NixOS · Apr 15, 2020 · Apr 22, 2020 · Apr 23, 2020 · Apr 26, 2020 · Apr 26, 2020
diff --git a/nixos/doc/manual/installation/installing.xml b/nixos/doc/manual/installation/installing.xml
@@ -41,6 +41,11 @@
    neo</command>!)
   </para>
 
+  <para>
+   If the text is too small to be legible, try <command>setfont ter-132n</command>
+   to increase the font size.
+  </para>
+
   <section xml:id="sec-installation-booting-networking">
    <title>Networking in the installer</title>
 

diff --git a/nixos/modules/installer/cd-dvd/installation-cd-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-base.nix
@@ -1,7 +1,7 @@
 # This module contains the basic configuration for building a NixOS
 # installation CD.
 
-{ config, lib, pkgs, ... }:
+{ config, lib, options, pkgs, ... }:
 
 with lib;
 
@@ -15,6 +15,9 @@ with lib;
       ../../profiles/installation-device.nix
     ];
 
+  # Adds terminus_font for people with HiDPI displays
+  console.packages = options.console.packages.default ++ [ pkgs.terminus_font ];
+
   # ISO naming.
   isoImage.isoName = "${config.isoImage.isoBaseName}-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.iso";
 

diff --git a/nixos/modules/virtualisation/podman.nix b/nixos/modules/virtualisation/podman.nix
@@ -4,18 +4,20 @@ let
 
   inherit (lib) mkOption types;
 
+  podmanPackage = (pkgs.podman.override { inherit (cfg) extraPackages; });
+
   # Provides a fake "docker" binary mapping to podman
-  dockerCompat = pkgs.runCommandNoCC "${pkgs.podman.pname}-docker-compat-${pkgs.podman.version}" {
+  dockerCompat = pkgs.runCommandNoCC "${podmanPackage.pname}-docker-compat-${podmanPackage.version}" {
     outputs = [ "out" "bin" "man" ];
-    inherit (pkgs.podman) meta;
+    inherit (podmanPackage) meta;
   } ''
     mkdir $out
 
     mkdir -p $bin/bin
-    ln -s ${pkgs.podman.bin}/bin/podman $bin/bin/docker
+    ln -s ${podmanPackage.bin}/bin/podman $bin/bin/docker
 
     mkdir -p $man/share/man/man1
-    for f in ${pkgs.podman.man}/share/man/man1/*; do
+    for f in ${podmanPackage.man}/share/man/man1/*; do
       basename=$(basename $f | sed s/podman/docker/g)
       ln -s $f $man/share/man/man1/$basename
     done
@@ -54,6 +56,19 @@ in
       '';
     };
 
+    extraPackages = mkOption {
+      type = with types; listOf package;
+      default = [ ];
+      example = lib.literalExample ''
+        [
+          pkgs.gvisor
+        ]
+      '';
+      description = ''
+        Extra packages to be installed in the Podman wrapper.
+      '';
+    };
+
     libpod = mkOption {
       default = {};
       description = "Libpod configuration";
@@ -77,25 +92,15 @@ in
 
   config = lib.mkIf cfg.enable {
 
-    environment.systemPackages = [
-      pkgs.podman # Docker compat
-      pkgs.runc # Default container runtime
-      pkgs.crun # Default container runtime (cgroups v2)
-      pkgs.conmon # Container runtime monitor
-      pkgs.slirp4netns # User-mode networking for unprivileged namespaces
-      pkgs.fuse-overlayfs # CoW for images, much faster than default vfs
-      pkgs.utillinux # nsenter
-      pkgs.iptables
-    ]
-    ++ lib.optional cfg.dockerCompat dockerCompat;
+    environment.systemPackages = [ podmanPackage ]
+      ++ lib.optional cfg.dockerCompat dockerCompat;
 
     environment.etc."containers/libpod.conf".text = ''
       cni_plugin_dir = ["${pkgs.cni-plugins}/bin/"]
-      cni_config_dir = "/etc/cni/net.d/"
 
     '' + cfg.libpod.extraConfig;
 
-    environment.etc."cni/net.d/87-podman-bridge.conflist".source = copyFile "${pkgs.podman.src}/cni/87-podman-bridge.conflist";
+    environment.etc."cni/net.d/87-podman-bridge.conflist".source = copyFile "${pkgs.podman-unwrapped.src}/cni/87-podman-bridge.conflist";
 
     # Enable common /etc/containers configuration
     virtualisation.containers.enable = true;

diff --git a/nixos/tests/elk.nix b/nixos/tests/elk.nix
@@ -101,6 +101,7 @@ let
                       prefixed indices. Ignore the error if the filter does not result in an
                       actionable list of indices (ignore_empty_list) and exit cleanly.
                     options:
+                      allow_ilm_indices: true
                       ignore_empty_list: True
                       disable_action: False
                     filters:

diff --git a/nixos/tests/google-oslogin/default.nix b/nixos/tests/google-oslogin/default.nix
@@ -22,17 +22,19 @@ in {
     client = { ... }: {};
   };
   testScript =  ''
+    MOCKUSER = "mockuser_nixos_org"
+    MOCKADMIN = "mockadmin_nixos_org"
     start_all()
 
     server.wait_for_unit("mock-google-metadata.service")
     server.wait_for_open_port(80)
 
     # mockserver should return a non-expired ssh key for both mockuser and mockadmin
     server.succeed(
-        '${pkgs.google-compute-engine-oslogin}/bin/google_authorized_keys mockuser | grep -q "${snakeOilPublicKey}"'
+        f'${pkgs.google-compute-engine-oslogin}/bin/google_authorized_keys {MOCKUSER} | grep -q "${snakeOilPublicKey}"'
     )
     server.succeed(
-        '${pkgs.google-compute-engine-oslogin}/bin/google_authorized_keys mockadmin | grep -q "${snakeOilPublicKey}"'
+        f'${pkgs.google-compute-engine-oslogin}/bin/google_authorized_keys {MOCKADMIN} | grep -q "${snakeOilPublicKey}"'
     )
 
     # install snakeoil ssh key on the client, and provision .ssh/config file
@@ -50,20 +52,22 @@ in {
     client.fail("ssh ghost@server 'true'")
 
     # we should be able to connect as mockuser
-    client.succeed("ssh mockuser@server 'true'")
+    client.succeed(f"ssh {MOCKUSER}@server 'true'")
     # but we shouldn't be able to sudo
     client.fail(
-        "ssh mockuser@server '/run/wrappers/bin/sudo /run/current-system/sw/bin/id' | grep -q 'root'"
+        f"ssh {MOCKUSER}@server '/run/wrappers/bin/sudo /run/current-system/sw/bin/id' | grep -q 'root'"
     )
 
     # we should also be able to log in as mockadmin
-    client.succeed("ssh mockadmin@server 'true'")
+    client.succeed(f"ssh {MOCKADMIN}@server 'true'")
     # pam_oslogin_admin.so should now have generated a sudoers file
-    server.succeed("find /run/google-sudoers.d | grep -q '/run/google-sudoers.d/mockadmin'")
+    server.succeed(
+        f"find /run/google-sudoers.d | grep -q '/run/google-sudoers.d/{MOCKADMIN}'"
+    )
 
     # and we should be able to sudo
     client.succeed(
-        "ssh mockadmin@server '/run/wrappers/bin/sudo /run/current-system/sw/bin/id' | grep -q 'root'"
+        f"ssh {MOCKADMIN}@server '/run/wrappers/bin/sudo /run/current-system/sw/bin/id' | grep -q 'root'"
     )
   '';
   })

diff --git a/nixos/tests/google-oslogin/server.py b/nixos/tests/google-oslogin/server.py
@@ -7,24 +7,29 @@
 import base64
 
 from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import urlparse, parse_qs
 from typing import Dict
 
