Merge branch 'staging' into glibc230

2020-01-23 11:31:13 +01:00 · 2020-01-23 11:31:13 +01:00 · eddfcc32b4
parent 91b7e73bbc cdfb32d17a
commit eddfcc32b4
309 changed files with 4679 additions and 1878 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -833,6 +833,7 @@ used in `buildPythonPackage`.
 - `pythonRemoveBinBytecode` to remove bytecode from the `/bin` folder.
 - `setuptoolsBuildHook` to build a wheel using `setuptools`.
 - `setuptoolsCheckHook` to run tests with `python setup.py test`.
+- `venvShellHook` to source a Python 3 `venv` at the `venvDir` location. A `venv` is created if it does not yet exist.
 - `wheelUnpackHook` to move a wheel to the correct folder so it can be installed with the `pipInstallHook`.

 ### Development mode
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -32,17 +32,17 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust

 ```
 rustPlatform.buildRustPackage rec {
-  name = "ripgrep-${version}";
-  version = "0.4.0";
+  pname = "ripgrep";
+  version = "11.0.2";

  src = fetchFromGitHub {
    owner = "BurntSushi";
-    repo = "ripgrep";
-    rev = "${version}";
-    sha256 = "0y5d1n6hkw85jb3rblcxqas2fp82h3nghssa4xqrhqnz25l799pj";
+    repo = pname;
+    rev = version;
+    sha256 = "1iga3320mgi7m853la55xip514a3chqsdi1a1rwv25lr9b1p7vd3";
  };

-  cargoSha256 = "0q68qyl2h6i0qsz82z840myxlnjay8p1w5z7hfyr8fqp7wgwa9cx";
+  cargoSha256 = "17ldqr3asrdcsh4l29m3b5r37r5d0b3npq1lrgjmxb6vlx6a36qh";
  verifyCargoDeps = true;

  meta = with stdenv.lib; {
@ -66,7 +66,11 @@ added in `cargoPatches` will also be prepended to the patches in `patches` at
 build-time.

 When `verifyCargoDeps` is set to `true`, the build will also verify that the
-`cargoSha256` is not out of date by comparing the `Cargo.lock` file in both the `cargoDeps` and `src`. Note that this option changes the value of `cargoSha256` since it also copies the `Cargo.lock` in it. To avoid breaking backward-compatibility this option is not enabled by default but hopefully will be in the future.
+`cargoSha256` is not out of date by comparing the `Cargo.lock` file in both the
+`cargoDeps` and `src`. Note that this option changes the value of `cargoSha256`
+since it also copies the `Cargo.lock` in it. To avoid breaking
+backward-compatibility this option is not enabled by default but hopefully will
+be in the future.

 ### Building a crate for a different target

--- a/doc/overrides.css
+++ b/doc/overrides.css
@ -1,9 +1,22 @@
 .docbook .xref img[src^=images\/callouts\/],
 .screen img,
-.programlisting img {
+.programlisting img,
+.literallayout img,
+.synopsis img {
    width: 1em;
 }

 .calloutlist img {
    width: 1.5em;
 }
+
+.prompt,
+.screen img,
+.programlisting img,
+.literallayout img,
+.synopsis img {
+    -moz-user-select: none;
+    -webkit-user-select: none;
+    -ms-user-select: none;
+    user-select: none;
+}
--- a/lib/cli.nix
+++ b/lib/cli.nix
@ -0,0 +1,56 @@
+{ lib }:
+
+rec {
+  /* Automatically convert an attribute set to command-line options.
+
+     This helps protect against malformed command lines and also to reduce
+     boilerplate related to command-line construction for simple use cases.
+
+     Example:
+       encodeGNUCommandLine
+         { }
+         { data = builtins.toJSON { id = 0; };
+
+           X = "PUT";
+
+           retry = 3;
+
+           retry-delay = null;
+
+           url = [ "https://example.com/foo" "https://example.com/bar" ];
+
+           silent = false;
+
+           verbose = true;
+         };
+       => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'"
+  */
+  encodeGNUCommandLine =
+    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+
+  toGNUCommandLine =
+    { renderKey ?
+        key: if builtins.stringLength key == 1 then "-${key}" else "--${key}"
+
+    , renderOption ?
+        key: value:
+          if value == null
+          then []
+          else [ (renderKey key) (builtins.toString value) ]
+
+    , renderBool ? key: value: lib.optional value (renderKey key)
+
+    , renderList ? key: value: lib.concatMap (renderOption key) value
+    }:
+    options:
+      let
+        render = key: value:
+                 if builtins.isBool value
+            then renderBool key value
+            else if builtins.isList value
+            then renderList key value
+            else renderOption key value;
+
+      in
+        builtins.concatLists (lib.mapAttrsToList render options);
+}
--- a/lib/default.nix
+++ b/lib/default.nix
@ -39,6 +39,7 @@ let

    # misc
    asserts = callLibs ./asserts.nix;
+    cli = callLibs ./cli.nix;
    debug = callLibs ./debug.nix;
    generators = callLibs ./generators.nix;
    misc = callLibs ./deprecated.nix;
@ -100,7 +101,7 @@ let
    inherit (sources) pathType pathIsDirectory cleanSourceFilter
      cleanSource sourceByRegex sourceFilesBySuffices
      commitIdFromGitRepo cleanSourceWith pathHasContext
-      canCleanSource;
+      canCleanSource pathIsRegularFile;
    inherit (modules) evalModules unifyModuleSyntax
      applyIfFunction mergeModules
      mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
@ -120,6 +121,7 @@ let
      isOptionType mkOptionType;
    inherit (asserts)
      assertMsg assertOneOf;
+    inherit (cli) encodeGNUCommandLine toGNUCommandLine;
    inherit (debug) addErrorContextToAttrs traceIf traceVal traceValFn
      traceXMLVal traceXMLValMarked traceSeq traceSeqN traceValSeq
      traceValSeqFn traceValSeqN traceValSeqNFn traceShowVal
--- a/lib/sources.nix
+++ b/lib/sources.nix
@ -9,6 +9,9 @@ rec {
  # Returns true if the path exists and is a directory, false otherwise
  pathIsDirectory = p: if builtins.pathExists p then (pathType p) == "directory" else false;

+  # Returns true if the path exists and is a regular file, false otherwise
+  pathIsRegularFile = p: if builtins.pathExists p then (pathType p) == "regular" else false;
+
  # Bring in a path as a source, filtering out all Subversion and CVS
  # directories, as well as backup files (*~).
  cleanSourceFilter = name: type: let baseName = baseNameOf (toString name); in ! (
@ -110,24 +113,43 @@ rec {
      with builtins;
        let fileName       = toString path + "/" + file;
            packedRefsName = toString path + "/packed-refs";
-        in if lib.pathExists fileName
+        in if pathIsRegularFile path
+           # Resolve git worktrees. See gitrepository-layout(5)
+           then
+             let m   = match "^gitdir: (.*)$" (lib.fileContents path);
+             in if m == null
+                then throw ("File contains no gitdir reference: " + path)
+                else
+                  let gitDir     = lib.head m;
+                      commonDir' = if pathIsRegularFile "${gitDir}/commondir"
+                                   then lib.fileContents "${gitDir}/commondir"
+                                   else gitDir;
+                      commonDir  = if lib.hasPrefix "/" commonDir'
+                                   then commonDir'
+                                   else toString (/. + "${gitDir}/${commonDir'}");
+                      refFile    = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
+                  in readCommitFromFile refFile commonDir
+
+           else if pathIsRegularFile fileName
+           # Sometimes git stores the commitId directly in the file but
+           # sometimes it stores something like: «ref: refs/heads/branch-name»
           then
             let fileContent = lib.fileContents fileName;
-                 # Sometimes git stores the commitId directly in the file but
-                 # sometimes it stores something like: «ref: refs/heads/branch-name»
                 matchRef    = match "^ref: (.*)$" fileContent;
-             in if   matchRef == null
+             in if  matchRef == null
                then fileContent
                else readCommitFromFile (lib.head matchRef) path
+
+           else if pathIsRegularFile packedRefsName
           # Sometimes, the file isn't there at all and has been packed away in the
           # packed-refs file, so we have to grep through it:
-           else if lib.pathExists packedRefsName
           then
             let fileContent = readFile packedRefsName;
                 matchRef    = match (".*\n([^\n ]*) " + file + "\n.*") fileContent;
-             in if   matchRef == null
+             in if  matchRef == null
                then throw ("Could not find " + file + " in " + packedRefsName)
                else lib.head matchRef
+
           else throw ("Not a .git directory: " + path);
    in readCommitFromFile "HEAD";

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -441,4 +441,25 @@ runTests {
    expected  = "«foo»";
  };

+  testRenderOptions = {
+    expr =
+       encodeGNUCommandLine
+         { }
+         { data = builtins.toJSON { id = 0; };
+
+           X = "PUT";
+
+           retry = 3;
+
+           retry-delay = null;
+
+           url = [ "https://example.com/foo" "https://example.com/bar" ];
+
+           silent = false;
+
+           verbose = true;
+         };
+
+    expected = "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
+  };
 }
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -174,8 +174,7 @@ checkConfigOutput "true" config.submodule.inner ./declare-submoduleWith-modules.
 checkConfigOutput "true" config.submodule.outer ./declare-submoduleWith-modules.nix

 ## Paths should be allowed as values and work as expected
-# Temporarily disabled until https://github.com/NixOS/nixpkgs/pull/76861
-#checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix
+checkConfigOutput "true" config.submodule.enable ./declare-submoduleWith-path.nix

 # Check that disabledModules works recursively and correctly
 checkConfigOutput "true" config.enable ./disable-recursive/main.nix
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@ -191,7 +191,7 @@ rec {
    let
      revisionFile = "${toString ./..}/.git-revision";
      gitRepo      = "${toString ./..}/.git";
-    in if lib.pathIsDirectory gitRepo
+    in if builtins.pathExists gitRepo
       then lib.commitIdFromGitRepo gitRepo
       else if lib.pathExists revisionFile then lib.fileContents revisionFile
       else default;
--- a/lib/types.nix
+++ b/lib/types.nix
@ -340,18 +340,68 @@ rec {
            let
              padWidth = stringLength (toString (length def.value));
              unnamed = i: unnamedPrefix + fixedWidthNumber padWidth i;
+              anyString = placeholder "name";
+              nameAttrs = [
+                { path = [ "environment" "etc" ];
+                  name = "target";
+                }
+                { path = [ "containers" anyString "bindMounts" ];
+                  name = "mountPoint";
+                }
+                { path = [ "programs" "ssh" "knownHosts" ];
+                  # hostNames is actually a list so we would need to handle it only when singleton
+                  name = "hostNames";
+                }
+                { path = [ "fileSystems" ];
+                  name = "mountPoint";
+                }
+                { path = [ "boot" "specialFileSystems" ];
+                  name = "mountPoint";
+                }
+                { path = [ "services" "znapzend" "zetup" ];
+                  name = "dataset";
+                }
+                { path = [ "services" "znapzend" "zetup" anyString "destinations" ];
+                  name = "label";
+                }
+                { path = [ "services" "geoclue2" "appConfig" ];
+                  name = "desktopID";
+                }
+              ];
+              matched = let
+                equals = a: b: b == anyString || a == b;
+                fallback = { name = "name"; };
+              in findFirst ({ path, ... }: all (v: v == true) (zipListsWith equals loc path)) fallback nameAttrs;
+              nameAttr = matched.name;
+              nameValueOld = value:
+                if isList value then
+                  if length value > 0 then
+                    "[ " + concatMapStringsSep " " escapeNixString value + " ]"
+                  else
+                    "[ ]"
+                else
+                  escapeNixString value;
+              nameValueNew = value: unnamed:
+                if isList value then
+                  if length value > 0 then
+                    head value
+                  else
+                    unnamed
+                else
+                  value;
              res =
                { inherit (def) file;
                  value = listToAttrs (
                    imap1 (elemIdx: elem:
-                      { name  = elem.name or (unnamed elemIdx);
+                      { name  = nameValueNew (elem.${nameAttr} or (unnamed elemIdx)) (unnamed elemIdx);
                        value = elem;
                      }) def.value);
                };
              option = concatStringsSep "." loc;
              sample = take 3 def.value;
-              list = concatMapStrings (x: ''{ name = "${x.name or "unnamed"}"; ...} '') sample;
-              set = concatMapStrings (x: ''${x.name or "unnamed"} = {...}; '') sample;
+              more = lib.optionalString (length def.value > 3) "... ";
+              list = concatMapStrings (x: ''{ ${nameAttr} = ${nameValueOld (x.${nameAttr} or "unnamed")}; ...} '') sample;
+              set = concatMapStrings (x: ''${nameValueNew (x.${nameAttr} or "unnamed") "unnamed"} = {...}; '') sample;
              msg = ''
                In file ${def.file}
                a list is being assigned to the option config.${option}.
@ -359,10 +409,10 @@ rec {
                See https://git.io/fj2zm for more information.
                Do
                  ${option} =
-                    { ${set}...}
+                    { ${set}${more}}
                instead of
                  ${option} =
-                    [ ${list}...]
+                    [ ${list}${more}]
              '';
            in
              lib.warn msg res
@ -430,14 +480,16 @@ rec {
          else unify (if shorthandOnlyDefinesConfig then { config = value; } else value);

        allModules = defs: modules ++ imap1 (n: { value, file }:
-          # Annotate the value with the location of its definition for better error messages
-          coerce (lib.modules.unifyModuleSyntax file "${toString file}-${toString n}") value
+          if isAttrs value || isFunction value then
+            # Annotate the value with the location of its definition for better error messages
+            coerce (lib.modules.unifyModuleSyntax file "${toString file}-${toString n}") value
+          else value
        ) defs;

      in
      mkOptionType rec {
        name = "submodule";
-        check = x: isAttrs x || isFunction x;
+        check = x: isAttrs x || isFunction x || path.check x;
        merge = loc: defs:
          (evalModules {
            modules = allModules defs;
@ -538,7 +590,7 @@ rec {
        tail' = tail ts;
      in foldl' either head' tail';

-    # Either value of type `finalType` or `coercedType`, the latter is
+    # Either value of type `coercedType` or `finalType`, the former is
    # converted to `finalType` using `coerceFunc`.
    coercedTo = coercedType: coerceFunc: finalType:
      assert lib.assertMsg (coercedType.getSubModules == null)
@ -547,12 +599,12 @@ rec {
      mkOptionType rec {
        name = "coercedTo";
        description = "${finalType.description} or ${coercedType.description} convertible to it";
-        check = x: finalType.check x || (coercedType.check x && finalType.check (coerceFunc x));
+        check = x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
        merge = loc: defs:
          let
            coerceVal = val:
-              if finalType.check val then val
-              else coerceFunc val;
+              if coercedType.check val then coerceFunc val
+              else val;
          in finalType.merge loc (map (def: def // { value = coerceVal def.value; }) defs);
        emptyValue = finalType.emptyValue;
        getSubOptions = finalType.getSubOptions;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -505,6 +505,12 @@
    githubId = 750786;
    name = "Justin Wood";
  };
+  anmonteiro = {
+    email = "anmonteiro@gmail.com";
+    github = "anmonteiro";
+    githubId = 661909;
+    name = "Antonio Nuno Monteiro";
+  };
  anpryl = {
    email = "anpryl@gmail.com";
    github = "anpryl";
@ -2433,6 +2439,12 @@
    githubId = 844574;
    name = "Daniel Austin";
  };
+  flyfloh = {
+    email = "nix@halbmastwurf.de";
+    github = "flyfloh";
+    githubId = 74379;
+    name = "Florian Pester";
+  };
  fmthoma = {
    email = "f.m.thoma@googlemail.com";
    github = "fmthoma";
@ -4430,6 +4442,12 @@
    githubId = 158568;
    name = "Matthias C. M. Troffaes";
  };
+  McSinyx = {
+    email = "vn.mcsinyx@gmail.com";
+    github = "McSinyx";
+    githubId = 13689192;
+    name = "Nguyễn Gia Phong";
+  };
  mdaiter = {
    email = "mdaiter8121@gmail.com";
    github = "mdaiter";
@ -5070,6 +5088,12 @@
    githubId = 7588406;
    name = "Andrew R. M.";
  };
+  nloomans = {
+    email = "noah@nixos.noahloomans.com";
+    github = "nloomans";
+    githubId = 7829481;
+    name = "Noah Loomans";
+  };
  nmattia = {
    email = "nicolas@nmattia.com";
    github = "nmattia";
@ -7014,6 +7038,11 @@
    github = "timbertson";
    name = "Tim Cuthbertson";
  };
+  timma = {
+    email = "kunduru.it.iitb@gmail.com";
+    github = "ktrsoft";
+    name = "Timma";
+  };
  timokau = {
    email = "timokau@zoho.com";
    github = "timokau";
--- a/nixos/doc/manual/development/option-types.xml
+++ b/nixos/doc/manual/development/option-types.xml
@ -257,9 +257,9 @@
    <listitem>
     <para>
      A set of sub options <replaceable>o</replaceable>.
-      <replaceable>o</replaceable> can be an attribute set or a function
-      returning an attribute set. Submodules are used in composed types to
-      create modular options. This is equivalent to
+      <replaceable>o</replaceable> can be an attribute set, a function
+      returning an attribute set, or a path to a file containing such a value. Submodules are used in
+      composed types to create modular options. This is equivalent to
      <literal>types.submoduleWith { modules = toList o; shorthandOnlyDefinesConfig = true; }</literal>.
      Submodules are detailed in
      <xref
--- a/nixos/doc/manual/man-pages.xml
+++ b/nixos/doc/manual/man-pages.xml
@ -6,7 +6,7 @@
  <author><personname><firstname>Eelco</firstname><surname>Dolstra</surname></personname>
   <contrib>Author</contrib>
  </author>
-  <copyright><year>2007-2019</year><holder>Eelco Dolstra</holder>
+  <copyright><year>2007-2020</year><holder>Eelco Dolstra</holder>
  </copyright>
 </info>
 <xi:include href="man-configuration.xml" />
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -391,6 +391,16 @@ users.users.me =
     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     For NixOS modules, the types <literal>types.submodule</literal> and <literal>types.submoduleWith</literal> now support
+     paths as allowed values, similar to how <literal>imports</literal> supports paths.
