPythonPackage rec {
-  version = "4.12.2";
+  version = "4.13.0";
   pname = "mt-940";
 
+  # No tests in PyPI tarball
   src = fetchFromGitHub {
     owner = "WoLpH";
     repo = "mt940";
     rev = "v${version}";
-    sha256 = "0l7q8v00dhpbc9mh6baaaqc55kf44rszygx28dq3pwp5b5x33nir";
+    sha256 = "0p6z4ipj0drph3ryn8mnb3xn0vjfv54y1c5w5i9ixrxwz48h6bga";
   };
 
   postPatch = ''
@@ -24,9 +25,8 @@ buildPythonPackage rec {
 
   checkInputs = [ pyyaml pytestpep8 pytestflakes pytest glibcLocales ];
 
-  # See https://github.com/WoLpH/mt940/issues/64 for the disabled test
   checkPhase = ''
-    py.test -k "not mt940.models.FixedOffset"
+    py.test
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/multidict/default.nix b/pkgs/development/python-modules/multidict/default.nix
index eb5ef396a4fc7..76a494230066a 100644
--- a/pkgs/development/python-modules/multidict/default.nix
+++ b/pkgs/development/python-modules/multidict/default.nix
@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "multidict";
-  version = "4.4.2";
+  version = "4.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3c11e92c3dfc321014e22fb442bc9eb70e01af30d6ce442026b0c35723448c66";
+    sha256 = "024b8129695a952ebd93373e45b5d341dbb87c17ce49637b34000093f243dd4f";
   };
 
   checkInputs = [ pytest pytestrunner pytestcov ];
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index 79f0002c35a5b..1978ce816375f 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -30,21 +30,28 @@
 , which
 , bash
 , glibcLocales
+, callPackage
 }:
 
 assert !isPy3k -> configparser != null;
 
+let
+
+ # This is a temporary convenience package for changes waiting to be merged into the primary rdflib repo.
+ neurdflib = callPackage ./neurdflib.nix { };
+
+in
+
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.1.5";
+  version = "1.1.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d49bbe531cdbf0a049f1581e4d3c63231ff5978445cb380aa6e7f8f1d256a29c";
+    sha256 = "0iyi5w2h42bpssqj52ixm2kxp56yxfxdacb6xv5r24yv3hmwd4yn";
   };
 
-  # see https://github.com/nipy/nipype/issues/2240
-  patches = [ ./prov-version.patch ];
+  patches = [ ./move-uneeded-requires.patch ];
 
   postPatch = ''
     substituteInPlace nipype/interfaces/base/tests/test_core.py \
@@ -57,6 +64,7 @@ buildPythonPackage rec {
     funcsigs
     future
     networkx
+    neurdflib
     nibabel
     numpy
     packaging
@@ -72,12 +80,24 @@ buildPythonPackage rec {
     futures
   ];
 
-  checkInputs = [ pytest mock pytestcov pytest_xdist pytest-forked codecov which glibcLocales ];
+  checkInputs = [
+    codecov
+    glibcLocales
+    mock
+    pytest
+    pytest-forked
+    pytest_xdist
+    pytestcov
+    which
+  ];
 
   checkPhase = ''
-    LC_ALL="en_US.UTF-8" py.test -v --doctest-modules nipype
+    LC_ALL="en_US.UTF-8" pytest -v --doctest-modules nipype
   '';
 
+  # See: https://github.com/nipy/nipype/issues/2839
+  doCheck = false;
+
   meta = with stdenv.lib; {
     homepage = http://nipy.org/nipype/;
     description = "Neuroimaging in Python: Pipelines and Interfaces";
diff --git a/pkgs/development/python-modules/nipype/move-uneeded-requires.patch b/pkgs/development/python-modules/nipype/move-uneeded-requires.patch
new file mode 100644
index 0000000000000..89324285d182a
--- /dev/null
+++ b/pkgs/development/python-modules/nipype/move-uneeded-requires.patch
@@ -0,0 +1,31 @@
+diff --git a/nipype/info.py b/nipype/info.py
+index c6503ac..4379643 100644
+--- a/nipype/info.py
++++ b/nipype/info.py
+@@ -147,9 +147,6 @@ REQUIRES = [
+     'neurdflib',
+     'click>=%s' % CLICK_MIN_VERSION,
+     'funcsigs',
+-    'pytest>=%s' % PYTEST_MIN_VERSION,
+-    'pytest-xdist',
+-    'mock',
+     'pydotplus',
+     'pydot>=%s' % PYDOT_MIN_VERSION,
+     'packaging',
+@@ -159,7 +156,15 @@ REQUIRES = [
+ if sys.version_info <= (3, 4):
+     REQUIRES.append('configparser')
+ 
+-TESTS_REQUIRES = ['pytest-cov', 'codecov', 'pytest-env', 'coverage<5']
++TESTS_REQUIRES = [
++    'pytest>=%s' % PYTEST_MIN_VERSION,
++    'pytest-xdist',
++    'mock',
++    'pytest-cov',
++    'codecov',
++    'pytest-env',
++    'coverage<5'
++]
+ 
+ EXTRA_REQUIRES = {
+     'doc': ['Sphinx>=1.4', 'numpydoc', 'matplotlib', 'pydotplus', 'pydot>=1.2.3'],
diff --git a/pkgs/development/python-modules/nipype/neurdflib.nix b/pkgs/development/python-modules/nipype/neurdflib.nix
new file mode 100644
index 0000000000000..3042f7156879c
--- /dev/null
+++ b/pkgs/development/python-modules/nipype/neurdflib.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, isodate
+, html5lib
+, SPARQLWrapper
+, networkx
+, nose
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "neurdflib";
+  version = "5.0.0.post1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1qgmprixqxycxpjk9wjdmjykma14qqa2wcbx4nsldxi0ga7i7vv5";
+  };
+
+  propagatedBuildInputs = [ isodate html5lib SPARQLWrapper ];
+
+  checkInputs = [ networkx nose ];
+
+  # Python 2 syntax
+  # Failing doctest
+  doCheck = false;
+
+  checkPhase = ''
+    ${python.interpreter} run_tests.py
+  '';
+
+  meta = with lib; {
+    description = "A temporary convenience package for changes waiting to be merged into the primary rdflib repo";
+    homepage = https://pypi.org/project/neurdflib;
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/python-modules/nipype/prov-version.patch b/pkgs/development/python-modules/nipype/prov-version.patch
deleted file mode 100644
index 133295d0560bf..0000000000000
--- a/pkgs/development/python-modules/nipype/prov-version.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/nipype/info.py b/nipype/info.py
-index 1daa382e2..da338d0ea 100644
---- a/nipype/info.py
-+++ b/nipype/info.py
-@@ -108,7 +108,6 @@ DATEUTIL_MIN_VERSION = '2.2'
- PYTEST_MIN_VERSION = '3.0'
- FUTURE_MIN_VERSION = '0.16.0'
- SIMPLEJSON_MIN_VERSION = '3.8.0'
--PROV_VERSION = '1.5.0'
- CLICK_MIN_VERSION = '6.6.0'
- PYDOT_MIN_VERSION = '1.2.3'
- 
-@@ -140,7 +139,7 @@ REQUIRES = [
-     'traits>=%s' % TRAITS_MIN_VERSION,
-     'future>=%s' % FUTURE_MIN_VERSION,
-     'simplejson>=%s' % SIMPLEJSON_MIN_VERSION,
--    'prov==%s' % PROV_VERSION,
-+    'prov<2',
-     'click>=%s' % CLICK_MIN_VERSION,
-     'funcsigs',
-     'pytest>=%s' % PYTEST_MIN_VERSION,
diff --git a/pkgs/development/python-modules/pastel/default.nix b/pkgs/development/python-modules/pastel/default.nix
new file mode 100644
index 0000000000000..2d99447f724f4
--- /dev/null
+++ b/pkgs/development/python-modules/pastel/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchFromGitHub, isPy3k, pytest }:
+
+buildPythonPackage rec {
+  pname = "pastel";
+  version = "0.1.0";
+
+  # No tests in PyPi tarball
+  src = fetchFromGitHub {
+    owner = "sdispater";
+    repo = "pastel";
+    rev = version;
+    sha256 = "1b4ag7jr7j0sxly5g29imdq8g0d4ixhbck55dblr45mlsidydx0s";
+  };
+
+  checkInputs = [ pytest ];
+  checkPhase = ''
+    pytest tests -sq
+  '';
+
+  meta = with lib; {
+    homepage = https://github.com/sdispater/pastel;
+    description = "Bring colors to your terminal";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/piep/default.nix b/pkgs/development/python-modules/piep/default.nix
index 671f631a40c6e..0ef44f9817570 100644
--- a/pkgs/development/python-modules/piep/default.nix
+++ b/pkgs/development/python-modules/piep/default.nix
@@ -1,21 +1,21 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, nose
 , pygments
-, isPy3k
 }:
 
 buildPythonPackage rec {
-  version = "0.8.0";
+  version = "0.9.2";
   pname = "piep";
-  disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1wgkg1kc28jpya5k4zvbc9jmpa60b3d5c3gwxfbp15hw6smyqirj";
+    sha256 = "0b5anpsq16xkiisws95jif5s5mplkl1kdnhy0w0i6m0zcy50jnxq";
   };
 
   propagatedBuildInputs = [ pygments ];
+  checkInputs = [ nose ];
 
   meta = with stdenv.lib; {
     description = "Bringing the power of python to stream editing";
diff --git a/pkgs/development/python-modules/pika-pool/default.nix b/pkgs/development/python-modules/pika-pool/default.nix
index 5cb1e9027a908..5007fc78d10f7 100644
--- a/pkgs/development/python-modules/pika-pool/default.nix
+++ b/pkgs/development/python-modules/pika-pool/default.nix
@@ -11,6 +11,10 @@ buildPythonPackage rec {
     sha256 = "f3985888cc2788cdbd293a68a8b5702a9c955db6f7b8b551aeac91e7f32da397";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py --replace "pika >=0.9,<0.11" "pika"
+  '';
+
   # Tests require database connections
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/poetry/default.nix b/pkgs/development/python-modules/poetry/default.nix
new file mode 100644
index 0000000000000..6f7ebc4cbc929
--- /dev/null
+++ b/pkgs/development/python-modules/poetry/default.nix
@@ -0,0 +1,76 @@
+{ lib, buildPythonPackage, fetchPypi, callPackage
+, isPy27, isPy34
+, cleo
+, requests
+, cachy
+, requests-toolbelt
+, pyrsistent
+, pyparsing
+, cachecontrol
+, pkginfo
+, html5lib
+, shellingham
+, tomlkit
+, typing
+, pathlib2
+, virtualenv
+, functools32
+, pytest
+}:
+
+let
+  cleo6 = cleo.overrideAttrs (oldAttrs: rec {
+    version = "0.6.8";
+    src = fetchPypi {
+      inherit (oldAttrs) pname;
+      inherit version;
+      sha256 = "06zp695hq835rkaq6irr1ds1dp2qfzyf32v60vxpd8rcnxv319l5";
+    };
+  });
+
+  jsonschema3 = callPackage ./jsonschema.nix { };
+
+in buildPythonPackage rec {
+  pname = "poetry";
+  version = "0.12.10";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "00npb0jlimnk4r01zkhfmns4843j1hfhd388s326da5pd8n0dq7l";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace "3.0a3" "3.0.0a3"
+    substituteInPlace setup.py --replace "3.0a3" "3.0.0a3"
+  '';
+
+  propagatedBuildInputs = [
+    cleo6
+    requests
+    cachy
+    requests-toolbelt
+    jsonschema3
+    pyrsistent
+    pyparsing
+    cachecontrol
+    pkginfo
+    html5lib
+    shellingham
+    tomlkit
+  ] ++ lib.optionals (isPy27 || isPy34) [ typing pathlib2 ]
+    ++ lib.optionals isPy27 [ virtualenv functools32 ];
+
+  # No tests in Pypi tarball
+  doCheck = false;
+  checkInputs = [ pytest ];
+  checkPhase = ''
+    pytest tests
+  '';
+
+  meta = with lib; {
+    homepage = https://github.com/sdispater/poetry;
+    description = "Python dependency management and packaging made easy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/poetry/jsonschema.nix b/pkgs/development/python-modules/poetry/jsonschema.nix
new file mode 100644
index 0000000000000..9f7cf34b94160
--- /dev/null
+++ b/pkgs/development/python-modules/poetry/jsonschema.nix
@@ -0,0 +1,37 @@
+{ lib, buildPythonPackage, fetchPypi, isPy27, callPackage
+, attrs
+, pyrsistent
+, six
+, functools32
+, lockfile
+, setuptools_scm
+}:
+
+buildPythonPackage rec {
+  pname = "jsonschema";
+  version = "3.0.0a3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0pkhsq91rhk6384p0jxjkhc9yml2ya2l0mysyq78sb4981h45n6z";
+  };
+
+  nativeBuildInputs = [ setuptools_scm ];
+  propagatedBuildInputs = [
+    attrs
+    pyrsistent
+    six
+    lockfile
+  ] ++ lib.optional isPy27 functools32;
+
+  # tests for latest version rely on custom version of betterpaths that is
+  # difficult to deal with and isn't used on master
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = https://github.com/Julian/jsonschema;
+    description = "An implementation of JSON Schema validation for Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/py3status/default.nix b/pkgs/development/python-modules/py3status/default.nix
index edd98020f06d6..412b3b2342a5c 100644
--- a/pkgs/development/python-modules/py3status/default.nix
+++ b/pkgs/development/python-modules/py3status/default.nix
@@ -19,11 +19,11 @@
 
 buildPythonPackage rec {
   pname = "py3status";
-  version = "3.14";
+  version = "3.15";
   
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8775fb3903458a519593fc22b712ccac598464e319a12b9fdf04803fa60a1583";
+    sha256 = "78aa7fa0af707641e215ea93bfd4bb5fd47f18a7193d84ed60bb9e6cccb75b7f";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/pycassa/default.nix b/pkgs/development/python-modules/pycassa/default.nix
index 3791efc0e2e4d..d5b6805c2bb04 100644
--- a/pkgs/development/python-modules/pycassa/default.nix
+++ b/pkgs/development/python-modules/pycassa/default.nix
@@ -1,5 +1,18 @@
 { stdenv, buildPythonPackage, fetchPypi, thrift, isPy3k }:
 
+let
+
+  thrift' = thrift.overridePythonAttrs (old: rec {
+    version = "0.9.3";
+    src= fetchPypi {
+      inherit (old) pname;
+      inherit version;
+      sha256 = "0zl7cgckqy9j5vq8wyfzw82q1blkdpsblnmhv8c6ffcxs4xkvg6z";
+    };
+  });
+
+in
+
 buildPythonPackage rec {
   pname = "pycassa";
   version = "1.11.2";
@@ -15,7 +28,7 @@ buildPythonPackage rec {
   # running
   doCheck = false;
 
