NixOS · Jun 8, 2020 · Jul 1, 2020 · Jul 13, 2020 · Aug 3, 2020 · Aug 3, 2020
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
@@ -43,6 +43,9 @@ let
 
     [gitlab-shell]
     dir = "${cfg.packages.gitlab-shell}"
+    secret_file = "${cfg.statePath}/gitlab_shell_secret"
+    gitlab_url = "http+unix://${pathUrlQuote gitlabSocket}"
+    http_settings = { self_signed_cert = false }
 
     ${concatStringsSep "\n" (attrValues (mapAttrs (k: v: ''
     [[storage]]

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
@@ -527,36 +527,40 @@ in {
                 '';
               };
               "/" = {
-                priority = 200;
-                extraConfig = "rewrite ^ /index.php;";
+                priority = 900;
+                extraConfig = "try_files $uri $uri/ /index.php$request_uri;";
               };
               "~ ^/store-apps" = {
                 priority = 201;
                 extraConfig = "root ${cfg.home};";
               };
-              "= /.well-known/carddav" = {
+              "^~ /.well-known" = {
                 priority = 210;
-                extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-              };
-              "= /.well-known/caldav" = {
-                priority = 210;
-                extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-              };
-              "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
-                priority = 300;
-                extraConfig = "deny all;";
-              };
-              "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
-                priority = 300;
-                extraConfig = "deny all;";
+                extraConfig = ''
+                  location = /.well-known/carddav {
+                    return 301 $scheme://$host/remote.php/dav;
+                  }
+                  location = /.well-known/caldav {
+                    return 301 $scheme://$host/remote.php/dav;
+                  }
+                  try_files $uri $uri/ =404;
+                '';
               };
-              "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
+              "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)".extraConfig = ''
+                return 404;
+              '';
+              "~ ^/(?:\\.|autotest|occ|issue|indie|db_|console)".extraConfig = ''
+                return 404;
+              '';
+              "~ \\.php(?:$|/)" = {
                 priority = 500;
                 extraConfig = ''
                   include ${config.services.nginx.package}/conf/fastcgi.conf;
-                  fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
+                  fastcgi_split_path_info ^(.+?\.php)(\\/.*)$;
+                  set $path_info $fastcgi_path_info;
                   try_files $fastcgi_script_name =404;
-                  fastcgi_param PATH_INFO $fastcgi_path_info;
+                  fastcgi_param PATH_INFO $path_info;
+                  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                   fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
                   fastcgi_param modHeadersAvailable true;
                   fastcgi_param front_controller_active true;
@@ -566,28 +570,24 @@ in {
                   fastcgi_read_timeout 120s;
                 '';
               };
-              "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
-                try_files $uri/ =404;
-                index index.php;
-              '';
-              "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
+              "~ \\.(?:css|js|svg|gif|map)$".extraConfig = ''
                 try_files $uri /index.php$request_uri;
-                add_header Cache-Control "public, max-age=15778463";
-                add_header X-Content-Type-Options nosniff;
-                add_header X-XSS-Protection "1; mode=block";
-                add_header X-Robots-Tag none;
-                add_header X-Download-Options noopen;
-                add_header X-Permitted-Cross-Domain-Policies none;
-                add_header X-Frame-Options sameorigin;
-                add_header Referrer-Policy no-referrer;
+                expires 6M;
                 access_log off;
               '';
-              "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
+              "~ \\.woff2?$".extraConfig = ''
                 try_files $uri /index.php$request_uri;
+                expires 7d;
                 access_log off;
               '';
+              "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
+                try_files $uri/ =404;
+                index index.php;
+              '';
             };
             extraConfig = ''
+              index index.php index.html /index.php$request_uri;
+              expires 1m;
               add_header X-Content-Type-Options nosniff;
               add_header X-XSS-Protection "1; mode=block";
               add_header X-Robots-Tag none;
@@ -596,8 +596,6 @@ in {
               add_header X-Frame-Options sameorigin;
               add_header Referrer-Policy no-referrer;
               add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-              error_page 403 /core/templates/403.php;
-              error_page 404 /core/templates/404.php;
               client_max_body_size ${cfg.maxUploadSize};
               fastcgi_buffers 64 4K;
               fastcgi_hide_header X-Powered-By;