+     Because of this, if you have a module that defines an option of type
+     <literal>either (submodule ...) path</literal>, it will break since a path
+     is now treated as the first type instead of the second. To fix this, change
+     the type to <literal>either path (submodule ...)</literal>.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -704,7 +704,8 @@ class Machine:

        def process_serial_output() -> None:
            for _line in self.process.stdout:
-                line = _line.decode("unicode_escape").replace("\r", "").rstrip()
+                # Ignore undecodable bytes that may occur in boot menus
+                line = _line.decode(errors="ignore").replace("\r", "").rstrip()
                eprint("{} # {}".format(self.name, line))
                self.logger.enqueue({"msg": line, "machine": self.name})

--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -155,7 +155,7 @@ in rec {
            --add-flags "''${vms[*]}" \
            ${lib.optionalString enableOCR
              "--prefix PATH : '${ocrProg}/bin:${imagemagick_tiff}/bin'"} \
-            --run "export testScript=\"\$(cat $out/test-script)\"" \
+            --run "export testScript=\"\$(${coreutils}/bin/cat $out/test-script)\"" \
            --set VLANS '${toString vlans}'
          ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
          wrapProgram $out/bin/nixos-run-vms \
--- a/nixos/modules/hardware/usb-wwan.nix
+++ b/nixos/modules/hardware/usb-wwan.nix
@ -21,6 +21,19 @@ with lib;
  ###### implementation

  config = mkIf config.hardware.usbWwan.enable {
+    # Attaches device specific handlers.
    services.udev.packages = with pkgs; [ usb-modeswitch-data ];
+
+    # Triggered by udev, usb-modeswitch creates systemd services via a
+    # template unit in the usb-modeswitch package.
+    systemd.packages = with pkgs; [ usb-modeswitch ];
+
+    # The systemd service requires the usb-modeswitch-data. The
+    # usb-modeswitch package intends to discover this via the
+    # filesystem at /usr/share/usb_modeswitch, and merge it with user
+    # configuration in /etc/usb_modeswitch.d. Configuring the correct
+    # path in the package is difficult, as it would cause a cyclic
+    # dependency.
+    environment.etc."usb_modeswitch.d".source = "${pkgs.usb-modeswitch-data}/share/usb_modeswitch";
  };
 }
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@ -91,8 +91,8 @@ in
      # These defaults are set here rather than up there so that
      # changing them would not rebuild the manual
      version = mkDefault (cfg.release + cfg.versionSuffix);
-      revision      = mkIf (pathIsDirectory gitRepo) (mkDefault            gitCommitId);
-      versionSuffix = mkIf (pathIsDirectory gitRepo) (mkDefault (".git." + gitCommitId));
+      revision      = mkIf (pathExists gitRepo) (mkDefault            gitCommitId);
+      versionSuffix = mkIf (pathExists gitRepo) (mkDefault (".git." + gitCommitId));
    };

    # Generate /etc/os-release.  See
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -735,6 +735,7 @@
  ./services/networking/wicd.nix
  ./services/networking/wireguard.nix
  ./services/networking/wpa_supplicant.nix
+  ./services/networking/xandikos.nix
  ./services/networking/xinetd.nix
  ./services/networking/xl2tpd.nix
  ./services/networking/xrdp.nix
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@ -222,7 +222,7 @@ in {
  };

  config = mkIf cfg.enable {
-    users.groups = optional (cfg.group == "buildbot") {
+    users.groups = optionalAttrs (cfg.group == "buildbot") {
      buildbot = { };
    };

--- a/nixos/modules/services/continuous-integration/buildbot/worker.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/worker.nix
@ -136,7 +136,7 @@ in {
  config = mkIf cfg.enable {
    services.buildbot-worker.workerPassFile = mkDefault (pkgs.writeText "buildbot-worker-password" cfg.workerPass);

-    users.groups = optional (cfg.group == "bbworker") {
+    users.groups = optionalAttrs (cfg.group == "bbworker") {
      bbworker = { };
    };

--- a/nixos/modules/services/continuous-integration/jenkins/slave.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/slave.nix
@ -50,7 +50,7 @@ in {
  };

  config = mkIf (cfg.enable && !masterCfg.enable) {
-    users.groups = optional (cfg.group == "jenkins") {
+    users.groups = optionalAttrs (cfg.group == "jenkins") {
      jenkins.gid = config.ids.gids.jenkins;
    };

--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@ -259,6 +259,8 @@ in
          ${openldap.out}/bin/slapadd ${configOpts} -l ${dataFile}
        ''}
        chown -R "${cfg.user}:${cfg.group}" "${cfg.dataDir}"
+
+        ${openldap}/bin/slaptest ${configOpts}
      '';
      serviceConfig.ExecStart =
        "${openldap.out}/libexec/slapd -d '${cfg.logLevel}' " +
--- a/nixos/modules/services/hardware/usbmuxd.nix
+++ b/nixos/modules/services/hardware/usbmuxd.nix
@ -51,7 +51,7 @@ in
      };
    };

-    users.groups = optional (cfg.group == defaultUserGroup) {
+    users.groups = optionalAttrs (cfg.group == defaultUserGroup) {
      ${cfg.group} = { };
    };

--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -612,10 +612,7 @@ in
    {

      environment = {
-        etc = singleton
-          { source = "/var/lib/postfix/conf";
-            target = "postfix";
-          };
+        etc.postfix.source = "/var/lib/postfix/conf";

        # This makes it comfortable to run 'postqueue/postdrop' for example.
        systemPackages = [ pkgs.postfix ];
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@ -124,7 +124,7 @@ in
    # Allow users to run 'spamc'.

    environment = {
-      etc = singleton { source = spamdEnv; target = "spamassassin"; };
+      etc.spamassassin.source = spamdEnv;
      systemPackages = [ pkgs.spamassassin ];
    };

--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -364,7 +364,7 @@ in
          ''}
          sed -e "s,#secretkey#,$KEY,g" \
              -e "s,#dbpass#,$DBPASS,g" \
-              -e "s,#jwtsecet#,$JWTSECET,g" \
+              -e "s,#jwtsecret#,$JWTSECRET,g" \
              -e "s,#mailerpass#,$MAILERPASSWORD,g" \
              -i ${runConfig}
          chmod 640 ${runConfig} ${secretKey} ${jwtSecret}
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -123,9 +123,9 @@ in
  config = mkIf cfg.enable {

    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' - ${cfg.user} ${cfg.user} - -"
+      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
    ] ++ (optional cfg.consumptionDirIsPublic
-      "d '${cfg.consumptionDir}' 777 ${cfg.user} ${cfg.user} - -"
+      "d '${cfg.consumptionDir}' 777 - - - -"
      # If the consumption dir is not created here, it's automatically created by
      # 'manage' with the default permissions.
    );
@ -169,17 +169,15 @@ in
    };

    users = optionalAttrs (cfg.user == defaultUser) {
-      users = [{
-        name = defaultUser;
+      users.${defaultUser} = {
        group = defaultUser;
        uid = config.ids.uids.paperless;
        home = cfg.dataDir;
-      }];
+      };

-      groups = [{
-        name = defaultUser;
+      groups.${defaultUser} = {
        gid = config.ids.gids.paperless;
-      }];
+      };
    };
  };
 }
--- a/nixos/modules/services/networking/ndppd.nix
+++ b/nixos/modules/services/networking/ndppd.nix
@ -161,7 +161,25 @@ in {
      documentation = [ "man:ndppd(1)" "man:ndppd.conf(5)" ];
      after = [ "network-pre.target" ];
      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+      serviceConfig = {
+        ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}";
+
+        # Sandboxing
+        CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = "AF_INET6 AF_PACKET AF_NETLINK";
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
    };
  };
 }
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -233,6 +233,7 @@ in {
      path = [ pkgs.wpa_supplicant ];

      script = ''
+        iface_args="-s -u -D${cfg.driver} -c ${configFile}"
        ${if ifaces == [] then ''
          for i in $(cd /sys/class/net && echo *); do
            DEVTYPE=
@ -240,14 +241,14 @@ in {
            if [ -e "$UEVENT_PATH" ]; then
              source "$UEVENT_PATH"
              if [ "$DEVTYPE" = "wlan" -o -e /sys/class/net/$i/wireless ]; then
-                ifaces="$ifaces''${ifaces:+ -N} -i$i"
+                args+="''${args:+ -N} -i$i $iface_args"
              fi
            fi
          done
        '' else ''
-          ifaces="${concatStringsSep " -N " (map (i: "-i${i}") ifaces)}"
+          args="${concatMapStringsSep " -N " (i: "-i${i} $iface_args") ifaces}"
        ''}
-        exec wpa_supplicant -s -u -D${cfg.driver} -c ${configFile} $ifaces
+        exec wpa_supplicant $args
      '';
    };

--- a/nixos/modules/services/networking/xandikos.nix
+++ b/nixos/modules/services/networking/xandikos.nix
@ -0,0 +1,148 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xandikos;
+in
+{
+
+  options = {
+    services.xandikos = {
+      enable = mkEnableOption "Xandikos CalDAV and CardDAV server";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.xandikos;
+        defaultText = "pkgs.xandikos";
+        description = "The Xandikos package to use.";
+      };
+
+      address = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = ''
+          The IP address on which Xandikos will listen.
+          By default listens on localhost.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8080;
+        description = "The port of the Xandikos web application";
+      };
+
+      routePrefix = mkOption {
+        type = types.str;
+        default = "/";
+        description = ''
+          Path to Xandikos.
+          Useful when Xandikos is behind a reverse proxy.
+        '';
+      };
+
+      extraOptions = mkOption {
+        default = [];
+        type = types.listOf types.str;
+        example = literalExample ''
+          [ "--autocreate"
+            "--defaults"
+            "--current-user-principal user"
+            "--dump-dav-xml"
+          ]
+        '';
+        description = ''
+          Extra command line arguments to pass to xandikos.
+        '';
+      };
+
+      nginx = mkOption {
+        default = {};
+        description = ''
+          Configuration for nginx reverse proxy.
+        '';
+
+        type = types.submodule {
+          options = {
+            enable = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Configure the nginx reverse proxy settings.
+              '';
+            };
+
+            hostName = mkOption {
+              type = types.str;
+              description = ''
+                The hostname use to setup the virtualhost configuration
+              '';
+            };
+          };
+        };
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.enable (
+    mkMerge [
+      {
+        meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+        systemd.services.xandikos = {
+          description = "A Simple Calendar and Contact Server";
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            User = "xandikos";
+            Group = "xandikos";
+            DynamicUser = "yes";
+            RuntimeDirectory = "xandikos";
+            StateDirectory = "xandikos";
+            StateDirectoryMode = "0700";
+            PrivateDevices = true;
+            # Sandboxing
+            CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
+            ProtectSystem = "strict";
+            ProtectHome = true;
+            PrivateTmp = true;
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectControlGroups = true;
+            RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_PACKET AF_NETLINK";
+            RestrictNamespaces = true;
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            ExecStart = ''
+              ${cfg.package}/bin/xandikos \
+                --directory /var/lib/xandikos \
+                --listen_address ${cfg.address} \
+                --port ${toString cfg.port} \
+                --route-prefix ${cfg.routePrefix} \
+                ${lib.concatStringsSep " " cfg.extraOptions}
+            '';
+          };
+        };
+      }
+
+      (
+        mkIf cfg.nginx.enable {
+          services.nginx = {
+            enable = true;
+            virtualHosts."${cfg.nginx.hostName}" = {
+              locations."/" = {
+                proxyPass = "http://${cfg.address}:${toString cfg.port}/";
+              };
+            };
+          };
+        }
+      )
+    ]
+  );
+}
--- a/nixos/modules/services/security/certmgr.nix
+++ b/nixos/modules/services/security/certmgr.nix
@ -113,7 +113,7 @@ in
        otherCert = "/var/certmgr/specs/other-cert.json";
      }
      '';
-      type = with types; attrsOf (either (submodule {
+      type = with types; attrsOf (either path (submodule {
        options = {
          service = mkOption {
            type = nullOr str;
@ -148,7 +148,7 @@ in
            description = "certmgr spec request object.";
          };
        };
-    }) path);
+    }));
      description = ''
        Certificate specs as described by:
        <link xlink:href="https://github.com/cloudflare/certmgr#certificate-specs" />
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -129,19 +129,23 @@ in
    # It's useful to have transmission in path, e.g. for remote control
    environment.systemPackages = [ pkgs.transmission ];

-    users.users = optionalAttrs (cfg.user == "transmission") (singleton
-      { name = "transmission";
+    users.users = optionalAttrs (cfg.user == "transmission") ({
+      transmission = {
+        name = "transmission";
        group = cfg.group;
        uid = config.ids.uids.transmission;
        description = "Transmission BitTorrent user";
        home = homeDir;
        createHome = true;
-      });
+      };
+    });

-    users.groups = optionalAttrs (cfg.group == "transmission") (singleton
-      { name = "transmission";
+    users.groups = optionalAttrs (cfg.group == "transmission") ({
+      transmission = {
+        name = "transmission";
        gid = config.ids.gids.transmission;
-      });
+      };
+    });

    # AppArmor profile
    security.apparmor.profiles = mkIf apparmor [
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -295,6 +295,7 @@ in
  wireguard-generated = handleTest ./wireguard/generated.nix {};
  wireguard-namespaces = handleTest ./wireguard/namespaces.nix {};
  wordpress = handleTest ./wordpress.nix {};
+  xandikos = handleTest ./xandikos.nix {};
  xautolock = handleTest ./xautolock.nix {};
  xfce = handleTest ./xfce.nix {};
  xmonad = handleTest ./xmonad.nix {};
--- a/nixos/tests/bittorrent.nix
+++ b/nixos/tests/bittorrent.nix
@ -18,6 +18,17 @@ let
  externalRouterAddress = "80.100.100.1";
  externalClient2Address = "80.100.100.2";
  externalTrackerAddress = "80.100.100.3";
+
+  transmissionConfig = { ... }: {
+    environment.systemPackages = [ pkgs.transmission ];
+    services.transmission = {
+      enable = true;
+      settings = {
+        dht-enabled = false;
+        message-level = 3;
+      };
+    };
+  };
 in

 {
@ -26,88 +37,79 @@ in
    maintainers = [ domenkozar eelco rob bobvanderlinden ];
  };

-  nodes =
-    { tracker =
-        { pkgs, ... }:
-        { environment.systemPackages = [ pkgs.transmission ];
+  nodes = {
+    tracker = { pkgs, ... }: {
+      imports = [ transmissionConfig ];

-          virtualisation.vlans = [ 1 ];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = externalTrackerAddress; prefixLength = 24; }
-          ];
+      virtualisation.vlans = [ 1 ];
+      networking.firewall.enable = false;
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = externalTrackerAddress; prefixLength = 24; }
+      ];

-          # We need Apache on the tracker to serve the torrents.
-          services.httpd.enable = true;
-          services.httpd.adminAddr = "foo@example.org";
-          services.httpd.documentRoot = "/tmp";
-
-          networking.firewall.enable = false;
-
-          services.opentracker.enable = true;
-
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.port-forwaring-enabled = false;
-        };
-
-      router =
-        { pkgs, nodes, ... }:
-        { virtualisation.vlans = [ 1 2 ];
-          networking.nat.enable = true;
-          networking.nat.internalInterfaces = [ "eth2" ];
-          networking.nat.externalInterface = "eth1";
-          networking.firewall.enable = true;
-          networking.firewall.trustedInterfaces = [ "eth2" ];
-          networking.interfaces.eth0.ipv4.addresses = [];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = externalRouterAddress; prefixLength = 24; }
-          ];
-          networking.interfaces.eth2.ipv4.addresses = [
-            { address = internalRouterAddress; prefixLength = 24; }
-          ];
-          services.miniupnpd = {
-            enable = true;
-            externalInterface = "eth1";
-            internalIPs = [ "eth2" ];
-            appendConfig = ''
-              ext_ip=${externalRouterAddress}
-            '';
+      # We need Apache on the tracker to serve the torrents.
+      services.httpd = {
+        enable = true;
+        virtualHosts = {
+          "torrentserver.org" = {
+            adminAddr = "foo@example.org";
+            documentRoot = "/tmp";
          };
        };
-
-      client1 =
-        { pkgs, nodes, ... }:
-        { environment.systemPackages = [ pkgs.transmission pkgs.miniupnpc ];
-          virtualisation.vlans = [ 2 ];
-          networking.interfaces.eth0.ipv4.addresses = [];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = internalClient1Address; prefixLength = 24; }
-          ];
-          networking.defaultGateway = internalRouterAddress;
-          networking.firewall.enable = false;
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.message-level = 3;
-        };
-
-      client2 =
-        { pkgs, ... }:
-        { environment.systemPackages = [ pkgs.transmission ];
-          virtualisation.vlans = [ 1 ];
-          networking.interfaces.eth0.ipv4.addresses = [];
-          networking.interfaces.eth1.ipv4.addresses = [
-            { address = externalClient2Address; prefixLength = 24; }
-          ];
-          networking.firewall.enable = false;
-          services.transmission.enable = true;
-          services.transmission.settings.dht-enabled = false;
-          services.transmission.settings.port-forwaring-enabled = false;
-        };
+      };
+      services.opentracker.enable = true;
    };

-  testScript =
-    { nodes, ... }:
-    ''
+    router = { pkgs, nodes, ... }: {
+      virtualisation.vlans = [ 1 2 ];
+      networking.nat.enable = true;
+      networking.nat.internalInterfaces = [ "eth2" ];
+      networking.nat.externalInterface = "eth1";
+      networking.firewall.enable = true;
+      networking.firewall.trustedInterfaces = [ "eth2" ];
+      networking.interfaces.eth0.ipv4.addresses = [];
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = externalRouterAddress; prefixLength = 24; }
+      ];
+      networking.interfaces.eth2.ipv4.addresses = [
+        { address = internalRouterAddress; prefixLength = 24; }
+      ];
+      services.miniupnpd = {
+        enable = true;
+        externalInterface = "eth1";
+        internalIPs = [ "eth2" ];
+        appendConfig = ''
+          ext_ip=${externalRouterAddress}
+        '';
+      };
+    };
+
+    client1 = { pkgs, nodes, ... }: {
+      imports = [ transmissionConfig ];
+      environment.systemPackages = [ pkgs.miniupnpc ];
+
+      virtualisation.vlans = [ 2 ];
+      networking.interfaces.eth0.ipv4.addresses = [];
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = internalClient1Address; prefixLength = 24; }
+      ];
+      networking.defaultGateway = internalRouterAddress;
+      networking.firewall.enable = false;
+    };
+
+    client2 = { pkgs, ... }: {
+      imports = [ transmissionConfig ];
+
+      virtualisation.vlans = [ 1 ];
+      networking.interfaces.eth0.ipv4.addresses = [];
+      networking.interfaces.eth1.ipv4.addresses = [
+        { address = externalClient2Address; prefixLength = 24; }
+      ];
+      networking.firewall.enable = false;
+    };
+  };
+
+  testScript = { nodes, ... }: ''
      start_all()