 SNAKEOIL_PUBLIC_KEY = os.environ['SNAKEOIL_PUBLIC_KEY']
+MOCKUSER="mockuser_nixos_org"
+MOCKADMIN="mockadmin_nixos_org"
 
 
-def w(msg):
+def w(msg: bytes):
     sys.stderr.write(f"{msg}\n")
     sys.stderr.flush()
 
 
-def gen_fingerprint(pubkey):
+def gen_fingerprint(pubkey: str):
     decoded_key = base64.b64decode(pubkey.encode("ascii").split()[1])
     return hashlib.sha256(decoded_key).hexdigest()
 
-def gen_email(username):
+
+def gen_email(username: str):
     """username seems to be a 21 characters long number string, so mimic that in a reproducible way"""
     return str(int(hashlib.sha256(username.encode()).hexdigest(), 16))[0:21]
 
+
 def gen_mockuser(username: str, uid: str, gid: str, home_directory: str, snakeoil_pubkey: str) -> Dict:
     snakeoil_pubkey_fingerprint = gen_fingerprint(snakeoil_pubkey)
     # seems to be a 21 characters long numberstring, so mimic that in a reproducible way
@@ -56,37 +61,71 @@ def gen_mockuser(username: str, uid: str, gid: str, home_directory: str, snakeoi
 
 
 class ReqHandler(BaseHTTPRequestHandler):
-    def _send_json_ok(self, data):
+
+    def _send_json_ok(self, data: dict):
         self.send_response(200)
         self.send_header('Content-type', 'application/json')
         self.end_headers()
         out = json.dumps(data).encode()
         w(out)
         self.wfile.write(out)
 
+    def _send_json_success(self, success=True):
+        self.send_response(200)
+        self.send_header('Content-type', 'application/json')
+        self.end_headers()
+        out = json.dumps({"success": success}).encode()
+        w(out)
+        self.wfile.write(out)
+
+    def _send_404(self):
+        self.send_response(404)
+        self.end_headers()
+
     def do_GET(self):
         p = str(self.path)
-        # mockuser and mockadmin are allowed to login, both use the same snakeoil public key
-        if p == '/computeMetadata/v1/oslogin/users?username=mockuser' \
-            or p == '/computeMetadata/v1/oslogin/users?uid=1009719690':
-            self._send_json_ok(gen_mockuser(username='mockuser', uid='1009719690', gid='1009719690',
-                                            home_directory='/home/mockuser', snakeoil_pubkey=SNAKEOIL_PUBLIC_KEY))
-        elif p == '/computeMetadata/v1/oslogin/users?username=mockadmin' \
-            or p == '/computeMetadata/v1/oslogin/users?uid=1009719691':
-            self._send_json_ok(gen_mockuser(username='mockadmin', uid='1009719691', gid='1009719691',
-                                            home_directory='/home/mockadmin', snakeoil_pubkey=SNAKEOIL_PUBLIC_KEY))
-
-        # mockuser is allowed to login
-        elif p == f"/computeMetadata/v1/oslogin/authorize?email={gen_email('mockuser')}&policy=login":
-            self._send_json_ok({'success': True})
-
-        # mockadmin may also become root
-        elif p == f"/computeMetadata/v1/oslogin/authorize?email={gen_email('mockadmin')}&policy=login" or p == f"/computeMetadata/v1/oslogin/authorize?email={gen_email('mockadmin')}&policy=adminLogin":
-            self._send_json_ok({'success': True})
+        pu = urlparse(p)
+        params = parse_qs(pu.query)
+
+        # users endpoint
+        if pu.path == "/computeMetadata/v1/oslogin/users":
+            # mockuser and mockadmin are allowed to login, both use the same snakeoil public key
+            if params.get('username') == [MOCKUSER] or params.get('uid') == ["1009719690"]:
+                username = MOCKUSER
+                uid = "1009719690"
+            elif params.get('username') == [MOCKADMIN] or params.get('uid') == ["1009719691"]:
+                username = MOCKADMIN
+                uid = "1009719691"
+            else:
+                self._send_404()
+                return
+
+            self._send_json_ok(gen_mockuser(username=username, uid=uid, gid=uid, home_directory=f"/home/{username}", snakeoil_pubkey=SNAKEOIL_PUBLIC_KEY))
+            return
+
+        # authorize endpoint
+        elif pu.path == "/computeMetadata/v1/oslogin/authorize":
+            # is user allowed to login?
+            if params.get("policy") == ["login"]:
+                # mockuser and mockadmin are allowed to login
+                if params.get('email') == [gen_email(MOCKUSER)] or params.get('email') == [gen_email(MOCKADMIN)]:
+                    self._send_json_success()
+                    return
+                self._send_json_success(False)
+                return
+            # is user allowed to become root?
+            elif params.get("policy") == ["adminLogin"]:
+                # only mockadmin is allowed to become admin
+                self._send_json_success((params['email'] == [gen_email(MOCKADMIN)]))
+                return
+            # send 404 for other policies
+            else:
+                self._send_404()
+                return
         else:
             sys.stderr.write(f"Unhandled path: {p}\n")
             sys.stderr.flush()
-            self.send_response(501)
+            self.send_response(404)
             self.end_headers()
             self.wfile.write(b'')
 

diff --git a/pkgs/applications/misc/st/default.nix b/pkgs/applications/misc/st/default.nix
@@ -13,9 +13,8 @@ stdenv.mkDerivation rec {
 
   inherit patches;
 
-  prePatch = optionalString (conf != null) ''
-    cp ${writeText "config.def.h" conf} config.def.h
-  '';
+  configFile = optionalString (conf!=null) (writeText "config.def.h" conf);
+  postPatch = optionalString (conf!=null) "cp ${configFile} config.def.h";
 
   nativeBuildInputs = [ pkgconfig ncurses ];
   buildInputs = [ libX11 libXft ] ++ extraLibs;

diff --git a/pkgs/applications/networking/cluster/terraform-providers/data.nix b/pkgs/applications/networking/cluster/terraform-providers/data.nix
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -50,9 +50,10 @@ let
 
   # These are the providers that don't fall in line with the default model
   special-providers = {
-    # Override the google providers
+    # Override providers that use Go modules + vendor/ folder
     google = patchGoModVendor automated-providers.google;
     google-beta = patchGoModVendor automated-providers.google-beta;
+    ibm = patchGoModVendor automated-providers.ibm;
 
     # providers that were moved to the `hashicorp` organization,
     # but haven't updated their references yet:
@@ -129,12 +130,13 @@ let
       '';
     });
 
-    elasticsearch = callPackage ./elasticsearch {};
+    # Packages that don't fit the default model
+    ansible = callPackage ./ansible {};
     gandi = callPackage ./gandi {};
-    ibm = callPackage ./ibm {};
+    elasticsearch = callPackage ./elasticsearch {};
     libvirt = callPackage ./libvirt {};
     lxd = callPackage ./lxd {};
-    ansible = callPackage ./ansible {};
+    vpsadmin = callPackage ./vpsadmin {};
   };
 in
   automated-providers // special-providers
diff --git a/pkgs/applications/networking/cluster/terraform-providers/ibm/default.nix b/pkgs/applications/networking/cluster/terraform-providers/ibm/default.nix
diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-all b/pkgs/applications/networking/cluster/terraform-providers/update-all
@@ -112,8 +112,10 @@ cd "$(dirname "$0")"
 
