Merge pull request #75700 from NixOS/staging-next

Staging next

nixos/modules/tasks/filesystems/nfs.nix

@@ -25,6 +25,9 @@ let
   '';
 
   nfsConfFile = pkgs.writeText "nfs.conf" cfg.extraConfig;
+  requestKeyConfFile = pkgs.writeText "request-key.conf" ''
+    create id_resolver * * ${pkgs.nfs-utils}/bin/nfsidmap -t 600 %k %d
+  '';
 
   cfg = config.services.nfs;
 
@@ -57,9 +60,12 @@ in
 
     systemd.packages = [ pkgs.nfs-utils ];
 
+    environment.systemPackages = [ pkgs.keyutils ];
+
     environment.etc = {
       "idmapd.conf".source = idmapdConfFile;
       "nfs.conf".source = nfsConfFile;
+      "request-key.conf".source = requestKeyConfFile;
     };
 
     systemd.services.nfs-blkmap =

nixos/release-combined.nix

@@ -120,8 +120,8 @@ in rec {
         (all nixos.tests.networking.scripted.macvlan)
         (all nixos.tests.networking.scripted.sit)
         (all nixos.tests.networking.scripted.vlan)
-        (all nixos.tests.nfs3)
+        (all nixos.tests.nfs3.simple)
-        (all nixos.tests.nfs4)
+        (all nixos.tests.nfs4.simple)
         (all nixos.tests.openssh)
         (all nixos.tests.php-pcre)
         (all nixos.tests.predictable-interface-names.predictable)

nixos/tests/all-tests.nix

@@ -190,8 +190,9 @@ in
   networkingProxy = handleTest ./networking-proxy.nix {};
   nextcloud = handleTest ./nextcloud {};
   nexus = handleTest ./nexus.nix {};
-  nfs3 = handleTest ./nfs.nix { version = 3; };
+  # TODO: Test nfsv3 + Kerberos
-  nfs4 = handleTest ./nfs.nix { version = 4; };
+  nfs3 = handleTest ./nfs { version = 3; };
+  nfs4 = handleTest ./nfs { version = 4; };
   nghttpx = handleTest ./nghttpx.nix {};
   nginx = handleTest ./nginx.nix {};
   nginx-sso = handleTest ./nginx-sso.nix {};

nixos/tests/nfs.nix

@@ -1,90 +0,0 @@
-import ./make-test.nix ({ pkgs, version ? 4, ... }:
-
-let
-
-  client =
-    { pkgs, ... }:
-    { fileSystems = pkgs.lib.mkVMOverride
-        [ { mountPoint = "/data";
-            # nfs4 exports the export with fsid=0 as a virtual root directory
-            device = if (version == 4) then "server:/" else "server:/data";
-            fsType = "nfs";
-            options = [ "vers=${toString version}" ];
-          }
-        ];
-      networking.firewall.enable = false; # FIXME: only open statd
-    };
-
-in
-
-{
-  name = "nfs";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ eelco ];
-  };
-
-  nodes =
-    { client1 = client;
-      client2 = client;
-
-      server =
-        { ... }:
-        { services.nfs.server.enable = true;
-          services.nfs.server.exports =
-            ''
-              /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
-            '';
-          services.nfs.server.createMountPoints = true;
-          networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
-        };
-    };
-
-  testScript =
-    ''
-      $server->waitForUnit("nfs-server");
-      $server->succeed("systemctl start network-online.target");
-      $server->waitForUnit("network-online.target");
-
-      startAll;
-
-      $client1->waitForUnit("data.mount");
-      $client1->succeed("echo bla > /data/foo");
-      $server->succeed("test -e /data/foo");
-
-      $client2->waitForUnit("data.mount");
-      $client2->succeed("echo bla > /data/bar");
-      $server->succeed("test -e /data/bar");
-
-      # Test whether restarting ‘nfs-server’ works correctly.
-      $server->succeed("systemctl restart nfs-server");
-      $client2->succeed("echo bla >> /data/bar"); # will take 90 seconds due to the NFS grace period
-
-      # Test whether we can get a lock.
-      $client2->succeed("time flock -n -s /data/lock true");
-
-      # Test locking: client 1 acquires an exclusive lock, so client 2
-      # should then fail to acquire a shared lock.
-      $client1->succeed("flock -x /data/lock -c 'touch locked; sleep 100000' &");
-      $client1->waitForFile("locked");
-      $client2->fail("flock -n -s /data/lock true");
-
-      # Test whether client 2 obtains the lock if we reset client 1.
-      $client2->succeed("flock -x /data/lock -c 'echo acquired; touch locked; sleep 100000' >&2 &");
-      $client1->crash;
-      $client1->start;
-      $client2->waitForFile("locked");
-
-      # Test whether locks survive a reboot of the server.
-      $client1->waitForUnit("data.mount");
-      $server->shutdown;
-      $server->start;
-      $client1->succeed("touch /data/xyzzy");
-      $client1->fail("time flock -n -s /data/lock true");
-
-      # Test whether unmounting during shutdown happens quickly.
-      my $t1 = time;
-      $client1->shutdown;
-      my $duration = time - $t1;
-      die "shutdown took too long ($duration seconds)" if $duration > 30;
-    '';
-})