      # Wait for network and miniupnpd.
@ -159,5 +161,4 @@ in
          "cmp /tmp/test.tar.bz2 ${file}"
      )
    '';
-
 })
--- a/nixos/tests/xandikos.nix
+++ b/nixos/tests/xandikos.nix
@ -0,0 +1,70 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+    {
+      name = "xandikos";
+
+      meta.maintainers = [ lib.maintainers."0x4A6F" ];
+
+      nodes = {
+        xandikos_client = {};
+        xandikos_default = {
+          networking.firewall.allowedTCPPorts = [ 8080 ];
+          services.xandikos.enable = true;
+        };
+        xandikos_proxy = {
+          networking.firewall.allowedTCPPorts = [ 80 8080 ];
+          services.xandikos.enable = true;
+          services.xandikos.address = "localhost";
+          services.xandikos.port = 8080;
+          services.xandikos.routePrefix = "/xandikos/";
+          services.xandikos.extraOptions = [
+            "--defaults"
+          ];
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+            virtualHosts."xandikos" = {
+              serverName = "xandikos.local";
+              basicAuth.xandikos = "snakeOilPassword";
+              locations."/xandikos/" = {
+                proxyPass = "http://localhost:8080/";
+              };
+            };
+          };
+        };
+      };
+
+      testScript = ''
+        start_all()
+
+        with subtest("Xandikos default"):
+            xandikos_default.wait_for_unit("multi-user.target")
+            xandikos_default.wait_for_unit("xandikos.service")
+            xandikos_default.wait_for_open_port(8080)
+            xandikos_default.succeed("curl --fail http://localhost:8080/")
+            xandikos_default.succeed(
+                "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+            )
+            xandikos_client.wait_for_unit("network.target")
+            xandikos_client.fail("curl --fail http://xandikos_default:8080/")
+
+        with subtest("Xandikos proxy"):
+            xandikos_proxy.wait_for_unit("multi-user.target")
+            xandikos_proxy.wait_for_unit("xandikos.service")
+            xandikos_proxy.wait_for_open_port(8080)
+            xandikos_proxy.succeed("curl --fail http://localhost:8080/")
+            xandikos_proxy.succeed(
+                "curl -s --fail --location http://localhost:8080/ | grep -qi Xandikos"
+            )
+            xandikos_client.wait_for_unit("network.target")
+            xandikos_client.fail("curl --fail http://xandikos_proxy:8080/")
+            xandikos_client.succeed(
+                "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/ | grep -qi Xandikos"
+            )
+            xandikos_client.succeed(
+                "curl -s --fail -u xandikos:snakeOilPassword -H 'Host: xandikos.local' http://xandikos_proxy/xandikos/user/ | grep -qi Xandikos"
+            )
+      '';
+    }
+)
--- a/pkgs/applications/audio/pavucontrol/default.nix
+++ b/pkgs/applications/audio/pavucontrol/default.nix
@ -1,5 +1,5 @@
 { fetchurl, stdenv, pkgconfig, intltool, libpulseaudio, gtkmm3
-, libcanberra-gtk3, makeWrapper, gnome3 }:
+, libcanberra-gtk3, gnome3, wrapGAppsHook }:

 stdenv.mkDerivation rec {
  pname = "pavucontrol";
@ -10,16 +10,10 @@ stdenv.mkDerivation rec {
    sha256 = "1qhlkl3g8d7h72xjskii3g1l7la2cavwp69909pzmbi2jyn5pi4g";
  };

-  preFixup = ''
-    wrapProgram "$out/bin/pavucontrol" \
-     --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-     --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS"
-  '';
-
-  buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3 makeWrapper
+  buildInputs = [ libpulseaudio gtkmm3 libcanberra-gtk3
                  gnome3.adwaita-icon-theme ];

-  nativeBuildInputs = [ pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];

  configureFlags = [ "--disable-lynx" ];

--- a/pkgs/applications/audio/spotifyd/default.nix
+++ b/pkgs/applications/audio/spotifyd/default.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "spotifyd";
-  version = "0.2.20";
+  version = "0.2.23";

  src = fetchFromGitHub {
    owner = "Spotifyd";
    repo = "spotifyd";
    rev = "v${version}";
-    sha256 = "1hf4wpk7r0s4jpjhxaz67y1hd8jx9ns5imd85r3cdg4lxf3j5gph";
+    sha256 = "0xxr21avgr4pvlr5vgb68jmad5xy5kqvaxfzh0qn1jpiax7y3avm";
  };

-  cargoSha256 = "1h3fis47hmxvppiv1icjhgp48nd46gayfcmzfjs34q6jask90n0w";
+  cargoSha256 = "1ykmn7zzwn9my96bbxwkparab5lck1zzdkpafil2mmrjyvyi40da";

  cargoBuildFlags = [
    "--no-default-features"
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -3236,10 +3236,10 @@
      elpaBuild {
        pname = "undo-tree";
        ename = "undo-tree";
-        version = "0.7";
+        version = "0.7.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/undo-tree-0.7.el";
-          sha256 = "0mc5spiqx20z8vh8b24dp9hqj27h5bm5wqk0ga7c6s6mp69r72h4";
+          url = "https://elpa.gnu.org/packages/undo-tree-0.7.2.el";
+          sha256 = "0gdqh5rkgwlancbjx5whgl5gqkdipdkspkl2bqmrq70sgg5ahrcc";
        };
        packageRequires = [];
        meta = {
@ -3734,4 +3734,4 @@
          license = lib.licenses.free;
        };
      }) {};
-  }
+  }
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@ -111,6 +111,11 @@ env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPac

        flycheck-rtags = fix-rtags super.flycheck-rtags;

+        gnuplot = super.gnuplot.overrideAttrs (old: {
+          nativeBuildInputs =
+            (old.nativeBuildInputs or []) ++ [ pkgs.autoreconfHook ];
+        });
+
        pdf-tools = super.pdf-tools.overrideAttrs(old: {
          nativeBuildInputs = [ external.pkgconfig ];
          buildInputs = with external; old.buildInputs ++ [ autoconf automake libpng zlib poppler ];
--- a/pkgs/applications/editors/neovim/qt.nix
+++ b/pkgs/applications/editors/neovim/qt.nix
@ -4,13 +4,13 @@
 let
  unwrapped = mkDerivation rec {
    pname = "neovim-qt-unwrapped";
-    version = "0.2.12";
+    version = "0.2.15";

    src = fetchFromGitHub {
      owner  = "equalsraf";
      repo   = "neovim-qt";
      rev    = "v${version}";
-      sha256 = "09s3044j0y8nmyi8ykslfii6fx7k9mckmdvb0jn2xmdabpb60i20";
+      sha256 = "097nykglqp4jyvla4yp32sc1f1hph4cqqhp6rm9ww7br8c0j54xl";
    };

    cmakeFlags = [
--- a/pkgs/applications/graphics/openimageio/default.nix
+++ b/pkgs/applications/graphics/openimageio/default.nix
@ -39,6 +39,5 @@ stdenv.mkDerivation rec {
    license = licenses.bsd3;
    maintainers = [ maintainers.goibhniu ];
    platforms = platforms.unix;
-    badPlatforms = [ "x86_64-darwin" ];
  };
 }
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -30,7 +30,7 @@ mkDerivation rec {
  # libraries.  These reside in build/lib, and are not found by
  # default.
  preBuild = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib:$PWD/VTK/ThirdParty/vtkm/vtk-m/lib
  '';

  enableParallelBuilding = true;
--- a/pkgs/applications/graphics/pencil/default.nix
+++ b/pkgs/applications/graphics/pencil/default.nix
@ -1,32 +1,72 @@
-{ stdenv, fetchurl, lib, makeWrapper,
+{ stdenv, fetchurl, lib, makeWrapper, wrapGAppsHook,
  # build dependencies
-  alsaLib, atk, cairo, cups, dbus, expat, fontconfig,
-  freetype, gdk-pixbuf, glib, gnome2, nspr, nss, xorg,
-  glibc, systemd
+  alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig,
+  freetype, gdk-pixbuf, glib, glibc, gtk3, libuuid, nspr, nss, pango,
+  xorg, systemd
 }:
+let

-stdenv.mkDerivation rec {
-  version = "3.0.4";
+  deps = [
+    alsaLib
+    atk
+    at-spi2-atk
+    at-spi2-core
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    glibc
+    gtk3
+    libuuid
+    nspr
+    nss
+    pango
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXScrnSaver
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXtst
+    stdenv.cc.cc.lib
+    stdenv.cc.cc
+  ];
+
+in stdenv.mkDerivation rec {
+  version = "3.1.0";
  pname = "pencil";

  src = fetchurl {
-    url    = "http://pencil.evolus.vn/dl/V${version}/Pencil_${version}_amd64.deb";
-    sha256 = "58e2b794c615ea8715d8374f177e19c87f7071e359826ec34a59836d537a62fd";
+    url    = "http://pencil.evolus.vn/dl/V${version}.ga/pencil_${version}.ga_amd64.deb";
+    sha256 = "01ae54b1a1351b909eb2366c6ec00816e1deba370e58f35601cf7368f10aaba3";
  };

  sourceRoot = ".";

  unpackCmd = ''
-    ar p "$src" data.tar.xz | tar xJ
+    ar p "$src" data.tar.gz | tar xz
  '';

  dontBuild = true;

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+
+  buildInputs = deps;

  installPhase = ''
-    mkdir -p $out/bin
-    cp -R usr/share opt $out/
+    mkdir -p $out/bin $out/opt $out/share/applications
+    cp -R usr/share $out/
+    cp -R opt/pencil*/ $out/opt/pencil
+    cp $out/opt/pencil/pencil.desktop $out/share/applications/

    # fix the path in the desktop file
    substituteInPlace \
@ -34,42 +74,12 @@ stdenv.mkDerivation rec {
      --replace /opt/ $out/opt/

    # symlink the binary to bin/
-    ln -s $out/opt/Pencil/pencil $out/bin/pencil
+    ln -s $out/opt/pencil/pencil $out/bin/pencil
  '';


  preFixup = let
-    packages = [
-      alsaLib
-      atk
-      cairo
-      cups
-      dbus
-      expat
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      gnome2.GConf
-      gnome2.gtk
-      gnome2.pango
-      nspr
-      nss
-      xorg.libX11
-      xorg.libXScrnSaver
-      xorg.libXcomposite
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libXrender
-      xorg.libXtst
-      stdenv.cc.cc.lib
-      stdenv.cc.cc
-      glibc
-    ];
+    packages = deps;
    libPathNative = lib.makeLibraryPath packages;
    libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
    libPath = "${libPathNative}:${libPath64}";
@ -77,21 +87,13 @@ stdenv.mkDerivation rec {
    # patch executable
    patchelf \
      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}:$out/opt/Pencil" \
-      $out/opt/Pencil/pencil
-
-    # patch libnode
-    patchelf \
-      --set-rpath "${libPath}" \
-      $out/opt/Pencil/libnode.so
-
-    # libffmpeg is for some reason  not executable
-    chmod a+x $out/opt/Pencil/libffmpeg.so
+      --set-rpath "${libPath}:$out/opt/pencil" \
+      $out/opt/pencil/pencil

    # fix missing libudev
-    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/Pencil/libudev.so.1
-    wrapProgram $out/opt/Pencil/pencil \
-      --prefix LD_LIBRARY_PATH : $out/opt/Pencil
+    ln -s ${systemd.lib}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
+    wrapProgram $out/opt/pencil/pencil \
+      --prefix LD_LIBRARY_PATH : $out/opt/pencil
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/graphics/rx/default.nix
+++ b/pkgs/applications/graphics/rx/default.nix
@ -7,13 +7,13 @@ with stdenv.lib;

 rustPlatform.buildRustPackage rec {
  pname = "rx";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "cloudhead";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1byaxbhd3q49473kcdd52rvn3xq7bmy8bdx3pz0jiw96bclzhcgq";
+    sha256 = "1n5s7v2z13550gkqz7w6dw62jdy60wdi8w1lfa23609b4yhg4w94";
  };

  cargoSha256 = "173jfjvdag97f6jvfg366hjk9v3cz301cbzpcahy51rbf1cip1w1";
--- a/pkgs/applications/misc/audio/soxr/default.nix
+++ b/pkgs/applications/misc/audio/soxr/default.nix
@ -11,9 +11,9 @@ stdenv.mkDerivation rec {
  outputs = [ "out" "doc" ]; # headers are just two and very small

  preConfigure = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH:"`pwd`/build/src
+    export DYLD_LIBRARY_PATH="$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}"`pwd`/build/src
  '' else ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:"`pwd`/build/src
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}"`pwd`/build/src
  '';

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/blender/darwin.patch
+++ b/pkgs/applications/misc/blender/darwin.patch
@ -0,0 +1,105 @@
+diff a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake/platform/platform_apple.cmake
+--- a/build_files/cmake/platform/platform_apple.cmake
+++ b/build_files/cmake/platform/platform_apple.cmake
+@@ -35,7 +35,6 @@ else()
+   message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+ endif()
+ if(NOT EXISTS "${LIBDIR}/")
+-  message(FATAL_ERROR "Mac OSX requires pre-compiled libs at: '${LIBDIR}'")
+ endif()
+ 
+ if(WITH_OPENAL)
+@@ -79,7 +78,7 @@ endif()
+ if(WITH_CODEC_SNDFILE)
+   set(LIBSNDFILE ${LIBDIR}/sndfile)
+   set(LIBSNDFILE_INCLUDE_DIRS ${LIBSNDFILE}/include)
+-  set(LIBSNDFILE_LIBRARIES sndfile FLAC ogg vorbis vorbisenc)
+  set(LIBSNDFILE_LIBRARIES sndfile)
+   set(LIBSNDFILE_LIBPATH ${LIBSNDFILE}/lib ${LIBDIR}/ffmpeg/lib)  # TODO, deprecate
+ endif()
+ 
+@@ -90,7 +89,7 @@ if(WITH_PYTHON)
+     # normally cached but not since we include them with blender
+     set(PYTHON_INCLUDE_DIR "${LIBDIR}/python/include/python${PYTHON_VERSION}m")
+     set(PYTHON_EXECUTABLE "${LIBDIR}/python/bin/python${PYTHON_VERSION}m")
+-    set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.a)
+    set(PYTHON_LIBRARY "${LIBDIR}/python/lib/libpython${PYTHON_VERSION}m.dylib")
+     set(PYTHON_LIBPATH "${LIBDIR}/python/lib/python${PYTHON_VERSION}")
+     # set(PYTHON_LINKFLAGS "-u _PyMac_Error")  # won't  build with this enabled
+   else()
+@@ -155,10 +154,7 @@ if(WITH_CODEC_FFMPEG)
+   set(FFMPEG_INCLUDE_DIRS ${FFMPEG}/include)
+   set(FFMPEG_LIBRARIES
+     avcodec avdevice avformat avutil
+-    mp3lame swscale x264 xvidcore
+-    theora theoradec theoraenc
+-    vorbis vorbisenc vorbisfile ogg opus
+-    vpx swresample)
+    swscale swresample)
+   set(FFMPEG_LIBPATH ${FFMPEG}/lib)
+ endif()
+ 
+@@ -199,14 +195,14 @@ if(WITH_OPENCOLLADA)
+   set(OPENCOLLADA ${LIBDIR}/opencollada)
+ 
+   set(OPENCOLLADA_INCLUDE_DIRS
+-    ${LIBDIR}/opencollada/include/COLLADAStreamWriter
+-    ${LIBDIR}/opencollada/include/COLLADABaseUtils
+-    ${LIBDIR}/opencollada/include/COLLADAFramework
+-    ${LIBDIR}/opencollada/include/COLLADASaxFrameworkLoader
+-    ${LIBDIR}/opencollada/include/GeneratedSaxParser
+    ${LIBDIR}/opencollada/include/opencollada/COLLADAStreamWriter
+    ${LIBDIR}/opencollada/include/opencollada/COLLADABaseUtils
+    ${LIBDIR}/opencollada/include/opencollada/COLLADAFramework
+    ${LIBDIR}/opencollada/include/opencollada/COLLADASaxFrameworkLoader
+    ${LIBDIR}/opencollada/include/opencollada/GeneratedSaxParser
+   )
+ 
+-  set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib)
+  set(OPENCOLLADA_LIBPATH ${OPENCOLLADA}/lib/opencollada)
+   set(OPENCOLLADA_LIBRARIES
+     OpenCOLLADASaxFrameworkLoader
+     -lOpenCOLLADAFramework
+@@ -215,7 +211,7 @@ if(WITH_OPENCOLLADA)
+     -lMathMLSolver
+     -lGeneratedSaxParser
+     -lbuffer -lftoa -lUTF
+-    ${OPENCOLLADA_LIBPATH}/libxml2.a
+    xml2
+   )
+   # PCRE is bundled with openCollada
+   # set(PCRE ${LIBDIR}/pcre)
+@@ -276,14 +272,13 @@ if(WITH_BOOST)
+ endif()
+ 
+ if(WITH_INTERNATIONAL OR WITH_CODEC_FFMPEG)
+-  set(PLATFORM_LINKFLAGS "${PLATFORM_LINKFLAGS} -liconv") # boost_locale and ffmpeg needs it !
