based on https://www.ec2instances.info/

fixes #47513 following the upstream recommended settings:
syncthing/syncthing#3434 (comment)

https://raw.githubusercontent.com/tats/w3m/v0.5.3+git20180125/NEWS

Include some CVE fixes it would appear.

…5515]

…tream systemd

* Lets container@.service  be activated by machines.target instead of
  multi-user.target

  According to the systemd manpages, all containers that are registered
  by machinectl, should be inside machines.target for easy stopping
  and starting container units altogether

* make sure container@.service and container.slice instances are
  actually located in machine.slice

  https://plus.google.com/112206451048767236518/posts/SYAueyXHeEX
  See original commit: NixOS/systemd@45d383a3b8

* Enable Cgroup delegation for nixos-containers

  Delegate=yes should be set for container scopes where a systemd instance
  inside the container shall manage the hierarchies below its own cgroup
  and have access to all controllers.

  This is equivalent to enabling all accounting options on the systemd
  process inside the system container.  This means that systemd inside
  the container is responsible for managing Cgroup resources for
  unit files that enable accounting options inside.  Without this
  option, units that make use of cgroup features within system
  containers might misbehave

  See original commit: NixOS/systemd@a931ad47a8

  from the manpage:
    Turns on delegation of further resource control partitioning to
    processes of the unit. Units where this is enabled may create and
    manage their own private subhierarchy of control groups below the
    control group of the unit itself. For unprivileged services (i.e.
    those using the User= setting) the unit's control group will be made
    accessible to the relevant user. When enabled the service manager
    will refrain from manipulating control groups or moving processes
    below the unit's control group, so that a clear concept of ownership
    is established: the control group tree above the unit's control
    group (i.e. towards the root control group) is owned and managed by
    the service manager of the host, while the control group tree below
    the unit's control group is owned and managed by the unit itself.
    Takes either a boolean argument or a list of control group
    controller names. If true, delegation is turned on, and all
    supported controllers are enabled for the unit, making them
    available to the unit's processes for management. If false,
    delegation is turned off entirely (and no additional controllers are
    enabled). If set to a list of controllers, delegation is turned on,
    and the specified controllers are enabled for the unit. Note that
    additional controllers than the ones specified might be made
    available as well, depending on configuration of the containing
    slice unit or other units contained in it. Note that assigning the
    empty string will enable delegation, but reset the list of
    controllers, all assignments prior to this will have no effect.
    Defaults to false.

    Note that controller delegation to less privileged code is only safe
    on the unified control group hierarchy. Accordingly, access to the
    specified controllers will not be granted to unprivileged services
    on the legacy hierarchy, even when requested.

    The following controller names may be specified: cpu, cpuacct, io,
    blkio, memory, devices, pids. Not all of these controllers are
    available on all kernels however, and some are specific to the
    unified hierarchy while others are specific to the legacy hierarchy.
    Also note that the kernel might support further controllers, which
    aren't covered here yet as delegation is either not supported at all
    for them or not defined cleanly.

Fixes #49092

It's deprecated, and no longer prints the urls of any xml files for the script
to parse.

Manually corrected three problems:
- fetch.sh: android cli cannot find java executable
- addons.nix: google_apis_25 expression not added correctly
- addons.nix: android_support_extra expression deleted (replaced in android 9 with jetpack/androidx)

- remove sqlite as dependency (I don't see why it's needed)
- run checkPhase after installPhase (at least one test assumes the
standard library in ../lib relative to the nim binary)
- the broken tests pass now or don't exist anymore
- two of the tests requiring network access pass now without network access
- the tests in manyloc do not download dependencies and are passing now

Desktop file is included now, so no need to create it manually.
libgnome-keyring is not used anymore, libsecret replaced it.

* the jre is no longer an official part of the jdk (jmod is
  recommended as a replacement when needing to create smaller runtime
  images)

* darwin continues to use zulu from azul

* apps that used 10 now use 11 (eclipse, bazel, josm)

… version

As suggested by @edolstra

As suggested by @Profpatsch

repstopdf is supposed to be a symlink to epstopdf. Then epstopdf looks
at "$0" to detect when restricted mode needs to be enabled.  Unfortunately
our wrapper will drop all intermediate symlinks, which messes up "$0".
Restricted mode appears to be a security feature, so a test is
introduced to verify that the wrapper works as expected.

http://lists.gnu.org/archive/html/info-gnu/2018-10/msg00003.html

As suggested by @Profpatsch

Technically this is 0.5.4 but it's unreleased

cudatoolkit_9_1: 9.1.85.1 -> 9.1.85.3
cudatoolkit_9_2: init at 9.2.148.1
cudatoolkit_9: 9.1.85.1 -> 9.2.148.1
cudatoolkit_10, cudatoolkit_10_0: init at 10.0.130

cudnn_cudatoolkit_9_0: 7.0.5 -> 7.3.0
cudnn_cudatoolkit_9_1: init at 7.1.3
cudnn_cudatoolkit_9_2: init at 7.2.1
cudnn_cudatoolkit_9: 7.0.5 (9.1) -> 7.3.1 (9.2)
cudnn_cudatoolkit_10, cudnn_cudatoolkit_10_0: init at 7.3.1