 # individual repos to fetch
 slugs=(
+  IBM-Cloud/terraform-provider-ibm
   ajbosco/terraform-provider-segment
   camptocamp/terraform-provider-pass
+  carlpett/terraform-provider-sops
   poseidon/terraform-provider-matchbox
   spaceapegames/terraform-provider-wavefront
   tweag/terraform-provider-nixos

diff --git a/pkgs/applications/networking/cluster/terraform-providers/vpsadmin/default.nix b/pkgs/applications/networking/cluster/terraform-providers/vpsadmin/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, buildGoModule }:
+buildGoModule rec {
+  pname = "terraform-provider-vpsadmin";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "vpsfreecz";
+    repo = "terraform-provider-vpsadmin";
+    rev = "v${version}";
+    hash = "sha256-+6jRjcManQdoKh7ewOJI1UaulY5OSbkIUHmtrBI33u4=";
+  };
+
+  modSha256 = "sha256-gz+t50uHFj4BQnJg6kOJI/joJVE+usLpVzTqziek2wY=";
+
+  subPackages = [ "." ];
+
+  # Terraform allow checking the provider versions, but this breaks
+  # if the versions are not provided via file paths.
+  postInstall = "mv $out/bin/${pname}{,_v${version}}";
+
+  meta = with stdenv.lib; {
+    description = "Terraform provider for vpsAdmin";
+    homepage = "https://github.com/vpsfreecz/terraform-provider-vpsadmin";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ zimbatm ];
+  };
+}
diff --git a/pkgs/applications/virtualization/podman/wrapper.nix b/pkgs/applications/virtualization/podman/wrapper.nix
@@ -0,0 +1,48 @@
+{ podman-unwrapped
+, runCommand
+, makeWrapper
+, lib
+, extraPackages ? []
+, podman # Docker compat
+, runc # Default container runtime
+, crun # Default container runtime (cgroups v2)
+, conmon # Container runtime monitor
+, slirp4netns # User-mode networking for unprivileged namespaces
+, fuse-overlayfs # CoW for images, much faster than default vfs
+, utillinux # nsenter
+, cni-plugins
+, iptables
+}:
+
+let
+  podman = podman-unwrapped;
+
+  binPath = lib.makeBinPath ([
+    runc
+    crun
+    conmon
+    slirp4netns
+    fuse-overlayfs
+    utillinux
+    iptables
+  ] ++ extraPackages);
+
+in runCommand podman.name {
+  inherit (podman) name pname version meta outputs;
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+} ''
+  # Symlink everything but $bin from podman-unwrapped
+  ${
+    lib.concatMapStringsSep "\n"
+    (o: "ln -s ${podman.${o}} ${placeholder o}")
+    (builtins.filter (o: o != "bin")
+    podman.outputs)}
+
+  mkdir -p $bin/bin
+  ln -s ${podman-unwrapped}/share $bin/share
+  makeWrapper ${podman-unwrapped}/bin/podman $bin/bin/podman \
+    --prefix PATH : ${binPath}
+''
diff --git a/pkgs/build-support/ocaml/dune.nix b/pkgs/build-support/ocaml/dune.nix
@@ -1,6 +1,6 @@
 { stdenv, ocaml, findlib, dune, dune_2, opaline }:
 
-{ pname, version, buildInputs ? [], ... }@args:
+{ pname, version, buildInputs ? [], enableParallelBuilding ? true, ... }@args:
 
 let Dune = if args.useDune2 or false then dune_2 else dune; in
 
@@ -11,14 +11,16 @@ else
 
 stdenv.mkDerivation ({
 
+  inherit enableParallelBuilding;
+
   buildPhase = ''
     runHook preBuild
-    dune build -p ${pname}
+    dune build -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
     runHook postBuild
   '';
   checkPhase = ''
     runHook preCheck
-    dune runtest -p ${pname}
+    dune runtest -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
     runHook postCheck
   '';
   installPhase = ''

diff --git a/pkgs/development/compilers/dmd/binary.nix b/pkgs/development/compilers/dmd/binary.nix
@@ -0,0 +1,52 @@
+{ stdenv, fetchurl, curl, tzdata, autoPatchelfHook, fixDarwinDylibNames, glibc
+, version, hashes }:
+with stdenv;
+let
+  OS = if hostPlatform.isDarwin then "osx" else hostPlatform.parsed.kernel.name;
+  MODEL = toString hostPlatform.parsed.cpu.bits;
+in mkDerivation {
+  pname = "dmd-bootstrap";
+  inherit version;
+
+  src = fetchurl rec {
+    name = "dmd.${version}.${OS}.tar.xz";
+    url = "http://downloads.dlang.org/releases/2.x/${version}/${name}";
+    sha256 = hashes.${OS} or (throw "missing bootstrap sha256 for OS ${OS}");
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ fixDarwinDylibNames autoPatchelfHook ];
+  propagatedBuildInputs = [ curl tzdata ] ++ lib.optional hostPlatform.isLinux glibc;
+
+  installPhase = ''
+    mkdir -p $out
+
+    # try to copy model-specific binaries into bin first
+    mv ${OS}/bin${MODEL} $out/bin || true
+
+    mv src license.txt ${OS}/* $out/
+
+    # move man into place
+    mkdir -p $out/share
+    mv man $out/share/
+
+    # move docs into place
+    mkdir -p $out/share/doc
+    mv html/d $out/share/doc/
+
+    # fix paths in dmd.conf (one level less)
+    substituteInPlace $out/bin/dmd.conf --replace "/../../" "/../"
+  '';
+
+  meta = with lib; {
+    inherit version;
+    description = "Digital Mars D Compiler Package";
+    # As of 2.075 all sources and binaries use the boost license
+    license = licenses.boost;
+    maintainers = [ maintainers.lionello ];
+    homepage = "https://dlang.org/";
+    platforms = [ "x86_64-darwin" "i686-linux" "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/development/compilers/dmd/bootstrap.nix b/pkgs/development/compilers/dmd/bootstrap.nix
@@ -0,0 +1,9 @@
+{ callPackage }:
+callPackage ./binary.nix {
+  version = "2.090.1";
+  hashes = {
+    # Get these from `nix-prefetch-url http://downloads.dlang.org/releases/2.x/2.090.1/dmd.2.090.1.linux.tar.xz` etc..
+    osx = "0rbn7j4dr3q0y09fblpj999bi063pi4230rqd5xgd3gwxxa0cz7l";
+    linux = "1vk6lsvd6y7ccvffd23yial4ig90azaxf2rxc6yvidqd1qhan807";
+  };
+}
diff --git a/pkgs/development/compilers/dmd/default.nix b/pkgs/development/compilers/dmd/default.nix
@@ -1,11 +1,13 @@
 { stdenv, lib, fetchFromGitHub
 , makeWrapper, unzip, which, writeTextFile
-, curl, tzdata, gdb, darwin, git
-, targetPackages, ldc
-, version ? "2.085.1"
-, dmdSha256 ? "0ccidfcawrcwdpfjwjiln5xwr4ffp8i2hwx52p8zn3xmc5yxm660"
-, druntimeSha256 ? "109f2glsqrlshk06761xlw4r5v22mivp873cq9g5gcax3g00k617"
-, phobosSha256 ? "0giispqqx8j8xg6c0hm7nx77bcahiwic8rvf12sws3sv5pizv8pr"
+, curl, tzdata, gdb, darwin, git, callPackage
+, targetPackages, fetchpatch, bash
+, dmdBootstrap ? callPackage ./bootstrap.nix { }
+, HOST_DMD ? "${dmdBootstrap}/bin/dmd"
+, version ? "2.091.1"
+, dmdSha256 ? "0brz0n84jdkhr4sq4k91w48p739psbhbb1jk2pi9q60psmx353yr"
+, druntimeSha256 ? "0smgpmfriffh110ksski1s5j921kmxbc2zjy0dyj9ksyrxbzklbl"
+, phobosSha256 ? "1n00anajgibrfs1xzvrmag28hvbvkc0w1fwlimqbznvhf28rhrxs"
 }:
 
 let
@@ -51,7 +53,17 @@ stdenv.mkDerivation rec {
   })
   ];
 