+ endif()
+ 
+ if(WITH_OPENIMAGEIO)
+   set(OPENIMAGEIO ${LIBDIR}/openimageio)
+   set(OPENIMAGEIO_INCLUDE_DIRS ${OPENIMAGEIO}/include)
+   set(OPENIMAGEIO_LIBRARIES
+-    ${OPENIMAGEIO}/lib/libOpenImageIO.a
+    ${OPENIMAGEIO}/lib/libOpenImageIO.dylib
+     ${PNG_LIBRARIES}
+     ${JPEG_LIBRARIES}
+     ${TIFF_LIBRARY}
+@@ -306,7 +301,7 @@ endif()
+ if(WITH_OPENCOLORIO)
+   set(OPENCOLORIO ${LIBDIR}/opencolorio)
+   set(OPENCOLORIO_INCLUDE_DIRS ${OPENCOLORIO}/include)
+-  set(OPENCOLORIO_LIBRARIES OpenColorIO tinyxml yaml-cpp)
+  set(OPENCOLORIO_LIBRARIES OpenColorIO)
+   set(OPENCOLORIO_LIBPATH ${OPENCOLORIO}/lib)
+ endif()
+ 
+@@ -443,7 +438,7 @@ else()
+   set(CMAKE_CXX_FLAGS_RELEASE "-mdynamic-no-pic -fno-strict-aliasing")
+ endif()
+ 
+-if(${XCODE_VERSION} VERSION_EQUAL 5 OR ${XCODE_VERSION} VERSION_GREATER 5)
+if(FALSE)
+   # Xcode 5 is always using CLANG, which has too low template depth of 128 for libmv
+   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -ftemplate-depth=1024")
+ endif()
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -1,13 +1,14 @@
 { config, stdenv, lib, fetchurl, boost, cmake, ffmpeg, gettext, glew
 , ilmbase, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
-, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio, openjpeg_1, python3Packages
+, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimageio2, openjpeg, python3Packages
 , openvdb, libXxf86vm, tbb
 , zlib, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
 , jackaudioSupport ? false, libjack2
 , cudaSupport ? config.cudaSupport or false, cudatoolkit
 , colladaSupport ? true, opencollada
 , enableNumpy ? false, makeWrapper
+, pugixml, SDL, Cocoa, CoreGraphics, ForceFeedback, OpenAL, OpenGL
 }:

 with lib;
@ -23,22 +24,53 @@ stdenv.mkDerivation rec {
    sha256 = "1zl0ar95qkxsrbqw9miz2hrjijlqjl06vg3clfk9rm7krr2l3b2j";
  };

+  patches = lib.optional stdenv.isDarwin ./darwin.patch;
+
  nativeBuildInputs = [ cmake ] ++ optional cudaSupport addOpenGLRunpath;
  buildInputs =
    [ boost ffmpeg gettext glew ilmbase
-      libXi libX11 libXext libXrender
-      freetype libjpeg libpng libsamplerate libsndfile libtiff libGLU libGL openal
-      opencolorio openexr openimageio openjpeg_1 python zlib fftw jemalloc
+      freetype libjpeg libpng libsamplerate libsndfile libtiff
+      opencolorio openexr openimageio2 openjpeg python zlib fftw jemalloc
      (opensubdiv.override { inherit cudaSupport; })
-      openvdb libXxf86vm tbb
+      tbb
      makeWrapper
    ]
+    ++ (if (!stdenv.isDarwin) then [
+      libXi libX11 libXext libXrender
+      libGLU libGL openal
+      libXxf86vm
+      # OpenVDB currently doesn't build on darwin
+      openvdb
+    ]
+    else [
+      pugixml SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
+    ])
    ++ optional jackaudioSupport libjack2
    ++ optional cudaSupport cudatoolkit
    ++ optional colladaSupport opencollada;

  postPatch =
-    ''
+    if stdenv.isDarwin then ''
+      : > build_files/cmake/platform/platform_apple_xcode.cmake
+      substituteInPlace source/creator/CMakeLists.txt \
+        --replace '${"$"}{LIBDIR}/python' \
+                  '${python}'
+      substituteInPlace build_files/cmake/platform/platform_apple.cmake \
+        --replace '${"$"}{LIBDIR}/python' \
+                  '${python}' \
+        --replace '${"$"}{LIBDIR}/opencollada' \
+                  '${opencollada}' \
+        --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
+                  '${python3Packages.numpy}/${python.sitePackages}/numpy' \
+        --replace 'set(OPENJPEG_INCLUDE_DIRS ' \
+                  'set(OPENJPEG_INCLUDE_DIRS "'$(echo ${openjpeg.dev}/include/openjpeg-*)'") #' \
+        --replace 'set(OPENJPEG_LIBRARIES ' \
+                  'set(OPENJPEG_LIBRARIES "${openjpeg}/lib/libopenjp2.dylib") #' \
+        --replace 'set(OPENIMAGEIO ' \
+                  'set(OPENIMAGEIO "${openimageio2.out}") #' \
+        --replace 'set(OPENEXR_INCLUDE_DIRS ' \
+                  'set(OPENEXR_INCLUDE_DIRS "${openexr.dev}/include/OpenEXR") #'
+    '' else ''
      substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
    '';

@ -48,7 +80,7 @@ stdenv.mkDerivation rec {
      "-DWITH_CODEC_SNDFILE=ON"
      "-DWITH_INSTALL_PORTABLE=OFF"
      "-DWITH_FFTW3=ON"
-      #"-DWITH_SDL=ON"
+      "-DWITH_SDL=OFF"
      "-DWITH_OPENCOLORIO=ON"
      "-DWITH_OPENSUBDIV=ON"
      "-DPYTHON_LIBRARY=${python.libPrefix}m"
@ -61,10 +93,18 @@ stdenv.mkDerivation rec {
      "-DWITH_OPENVDB=ON"
      "-DWITH_TBB=ON"
      "-DWITH_IMAGE_OPENJPEG=ON"
+      "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
    ]
+    ++ optionals stdenv.isDarwin [
+      "-DWITH_CYCLES_OSL=OFF" # requires LLVM
+      "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
+
+      "-DLIBDIR=/does-not-exist"
+    ]
+    # Clang doesn't support "-export-dynamic"
+    ++ optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS="
    ++ optional jackaudioSupport "-DWITH_JACK=ON"
-    ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON"
-    ++ optional colladaSupport "-DWITH_OPENCOLLADA=ON";
+    ++ optional cudaSupport "-DWITH_CYCLES_CUDA_BINARIES=ON";

  NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR -I${python}/include/${python.libPrefix}";

@ -95,7 +135,7 @@ stdenv.mkDerivation rec {
    # They comment two licenses: GPLv2 and Blender License, but they
    # say: "We've decided to cancel the BL offering for an indefinite period."
    license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
    maintainers = [ maintainers.goibhniu ];
  };
 }
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3, fetchpatch,
+{ stdenv, fetchFromGitHub, meson, ninja, gettext, python3,
  pkgconfig, libxml2, json-glib , sqlite, itstool, librsvg, yelp-tools,
  vala, gtk3, gnome3, desktop-file-utils, wrapGAppsHook, gobject-introspection
 }:

 stdenv.mkDerivation rec {
  pname = "font-manager";
-  version = "0.7.5";
+  version = "0.7.7";

  src = fetchFromGitHub {
    owner = "FontManager";
    repo = "master";
    rev = version;
-    sha256 = "16hma8rrkam6ngn5vbdaryn31vdixvii6920g9z928gylz9xkd3g";
+    sha256 = "1bzqvspplp1zj0n0869jqbc60wgbjhf0vdrn5bj8dfawxynh8s5f";
  };

  nativeBuildInputs = [
@ -38,19 +38,6 @@ stdenv.mkDerivation rec {
    gnome3.adwaita-icon-theme
  ];

-  mesonFlags = [
-    "-Ddisable_pycompile=true"
-  ];
-
-  patches = [
-    # fix build with Vala 0.46
-    (fetchpatch {
-      url = "https://github.com/FontManager/font-manager/commit/c73b40de11f376f4515a0edfe97fb3721a264b35.patch";
-      sha256 = "0lacwsifgvda2r3z6j2a0svdqr6mgav7zkvih35xa8155y8wfpnw";
-      excludes = [ "fedora/font-manager.spec" ];
-    })
-  ];
-
  postPatch = ''
    chmod +x meson_post_install.py
    patchShebangs meson_post_install.py
--- a/pkgs/applications/misc/mako/default.nix
+++ b/pkgs/applications/misc/mako/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "mako";
-  version = "1.4";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "emersion";
    repo = pname;
    rev = "v${version}";
-    sha256 = "11ymiq6cr2ma0iva1mqybn3j6k73bsc6lv6pcbdq7hkhd4f9b7j9";
+    sha256 = "0hwvibpnrximb628w9dsfjpi30b5jy7nfkm4d94z5vhp78p43vxh";
  };

  nativeBuildInputs = [ meson ninja pkgconfig scdoc wayland-protocols ];
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    description = "A lightweight Wayland notification daemon";
    homepage = https://wayland.emersion.fr/mako/;
    license = licenses.mit;
-    maintainers = with maintainers; [ dywedir ];
+    maintainers = with maintainers; [ dywedir synthetica ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/osmctools/default.nix
+++ b/pkgs/applications/misc/osmctools/default.nix
@ -1,46 +1,27 @@
-{ stdenv, fetchurl, zlib } :
+{ stdenv, fetchFromGitLab, autoreconfHook, zlib }:

-let
-
-  convert_src = fetchurl {
-    url = http://m.m.i24.cc/osmconvert.c;
-    sha256 = "1mvmb171c1jqxrm80jc7qicwk4kgg7yq694n7ci65g6i284r984x";
-    # version = 0.8.5
-  };
-
-  filter_src = fetchurl {
-    url = http://m.m.i24.cc/osmfilter.c;
-    sha256 = "0vm3bls9jb2cb5b11dn82sxnc22qzkf4ghmnkivycigrwa74i6xl";
-    # version = 1.4.0
-  };
-
-in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "osmctools";
-  version = "0.8.5plus1.4.0";
+  version = "0.9";

+  src = fetchFromGitLab {
+    owner = "osm-c-tools";
+    repo = pname;
+    rev = version;
+    sha256 = "1m8d3r1q1v05pkr8k9czrmb4xjszw6hvgsf3kn9pf0v14gpn4r8f";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
  buildInputs = [ zlib ];

-  phases = [ "buildPhase" "installPhase" ];
-
-  buildPhase = ''
-    cc ${convert_src} -lz -O3 -o osmconvert
-    cc ${filter_src} -O3 -o osmfilter
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv osmconvert $out/bin
-    mv osmfilter $out/bin
-  '';
-
  meta = with stdenv.lib; {
    description = "Command line tools for transforming Open Street Map files";
    homepage = [
-      https://wiki.openstreetmap.org/wiki/Osmconvert
-      https://wiki.openstreetmap.org/wiki/Osmfilter
+      https://wiki.openstreetmap.org/wiki/osmconvert
+      https://wiki.openstreetmap.org/wiki/osmfilter
+      https://wiki.openstreetmap.org/wiki/osmupdate
    ];
+    maintainers = with maintainers; [ sikmir ];
    platforms = platforms.unix;
    license = licenses.agpl3;
  };
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja
+{ stdenv, fetchFromGitHub, meson, pkgconfig, ninja, wrapGAppsHook
 , wayland, wlroots, gtkmm3, libinput, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
 , traySupport  ? true,  libdbusmenu-gtk3
 , pulseSupport ? false, libpulseaudio
@ -19,7 +19,7 @@
    };

    nativeBuildInputs = [
-      meson ninja pkgconfig scdoc
+      meson ninja pkgconfig scdoc wrapGAppsHook
    ];

    buildInputs = with stdenv.lib;
--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@ -2,7 +2,7 @@

 let
  pname = "Sylk";
-  version = "2.1.0";
+  version = "2.5.0";
 in

 appimageTools.wrapType2 rec {
@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {

  src = fetchurl {
    url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    sha256 = "1ifi8qr6f84dcssxhv5ar1s48nsqxiv2j1blc82248hmq5is24mf";
+    sha256 = "1jhs25zzdac3r2wz886vlpb0bz77p52mdlrbsbv28h6is79pbd69";
  };

  profile = ''
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@ -45,11 +45,11 @@ let

  flash = stdenv.mkDerivation rec {
    pname = "flashplayer-ppapi";
-    version = "32.0.0.303";
+    version = "32.0.0.314";

    src = fetchzip {
      url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "0b2cw8y9rif2p0lyy2ir1v5lchxlsh543b9c743a2p85c9p7q62b";
+      sha256 = "05xcscpzglpfpiiqc3ngs5snxli99irjk18g5vdhw91jk9808gnl";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "flashplayer";
-  version = "32.0.0.303";
+  version = "32.0.0.314";

  src = fetchurl {
    url =
@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
    sha256 =
      if debug then
        if arch == "x86_64" then
-          "05hfc5ywmcvp6zf8aqmzjp3qy3byp0zdl0ssrv9gvzcskdqkhsj2"
+          "076l93wjcy15sic88cyq6msp87gdhcvbk4ym2vbvvjz2bav2z456"
        else
-          "12hl8lvxz648ha70gi3v85mwf0nnayjiaslr669vjan3ww94jymv"
+          "0kxr8d6fh00akqgk3lwv0z6rk7xswislicsbh9b9p33f19mj7c8a"
      else
        if arch == "x86_64" then
-          "0x0mabgswly2v8z13832pkbjsv404aq61pback6sgmp2lyycdg6w"
+          "0a3hvp0qmqlann8k875ajf0i70cv0an1a3mr8kbgji46dxqvwjxz"
        else
-          "16kbpf1i3aqlrfbfh5ncg1n46ncl9hp6qdp36s5j3ivbc68pj81z";
+          "0jyywas2z7ssgzng82qgnp01gy6nccqavkbx9529m07xrclvqbxn";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@ -50,7 +50,7 @@

 stdenv.mkDerivation {
  pname = "flashplayer-standalone";
-  version = "32.0.0.303";
+  version = "32.0.0.314";

  src = fetchurl {
    url =
@ -60,9 +60,9 @@ stdenv.mkDerivation {
        "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
    sha256 =
      if debug then
-        "0xkzlv90lpyy54j6pllknrp1l9vjyh6dsl63l4c8cgh4i830gi14"
+        "0zlin94rip13rn58m7v5l6m20ylnw59l77rbg5j5qyxkr53zawdz"
      else
-        "0mi3ggv6zhzmdd1h68cgl87n6izhp0pbkhnidd2gl2cp95f23c2d";
+        "0pfrm02iwa01pqx3adqj0sw27p1ddlz9knjky6x248ak8zywsqr2";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/networking/cawbird/default.nix
+++ b/pkgs/applications/networking/cawbird/default.nix
@ -20,14 +20,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.0.3.1";
+  version = "1.0.4";
  pname = "cawbird";

  src = fetchFromGitHub {
    owner = "IBBoard";
    repo = "cawbird";
    rev = "v${version}";
-    sha256 = "sha256:1v1y4bx0mm518b9vlpsry12fw1qz2j28jfhjqq73blvzd89lgb0y";
+    sha256 = "sha256:1gqi7bn08b9cjpb0mgs6bk1a2npdfhn56ckps95nck0jyqzfbnir";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@ -1,13 +1,13 @@
 { stdenv, lib, fetchFromGitHub, go, removeReferencesTo, buildGoPackage }:
 buildGoPackage rec {
  pname = "cni-plugins";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = "plugins";
    rev = "v${version}";
-    sha256 = "0dc4fs08x4x518yhgvq3drjvansnc0cb8rm4h5wiw7k3whjii3cd";
+    sha256 = "02kz6y3klhbriybsskn4hmldwli28cycnp2klsm2x0y9c73iczdp";
  };

  goDeps = ./plugins-deps.nix;
--- a/pkgs/applications/networking/cluster/docker-machine/xhyve-deps.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/xhyve-deps.nix
@ -1,21 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/docker/machine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/docker/machine";
-      rev = "5b274558ea6ca822c06dd407a4e774a0105c3f60";
-      sha256 = "1wdq9h4bx7awgclh969gvmcnl9jvgv7ldfklnclh5iv47mi7q22d";
-    };
-  }
-  {
-    goPackagePath = "github.com/zchee/libhyperkit";
-    fetch = {
-      type = "git";
-      url = "https://github.com/zchee/libhyperkit";
-      rev = "1a19a7693fac32b46ec6cdd22da6fbec974447fc";
-      sha256 = "119f5gcl24znwnmi837jk667asd3lirx32jldpd4mbyb3sm9nz24";
-    };
-  }
-]
--- a/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
@ -1,24 +1,36 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, pkgconfig, Hypervisor, vmnet }:
+{ stdenv, buildGoPackage, fetchFromGitHub, fetchpatch, pkgconfig, cctools, Hypervisor, vmnet }:

 buildGoPackage rec {
  pname = "docker-machine-xhyve";
-  version = "0.3.3";
+  version = "0.4.0";

  goPackagePath = "github.com/zchee/docker-machine-driver-xhyve";
-  goDeps = ./xhyve-deps.nix;
+
+  # https://github.com/machine-drivers/docker-machine-driver-xhyve/pull/225
+  patches = fetchpatch {
+    url = "https://github.com/machine-drivers/docker-machine-driver-xhyve/commit/546256494bf2ccc33e4125bf45f504b0e3027d5a.patch";
+    sha256 = "1i8wxqccqkxvqrbsyd0g9s0kdskd8xi2jv0c1bji9aj4rq0a8cgz";
+  };
+
+  preBuild = ''
+    make -C go/src/${goPackagePath} CC=${stdenv.cc}/bin/cc LIBTOOL=${cctools}/bin/libtool GIT_CMD=: lib9p
+    export CGO_CFLAGS=-I$(pwd)/go/src/${goPackagePath}/vendor/github.com/jceel/lib9p
+    export CGO_LDFLAGS=$(pwd)/go/src/${goPackagePath}/vendor/build/lib9p/lib9p.a
+  '';
+  buildFlags = "--tags lib9p";

  src = fetchFromGitHub {
    rev    = "v${version}";
-    owner  = "zchee";
+    owner  = "machine-drivers";
    repo   = "docker-machine-driver-xhyve";
-    sha256 = "0rj6pyqp4yv4j28bglqjs95rip5i77vv8mrkmqv1rxrsl3i8aqqy";
+    sha256 = "0000v97fr8xc5b39v44hsa87wrbk4bcwyaaivxv4hxlf4vlgg863";
  };

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ Hypervisor vmnet ];

  meta = with stdenv.lib; {
-    homepage = https://github.com/zchee/docker-machine-driver-xhyve;
+    homepage = https://github.com/machine-drivers/docker-machine-driver-xhyve;
    description = "Xhyve driver for docker-machine.";
    license = licenses.bsd3;
    maintainers = with maintainers; [ periklis ];
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {

  preConfigure = ''
    # autotools check tries to dlopen libpython as a requirement for the python plugin
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${python}/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${python}/lib
  '';

  postPatch = ''
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -27,11 +27,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "mutt";
-  version = "1.13.2";
+  version = "1.13.3";

  src = fetchurl {
    url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0x4yfvk8415p80h9an242n6q3b43mw6mnnczh95zd3j0zwdr6wrg";
+    sha256 = "0y3ks10mc7m8c7pd4c4j8pj7n5rqcvzrjs8mzldv7z7jnlb30hkq";
  };

  patches = optional smimeSupport (fetchpatch {
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
  #   80 - test-gnc-module-scm-module (Failed)
  #   81 - test-gnc-module-scm-multi (Failed)
  preCheck = ''
-    export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test:$LD_LIBRARY_PATH