-  propagatedBuildInputs = [ thrift ];
+  propagatedBuildInputs = [ thrift' ];
 
   meta = {
     description = "A python client library for Apache Cassandra";
diff --git a/pkgs/development/python-modules/pygit2/default.nix b/pkgs/development/python-modules/pygit2/default.nix
index 313a3e5ab1897..2334e4a3431bc 100644
--- a/pkgs/development/python-modules/pygit2/default.nix
+++ b/pkgs/development/python-modules/pygit2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildPythonPackage, fetchPypi, fetchpatch, isPyPy, libgit2, six, cffi }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, fetchpatch, isPyPy, libgit2_0_27, six, cffi }:
 
 buildPythonPackage rec {
   pname = "pygit2";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
   };
 
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    export DYLD_LIBRARY_PATH="${libgit2}/lib"
+    export DYLD_LIBRARY_PATH="${libgit2_0_27}/lib"
   '';
 
   patches = [ (fetchpatch {
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     sha256 = "18x1fpmywhjjr4lvakwmy34zpxfqi8pqqj48g1wcib39lh3s7l4f";
   }) ];
 
-  propagatedBuildInputs = [ libgit2 six ] ++ lib.optional (!isPyPy) cffi;
+  propagatedBuildInputs = [ libgit2_0_27 six ] ++ lib.optional (!isPyPy) cffi;
 
   preCheck = ''
     # disable tests that require networking
diff --git a/pkgs/development/python-modules/pylev/default.nix b/pkgs/development/python-modules/pylev/default.nix
new file mode 100644
index 0000000000000..895171ff7138f
--- /dev/null
+++ b/pkgs/development/python-modules/pylev/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "pylev";
+  version = "1.3.0";
+
+  # No tests in PyPi tarball
+  src = fetchFromGitHub {
+    owner = "toastdriven";
+    repo = "pylev";
+    # Can't use a tag because it's missing
+    # https://github.com/toastdriven/pylev/issues/10
+    # rev = "v${version};
+    rev = "72e3d490515c3188e2acac9c15ea1b466f9ff938";
+    sha256 = "18dg1rfnqgfl6x4vafiq4la9d7f65xak19gcvngslq0bm1z6hyd8";
+  };
+
+  meta = with lib; {
+    homepage = https://github.com/toastdriven/pylev;
+    description = "A pure Python Levenshtein implementation that's not freaking GPL'd";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyrsistent/default.nix b/pkgs/development/python-modules/pyrsistent/default.nix
index 0c32c4ef38657..ceb0d718a403b 100644
--- a/pkgs/development/python-modules/pyrsistent/default.nix
+++ b/pkgs/development/python-modules/pyrsistent/default.nix
@@ -4,6 +4,7 @@
 , six
 , pytest
 , hypothesis
+, pytestrunner
 }:
 
 buildPythonPackage rec {
@@ -16,11 +17,11 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [ six ];
-  buildInputs = [ pytest hypothesis ];
 
-  checkPhase = ''
-    py.test
-  '';
+  checkInputs = [ pytestrunner pytest hypothesis ];
+
+  # pytestrunner is only needed to run tests
+  patches = [ ./no-setup-requires-pytestrunner.patch ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/tobgu/pyrsistent/;
diff --git a/pkgs/development/python-modules/pyrsistent/no-setup-requires-pytestrunner.patch b/pkgs/development/python-modules/pyrsistent/no-setup-requires-pytestrunner.patch
new file mode 100644
index 0000000000000..74d85dc42931c
--- /dev/null
+++ b/pkgs/development/python-modules/pyrsistent/no-setup-requires-pytestrunner.patch
@@ -0,0 +1,15 @@
+diff --git a/setup.py b/setup.py
+index 90a39a5..7bf444f 100644
+--- a/setup.py
++++ b/setup.py
+@@ -77,9 +77,8 @@ setup(
+         'Programming Language :: Python :: Implementation :: PyPy',
+     ],
+     test_suite='tests',
+-    tests_require=['pytest','hypothesis'],
++    tests_require=['pytest-runner', 'pytest','hypothesis'],
+     scripts=[],
+-    setup_requires=['pytest-runner'],
+     ext_modules=extensions,
+     cmdclass={'build_ext': custom_build_ext},
+     install_requires=['six'],
diff --git a/pkgs/development/python-modules/scapy/default.nix b/pkgs/development/python-modules/scapy/default.nix
index 29dd4638b23bd..18dd6e58f5c38 100644
--- a/pkgs/development/python-modules/scapy/default.nix
+++ b/pkgs/development/python-modules/scapy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "scapy";
-  version = "2.4.1";
+  version = "2.4.2";
 
   disabled = isPyPy;
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "secdev";
     repo = "scapy";
     rev = "v${version}";
-    sha256 = "1k5hfhgq87b99x854s50ffyzh6jqv263n1lnr4y3pm6as9r7iff5";
+    sha256 = "03xzjklvc6y4d87k0rqpx5h112ld5nvgfldrbd8c4mx6f9mmd11n";
   };
 
   # TODO: Temporary workaround
diff --git a/pkgs/development/python-modules/thrift/default.nix b/pkgs/development/python-modules/thrift/default.nix
index 6897a5bbba858..d5a83832cb27e 100644
--- a/pkgs/development/python-modules/thrift/default.nix
+++ b/pkgs/development/python-modules/thrift/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , buildPythonPackage
 , fetchPypi
+, six
 }:
 
 buildPythonPackage rec {
@@ -12,6 +13,8 @@ buildPythonPackage rec {
     sha256 = "7d59ac4fdcb2c58037ebd4a9da5f9a49e3e034bf75b3f26d9fe48ba3d8806e6b";
   };
 
+  propagatedBuildInputs = [ six ];
+
   # No tests. Breaks when not disabling.
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/tinycss/default.nix b/pkgs/development/python-modules/tinycss/default.nix
index ab6a4183df507..223d778095af4 100644
--- a/pkgs/development/python-modules/tinycss/default.nix
+++ b/pkgs/development/python-modules/tinycss/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pytest
 , python
+, cython
 , cssutils
 , isPyPy
 }:
@@ -18,6 +19,17 @@ buildPythonPackage rec {
 
   checkInputs = [ pytest ];
   propagatedBuildInputs = [ cssutils ];
+  nativeBuildInputs = [
+    cython
+  ];
+
+  preBuild = ''
+    # Force cython to re-generate this file. If it is present, cython will
+    # think it is "up to date" even though it was generated with an older,
+    # incompatible version of cython. See
+    # https://github.com/Kozea/tinycss/issues/17.
+    rm tinycss/speedups.c
+  '';
 
   checkPhase = ''
     py.test $out/${python.sitePackages}
diff --git a/pkgs/development/python-modules/tomlkit/default.nix b/pkgs/development/python-modules/tomlkit/default.nix
new file mode 100644
index 0000000000000..47cf737f18896
--- /dev/null
+++ b/pkgs/development/python-modules/tomlkit/default.nix
@@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, fetchPypi, isPy27, isPy34
+, enum34, functools32, typing
+}:
+
+buildPythonPackage rec {
+  pname = "tomlkit";
+  version = "0.5.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1hjfzlb6y694pkadygcaq1n63di97pxgq2zpc74in1axc5166l6n";
+  };
+
+  propagatedBuildInputs =
+    lib.optionals isPy27 [ enum34 functools32 ]
+    ++ lib.optional (isPy27 || isPy34) typing;
+
+  # The Pypi tarball doesn't include tests, and the GitHub source isn't
+  # buildable until we bootstrap poetry, see
+  # https://github.com/NixOS/nixpkgs/pull/53599#discussion_r245855665
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = https://github.com/sdispater/tomlkit;
+    description = "Style-preserving TOML library for Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakewaksbaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/xml2rfc/default.nix b/pkgs/development/python-modules/xml2rfc/default.nix
index ae8867b3ddd67..91933c5f95ece 100644
--- a/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/pkgs/development/python-modules/xml2rfc/default.nix
@@ -1,4 +1,6 @@
-{ lib, fetchPypi, buildPythonPackage, intervaltree, pyflakes, requests, lxml }:
+{ lib, fetchPypi, buildPythonPackage, intervaltree, pyflakes, requests, lxml, google-i18n-address
+, pycountry, html5lib, six
+}:
 
 buildPythonPackage rec {
   pname = "xml2rfc";
@@ -9,7 +11,20 @@ buildPythonPackage rec {
     sha256 = "64609a2194d18c03e2348f1ea2fb97208b3455dfb76a16900143813aa61b6d3c";
   };
 
-  propagatedBuildInputs = [ intervaltree pyflakes requests lxml ];
+  propagatedBuildInputs = [
+    intervaltree
+    pyflakes
+    requests
+    lxml
+    google-i18n-address
+    pycountry
+    html5lib
+    six
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
 
   meta = with lib; {
     description = "Tool generating IETF RFCs and drafts from XML sources";
diff --git a/pkgs/development/python-modules/xvfbwrapper/default.nix b/pkgs/development/python-modules/xvfbwrapper/default.nix
index 4ba9cd61d4c5b..c7708d0f20b73 100644
--- a/pkgs/development/python-modules/xvfbwrapper/default.nix
+++ b/pkgs/development/python-modules/xvfbwrapper/default.nix
@@ -15,6 +15,9 @@ buildPythonPackage rec {
   };
   propagatedBuildInputs = [ xorgserver ];
 
+  # See: https://github.com/cgoldberg/xvfbwrapper/issues/30
+  doCheck = false;
+
   checkInputs = [ mock ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/build-managers/bazel/default.nix b/pkgs/development/tools/build-managers/bazel/default.nix
index 9aff59f3497f1..510ad3956b689 100644
--- a/pkgs/development/tools/build-managers/bazel/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/default.nix
@@ -13,8 +13,8 @@
 let
   srcDeps = lib.singleton (
     fetchurl {
-      url = "https://github.com/google/desugar_jdk_libs/archive/fd937f4180c1b557805219af4482f1a27eb0ff2b.zip";
-      sha256 = "04hs399340xfwcdajbbcpywnb2syp6z5ydwg966if3hqdb2zrf23";
+      url = "https://github.com/google/desugar_jdk_libs/archive/915f566d1dc23bc5a8975320cd2ff71be108eb9c.zip";
+      sha256 = "0b926df7yxyyyiwm9cmdijy6kplf0sghm23sf163zh8wrk87wfi7";
     }
   );
 
@@ -23,12 +23,12 @@ let
     for i in ${builtins.toString srcDeps}; do cp $i $out/$(stripHash $i); done
   '';
 
-  defaultShellPath = lib.makeBinPath [ bash coreutils findutils gnugrep gnused which ];
+  defaultShellPath = lib.makeBinPath [ bash coreutils findutils gnugrep gnused which unzip ];
 
 in
 stdenv.mkDerivation rec {
 
-  version = "0.20.0";
+  version = "0.21.0";
 
   meta = with lib; {
     homepage = "https://github.com/bazelbuild/bazel/";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    sha256 = "1g9hglly5199gcw929fzc5f0d0dwlharkh387h58p1fq9ylayi8r";
+    sha256 = "1d3x0f1hzaiqq00pd65bks7v8kbv57m13jsing7y0y9id0g87jvc";
   };
 
   sourceRoot = ".";
@@ -78,6 +78,7 @@ stdenv.mkDerivation rec {
   '';
 
   postPatch = let
+
     darwinPatches = ''
       # Disable Bazel's Xcode toolchain detection which would configure compilers
       # and linkers from Xcode instead of from PATH
@@ -115,27 +116,45 @@ stdenv.mkDerivation rec {
         sed -i -e "s,/usr/bin/install_name_tool,${cctools}/bin/install_name_tool,g" $wrapper
       done
     '';
+
     genericPatches = ''
-      find src/main/java/com/google/devtools -type f -print0 | while IFS="" read -r -d "" path; do
+      # substituteInPlace is rather slow, so prefilter the files with grep
+      grep -rlZ /bin src/main/java/com/google/devtools | while IFS="" read -r -d "" path; do
+        # If you add more replacements here, you must change the grep above!
+        # Only files containing /bin are taken into account.
         substituteInPlace "$path" \
           --replace /bin/bash ${customBash}/bin/bash \
           --replace /usr/bin/env ${coreutils}/bin/env \
           --replace /bin/true ${coreutils}/bin/true
       done
+
       # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
       substituteInPlace scripts/bootstrap/compile.sh \
           --replace /bin/sh ${customBash}/bin/bash
 
-      echo "build --experimental_distdir=${distDir}" >> .bazelrc
-      echo "fetch --experimental_distdir=${distDir}" >> .bazelrc
-      echo "build --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\"" >> .bazelrc
-      echo "build --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\"" >> .bazelrc
-      echo "build --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\"" >> .bazelrc
-      echo "build --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\"" >> .bazelrc
-      sed -i -e "420 a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" scripts/bootstrap/compile.sh
-      sed -i -e "420 a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" scripts/bootstrap/compile.sh
-      sed -i -e "420 a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" scripts/bootstrap/compile.sh
-      sed -i -e "420 a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" scripts/bootstrap/compile.sh
+      # We only build with JDK8 for now, since JDK11 does not compile bazel
+      substituteInPlace tools/jdk/default_java_toolchain.bzl \
+        --replace '"jvm_opts": JDK9_JVM_OPTS' \
+                  '"jvm_opts": JDK8_JVM_OPTS'
+
+      # add nix environment vars to .bazelrc
+      cat >> .bazelrc <<EOF
+      build --experimental_distdir=${distDir}
+      fetch --experimental_distdir=${distDir}
+      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
+      build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
+      build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
+      build --host_javabase='@local_jdk//:jdk'
+      EOF
+
+      # add the same environment vars to compile.sh
+      sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \
+          -i scripts/bootstrap/compile.sh
 
       # --experimental_strict_action_env (which will soon become the
       # default, see bazelbuild/bazel#2574) hardcodes the default
@@ -159,6 +178,8 @@ stdenv.mkDerivation rec {
     buildJdk
   ];
 
+  # when a command can’t be found in a bazel build, you might also
+  # need to add it to `defaultShellPath`.
   nativeBuildInputs = [
     zip
     python
diff --git a/pkgs/development/tools/build-managers/dub/default.nix b/pkgs/development/tools/build-managers/dub/default.nix
index cce34b17040ea..18c6eff76e1f4 100644
--- a/pkgs/development/tools/build-managers/dub/default.nix
+++ b/pkgs/development/tools/build-managers/dub/default.nix
@@ -4,7 +4,7 @@ let
 
   dubBuild = stdenv.mkDerivation rec {
     name = "dubBuild-${version}";
-    version = "1.12.1";
+    version = "1.13.0";
 
     enableParallelBuilding = true;
 
@@ -12,7 +12,7 @@ let
       owner = "dlang";
       repo = "dub";
       rev = "v${version}";
-      sha256 = "0q4968vxgfxhq6ywhdvj6sqddwf7aadqmmpfqc6nl65r7jyga52a";
+      sha256 = "1wd5pdnbaafj33bbg188w0iz28ps4cyjangb12g2s9dyic29zjqv";
     };
 
     postUnpack = ''
diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 4faf524af1177..30422c353afc6 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -3,18 +3,18 @@
 
 stdenv.mkDerivation rec {
   pname = "leiningen";
-  version = "2.8.1";
+  version = "2.8.3";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://raw.github.com/technomancy/leiningen/${version}/bin/lein-pkg";
-    sha256 = "0wk4m7m66xxx7i3nis08mc8qna7acgcmpim562vdyyrpbxdhj24i";
+    sha256 = "1jbrm4vdvwskbi9sxvn6i7h2ih9c3nfld63nx58nblghvlcb9vwx";
   };
 
   jarsrc = fetchurl {
     # NOTE: This is actually a .jar, Github has issues
     url = "https://github.com/technomancy/leiningen/releases/download/${version}/${name}-standalone.zip";
-    sha256 = "0n3wkb0a9g25r1xq93lskay2lw210qymz2qakjnl5vr5zz3vnjgw";
+    sha256 = "07kb7d84llp24l959gndnfmislnnvgpsxghmgfdy8chy7g4sy2kz";
   };
 
