NixOS · Nov 24, 2019 · Jan 6, 2020 · Jan 15, 2020 · Jan 18, 2020 · Jan 18, 2020
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -40,12 +40,6 @@
   See `./scripts/check-maintainer-github-handles.sh` for an example on how to work with this data.
   */
 {
-  "00-matt" = {
-    name = "Matt Smith";
-    email = "matt@offtopica.uk";
-    github = "00-matt";
-    githubId = 48835712;
-  };
   "0x4A6F" = {
     email = "0x4A6F@shackspace.de";
     name = "Joachim Ernst";

diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
@@ -5,6 +5,8 @@ with lib;
 let
   cfg = config.services.roundcube;
   fpm = config.services.phpfpm.pools.roundcube;
+  localDB = cfg.database.host == "localhost";
+  user = cfg.database.username;
 in
 {
   options.services.roundcube = {
@@ -44,7 +46,10 @@ in
       username = mkOption {
         type = types.str;
         default = "roundcube";
-        description = "Username for the postgresql connection";
+        description = ''
+          Username for the postgresql connection.
+          If <literal>database.host</literal> is set to <literal>localhost</literal>, a unix user and group of the same name will be created as well.
+        '';
       };
       host = mkOption {
         type = types.str;
@@ -58,7 +63,12 @@ in
       };
       password = mkOption {
         type = types.str;
-        description = "Password for the postgresql connection";
+        description = "Password for the postgresql connection. Do not use: the password will be stored world readable in the store; use <literal>passwordFile</literal> instead.";
+        default = "";
+      };
+      passwordFile = mkOption {
+        type = types.str;
+        description = "Password file for the postgresql connection. Must be readable by user <literal>nginx</literal>. Ignored if <literal>database.host</literal> is set to <literal>localhost</literal>, as peer authentication will be used.";
       };
       dbname = mkOption {
         type = types.str;
@@ -83,14 +93,22 @@ in
   };
 
   config = mkIf cfg.enable {
+    # backward compatibility: if password is set but not passwordFile, make one.
+    services.roundcube.database.passwordFile = mkIf (!localDB && cfg.database.password != "") (mkDefault ("${pkgs.writeText "roundcube-password" cfg.database.password}"));
+    warnings = lib.optional (!localDB && cfg.database.password != "") "services.roundcube.database.password is deprecated and insecure; use services.roundcube.database.passwordFile instead";
+
     environment.etc."roundcube/config.inc.php".text = ''
       <?php
 
+      ${lib.optionalString (!localDB) "$password = file_get_contents('${cfg.database.passwordFile}');"}
+
       $config = array();
-      $config['db_dsnw'] = 'pgsql://${cfg.database.username}:${cfg.database.password}@${cfg.database.host}/${cfg.database.dbname}';
+      $config['db_dsnw'] = 'pgsql://${cfg.database.username}${lib.optionalString (!localDB) ":' . $password . '"}@${if localDB then "unix(/run/postgresql)" else cfg.database.host}/${cfg.database.dbname}';
       $config['log_driver'] = 'syslog';
       $config['max_message_size'] = '25M';
       $config['plugins'] = [${concatMapStringsSep "," (p: "'${p}'") cfg.plugins}];
+      $config['des_key'] = file_get_contents('/var/lib/roundcube/des_key');
+      $config['mime_types'] = '${pkgs.nginx}/conf/mime.types';
       ${cfg.extraConfig}
     '';
 
@@ -116,12 +134,26 @@ in
       };
     };
 
-    services.postgresql = mkIf (cfg.database.host == "localhost") {
+    services.postgresql = mkIf localDB {
       enable = true;
+      ensureDatabases = [ cfg.database.dbname ];
+      ensureUsers = [ {
+        name = cfg.database.username;
+        ensurePermissions = {
+          "DATABASE ${cfg.database.username}" = "ALL PRIVILEGES";
+        };
+      } ];
+    };
+
+    users.users.${user} = mkIf localDB {
+      group = user;
+      isSystemUser = true;
+      createHome = false;
     };
+    users.groups.${user} = mkIf localDB {};
 
     services.phpfpm.pools.roundcube = {
-      user = "nginx";
+      user = if localDB then user else "nginx";
       phpOptions = ''
         error_log = 'stderr'
         log_errors = on
@@ -143,32 +175,39 @@ in
     };
     systemd.services.phpfpm-roundcube.after = [ "roundcube-setup.service" ];
 