+    export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
    export NIX_CFLAGS_LINK="-lgtest -lgtest_main"
  '';
  doCheck = false;
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@ -8,7 +8,7 @@

 let

-  version = "0.7.1";
+  version = "0.7.2";
  modulesVersion = with lib; versions.major version + "." + versions.minor version;
  modulesPath = "lib/SoapySDR/modules" + modulesVersion;
  extraPackagesSearchPath = lib.makeSearchPath modulesPath extraPackages;
@ -21,7 +21,7 @@ in stdenv.mkDerivation {
    owner = "pothosware";
    repo = "SoapySDR";
    rev = "soapy-sdr-${version}";
-    sha256 = "1rbnd3w12kzsh94fiywyn4vch7h0kf75m88fi6nq992b3vnmiwvl";
+    sha256 = "102wnpjxrwba20pzdh1vvx0yg1h8vqd8z914idxflg9p14r6v5am";
  };

  nativeBuildInputs = [ cmake makeWrapper pkgconfig ];
--- a/pkgs/applications/science/math/nota/default.nix
+++ b/pkgs/applications/science/math/nota/default.nix
@ -0,0 +1,40 @@
+{ mkDerivation, haskellPackages, fetchurl, lib }:
+
+mkDerivation rec {
+  pname = "nota";
+  version = "1.0";
+
+  # Can't use fetchFromGitLab since codes.kary.us doesn't support https
+  src = fetchurl {
+    url = "http://codes.kary.us/nota/nota/-/archive/V${version}/nota-V${version}.tar.bz2";
+    sha256 = "0bbs6bm9p852hvqadmqs428ir7m65h2prwyma238iirv42pk04v8";
+  };
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/source
+  '';
+
+  isLibrary = false;
+  isExecutable = true;
+
+  libraryHaskellDepends = with haskellPackages; [
+    base
+    bytestring
+    array
+    split
+    scientific
+    parsec
+    ansi-terminal
+    regex-compat
+    containers
+    terminal-size
+    numbers
+    text
+    time
+  ];
+
+  description = "The most beautiful command line calculator";
+  homepage = "https://kary.us/nota";
+  license = lib.licenses.mpl20;
+  maintainers = with lib.maintainers; [ dtzWill ];
+}
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@ -177,7 +177,7 @@ writeTextFile rec {
    export SAGE_EXTCODE='${sagelib.src}/src/ext'

  # for find_library
-    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}:$DYLD_LIBRARY_PATH"
+    export DYLD_LIBRARY_PATH="${lib.makeLibraryPath [stdenv.cc.libc singular]}''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
  '';
 } // {
  lib = sagelib; # equivalent of `passthru`, which `writeTextFile` doesn't support
--- a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
@ -13,7 +13,7 @@ stdenv.mkDerivation {

  buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];
  patchPhase = ''
-    sed -i "s|local daemon=.*|local daemon=$out/bin/gitstatusd|" gitstatus.plugin.zsh
+    sed -i "1i GITSTATUS_DAEMON=$out/bin/gitstatusd" gitstatus.plugin.zsh
  '';
  installPhase = ''
    install -Dm755 gitstatusd $out/bin/gitstatusd
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,11 +1,11 @@
 {
-  "version": "12.6.2",
-  "repo_hash": "0bchamvr3f0ph49f7xa76gsp2mjj1ajy4q0wy1hjvr9bayxx94av",
+  "version": "12.6.4",
+  "repo_hash": "0jsww785bxvjdrp1wsz6zkvx9zr69j24bway6nfyjkz8a7vbl9ls",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v12.6.2-ee",
+  "rev": "v12.6.4-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "a4b6c71d4b7c1588587345e2dfe0c6bd7cc63a83",
+    "GITALY_SERVER_VERSION": "1.77.1",
    "GITLAB_PAGES_VERSION": "1.12.0",
    "GITLAB_SHELL_VERSION": "10.3.0",
    "GITLAB_WORKHORSE_VERSION": "8.18.0"
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -17,14 +17,14 @@ let
      };
  };
 in buildGoPackage rec {
-  version = "a4b6c71d4b7c1588587345e2dfe0c6bd7cc63a83";
+  version = "1.77.1";
  pname = "gitaly";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
-    rev = version;
-    sha256 = "1pxmhq1nrc8q2kk83bz5afx14hshqgzqm6j4vgmyjvbmdvgl80wv";
+    rev = "v${version}";
+    sha256 = "08xc9lxlvga36yq1wdvb1h4zk70c36qspyd7azhkw84kzwfrif1c";
  };

  # Fix a check which assumes that hook files are writeable by their
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -327,7 +327,7 @@ group :metrics do
  gem 'influxdb', '~> 0.2', require: false

  # Prometheus
-  gem 'prometheus-client-mmap', '~> 0.9.10'
+  gem 'prometheus-client-mmap', '~> 0.10.0'
  gem 'raindrops', '~> 0.18'
 end

--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -531,8 +531,8 @@ GEM
      regexp_parser (~> 1.1)
      regexp_property_values (~> 0.3)
    json (1.8.6)
-    json-jwt (1.9.4)
-      activesupport
+    json-jwt (1.11.0)
+      activesupport (>= 4.2)
      aes_key_wrap
      bindata
    json-schema (2.8.0)
@ -746,7 +746,7 @@ GEM
      parser
      unparser
    procto (0.0.3)
-    prometheus-client-mmap (0.9.10)
+    prometheus-client-mmap (0.10.0)
    pry (0.11.3)
      coderay (~> 1.1.0)
      method_source (~> 0.9.0)
@ -1283,7 +1283,7 @@ DEPENDENCIES
  peek (~> 1.1)
  pg (~> 1.1)
  premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 0.9.10)
+  prometheus-client-mmap (~> 0.10.0)
  pry-byebug (~> 3.5.1)
  pry-rails (~> 0.3.4)
  rack (~> 2.0.7)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -2326,10 +2326,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "065k7vffdki73f4nz89lxi6wxmcw5dlf593831pgvlbralll6x3r";
+      sha256 = "18rf9v20i0dk5dblr7m22di959xpch2h7gsx0cl585cryr7apwp3";
      type = "gem";
    };
-    version = "1.9.4";
+    version = "1.11.0";
  };
  json-schema = {
    dependencies = ["addressable"];
@ -3365,10 +3365,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0immyg4as0isyj2dcjf44n0avg1jv5kx1qk0asrgb5ayzwmjqg1k";
+      sha256 = "00d2c79xhz5k3fcclarjr1ffxbrvc6236f4rrvriad9kwqr7c1mp";
      type = "gem";
    };
-    version = "0.9.10";
+    version = "0.10.0";
  };
  pry = {
    dependencies = ["coderay" "method_source"];
--- a/pkgs/applications/video/avidemux/default.nix
+++ b/pkgs/applications/video/avidemux/default.nix
@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
    cd "$sourceRoot"
    patchPhase

-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${libXext}/lib"
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${libXext}/lib"
    ${stdenv.shell} bootStrap.bash \
      --with-core \
      ${if withQT then "--with-qt" else "--without-qt"} \
--- a/pkgs/applications/window-managers/sway/lock-fancy.nix
+++ b/pkgs/applications/window-managers/sway/lock-fancy.nix
@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {

  src = fetchFromGitHub {
    owner = "Big-B";
-    repo = pname;
+    repo = "swaylock-fancy";
    rev = "35618ceec70338047355b6b057825e68f16971b5";
    sha256 = "06fjqwblmj0d9pq6y11rr73mizirna4ixy6xkvblf1c7sn5n8lpc";
  };
--- a/pkgs/build-support/build-fhs-userenv/env.nix
+++ b/pkgs/build-support/build-fhs-userenv/env.nix
@ -52,7 +52,7 @@ let
  etcProfile = writeText "profile" ''
    export PS1='${name}-chrootenv:\u@\h:\w\$ '
    export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
-    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib:/usr/lib:/usr/lib32''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
    export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
    export TZDIR='/etc/zoneinfo'

--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@ -100,9 +100,9 @@ stdenv.mkDerivation (args // {
  '' + stdenv.lib.optionalString verifyCargoDeps ''
    if ! diff source/Cargo.lock $cargoDeps/Cargo.lock ; then
      echo
-      echo "ERROR: cargoSha256 is out of date."
+      echo "ERROR: cargoSha256 is out of date"
      echo
-      echo "Cargo.lock is not the same in $cargoDeps."
+      echo "Cargo.lock is not the same in $cargoDeps"
      echo
      echo "To fix the issue:"
      echo '1. Use "1111111111111111111111111111111111111111111111111111" as the cargoSha256 value'
--- a/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
+++ b/pkgs/build-support/setup-hooks/make-symlinks-relative.sh
@ -0,0 +1,28 @@
+fixupOutputHooks+=(_makeSymlinksRelative)
+
+# For every symlink in $output that refers to another file in $output
+# ensure that the symlink is relative. This removes references to the output
+# has from the resulting store paths and thus the NAR files.
+_makeSymlinksRelative() {
+    local symlinkTarget
+
+    if [ -n "${dontRewriteSymlinks-}" ]; then
+        return 0
+    fi
+
+    while IFS= read -r -d $'\0' f; do
+        symlinkTarget=$(readlink "$f")
+        if [[ "$symlinkTarget"/ != "$prefix"/* ]]; then
+            # skip this symlink as it doesn't point to $prefix
+            continue
+        fi
+
+        if [ ! -e "$symlinkTarget" ]; then
+            echo "the symlink $f is broken, it points to $symlinkTarget (which is missing)"
+        fi
+
+        echo "rewriting symlink $f to be relative to $prefix"
+        ln -snrf "$symlinkTarget" "$f"
+
+    done < <(find $prefix -type l -print0)
+}
--- a/pkgs/data/fonts/victor-mono/default.nix
+++ b/pkgs/data/fonts/victor-mono/default.nix
@ -2,7 +2,7 @@

 let
  pname = "victor-mono";
-  version = "1.3.0";
+  version = "1.3.1";
 in fetchFromGitHub rec {
  name = "${pname}-${version}";

@ -26,7 +26,7 @@ in fetchFromGitHub rec {
    unzip -j VictorMonoAll.zip \*.otf -d $out/share/fonts/opentype/${pname}
  '';

-  sha256 = "1lv2x7kfspabnhvm8z79n165fw3awvzj1r8f0g5zn26wgdalgw69";
+  sha256 = "1yj91rhs9pd705406r4lqabdfzjclbz837nzm6z1rziy6mbpd61s";

  meta = with lib; {
    description = "Free programming font with cursive italics and ligatures";
--- a/pkgs/desktops/deepin/dde-file-manager/default.nix
+++ b/pkgs/desktops/deepin/dde-file-manager/default.nix
@ -228,8 +228,8 @@ mkDerivation rec {
  ];

  preBuild = ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${zlib}/lib";
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${libX11}/lib";
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${zlib}/lib";
+    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${libX11}/lib";
  '';

  dontWrapQtApps = true;
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@ -123,7 +123,7 @@ stdenv.mkDerivation rec {

  preConfigure = ''
    # allow ecore_con to find libcurl.so, which is a runtime dependency (it is dlopened)
-    export LD_LIBRARY_PATH="${curl.out}/lib:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="${curl.out}/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"

    source "$setupHook"
  '';
--- a/pkgs/desktops/gnome-3/apps/seahorse/default.nix
+++ b/pkgs/desktops/gnome-3/apps/seahorse/default.nix
@ -26,11 +26,11 @@

 stdenv.mkDerivation rec {
  pname = "seahorse";
-  version = "3.34";
+  version = "3.34.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "16sfnqrdlr5xx6kixx2ln1mva7nngjlw1k3f5n454vyaigffjh2v";
+    sha256 = "19c2zylwgycb5q9hal8rmflc2sywc5c2grpsfsq3rf37i9lfwynw";
  };

  doCheck = true;
--- a/pkgs/development/compilers/bs-platform/build-bs-platform.nix
+++ b/pkgs/development/compilers/bs-platform/build-bs-platform.nix
@ -1,35 +1,33 @@
-{ stdenv, fetchFromGitHub, ninja, nodejs, python3 }:
-let
-  version = "6.2.1";
-  ocaml-version = "4.06.1";
-  src = fetchFromGitHub {
-    owner = "BuckleScript";
-    repo = "bucklescript";
-    rev = "${version}";
-    sha256 = "0zx9nq7cik0c60n3rndqfqy3vdbj5lcrx6zcqcz2d60jjxi1z32y";
-    fetchSubmodules = true;
-  };
-  ocaml =  import ./ocaml.nix {
-    bs-version = version;
+# This file is based on https://github.com/turboMaCk/bs-platform.nix/blob/master/build-bs-platform.nix
+# to make potential future updates simpler
+
+{ stdenv, fetchFromGitHub, ninja, runCommand, nodejs, python3,
+  ocaml-version, version, src,
+  ocaml ? (import ./ocaml.nix {
    version = ocaml-version;
    inherit stdenv;
    src = "${src}/ocaml";
-  };
-in
+  }),
+  custom-ninja ? (ninja.overrideAttrs (attrs: {
+    src = runCommand "ninja-patched-source" {} ''
+      mkdir -p $out
+      tar zxvf ${src}/vendor/ninja.tar.gz -C $out
+    '';
+    patches = [];
+  }))
+}:
 stdenv.mkDerivation {
  inherit src version;
  pname = "bs-platform";
  BS_RELEASE_BUILD = "true";
-  buildInputs = [ nodejs python3 ];
+  buildInputs = [ nodejs python3 custom-ninja ];

  patchPhase = ''
    sed -i 's:./configure.py --bootstrap:python3 ./configure.py --bootstrap:' ./scripts/install.js
-
    mkdir -p ./native/${ocaml-version}/bin
-    ln -sf ${ocaml}/bin/* ./native/${ocaml-version}/bin
-
+    ln -sf ${ocaml}/bin/*  ./native/${ocaml-version}/bin
    rm -f vendor/ninja/snapshot/ninja.linux
-    cp ${ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
+    cp ${custom-ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
  '';

  configurePhase = ''
@ -42,12 +40,9 @@ stdenv.mkDerivation {

  installPhase = ''
    node scripts/install.js
-
    mkdir -p $out/bin
-
    cp -rf jscomp lib vendor odoc_gen native $out
    cp bsconfig.json package.json $out
-
    ln -s $out/lib/bsb $out/bin/bsb
    ln -s $out/lib/bsc $out/bin/bsc
    ln -s $out/lib/bsrefmt $out/bin/bsrefmt
--- a/pkgs/development/compilers/bs-platform/default.nix
+++ b/pkgs/development/compilers/bs-platform/default.nix
@ -1,15 +1,28 @@
-{ stdenv, fetchFromGitHub, ninja, nodejs, python3, ... }:
+{ stdenv, runCommand, fetchFromGitHub, ninja, nodejs, python3, ... }:
 let
+  build-bs-platform = import ./build-bs-platform.nix;
+in
+(build-bs-platform {
+  inherit stdenv runCommand fetchFromGitHub ninja nodejs python3;
+  version = "7.0.1";
+  ocaml-version = "4.06.1";
+
+  src = fetchFromGitHub {
+    owner = "BuckleScript";
+    repo = "bucklescript";
+    rev = "52770839e293ade2bcf187f2639000ca0a9a1d46";
+    sha256 = "0s7g2zfhshsilv9zyp0246bypg34d294z27alpwz03ws9608yr7k";
+    fetchSubmodules = true;
+  };
+}).overrideAttrs (attrs: {
  meta = with stdenv.lib; {
    description = "A JavaScript backend for OCaml focused on smooth integration and clean generated code.";
    homepage = https://bucklescript.github.io;
    license = licenses.lgpl3;
-    maintainers = with maintainers; [ turbomack gamb ];
+    maintainers = with maintainers; [ turbomack gamb anmonteiro ];
    platforms = platforms.all;
+    # Currently there is an issue with aarch build in hydra
+    # https://github.com/BuckleScript/bucklescript/issues/4091
+    badPlatforms = platforms.aarch64;
  };
-in
-{
-  bs-platform-621 = import ./bs-platform-62.nix {
-    inherit stdenv fetchFromGitHub ninja nodejs python3;
-  } // { inherit meta; };
-}
+})
--- a/pkgs/development/compilers/bs-platform/ocaml.nix
+++ b/pkgs/development/compilers/bs-platform/ocaml.nix
@ -1,7 +1,7 @@
-{ stdenv, src, version, bs-version }:
+{ stdenv, src, version }:
 stdenv.mkDerivation rec {
  inherit src version;
-  name = "ocaml-${version}+bs-${bs-version}";
+  name = "ocaml-${version}+bs";
  configurePhase = ''
    ./configure -prefix $out
  '';
--- a/pkgs/development/compilers/ghc/8.10.1.nix
+++ b/pkgs/development/compilers/ghc/8.10.1.nix
@ -86,12 +86,12 @@ let

 in
 stdenv.mkDerivation (rec {
-  version = "8.10.0.20191210";
+  version = "8.10.0.20200108";
  name = "${targetPrefix}ghc-${version}";

  src = fetchurl {
-    url = "https://downloads.haskell.org/ghc/8.10.1-alpha2/ghc-${version}-src.tar.xz";
-    sha256 = "1mmv8s9cs41kp7wh1qqnzin5wv32cvs3lmzgda7njz0ssqb0mmvj";
+    url = "https://downloads.haskell.org/ghc/8.10.1-rc1/ghc-${version}-src.tar.xz";
+    sha256 = "1xm6cb3s2x3rycnyvkh12mp65xi3zbwrk5ima8sg7c245f3dl0ay";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/compilers/graalvm/001_mx.py.patch
+++ b/pkgs/development/compilers/graalvm/001_mx.py.patch
@ -1,57 +1,31 @@
 diff --git a/mx.py b/mx.py
-index af7a9c2..08c0ea8 100755
+index a0b9315..b7d67a0 100755
 --- a/mx.py
 +++ b/mx.py
-@@ -4976,30 +4976,6 @@ class PackedResourceLibrary(ResourceLibrary):
+@@ -238,21 +238,7 @@ def _check_file_with_sha1(path, sha1, sha1path, mustExist=True, newFile=False, l
+             f.write(value or sha1OfFile(path))
 
-     def get_path(self, resolve):
-         extract_path = _make_absolute(self.extract_path, self.suite.dir)
-        download_path = super(PackedResourceLibrary, self).get_path(resolve)
-        if resolve and self._check_extract_needed(extract_path, download_path):
-            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
-            try:
-                # extract archive
-                Extractor.create(download_path).extract(extract_path_tmp)
-                # ensure modification time is up to date
-                os.utime(extract_path_tmp, None)
-                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
-                try:
-                    # attempt atomic overwrite
-                    os.rename(extract_path_tmp, extract_path)
-                except OSError:
-                    # clean destination & re-try for cases where atomic overwrite doesn't work
-                    rmtree(extract_path, ignore_errors=True)
-                    os.rename(extract_path_tmp, extract_path)
-            except OSError as ose:
-                # Rename failed. Race with other process?