   JARNAME = "${name}-standalone.jar";
diff --git a/pkgs/development/tools/build-managers/scons/default.nix b/pkgs/development/tools/build-managers/scons/default.nix
index 3d919be2ebafb..d9bfb40b46e7f 100644
--- a/pkgs/development/tools/build-managers/scons/default.nix
+++ b/pkgs/development/tools/build-managers/scons/default.nix
@@ -3,10 +3,6 @@
 let
   mkScons = args: callPackage (import ./common.nix args) { };
 in {
-  scons_2_5_1 = mkScons {
-    version = "2.5.1";
-    sha256 = "1wji1z9jdkhnmm99apx6fhld9cs52rr56aigniyrcsmlwy52298b";
-  };
   scons_3_0_1 = mkScons {
     version = "3.0.1";
     sha256 = "0wzid419mlwqw9llrg8gsx4nkzhqy16m4m40r0xnh6cwscw5wir4";
diff --git a/pkgs/development/tools/dtools/default.nix b/pkgs/development/tools/dtools/default.nix
index 9fc1a682c60af..ccfcfaace014e 100644
--- a/pkgs/development/tools/dtools/default.nix
+++ b/pkgs/development/tools/dtools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "dtools-${version}";
-  version = "2.083.1";
+  version = "2.084.0";
 
   srcs = [
     (fetchFromGitHub {
       owner = "dlang";
       repo = "dmd";
       rev = "v${version}";
-      sha256 = "0b52yq7slgbrawb22kib9bk2x9xjiy6axwz1317fck5axl093d90";
+      sha256 = "1v61spdamncl8c1bzjc19b03p4jl0ih5zq9b7cqsy9ix7qaxmikf";
       name = "dmd";
     })
     (fetchFromGitHub {
diff --git a/pkgs/development/tools/hcloud/default.nix b/pkgs/development/tools/hcloud/default.nix
index 527737855bdac..fd05e12b4d552 100644
--- a/pkgs/development/tools/hcloud/default.nix
+++ b/pkgs/development/tools/hcloud/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "hcloud-${version}";
-  version = "1.9.1";
+  version = "1.11.0";
   
   goPackagePath = "github.com/hetznercloud/cli";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "hetznercloud";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "0qc4mzjd1q3xv1j0dxv5qvk443bdhh5hlbv3i3444v36wycj3171";
+    sha256 = "0iknw14728l2mynrvb3fiqm7y893ppp22gbb3mppi6iy3as94f1f";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/development/tools/hcloud/deps.nix b/pkgs/development/tools/hcloud/deps.nix
index 66612d54daf76..b0b544701283c 100644
--- a/pkgs/development/tools/hcloud/deps.nix
+++ b/pkgs/development/tools/hcloud/deps.nix
@@ -41,8 +41,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/hetznercloud/hcloud-go";
-      rev = "eaf050e4f37028d2ca5f99a2fb38ead2c9b293d3";
-      sha256 = "0ki4vk02da4dj6prx3gz8cvrfkj6xb72sjkwqcrbdp4n4klasngi";
+      rev = "ecee721a51a772254d0104bf4d796358e40d6bbd";
+      sha256 = "0bwym7f8am14yfh584p28d8lnj4f9mhqi05l1mlrl315xn0c78v3";
     };
   }
   {
@@ -50,8 +50,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/pelletier/go-toml";
-      rev = "81a861c69d25a841d0c4394f0e6f84bc8c5afae0";
-      sha256 = "1sk301rm7rm5hfcx7z7vgask5i80wx3mhyxjr3xnm5q1rvdj6vsl";
+      rev = "27c6b39a135b7dc87a14afb068809132fb7a9a8f";
+      sha256 = "13ldxh43xf4prmcrjzriz3gxpnijpqlzrgyhh7bnkj7lkhryfpk9";
     };
   }
   {
@@ -59,8 +59,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/spf13/cobra";
-      rev = "8d114be902bc9f08717804830a55c48378108a28";
-      sha256 = "1ipmdjwqxyvj6cv33xm1m4ngyx49jsnp8n9jd8fjbkng8aw3q4al";
+      rev = "d2d81d9a96e23f0255397222bb0b4e3165e492dc";
+      sha256 = "14nhpiyhz2lm468y5sm1vyxks5aky12kmbhmqq319s92lkm494cy";
     };
   }
   {
@@ -68,8 +68,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/spf13/pflag";
-      rev = "298182f68c66c05229eb03ac171abe6e309ee79a";
-      sha256 = "1cj3cjm7d3zk0mf1xdybh0jywkbbw7a6yr3y22x9sis31scprswd";
+      rev = "24fa6976df40757dce6aea913e7b81ade90530e1";
+      sha256 = "0rf6prz6gl0l1b3wijzdgq887cdwigvzxvz6gqbm5l8pkq3fx1m9";
     };
   }
   {
@@ -86,8 +86,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/crypto";
-      rev = "0c41d7ab0a0ee717d4590a44bcb987dfd9e183eb";
-      sha256 = "1mff9l49dffsak7vxg3dzxlzkgm5nqfksh9cbsjpmngpc5pk0fbc";
+      rev = "ff983b9c42bc9fbf91556e191cc8efb585c16908";
+      sha256 = "1hpr06kzn8jnn3gvzp0p9zn4fz4l9h69f7x66idx142w4xdlaanz";
     };
   }
   {
@@ -95,8 +95,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev = "fa43e7bc11baaae89f3f902b2b4d832b68234844";
-      sha256 = "1z96xhgw930jpd53g1sy9x6wiijgz751czbvr2zzgc55y0md1mfw";
+      rev = "7fbe1cd0fcc20051e1fcb87fbabec4a1bacaaeba";
+      sha256 = "0y49s4kazign9nsw2x3h39cgs14lqi57m4hrka26w49z8a1xdyc6";
     };
   }
 ]
diff --git a/pkgs/development/tools/icestorm/default.nix b/pkgs/development/tools/icestorm/default.nix
index 68e217f9aabbf..0d96ec02c4ca8 100644
--- a/pkgs/development/tools/icestorm/default.nix
+++ b/pkgs/development/tools/icestorm/default.nix
@@ -1,4 +1,13 @@
-{ stdenv, fetchFromGitHub, python3, libftdi, pkgconfig }:
+{ stdenv, fetchFromGitHub
+, pkgconfig, libftdi
+, python3, pypy3
+}:
+
+let
+  pypyCompatible = stdenv.isx86_64; /* pypy3 seems broken on i686 */
+  pythonPkg      = if pypyCompatible then pypy3 else python3;
+  pythonInterp   = if pypyCompatible then "pypy3" else "python3";
+in
 
 stdenv.mkDerivation rec {
   name = "icestorm-${version}";
@@ -12,14 +21,28 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ python3 libftdi ];
+  buildInputs = [ pythonPkg libftdi ];
   makeFlags = [ "PREFIX=$(out)" ];
 
+  enableParallelBuilding = true;
+
   # fix icebox_vlog chipdb path. icestorm issue:
   #   https://github.com/cliffordwolf/icestorm/issues/125
+  #
+  # also, fix up the path to the chosen Python interpreter. for pypy-compatible
+  # platforms, it offers significant performance improvements.
   patchPhase = ''
     substituteInPlace ./icebox/icebox_vlog.py \
       --replace /usr/local/share "$out/share"
+
+    for x in icefuzz/Makefile icebox/Makefile icetime/Makefile; do
+      substituteInPlace "$x" --replace python3 "${pythonInterp}"
+    done
+
+    for x in $(find . -type f -iname '*.py'); do
+      substituteInPlace "$x" \
+        --replace '/usr/bin/env python3' '${pythonPkg}/bin/${pythonInterp}'
+    done
   '';
 
   meta = {
@@ -30,9 +53,9 @@ stdenv.mkDerivation rec {
       FPGAs and providing simple tools for analyzing and
       creating bitstream files.
     '';
-    homepage = http://www.clifford.at/icestorm/;
-    license = stdenv.lib.licenses.isc;
+    homepage    = http://www.clifford.at/icestorm/;
+    license     = stdenv.lib.licenses.isc;
     maintainers = with stdenv.lib.maintainers; [ shell thoughtpolice ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms   = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/development/tools/literate-programming/Literate/default.nix b/pkgs/development/tools/literate-programming/Literate/default.nix
index d8afdf54a9334..035374d3e9006 100644
--- a/pkgs/development/tools/literate-programming/Literate/default.nix
+++ b/pkgs/development/tools/literate-programming/Literate/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchgit, dmd, dub }:
 
 stdenv.mkDerivation {
-  name = "Literate-2018-12-23";
+  name = "Literate-2019-01-08";
 
   src = fetchgit {
     url = "https://github.com/zyedidia/Literate.git";
-    rev = "99a0b7dd1ac451c2386094be06364df9386c3862";
-    sha256 = "0jvciajr33iz049m0yal41mz9p8nxmwkpq2mrfhg1ysx2zv3q3pm";
+    rev = "e20c5c86713701d4d17fd2881779d758a27a3e5a";
+    sha256 = "1pr7iipcnp6jxi13341p5b3szdrvs7aixpfbwifj6lgbb45vg9sm";
   };
 
   buildInputs = [ dmd dub ];
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index ecc86d51a06e8..6b1918a5d982a 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -6,8 +6,8 @@ let
   ## fetchgit info
   url = git://sourceware.org/git/systemtap.git;
   rev = "release-${version}";
-  sha256 = "0hckbmrlcz5nj438409fmdjjaaqzf68r2242v10lkssw5daia1gj";
-  version = "3.3";
+  sha256 = "075p45ndr4pzrf5679hcsw1ws4x0xqvx3m037v04545762hki6la";
+  version = "4.0";
 
   inherit (kernel) stdenv;
   inherit (stdenv) lib;
diff --git a/pkgs/development/tools/repository-managers/nexus/default.nix b/pkgs/development/tools/repository-managers/nexus/default.nix
index 39e37b217cf32..8b42ed124360c 100644
--- a/pkgs/development/tools/repository-managers/nexus/default.nix
+++ b/pkgs/development/tools/repository-managers/nexus/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "nexus-${version}";
-  version = "3.12.1-01";
+  version = "3.14.0-04";
 
   src = fetchurl {
     url = "https://sonatype-download.global.ssl.fastly.net/nexus/3/nexus-${version}-unix.tar.gz";
-    sha256 = "1vv50zv3cr42rq1g16gdl2d1hrxna2jjynlr7kivzlbyfq89ic3f";
+    sha256 = "1ql707672xhybmfajjmli9w0wcf1f26skq8i5kqirms2364wg35f";
   };
 
   sourceRoot = name;
@@ -41,6 +41,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.sonatype.org/nexus;
     license = licenses.epl10;
     platforms = platforms.all;
-    maintainers = with maintainers; [ aespinosa ironpinguin ma27 ];
+    maintainers = with maintainers; [ aespinosa ironpinguin ma27 zaninime ];
   };
 }
diff --git a/pkgs/development/tools/rubocop/Gemfile.lock b/pkgs/development/tools/rubocop/Gemfile.lock
index 9c6f2fc32d211..beee9772bebd3 100644
--- a/pkgs/development/tools/rubocop/Gemfile.lock
+++ b/pkgs/development/tools/rubocop/Gemfile.lock
@@ -2,23 +2,23 @@ GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.0)
-    jaro_winkler (1.5.1)
+    jaro_winkler (1.5.2)
     parallel (1.12.1)
-    parser (2.5.1.2)
+    parser (2.5.3.0)
       ast (~> 2.4.0)
     powerpack (0.1.2)
     rainbow (3.0.0)
-    rake (12.3.1)
-    rubocop (0.59.1)
+    rake (12.3.2)
+    rubocop (0.62.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
       parser (>= 2.5, != 2.5.1.1)
       powerpack (~> 0.1)
       rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
+      unicode-display_width (~> 1.4.0)
     ruby-progressbar (1.10.0)
-    unicode-display_width (1.4.0)
+    unicode-display_width (1.4.1)
 
 PLATFORMS
   ruby
diff --git a/pkgs/development/tools/rubocop/gemset.nix b/pkgs/development/tools/rubocop/gemset.nix
index 862f655b49da2..57146a9a15e67 100644
--- a/pkgs/development/tools/rubocop/gemset.nix
+++ b/pkgs/development/tools/rubocop/gemset.nix
@@ -8,12 +8,14 @@
     version = "2.4.0";
   };
   jaro_winkler = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rr797nqz081bfk30m2apj5h24bg5d1jr1c8p3xwx4hbwsrbclah";
+      sha256 = "1zz27z88qznix4r65gd9h56gl177snlfpgv10b0s69vi8qpl909l";
       type = "gem";
     };
-    version = "1.5.1";
+    version = "1.5.2";
   };
   parallel = {
     source = {
@@ -25,12 +27,14 @@
   };
   parser = {
     dependencies = ["ast"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zp89zg7iypncszxsjp8kiccrpbdf728jl449g6cnfkz990fyb5k";
+      sha256 = "1zjk0w1kjj3xk8ymy1430aa4gg0k8ckphfj88br6il4pm83f0n1f";
       type = "gem";
     };
-    version = "2.5.1.2";
+    version = "2.5.3.0";
   };
   powerpack = {
     source = {
@@ -49,21 +53,25 @@
     version = "3.0.0";
   };
   rake = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1idi53jay34ba9j68c3mfr9wwkg3cd9qh0fn9cg42hv72c6q8dyg";
+      sha256 = "1sy5a7nh6xjdc9yhcw31jji7ssrf9v5806hn95gbrzr998a2ydjn";
       type = "gem";
     };
-    version = "12.3.1";
+    version = "12.3.2";
   };
   rubocop = {
     dependencies = ["jaro_winkler" "parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hz4slfisbq8nqs83mvvh6yv5hb7z7zx9fxvv9cka6b9ldvr2i2b";
+      sha256 = "03narxzrpbilwbhr19qklvxhg22i8jkfar4igb1l8m73jydpxfvk";
       type = "gem";
     };
-    version = "0.59.1";
+    version = "0.62.0";
   };
   ruby-progressbar = {
     source = {
@@ -74,11 +82,13 @@
     version = "1.10.0";
   };
   unicode-display_width = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0040bsdpcmvp8w31lqi2s9s4p4h031zv52401qidmh25cgyh4a57";
+      sha256 = "0bq528fibi8s0jmxz0xzlgzggdq0x4fx46wfqz49478pv8gb2diq";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.4.1";
   };
 }
\ No newline at end of file
diff --git a/pkgs/development/tools/rust/bindgen/default.nix b/pkgs/development/tools/rust/bindgen/default.nix
index 836003eeb7362..5a1c2364a777c 100644
--- a/pkgs/development/tools/rust/bindgen/default.nix
+++ b/pkgs/development/tools/rust/bindgen/default.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
     chmod +x $out/bin/bindgen
   '';
 