nixos/tests/nfs/default.nix

@@ -0,0 +1,9 @@
+{ version ? 4
+, system ? builtins.currentSystem
+, pkgs ? import ../../.. { inherit system; }
+}: {
+  simple = import ./simple.nix { inherit version system pkgs; };
+} // pkgs.lib.optionalAttrs (version == 4) {
+  # TODO: Test kerberos + nfsv3
+  kerberos = import ./kerberos.nix { inherit version system pkgs; };
+}

nixos/tests/nfs/kerberos.nix

@@ -0,0 +1,133 @@
+import ../make-test-python.nix ({ pkgs, lib, ... }:
+
+with lib;
+
+let
+  krb5 = 
+    { enable = true;
+      domain_realm."nfs.test"   = "NFS.TEST";
+      libdefaults.default_realm = "NFS.TEST";
+      realms."NFS.TEST" =
+        { admin_server = "server.nfs.test";
+          kdc = "server.nfs.test";
+        };
+    };
+
+  hosts =
+    ''
+      192.168.1.1 client.nfs.test
+      192.168.1.2 server.nfs.test
+    '';
+
+  users = {
+    users.alice = {
+        isNormalUser = true;
+        name = "alice";
+        uid = 1000;
+      };
+  };
+
+in
+
+{
+  name = "nfsv4-with-kerberos";
+ 
+  nodes = {
+    client = { lib, ... }:
+      { inherit krb5 users;
+
+        networking.extraHosts = hosts;
+        networking.domain = "nfs.test";
+        networking.hostName = "client";
+
+        fileSystems = lib.mkVMOverride
+          { "/data" = {
+              device  = "server.nfs.test:/";
+              fsType  = "nfs";
+              options = [ "nfsvers=4" "sec=krb5p" "noauto" ];
+            };
+          };
+      };
+
+    server = { lib, ...}:
+      { inherit krb5 users;
+
+        networking.extraHosts = hosts;
+        networking.domain = "nfs.test";
+        networking.hostName = "server";
+
+        networking.firewall.allowedTCPPorts = [
+          111  # rpc
+          2049 # nfs
+          88   # kerberos
+          749  # kerberos admin
+        ];
+
+        services.kerberos_server.enable = true;
+        services.kerberos_server.realms =
+          { "NFS.TEST".acl =
+            [ { access = "all"; principal = "admin/admin"; } ];
+          };
+
+        services.nfs.server.enable = true;
+        services.nfs.server.createMountPoints = true;
+        services.nfs.server.exports =
+          ''
+            /data *(rw,no_root_squash,fsid=0,sec=krb5p)
+          '';
+      };
+  };
+
+  testScript =
+    ''
+      server.succeed("mkdir -p /data/alice")
+      server.succeed("chown alice:users /data/alice")
+
+      # set up kerberos database
+      server.succeed(
+          "kdb5_util create -s -r NFS.TEST -P master_key",
+          "systemctl restart kadmind.service kdc.service",
+      )
+      server.wait_for_unit(f"kadmind.service")
+      server.wait_for_unit(f"kdc.service")
+
+      # create principals
+      server.succeed(
+          "kadmin.local add_principal -randkey nfs/server.nfs.test",
+          "kadmin.local add_principal -randkey nfs/client.nfs.test",
+          "kadmin.local add_principal -pw admin_pw admin/admin",
+          "kadmin.local add_principal -pw alice_pw alice",
+      )
+
+      # add principals to server keytab
+      server.succeed("kadmin.local ktadd nfs/server.nfs.test")
+      server.succeed("systemctl start rpc-gssd.service rpc-svcgssd.service")
+      server.wait_for_unit(f"rpc-gssd.service")
+      server.wait_for_unit(f"rpc-svcgssd.service")
+
+      client.wait_for_unit("network-online.target")
+
+      # add principals to client keytab
+      client.succeed("echo admin_pw | kadmin -p admin/admin ktadd nfs/client.nfs.test")
+      client.succeed("systemctl start rpc-gssd.service")
+      client.wait_for_unit("rpc-gssd.service")
+
+      with subtest("nfs share mounts"):
+          client.succeed("systemctl restart data.mount")
+          client.wait_for_unit("data.mount")
+
+      with subtest("permissions on nfs share are enforced"):
+          client.fail("su alice -c 'ls /data'")
+          client.succeed("su alice -c 'echo alice_pw | kinit'")
+          client.succeed("su alice -c 'ls /data'")
+
+          client.fail("su alice -c 'echo bla >> /data/foo'")
+          client.succeed("su alice -c 'echo bla >> /data/alice/foo'")
+          server.succeed("test -e /data/alice/foo")
+
+      with subtest("uids/gids are mapped correctly on nfs share"):
+          ids = client.succeed("stat -c '%U %G' /data/alice").split()
+          expected = ["alice", "users"]
+          assert ids == expected, f"ids incorrect: got {ids} expected {expected}"
+    '';
+})