-  patchFlags = [ "--directory=dmd" "-p1" ];
+  patchFlags = [ "--directory=dmd" "-p1" "-F3" ];
+  patches = [
+    (fetchpatch {
+     url = "https://github.com/dlang/dmd/commit/4157298cf04f7aae9f701432afd1de7b7e05c30f.patch";
+     sha256 = "0v4xgqmrx5r8vbx5a4v88s0xnm23mam9nm99yfga7s2sxr0hi5p2";
+    })
+    (fetchpatch {
+     url = "https://github.com/dlang/dmd/commit/1b8a4c90b040bf2f0b68a2739de4991315580b13.patch";
+     sha256 = "1iih6aalv4fsw9mbrlrybhngkkchzzrzg7q8zl047w36c0x397cs";
+    })
+  ];
 
   sourceRoot = ".";
 
@@ -62,15 +74,17 @@ stdenv.mkDerivation rec {
       patchShebangs .
   '';
 
-  postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isLinux ''
+  postPatch = ''
+      substituteInPlace dmd/test/dshell/test6952.d --replace "/usr/bin/env bash" "${bash}/bin/bash"
+  ''
+  + stdenv.lib.optionalString stdenv.hostPlatform.isLinux ''
       substituteInPlace phobos/std/socket.d --replace "assert(ih.addrList[0] == 0x7F_00_00_01);" ""
   ''
-
   + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace phobos/std/socket.d --replace "foreach (name; names)" "names = []; foreach (name; names)"
   '';
 
-  nativeBuildInputs = [ ldc makeWrapper unzip which gdb git ]
+  nativeBuildInputs = [ makeWrapper unzip which gdb git ]
 
   ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
     Foundation
@@ -89,7 +103,7 @@ stdenv.mkDerivation rec {
   # Buid and install are based on http://wiki.dlang.org/Building_DMD
   buildPhase = ''
       cd dmd
-      make -j$NIX_BUILD_CORES -f posix.mak INSTALL_DIR=$out BUILD=release ENABLE_RELEASE=1 PIC=1 HOST_DMD=ldmd2
+      make -j$NIX_BUILD_CORES -f posix.mak INSTALL_DIR=$out BUILD=release ENABLE_RELEASE=1 PIC=1 HOST_DMD=${HOST_DMD}
       cd ../druntime
       make -j$NIX_BUILD_CORES -f posix.mak BUILD=release ENABLE_RELEASE=1 PIC=1 INSTALL_DIR=$out DMD=${pathToDmd}
       cd ../phobos
@@ -147,8 +161,7 @@ stdenv.mkDerivation rec {
     # Everything is now Boost licensed, even the backend.
     # https://github.com/dlang/dmd/pull/6680
     license = licenses.boost;
-    maintainers = with maintainers; [ ThomasMader ];
+    maintainers = with maintainers; [ ThomasMader lionello ];
     platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
   };
 }
-
diff --git a/pkgs/development/compilers/ldc/binary.nix b/pkgs/development/compilers/ldc/binary.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, curl, tzdata, autoPatchelfHook, fixDarwinDylibNames, libxml2
+, version, hashes }:
+with stdenv;
+let
+  OS = if hostPlatform.isDarwin then "osx" else hostPlatform.parsed.kernel.name;
+  ARCH = toString hostPlatform.parsed.cpu.name;
+in mkDerivation {
+  pname = "ldc-bootstrap";
+  inherit version;
+
+  src = fetchurl rec {
+    name = "ldc2-${version}-${OS}-${ARCH}.tar.xz";
+    url = "https://github.com/ldc-developers/ldc/releases/download/v${version}/${name}";
+    sha256 = hashes."${OS}-${ARCH}" or (throw "missing bootstrap sha256 for ${OS}-${ARCH}");
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ fixDarwinDylibNames autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxml2 stdenv.cc.cc ];
+
+  propagatedBuildInputs = [ curl tzdata ];
+
+  installPhase = ''
+    mkdir -p $out
+
+    mv bin etc import lib LICENSE README $out/
+  '';
+
+  meta = with lib; {
+    inherit version;
+    description = "The LLVM-based D Compiler";
+    homepage = "https://github.com/ldc-developers/ldc";
+    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
+    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
+    maintainers = with maintainers; [ ThomasMader lionello ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" ];
+  };
+}
diff --git a/pkgs/development/compilers/ldc/bootstrap.nix b/pkgs/development/compilers/ldc/bootstrap.nix
@@ -0,0 +1,10 @@
+{ callPackage }:
+callPackage ./binary.nix {
+  version = "1.19.0";
+  hashes = {
+    # Get these from `nix-prefetch-url https://github.com/ldc-developers/ldc/releases/download/v1.19.0/ldc2-1.19.0-osx-x86_64.tar.xz` etc..
+    osx-x86_64 = "1bp3xkh9zp64dzq8isanib1gacb3nfbl70qv15qygwk1zan6zgy7";
+    linux-x86_64 = "146grr2lwarfk13wgkpyb77xb6b3as1is2rf4s2hipqjmc8biy1h";
+    linux-aarch64  = "1fv6jshfvi15m7masgxq1hgp216qjd5amizrqdf26vhrq3a08li3";
+  };
+}
diff --git a/pkgs/development/compilers/ldc/default.nix b/pkgs/development/compilers/ldc/default.nix
@@ -1,173 +1,5 @@
-{ stdenv, fetchurl, cmake, ninja, llvm_5, llvm_8, curl, tzdata
-, libconfig, lit, gdb, unzip, darwin, bash
-, callPackage, makeWrapper, runCommand, targetPackages
-, bootstrapVersion ? false
-, version ? "1.17.0"
-, ldcSha256 ? "1aag5jfrng6p4ms0fs90hjbv9bcj3hj8h52r68c3cm6racdajbva"
-}:
-
-let
-  bootstrapLdc = if !bootstrapVersion then
-    # LDC 0.17.x is the last version which doesn't need a working D compiler to
-    # build so we use that version to bootstrap the actual build.
-    callPackage ./default.nix {
-      bootstrapVersion = true;
-      version = "0.17.6";
-      ldcSha256 = "0qf5kbxddgmg3kqzi0kf4bgv8vdrnv16y07hcpm0cwv9mc3qr2w6";
-    }
-  else
-    "";
-
-  pathConfig = runCommand "ldc-lib-paths" {} ''
-    mkdir $out
-    echo ${tzdata}/share/zoneinfo/ > $out/TZDatabaseDirFile
-    echo ${curl.out}/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} > $out/LibcurlPathFile
-  '';
-in
-
-stdenv.mkDerivation rec {
-  pname = "ldc";
-  inherit version;
-
-  enableParallelBuilding = true;
-
-  src = fetchurl {
-    url = "https://github.com/ldc-developers/ldc/releases/download/v${version}/ldc-${version}-src.tar.gz";
-    sha256 = ldcSha256;
-  };
-
-  # https://issues.dlang.org/show_bug.cgi?id=19553
-  hardeningDisable = [ "fortify" ];
-
-  postUnpack = ''
-    patchShebangs .
-  ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion) ''
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/fail_compilation/mixin_gc.d
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/xtest46_gc.d
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/testptrref_gc.d
-
-      # test depends on current year
-      rm ldc-${version}-src/tests/d2/dmd-testsuite/compilable/ddocYear.d
-  ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion && stdenv.hostPlatform.isDarwin) ''
-      # https://github.com/NixOS/nixpkgs/issues/34817
-      rm -r ldc-${version}-src/tests/plugins/addFuncEntryCall
-  '';
-
-  postPatch = ''
-      # Setting SHELL=$SHELL when dmd testsuite is run doesn't work on Linux somehow
-      substituteInPlace tests/d2/dmd-testsuite/Makefile --replace "SHELL=/bin/bash" "SHELL=${bash}/bin/bash"
-    ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion && stdenv.hostPlatform.isLinux) ''
-      substituteInPlace runtime/phobos/std/socket.d --replace "assert(ih.addrList[0] == 0x7F_00_00_01);" ""
-  ''
-
-  + stdenv.lib.optionalString (!bootstrapVersion && stdenv.hostPlatform.isDarwin) ''
-      substituteInPlace runtime/phobos/std/socket.d --replace "foreach (name; names)" "names = []; foreach (name; names)"
-  ''
-
-  + stdenv.lib.optionalString (bootstrapVersion && stdenv.hostPlatform.isDarwin) ''
-      # Was not able to compile on darwin due to "__inline_isnanl"
-      # being undefined.
-      # TODO Remove with version > 0.17.6
-      substituteInPlace dmd2/root/port.c --replace __inline_isnanl __inline_isnan
-  '';
-
-  nativeBuildInputs = [ cmake ninja makeWrapper unzip ]
-    ++ stdenv.lib.optionals (!bootstrapVersion) [
-      bootstrapLdc lit lit.python
-    ]
-    ++ stdenv.lib.optional (!bootstrapVersion && stdenv.hostPlatform.isDarwin)
-      # https://github.com/NixOS/nixpkgs/issues/57120
-      # https://github.com/NixOS/nixpkgs/pull/59197#issuecomment-481972515
-      llvm_5
-    ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin)
-      llvm_8
-    ++ stdenv.lib.optional (!bootstrapVersion && !stdenv.hostPlatform.isDarwin)
-      # https://github.com/NixOS/nixpkgs/pull/36378#issuecomment-385034818
-      gdb
-    ++ stdenv.lib.optionals (bootstrapVersion) [
-      libconfig llvm_5
-    ]
-    ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin
-      darwin.apple_sdk.frameworks.Foundation;
-
-
-  buildInputs = [ curl tzdata ];
-
-  cmakeFlags = stdenv.lib.optionals (!bootstrapVersion) [
-    "-DD_FLAGS=-d-version=TZDatabaseDir;-d-version=LibcurlPath;-J${pathConfig}"
-    "-DCMAKE_BUILD_TYPE=Release"
-  ];
-
-  postConfigure = ''
-    export DMD=$PWD/bin/ldmd2
-  '';
-
-  makeFlags = [ "DMD=$DMD" ];
-
-  fixNames = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin  ''
-    fixDarwinDylibNames() {
-      local flags=()
-
-      for fn in "$@"; do
-        flags+=(-change "$(basename "$fn")" "$fn")
-      done
-
-      for fn in "$@"; do
-        if [ -L "$fn" ]; then continue; fi
-        echo "$fn: fixing dylib"
-        install_name_tool -id "$fn" "''${flags[@]}" "$fn"
-      done
-    }
-
-    fixDarwinDylibNames $(find "$(pwd)/lib" -name "*.dylib")
-    export DYLD_LIBRARY_PATH=$(pwd)/lib
-  '';
-
-  # https://github.com/ldc-developers/ldc/issues/2497#issuecomment-459633746
-  additionalExceptions = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin
-    "|druntime-test-shared";
-
-  doCheck = !bootstrapVersion;
-
-  checkPhase = stdenv.lib.optionalString doCheck ''
-    # Build default lib test runners
-    ninja -j$NIX_BUILD_CORES all-test-runners
-
-    ${fixNames}
-
-    # Run dmd testsuite
-    export DMD_TESTSUITE_MAKE_ARGS="-j$NIX_BUILD_CORES DMD=$DMD CC=$CXX"
-    ctest -V -R "dmd-testsuite"
-
-    # Build and run LDC D unittests.
-    ctest --output-on-failure -R "ldc2-unittest"
-
-    # Run LIT testsuite.
-    ctest -V -R "lit-tests"
-
-    # Run default lib unittests
-    ctest -j$NIX_BUILD_CORES --output-on-failure -E "ldc2-unittest|lit-tests|dmd-testsuite${additionalExceptions}"
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/ldc2 \
-        --prefix PATH ":" "${targetPackages.stdenv.cc}/bin" \
-        --set-default CC "${targetPackages.stdenv.cc}/bin/cc"
-   '';
-
-  meta = with stdenv.lib; {
-    description = "The LLVM-based D compiler";
-    homepage = "https://github.com/ldc-developers/ldc";
-    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
-    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
-    maintainers = with maintainers; [ ThomasMader ];
-    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
-  };
+import ./generic.nix {
+  version = "1.20.1";
+  ldcSha256 = "1bqsgab22v02pc3c9gcyf15y7aimadv24d68icaw5lpgnvzxy89b";
 }
 