-  doCheck = false; # half the tests fail because our rustfmt is not nightly enough
+  doCheck = true;
   checkInputs =
     let fakeRustup = writeScriptBin "rustup" ''
       #!${stdenv.shell}
@@ -42,6 +42,10 @@ rustPlatform.buildRustPackage rec {
     fakeRustup # the test suite insists in calling `rustup run nightly rustfmt`
     clang
   ];
+  preCheck = ''
+    # for the ci folder, notably
+    patchShebangs .
+  '';
 
   meta = with stdenv.lib; {
     description = "C and C++ binding generator";
diff --git a/pkgs/development/tools/rust/rustfmt/default.nix b/pkgs/development/tools/rust/rustfmt/default.nix
index b8585dace5446..4684841cf4784 100644
--- a/pkgs/development/tools/rust/rustfmt/default.nix
+++ b/pkgs/development/tools/rust/rustfmt/default.nix
@@ -1,17 +1,28 @@
-{ stdenv, fetchFromGitHub, rustPlatform }:
+{ stdenv, fetchFromGitHub, rustPlatform, darwin }:
 
 rustPlatform.buildRustPackage rec {
   name = "rustfmt-${version}";
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
-    owner = "rust-lang-nursery";
+    owner = "rust-lang";
     repo = "rustfmt";
     rev = "${version}";
-    sha256 = "12l3ff0s0pzhcf5jbs8wqawjk4jghhhz8j6dq1n5201yvny12jlr";
+    sha256 = "17ady2zq4jcbgawgpfszrkp6kxabb2f261g82y2az7nfax1h1pwy";
   };
 
-  cargoSha256 = "0gppki9mgx99xipapg36ydwk1bplygnz6sbyzbg46vhn10iggfwm";
+  cargoSha256 = "0v8iq50h9368kai3m710br5cxc3p6mpbwz1v6gaf5802n48liqs8";
+
+  buildInputs = stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+
+  # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
+  RUSTC_BOOTSTRAP = 1;
+
+  # we run tests in debug mode so tests look for a debug build of
+  # rustfmt. Anyway this adds nearly no compilation time.
+  preCheck = ''
+    cargo build
+  '';
 
   meta = with stdenv.lib; {
     description = "A tool for formatting Rust code according to style guidelines";
diff --git a/pkgs/development/tools/yarn/default.nix b/pkgs/development/tools/yarn/default.nix
index e2e115992bc63..2bbb0bc608098 100644
--- a/pkgs/development/tools/yarn/default.nix
+++ b/pkgs/development/tools/yarn/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "yarn-${version}";
-  version = "1.12.3";
+  version = "1.13.0";
 
   src = fetchzip {
     url = "https://github.com/yarnpkg/yarn/releases/download/v${version}/yarn-v${version}.tar.gz";
-    sha256 = "0izn7lfvfw046qlxdgiiiyqj24sl2yclm6v8bzy8ilsr00csbrm2";
+    sha256 = "0wkh8m41g5sajxlchsaqardn4v2ax06xywk12fwdjn5j3sxlgq2a";
   };
 
   buildInputs = [ nodejs ];
diff --git a/pkgs/games/openra/common.nix b/pkgs/games/openra/common.nix
new file mode 100644
index 0000000000000..e90f8170e18ee
--- /dev/null
+++ b/pkgs/games/openra/common.nix
@@ -0,0 +1,87 @@
+/*  The reusable code, and package attributes, between OpenRA engine packages (engine.nix)
+    and out-of-tree mod packages (mod.nix).
+*/
+{ stdenv, makeSetupHook, curl, unzip, dos2unix, pkgconfig, makeWrapper
+, lua, mono, dotnetPackages, python
+, libGL, openal, SDL2
+, zenity
+}:
+
+with stdenv.lib;
+
+let
+  path = makeBinPath ([ mono python ] ++ optional (zenity != null) zenity);
+  rpath = makeLibraryPath [ lua openal SDL2 ];
+  mkdirp = makeSetupHook { } ./mkdirp.sh;
+
+in {
+  patchEngine = dir: version: ''
+    sed -i \
+      -e 's/^VERSION.*/VERSION = ${version}/g' \
+      -e '/fetch-geoip-db/d' \
+      -e '/GeoLite2-Country.mmdb.gz/d' \
+      ${dir}/Makefile
+
+    sed -i 's|locations=.*|locations=${lua}/lib|' ${dir}/thirdparty/configure-native-deps.sh
+  '';
+
+  wrapLaunchGame = openraSuffix: ''
+    # Setting TERM=xterm fixes an issue with terminfo in mono: System.Exception: Magic number is wrong: 542
+    # https://github.com/mono/mono/issues/6752#issuecomment-365212655
+    wrapProgram $out/lib/openra${openraSuffix}/launch-game.sh \
+      --prefix PATH : "${path}" \
+      --prefix LD_LIBRARY_PATH : "${rpath}" \
+      --set TERM xterm
+
+    makeWrapper $out/lib/openra${openraSuffix}/launch-game.sh $(mkdirp $out/bin)/openra${openraSuffix} \
+      --run "cd $out/lib/openra${openraSuffix}"
+  '';
+
+  packageAttrs = {
+    buildInputs = with dotnetPackages; [
+      FuzzyLogicLibrary
+      MaxMindDb
+      MaxMindGeoIP2
+      MonoNat
+      NewtonsoftJson
+      NUnit3
+      NUnitConsole
+      OpenNAT
+      RestSharp
+      SharpFont
+      SharpZipLib
+      SmartIrc4net
+      StyleCopMSBuild
+      StyleCopPlusMSBuild
+    ] ++ [
+      lua
+      libGL
+      openal
+      SDL2
+    ];
+
+    # TODO: Test if this is correct.
+    nativeBuildInputs = [
+      curl
+      unzip
+      dos2unix
+      pkgconfig
+      makeWrapper
+      mkdirp
+      mono
+      python
+    ];
+
+    makeFlags = "prefix=$(out)";
+
+    doCheck = true;
+
+    dontStrip = true;
+
+    meta = {
+      maintainers = with maintainers; [ msteen rardiol ];
+      license = licenses.gpl3;
+      platforms = platforms.linux;
+    };
+  };
+}
diff --git a/pkgs/games/openra/default.nix b/pkgs/games/openra/default.nix
index 922d4f4762c8b..bf243e610bdee 100644
--- a/pkgs/games/openra/default.nix
+++ b/pkgs/games/openra/default.nix
@@ -1,79 +1,72 @@
-{ stdenv, fetchFromGitHub, mono, makeWrapper, lua
-, SDL2, freetype, openal, systemd, pkgconfig,
-  dotnetPackages, gnome3, curl, unzip, which, python
-}:
+/*  This file defines all OpenRA packages under `openraPackages`,
+    e.g. the OpenRA release engine can be found at `openraPackages.engines.release` (see `engines.nix`),
+    or the out-of-tree mod "Combined Arms" can be found at `openraPackages.mods.ca` (see `mods.nix`).
+    The `openra` package is just an alias to `openraPackages.engines.release`,
+    and just provides the mods included in the source code of the engine.
+    Additional engines or mods can be added with `openraPackages.buildOpenRAEngine` (function around `engine.nix`)
+    and `openraPackages.buildOpenRAMod` (function around `mod.nix`), respectively.
+*/
+pkgs:
 
-stdenv.mkDerivation rec {
-  pname = "openra";
-  version = "20181215";
+with pkgs.lib;
 
-  meta = with stdenv.lib; {
-    description = "Real Time Strategy game engine recreating the C&C titles";
-    homepage    = "http://www.openra.net/";
-    maintainers = [ maintainers.rardiol ];
-    license     = licenses.gpl3;
-    platforms   = platforms.linux;
-  };
+let
+  /*  Building an engine or out-of-tree mod is very similar,
+      but different enough not to be able to build them with the same package definition,
+      so instaed we define what is common between them in a seperate file.
 
-  src = fetchFromGitHub {
-    owner = "OpenRA";
-    repo = "OpenRA";
-    rev = "release-${version}";
-    sha256 = "0p0izykjnz7pz02g2khp7msqa00jhjsrzk9y0g29dirmdv75qa4r";
+      Although `callPackage` could be used, it would require undoing `makeOverridable`,
+      because `common.nix` does not define a package, but just an attribute set,
+      which is directly passed as part of the argument to the engines and mods `callPackage`,
+      so either the attributes added by `makeOverridable` have to be removed
+      or the engine and mod package definitions will need to add `...` to the argument list.
+  */
+  common = let f = import ./common.nix; in f (builtins.intersectAttrs (functionArgs f) pkgs // {
+    lua = pkgs.lua5_1;
+    # It is not necessary to run the game, but it is nicer to be given an error dialog in the case of failure,
+    # rather than having to look to the logs why it is not starting.
+    inherit (pkgs.gnome3) zenity;
+  });
 
+  /*  Building a set of engines or mods requires some dependencies as well,
+      so the sets will actually be defined as a function instead,
+      requiring the dependencies and returning the actual set.
+
+      Not all dependencies for defining a engine or mod set are shared,
+      so additional arguments can be passed as well.
+
+      The builders for engines and mods allow to delay specifying the name,
+      by returning a function that expects a name, which we use, in this case,
+      to base the name on the attribute name instead, preventing the need to specify the name twice
+      if the attribute name and engine/mod name are equal.
+  */
+  callWithName = name: value: if isFunction value then value name else value;
+  buildOpenRASet = f: args: pkgs.recurseIntoAttrs (mapAttrs callWithName (f ({
+    inherit (pkgs) fetchFromGitHub;
+    abbrevCommit = commit: substring 0 7 commit;
     extraPostFetch = ''
-      sed -i 's,curl,curl --insecure,g' $out/thirdparty/{fetch-thirdparty-deps,noget}.sh
+      sed -i 's/curl/curl --insecure/g' $out/thirdparty/{fetch-thirdparty-deps,noget}.sh
       $out/thirdparty/fetch-thirdparty-deps.sh
     '';
-  };
-
-  dontStrip = true;
-
-  buildInputs = (with dotnetPackages;
-     [ NUnit3 NewtonsoftJson MonoNat FuzzyLogicLibrary SmartIrc4net SharpZipLib MaxMindGeoIP2 MaxMindDb SharpFont StyleCopMSBuild StyleCopPlusMSBuild RestSharp NUnitConsole OpenNAT ])
-     ++ [ curl unzip lua gnome3.zenity ];
-  nativeBuildInputs = [ curl unzip mono makeWrapper lua pkgconfig ];
-
-  postPatch = ''
-    mkdir Support
-    sed -i \
-      -e 's/^VERSION.*/VERSION = release-${version}/g' \
-      -e '/GeoLite2-Country.mmdb.gz/d' \
-      -e '/fetch-geoip-db.sh/d' \
-      Makefile
-    substituteInPlace thirdparty/configure-native-deps.sh --replace "locations=\"" "locations=\"${lua}/lib "
-  '';
-
-  preConfigure = ''
-    makeFlags="prefix=$out"
-    make version
-  '';
-
-  buildFlags = [ "DEBUG=false" "default" "man-page" ];
-
-  doCheck = true;
-
-  #TODO: check
-  checkTarget = "nunit test";
+  } // args)));
 
-  installTargets = [ "install" "install-linux-icons" "install-linux-desktop" "install-linux-appdata" "install-linux-mime" "install-man-page" ];
+in pkgs.recurseIntoAttrs rec {
+  # The whole attribute set is destructered to ensure those (and only those) attributes are given
+  # and to provide defaults for those that are optional.
+  buildOpenRAEngine = { name ? null, version, description, homepage, mods, src }@engine:
+    # Allow specifying the name at a later point if no name has been given.
+    let builder = name: pkgs.callPackage ./engine.nix (common // {
+      engine = engine // { inherit name; };
+    }); in if name == null then builder else builder name;
 
-  postInstall = with stdenv.lib; let
-    runtime = makeLibraryPath [ SDL2 freetype openal systemd lua ];
-    binaries= makeBinPath [ which mono gnome3.zenity python ];
-  in ''
-    wrapProgram $out/lib/openra/launch-game.sh \
-      --prefix PATH : "${binaries}" \
-      --prefix LD_LIBRARY_PATH : "${runtime}" \
-      --set TERM "xterm"
+  # See `buildOpenRAEngine`.
+  buildOpenRAMod = { name ? null, version, title, description, homepage, src, engine, assetsError ? "" }@mod: ({ version, mods ? [], src }@engine:
+    let builder = name: pkgs.callPackage ./mod.nix (common // {
+      mod = mod // { inherit name assetsError; };
+      engine = engine // { inherit mods; };
+    }); in if name == null then builder else builder name) engine;
 