nixos/tests/nfs/simple.nix

@@ -0,0 +1,94 @@
+import ../make-test-python.nix ({ pkgs, version ? 4, ... }:
+
+let
+
+  client =
+    { pkgs, ... }:
+    { fileSystems = pkgs.lib.mkVMOverride
+        [ { mountPoint = "/data";
+            # nfs4 exports the export with fsid=0 as a virtual root directory
+            device = if (version == 4) then "server:/" else "server:/data";
+            fsType = "nfs";
+            options = [ "vers=${toString version}" ];
+          }
+        ];
+      networking.firewall.enable = false; # FIXME: only open statd
+    };
+
+in
+
+{
+  name = "nfs";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ eelco ];
+  };
+
+  nodes =
+    { client1 = client;
+      client2 = client;
+
+      server =
+        { ... }:
+        { services.nfs.server.enable = true;
+          services.nfs.server.exports =
+            ''
+              /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
+            '';
+          services.nfs.server.createMountPoints = true;
+          networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
+        };
+    };
+
+  testScript =
+    ''
+      import time
+
+      server.wait_for_unit("nfs-server")
+      server.succeed("systemctl start network-online.target")
+      server.wait_for_unit("network-online.target")
+
+      start_all()
+
+      client1.wait_for_unit("data.mount")
+      client1.succeed("echo bla > /data/foo")
+      server.succeed("test -e /data/foo")
+
+      client2.wait_for_unit("data.mount")
+      client2.succeed("echo bla > /data/bar")
+      server.succeed("test -e /data/bar")
+
+      with subtest("restarting 'nfs-server' works correctly"):
+          server.succeed("systemctl restart nfs-server")
+          # will take 90 seconds due to the NFS grace period
+          client2.succeed("echo bla >> /data/bar")
+
+      with subtest("can get a lock"):
+          client2.succeed("time flock -n -s /data/lock true")
+
+      with subtest("client 2 fails to acquire lock held by client 1"):
+          client1.succeed("flock -x /data/lock -c 'touch locked; sleep 100000' &")
+          client1.wait_for_file("locked")
+          client2.fail("flock -n -s /data/lock true")
+
+      with subtest("client 2 obtains lock after resetting client 1"):
+          client2.succeed(
+              "flock -x /data/lock -c 'echo acquired; touch locked; sleep 100000' >&2 &"
+          )
+          client1.crash()
+          client1.start()
+          client2.wait_for_file("locked")
+
+      with subtest("locks survive server reboot"):
+          client1.wait_for_unit("data.mount")
+          server.shutdown()
+          server.start()
+          client1.succeed("touch /data/xyzzy")
+          client1.fail("time flock -n -s /data/lock true")
+
+      with subtest("unmounting during shutdown happens quickly"):
+          t1 = time.monotonic()
+          client1.shutdown()
+          duration = time.monotonic() - t1
+          assert duration < 30, f"shutdown took too long ({duration} seconds)"
+    '';
+})