diff --git a/pkgs/development/compilers/ldc/generic.nix b/pkgs/development/compilers/ldc/generic.nix
@@ -0,0 +1,143 @@
+{ version, ldcSha256 }:
+{ stdenv, fetchurl, cmake, ninja, llvm_5, llvm_8, curl, tzdata
+, libconfig, lit, gdb, unzip, darwin, bash
+, callPackage, makeWrapper, runCommand, targetPackages
+, ldcBootstrap ? callPackage ./bootstrap.nix { }
+}:
+
+let
+  pathConfig = runCommand "ldc-lib-paths" {} ''
+    mkdir $out
+    echo ${tzdata}/share/zoneinfo/ > $out/TZDatabaseDirFile
+    echo ${curl.out}/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} > $out/LibcurlPathFile
+  '';
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "ldc";
+  inherit version;
+
+  enableParallelBuilding = true;
+
+  src = fetchurl {
+    url = "https://github.com/ldc-developers/ldc/releases/download/v${version}/ldc-${version}-src.tar.gz";
+    sha256 = ldcSha256;
+  };
+
+  # https://issues.dlang.org/show_bug.cgi?id=19553
+  hardeningDisable = [ "fortify" ];
+
+  postUnpack = ''
+    patchShebangs .
+  ''
+  + ''
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/fail_compilation/mixin_gc.d
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/xtest46_gc.d
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/runnable/testptrref_gc.d
+
+      # test depends on current year
+      rm ldc-${version}-src/tests/d2/dmd-testsuite/compilable/ddocYear.d
+  ''
+  + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # https://github.com/NixOS/nixpkgs/issues/34817
+      rm -r ldc-${version}-src/tests/plugins/addFuncEntryCall
+  '';
+
+  postPatch = ''
+    # Setting SHELL=$SHELL when dmd testsuite is run doesn't work on Linux somehow
+    substituteInPlace tests/d2/dmd-testsuite/Makefile --replace "SHELL=/bin/bash" "SHELL=${bash}/bin/bash"
+  ''
+  + stdenv.lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace runtime/phobos/std/socket.d --replace "assert(ih.addrList[0] == 0x7F_00_00_01);" ""
+  ''
+  + stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace runtime/phobos/std/socket.d --replace "foreach (name; names)" "names = []; foreach (name; names)"
+  '';
+
+  nativeBuildInputs = [
+    cmake ninja makeWrapper unzip ldcBootstrap lit lit.python
+  ]
+  ++ stdenv.lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.apple_sdk.frameworks.Foundation
+    # https://github.com/NixOS/nixpkgs/issues/57120
+    # https://github.com/NixOS/nixpkgs/pull/59197#issuecomment-481972515
+    llvm_5
+  ]
+  ++ stdenv.lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    llvm_8
+    # https://github.com/NixOS/nixpkgs/pull/36378#issuecomment-385034818
+    gdb
+  ];
+
+  buildInputs = [ curl tzdata ];
+
+  cmakeFlags = [
+    "-DD_FLAGS=-d-version=TZDatabaseDir;-d-version=LibcurlPath;-J${pathConfig}"
+    "-DCMAKE_BUILD_TYPE=Release"
+  ];
+
+  postConfigure = ''
+    export DMD=$PWD/bin/ldmd2
+  '';
+
+  makeFlags = [ "DMD=$DMD" ];
+
+  fixNames = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin  ''
+    fixDarwinDylibNames() {
+      local flags=()
+
+      for fn in "$@"; do
+        flags+=(-change "$(basename "$fn")" "$fn")
+      done
+
+      for fn in "$@"; do
+        if [ -L "$fn" ]; then continue; fi
+        echo "$fn: fixing dylib"
+        install_name_tool -id "$fn" "''${flags[@]}" "$fn"
+      done
+    }
+
+    fixDarwinDylibNames $(find "$(pwd)/lib" -name "*.dylib")
+    export DYLD_LIBRARY_PATH=$(pwd)/lib
+  '';
+
+  # https://github.com/ldc-developers/ldc/issues/2497#issuecomment-459633746
+  additionalExceptions = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin
+    "|druntime-test-shared";
+
+  checkPhase = ''
+    # Build default lib test runners
+    ninja -j$NIX_BUILD_CORES all-test-runners
+
+    ${fixNames}
+
+    # Run dmd testsuite
+    export DMD_TESTSUITE_MAKE_ARGS="-j$NIX_BUILD_CORES DMD=$DMD"
+    ctest -V -R "dmd-testsuite"
+
+    # Build and run LDC D unittests.
+    ctest --output-on-failure -R "ldc2-unittest"
+
+    # Run LIT testsuite.
+    ctest -V -R "lit-tests"
+
+    # Run default lib unittests
+    ctest -j$NIX_BUILD_CORES --output-on-failure -E "ldc2-unittest|lit-tests|dmd-testsuite${additionalExceptions}"
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/ldc2 \
+        --prefix PATH ":" "${targetPackages.stdenv.cc}/bin" \
+        --set-default CC "${targetPackages.stdenv.cc}/bin/cc"
+   '';
+
+  meta = with stdenv.lib; {
+    description = "The LLVM-based D compiler";
+    homepage = "https://github.com/ldc-developers/ldc";
+    # from https://github.com/ldc-developers/ldc/blob/master/LICENSE
+    license = with licenses; [ bsd3 boost mit ncsa gpl2Plus ];
+    maintainers = with maintainers; [ ThomasMader lionello ];
+    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
+  };
+}
diff --git a/pkgs/development/libraries/libeatmydata/default.nix b/pkgs/development/libraries/libeatmydata/default.nix
@@ -1,23 +1,41 @@
-{ stdenv, fetchurl, makeWrapper }:
+{ stdenv, fetchFromGitHub, autoreconfHook, strace, which }:
 
 stdenv.mkDerivation rec {
-  name = "libeatmydata-105";
+  pname = "libeatmydata";
+  version = "105";
 
-  src = fetchurl {
-    url = "https://www.flamingspork.com/projects/libeatmydata/${name}.tar.gz";
-    sha256 = "1pd8sc73cgc41ldsvq6g8ics1m5k8gdcb91as9yg8z5jnrld1lmx";
+  src = fetchFromGitHub {
+    owner = "stewartsmith";
+    repo = pname;
+    rev = "${pname}-${version}";
+    sha256 = "0sx803h46i81h67xbpd3c7ky0nhaw4gij214nsx4lqig70223v9r";
   };
 
   patches = [ ./find-shell-lib.patch ];
+
   patchFlags = "-p0";
+
   postPatch = ''
-    substituteInPlace eatmydata.in --replace NIX_OUT_DIR $out
+    substituteInPlace eatmydata.in \
+      --replace NIX_OUT_DIR $out
+
+    patchShebangs .
   '';
 
-  meta = {
-    homepage = "https://www.flamingspork.com/projects/libeatmydata/";
-    license = stdenv.lib.licenses.gpl3Plus;
+  nativeBuildInputs = [
+    autoreconfHook
+  ] ++ stdenv.lib.optionals doCheck [ strace which ];
+
+  # while we can *build* in parallel, the tests also run in parallel which does
+  # not work with v105. Later versions (unreleased) have a fix for that. The
+  # problem is that on hydra we cannot use strace, so the tests don't run there.
+  enableParallelBuilding = true;
+  doCheck = false;
+
+  meta = with stdenv.lib; {
     description = "Small LD_PRELOAD library to disable fsync and friends";
-    platforms = stdenv.lib.platforms.unix;
+    homepage = "https://www.flamingspork.com/projects/libeatmydata/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix
@@ -1,8 +1,21 @@
-{ fetchurl, stdenv, libtool, gettext, zlib, bzip2, flac, libvorbis
+{ fetchurl, stdenv, substituteAll
+, libtool, gettext, zlib, bzip2, flac, libvorbis
 , exiv2, libgsf, rpm, pkgconfig, fetchpatch
+, gstreamerSupport ? true, gst_all_1 ? null
+# ^ Needed e.g. for proper id3 and FLAC support.
+#   Set to `false` to decrease package closure size by about 87 MB (53%).
+, gstPlugins ? (gst: [ gst.gst-plugins-base gst.gst-plugins-good ])
+# If an application needs additional gstreamer plugins it can also make them
+# available by adding them to the environment variable
+# GST_PLUGIN_SYSTEM_PATH_1_0, e.g. like this:
+# postInstall = ''
+#   wrapProgram $out/bin/extract --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+# '';
+# See also <https://nixos.org/nixpkgs/manual/#sec-language-gnome>.
 , gtkSupport ? true, glib ? null, gtk3 ? null
 , videoSupport ? true, ffmpeg ? null, libmpeg2 ? null}:
 
+assert gstreamerSupport -> gst_all_1 != null && builtins.isList (gstPlugins gst_all_1);
 assert gtkSupport -> glib != null && gtk3 != null;
 assert videoSupport -> ffmpeg != null && libmpeg2 != null;
 