-    mkdir -p $out/bin
-    makeWrapper $out/lib/openra/launch-game.sh $out/bin/openra --run "cd $out/lib/openra"
-    printf "#!/bin/sh\nexec $out/bin/openra Game.Mod=ra" > $out/bin/openra-ra
-    chmod +x $out/bin/openra-ra
-    printf "#!/bin/sh\nexec $out/bin/openra Game.Mod=cnc" > $out/bin/openra-cnc
-    chmod +x $out/bin/openra-cnc
-    printf "#!/bin/sh\nexec $out/bin/openra Game.Mod=d2k" > $out/bin/openra-d2k
-    chmod +x $out/bin/openra-d2k
-  '';
+  # See `buildOpenRASet`.
+  engines = buildOpenRASet (import ./engines.nix) { inherit buildOpenRAEngine; };
+  mods = buildOpenRASet (import ./mods.nix) { inherit buildOpenRAMod; };
 }
diff --git a/pkgs/games/openra/engine.nix b/pkgs/games/openra/engine.nix
new file mode 100644
index 0000000000000..7d2d007d07585
--- /dev/null
+++ b/pkgs/games/openra/engine.nix
@@ -0,0 +1,60 @@
+/*  The package defintion for an OpenRA engine.
+    It shares code with `mod.nix` by what is defined in `common.nix`.
+    Similar to `mod.nix` it is a generic package definition,
+    in order to make it easy to define multiple variants of the OpenRA engine.
+    For each mod provided by the engine, a wrapper script is created,
+    matching the naming convention used by `mod.nix`.
+    This package could be seen as providing a set of in-tree mods,
+    while the `mod.nix` pacakges provide a single out-of-tree mod.
+*/
+{ stdenv
+, packageAttrs
+, patchEngine
+, wrapLaunchGame
+, engine
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation (recursiveUpdate packageAttrs rec {
+  name = "${pname}-${version}";
+  pname = "openra";
+  version = "${engine.name}-${engine.version}";
+
+  src = engine.src;
+
+  postPatch = patchEngine "." version;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    make version VERSION=${escapeShellArg version}
+
+    runHook postConfigure
+  '';
+
+  buildFlags = [ "DEBUG=false" "default" "man-page" ];
+
+  checkTarget = "nunit test";
+
+  installTargets = [
+    "install"
+    "install-linux-icons"
+    "install-linux-desktop"
+    "install-linux-appdata"
+    "install-linux-mime"
+    "install-man-page"
+  ];
+
+  postInstall = ''
+    ${wrapLaunchGame ""}
+
+    ${concatStrings (map (mod: ''
+      makeWrapper $out/bin/openra $out/bin/openra-${mod} --add-flags Game.Mod=${mod}
+    '') engine.mods)}
+  '';
+
+  meta = {
+    inherit (engine) description homepage;
+  };
+})
diff --git a/pkgs/games/openra/engines.nix b/pkgs/games/openra/engines.nix
new file mode 100644
index 0000000000000..e0d97f3c548b9
--- /dev/null
+++ b/pkgs/games/openra/engines.nix
@@ -0,0 +1,41 @@
+{ buildOpenRAEngine, fetchFromGitHub, abbrevCommit, extraPostFetch }:
+
+let
+  buildUpstreamOpenRAEngine = { version, rev, sha256 }: name: (buildOpenRAEngine {
+    inherit version;
+    description = "Open-source re-implementation of Westwood Studios' 2D Command and Conquer games";
+    homepage = https://www.openra.net/;
+    mods = [ "cnc" "d2k" "ra" "ts" ];
+    src = fetchFromGitHub {
+      owner = "OpenRA";
+      repo = "OpenRA" ;
+      inherit rev sha256 extraPostFetch;
+    };
+  } name).overrideAttrs (oldAttrs: {
+    postInstall = ''
+      ${oldAttrs.postInstall}
+      cp -r mods/ts $out/lib/openra/mods/
+      cp mods/ts/icon.png $(mkdirp $out/share/pixmaps)/openra-ts.png
+      ( cd $out/share/applications; sed -e 's/Dawn/Sun/g' -e 's/cnc/ts/g' openra-cnc.desktop > openra-ts.desktop )
+    '';
+  });
+
+in {
+  release = buildUpstreamOpenRAEngine rec {
+    version = "20181215";
+    rev = "release-${version}";
+    sha256 = "0p0izykjnz7pz02g2khp7msqa00jhjsrzk9y0g29dirmdv75qa4r";
+  };
+
+  playtest = buildUpstreamOpenRAEngine rec {
+    version = "20190106";
+    rev = "playtest-${version}";
+    sha256 = "0ps9x379plrrj1hnj4fpr26lc46mzgxknv5imxi0bmrh5y4781ql";
+  };
+
+  bleed = let commit = "6de92de8d982094a766eab97a92225c240d85493"; in buildUpstreamOpenRAEngine {
+    version = abbrevCommit commit;
+    rev = commit;
+    sha256 = "0p0izykjnz7pz02g2khp7msqa00jhjsrzk9y0g29dirmdv75qa4r";
+  };
+}
diff --git a/pkgs/games/openra/mkdirp.sh b/pkgs/games/openra/mkdirp.sh
new file mode 100644
index 0000000000000..7b2cf0b89c0e6
--- /dev/null
+++ b/pkgs/games/openra/mkdirp.sh
@@ -0,0 +1,4 @@
+mkdirp() {
+  mkdir -p "$@"
+  echo "$@"
+}
diff --git a/pkgs/games/openra/mod-launch-game.sh b/pkgs/games/openra/mod-launch-game.sh
new file mode 100644
index 0000000000000..ec03353bee546
--- /dev/null
+++ b/pkgs/games/openra/mod-launch-game.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+show_error() {
+  if command -v zenity > /dev/null; then
+    zenity --no-wrap --no-markup --error --title "OpenRA - @title@" --text "$1" 2>/dev/null
+  else
+    printf "$1\n" >&2
+  fi
+  exit 1
+}
+
+cd "@out@/lib/openra-@name@"
+
+# Check for missing assets
+assetsError='@assetsError@'
+if [ -n "$assetsError" -a ! -d "$HOME/.openra/Content/@name@" ]; then
+  show_error "$assetsError"
+fi
+
+# Run the game
+mono --debug OpenRA.Game.exe Game.Mod=@name@ Engine.LaunchPath="@out@/bin/openra-@name@" Engine.ModSearchPaths="@out@/lib/openra-@name@/mods" "$@"
+
+# Show a crash dialog if something went wrong
+if [ $? -ne 0 -a $? -ne 1 ]; then
+  show_error "OpenRA - @title@ has encountered a fatal error.\nPlease refer to the crash logs for more information.\n\nLog files are located in ~/.openra/Logs"
+fi
diff --git a/pkgs/games/openra/mod.nix b/pkgs/games/openra/mod.nix
new file mode 100644
index 0000000000000..ebc65b2f5c4e5
--- /dev/null
+++ b/pkgs/games/openra/mod.nix
@@ -0,0 +1,104 @@
+/*  The package defintion for an OpenRA out-of-tree mod.
+    It shares code with `engine.nix` by what is defined in `common.nix`.
+    To build an out-of-tree mod it needs the source code of the engine available,
+    and they each need to be build with a specific version or fork of the engine,
+    so the engine needs to be supplied as an argument as well.
+    The engine is relatively small and quick to build, so this is not much of a problem.
+    Building a mod will result in a wrapper script that starts the mod inside the specified engine.
+*/
+{ stdenv
+, packageAttrs
+, patchEngine
+, wrapLaunchGame
+, mod
+, engine
+}:
+
+with stdenv.lib;
+
+let
+  engineSourceName = engine.src.name or "engine";
+  modSourceName = mod.src.name or "mod";
+
+# Based on: https://build.opensuse.org/package/show/home:fusion809/openra-ura
+in stdenv.mkDerivation (recursiveUpdate packageAttrs rec {
+  name = "${pname}-${version}";
+  pname = "openra-${mod.name}";
+  inherit (mod) version;
+
+  srcs = [
+    mod.src
+    engine.src
+  ];
+
+  sourceRoot = ".";
+
+  postUnpack = ''
+    mv ${engineSourceName} ${modSourceName}
+    cd ${modSourceName}
+  '';
+
+  postPatch = ''
+    cat <<'EOF' > fetch-engine.sh
+    #!/bin/sh
+    exit 0
+    EOF
+
+    sed -i 's/^VERSION.*/VERSION = ${version}/g' Makefile
+
+    dos2unix *.md
+
+    ${patchEngine engineSourceName engine.version}
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+
+    make version VERSION=${escapeShellArg version}
+    make -C ${engineSourceName} version VERSION=${escapeShellArg engine.version}
+
+    runHook postConfigure
+  '';
+
+  checkTarget = "test";
+
+  installPhase = ''
+    runHook preInstall
+
+    make -C ${engineSourceName} install-engine install-common-mod-files DATA_INSTALL_DIR=$out/lib/${pname}
+
+    cp -r ${engineSourceName}/mods/{${concatStringsSep "," ([ "common" "modcontent" ] ++ engine.mods)}} mods/${mod.name} \
+      $out/lib/${pname}/mods/
+
+    substitute ${./mod-launch-game.sh} $out/lib/${pname}/launch-game.sh \
+      --subst-var out \
+      --subst-var-by name ${escapeShellArg mod.name} \
+      --subst-var-by title ${escapeShellArg mod.title} \
+      --subst-var-by assetsError ${escapeShellArg mod.assetsError}
+    chmod +x $out/lib/${pname}/launch-game.sh
+
+    ${wrapLaunchGame "-${mod.name}"}
+
+    substitute ${./openra-mod.desktop} $(mkdirp $out/share/applications)/${pname}.desktop \
+      --subst-var-by name ${escapeShellArg mod.name} \
+      --subst-var-by title ${escapeShellArg mod.title}
+
+    cp README.md $(mkdirp $out/share/doc/packages/${pname})/README.md
+
+    [[ -e mods/${mod.name}/icon.png ]] && mod_icon=mods/${mod.name}/icon.png || {
+      [[ -e mods/${mod.name}/logo.png ]] && mod_icon=mods/${mod.name}/logo.png || mod_icon=packaging/linux/mod_256x256.png
+    }
+    cp "$mod_icon" $(mkdirp $out/share/pixmaps)/${pname}.png
+
+    for size in 16 32 48 64 128 256; do
+      size=''${size}x''${size}
+      cp packaging/linux/mod_''${size}.png $(mkdirp $out/share/icons/hicolor/''${size}/apps)/${pname}.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    inherit (mod) description homepage;
+  };
+})
diff --git a/pkgs/games/openra/mods.nix b/pkgs/games/openra/mods.nix
new file mode 100644
index 0000000000000..5bfc5a224a5cf
--- /dev/null
+++ b/pkgs/games/openra/mods.nix
@@ -0,0 +1,339 @@
+{ buildOpenRAMod, fetchFromGitHub, abbrevCommit, extraPostFetch }:
+
+let
+  unsafeBuildOpenRAMod = attrs: name: (buildOpenRAMod attrs name).overrideAttrs (_: {
+    doCheck = false;
+  });
+
+in {
+  ca = buildOpenRAMod {
+    version = "93";
+    title = "Combined Arms";
+    description = "A game that combines units from the official OpenRA Red Alert and Tiberian Dawn mods";
+    homepage = https://github.com/Inq8/CAmod;
+    src = fetchFromGitHub {
+      owner = "Inq8";
+      repo = "CAmod";
+      rev = "16fb77d037be7005c3805382712c33cec1a2788c";
+      sha256 = "11fjyr3692cy2a09bqzk5ya1hf6plh8hmdrgzds581r9xbj0q4pr";
+    };
+    engine = let commit = "b8a7dd52ff893ed8225726d4ed4e14ecad748404"; in {
+      version = abbrevCommit commit;
+      src = fetchFromGitHub {
+        owner = "Inq8";
+        repo = "CAengine" ;
+        rev = commit;
+        sha256 = "0dyk861qagibx8ldshz7d2nrki9q550f6f0wy8pvayvf1gv1dbxj";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  d2 = unsafeBuildOpenRAMod rec {
+    version = "128";
+    title = "Dune II";
+    description = "A modernization of the original ${title} game";
+    homepage = https://github.com/OpenRA/d2;
+    src = fetchFromGitHub {
+      owner = "OpenRA";
+      repo = "d2";
+      rev = "bc969207b532a2def69e0d6ac09a4e8fb5d4e946";
+      sha256 = "18v154kf1fmfk2gnymb3ggsfy73ql8rr7jvbhiw60yhzwx89cdk8";
+    };
+    engine = rec {
+      version = "20181215";
+      mods = [ "cnc" "d2k" "ra" ];
+      src = fetchFromGitHub {
+        owner = "OpenRA";
+        repo = "OpenRA" ;
+        rev = "release-${version}";
+        sha256 = "0p0izykjnz7pz02g2khp7msqa00jhjsrzk9y0g29dirmdv75qa4r";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+    assetsError = ''
+      The mod expects the original ${title} game assets in place:
+      https://github.com/OpenRA/d2/wiki
+    '';
+  };
+
+  dr = buildOpenRAMod rec {
+    version = "244";
+    title = "Dark Reign";
+    description = "A re-imagination of the original Command & Conquer: ${title} game";
+    homepage = https://github.com/drogoganor/DarkReign;
+    src = fetchFromGitHub {
+      owner = "drogoganor";
+      repo = "DarkReign";
+      rev = "e21db398f4d995c91b9e1a0f31ffaa7d54f43742";
+      sha256 = "1gzvdf6idmx0rr8afaxd9dsbnxljif2kic6znkd9vcrwnqmp1fjr";
+    };
+    engine = let commit = "7fcfb1dcb2bd472fa6680ffa37bd3bbedb2c44c5"; in {
+      version = abbrevCommit commit;
+      src = fetchFromGitHub {
+        owner = "drogoganor";
+        repo = "OpenRA" ;
+        rev = commit;
+        sha256 = "0x7k96j3q16dgay4jjlyv9kcgn4sc4v9ksw6ijnjws7q1r2rjs0m";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  gen = buildOpenRAMod {
+    version = "1133";
+    title = "Generals Alpha";
+    description = "Re-imagination of the original Command & Conquer: Generals game";
+    homepage = https://github.com/MustaphaTR/Generals-Alpha;
+    src = fetchFromGitHub {
+      owner = "MustaphaTR";
+      repo = "Generals-Alpha";
+      rev = "277d20d5a8b5e11eac9443031af133dc110c653f";
+      sha256 = "1k37545l99q7zphnh1ykvimsyp5daykannps07d4dgr2w9l7bmhg";
+    };
+    engine = rec {
+      version = "gen-20180905";
+      src = fetchFromGitHub {
+        owner = "MustaphaTR";
+        repo = "OpenRA" ;
+        rev = version;
+        sha256 = "0wy1h7fg0n8dpy6y91md7x0qnr9rk4xf6155jali4bi8gghw2g5v";
+        name = "generals-alpha-engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  kknd = buildOpenRAMod rec {
+    version = "142";
+    title = "Krush, Kill 'n' Destroy";
+    description = "Re-imagination of the original ${title} game";
+    homepage = https://kknd-game.com/;
+    src = fetchFromGitHub {
+      owner = "IceReaper";
+      repo = "KKnD";
+      rev = "54d34292168d5c47529688c8d5ca7693c4001ef3";
+      sha256 = "1rsdig282cfr8b4iamr9ri6sshgppp8gllfyib6c2hvqqr301720";
+    };
+    engine = let commit = "4e8eab4ca00d1910203c8a103dfd2c002714daa8"; in {
+      version = abbrevCommit commit;
+      src = fetchFromGitHub {
+        owner = "OpenRA";
+        repo = "OpenRA" ;
+        rev = commit;
+        sha256 = "1yyqparf93x8yzy1f46gsymgkj5jls25v2yc7ighr3f7mi3igdvq";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  mw = buildOpenRAMod rec {
+    version = "235";
+    title = "Medieval Warfare";
+    description = "A re-imagination of the original Command & Conquer: ${title} game";
+    homepage = https://github.com/CombinE88/Medieval-Warfare;
+    src = fetchFromGitHub {
+      owner = "CombinE88";
+      repo = "Medieval-Warfare";
+      rev = "1e4fc7ea24d0806c5a7cd753490e967d804a3567";
+      sha256 = "0swa66mzb6wr8vf1yivrss54dl98jzzwh9b8qrjfwmfrq2i356iq";
+    };
+    engine = let commit = "9f9617aa359ebc1923252b7a4a79def73ecfa8a2"; in {
+      version = abbrevCommit commit;
+      src = fetchFromGitHub {
+        owner = "CombinE88";
+        repo = "OpenRA" ;
+        rev = commit;
+        sha256 = "02h29xnc1cb5zr001cnmaww5qnfnfaza4v28251jgzkby593r32q";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  ra2 = buildOpenRAMod rec {
+    version = "876";
+    title = "Red Alert 2";
+    description = "Re-imagination of the original Command & Conquer: ${title} game";
+    homepage = https://github.com/OpenRA/ra2;
+    src = fetchFromGitHub {
+      owner = "OpenRA";
+      repo = "ra2";
+      rev = "6a864b2a5887ae42291768fb3dec73082fee44ee";
+      sha256 = "19m4z9r00dj67746ps2f9a8i1icq8nm0iiww6dl975yl6gaxp5qy";
+    };
+    engine = rec {
+      version = "20180923";
+      src = fetchFromGitHub {
+        owner = "OpenRA";
+        repo = "OpenRA" ;
+        rev = "release-${version}";
+        sha256 = "1pgi3zaq9fwwdq6yh19bwxscslqgabjxkvl9bcn1a5agy4bfbqk5";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+    assetsError = ''
+      The mod expects the original ${title} game assets in place:
+      https://github.com/OpenRA/ra2/wiki
+    '';
+  };
+
+  raclassic = buildOpenRAMod {
+    version = "171";
+    title = "Red Alert Classic";
+    description = "A modernization of the original Command & Conquer: Red Alert game";
+    homepage = https://github.com/OpenRA/raclassic;
+    src = fetchFromGitHub {
+      owner = "OpenRA";
+      repo = "raclassic";
+      rev = "a2319b3dfb367a8d4278bf7baf55a10abf615fbc";
+      sha256 = "1k67fx4d9hg8mckzp7pp8lxa6ngqxnnrnbqyfls99dqc4df1iw0a";
+    };
+    engine = rec {
+      version = "20181215";
+      src = fetchFromGitHub {
+        owner = "OpenRA";
+        repo = "OpenRA" ;
+        rev = "release-${version}";
+        sha256 = "0p0izykjnz7pz02g2khp7msqa00jhjsrzk9y0g29dirmdv75qa4r";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  rv = unsafeBuildOpenRAMod {
+    version = "1294";
+    title = "Romanov's Vengeance";
+    description = "Re-imagination of the original Command & Conquer: Red Alert 2 game";
+    homepage = https://github.com/MustaphaTR/Romanovs-Vengeance;
+    src = fetchFromGitHub {
+      owner = "MustaphaTR";
+      repo = "Romanovs-Vengeance";
+      rev = "c21cb11579d7e12354c5ccb5c3c47e567c6b3d4f";
+      sha256 = "1vmc5b9awx8q0mahwv11fzgplw9w7m8kzvnx5cl7xr1w5wk87428";
+    };
+    engine = let commit = "e9e99074b294c32fbe88dd8727581cb8c512c2e2"; in {
+      version = abbrevCommit commit;
+      mods = [ "as" ];
+      src = fetchFromGitHub {
+        owner = "GraionDilach";
+        repo = "OpenRA" ;
+        rev = commit;
+        sha256 = "0bibnakpmbxwglf2dka6g04xp8dzwyms1zk5kqlbm8gpdp0aqmxp";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+    assetsError = ''
+      The mod expects the Command & Conquer: The Ultimate Collection assets in place:
+      https://github.com/OpenRA/ra2/wiki
+    '';
+  };
+
+  sp = unsafeBuildOpenRAMod {
+    version = "153";
+    title = "Shattered Paradise";
+    description = "Re-imagination of the original Command & Conquer: Tiberian Sun game";
+    homepage = https://github.com/ABrandau/OpenRAModSDK;
+    src = fetchFromGitHub {
+      owner = "ABrandau";
+      repo = "OpenRAModSDK";
+      rev = "89148b8cf89bf13911fafb74a1aa2b4cacf027e0";
+      sha256 = "1bb8hzd3mhnn76iqiah1161qz98f0yvyryhmrghq03xlbin3mhbi";
+    };
+    engine = let commit = "82a2f234bdf3b768cea06408e3de30f9fbbe9412"; in {
+      version = abbrevCommit commit;
+      mods = [ "as" "ts" ];
+      src = fetchFromGitHub {
+        owner = "ABrandau";
+        repo = "OpenRA" ;
+        rev = commit;
+        sha256 = "1nl3brvx1bikxm5rmpc7xmd32n722jiyjh86pnar6b6idr1zj2ws";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  ss = buildOpenRAMod rec {
+    version = "72";
+    title = "Sole Survivor";
+    description = "A re-imagination of the original Command & Conquer: ${title} game";
+    homepage = https://github.com/MustaphaTR/sole-survivor;
+    src = fetchFromGitHub {
+      owner = "MustaphaTR";
+      repo = "sole-survivor";
+      rev = "fad65579c8b487cef9a8145e872390ed77c16c69";
+      sha256 = "0h7is7x2qyvq7vqp0jgw5zrdkw8g7ndd82d843ldhnb0a3vyrk34";
+    };
+    engine = let commit = "becfc154c5cd3891d695339ff86883db8b5790a5"; in {
+      version = abbrevCommit commit;
+      src = fetchFromGitHub {
+        owner = "OpenRA";
+        repo = "OpenRA" ;
+        rev = commit;
+        sha256 = "0id8vf3cjr7h5pz4sw8pdaz3sc45lxr21k1fk4309kixsrpa7i0y";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  ura = buildOpenRAMod {
+    version = "431";
+    title = "Red Alert Unplugged";
+    description = "Re-imagination of the original Command & Conquer: Red Alert game";
+    homepage = http://redalertunplugged.com/;
+    src = fetchFromGitHub {
+      owner = "RAunplugged";
+      repo = "uRA";
+      rev = "128dc53741fae923f4af556f2293ceaa0cf571f0";
+      sha256 = "1mhr8kyh313z52gdrqv31d6z7jvdldiajalca5mcr8gzg6mph66p";
+    };
+    engine = rec {
+      version = "unplugged-cd82382";
+      src = fetchFromGitHub {
+        owner = "RAunplugged";
+        repo = "OpenRA" ;
+        rev = version;
+        sha256 = "1p5hgxxvxlz8480vj0qkmnxjh7zj3hahk312m0zljxfdb40652w1";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+  };
+
+  yr = unsafeBuildOpenRAMod rec {
+    version = "117";
+    homepage = https://github.com/cookgreen/yr;
+    title = "Yuri's Revenge";
+    description = "Re-imagination of the original Command & Conquer: ${title} game";
+    src = fetchFromGitHub {
+      owner = "cookgreen";
+      repo = "yr";
+      rev = "1d4beeb0687fe4b39b01ec31f3702cfb90a7f4f7";
+      sha256 = "1rd962ja1x72rz68kbmp19yiip3iif50hzlj3v8k1f5l94r2x2pn";
+    };
+    engine = rec {
+      version = "20180923";
+      src = fetchFromGitHub {
+        owner = "OpenRA";
+        repo = "OpenRA" ;
+        rev = "release-${version}";
+        sha256 = "1pgi3zaq9fwwdq6yh19bwxscslqgabjxkvl9bcn1a5agy4bfbqk5";
+        name = "engine";
+        inherit extraPostFetch;
+      };
+    };
+    assetsError = ''
+      The mod expects the Command & Conquer: The Ultimate Collection assets in place:
+      https://github.com/OpenRA/ra2/wiki
+    '';
+  };
+}
diff --git a/pkgs/games/openra/openra-mod.desktop b/pkgs/games/openra/openra-mod.desktop
new file mode 100644
index 0000000000000..090b6c1325d10
--- /dev/null
+++ b/pkgs/games/openra/openra-mod.desktop
@@ -0,0 +1,11 @@
+[Desktop Entry]
+Type=Application
+Version=1.0
+Name=OpenRA - @title@
+GenericName=Real Time Strategy Game
+GenericName[de]=Echtzeit-Strategiespiel
+Comment=@description@
+Icon=openra-@name@
+Exec=openra-@name@
+Terminal=false
+Categories=Game;StrategyGame;X-RTS;X-RealTimeStrategy;X-RealTimeStrategyGame;
diff --git a/pkgs/games/openra/packages.nix b/pkgs/games/openra/packages.nix
new file mode 100644
index 0000000000000..c09b697771a39
--- /dev/null
+++ b/pkgs/games/openra/packages.nix
@@ -0,0 +1,60 @@
+pkgs:
+
+let
+  /*  Building an engine or out-of-tree mod is very similar,
+      but different enough not to be able to build them with the same package definition,
+      so instaed we define what is common between them in a seperate file.
+
+      Although `callPackage` could be used, it would require undoing `makeOverridable`,
+      because `common.nix` does not define a package, but just an attribute set,
+      which is directly passed as part of the argument to the engines and mods `callPackage`,
+      so either the attributes added by `makeOverridable` have to be removed
+      or the engine and mod package definitions will need to add `...` to the argument list.
+  */
+  common = let f = import ./common.nix; in f (builtins.intersectAttrs (builtins.functionArgs f) pkgs // {
+    lua = pkgs.lua5_1;
+    # It is not necessary to run the game, but it is nicer to be given an error dialog in the case of failure,
+    # rather than having to look to the logs why it is not starting.
+    inherit (pkgs.gnome3) zenity;
+  });
+
+  /*  Building a set of engines or mods requires some dependencies as well,
+      so the sets will actually be defined as a function instead,
+      requiring the dependencies and returning the actual set.
+
+      Not all dependencies for defining a engine or mod set are shared,
+      so additional arguments can be passed as well.
+
+      The builders for engines and mods allow to delay specifying the name,
+      by returning a function that expects a name, which we use, in this case,
+      to base the name on the attribute name instead, preventing the need to specify the name twice
+      if the attribute name and engine/mod name are equal.
+  */
+  buildOpenRASet = f: args: builtins.mapAttrs (name: value: if builtins.isFunction value then value name else value) (f ({
+    inherit (pkgs) fetchFromGitHub;
+    extraPostFetch = ''
+      sed -i 's/curl/curl --insecure/g' $out/thirdparty/{fetch-thirdparty-deps,noget}.sh
+      $out/thirdparty/fetch-thirdparty-deps.sh
+    '';
+  } // args));
+
+in rec {
+  # The whole attribute set is destructered to ensure those (and only those) attributes are given
+  # and to provide defaults for those that are optional.
+  buildOpenRAEngine = { name ? null, version, description, homepage, mods, src, installExperimental ? "" }@engine:
+    # Allow specifying the name at a later point if no name has been given.
+    let builder = name: pkgs.callPackage ./engine.nix (common // {
+      engine = engine // { inherit name installExperimental; };
+    }); in if name == null then builder else builder name;
+
+  # See `buildOpenRAEngine`.
+  buildOpenRAMod = { name ? null, version, title, description, homepage, src, engine }@mod: ({ version, mods ? [], src }@engine:
+    let builder = name: pkgs.callPackage ./mod.nix (common // {
+      mod = mod // { inherit name; };
+      engine = engine // { inherit mods; };
+    }); in if name == null then builder else builder name) engine;
+
+  # See `buildOpenRASet`.
+  engines = buildOpenRASet (import ./engines.nix) { inherit buildOpenRAEngine; };
+  mods = buildOpenRASet (import ./mods.nix) { inherit buildOpenRAMod; };
+}
diff --git a/pkgs/misc/emulators/wine/sources.nix b/pkgs/misc/emulators/wine/sources.nix
index 8b80dd838aeac..2fcb38c0a1eb3 100644
--- a/pkgs/misc/emulators/wine/sources.nix
+++ b/pkgs/misc/emulators/wine/sources.nix
@@ -39,16 +39,16 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "4.0-rc2";
+    version = "4.0-rc5";
     url = "https://dl.winehq.org/wine/source/4.0/wine-${version}.tar.xz";
-    sha256 = "0apqavsk1y56b6c4zkjpi014xwgn6gjg6pzjx94qy4nfr1gz63n4";
+    sha256 = "0nx5ahahfnmimd2b7zh2wx36b877vad10i2kr2zib9m9b2w8wyfd";
     inherit (stable) mono gecko32 gecko64;
   };
 