-    systemd.services.roundcube-setup = let
-      pgSuperUser = config.services.postgresql.superUser;
-    in mkMerge [
+    systemd.services.roundcube-setup = mkMerge [
       (mkIf (cfg.database.host == "localhost") {
         requires = [ "postgresql.service" ];
         after = [ "postgresql.service" ];
         path = [ config.services.postgresql.package ];
       })
       {
         wantedBy = [ "multi-user.target" ];
-        script = ''
-          mkdir -p /var/lib/roundcube
-          if [ ! -f /var/lib/roundcube/db-created ]; then
-            if [ "${cfg.database.host}" = "localhost" ]; then
-              ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql postgres -c "create role ${cfg.database.username} with login password '${cfg.database.password}'";
-              ${pkgs.sudo}/bin/sudo -u ${pgSuperUser} psql postgres -c "create database ${cfg.database.dbname} with owner ${cfg.database.username}";
-            fi
-            PGPASSWORD="${cfg.database.password}" ${pkgs.postgresql}/bin/psql -U ${cfg.database.username} \
-              -f ${cfg.package}/SQL/postgres.initial.sql \
-              -h ${cfg.database.host} ${cfg.database.dbname}
-            touch /var/lib/roundcube/db-created
+        script = let
+          psql = "${lib.optionalString (!localDB) "PGPASSFILE=${cfg.database.passwordFile}"} ${pkgs.postgresql}/bin/psql ${lib.optionalString (!localDB) "-h ${cfg.database.host} -U ${cfg.database.username} "} ${cfg.database.dbname}";
+        in
+        ''
+          version="$(${psql} -t <<< "select value from system where name = 'roundcube-version';" || true)"
+          if ! (grep -E '[a-zA-Z0-9]' <<< "$version"); then
+            ${psql} -f ${cfg.package}/SQL/postgres.initial.sql
+          fi
+
+          if [ ! -f /var/lib/roundcube/des_key ]; then
+            base64 /dev/urandom | head -c 24 > /var/lib/roundcube/des_key;
+            # we need to log out everyone in case change the des_key
+            # from the default when upgrading from nixos 19.09
+            ${psql} <<< 'TRUNCATE TABLE session;'
           fi
 
           ${pkgs.php}/bin/php ${cfg.package}/bin/update.sh
         '';
-        serviceConfig.Type = "oneshot";
+        serviceConfig = {
+          Type = "oneshot";
+          StateDirectory = "roundcube";
+          User = if localDB then user else "nginx";
+          # so that the des_key is not world readable
+          StateDirectoryMode = "0700";
+        };
       }
     ];
   };

diff --git a/pkgs/applications/networking/cluster/kubeless/default.nix b/pkgs/applications/networking/cluster/kubeless/default.nix
@@ -23,7 +23,7 @@ buildGoPackage rec {
     homepage = "https://kubeless.io";
     description = "The Kubernetes Native Serverless Framework";
     license = licenses.asl20;
-    maintainers = with maintainers; [ "00-matt" ];
+    maintainers = with maintainers; [];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/chatterino2/default.nix b/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, pkgconfig, fetchFromGitHub, qtbase, qtsvg, qtmultimedia, qmake, boost, openssl }:
+{ mkDerivation, lib, pkgconfig, fetchFromGitHub, qtbase, qtsvg, qtmultimedia, qmake, boost, openssl }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "chatterino2";
   version = "unstable-2019-05-11";
   src = fetchFromGitHub {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ qmake pkgconfig ];
   buildInputs = [ qtbase qtsvg qtmultimedia boost openssl ];
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A chat client for Twitch chat";
     longDescription = ''
       Chatterino is a chat client for Twitch chat. It aims to be an

diff --git a/pkgs/applications/networking/instant-messengers/teams/default.nix b/pkgs/applications/networking/instant-messengers/teams/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "teams";
-  version = "1.2.00.32451";
+  version = "1.3.00.958";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/ms-teams/pool/main/t/teams/teams_${version}_amd64.deb";
-    sha256 = "1p053kg5qksr78v2h7cxia5mb9kzgfwm6n99x579vfx48kka1n18";
+    sha256 = "015awxgbwk4j973jnxj7q3i8csx7wnwpwp5g4jlmn7z8fxwy83d5";
   };
 
   nativeBuildInputs = [ dpkg autoPatchelfHook wrapGAppsHook ];

diff --git a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
       gtk-doc.
     '';
 