@@ -28,6 +41,15 @@ stdenv.mkDerivation rec {
       sha256 = "01xhcjbzv6p53wz7y2ii76kb8m9iwvnm4ip9w4a0bpgaxqz4b9fw";
       excludes = [ "ChangeLog" ];
     })
+  ] ++ stdenv.lib.optionals gstreamerSupport [
+
+    # Libraries cannot be wrapped so we need to hardcode the plug-in paths.
+    (substituteAll {
+      src = ./gst-hardcode-plugins.patch;
+      load_gst_plugins = stdenv.lib.concatMapStrings
+        (plugin: ''gst_registry_scan_path(gst_registry_get(), "${plugin}/lib/gstreamer-1.0");'')
+        (gstPlugins gst_all_1);
+    })
   ];
 
   preConfigure =
@@ -40,7 +62,9 @@ stdenv.mkDerivation rec {
    [ libtool gettext zlib bzip2 flac libvorbis exiv2
      libgsf rpm
      pkgconfig
-   ] ++ stdenv.lib.optionals gtkSupport [ glib gtk3 ]
+   ] ++ stdenv.lib.optionals gstreamerSupport
+          ([ gst_all_1.gstreamer ] ++ gstPlugins gst_all_1)
+     ++ stdenv.lib.optionals gtkSupport [ glib gtk3 ]
      ++ stdenv.lib.optionals videoSupport [ ffmpeg libmpeg2 ];
 
   configureFlags = [

diff --git a/pkgs/development/libraries/libextractor/gst-hardcode-plugins.patch b/pkgs/development/libraries/libextractor/gst-hardcode-plugins.patch
@@ -0,0 +1,11 @@
+--- a/src/plugins/gstreamer_extractor.c
++++ b/src/plugins/gstreamer_extractor.c
+@@ -2215,6 +2215,7 @@ void __attribute__ ((constructor))
+ gstreamer_init ()
+ {
+   gst_init (NULL, NULL);
++  @load_gst_plugins@
+   g_log_set_default_handler (&log_handler, NULL);
+   g_log_set_handler (NULL, G_LOG_LEVEL_MASK | G_LOG_FLAG_FATAL | G_LOG_FLAG_RECURSION,
+                     &log_handler, NULL);
+
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
@@ -98,7 +98,7 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://mesonbuild.com";
     description = "SCons-like build system that use python as a front-end language and Ninja as a building backend";
     license = licenses.asl20;
-    maintainers = with maintainers; [ jtojnar mbe rasendubi ];
+    maintainers = with maintainers; [ jtojnar mbe ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/tools/gox/default.nix b/pkgs/development/tools/gox/default.nix
@@ -1,25 +1,22 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 
-buildGoPackage {
+buildGoPackage rec {
   pname = "gox";
-  version = "20181025";
+  version = "1.0.1";
 
   goPackagePath = "github.com/mitchellh/gox";
 
   src = fetchFromGitHub {
     owner = "mitchellh";
     repo = "gox";
-    rev = "9cc487598128d0963ff9dcc51176e722788ec645";
-    sha256 = "18indkdwq2m1wy95d71lgbf46jxxrfc5km1fys5laapz993h77v6";
+    rev = "v${version}";
+    sha256 = "0mkh81hd7kn45dz7b6yhzqsg2mvg1g6pwx89jjigxrnqhyg9vrl7";
   };
 
-  goDeps = ./deps.nix;
-
   meta = with stdenv.lib; {
     homepage = "https://github.com/mitchellh/gox";
     description = "A dead simple, no frills Go cross compile tool";
     platforms = platforms.all;
     license = licenses.mpl20;
   };
-
 }
diff --git a/pkgs/development/tools/gox/deps.nix b/pkgs/development/tools/gox/deps.nix
diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "act";
-  version = "0.2.7";
+  version = "0.2.8";
 
   src = fetchFromGitHub {
     owner = "nektos";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0qx3vwsynmil1h3d2dzvqz0jzshfyy3vin14zjfmd353d915hf06";
+    sha256 = "14ird8z8f467spa0kdzjf6lq7pipq7rwxrdk6ppv7y1fxw96qm9x";
   };
 
-  modSha256 = "0276dngh29kzgm95d23r8ajjrrkss0v0f0wfq1ribgsxh17v0y5n";
+  modSha256 = "09q8dh4g4k0y7mrhwyi9py7zdiipmq91j3f32cn635v2xw6zyg2k";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 

diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation {
     ./linux-4.12.patch
     ./linux-4.15.patch
     ./linux-5.1.patch
+    # source: https://salsa.debian.org/Herrie82-guest/broadcom-sta/-/commit/247307926e5540ad574a17c062c8da76990d056f
+    ./linux-5.6.patch
     ./null-pointer-fix.patch
     ./gcc.patch
   ];

diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-5.6.patch b/pkgs/os-specific/linux/broadcom-sta/linux-5.6.patch
@@ -0,0 +1,87 @@
+From dd057e40a167f4febb1a7c77dd32b7d36056952c Mon Sep 17 00:00:00 2001
+From: Herman van Hazendonk <github.com@herrie.org>
+Date: Tue, 31 Mar 2020 17:09:55 +0200
+Subject: [PATCH] Add fixes for 5.6 kernel
+
+Use ioremap instead of ioremap_nocache and proc_ops instead of file_operations on Linux kernel 5.6 and above.
+
+Signed-off-by: Herman van Hazendonk <github.com@herrie.org>
+---
+ src/shared/linux_osl.c |  6 +++++-
+ src/wl/sys/wl_linux.c  | 21 ++++++++++++++++++++-
+ 2 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/src/shared/linux_osl.c b/src/shared/linux_osl.c
+index 6157d18..dcfc075 100644
+--- a/src/shared/linux_osl.c
++++ b/src/shared/linux_osl.c
+@@ -942,7 +942,11 @@ osl_getcycles(void)
+ void *
+ osl_reg_map(uint32 pa, uint size)
+ {
+-	return (ioremap_nocache((unsigned long)pa, (unsigned long)size));
++	#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
++		return (ioremap((unsigned long)pa, (unsigned long)size));
++	#else
++		return (ioremap_nocache((unsigned long)pa, (unsigned long)size));
++	#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) */
+ }
+
+ void
+diff --git a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
+index 0d05100..6d9dd0d 100644
+--- a/src/wl/sys/wl_linux.c
++++ b/src/wl/sys/wl_linux.c
+@@ -582,10 +582,17 @@ wl_attach(uint16 vendor, uint16 device, ulong regs,
+ 	}
+ 	wl->bcm_bustype = bustype;
+
++	#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
++	if ((wl->regsva = ioremap(dev->base_addr, PCI_BAR0_WINSZ)) == NULL) {
++		WL_ERROR(("wl%d: ioremap() failed\n", unit));
++		goto fail;
++	}
++	#else 
+ 	if ((wl->regsva = ioremap_nocache(dev->base_addr, PCI_BAR0_WINSZ)) == NULL) {
+ 		WL_ERROR(("wl%d: ioremap() failed\n", unit));
+ 		goto fail;
+ 	}
++	#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) */
+
+ 	wl->bar1_addr = bar1_addr;
+ 	wl->bar1_size = bar1_size;
+@@ -772,8 +779,13 @@ wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	if ((val & 0x0000ff00) != 0)
+ 		pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
+ 		bar1_size = pci_resource_len(pdev, 2);
++		#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
++		bar1_addr = (uchar *)ioremap(pci_resource_start(pdev, 2),
++			bar1_size);
++		#else
+ 		bar1_addr = (uchar *)ioremap_nocache(pci_resource_start(pdev, 2),
+ 			bar1_size);
++		#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) */
+ 	wl = wl_attach(pdev->vendor, pdev->device, pci_resource_start(pdev, 0), PCI_BUS, pdev,
+ 		pdev->irq, bar1_addr, bar1_size);
+
+@@ -3335,12 +3347,19 @@ wl_proc_write(struct file *filp, const char __user *buff, size_t length, loff_t
+ }
+
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
++static const struct proc_ops wl_fops = {
++	.proc_read	= wl_proc_read,
++	.proc_write	= wl_proc_write,
++};
++#else
+ static const struct file_operations wl_fops = {
+ 	.owner	= THIS_MODULE,
+ 	.read	= wl_proc_read,
+ 	.write	= wl_proc_write,
+ };
+-#endif
++#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) */
++#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0) */
+
+ static int
+ wl_reg_proc_entry(wl_info_t *wl)
diff --git a/pkgs/servers/coturn/default.nix b/pkgs/servers/coturn/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, openssl, libevent }:
+{ stdenv, fetchFromGitHub, fetchpatch, openssl, libevent }:
 
 stdenv.mkDerivation rec {
   pname = "coturn";
@@ -13,7 +13,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl libevent ];
 