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    sha256 = "1vqvy44h9rwfx32pad831kdyhazn68s8r14w8765ly42rixc6dgj";
+    sha256 = "0smp6ngs77vk1yg0saavhhn7kmi9ri8y8gc3vcgg837ycwg5i5qb";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";
diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix
index 4fadd44765483..ed540a9e7518d 100644
--- a/pkgs/os-specific/linux/kernel/hardened-config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened-config.nix
@@ -125,6 +125,11 @@ ${optionalString (versionAtLeast version "4.20") ''
   GCC_PLUGIN_STACKLEAK y # A port of the PaX stackleak plugin
 ''}
 
+${optionalString (versionAtLeast version "4.13") ''
+  GCC_PLUGIN_RANDSTRUCT y # A port of the PaX randstruct plugin
+  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE y
+''}
+
 # Disable various dangerous settings
 ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory
 PROC_KCORE n # Exposes kernel text image layout
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 6adc3a33bb06b..4b570c1fe9404 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -88,7 +88,10 @@ let
 
       inherit src;
 
-      patches = map (p: p.patch) kernelPatches;
+      patches =
+        map (p: p.patch) kernelPatches
+        # Required for deterministic builds along with some postPatch magic.
+        ++ optional (stdenv.lib.versionAtLeast version "4.13") ./randstruct-provide-seed.patch;
 
       prePatch = ''
         for mf in $(find -name Makefile -o -name Makefile.include -o -name install.sh); do
@@ -99,6 +102,19 @@ let
         sed -i scripts/ld-version.sh -e "s|/usr/bin/awk|${buildPackages.gawk}/bin/awk|"
       '';
 
+      postPatch = ''
+        # Set randstruct seed to a deterministic but diversified value. Note:
+        # we could have instead patched gen-random-seed.sh to take input from
+        # the buildFlags, but that would require also patching the kernel's
+        # toplevel Makefile to add a variable export. This would be likely to
+        # cause future patch conflicts.
+        if [ -f scripts/gcc-plugins/gen-random-seed.sh ]; then
+          substituteInPlace scripts/gcc-plugins/gen-random-seed.sh \
+            --replace NIXOS_RANDSTRUCT_SEED \
+            $(echo ${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+        fi
+      '';
+
       configurePhase = ''
         runHook preConfigure
 
diff --git a/pkgs/os-specific/linux/kernel/randstruct-provide-seed.patch b/pkgs/os-specific/linux/kernel/randstruct-provide-seed.patch
new file mode 100644
index 0000000000000..1328b9cee3c95
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/randstruct-provide-seed.patch
@@ -0,0 +1,12 @@
+diff -ru a/scripts/gcc-plugins/gen-random-seed.sh b/scripts/gcc-plugins/gen-random-seed.sh
+--- a/scripts/gcc-plugins/gen-random-seed.sh	2019-01-11 11:50:29.228258920 +0100
++++ b/scripts/gcc-plugins/gen-random-seed.sh	2019-01-11 12:18:33.555902720 +0100
+@@ -2,7 +2,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+ if [ ! -f "$1" ]; then
+-	SEED=`od -A n -t x8 -N 32 /dev/urandom | tr -d ' \n'`
++	SEED="NIXOS_RANDSTRUCT_SEED"
+ 	echo "const char *randstruct_seed = \"$SEED\";" > "$1"
+ 	HASH=`echo -n "$SEED" | sha256sum | cut -d" " -f1 | tr -d ' \n'`
+ 	echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2"
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index 906e59eb1c1fc..1a08a89dc2332 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -90,7 +90,7 @@ let
       description = "X.org driver and kernel module for NVIDIA graphics cards";
       license = licenses.unfreeRedistributable;
       platforms = [ "i686-linux" "x86_64-linux" ];
-      maintainers = [ ];
+      maintainers = with maintainers; [ baracoder ];
       priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
       inherit broken;
     };
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index b40b6125bd91e..49171697ffec4 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "nvme-cli-${version}";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "0pp00yzj9c398bzd7jrjhzr7q1pk7d069dnbzyq1qqssszgcj599";
+    sha256 = "1wwr31s337km3v528hvsq72j2ph17fir0j3rr622z74k68pzdh1x";
   };
 