-                if self._check_extract_needed(extract_path, download_path):
-                    # ok something really went wrong
-                    abort("Extracting {} failed!".format(download_path), context=ose)
-            finally:
-                rmtree(extract_path_tmp, ignore_errors=True)
+     if exists(path):
+-        if sha1Check and sha1:
+-            if not _sha1CachedValid() or (newFile and sha1 != _sha1Cached()):
+-                logv('Create/update SHA1 cache file ' + sha1path)
+-                _writeSha1Cached()
 -
-         return extract_path
- 
-     def _check_download_needed(self):
-@@ -5900,7 +5876,7 @@ class HgConfig(VC):
- 
-     def update_to_branch(self, vcdir, branch, abortOnError=True):
-         cmd = ['update', branch]
-        self.hg_command(vcdir, cmd, abortOnError=abortOnError)
-+        self.run(['hg', vcdir] + cmd)
- 
-     def add(self, vcdir, path, abortOnError=True):
-         return self.run(['hg', '-q', '-R', vcdir, 'add', path]) == 0
-@@ -5937,7 +5913,7 @@ class HgConfig(VC):
-                 return None
- 
-     def parent_info(self, vcdir, abortOnError=True):
-        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
-+        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
-         author, date = out.split("|||")
-         ts, _ = date.split(" ")
-         return self._sanitize_parent_info({
-@@ -8301,46 +8277,8 @@ class SuiteImport:
+-            if sha1 != _sha1Cached():
+-                computedSha1 = sha1OfFile(path)
+-                if sha1 == computedSha1:
+-                    warn('Fixing corrupt SHA1 cache file ' + sha1path)
+-                    _writeSha1Cached(computedSha1)
+-                    return True
+-                if logErrors:
+-                    size = os.path.getsize(path)
+-                    log_error('SHA1 of {} [size: {}] ({}) does not match expected value ({})'.format(TimeStampFile(path), size, computedSha1, sha1))
+-                return False
+        return True
+     elif mustExist:
+         if logErrors:
+             log_error("'{}' does not exist".format(path))
+@@ -1057,46 +1043,8 @@ class SuiteImport:
         version = import_dict.get("version")
         suite_dir = None
         version_from = import_dict.get("versionFrom")
@ -100,7 +74,7 @@ index af7a9c2..08c0ea8 100755
 
     @staticmethod
     def get_source_urls(source, kind=None):
-@@ -8381,8 +8319,6 @@ class Suite(object):
+@@ -1467,8 +1415,6 @@ class Suite(object):
     :type dists: list[Distribution]
     """
     def __init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=False):
@ -109,7 +83,7 @@ index af7a9c2..08c0ea8 100755
         self.imported_by = [] if primary else [importing_suite]
         self.mxDir = mxDir
         self.dir = dirname(mxDir)
-@@ -8410,7 +8346,7 @@ class Suite(object):
+@@ -1496,7 +1442,7 @@ class Suite(object):
         self._outputRoot = None
         self._preloaded_suite_dict = None
         self.vc = vc
@ -118,7 +92,7 @@ index af7a9c2..08c0ea8 100755
         self._preload_suite_dict()
         self._init_imports()
         if load:
-@@ -9310,7 +9246,9 @@ def get_dynamic_imports():
+@@ -2405,7 +2351,9 @@ class Repository(SuiteConstituent):
 class SourceSuite(Suite):
     """A source suite"""
     def __init__(self, mxDir, primary=False, load=True, internal=False, importing_suite=None, dynamicallyImported=False):
@ -129,7 +103,7 @@ index af7a9c2..08c0ea8 100755
         Suite.__init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=dynamicallyImported)
         logvv("SourceSuite.__init__({}), got vc={}, vc_dir={}".format(mxDir, self.vc, self.vc_dir))
         self.projects = []
-@@ -9359,17 +9297,7 @@ class SourceSuite(Suite):
+@@ -2454,17 +2402,7 @@ class SourceSuite(Suite):
         """
         Gets the release tag from VC or create a time based once if VC is unavailable
         """
@ -148,73 +122,7 @@ index af7a9c2..08c0ea8 100755
 
     def scm_metadata(self, abortOnError=False):
         scm = self.scm
-@@ -12541,55 +12469,8 @@ def _attempt_download(url, path, jarEntryName=None):
-     return False
- 
- def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
-    """
-    Attempts to downloads content for each URL in a list, stopping after the first successful download.
-    If the content cannot be retrieved from any URL, the program is aborted, unless abortOnError=False.
-    The downloaded content is written to the file indicated by `path`.
-    """
-    if not verifyOnly:
-        ensure_dirname_exists(path)
-        assert not path.endswith(os.sep)
-
-    # https://docs.oracle.com/javase/7/docs/api/java/net/JarURLConnection.html
-    jarURLPattern = re.compile('jar:(.*)!/(.*)')
-    verify_errors = {}
-    for url in urls:
-        if not verifyOnly or verbose:
-            log('Downloading ' + url + ' to ' + path)
-        m = jarURLPattern.match(url)
-        jarEntryName = None
-        if m:
-            url = m.group(1)
-            jarEntryName = m.group(2)
-
-        if verifyOnly:
-            try:
-                conn = _urlopen(url, timeout=10)
-                conn.close()
-                return True
-            except (IOError, socket.timeout) as e:
-                _suggest_tlsv1_error(e)
-                verify_errors[url] = e
-            continue
-
-        for i in range(4):
-            if i != 0:
-                time.sleep(1)
-                warn('Retry {} to download from {}'.format(i, url))
-            res = _attempt_download(url, path, jarEntryName)
-            if res is True:
-                return True
-            if res is False:
-                break
-
-    if abortOnError:
-        msg = 'Could not download to ' + path + ' from any of the following URLs: ' + ', '.join(urls)
-        if verifyOnly:
-            for url, e in verify_errors.items():
-                msg += '\n  ' + url + ': ' + str(e)
-        abort(msg)
-    else:
-        return False
-+    print("FAKE download(path={} urls={} verbose={} abortOnError={} verifyOnly={})".format(path, urls, verbose, abortOnError, verifyOnly))
-+    return True
- 
- def update_file(path, content, showDiff=False):
-     """
-@@ -13393,6 +13274,7 @@ class Archiver(SafeFileCreation):
- 
-     def _add_zip(self, filename, archive_name, provenance):
-         self._add_provenance(archive_name, provenance)
-+        os.utime(filename, (315532800, 315532800))
-         self.zf.write(filename, archive_name)
- 
-     def _add_str_zip(self, data, archive_name, provenance):
-@@ -18541,12 +18423,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
+@@ -2993,12 +2931,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
         Attempts to locate an existing suite in the local context
         Returns the path to the mx.name dir if found else None
         """
@ -255,3 +163,129 @@ index af7a9c2..08c0ea8 100755
 
     def _get_import_dir(url, mode):
         """Return directory where the suite will be cloned to"""
+@@ -3816,7 +3777,7 @@ def getmtime(name):
+     """
+     Wrapper for builtin open function that handles long path names on Windows.
+     """
+-    return os.path.getmtime(_safe_path(name))
+    return 315532800
+ 
+ 
+ def stat(name):
+@@ -4062,57 +4023,8 @@ def _attempt_download(url, path, jarEntryName=None):
+     return False
+ 
+ def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
+-    """
+-    Attempts to downloads content for each URL in a list, stopping after the first successful download.
+-    If the content cannot be retrieved from any URL, the program is aborted, unless abortOnError=False.
+-    The downloaded content is written to the file indicated by `path`.
+-    """
+-    if not verifyOnly:
+-        ensure_dirname_exists(path)
+-        assert not path.endswith(os.sep)
+-
+-    # https://docs.oracle.com/javase/7/docs/api/java/net/JarURLConnection.html
+-    jarURLPattern = re.compile('jar:(.*)!/(.*)')
+-    verify_errors = {}
+-    for url in urls:
+-        if not verifyOnly or verbose:
+-            log('Downloading ' + url + ' to ' + path)
+-        m = jarURLPattern.match(url)
+-        jarEntryName = None
+-        if m:
+-            url = m.group(1)
+-            jarEntryName = m.group(2)
+-
+-        if not _opts.trust_http and (url.lower().startswith('http://') or url.lower().startswith('ftp://')):
+-            warn('Downloading from non-https URL {}. Use --trust-http mx option to suppress this warning.'.format(url))
+-
+-        if verifyOnly:
+-            try:
+-                conn = _urlopen(url, timeout=10)
+-                conn.close()
+-            except (IOError, socket.timeout) as e:
+-                _suggest_tlsv1_error(e)
+-                verify_errors[url] = e
+-        else:
+-            for i in range(4):
+-                if i != 0:
+-                    time.sleep(1)
+-                    warn('Retry {} to download from {}'.format(i, url))
+-                if _attempt_download(url, path, jarEntryName):
+-                    return True # Download was successful
+-
+-    if verifyOnly and len(verify_errors) < len(urls): # verify-mode at least one success -> success
+-        return True
+-    else: # Either verification error or no download was successful
+-        msg = 'Could not download to ' + path + ' from any of the following URLs: ' + ', '.join(urls)
+-        if verifyOnly: # verify-mode -> print error details
+-            for url, e in verify_errors.items():
+-                msg += '\n  ' + url + ': ' + str(e)
+-        if abortOnError:
+-            abort(msg)
+-        else:
+-            warn(msg)
+-            return False
+    print("FAKE download(path={} urls={} verbose={} abortOnError={} verifyOnly={})".format(path, urls, verbose, abortOnError, verifyOnly))
+    return True
+ 
+ def update_file(path, content, showDiff=False):
+     """
+@@ -7887,30 +7799,6 @@ class PackedResourceLibrary(ResourceLibrary):
+ 
+     def get_path(self, resolve):
+         extract_path = _make_absolute(self.extract_path, self.suite.dir)
+-        download_path = super(PackedResourceLibrary, self).get_path(resolve)
+-        if resolve and self._check_extract_needed(extract_path, download_path):
+-            extract_path_tmp = tempfile.mkdtemp(suffix=basename(extract_path), dir=dirname(extract_path))
+-            try:
+-                # extract archive
+-                Extractor.create(download_path).extract(extract_path_tmp)
+-                # ensure modification time is up to date
+-                os.utime(extract_path_tmp, None)
+-                logv("Moving temporary directory {} to {}".format(extract_path_tmp, extract_path))
+-                try:
+-                    # attempt atomic overwrite
+-                    os.rename(extract_path_tmp, extract_path)
+-                except OSError:
+-                    # clean destination & re-try for cases where atomic overwrite doesn't work
+-                    rmtree(extract_path, ignore_errors=True)
+-                    os.rename(extract_path_tmp, extract_path)
+-            except OSError as ose:
+-                # Rename failed. Race with other process?
+-                if self._check_extract_needed(extract_path, download_path):
+-                    # ok something really went wrong
+-                    abort("Extracting {} failed!".format(download_path), context=ose)
+-            finally:
+-                rmtree(extract_path_tmp, ignore_errors=True)
+-
+         return extract_path
+ 
+     def _check_download_needed(self):
+@@ -8430,7 +8318,7 @@ class VC(_with_metaclass(ABCMeta, object)):
+         :param str branch: a branch name
+         :param bool abortOnError: if True abort on error
+         """
+-        abort(self.kind + " update_to_branch is not implemented")
+        self.run(['hg', vcdir] + cmd)
+ 
+     def is_release_from_tags(self, vcdir, prefix):
+         """
+@@ -8831,7 +8719,7 @@ class HgConfig(VC):
+                 return None
+ 
+     def parent_info(self, vcdir, abortOnError=True):
+-        out = self.hg_command(vcdir, ["log", "-r", ".", "--template", "{author}|||{date|hgdate}"], abortOnError=abortOnError)
+        out = _check_output_str(["hg", '-R', vcdir, "log", "-r", ".", "--template", "{author}|||{date|hgdate}"])
+         author, date = out.split("|||")
+         ts, _ = date.split(" ")
+         return self._sanitize_parent_info({
+@@ -14069,6 +13957,7 @@ class Archiver(SafeFileCreation):
+ 
+     def _add_zip(self, filename, archive_name, provenance):
+         self._add_provenance(archive_name, provenance)
+        os.utime(filename, (315532800, 315532800))
+         self.zf.write(filename, archive_name)
+ 
+     def _add_str_zip(self, data, archive_name, provenance):
--- a/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch
+++ b/pkgs/development/compilers/graalvm/005_tool_jt.rb.patch
@ -0,0 +1,46 @@
+diff --git a/tool/jt.rb b/tool/jt.rb
+index 870d88edcb..0a6e4c367b 100755
+--- a/tool/jt.rb
+++ b/tool/jt.rb
+@@ -152,13 +152,16 @@ module Utilities
+   end
+ 
+   def find_mx
+-    if which('mx')
+-      'mx'
+    if ENV.key?("MX_GIT_CACHE_DIR")
+      "mx-internal"
+     else
+-      mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
+-      "#{mx_repo}/mx"
+      if which('mx')
+        'mx'
+      else
+        mx_repo = find_or_clone_repo("https://github.com/graalvm/mx.git")
+        "#{mx_repo}/mx"
+      end
+     end
+-  end
+ 
+   def find_launcher(use_native)
+     if use_native
+@@ -444,8 +447,8 @@ module Commands
+           --no-sforceimports                         do not run sforceimports before building
+           parser                                     build the parser
+           options                                    build the options
+-          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby, 
+-                                                     available by default in mxbuild/truffleruby-jvm, 
+          graalvm                                    build a minimal JVM-only GraalVM containing only TruffleRuby,
+                                                     available by default in mxbuild/truffleruby-jvm,
+                                                      the Ruby is symlinked into rbenv or chruby if available
+               --graal      include the GraalVM Compiler in the build
+               --native     build native ruby image as well, available in mxbuild/truffleruby-native
+@@ -491,7 +494,7 @@ module Commands
+       jt test compiler                               run compiler tests
+       jt test integration [TESTS]                    run integration tests
+       jt test bundle [--jdebug]                      tests using bundler
+-      jt test gems [TESTS]                           tests using gems 
+      jt test gems [TESTS]                           tests using gems
+       jt test ecosystem [TESTS]                      tests using the wider ecosystem such as bundler, Rails, etc
+       jt test cexts [--no-openssl] [--no-gems] [test_names...]