+    license = [ licenses.gpl2 licenses.lgpl2 ];
     platforms = platforms.linux;
     maintainers = [ maintainers.mkg20001 ];
   };

diff --git a/pkgs/desktops/cinnamon/cinnamon-menus/default.nix b/pkgs/desktops/cinnamon/cinnamon-menus/default.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://github.com/linuxmint/cinnamon-menus";
     description = "A menu system for the Cinnamon project";
+    license = [ licenses.gpl2 licenses.lgpl2 ];
     platforms = platforms.linux;
     maintainers = [ maintainers.mkg20001 ];
   };

diff --git a/pkgs/desktops/cinnamon/cinnamon-translations/default.nix b/pkgs/desktops/cinnamon/cinnamon-translations/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = "https://github.com/linuxmint/cinnamon-translations";
     description = "Translations files for the Cinnamon desktop";
+    license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.mkg20001 ];
   };

diff --git a/pkgs/desktops/cinnamon/cjs/default.nix b/pkgs/desktops/cinnamon/cjs/default.nix
@@ -78,6 +78,12 @@ stdenv.mkDerivation rec {
       This module contains JavaScript bindings based on gobject-introspection.
     '';
 
+    license = with licenses; [
+     gpl2Plus
+     lgpl2Plus
+     mit
+     mpl11
+   ];
     platforms = platforms.linux;
     maintainers = [ maintainers.mkg20001 ];
   };

diff --git a/pkgs/desktops/cinnamon/default.nix b/pkgs/desktops/cinnamon/default.nix
@@ -6,5 +6,6 @@ lib.makeScope pkgs.newScope (self: with self; {
   cinnamon-translations = callPackage ./cinnamon-translations { };
   cinnamon-settings-daemon = callPackage ./cinnamon-settings-daemon { };
   cjs = callPackage ./cjs { };
+  nemo = callPackage ./nemo { };
   xapps = callPackage ./xapps { };
 })
diff --git a/pkgs/desktops/cinnamon/nemo/default.nix b/pkgs/desktops/cinnamon/nemo/default.nix
@@ -0,0 +1,76 @@
+{ fetchFromGitHub
+, fetchpatch
+, glib
+, gobject-introspection
+, meson
+, ninja
+, pkgconfig
+, stdenv
+, wrapGAppsHook
+, libxml2
+, gtk3
+, libnotify
+, cinnamon-desktop
+, xapps
+, libexif
+, exempi
+, intltool
+, shared-mime-info
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nemo";
+  version = "4.4.1";
+
+  # TODO: add plugins support (see https://github.com/NixOS/nixpkgs/issues/78327)
+
+  src = fetchFromGitHub {
+    owner = "linuxmint";
+    repo = pname;
+    rev = version;
+    sha256 = "0sskq0rssxvna937md446x1489hkhxys1zq03hvl8asjqa259w2q";
+  };
+
+  patches = [
+    (fetchpatch { # details see https://github.com/linuxmint/nemo/pull/2303
+      url = "https://github.com/linuxmint/nemo/pull/2303/commits/9c1ec7812abe712419317df07d6b64623e8f639d.patch";
+      sha256 = "09dz7lq3i47rbvycawrxwgjmd9g1mhb76ibx2vq85wck6r08arml";
+    })
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libnotify
+    cinnamon-desktop
+    libxml2
+    xapps
+    libexif
+    exempi
+    gobject-introspection
+  ];
+
+  nativeBuildInputs = [
+    meson
+    pkgconfig
+    ninja
+    wrapGAppsHook
+    intltool
+    shared-mime-info
+  ];
+
+  mesonFlags = [
+    # TODO: https://github.com/NixOS/nixpkgs/issues/36468
+    "-Dc_args=-I${glib.dev}/include/gio-unix-2.0"
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/linuxmint/nemo";
+    description = "File browser for Cinnamon";
+    license = [ licenses.gpl2 licenses.lgpl2 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.mkg20001 ];
+  };
+}
diff --git a/pkgs/development/compilers/graalvm/enterprise-edition.nix b/pkgs/development/compilers/graalvm/enterprise-edition.nix
@@ -1,133 +1,167 @@
-{ stdenv, requireFile, perl, unzip, glibc, zlib, gdk-pixbuf, xorg, glib, fontconfig, freetype, cairo, pango, gtk3, gtk2, ffmpeg, libGL, atk, alsaLib, libav_0_8, setJavaClassPath }:
+{ stdenv, requireFile, perl, unzip, glibc, zlib, bzip2, gdk-pixbuf, xorg, glib, fontconfig, freetype, cairo, pango, gtk3, gtk2, ffmpeg, libGL, atk, alsaLib, libav_0_8, setJavaClassPath }:
 