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 5ec708dd69fd6..f24f5a5d06fd1 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, fetchpatch, gettext, libnl, ncurses, pciutils, pkgconfig, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "powertop-${version}";
-  version = "2.9";
+  pname = "powertop";
+  version = "2.10";
 
   src = fetchurl {
-    url = "https://01.org/sites/default/files/downloads/powertop/powertop-v${version}.tar.gz";
-    sha256 = "0l4jjlf05li2mc6g8nrss3h435wjhmnqd8m7v3kha3x0x7cbfzxa";
+    url = "https://01.org/sites/default/files/downloads/${pname}-v${version}.tar.gz";
+    sha256 = "0xaazqccyd42v2q532dxx40nqhb9sfsa6cyx8641rl57mfg4bdyk";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 2a614e22c9a69..33f1bbdd893f2 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     license = with licenses; [ asl20 gpl2 mit ];
     maintainers = [maintainers.raskin];
     platforms = ["x86_64-linux"] ++ platforms.darwin;
-    broken = kernel != null && (versionOlder kernel.version "4.14" || versionAtLeast kernel.version "4.20");
+    broken = kernel != null && versionOlder kernel.version "4.14";
     homepage = "https://sysdig.com/opensource/";
     downloadPage = "https://github.com/draios/sysdig/releases";
   };
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 1d45109ac852d..d4623ccd633db 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -18,7 +18,7 @@ let
   pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
 
 in stdenv.mkDerivation rec {
-  version = "239";
+  version = "239.20190110";
   name = "systemd-${version}";
 
   # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
@@ -26,8 +26,8 @@ in stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "31859ddd35fc3fa82a583744caa836d356c31d7f";
-    sha256 = "1xci0491j95vdjgs397n618zii3sgwnvanirkblqqw6bcvcjvir1";
+    rev = "nixos-v${version}";
+    sha256 = "1m9mhv7b4kfa43z79106gpgxx51zlhvvfjrlmimdsvsiw72nzldj";
   };
 
   prePatch = let
@@ -37,8 +37,8 @@ in stdenv.mkDerivation rec {
         # When the URL disappears, it typically means that Debian has new patches
         # (probably security) and updating to new tarball will apply them as well.
         name = "systemd-debian-patches.tar.xz";
-        url = mirror://debian/pool/main/s/systemd/systemd_239-11~bpo9+1.debian.tar.xz;
-        sha256 = "136f6p4jbi4z94mf4g099dfcacwka8jwhza0wxxw2q5l5q3xiysh";
+        url = mirror://debian/pool/main/s/systemd/systemd_239-12~bpo9+1.debian.tar.xz;
+        sha256 = "0v9f62gyfiw5icdrdlcvjcipsqrsm49w6n8bqp9nb8s2ih6rsfhg";
       };
       # Note that we skip debian-specific patches, i.e. ./debian/patches/debian/*
     in ''
diff --git a/pkgs/servers/home-assistant/appdaemon.nix b/pkgs/servers/home-assistant/appdaemon.nix
index 15ebccbc0dae9..42faa01db480d 100644
--- a/pkgs/servers/home-assistant/appdaemon.nix
+++ b/pkgs/servers/home-assistant/appdaemon.nix
@@ -11,7 +11,8 @@ let
           sha256 = "8adda6583ba438a4c70693374e10b60168663ffa6564c5c75d3c7a9055290964";
         };
         # TODO: remove after pinning aiohttp to a newer version
-        propagatedBuildInputs = oldAttrs.propagatedBuildInputs ++ [ self.idna-ssl ];
+        propagatedBuildInputs = with self; [ chardet multidict async-timeout yarl idna-ssl ];
+        doCheck = false;
       });
 
       yarl = super.yarl.overridePythonAttrs (oldAttrs: rec {
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 562fb79d62b60..c28160b04a428 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "0.85.0";
+  version = "0.85.1";
   components = {
     "abode" = ps: with ps; [  ];
     "ads" = ps: with ps; [  ];
@@ -21,6 +21,7 @@
     "alarm_control_panel.egardia" = ps: with ps; [  ];
     "alarm_control_panel.elkm1" = ps: with ps; [  ];
     "alarm_control_panel.envisalink" = ps: with ps; [  ];
+    "alarm_control_panel.homekit_controller" = ps: with ps; [  ];
     "alarm_control_panel.homematicip_cloud" = ps: with ps; [  ];
     "alarm_control_panel.ialarm" = ps: with ps; [  ];
     "alarm_control_panel.ifttt" = ps: with ps; [ aiohttp-cors pyfttt ];
@@ -117,7 +118,7 @@
     "binary_sensor.iss" = ps: with ps; [  ];
     "binary_sensor.isy994" = ps: with ps; [  ];
     "binary_sensor.knx" = ps: with ps; [  ];
-    "binary_sensor.konnected" = ps: with ps; [ aiohttp-cors netdisco ];
+    "binary_sensor.konnected" = ps: with ps; [ aiohttp-cors ];
     "binary_sensor.linode" = ps: with ps; [ linode-api ];
     "binary_sensor.lupusec" = ps: with ps; [  ];
     "binary_sensor.maxcube" = ps: with ps; [  ];
@@ -419,6 +420,10 @@
     "emulated_hue" = ps: with ps; [ aiohttp-cors ];
     "emulated_hue.hue_api" = ps: with ps; [  ];
     "emulated_hue.upnp" = ps: with ps; [  ];
+    "emulated_roku" = ps: with ps; [  ];
+    "emulated_roku.binding" = ps: with ps; [  ];
+    "emulated_roku.config_flow" = ps: with ps; [  ];
+    "emulated_roku.const" = ps: with ps; [  ];
     "enocean" = ps: with ps; [  ];
     "envisalink" = ps: with ps; [  ];
     "esphome" = ps: with ps; [  ];
@@ -512,6 +517,7 @@
     "hue.config_flow" = ps: with ps; [  ];
     "hue.const" = ps: with ps; [  ];
     "hue.errors" = ps: with ps; [  ];
+    "hue.light" = ps: with ps; [ aiohue ];
     "hydrawise" = ps: with ps; [  ];
     "idteck_prox" = ps: with ps; [  ];
     "ifttt" = ps: with ps; [ aiohttp-cors pyfttt ];
@@ -550,7 +556,7 @@
     "keyboard_remote" = ps: with ps; [ evdev ];
     "kira" = ps: with ps; [  ];
     "knx" = ps: with ps; [  ];
-    "konnected" = ps: with ps; [ aiohttp-cors netdisco ];
+    "konnected" = ps: with ps; [ aiohttp-cors ];
     "lametric" = ps: with ps; [  ];
     "lcn" = ps: with ps; [  ];
     "lifx" = ps: with ps; [  ];
@@ -578,7 +584,6 @@
     "light.homematic" = ps: with ps; [ pyhomematic ];
     "light.homematicip_cloud" = ps: with ps; [  ];
     "light.homeworks" = ps: with ps; [  ];
-    "light.hue" = ps: with ps; [ aiohue ];
     "light.hyperion" = ps: with ps; [  ];
     "light.iglo" = ps: with ps; [  ];
     "light.ihc" = ps: with ps; [ defusedxml ];
@@ -713,7 +718,6 @@
     "media_player.mpchc" = ps: with ps; [  ];
     "media_player.mpd" = ps: with ps; [ mpd2 ];
     "media_player.nad" = ps: with ps; [  ];
-    "media_player.nadtcp" = ps: with ps; [  ];
     "media_player.onkyo" = ps: with ps; [ onkyo-eiscp ];
     "media_player.openhome" = ps: with ps; [  ];
     "media_player.panasonic_bluray" = ps: with ps; [  ];
@@ -1290,7 +1294,7 @@
     "switch.isy994" = ps: with ps; [  ];
     "switch.kankun" = ps: with ps; [  ];
     "switch.knx" = ps: with ps; [  ];
-    "switch.konnected" = ps: with ps; [ aiohttp-cors netdisco ];
+    "switch.konnected" = ps: with ps; [ aiohttp-cors ];
     "switch.lightwave" = ps: with ps; [  ];
     "switch.linode" = ps: with ps; [ linode-api ];
     "switch.litejet" = ps: with ps; [  ];
@@ -1458,6 +1462,7 @@
     "zabbix" = ps: with ps; [  ];
     "zeroconf" = ps: with ps; [ aiohttp-cors zeroconf ];
     "zha" = ps: with ps; [  ];
+    "zha.api" = ps: with ps; [  ];
     "zha.config_flow" = ps: with ps; [  ];
     "zha.const" = ps: with ps; [  ];
     "zha.entities" = ps: with ps; [  ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index c7764c134bd6f..c56423adcdd03 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -51,8 +51,8 @@ let
 
     # used by check_config script
     # can be unpinned once https://github.com/home-assistant/home-assistant/issues/11917 is resolved
-    (mkOverride "colorlog" "3.1.4"
-      "418db638c9577f37f0fae4914074f395847a728158a011be2a193ac491b9779d")
+    (mkOverride "colorlog" "4.0.2"
+      "3cf31b25cbc8f86ec01fef582ef3b840950dea414084ed19ab922c8b493f9b42")
 
     # hass-frontend does not exist in python3.pkgs
     (self: super: {
@@ -87,7 +87,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.85.0";
+  hassVersion = "0.85.1";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -102,7 +102,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "home-assistant";
     rev = version;
-    sha256 = "10lpah90ia2ycw22s65kqxd2az7l69n9hs1i4lvx1179ncvnfq9r";
+    sha256 = "0i9s0mgzfs3s6k4vw2zvwgqziz77fghpijrjrxx5nbrmm592h01a";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 22e3eb4e0d5b8..d4be40c736852 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-frontend";
-  version = "20190109.0";
+  version = "20190109.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d4e0241feca3779af67efe906be31ba3fac76e8fb3e46d8416f349f5ec3009a6";
+    sha256 = "2ca035461c06591dc793c7651ed3f7c17ab3addf5859e89d2f956215433140ba";
   };
 
   propagatedBuildInputs = [ user-agents ];
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index a7e9c1447f1ce..db459dc81c8eb 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs tests
+    # Linux sandbox has an empty hostname and not /etc/hosts, which fails some tests
+    sed -ire '/[$]self->{HOSTNAME} *=/i     if(length($name)==0) { $name = "127.0.0.1" }' tests/LightyTest.pm
   '';
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index 8f33fa8d33b15..3f4f99acbc653 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix (args // {
-  version = "1.15.7";
-  sha256 = "14yz5cag9jdi088kdyammpi0ixrzi91bc0nwdldj42hfdhpyl8lg";
+  version = "1.15.8";
+  sha256 = "11q7njr0khv8hb96bclyw5f75gvm12nw3jjgmq9rifbym2yazgd8";
 })
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 5db09284874ce..85794d2b6ee34 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -37,11 +37,11 @@ let
 
 in buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "0.34.0";
+  version = "0.34.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bqwivzfx3kikzjmn4mng829ll8y62pd08hvsx99arr7cyzp6gri";
+    sha256 = "00mj8gb8yx43frzni7xqxr52xix0vizydbmcnhjb6mnr5w6jafb7";
   };
 
   patches = [
diff --git a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
index 5c5750fccc8ee..3d811c394cf9a 100644
--- a/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
+++ b/pkgs/servers/monitoring/nagios/plugins/check_ssl_cert.nix
@@ -2,15 +2,20 @@
 
 stdenv.mkDerivation rec {
   name = "check_ssl_cert-${version}";
-  version = "1.79.0";
+  version = "1.80.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     rev = "v${version}";
-    sha256 = "0pqk09xypa9vdxw5lbaa1j8w3mbmdwh2y1sq768rqq0izyfynf4d";
+    sha256 = "1jkwii45hynil1jail9gmz4bak066rdi8zfcczicjsa6npbz50w4";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace 'YEAR=`date +"%Y"`' 'YEAR=2018'
+  '';
+
   nativeBuildInputs = [ makeWrapper ];
 
   makeFlags = [ "DESTDIR=$(out)/bin" "MANDIR=$(out)/share/man" ];
diff --git a/pkgs/servers/monitoring/prometheus/node-exporter.nix b/pkgs/servers/monitoring/prometheus/node-exporter.nix
index 9714a6048e88a..80ad4a32be75f 100644
--- a/pkgs/servers/monitoring/prometheus/node-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/node-exporter.nix
@@ -1,8 +1,6 @@
-{ stdenv, buildGo19Package, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub }:
 
-# Go 1.10 causes segfaults:
-# https://github.com/prometheus/node_exporter/issues/870
-buildGo19Package rec {
+buildGoPackage rec {
   name = "node_exporter-${version}";
   version = "0.17.0";
   rev = "v${version}";
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index a3cc183bb3a56..27fc33e764bff 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -616,7 +616,7 @@ self: super:
   });
 
   xcursorthemes = super.xcursorthemes.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [self.xcursorgen];
+    buildInputs = attrs.buildInputs ++ [ self.xcursorgen self.xorgproto ];
     configureFlags = [ "--with-cursordir=$(out)/share/icons" ];
   });
 
diff --git a/pkgs/tools/misc/bonfire/default.nix b/pkgs/tools/misc/bonfire/default.nix
index 9355f3e54076e..b8e5e3de65066 100644
--- a/pkgs/tools/misc/bonfire/default.nix
+++ b/pkgs/tools/misc/bonfire/default.nix
@@ -20,7 +20,8 @@ buildPythonApplication rec {
     # https://github.com/blue-yonder/bonfire/pull/24
     substituteInPlace requirements.txt \
       --replace "arrow>=0.5.4,<0.8" "arrow>=0.5.4" \
-      --replace "keyring>=9,<10"    "keyring>=9"
+      --replace "keyring>=9,<10"    "keyring>=9" \
+      --replace "click>=3.3,<7"     "click>=3.3"
     # pip fails when encountering the git hash for the package version
     substituteInPlace setup.py \
       --replace "version=version," "version='${version}',"
diff --git a/pkgs/tools/misc/cht.sh/default.nix b/pkgs/tools/misc/cht.sh/default.nix
new file mode 100644
index 0000000000000..837bc0e9ed71a
--- /dev/null
+++ b/pkgs/tools/misc/cht.sh/default.nix
@@ -0,0 +1,39 @@
+{ stdenv
+, fetchFromGitHub
+, makeWrapper
+, curl
+, ncurses
+, rlwrap
+, xsel
+}:
+
+stdenv.mkDerivation rec {
+  name = "cht.sh-${version}";
+  version = "unstable-2018-11-02";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  src = fetchFromGitHub {
+    owner = "chubin";
+    repo = "cheat.sh";
+    rev = "9595805ac68b3c096f7c51fa024dcb97a7dfac44";
+    sha256 = "11g8say5fksg0zg0bqrgl92rprn4lwp20g9rz1i0r38f0jy3nyrf";
+  };
+
+  # Fix ".cht.sh-wrapped" in the help message
+  postPatch = "substituteInPlace share/cht.sh.txt --replace '\${0##*/}' cht.sh";
+
+  installPhase = ''
+    install -m755 -D share/cht.sh.txt "$out/bin/cht.sh"
+    wrapProgram "$out/bin/cht.sh" \
+      --prefix PATH : "${stdenv.lib.makeBinPath [ curl rlwrap ncurses xsel ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "CLI client for cheat.sh, a community driven cheat sheet";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fgaz ];
+    homepage = https://github.com/chubin/cheat.sh;
+  };
+}
+
diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix
index 6787549e053b8..27dfdae328124 100644
--- a/pkgs/tools/misc/hexyl/default.nix
+++ b/pkgs/tools/misc/hexyl/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   name    = "hexyl-${version}";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner  = "sharkdp";
     repo   = "hexyl";
     rev    = "v${version}";
-    sha256 = "138w6czi62dpw6gcd3yqpk7lns7m89kwbgm1d1i5lnzsqck3wb4s";
+    sha256 = "1q4klph45a7zjzwajrccb51yc3k1p16mjlnqislpm43h653f728q";
   };
 