pkgs/build-support/setup-hooks/wrap-gapps-hook.sh

@@ -42,7 +42,9 @@ wrapGAppsHook() {
   fi
 
   for v in ${wrapPrefixVariables:-} GST_PLUGIN_SYSTEM_PATH_1_0 GI_TYPELIB_PATH GRL_PLUGIN_PATH; do
-    gappsWrapperArgs+=(--prefix "$v" : "${!v}")
+    if [ -n "${!v}" ]; then
+      gappsWrapperArgs+=(--prefix "$v" : "${!v}")
+    fi
   done
 
   if [[ -z "${dontWrapGApps:-}" ]]; then

pkgs/development/libraries/gstreamer/bad/default.nix

@@ -86,13 +86,13 @@ let
   inherit (stdenv.lib) optional optionals;
 in stdenv.mkDerivation rec {
   pname = "gst-plugins-bad";
-  version = "1.16.1";
+  version = "1.16.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1dddqacxgp77f3nl153x5a6139wdphc9phds2fpqb2cv6faiqj2n";
+    sha256 = "0x0y0hm0ga3zqi5q4090hw5sjh59y1ry9ak16qsaascm72i7mjzi";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/base/default.nix

@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-base";
-  version = "1.16.1";
+  version = "1.16.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0aybbwnzm15074smdk2bamj3ssck3hjvmilvgh49f19xjf4w8g2w";
+    sha256 = "0sl1hxlyq46r02k7z70v09vx1gi4rcypqmzra9jid93lzvi76gmi";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/core/default.nix

@@ -25,14 +25,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer";
-  version = "1.16.1";
+  version = "1.16.2";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0z9pyhf6zm1r0spw6zym80bvbyx6h8xg9h6535csbnn48ws1q882";
+    sha256 = "0kp93622y29pck8asvil1fmzf55s2gx76wv475a6izc3cwj49w73";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/ges/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-editing-services";
-  version = "1.16.1";
+  version = "1.16.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "10375z5mc3bwfs07mhmfx943sbp55z8m8ihp9xpcknkdks7qg168";
+    sha256 = "05hcf3prna8ajjnqd53221gj9syarrrjbgvjcbhicv0c38csc1hf";
   };
 
   patches = [

pkgs/development/libraries/gstreamer/good/default.nix

@@ -48,13 +48,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gst-plugins-good";
-  version = "1.16.1";
+  version = "1.16.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "07wgz9anf4ram2snp8n1wv6l0q3pd00iaw8bvw3wgklg05lvxflz";
+    sha256 = "068k3cbv1yf3gbllfdzqsg263kzwh21y8dpwr0wvgh15vapkpfs0";
   };
 
   patches = [ ./fix_pkgconfig_includedir.patch ];

pkgs/development/libraries/gstreamer/libav/default.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-libav";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1i31ra0l77cfahb6k5xpx45zwvpskzm848aijsbbx9x4x65799g8";
+    sha256 = "1wpfilc98bad9nsv3y1qapxp35dvn2mvwvrmqwrsj58cf09gc967";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/gstreamer/rtsp-server/default.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-rtsp-server";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0i01f1nr0921z6z4nrh8icz76s2n7i228aqxg1ihvxl65ynsraxh";
+    sha256 = "0vn23nxwvs96g7gcxw5zbnw23hkhky8a8r42wq68411vgf1s41yy";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/gstreamer/ugly/default.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-plugins-ugly";
-  version = "1.16.1";
+  version = "1.16.2";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "07cajqjs8pqchpf2sm87hljx4ibwvkiavqxmacxsr5airar17yab";
+    sha256 = "1jpvc32x6q01zjkfgh6gmq6aaikiyfwwnhj7bmvn52syhrdl202m";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gstreamer/vaapi/default.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gstreamer-vaapi";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0fk0nymvbfc04fv63fj2r6q9vvi431svhkrwpr7kdjvq3rphymyb";
+    sha256 = "00f6sx700qm1ximi1ag2c27m35dywwhhg6awhz85va34mfqff78r";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/gstreamer/validate/default.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gst-validate";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchurl {
     url = "${meta.homepage}/src/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1698arvmpb0cvyi8ll1brvs51vs7i3f3fw19iswh8xhj5adrn1vz";
+    sha256 = "1jpfrzg3yc6kp66bgq3jy14xsj3x71mk2zh0k16yf0326awwqqa8";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libuv/default.nix