 let
-  graalvm8-ee = stdenv.mkDerivation rec {
-    pname = "graalvm8-ee";
-    version = "19.2.0";
-    srcs = [
-      (requireFile {
-         name   = "graalvm-ee-linux-amd64-${version}.tar.gz";
-         sha256 = "1j56lyids48zyjhxk8xl4niy8hk6qzi1aj7c55yfh62id8v6cpbw";
-         url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
-      })
-      (requireFile {
-         name   = "native-image-installable-svm-svmee-linux-amd64-${version}.jar";
-         sha256 = "07c25l27msxccqrbz4bknz0sxsl0z2k8990cdfkbrgxvhxspfnnm";
-         url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
-      })
-      (requireFile {
-         name   = "python-installable-svm-svmee-linux-amd64-${version}.jar";
-         sha256 = "1c7kpz56w9p418li97ymixdwywscr85vhn7jkzxq71bj7ia7pxwz";
-         url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
-      })
-      (requireFile {
-         name   = "ruby-installable-svm-svmee-linux-amd64-${version}.jar";
-         sha256 = "13jfm5qpxqxz7f5n9yyvqrv1vwigifrjwk3hssp23maski2ssys1";
-         url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
-      })
-    ];
-    nativeBuildInputs = [ unzip perl ];
-    unpackPhase = ''
-      unpack_jar() {
-        jar=$1
-        unzip $jar -d $out
-        perl -ne 'use File::Path qw(make_path);
-                  use File::Basename qw(dirname);
-                  if (/^(.+) = (.+)$/) {
-                    make_path dirname("$ENV{out}/$1");
-                    system "ln -s $2 $ENV{out}/$1";
-                  }' $out/META-INF/symlinks
-        perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
-                    my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
-                               ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
-                               ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
-                    chmod $mode, "$ENV{out}/$1";
-                  }' $out/META-INF/permissions
-        rm -rf $out/META-INF
-      }
-
-      mkdir -p $out
-      arr=($srcs)
-      tar xf ''${arr[0]} -C $out --strip-components=1
-      unpack_jar ''${arr[1]}
-      unpack_jar ''${arr[2]}
-      unpack_jar ''${arr[3]}
-    '';
-
-    installPhase = ''
-      # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-      substituteInPlace $out/jre/lib/security/java.security \
-        --replace file:/dev/random    file:/dev/./urandom \
-        --replace NativePRNGBlocking  SHA1PRNG
-
-      # provide libraries needed for static compilation
-      for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
-        ln -s $f $out/jre/lib/svm/clibraries/linux-amd64/$(basename $f)
-      done
-    '';
-
-    dontStrip = true;
-
-    preFixup = ''
-      # Set JAVA_HOME automatically.
-      mkdir -p $out/nix-support
-      cat <<EOF > $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    postFixup = ''
-      rpath="$out/jre/lib/amd64/jli:$out/jre/lib/amd64/server:$out/jre/lib/amd64:${
-        stdenv.lib.strings.makeLibraryPath [ glibc xorg.libXxf86vm xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXrender
-                                             glib zlib alsaLib fontconfig freetype pango gtk3 gtk2 cairo gdk-pixbuf atk ffmpeg libGL ]}"
-
-      for f in $(find $out -type f -perm -0100); do
-        patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f" || true
-        patchelf --set-rpath   "$rpath"                                    "$f" || true
-      done
-
-      for f in $(find $out -type f -perm -0100); do
-        if ldd "$f" | fgrep 'not found'; then echo "in file $f"; fi
-      done
-    '';
-
-    propagatedBuildInputs = [ setJavaClassPath zlib ]; # $out/bin/native-image needs zlib to build native executables
-
-    doInstallCheck = true;
-    installCheckPhase = ''
-      echo ${stdenv.lib.escapeShellArg ''
-               public class HelloWorld {
-                 public static void main(String[] args) {
-                   System.out.println("Hello World");
-                 }
-               }
-             ''} > HelloWorld.java
-      $out/bin/javac HelloWorld.java
-
-      # run on JVM with Graal Compiler