+                                                      run C extension tests (set GEM_HOME)
--- a/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch
+++ b/pkgs/development/compilers/graalvm/006_mx_copylib.py.patch
@ -0,0 +1,14 @@
+diff --git a/mx.fastr/mx_copylib.py b/mx.fastr/mx_copylib.py
+index 4f57e1954..db45220d9 100644
+--- a/mx.fastr/mx_copylib.py
+++ b/mx.fastr/mx_copylib.py
+@@ -54,6 +54,9 @@ def _copylib(lib, libpath, plain_libpath_base, target):
+     else:
+         try:
+             if platform.system() == 'Linux':
+                # https://github.com/oracle/fastr/issues/110
+                if libpath.endswith("libgcc_s.so"):
+                    libpath = libpath + ".1"
+                 output = subprocess.check_output(['objdump', '-p', libpath])
+             elif platform.system() == 'SunOS':
+                 output = subprocess.check_output(['elfdump', '-d', libpath])
--- a/pkgs/development/compilers/graalvm/007_unimplemented.c.patch
+++ b/pkgs/development/compilers/graalvm/007_unimplemented.c.patch
@ -0,0 +1,85 @@
+diff --git a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+index dcf081316..c2cb4879b 100644
+--- a/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+++ b/com.oracle.truffle.r.native/fficall/src/common/unimplemented.c
+@@ -20,8 +20,10 @@
+ 
+ #include <Rinternals.h>
+ #include <stdlib.h>
+#include <rlocale.h>
+ 
+ #include <R_ext/eventloop.h>
+#include <R_ext/GraphicsEngine.h>
+ #include <Defn.h>
+ 
+ Rboolean known_to_be_latin1 = FALSE;
+@@ -166,3 +168,69 @@ int Scollate(SEXP a, SEXP b) {
+ void z_prec_r(Rcomplex *r, Rcomplex *x, double digits) {
+     unimplemented("z_prec_r");
+ }
+
+int Rf_AdobeSymbol2ucs2(int n) {
+  unimplemented("Rf_AdobeSymbol2ucs2");
+  return 0;
+}
+
+size_t Mbrtowc(wchar_t *wc, const char *s, size_t n, mbstate_t *ps) {
+  unimplemented("Mbrtowc");
+  return 0;
+}
+
+double R_GE_VStrHeight(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
+  unimplemented("R_GE_VStrHeight");
+  return 0;
+}
+
+void R_GE_VText(double x, double y, const char * const s, cetype_t enc,
+		double x_justify, double y_justify, double rotation,
+		const pGEcontext gc, pGEDevDesc dd) {
+  unimplemented("R_GE_VText");
+}
+
+double R_GE_VStrWidth(const char *s, cetype_t enc, const pGEcontext gc, pGEDevDesc dd) {
+  unimplemented("R_GE_VStrWidth");
+}
+
+void setulb(int n, int m, double *x, double *l, double *u, int *nbd,
+	    double *f, double *g, double factr, double *pgtol,
+	    double *wa, int * iwa, char *task, int iprint, int *isave) {
+  unimplemented("setulb");
+}
+
+void genptry(int n, double *p, double *ptry, double scale, void *ex) {
+  unimplemented("genptry");
+}
+
+double EXP(double x) {
+  unimplemented("EXP");
+  return 0;
+}
+
+double LOG(double x) {
+  unimplemented("LOG");
+  return 0;
+}
+
+Rwchar_t Rf_utf8toucs32(wchar_t high, const char *s) {
+  unimplemented("Rf_utf8toucs32");
+  return 0;
+}
+
+size_t mbtoucs(unsigned int *wc, const char *s, size_t n) {
+  unimplemented("mbtoucs");
+  return (size_t) 0;
+}
+
+
+int DispatchOrEval(SEXP call, SEXP op, const char *generic, SEXP args,
+		   SEXP rho, SEXP *ans, int dropmissing, int argsevald) {
+  unimplemented("DispatchOrEval");
+  return 0;
+}
+
+void ENSURE_NAMEDMAX (SEXP x) {
+  unimplemented("ENSURE_NAMEDMAX");
+}
--- a/pkgs/development/compilers/graalvm/008_remove_jfr.patch
+++ b/pkgs/development/compilers/graalvm/008_remove_jfr.patch
@ -0,0 +1,33 @@
+diff --git a/mx.jvmci/suite.py b/mx.jvmci/suite.py
+index 9690c0a38f..fa1d36b7e1 100644
+--- a/mx.jvmci/suite.py
+++ b/mx.jvmci/suite.py
+@@ -241,18 +241,7 @@ suite = {
+       "workingSets" : "JVMCI,HotSpot,SPARC",
+     },
+ 
+-    "jdk.vm.ci.hotspot.jfr" : {
+-      "subDir" : "jvmci",
+-      "sourceDirs" : ["src"],
+-      "dependencies" : [
+-        "jdk.vm.ci.hotspot",
+-        "JFR",
+-      ],
+-      "checkstyle" : "jdk.vm.ci.hotspot",
+-      "javaCompliance" : "1.8",
+-      "profile" : "",
+-      "workingSets" : "JVMCI,HotSpot",
+-    },
+
+ 
+     "hotspot" : {
+       "native" : True,
+@@ -354,7 +343,7 @@ suite = {
+         "jdk.vm.ci.hotspot.aarch64",
+         "jdk.vm.ci.hotspot.amd64",
+         "jdk.vm.ci.hotspot.sparc",
+-        "jdk.vm.ci.hotspot.jfr",
+
+       ],
+       "distDependencies" : [
+         "JVMCI_SERVICES",
--- a/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch
+++ b/pkgs/development/compilers/graalvm/009_remove_signedness_verifier.patch
@ -0,0 +1,21 @@
+diff --git a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+index 23a76357fd2..f13694b6ed7 100644
+--- a/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+++ b/substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/query/SizeAndSignednessVerifier.java
+@@ -249,15 +249,6 @@ public final class SizeAndSignednessVerifier extends NativeInfoTreeVisitor {
+     }
+ 
+     private void checkSignedness(boolean isUnsigned, ResolvedJavaType type, ResolvedJavaMethod method) {
+-        if (isSigned(type)) {
+-            if (isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is signed, but accessed C value is unsigned", method);
+-            }
+-        } else if (nativeLibs.isWordBase(type)) {
+-            /* every Word type other than Signed is assumed to be unsigned. */
+-            if (!isUnsigned) {
+-                addError("Type " + type.toJavaName(false) + " is unsigned, but accessed C value is signed", method);
+-            }
+-        }
+
+     }
+ }
--- a/pkgs/development/compilers/graalvm/010_mx_substratevm.py
+++ b/pkgs/development/compilers/graalvm/010_mx_substratevm.py
@ -0,0 +1,13 @@
+diff --git a/substratevm/mx.substratevm/mx_substratevm.py b/substratevm/mx.substratevm/mx_substratevm.py
+index b89163ef983..0fd0138b336 100644
+--- a/substratevm/mx.substratevm/mx_substratevm.py
+++ b/substratevm/mx.substratevm/mx_substratevm.py
+@@ -189,7 +189,7 @@ if str(svm_java_compliance().value) not in GRAAL_COMPILER_FLAGS_MAP:
+     mx.abort("Substrate VM does not support this Java version: " + str(svm_java_compliance()))
+ GRAAL_COMPILER_FLAGS = GRAAL_COMPILER_FLAGS_BASE + GRAAL_COMPILER_FLAGS_MAP[str(svm_java_compliance().value)]
+ 
+-IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases']
+IMAGE_ASSERTION_FLAGS = ['-H:+VerifyGraalGraphs', '-H:+VerifyPhases', '-H:+ReportExceptionStackTraces']
+ suite = mx.suite('substratevm')
+ svmSuites = [suite]
+ clibraryDists = ['SVM_HOSTED_NATIVE']
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@ -1,10 +1,11 @@
 { stdenv, lib, fetchFromGitHub, fetchurl, fetchzip, fetchgit, mercurial_4, python27, setJavaClassPath,
-  zlib, makeWrapper, openjdk, unzip, git, clang, llvm, which, icu, ruby, bzip2, glibc
-  # gfortran, readline, bzip2, lzma, pcre, curl, ed, tree ## WIP: fastr deps
+  which, zlib, makeWrapper, openjdk, unzip, git, clang, llvm, icu, ruby, glibc, bash, gcc, libobjc,
+  xcodebuild, gfortran, readline, bzip2, lzma, pcre, curl, ed, libresolv, libiconv, writeScriptBin,
+  openssl, perl, CoreFoundation, Foundation, JavaNativeFoundation, JavaRuntimeSupport, JavaVM, Cocoa
 }:

 let
-  version = "19.1.1";
+  version = "19.2.1";
  mercurial = mercurial_4;
  truffleMake = ./truffle.make;
  makeMxGitCache = list: out: ''
@ -25,6 +26,57 @@ let
    chmod -R +rw ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2
    patchShebangs ${out}/graaljs/graal-nodejs/mx.graal-nodejs/python2/python

+    # # TUFFLE-RUBY # #
+    (cd ${out}/truffleruby && git apply ${./005_tool_jt.rb.patch})
+    patchShebangs ${out}/truffleruby/tool/query-versions-json.rb
+
+    substituteInPlace ${out}/truffleruby/src/main/c/Makefile \
+      --replace '(MX_HOME)/mx' '(MX_HOME)/mx-internal'
+
+    substituteInPlace ${out}/truffleruby/src/processor/java/org/truffleruby/processor/BuildInformationProcessor.java \
+      --replace 'trufflerubyHome = findHome();' \
+                'trufflerubyHome = new File(System.getenv("MX_GIT_CACHE_DIR"), "truffleruby");' \
+      --replace tool/query-versions-json.rb 'ruby tool/query-versions-json.rb' \
+      --replace 'revision = runCommand("git rev-parse --short=8 HEAD");' \
+                'revision = "${version}";' \
+      --replace 'compileDate = runCommand("git log -1 --date=short --pretty=format:%cd");' \
+                'compileDate = "1970-01-01";'
+
+    substituteInPlace ${out}/truffleruby/mx.truffleruby/mx_truffleruby.py \
+      --replace "mx_binary = join(mx._mx_home, 'mx')" "mx_binary = join(mx._mx_home, 'mx-internal')"
+
+    # # FASTR # #
+    (cd ${out}/fastr && git apply ${ ./006_mx_copylib.py.patch })
+    (cd ${out}/fastr && git apply ${ ./007_unimplemented.c.patch })
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.parser.processor/src/com/oracle/truffle/r/parser/processor/GenerateRParserProcessor.java \
+      --replace 'File suiteRoot = srcGenDir.getCanonicalFile().getParentFile().getParentFile().getParentFile();' \
+                'File suiteRoot = new File(System.getenv("MX_GIT_CACHE_DIR"), "fastr");'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.libs \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/include/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/fficall/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native.recommended/Makefile \
+      --replace 'mx -p' 'mx-internal -p'
+
+    # Make sure that the logs aren't hidden when compiling gnur
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/gnur/Makefile.gnur \
+      --replace '> gnur_configure.log 2>&1' "" \
+      --replace '> gnur_make.log 2>&1' ""
+
+    substituteInPlace ${out}/fastr/com.oracle.truffle.r.native/run/Linux/Renviron \
+      --replace /bin/ "" \
+      --replace /usr/bin/ ""
+
+    sed -i "s|exec \$mx|exec mx-internal|g" ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    chmod +x ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+    patchShebangs ${out}/fastr/com.oracle.truffle.r.native/run/*.sh
+
    cd ${out}
    hg init
    hg add
@ -50,14 +102,15 @@ let
                unzip "$out/${name}" -d "$out/$BASENAME.extracted"

                # Ninja is called later in the build process
-                if [ -f $out/$BASENAME.extracted/ninja ]; then
-                  patchelf --set-interpreter \
-                    "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-                    --set-rpath "${stdenv.cc.cc.lib}/lib64" \
-                    $out/$BASENAME.extracted/ninja
-                fi
-              ''
-            else ""}
+               ${lib.optionalString stdenv.isLinux ''
+                 if [ -f $out/$BASENAME.extracted/ninja ]; then
+                   patchelf --set-interpreter \
+                     "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+                     --set-rpath "${stdenv.cc.cc.lib}/lib64" \
+                     $out/$BASENAME.extracted/ninja
+                 fi''}
+                ''
+              else ""}
         '') list}
      '';
    };
@ -89,30 +142,32 @@ let
    rec { sha1 = "42a25dc3219429f0e5d060061f71acb49bf010a0"; name = "HAMCREST_${sha1}/hamcrest.jar";                                                   url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar; }
    rec { sha1 = "1dc37250fbc78e23a65a67fbbaf71d2e9cbc3c0b"; name = "HAMCREST_${sha1}/hamcrest.sources.jar";                                           url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3-sources.jar; }
    rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
-  ];
+] ++ lib.optionals stdenv.isLinux [
+  rec { sha1 = "0d031013db9a80d6c88330c42c983fbfa7053193"; name = "hsdis_${sha1}/hsdis.so";                                                          url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-linux-${sha1}.so"; }
+                                                                          ]
++ lib.optionals stdenv.isDarwin [
+  rec { sha1 = "67f6d23cbebd8998450a88b5bef362171f66f11a"; name = "hsdis_${sha1}/hsdis.dylib";                                                       url = "https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/hsdis/intel/hsdis-amd64-darwin-${sha1}.dylib"; }
+                                                                          ];

  graal-mxcache = jvmci8-mxcache ++ [
+    # rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_LIBCXX_SRC_${sha1}/llvm-org-libcxx-src.tar.gz";                          url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "5001adab652fc4eb35e30cdefbb0765442f8b7db"; name = "LLVM_ORG_COMPILER_RT_LINUX_${sha1}/llvm-org-compiler-rt-linux.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/compiler-rt-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
    rec { sha1 = "a990b2dba1c706f5c43c56fedfe70bad9a695852"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.jar";                                           url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2.jar; }
    rec { sha1 = "decbd95d46092fa9afaf2523b5b23d07ad7ad6bc"; name = "LLVM_WRAPPER_${sha1}/llvm-wrapper.sources.jar";                                   url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-sources.jar; }
-    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
-    rec { sha1 = "503402aa0cf80fd95ede043c0011152c2b4556fd"; name = "LLVM_PLATFORM_${sha1}/llvm-platform.jar";                                         url = mirror://maven/org/bytedeco/javacpp-presets/llvm-platform/6.0.1-1.4.2/llvm-platform-6.0.1-1.4.2.jar; }
    rec { sha1 = "cfa6a0259d98bff5aa8d41ba11b4d1dad648fbaa"; name = "JAVACPP_${sha1}/javacpp.jar";                                                     url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2.jar; }
    rec { sha1 = "fdb2d2c17f6b91cdd5421554396da8905f0dfed2"; name = "JAVACPP_${sha1}/javacpp.sources.jar";                                             url = mirror://maven/org/bytedeco/javacpp/1.4.2/javacpp-1.4.2-sources.jar; }
    rec { sha1 = "702ca2d0ae93841c5ab75e4d119b29780ec0b7d9"; name = "NINJA_SYNTAX_${sha1}/ninja-syntax.tar.gz";                                        url = "https://pypi.org/packages/source/n/ninja_syntax/ninja_syntax-1.7.2.tar.gz"; }
-    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
-          isNinja = true; }
    rec { sha1 = "f2cfb09cee12469ff64f0d698b13de19903bb4f7"; name = "NanoHTTPD-WebSocket_${sha1}/nanohttpd-websocket.jar";                             url = mirror://maven/org/nanohttpd/nanohttpd-websocket/2.3.1/nanohttpd-websocket-2.3.1.jar; }
    rec { sha1 = "a8d54d1ca554a77f377eff6bf9e16ca8383c8f6c"; name = "NanoHTTPD_${sha1}/nanohttpd.jar";                                                 url = mirror://maven/org/nanohttpd/nanohttpd/2.3.1/nanohttpd-2.3.1.jar; }
    rec { sha1 = "946f8aa9daa917dd81a8b818111bec7e288f821a"; name = "ANTLR4_${sha1}/antlr4.jar";                                                       url = mirror://maven/org/antlr/antlr4-runtime/4.7.1/antlr4-runtime-4.7.1.jar; }
    rec { sha1 = "c3aeac59c022bdc497c8c48ed86fa50450e4896a"; name = "JLINE_${sha1}/jline.jar";                                                         url = mirror://maven/jline/jline/2.14.6/jline-2.14.6.jar; }
    rec { sha1 = "d0bdc21c5e6404726b102998e44c66a738897905"; name = "JAVA_ALLOCATION_INSTRUMENTER_${sha1}/java-allocation-instrumenter.jar";           url = mirror://maven/com/google/code/java-allocation-instrumenter/java-allocation-instrumenter/3.1.0/java-allocation-instrumenter-3.1.0.jar; }
-    rec { sha1 = "0da08b8cce7bbf903602a25a3a163ae252435795"; name = "ASM5_${sha1}/asm5.jar";                                                        url = mirror://maven/org/ow2/asm/asm/5.0.4/asm-5.0.4.jar; }
+    rec { sha1 = "0da08b8cce7bbf903602a25a3a163ae252435795"; name = "ASM5_${sha1}/asm5.jar";                                                           url = mirror://maven/org/ow2/asm/asm/5.0.4/asm-5.0.4.jar; }
    rec { sha1 = "396ce0c07ba2b481f25a70195c7c94922f0d1b0b"; name = "ASM_TREE5_${sha1}/asm-tree5.jar";                                                 url = mirror://maven/org/ow2/asm/asm-tree/5.0.4/asm-tree-5.0.4.jar; }
    rec { sha1 = "280c265b789e041c02e5c97815793dfc283fb1e6"; name = "LIBFFI_SOURCES_${sha1}/libffi-sources.tar.gz";                                    url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/libffi-3.2.1.tar.gz; }
    rec { sha1 = "8819cea8bfe22c9c63f55465e296b3855ea41786"; name = "TruffleJSON_${sha1}/trufflejson.jar";                                             url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/trufflejson-20180130.jar; }
    rec { sha1 = "9712a8124c40298015f04a74f61b3d81a51513af"; name = "CHECKSTYLE_8.8_${sha1}/checkstyle-8.8.jar";                                       url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/checkstyle-8.8-all.jar; }
-    rec { sha1 = "158ba6f2b346469b5f8083d1700c3f55b8b9082c"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11.tar.gz; }
-    rec { sha1 = "eb5ffa476ed2f6fac0ecd4bb2ae32741f9646932"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11-linux-amd64.tar.gz; }
+    rec { sha1 = "8dc5a90bed5f51d7538d05b8c31c31b7dfddbd66"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20.tar.gz; }
    rec { sha1 = "e6e60889b7211a80b21052a249bd7e0f88f79fee"; name = "Java-WebSocket_${sha1}/java-websocket.jar";                                       url = mirror://maven/org/java-websocket/Java-WebSocket/1.3.9/Java-WebSocket-1.3.9.jar; }
    rec { sha1 = "7a4d00d5ec5febd252a6182e8b6e87a0a9821f81"; name = "ICU4J_${sha1}/icu4j.jar";                                                         url = mirror://maven/com/ibm/icu/icu4j/62.1/icu4j-62.1.jar; }
    # This duplication of asm with underscore and minus is totally weird
@ -138,15 +193,25 @@ let
    rec { sha1 = "505a09064f6e2209616f38724f6d97d8d889aa92"; name = "JONI_${sha1}/joni.sources.jar";                                                   url = mirror://maven/org/jruby/joni/joni/2.1.25/joni-2.1.25-sources.jar; }
    rec { sha1 = "c4f7d054303948eb6a4066194253886c8af07128"; name = "XZ-1.8_${sha1}/xz-1.8.jar";                                                       url = mirror://maven/org/tukaani/xz/1.8/xz-1.8.jar; }
    rec { sha1 = "9314d3d372b05546a33791fbc8dd579c92ebd16b"; name = "GNUR_${sha1}/gnur.tar.gz";                                                        url = http://cran.rstudio.com/src/base/R-3/R-3.5.1.tar.gz; }
-    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }
-  ];
+    rec { sha1 = "90aa8308da72ae610207d8f6ca27736921be692a"; name = "ANTLR4_COMPLETE_${sha1}/antlr4-complete.jar";                                     url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/antlr-4.7.1-complete.jar; }] ++
+  lib.optionals stdenv.isLinux [
+    rec { sha1 = "df4c1f784294d02a82d78664064248283bfcc297"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-linux-amd64.tar.gz; }
+    rec { sha1 = "344483aefa15147c121a8fb6fb35a2406768cc5c"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-linux-x86_64.jar; }
+    rec { sha1 = "fd1a723d62cbbc591041d303e8b151d89f131643"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-linux-amd64.tar.gz; }
+    rec { sha1 = "987234c4ce45505c21302e097c24efef4873325c"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-linux.zip";
+          isNinja = true; }] ++
+  lib.optionals stdenv.isDarwin [
+    rec { sha1 = "0fa1af180755fa4cc018ee9be33f2d7d827593c4"; name = "LLVM_ORG_${sha1}/llvm-org.tar.gz";                                                url = https://lafo.ssw.uni-linz.ac.at/pub/llvm-org/llvm-llvmorg-8.0.0-4-gd563e33a79-bgae3b177eaa-darwin-amd64.tar.gz; }