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
@@ -696,7 +696,10 @@ in
       '';
       serviceConfig = {
         ExecStart = execCommand;
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        ExecReload = [
+          "${execCommand} -t"
+          "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
+        ];
         Restart = "always";
         RestartSec = "10s";
         StartLimitInterval = "1min";
@@ -725,9 +728,8 @@ in
       serviceConfig.Type = "oneshot";
       serviceConfig.TimeoutSec = 60;
       script = ''
-        if ${pkgs.systemd}/bin/systemctl -q is-active nginx.service ; then
-          ${execCommand} -t && \
-            ${pkgs.systemd}/bin/systemctl reload nginx.service
+        if /run/current-system/systemd/bin/systemctl -q is-active nginx.service ; then
+          /run/current-system/systemd/bin/systemctl reload nginx.service
         fi
       '';
       serviceConfig.RemainAfterExit = true;

diff --git a/pkgs/applications/audio/sonic-visualiser/default.nix b/pkgs/applications/audio/sonic-visualiser/default.nix
@@ -2,21 +2,23 @@
 
 { stdenv, fetchurl, alsaLib, bzip2, fftw, libjack2, libX11, liblo
 , libmad, libogg, librdf, librdf_raptor, librdf_rasqal, libsamplerate
-, libsndfile, pkgconfig, libpulseaudio, qtbase, redland
-, qmake, rubberband, serd, sord, vampSDK, fftwFloat
+, libsndfile, pkgconfig, libpulseaudio, qtbase, qtsvg, redland
+, rubberband, serd, sord, vampSDK, fftwFloat
+, capnproto, liboggz, libfishsound, libid3tag, opusfile
+, wrapQtAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "sonic-visualiser";
-  version = "2.4.1";
+  version = "4.0.1";
 
   src = fetchurl {
-    url = "https://code.soundsoftware.ac.uk/attachments/download/1185/${pname}-${version}.tar.gz";
-    sha256 = "06nlha70kgrby16nyhngrv5q846xagnxdinv608v7ga7vpywwmyb";
+    url = "https://code.soundsoftware.ac.uk/attachments/download/2607/${pname}-${version}.tar.gz";
+    sha256 = "14674adzp3chilymna236qyvci3b1zmi3wyz696wk7bcd3ndpsg6";
   };
 
   buildInputs =
-    [ libsndfile qtbase fftw fftwFloat bzip2 librdf rubberband
+    [ libsndfile qtbase qtsvg fftw fftwFloat bzip2 librdf rubberband
       libsamplerate vampSDK alsaLib librdf_raptor librdf_rasqal redland
       serd
       sord
@@ -26,23 +28,22 @@ stdenv.mkDerivation rec {
       libpulseaudio
       libmad
       libogg # ?
-      # fishsound
+      libfishsound
       liblo
       libX11
+      capnproto
+      liboggz
+      libid3tag
+      opusfile
     ];
 
-  nativeBuildInputs = [ pkgconfig qmake ];
+  nativeBuildInputs = [ pkgconfig wrapQtAppsHook ];
 
-  configurePhase = ''
-    for i in sonic-visualiser svapp svcore svgui;
-      do cd $i && qmake PREFIX=$out && cd ..;
-    done
-  '';
+  enableParallelBuilding = true;
 