-      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld
-      $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
-
-      # Ahead-Of-Time compilation
-      $out/bin/native-image --no-server HelloWorld
-      ./helloworld
-      ./helloworld | fgrep 'Hello World'
-
-      # Ahead-Of-Time compilation with --static
-      $out/bin/native-image --no-server --static HelloWorld
-      ./helloworld
-      ./helloworld | fgrep 'Hello World'
-    '';
-
-    passthru.home = graalvm8-ee;
-
-    meta = with stdenv.lib; {
-      homepage = https://www.graalvm.org/;
-      description = "High-Performance Polyglot VM";
-      license = licenses.unfree;
-      maintainers = with maintainers; [ volth hlolli ];
-      platforms = [ "x86_64-linux" ];
-    };
-  };
-in
-  graalvm8-ee
+  common = javaVersion:
+    let
+      graalvmXXX-ee = stdenv.mkDerivation rec {
+        pname = "graalvm${javaVersion}-ee";
+        version = "19.3.1";
+        srcs = [
+          (requireFile {
+             name   = "graalvm-ee-java${javaVersion}-linux-amd64-${version}.tar.gz";
+             sha256 = {  "8" = "b4833f1996e0e271d8abde1d0af3420e2bc6797624515a3720bdbedfa99b1e82";
+                        "11" = "a965abb093934712f31cd2183f3f0d68ed1410a50365489f665a30e5382908dc";
+                      }.${javaVersion};
+             url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
+          })
+          (requireFile {
+             name   = "native-image-installable-svm-svmee-java${javaVersion}-linux-amd64-${version}.jar";
+             sha256 = {  "8" = "fe3447dd60fbe3da39c650654594796873cd6bc9995d1430a421363e71d41702";
+                        "11" = "53357b7facb36c7b38857a2369471d0e869c0ff45555aa8baf2ab84de0c4782c";
+                      }.${javaVersion};
+             url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
+          })
+          (requireFile {
+             name   = "python-installable-svm-svmee-java${javaVersion}-linux-amd64-${version}.jar";
+             sha256 = {  "8" = "003e9574e18656a82626aa5d310fac31979abc04955587d68ff977808829a91d";
+                        "11" = "65558e14a25802001f3c79571a09170fa11564de34df6987724163416d3889bf";
+                      }.${javaVersion};
+             url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
+          })
+          (requireFile {
+             name   = "ruby-installable-svm-svmee-java${javaVersion}-linux-amd64-${version}.jar";
+             sha256 = {  "8" = "45abe74d10e09680f1e40101f93def5615e65f29ced328054a40c8517e054290";
+                        "11" = "3d4de372b78b68dbd966b36489d1c6d84a326990e91a0314fb77404eed0741ad";
+                      }.${javaVersion};
+             url    = "https://www.oracle.com/technetwork/graalvm/downloads/index.html";
+          })
+        ];
+        nativeBuildInputs = [ unzip perl ];
+        unpackPhase = ''
+          unpack_jar() {
+            jar=$1
+            unzip $jar -d $out
+            perl -ne 'use File::Path qw(make_path);
+                      use File::Basename qw(dirname);
+                      if (/^(.+) = (.+)$/) {
+                        make_path dirname("$ENV{out}/$1");
+                        system "ln -s $2 $ENV{out}/$1";
+                      }' $out/META-INF/symlinks
+            perl -ne 'if (/^(.+) = ([r-])([w-])([x-])([r-])([w-])([x-])([r-])([w-])([x-])$/) {
+                        my $mode = ($2 eq 'r' ? 0400 : 0) + ($3 eq 'w' ? 0200 : 0) + ($4  eq 'x' ? 0100 : 0) +
+                                   ($5 eq 'r' ? 0040 : 0) + ($6 eq 'w' ? 0020 : 0) + ($7  eq 'x' ? 0010 : 0) +
+                                   ($8 eq 'r' ? 0004 : 0) + ($9 eq 'w' ? 0002 : 0) + ($10 eq 'x' ? 0001 : 0);
+                        chmod $mode, "$ENV{out}/$1";
+                      }' $out/META-INF/permissions
+            rm -rf $out/META-INF
+          }
+
+          mkdir -p $out
+          arr=($srcs)
+          tar xf ''${arr[0]} -C $out --strip-components=1
+          unpack_jar ''${arr[1]}
+          unpack_jar ''${arr[2]}
+          unpack_jar ''${arr[3]}
+        '';
+
+        installPhase = {
+          "8" = ''
+            # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