+    rec { sha1 = "57bc74574104a9e0a2dc4d7a71ffcc5731909e57"; name = "LLVM_PLATFORM_SPECIFIC_${sha1}/llvm-platform-specific.jar";                       url = mirror://maven/org/bytedeco/javacpp-presets/llvm/6.0.1-1.4.2/llvm-6.0.1-1.4.2-macosx-x86_64.jar; }
+    rec { sha1 = "ae23bb365930f720acc88c62640bae6852a37d67"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-20-macosx-x86_64.tar.gz; }
+    rec { sha1 = "8142c497f7dfbdb052a1e31960fdfe2c6f9a5ca2"; name = "NINJA_${sha1}/ninja.zip";                                                         url = "https://github.com/ninja-build/ninja/releases/download/v1.8.2/ninja-mac.zip";
+          isNinja = true; }];

  graal-mxcachegit = [
-    { sha256 = "05z2830ng71bhgsxc0zyc74l1bz7hg54la8j1r99993fhhch4y36"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
-    { sha256 = "0ai5x4n1c2lcfkfpp29zn1bcmp3khc5hvssyw1qr1l2zy79fxwjp"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
-    { sha256 = "010079qsl6dff3yca8vlzcahq9z1ppyr758shjkm1f7izwphjv7p"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
-    { sha256 = "0hcqbasqs0yb7p1sal63qbxqxh942gh5vzl95pfdlflmc2g82v4q"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }
-  ];
+    { sha256 = "01w39ms39gl3cw7c2fgcacr2yjg94im9x2x7p5g94l6xlcgqvcnr"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
+    { sha256 = "1dps9n5b9c80pbg1fmlwpffy6ina0f0h27di24kafc8isxrdggia"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
+    { sha256 = "0jdpdqm3ld1wsasmi8ka26qf19cibjac8lrqm040h5vh0iqzxizy"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
+    { sha256 = "1gv8vafwrafjzvgv4gwk4kcsb3bnvsx07qa5inc0bdyxy5shl381"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }];

  ninja-syntax = python27.pkgs.buildPythonPackage rec {
    version = "1.7.2";
@ -169,13 +234,13 @@ let
 in rec {

  mx = stdenv.mkDerivation rec {
-    version = "5.223.0";
+    version = "5.247.1";
    pname = "mx";
    src = fetchFromGitHub {
      owner  = "graalvm";
      repo   = "mx";
      rev    = version;
-      sha256 = "0q51dnm6n1472p93dxr4jh8d7cv09a70pq89cdgxwh42vapykrn9";
+      sha256 = "038qr49rqzkhj76nqd27h8fysssnlpdhmy23ks2y81xlxhlzkc59";
    };
    nativeBuildInputs = [ makeWrapper ];
    prePatch = ''
@ -214,15 +279,17 @@ in rec {
  };

  jvmci8 = stdenv.mkDerivation rec {
-    version = "19.2-b01";
+    version = "19.3-b05";
    pname = "jvmci";
    src = fetchFromGitHub {
      owner  = "graalvm";
      repo   = "graal-jvmci-8";
      rev    = "jvmci-${version}";
-      sha256 = "0maipj871vaxvap4576m0pzblzqxfjjzmwap3ndd84ny8d6vbqaa";
+      sha256 =  "0j7my76vldbrvki9x1gn9ics3x2z96j05jdy4nflbpik8i396114";
    };
-    buildInputs = [ mx mercurial openjdk ];
+    buildInputs = [ mx mercurial openjdk ] ++ lib.optional stdenv.isDarwin [
+      libobjc CoreFoundation Foundation JavaNativeFoundation JavaRuntimeSupport JavaVM xcodebuild Cocoa
+    ];
    postUnpack = ''
      # a fake mercurial dir to prevent mx crash and supply the version to mx
      ( cd $sourceRoot
@ -233,17 +300,27 @@ in rec {
        hg checkout ${lib.escapeShellArg src.rev}
      )
    '';
-    patches = [ ./004_mx_jvmci.py.patch ];
+    patches = [ ./004_mx_jvmci.py.patch ] ++
+              lib.optional stdenv.isDarwin [
+                ./008_remove_jfr.patch ];
    postPatch =''
      # The hotspot version name regex fix
      substituteInPlace mx.jvmci/mx_jvmci.py \
-        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-bga"
-      substituteInPlace src/share/vm/jvmci/jvmciCompilerToVM.cpp \
-        --replace 'method->name_and_sig_as_C_string(), method->native_function(), entry' \
-                  'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
+        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-b[g\\d][a\\d]"
+      # darwin: https://github.com/oracle/graal/issues/1816
+      substituteInPlace src/share/vm/code/compiledIC.cpp \
+        --replace 'entry == false' '*entry == false'
    '';
    hardeningDisable = [ "fortify" ];
-    NIX_CFLAGS_COMPILE = "-Wno-error=format-overflow -Wno-error=nonnull";
+    NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.isDarwin [
+      "-Wno-reserved-user-defined-literal"
+      "-Wno-c++11-narrowing"
+    ] ++
+    lib.optional stdenv.isLinux [
+      "-Wno-error=format-overflow" # newly detected by gcc7
+      "-Wno-error=nonnull"
+    ]);
+
    buildPhase = ''
      export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
      export MX_CACHE_DIR=${makeMxCache jvmci8-mxcache}
@ -254,7 +331,9 @@ in rec {
    '';
    installPhase = ''
      mkdir -p $out
-      mv openjdk1.8.0_*/linux-amd64/product/* $out
+      ${if stdenv.isDarwin
+        then "mv openjdk1.8.0_*/darwin-amd64/product/* $out"
+        else "mv openjdk1.8.0_*/linux-amd64/product/* $out"}
      install -v -m0555 -D $MX_CACHE_DIR/hsdis*/hsdis.so $out/jre/lib/amd64/hsdis-amd64.so
    '';
    # copy-paste openjdk's preFixup
@ -276,25 +355,36 @@ in rec {
    inherit (openjdk) meta;
  };

-  graalvm8 = stdenv.mkDerivation rec {
+  graalvm8 = 	stdenv.mkDerivation rec {
    inherit version;
    pname = "graal";
    src = fetchFromGitHub {
      owner  = "oracle";
      repo   = "graal";
      rev    = "vm-${version}";
-      sha256 = "0abx6adk91yzaf1md4qbidxykpqcgphh6j4hj01ry57s4if0j66f";
+      sha256 = "0v8zkmzkyhmmmvra5pp876d4i4ijrrw15j98ipayc7is02kwiwmq";
    };
-    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ];
-    buildInputs = [ mx zlib mercurial jvmci8 git clang llvm
-                    python27withPackages which icu ruby bzip2
-                    # gfortran readline bzip2 lzma pcre.dev curl ed ## WIP: fastr dependencies
+
+    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ] ++
+              lib.optional stdenv.isDarwin [
+                ./009_remove_signedness_verifier.patch ./010_mx_substratevm.py
+              ];
+
+    buildInputs = [ mx zlib.dev mercurial jvmci8 git llvm clang
+                    python27withPackages icu ruby bzip2 which
+                    readline bzip2 lzma pcre curl ed gfortran
+                  ]  ++ lib.optional stdenv.isDarwin [
+                    CoreFoundation gcc.cc.lib libiconv perl openssl
                  ];
+
    postUnpack = ''
-      cp ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/stdlib.h \
-        $sourceRoot/sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include
-      cp ${truffleMake} $TMP && mv *truffle.make truffle.make
+      ${lib.optionalString stdenv.isLinux ''
+        cp ${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/stdlib.h \
+          $sourceRoot/sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include
+      ''}
+      cp ${truffleMake} $TMPDIR/truffle.make
      rm $sourceRoot/truffle/src/libffi/patches/others/0001-Add-mx-bootstrap-Makefile.patch
+
      # a fake mercurial dir to prevent mx crash and supply the version to mx
      ( cd $sourceRoot
        hg init
@ -303,57 +393,93 @@ in rec {
        hg tag      ${lib.escapeShellArg src.rev}
        hg checkout ${lib.escapeShellArg src.rev}
      )
+
+      # make a copy of jvmci8
+      mkdir $NIX_BUILD_TOP/jvmci8
+      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
+      chmod +w -R $NIX_BUILD_TOP/jvmci8
+      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
+      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
+      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
+      cd $TMPDIR
    '';
+
    postPatch = ''
      substituteInPlace substratevm/src/com.oracle.svm.core.posix/src/com/oracle/svm/core/posix/headers/PosixDirectives.java \
        --replace '<zlib.h>' '<${zlib.dev}/include/zlib.h>'
      substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
        --replace 'cmd.add("-v");' 'cmd.add("-v"); cmd.add("-L${zlib}/lib");'
-      substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
-        --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
-          'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");'
+
+      # For debugging native-image build, add this replace statement on CCompilerInvoker.java
+      # --replace '(String line : lines) {' '(String line : lines) {System.out.println("DEBUG: " + line);'
+      ${if stdenv.isLinux then ''
+          substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
+            --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${stdenv.cc}/bin/gcc");' ''
+        else ''
+          substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/c/codegen/CCompilerInvoker.java \
+            --replace 'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "gcc");' \
+                      'command.add(Platform.includedIn(Platform.WINDOWS.class) ? "CL" : "${gcc.cc}/bin/gcc");
+                       command.add("-F"); command.add("${CoreFoundation}/Library/Frameworks");
+                       command.add("-framework"); command.add("CoreFoundation");'
+       ''}
+
+      # prevent cyclical imports caused by identical <include> names
      substituteInPlace substratevm/src/com.oracle.svm.hosted/src/com/oracle/svm/hosted/image/CCLinkerInvocation.java \
        --replace 'protected String compilerCommand = "cc";' 'protected String compilerCommand = "${stdenv.cc}/bin/cc";'
-      # prevent cyclical imports caused by identical <include> names
-      substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
-        --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
      # dragonegg can't seem to compile on nix, so let's not require it
      substituteInPlace sulong/mx.sulong/suite.py \
        --replace '"requireDragonegg" : True,' '"requireDragonegg" : False,'
      substituteInPlace truffle/mx.truffle/mx_truffle.py \
        --replace 'os.path.relpath(self.subject.delegate.dir, self.subject.suite.vc_dir)' \
                  'self.subject.delegate.dir'
-
+      substituteInPlace sulong/projects/bootstrap-toolchain-launchers/Makefile \
+        --replace /bin/bash ${bash}/bin/bash
      # Patch the native-image template, as it will be run during build
      chmod +x vm/mx.vm/launcher_template.sh && patchShebangs vm/mx.vm
      # Prevent random errors from too low maxRuntimecompilemethods
      substituteInPlace truffle/mx.truffle/macro-truffle.properties \
        --replace '-H:MaxRuntimeCompileMethods=1400' \
                  '-H:MaxRuntimeCompileMethods=28000'
+      ${lib.optionalString stdenv.isDarwin ''
+        substituteInPlace truffle/src/com.oracle.truffle.nfi.test.native/src/object.cc \
+          --replace '#include <stdlib.h>' ""
+      ''}
+      ${lib.optionalString stdenv.isLinux ''
+        substituteInPlace sulong/projects/com.oracle.truffle.llvm.libraries.bitcode/include/stdlib.h \
+          --replace '# include <cstdlib>' '# include "${stdenv.cc.cc}/include/c++/${lib.getVersion stdenv.cc.cc}/cstdlib"'
+      ''}
    '';

    buildPhase = ''
-      # make a copy of jvmci8
-      mkdir $NIX_BUILD_TOP/jvmci8
-      cp -dpR ${jvmci8}/* $NIX_BUILD_TOP/jvmci8
-      chmod +w -R $NIX_BUILD_TOP/jvmci8
-
      export MX_ALT_OUTPUT_ROOT=$NIX_BUILD_TOP/mxbuild
-      export MX_CACHE_DIR=${makeMxCache graal-mxcache}
      export MX_GIT_CACHE='refcache'
-      export MX_GIT_CACHE_DIR=$NIX_BUILD_TOP/mxgitcache
      export JVMCI_VERSION_CHECK='ignore'
      export JAVA_HOME=$NIX_BUILD_TOP/jvmci8
-      # export FASTR_RELEASE=true ## WIP
-      ${makeMxGitCache graal-mxcachegit "$MX_GIT_CACHE_DIR"}
-      cd $NIX_BUILD_TOP/source
-
+      export FASTR_RELEASE=true
+      export PKG_LDFLAGS_OVERRIDE="-L${pcre.out}/lib -L${zlib}/lib -L${gfortran.cc.lib}/lib64"
+      ${lib.optionalString stdenv.isDarwin ''
+        export CC="gcc"
+        export CPP="gcc -E"
+        export NIX_CXXSTDLIB_LINK=""
+        export NIX_TARGET_CXXSTDLIB_LINK=""
+        export OPENSSL_PREFIX=$(realpath openssl)
+        # this fixes error: impure path 'LibFFIHeaderDirectives' used in link
+        export NIX_ENFORCE_PURITY=0
+      ''}
      ( cd vm
-        mx-internal -v --dynamicimports /substratevm,/tools,sulong,/graal-nodejs,graalpython build
+        mx-internal -v --suite sdk --suite compiler --suite vm --suite tools --suite regex --suite truffle \
+                       --dynamicimports /substratevm,/sulong,graal-js,graalpython,fastr,truffleruby build
      )
    '';

-    installPhase = ''
+    installPhase =
+      (if stdenv.isDarwin then ''
+      mkdir -p $out
+      rm -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM_*STAGE1*
+      cp -rf $MX_ALT_OUTPUT_ROOT/vm/darwin-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
+      ''
+       else ''
      mkdir -p $out
      rm -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM_*STAGE1*
      cp -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM*/graalvm-unknown-${version}/* $out
@ -366,7 +492,7 @@ in rec {
      cp -rf ${glibc}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
      cp ${glibc.static}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
      cp ${zlib.static}/lib/libz.a $out/jre/lib/svm/clibraries/linux-amd64/libz.a
-    '';
+    '');

    inherit (jvmci8) preFixup;
    dontStrip = true; # stripped javac crashes with "segmentaion fault"
@ -390,12 +516,14 @@ in rec {
      ./helloworld
      ./helloworld | fgrep 'Hello World'

-      # Ahead-Of-Time compilation with --static
-      $out/bin/native-image --no-server --static HelloWorld
-      ./helloworld
-      ./helloworld | fgrep 'Hello World'
-    '';
-
+      ${lib.optionalString stdenv.isLinux
+        ''
+          # Ahead-Of-Time compilation with --static (supported on linux only)
+          $out/bin/native-image --no-server --static HelloWorld
+          ./helloworld
+          ./helloworld | fgrep 'Hello World'
+        ''}
+         '';
    enableParallelBuilding = true;
    passthru.home = graalvm8;

@ -404,7 +532,7 @@ in rec {
      description = "High-Performance Polyglot VM";
      license = licenses.gpl2;
      maintainers = with maintainers; [ volth hlolli ];
-      platforms = [ "x86_64-linux" /*"aarch64-linux" "x86_64-darwin"*/ ];
+      platforms = [ "x86_64-linux" "x86_64-darwin" /*"aarch64-linux"*/ ];
    };
  };
 }
--- a/pkgs/development/compilers/graalvm/truffle.make
+++ b/pkgs/development/compilers/graalvm/truffle.make
@ -2,13 +2,15 @@

 # `make MX_VERBOSE=y` will report all lines executed. The actual value doesn't
 # matter as long as it's not empty.
+
 QUIETLY$(MX_VERBOSE) = @

 .PHONY: default

 default:
+	sed -i "s|-print-multi-os-directory||g" ../$(SOURCES)/configure
 	$(QUIETLY) echo CONFIGURE libffi
 	$(QUIETLY) mkdir ../$(OUTPUT)
-	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS) > ../libffi.configure.log
+	$(QUIETLY) cd ../$(OUTPUT) && ../$(SOURCES)/configure $(CONFIGURE_ARGS)
 	$(QUIETLY) echo MAKE libffi
-	$(QUIETLY) $(MAKE) -C ../$(OUTPUT) > ../libffi.build.log
+	$(QUIETLY) $(MAKE) -C ../$(OUTPUT)
--- a/pkgs/development/compilers/halide/default.nix
+++ b/pkgs/development/compilers/halide/default.nix
@ -29,7 +29,7 @@ in llvmPackages.stdenv.mkDerivation {
  # To handle the lack of 'local' RPATH; required, as they call one of
  # their built binaries requiring their libs, in the build process.
  preBuild = ''
-    export LD_LIBRARY_PATH="$(pwd)/lib:$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$(pwd)/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
  '';

  enableParallelBuilding = true;
--- a/pkgs/development/compilers/llvm/4/clang/default.nix
+++ b/pkgs/development/compilers/llvm/4/clang/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, release_version, clang-tools-extra_src, python
+{ stdenv, fetch, cmake, libxml2, llvm, version, release_version, clang-tools-extra_src, python3
 , fixDarwinDylibNames
 , enableManpages ? false
 }:
@ -19,8 +19,8 @@ let
      mv clang-tools-extra-* $sourceRoot/tools/extra
    '';

-    nativeBuildInputs = [ cmake python ]
-      ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+    nativeBuildInputs = [ cmake python3 ]
+      ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;

    buildInputs = [ libxml2 llvm ]
      ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
--- a/pkgs/development/compilers/llvm/4/default.nix
+++ b/pkgs/development/compilers/llvm/4/default.nix
@ -1,5 +1,5 @@
 { lowPrio, newScope, pkgs, stdenv, cmake, libstdcxxHook
-, libxml2, python, isl, fetchurl, overrideCC, wrapCCWith
+, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 }:
@ -17,7 +17,7 @@ let
  clang-tools-extra_src = fetch "clang-tools-extra" "1dhmp7ccfpr42bmvk3kp37ngjpf3a9m5d4kkpsn7d00hzi7fdl9m";

  tools = stdenv.lib.makeExtensible (tools: let
-    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (tools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
  in {

    llvm = callPackage ./llvm.nix {
@ -29,12 +29,12 @@ let

    llvm-manpages = lowPrio (tools.llvm.override {
      enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
    });

    clang-manpages = lowPrio (tools.clang-unwrapped.override {
      enableManpages = true;
-      python = pkgs.python;  # don't use python-boot
+      python3 = pkgs.python3;  # don't use python-boot
    });

    libclang = tools.clang-unwrapped.lib;
@ -57,7 +57,7 @@ let
  });

  libraries = stdenv.lib.makeExtensible (libraries: let
-    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python isl release_version version fetch; });
+    callPackage = newScope (libraries // buildLlvmTools // { inherit stdenv cmake libxml2 python3 isl release_version version fetch; });
  in {

    stdenv = overrideCC stdenv buildLlvmTools.clang;
--- a/pkgs/development/compilers/llvm/4/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/4/libc++/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetch, cmake, python, libcxxabi, fixDarwinDylibNames, version }:
+{ lib, stdenv, fetch, cmake, python3, libcxxabi, fixDarwinDylibNames, version }:

 stdenv.mkDerivation {
  pname = "libc++";
@ -31,7 +31,7 @@ stdenv.mkDerivation {
  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
    patchShebangs utils/cat_files.py
  '';
-  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python;
+  nativeBuildInputs = [ cmake ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl python3;

  buildInputs = [ libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;

--- a/pkgs/development/compilers/llvm/4/lldb.nix
+++ b/pkgs/development/compilers/llvm/4/lldb.nix
@ -9,7 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
-, python
+, python3
 , version
 , darwin
 }:
@ -31,7 +31,7 @@ stdenv.mkDerivation {
      cmake/modules/LLDBStandalone.cmake
  '';

-  nativeBuildInputs = [ cmake python which swig ];
+  nativeBuildInputs = [ cmake python3 which swig ];
  buildInputs = [ ncurses zlib libedit libxml2 llvm ]
    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];

--- a/pkgs/development/compilers/llvm/4/llvm.nix
+++ b/pkgs/development/compilers/llvm/4/llvm.nix
@ -2,7 +2,7 @@
 , fetch
 , fetchpatch
 , cmake
-, python
+, python3
 , libffi
 , libbfd
 , libxml2
@ -40,8 +40,8 @@ stdenv.mkDerivation ({
  outputs = [ "out" ]
    ++ stdenv.lib.optional enableSharedLibraries "lib";

-  nativeBuildInputs = [ cmake python ]
-    ++ stdenv.lib.optional enableManpages python.pkgs.sphinx;
+  nativeBuildInputs = [ cmake python3 ]
+    ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;

  buildInputs = [ libxml2 libffi ];

@ -143,7 +143,7 @@ stdenv.mkDerivation ({
  '';

  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/lib
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/lib
  '';

  postInstall = stdenv.lib.optionalString enableSharedLibraries ''
--- a/Show more
+++ b/Show more