-  cargoSha256 = "01m8n7yl3yqr8kj0dl1wfaz724da17hs3sb1fbncv64l6qpvdka1";
+  cargoSha256 = "17mp6amib58akh175qprqsz3qkffgdacfm3dhkbysiqmw5m2p2p7";
 
   meta = with stdenv.lib; {
     description = "A command-line hex viewer";
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
     '';
     homepage    = https://github.com/sharkdp/hexyl;
     license     = with licenses; [ asl20 /* or */ mit ];
-    maintainers = [];
+    maintainers = with maintainers; [ dywedir ];
     platforms   = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/tools/misc/neofetch/default.nix b/pkgs/tools/misc/neofetch/default.nix
index a076a405ce787..18ae88547a09b 100644
--- a/pkgs/tools/misc/neofetch/default.nix
+++ b/pkgs/tools/misc/neofetch/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "neofetch-${version}";
-  version = "5.0.0";
+  version = "6.0.0";
   src = fetchFromGitHub {
     owner = "dylanaraps";
     repo = "neofetch";
     rev = version;
-    sha256 = "0yzyi2p0d8xp576lxyv5m9h60dl1d5dmrn40aad307872835b9rr";
+    sha256 = "0j0r40llyry1sgc6p9wd7jrpydps2lnj4rwajjp37697g2bik89i";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/networking/ubridge/default.nix b/pkgs/tools/networking/ubridge/default.nix
new file mode 100644
index 0000000000000..91ab22a3c5a01
--- /dev/null
+++ b/pkgs/tools/networking/ubridge/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub
+, libpcap
+}:
+
+stdenv.mkDerivation rec {
+  name = "ubridge-${version}";
+  version = "0.9.14";
+
+  src = fetchFromGitHub {
+    owner = "GNS3";
+    repo = "ubridge";
+    rev = "v${version}";
+    sha256 = "1m3j9jfj8fm0532jhaagqgsyr241j6z9wn8lgrl7q3973rhiahfs";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "/usr/local/bin" "$out/bin" \
+      --replace "setcap" "#setcap"
+  '';
+
+  buildInputs = [ libpcap ];
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Bridge for UDP tunnels, Ethernet, TAP, and VMnet interfaces";
+    longDescription = ''
+      uBridge is a simple application to create user-land bridges between
+      various technologies. Currently bridging between UDP tunnels, Ethernet
+      and TAP interfaces is supported. Packet capture is also supported.
+    '';
+    inherit (src.meta) homepage;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 4f8395ed961f9..995f123b81d3a 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, fetchpatch, perl, curl, bzip2, sqlite, openssl ? null, xz
-, pkgconfig, boehmgc, perlPackages, libsodium, brotli, boost
+, pkgconfig, boehmgc, perlPackages, libsodium, brotli, boost, editline
 , autoreconfHook, autoconf-archive, bison, flex, libxml2, libxslt, docbook5, docbook_xsl_ns
 , busybox-sandbox-shell
 , storeDir ? "/nix/store"
@@ -30,7 +30,7 @@ let
 
     buildInputs = [ curl openssl sqlite xz bzip2 ]
       ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-      ++ lib.optionals is20 [ brotli boost ]
+      ++ lib.optionals is20 [ brotli boost editline ]
       ++ lib.optional withLibseccomp libseccomp
       ++ lib.optional (withAWS && is20)
           ((aws-sdk-cpp.override {
@@ -149,10 +149,10 @@ in rec {
   }) // { perl-bindings = nix1; };
 
   nixStable = (common rec {
-    name = "nix-2.1.3";
+    name = "nix-2.2";
     src = fetchurl {
       url = "http://nixos.org/releases/nix/${name}/${name}.tar.xz";
-      sha256 = "5d22dad058d5c800d65a115f919da22938c50dd6ba98c5e3a183172d149840a4";
+      sha256 = "63238d00d290b8a93925891fc9164439d3941e2ccc569bf7f7ca32f53c3ec0c7";
     };
   }) // { perl-bindings = perl-bindings {
     nix = nixStable;
@@ -166,7 +166,7 @@ in rec {
       owner = "NixOS";
       repo = "nix";
       rev = "85488a93ec3b07210339f2b05aa93e970f9ac3be";
-      sha256 = "0fkmx7gmgg0yij9kw52fkyvib88hj1jsj90vbpy13ccfwknh1044";
+      sha256 = "1n5dp7p2lzpnj7f834d25k020v16gnnsm56jz46y87v2x7b69ccm";
     };
     fromGit = true;
   })) // { perl-bindings = perl-bindings {
diff --git a/pkgs/tools/package-management/nixops/generic.nix b/pkgs/tools/package-management/nixops/generic.nix
index bc55f99aa81a9..2ce7f9858a5b0 100644
--- a/pkgs/tools/package-management/nixops/generic.nix
+++ b/pkgs/tools/package-management/nixops/generic.nix
@@ -1,4 +1,4 @@
-{ lib, python2Packages, libxslt, docbook_xsl_ns, openssh
+{ lib, python2Packages, libxslt, docbook_xsl_ns, openssh, cacert
 # version args
 , src, version
 }:
@@ -29,7 +29,13 @@ python2Packages.buildPythonApplication {
       typing
     ];
 
-  doCheck = false;
+  checkPhase =
+  # Ensure, that there are no (python) import errors
+  ''
+    SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt \
+    HOME=$(pwd) \
+      $out/bin/nixops --version
+  '';
 
   postInstall = ''
     make -C doc/manual install nixops.1 docbookxsl=${docbook_xsl_ns}/xml/xsl/docbook \
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/tools/security/tor/default.nix
index d43b8598c18b3..1bda80dab4549 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/tools/security/tor/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, libevent, openssl, zlib, torsocks
-, libseccomp, systemd, libcap
+, libseccomp, systemd, libcap, lzma, zstd, scrypt
 
 # for update.nix
 , writeScript
@@ -14,17 +14,17 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "tor-0.3.4.9";
+  name = "tor-0.3.5.7";
 
   src = fetchurl {
     url = "https://dist.torproject.org/${name}.tar.gz";
-    sha256 = "0jhnvnp08hsfrzgsvg5xnfxyaw3nzgg9h24cwbwnz6iby20i05qs";
+    sha256 = "17l31p58rsd30w4b6r4d8pbr84z3y7awahvjxbpmnlxc47y8f20v";
   };
 
   outputs = [ "out" "geoip" ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libevent openssl zlib ] ++
+  buildInputs = [ libevent openssl zlib lzma zstd scrypt ] ++
     stdenv.lib.optionals stdenv.isLinux [ libseccomp systemd libcap ];
 
   NIX_CFLAGS_LINK = stdenv.lib.optionalString stdenv.cc.isGNU "-lgcc_s";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1a4992666b718..c8b17e501ee32 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1007,7 +1007,9 @@ in
 
   blockdiag = with python3Packages; toPythonApplication blockdiag;
 
-  blsd = callPackage ../tools/misc/blsd { };
+  blsd = callPackage ../tools/misc/blsd {
+    libgit2 = libgit2_0_27;
+  };
 
   bluez-alsa = callPackage ../tools/bluetooth/bluez-alsa { };
 
@@ -1168,6 +1170,8 @@ in
 
   cfdyndns = callPackage ../applications/networking/dyndns/cfdyndns { };
 
+  cht-sh = callPackage ../tools/misc/cht.sh { };
+
   ckbcomp = callPackage ../tools/X11/ckbcomp { };
 
   clac = callPackage ../tools/misc/clac {};
@@ -1484,7 +1488,7 @@ in
     pythonPackages = python3Packages;
   };
 
-  gringo = callPackage ../tools/misc/gringo { scons = scons_2_5_1; };
+  gringo = callPackage ../tools/misc/gringo { };
 
   grobi = callPackage ../tools/X11/grobi { };
 
@@ -4580,6 +4584,8 @@ in
 
   ola = callPackage ../applications/misc/ola { };
 
+  omping = callPackage ../applications/networking/omping { };
+
   onioncircuits = callPackage ../tools/security/onioncircuits {
     inherit (gnome3) defaultIconTheme;
   };
@@ -5911,6 +5917,8 @@ in
 
   ua = callPackage ../tools/networking/ua { };
 
+  ubridge = callPackage ../tools/networking/ubridge { };
+
   ucl = callPackage ../development/libraries/ucl { };
 
   ucspi-tcp = callPackage ../tools/networking/ucspi-tcp { };
@@ -6664,7 +6672,10 @@ in
   clang-sierraHack-stdenv = overrideCC stdenv clang-sierraHack;
   libcxxStdenv = if stdenv.isDarwin then stdenv else lowPrio llvmPackages.libcxxStdenv;
 
-  clasp-common-lisp = callPackage ../development/compilers/clasp {};
+  clasp-common-lisp = callPackage ../development/compilers/clasp {
+    llvmPackages = llvmPackages_6;
+    stdenv = llvmPackages_6.stdenv;
+  };
 
   clean = callPackage ../development/compilers/clean { };
 
@@ -7008,7 +7019,8 @@ in
   };
   gcc-arm-embedded-6 = callPackage ../development/compilers/gcc-arm-embedded/6 {};
   gcc-arm-embedded-7 = callPackage ../development/compilers/gcc-arm-embedded/7 {};
-  gcc-arm-embedded = gcc-arm-embedded-7;
+  gcc-arm-embedded-8 = callPackage ../development/compilers/gcc-arm-embedded/8 {};
+  gcc-arm-embedded = gcc-arm-embedded-8;
 
   gforth = callPackage ../development/compilers/gforth {};
 
@@ -7574,6 +7586,8 @@ in
 
   tinycc = callPackage ../development/compilers/tinycc { };
 
+  tinyscheme = callPackage ../development/interpreters/tinyscheme { };
+
   inherit (ocaml-ng.ocamlPackages_4_02) trv;
 
   bupc = callPackage ../development/compilers/bupc { };
@@ -9021,7 +9035,6 @@ in
 
   sconsPackages = callPackage ../development/tools/build-managers/scons { };
   scons = sconsPackages.scons_3_0_3;
-  scons_2_5_1 = sconsPackages.scons_2_5_1;
 
   mill = callPackage ../development/tools/build-managers/mill { };
 
@@ -9888,6 +9901,10 @@ in
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  libgit2_0_27 = callPackage ../development/libraries/git2/0.27.nix {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   libgit2-glib = callPackage ../development/libraries/libgit2-glib { };
 
   glbinding = callPackage ../development/libraries/glbinding { };
@@ -11789,6 +11806,8 @@ in
 
   ntrack = callPackage ../development/libraries/ntrack { };
 
+  nv-codec-headers = callPackage ../development/libraries/nv-codec-headers { };
+
   nvidia-texture-tools = callPackage ../development/libraries/nvidia-texture-tools { };
 
   nvidia-video-sdk = callPackage ../development/libraries/nvidia-video-sdk { };
@@ -20792,7 +20811,9 @@ in
 
   openmw-tes3mp = libsForQt5.callPackage ../games/openmw/tes3mp.nix { };
 
-  openra = callPackage ../games/openra { lua = lua5_1; };
+  openraPackages = import ../games/openra pkgs;
+
+  openra = openraPackages.engines.release;
 
   openrw = callPackage ../games/openrw { };
 
@@ -21399,6 +21420,8 @@ in
 
   bcftools = callPackage ../applications/science/biology/bcftools { };
 
+  bftools = callPackage ../applications/science/biology/bftools { };
+
   conglomerate = callPackage ../applications/science/biology/conglomerate { };
 
   dcm2niix = callPackage ../applications/science/biology/dcm2niix { };
@@ -22050,10 +22073,12 @@ in
   ns-3 = callPackage ../development/libraries/science/networking/ns3 { };
 
   root = callPackage ../applications/science/misc/root {
+    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
   };
 
   root5 = lowPrio (callPackage ../applications/science/misc/root/5.nix {
+    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
   });
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index a80aec268b9a5..8df57e8d710a2 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -589,6 +589,8 @@ let
 
     re2_p4 = callPackage ../development/ocaml-modules/re2 { };
 
+    resource-pooling = callPackage ../development/ocaml-modules/resource-pooling { };
+
     result = callPackage ../development/ocaml-modules/ocaml-result { };
 
     seq = callPackage ../development/ocaml-modules/seq { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2baaefaba9998..b7eb692c4ab85 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -278,10 +278,16 @@ in {
 
   cachecontrol = callPackage ../development/python-modules/cachecontrol { };
 
+  cachy = callPackage ../development/python-modules/cachy { };
+
   cdecimal = callPackage ../development/python-modules/cdecimal { };
 
   chalice = callPackage ../development/python-modules/chalice { };
 
+  cleo = callPackage ../development/python-modules/cleo { };
+
+  clikit = callPackage ../development/python-modules/clikit { };
+
   clustershell = callPackage ../development/python-modules/clustershell { };
 
   cozy = callPackage ../development/python-modules/cozy { };
@@ -484,6 +490,8 @@ in {
 
   palettable = callPackage ../development/python-modules/palettable { };
 
+  pastel = callPackage ../development/python-modules/pastel { };
+
   pathlib = callPackage ../development/python-modules/pathlib { };
 
   pdf2image = callPackage ../development/python-modules/pdf2image { };
@@ -500,6 +508,8 @@ in {
 
   plantuml = callPackage ../tools/misc/plantuml { };
 
+  poetry = callPackage ../development/python-modules/poetry { };
+
   progress = callPackage ../development/python-modules/progress { };
 
   pymysql = callPackage ../development/python-modules/pymysql { };
@@ -591,6 +601,8 @@ in {
 
   pykeepass = callPackage ../development/python-modules/pykeepass { };
 
+  pylev = callPackage ../development/python-modules/pylev { };
+
   pymatgen = callPackage ../development/python-modules/pymatgen { };
 
   pymatgen-lammps = callPackage ../development/python-modules/pymatgen-lammps { };
@@ -760,6 +772,8 @@ in {
 
   toml = callPackage ../development/python-modules/toml { };
 
+  tomlkit = callPackage ../development/python-modules/tomlkit { };
+
   unifi = callPackage ../development/python-modules/unifi { };
 
   vidstab = callPackage ../development/python-modules/vidstab { };
@@ -2611,6 +2625,8 @@ in {
 
   google_cloud_websecurityscanner = callPackage ../development/python-modules/google_cloud_websecurityscanner { };
 
+  google-i18n-address = callPackage ../development/python-modules/google-i18n-address { };
+
   google_resumable_media = callPackage ../development/python-modules/google_resumable_media { };
 
   gpgme = toPythonModule (pkgs.gpgme.override {