+            substituteInPlace $out/jre/lib/security/java.security \
+              --replace file:/dev/random    file:/dev/./urandom \
+              --replace NativePRNGBlocking  SHA1PRNG
+
+            # provide libraries needed for static compilation
+            for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
+              ln -s $f $out/jre/lib/svm/clibraries/linux-amd64/$(basename $f)
+            done
+
+            # allow using external truffle-api.jar and languages not included in the distrubution
+            rm $out/jre/lib/jvmci/parentClassLoader.classpath
+          '';
+          "11" = ''
+            # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
+            substituteInPlace $out/conf/security/java.security \
+              --replace file:/dev/random    file:/dev/./urandom \
+              --replace NativePRNGBlocking  SHA1PRNG
+
+            # provide libraries needed for static compilation
+            for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
+              ln -s $f $out/lib/svm/clibraries/linux-amd64/$(basename $f)
+            done
+           '';
+        }.${javaVersion};
+
+        dontStrip = true;
+
+        # copy-paste openjdk's preFixup
+        preFixup = ''
+          # Set JAVA_HOME automatically.
+          mkdir -p $out/nix-support
+          cat <<EOF > $out/nix-support/setup-hook
+            if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+          EOF
+        '';
+
+        postFixup = ''
+          rpath="${ {  "8" = "$out/jre/lib/amd64/jli:$out/jre/lib/amd64/server:$out/jre/lib/amd64";
+                      "11" = "$out/lib/jli:$out/lib/server:$out/lib";
+                    }.${javaVersion}
+                 }:${
+            stdenv.lib.strings.makeLibraryPath [ glibc xorg.libXxf86vm xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXrender
+                                                 glib zlib bzip2 alsaLib fontconfig freetype pango gtk3 gtk2 cairo gdk-pixbuf atk ffmpeg libGL ]}"
+
+          for f in $(find $out -type f -perm -0100); do
+            patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f" || true
+            patchelf --set-rpath   "$rpath"                                    "$f" || true
+          done
+
+          for f in $(find $out -type f -perm -0100); do
+            if ldd "$f" | fgrep 'not found'; then echo "in file $f"; fi
+          done
+        '';
+
+        propagatedBuildInputs = [ setJavaClassPath zlib ]; # $out/bin/native-image needs zlib to build native executables
+
+        doInstallCheck = true;
+        installCheckPhase = ''
+          echo ${stdenv.lib.escapeShellArg ''
+                   public class HelloWorld {
+                     public static void main(String[] args) {
+                       System.out.println("Hello World");
+                     }
+                   }
+                 ''} > HelloWorld.java
+          $out/bin/javac HelloWorld.java
+
+          # run on JVM with Graal Compiler
+          $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld
+          $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+          # Ahead-Of-Time compilation
+          $out/bin/native-image --no-server HelloWorld
+          ./helloworld
+          ./helloworld | fgrep 'Hello World'
+
+          # Ahead-Of-Time compilation with --static
+          $out/bin/native-image --no-server --static HelloWorld
+          ./helloworld
+          ./helloworld | fgrep 'Hello World'
+        '';
+
+        passthru.home = graalvmXXX-ee;
+
+        meta = with stdenv.lib; {
+          homepage = https://www.graalvm.org/;
+          description = "High-Performance Polyglot VM";
+          license = licenses.unfree;
+          maintainers = with maintainers; [ volth hlolli ];
+          platforms = [ "x86_64-linux" ];
+        };
+      };
+    in
+      graalvmXXX-ee;
+in {
+  graalvm8-ee  = common  "8";
+  graalvm11-ee = common "11";
+}
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0m0pddqrpfm526f0fyzzjpcp7hi3d6pj0bgk2vl004lkas4li1hw";
+    sha256 = "1j925g7x0j8fzns431360myr8844swb8mb78wacw2vlj6x1c558c";
   };
 