-  installPhase = ''
-    mkdir -p $out/{bin,share/sonic-visualiser}
-    cp sonic-visualiser $out/bin/
-    cp -r samples $out/share/sonic-visualiser/
+  # comment out the tests
+  preConfigure = ''
+    sed -i 's/sub_test_svcore_/#sub_test_svcore_/' sonic-visualiser.pro
   '';
 
   meta = with stdenv.lib; {
@@ -51,6 +52,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.goibhniu maintainers.marcweber ];
     platforms = platforms.linux;
-    broken = true;
   };
 }
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
@@ -20,13 +20,13 @@ let
 in
   stdenv.mkDerivation rec {
     pname = "neovim-unwrapped";
-    version = "0.4.3";
+    version = "0.4.4";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
       rev = "v${version}";
-      sha256 = "03p7pic7hw9yxxv7fbgls1f42apx3lik2k6mpaz1a109ngyc5kaj";
+      sha256 = "11zyj6jvkwas3n6w1ckj3pk6jf81z1g7ngg4smmwm7c27y2a6f2m";
     };
 
     patches = [

diff --git a/pkgs/applications/editors/sigil/default.nix b/pkgs/applications/editors/sigil/default.nix
@@ -1,15 +1,15 @@
 { stdenv, mkDerivation, fetchFromGitHub, cmake, pkgconfig, makeWrapper
 , boost, xercesc
-, qtbase, qttools, qtwebkit, qtxmlpatterns
+, qtbase, qttools, qtwebengine, qtxmlpatterns
 , python3, python3Packages
 }:
 
 mkDerivation rec {
   pname = "sigil";
-  version = "0.9.14";
+  version = "0.9.16";
 
   src = fetchFromGitHub {
-    sha256 = "0fmfbfpnmhclbbv9cbr1xnv97si6ls7331kk3ix114iqkngqwgl1";
+    sha256 = "1xxd59j21g31lp9phrf64y9zvg15g8mk6snsp3n4f6bsf44dn4ha";
     rev = version;
     repo = "Sigil";
     owner = "Sigil-Ebook";
@@ -20,7 +20,7 @@ mkDerivation rec {
   nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
 
   buildInputs = [
-    boost xercesc qtbase qttools qtwebkit qtxmlpatterns
+    boost xercesc qtbase qttools qtwebengine qtxmlpatterns
     python3Packages.lxml ];
 
   dontWrapQtApps = true;

diff --git a/pkgs/applications/graphics/displaycal/default.nix b/pkgs/applications/graphics/displaycal/default.nix
@@ -12,16 +12,16 @@
  }:
 
 let
-  inherit (python2.pkgs) buildPythonApplication wxPython numpy;
-in buildPythonApplication {
+  inherit (python2.pkgs) buildPythonApplication wxPython numpy dbus-python;
+in buildPythonApplication rec {
   pname = "displaycal";
-  version = "3.5.0.0";
+  version = "3.8.9.3";
 
   enableParallelBuilding = true;
 
   src = fetchurl {
-    url = mirror://sourceforge/project/dispcalgui/release/3.5.0.0/DisplayCAL-3.5.0.0.tar.gz;
-    sha256 = "1j496sv8pbhby5hkkbp07k6bs3f7mb1l3dijmn2iga3kmix0fn5q";
+    url = "mirror://sourceforge/project/dispcalgui/release/${version}/DisplayCAL-${version}.tar.gz";
+    sha256 = "1sivi4q7sqsrc95qg5gh37bsm2761md4mpl89hflzwk6kyyxyd3w";
   };
 
   propagatedBuildInputs = [
@@ -34,6 +34,7 @@ in buildPythonApplication {
     argyllcms
     wxPython
     numpy
+    dbus-python
   ];
 
   nativeBuildInputs = [
@@ -42,7 +43,8 @@ in buildPythonApplication {
 
   preConfigure = ''
     mkdir dist
-    cp {misc,dist}/DisplayCAL.appdata.xml
+    cp {misc,dist}/net.displaycal.DisplayCAL.appdata.xml
+    touch dist/copyright
     mkdir -p $out
     ln -s $out/share/DisplayCAL $out/Resources
   '';