-  patches = [ ./pure-configure.patch ];
+  patches = [
+    ./pure-configure.patch
+    (fetchpatch {
+      name = "CVE-2020-6061+6062.patch";
+      url = "https://sources.debian.org/data/main/c/coturn/4.5.1.1-1.2/debian/patches/CVE-2020-6061+6062.patch";
+      sha256 = "0fcy1wp91bb4hlhnp96sf9bs0d9hf3pwx5f7b1r9cfvr3l5c1bk2";
+    })
+  ];
 
   meta = with stdenv.lib; {
     homepage = "https://coturn.net/";

diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
@@ -16,21 +16,13 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.0.1";
+  version = "5.1.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "4a93264ad0cda7ea2252d1ba057e474722f77848165f2893e0c76e21ae406415";
+    sha256 = "9ab179d1dccc6ba59aacac81a4cd10a039615c7a846d9f77f26b851da25d1a86";
   };
 
-  patches = [
-    (fetchpatch { # merged to upstream master, remove on update
-      name = "zfs-cpu-usage.diff";
-      url = "https://gitlab.labs.nic.cz/knot/knot-resolver/merge_requests/946.diff";
-      sha256 = "0mcvx4pfnl19h6zrv2fcgxdjarqzczn2dz85sylcczsfvdmn6i5m";
-    })
-  ];
-
   outputs = [ "out" "dev" ];
 
   # Path fixups for the NixOS service.

diff --git a/pkgs/shells/zsh/zsh-powerlevel10k/default.nix b/pkgs/shells/zsh/zsh-powerlevel10k/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "powerlevel10k";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "powerlevel10k";
     rev = "v${version}";
-    sha256 = "1hlad5rf6piillmc83bkf03bbw78ylhhfxpxlkdc30ai9y5dpfvv";
+    sha256 = "04j37qmgzj62gixysj3di9dccfib4hx1c4ld9kcms3ag7k403bgj";
   };
 
   patches = [

diff --git a/pkgs/tools/misc/shadowenv/default.nix b/pkgs/tools/misc/shadowenv/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowenv";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = version;
-    sha256 = "1fjqm4qr85wb0i3vazp0w74izfzvkycdii7dlpdp5zs8jgb35pdh";
+    sha256 = "1x5i5km6wblqbc0fibdjdlqkamqswxwhy8p6cbfz2nvcia7fgsf1";
   };
 
-  cargoSha256 = "1n8qh730nhdmpm08mm2ppcl3nkcgm50cyz9q5h6dlzq4bv4rijp4";
+  cargoSha256 = "1hrsbd6025sfgnwr7smp43yzi7w2lfyfbdxhapgizrpwbq8y7xzd";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -20,6 +20,9 @@ rustPlatform.buildRustPackage rec {
   postInstall = ''
     installManPage man/man1/shadowenv.1
     installManPage man/man5/shadowlisp.5
+    installShellCompletion --bash sh/completions/shadowenv.bash
+    installShellCompletion --fish sh/completions/shadowenv.fish
+    installShellCompletion --zsh sh/completions/_shadowenv
   '';
 
   meta = with stdenv.lib; {

diff --git a/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix b/pkgs/tools/virtualization/google-compute-engine-oslogin/default.nix
@@ -1,4 +1,5 @@
 { stdenv
+, lib
 , fetchFromGitHub
 , curl
 , json_c
@@ -8,38 +9,36 @@
 
 stdenv.mkDerivation rec {
   pname = "google-compute-engine-oslogin";
-  version = "1.5.3";
-  # from packages/google-compute-engine-oslogin/packaging/debian/changelog
+  version = "20200325.00";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
-    repo = "compute-image-packages";
-    rev = "20190522";
-    sha256 = "16jbbrnz49g843h813r408dbvfa2hicf8canxwbfxr2kzhv7ycmm";
+    repo = "guest-oslogin";
+    rev = version;
+    sha256 = "03hk95pgzcgy6ginp8zdy0fbk88m6n65qq22jq490z1xwbjffm8r";
   };
-  sourceRoot = "source/packages/google-compute-engine-oslogin";
 
   postPatch = ''
     # change sudoers dir from /var/google-sudoers.d to /run/google-sudoers.d (managed through systemd-tmpfiles)
-    substituteInPlace pam_module/pam_oslogin_admin.cc --replace /var/google-sudoers.d /run/google-sudoers.d
+    substituteInPlace src/pam/pam_oslogin_admin.cc --replace /var/google-sudoers.d /run/google-sudoers.d
     # fix "User foo not allowed because shell /bin/bash does not exist"
-    substituteInPlace compat.h --replace /bin/bash ${bashInteractive}/bin/bash
+    substituteInPlace src/include/compat.h --replace /bin/bash ${bashInteractive}/bin/bash
   '';
 
   buildInputs = [ curl.dev pam ];
 
   NIX_CFLAGS_COMPILE="-I${json_c.dev}/include/json-c";
   NIX_CFLAGS_LINK="-L${json_c}/lib";
 
-  installPhase = ''
-    mkdir -p $out/{bin,lib}
-
-    install -Dm755 libnss_cache_google-compute-engine-oslogin-${version}.so $out/lib/libnss_cache_oslogin.so.2
-    install -Dm755 libnss_google-compute-engine-oslogin-${version}.so $out/lib/libnss_oslogin.so.2
-
-    install -Dm755 pam_oslogin_admin.so pam_oslogin_login.so $out/lib
-    install -Dm755 google_{oslogin_nss_cache,authorized_keys} $out/bin
-  '';
+  makeFlags = [
+    "VERSION=${version}"
+    "DESTDIR=${placeholder "out"}"
+    "PREFIX=/"
+    "BINDIR=/bin"
+    "LIBDIR=/lib"
+    "PAMDIR=/lib"
+    "MANDIR=/share/man"
+  ];
 
   enableParallelBuilding = true;
 

diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
@@ -575,6 +575,7 @@ mapAliases ({
   transporter = throw "transporter has been removed. It was archived upstream, so it's considered abandoned.";
   truecrypt = veracrypt; # added 2018-10-24
   tshark = wireshark-cli; # added 2018-04-25
+  uberwriter = apostrophe; # added 2020-04-23
   ubootBeagleboneBlack = ubootAmx335xEVM; # added 2020-01-21
   ucsFonts = ucs-fonts; # added 2016-07-15
   ultrastardx-beta = ultrastardx; # added 2017-08-12

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -5966,7 +5966,8 @@ in
 
   podiff = callPackage ../tools/text/podiff { };
 
-  podman = callPackage ../applications/virtualization/podman { };
+  podman = callPackage ../applications/virtualization/podman/wrapper.nix { };
+  podman-unwrapped = callPackage ../applications/virtualization/podman { };
 
   podman-compose = python3Packages.callPackage ../applications/virtualization/podman-compose {};
 
@@ -20611,6 +20612,7 @@ in
 
   monotone = callPackage ../applications/version-management/monotone {
     lua = lua5;
+    botan = botan.override (x: { openssl = null; });
   };
 
   monotoneViz = callPackage ../applications/version-management/monotone-viz {