   nativeBuildInputs = [ Babel ];

diff --git a/pkgs/development/python-modules/bumps/default.nix b/pkgs/development/python-modules/bumps/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "bumps";
-  version = "0.7.13";
+  version = "0.7.14";
 
   propagatedBuildInputs = [six];
 
@@ -12,7 +12,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fdcf335b800d892edfdbc87fdd539cb45166d8667edbec3dfbb1a3b5c3a35547";
+    sha256 = "0l0ljm7n19522m6mb0jnbcwdyqya15vfj3li3mvfsyv4rkxvy18b";
   };
 
   meta = with stdenv.lib; {

diff --git a/pkgs/development/python-modules/cmd2/default.nix b/pkgs/development/python-modules/cmd2/default.nix
@@ -6,11 +6,11 @@
 }:
 buildPythonPackage rec {
   pname = "cmd2";
-  version = "0.9.22";
+  version = "0.9.23";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ba244b07c0b465ff54a6838dc61919599141dc92de1bf00bb0a70875189155e6";
+    sha256 = "17ic6lxzz9yrwxh3l1skcqgr59c47w5fidj5qmrk1l26rkrjxlca";
   };
 
   LC_ALL="en_US.UTF-8";

diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "jupyterlab";
-  version = "1.2.4";
+  version = "1.2.5";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6adb88acd05b51512c37df477a18c36240823a591c2a51bf6556198414026d8f";
+    sha256 = "086zl3pdsq2jwcxv7ppp3lpwh25mgnn0y0s6scmkrz158yj55kp3";
   };
 
   propagatedBuildInputs = [ jupyterlab_server notebook ];

diff --git a/pkgs/development/python-modules/libnacl/default.nix b/pkgs/development/python-modules/libnacl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "libnacl";
-  version = "1.6.1";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "saltstack";
     repo = pname;
     rev = "v${version}";
-    sha256 = "05iamhbsqm8binqhc2zchfqdkajlx2icf8xl5vkd5fbrhw6yylad";
+    sha256 = "10rpim9lf0qd861a3miq8iqg8w87slqwqni7nq66h72jdk130axg";
   };
 
   checkInputs = [ pytest ];

diff --git a/pkgs/development/python-modules/phonenumbers/default.nix b/pkgs/development/python-modules/phonenumbers/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.11.1";
+  version = "8.11.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "239507184ee5b1b83557005af1d5fcce70f83ae18f5dff45b94a67226db10d63";
+    sha256 = "0j73mr3d3rf2r4nkaxbvl7323xima0l95pjagjzgk2piqwa3nbd2";
   };
 
   meta = {

diff --git a/pkgs/development/python-modules/python-dotenv/default.nix b/pkgs/development/python-modules/python-dotenv/default.nix
@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "python-dotenv";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0i25gh8wi87l4g0iflp81rlgmps4cdmp90hwypalp7gcbwfxfmzi";
+    sha256 = "16s2x5ghrhz9ljm6h3y0pbwh97558vbs7l0yiicag4s0xyn0nzq0";
   };
 
   propagatedBuildInputs = [ click ] ++ lib.optionals isPy27 [ typing ];

diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
-  version = "12.2.0";
+  version = "12.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "346d42771c2b23384c59f5f41e05bd7e801a0ce118d8dcb95209bb73d5f694c5";
+    sha256 = "0yrg5342zz0hpf2pc85ffwx57msa6jpcmvvjfkzh8nh2lc98aq21";
   };
 