diff --git a/pkgs/applications/misc/adobe-reader/default.nix b/pkgs/applications/misc/adobe-reader/default.nix
@@ -28,5 +28,9 @@ stdenv.mkDerivation {
     description = "Adobe Reader, a viewer for PDF documents";
     homepage = http://www.adobe.com/products/reader;
     license = stdenv.lib.licenses.unfree;
+    knownVulnerabilities = [
+      "Numerous unresolved vulnerabilities"
+      "See: https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader.html?vendor_id=53"
+    ];
   };
 }
diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
@@ -123,6 +123,6 @@ buildPythonApplication rec {
     description = "A modern, hackable, featureful, OpenGL based terminal emulator";
     license = licenses.gpl3;
     platforms = platforms.darwin ++ platforms.linux;
-    maintainers = with maintainers; [ tex rvolosatovs ma27 ];
+    maintainers = with maintainers; [ tex rvolosatovs ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -90,5 +90,6 @@ mkChromiumDerivation (base: rec {
     platforms = platforms.linux;
     hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
     timeout = 172800; # 48 hours
+    broken = channel == "dev"; # Requires LLVM 11
   };
 })
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -1,5 +1,5 @@
 { newScope, config, stdenv, llvmPackages_9, llvmPackages_10
-, makeWrapper, ed
+, makeWrapper, ed, gnugrep, coreutils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , gcc, nspr, nss, patchelfUnstable, runCommand
@@ -27,7 +27,7 @@ let
 
   callPackage = newScope chromium;
 
-  chromium = {
+  chromium = rec {
     inherit stdenv llvmPackages;
 
     upstream-info = (callPackage ./update.nix {}).getChannel channel;
@@ -36,20 +36,20 @@ let
       inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useOzone;
       # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
       gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-03-23";
+        version = "2020-05-19";
         src = fetchgit {
           url = "https://gn.googlesource.com/gn";
-          rev = "5ed3c9cc67b090d5e311e4bd2aba072173e82db9";
-          sha256 = "00y2d35wvqmx9glaqhfb62wdgbfpwr77v0934nnvh9ks71vnsjqy";
+          rev = "d0a6f072070988e7b038496c4e7d6c562b649732";
+          sha256 = "0197msabskgfbxvhzq73gc3wlr3n9cr4bzrhy5z5irbvy05lxk17";
         };
       });
-    } // lib.optionalAttrs (channel == "dev") {
+    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "86") {
       gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-05-19";
+        version = "2020-07-20";
         src = fetchgit {
           url = "https://gn.googlesource.com/gn";
-          rev = "d0a6f072070988e7b038496c4e7d6c562b649732";
-          sha256 = "0197msabskgfbxvhzq73gc3wlr3n9cr4bzrhy5z5irbvy05lxk17";
+          rev = "3028c6a426a4aaf6da91c4ebafe716ae370225fe";
+          sha256 = "0h3wf4152zdvrbb0jbj49q6814lfl3rcy5mj8b2pl9s0ahvkbc6q";
         };
       });
     });
@@ -188,7 +188,7 @@ in stdenv.mkDerivation {
   '' + ''
 
     # libredirect causes chromium to deadlock on startup
-    export LD_PRELOAD="\$(echo -n "\$LD_PRELOAD" | tr ':' '\n' | grep -v /lib/libredirect\\\\.so$ | tr '\n' ':')"
+    export LD_PRELOAD="\$(echo -n "\$LD_PRELOAD" | ${coreutils}/bin/tr ':' '\n' | ${gnugrep}/bin/grep -v /lib/libredirect\\\\.so$ | ${coreutils}/bin/tr '\n' ':')"
 
     export XDG_DATA_DIRS=$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH\''${XDG_DATA_DIRS:+:}\$XDG_DATA_DIRS
 

diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.403";
+    version = "32.0.0.414";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1xirngiqypylgm8f3ddvny2ghqxgj8i98bm1carcj2vryw53wwal";
+      sha256 = "0wzf5i6qf5wgjm905kd3qh97rj47fybl9g7z72vasilbx8q5wfwk";
       stripRoot = false;
     };