   prePatch = ''

diff --git a/pkgs/development/python-modules/shodan/default.nix b/pkgs/development/python-modules/shodan/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "shodan";
-  version = "1.21.1";
+  version = "1.21.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "834dfd084fed290b2b445545b0d1cac7822f3c0ed6ba09707efb1716bb485ede";
+    sha256 = "1pbfmab3ixvaa845qp6ms2djcwp9c5vnlsr2bf9prmx5973khg7d";
   };
 
   propagatedBuildInputs = [

diff --git a/pkgs/development/python-modules/spotipy/default.nix b/pkgs/development/python-modules/spotipy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "spotipy";
-  version = "2.4.4";
+  version = "2.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1l8ya0cln936x0mx2j5ngl1xwpc0r89hs3wcvb8x8paw3d4dl1ab";
+    sha256 = "1jpj9ljc5g89jbnzwnmgz5s6jdrsgd6g9s09igvbw3pppi9070h0";
   };
 
   propagatedBuildInputs = [ requests ];

diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
@@ -1,7 +1,7 @@
 { stdenv, buildGoPackage, fetchFromGitHub, makeWrapper, systemd }:
 
 buildGoPackage rec {
-  version = "1.2.0";
+  version = "1.3.0";
   pname = "grafana-loki";
   goPackagePath = "github.com/grafana/loki";
 
@@ -11,9 +11,15 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "loki";
-    sha256 = "04ix58gb9yy5jf8fhn3k1pbwqs69k7m96cck38ymhwml1793b4k9";
+    sha256 = "0b1dpb3vh5i18467qk8kpb5ic14p4p1dfyr8hjkznf6bs7g8ka1q";
   };
 
+  postPatch = ''
+    substituteInPlace pkg/distributor/distributor_test.go --replace \
+      '"eth0", "en0", "lo0"' \
+      '"lo"'
+  '';
+
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = stdenv.lib.optionals stdenv.isLinux [ systemd.dev ];
 

diff --git a/pkgs/tools/networking/amass/default.nix b/pkgs/tools/networking/amass/default.nix
@@ -5,22 +5,22 @@
 
 buildGoModule rec {
   pname = "amass";
-  version = "3.0.25";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "OWASP";
     repo = "Amass";
     rev = "v${version}";
-    sha256 = "04vsahqmbs9rysdwyjq0zgwcn6dgdvkyz8lsp1g1p9d3amrgbqjy";
+    sha256 = "0mia01cqmaa17696m73qazpbyrcng7wldca79g46xgc4z96q1i7i";
   };
 
-  modSha256 = "0kwi4pys08kszrh5kz64gs68k20y00v2zqh5hyrgpy9nivqrlj62";
+  modSha256 = "1zwm7skdhql6isffyhixqsgvcgxw2436iv8bj92cxs70ipk537v9";
 
   outputs = [ "out" "wordlists" ];
 
   postInstall = ''
     mkdir -p $wordlists
-    cp -R $src/wordlists/*.txt $wordlists
+    cp -R $src/examples/wordlists/*.txt $wordlists
     gzip $wordlists/*.txt
   '';
 

diff --git a/pkgs/tools/system/hwinfo/default.nix b/pkgs/tools/system/hwinfo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwinfo";
-  version = "21.67";
+  version = "21.68";
 
   src = fetchFromGitHub {
     owner = "opensuse";
     repo = "hwinfo";
     rev = version;
-    sha256 = "1fvlrqx1wgl79a9j3xhhhdihj4lkpbrchfsc27il0p52fynn4dji";
+    sha256 = "0x63rkyl16918l8yf0azy2lyxaqy8nc6iafid89acvxn32j146rg";
   };
 
   patchPhase = ''

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -8456,7 +8456,9 @@ in
 
   inherit (callPackages ../development/compilers/graalvm { }) mx jvmci8 graalvm8;
 
-  graalvm8-ee = callPackage ../development/compilers/graalvm/enterprise-edition.nix { };
+  inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })
+    graalvm8-ee
+    graalvm11-ee;
 
   openshot-qt = libsForQt5.callPackage ../applications/video/openshot-qt { };