@@ -1,14 +1,14 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.33.1";
+  version = "1.34.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "13w60g9pc6998v8plslwpwn7f1hx3c1y4zhgmw025nyd504h5lak";
+    sha256 = "0vcrrqf0zqgsfmgbyl45qhajyab98kxqq66l0w4lkj5say86aln8";
   };
 
   postPatch = let

pkgs/development/libraries/nghttp2/default.nix

@@ -20,11 +20,11 @@ let inherit (stdenv.lib) optional; in
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.39.2";
+  version = "1.40.0";
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "1l51q8xqg7d7y9413z8l0scxgbbl1qkwgq4f09jqb31j492kx8lj";
+    sha256 = "0kyrgd4s2pq51ps5z385kw1hn62m8qp7c4h6im0g4ibrf89qwxc2";
   };
 
   outputs = [ "bin" "out" "dev" "lib" ];

pkgs/development/libraries/openh264/default.nix

@@ -2,25 +2,23 @@
 
 stdenv.mkDerivation rec {
   pname = "openh264";
-  version = "1.8.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "cisco";
-    repo = "openh264";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1pl7hpk25nh7lcx1lbbv984gvnim0d6hxf4qfmrjjfjf6w37sjw4";
+    sha256 = "0sa4n4xshmiiv6h767jjq9qxapxxjwwwm3bpcignkxv5xn5sls5r";
   };
 
-  buildInputs = [ nasm ];
+  nativeBuildInputs = [ nasm ];
 
-  installPhase = ''
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
-    make PREFIX=$out install
-  '';
 
   meta = with stdenv.lib; {
     description = "A codec library which supports H.264 encoding and decoding";
-    homepage = http://www.openh264.org;
+    homepage = "https://www.openh264.org";
-    license = stdenv.lib.licenses.bsd2;
+    license = licenses.bsd2;
     platforms = platforms.unix;
   };
 }

pkgs/development/python-modules/Rtree/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "Rtree";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "140j1vsbcj6sivq1b6pgkwm0czivx2x3d66mqq0d9ymg46njrzn9";
+    sha256 = "6a34b25f588e1563e45af251a8469b43a125d972eb2fa66e9ce96ed29f06c454";
   };
 
   propagatedBuildInputs = [ libspatialindex ];

pkgs/development/python-modules/aresponses/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "aresponses";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d1d6ef52b9a97142d106688cf9b112602ef3dc66f6368de8f91f47241d8cfc9c";
+    sha256 = "20a63536d86af6f31f9b0720c561bdc595b6bfe071940e347ab58b11caff9e1b";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/argcomplete/default.nix

@@ -3,11 +3,11 @@
 }:
 buildPythonPackage rec {
   pname = "argcomplete";
-  version = "1.10.2";
+  version = "1.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ec88b5ccefe2d47d8f14916a006431d0afb756751ee5c46f28654a7d8a69be53";
+    sha256 = "a37f522cf3b6a34abddfedb61c4546f60023b3799b22d1cd971eacdc0861530a";
   };
 
   doCheck = false; # bash-completion test fails with "compgen: command not found".

pkgs/development/python-modules/astor/default.nix

@@ -1,22 +1,14 @@
-{ stdenv, buildPythonPackage, fetchPypi, isPy27, pytest, fetchpatch }:
+{ lib, buildPythonPackage, fetchPypi, isPy27, pytest, fetchpatch }:
 
 buildPythonPackage rec {
   pname = "astor";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0qkq5bf13fqcwablg0nk7rx83izxdizysd42n26j5wbingcfx9ip";
+    sha256 = "0ppscdzzvxpznclkmhhj53iz314x3pfv4yc7c6gwxqgljgdgyvka";
   };
 
-  # fix packaging for setuptools>=41.4
-  patches = [
-    ( fetchpatch {
-        url = "https://github.com/berkerpeksag/astor/pull/163/commits/bd697678674aafcf3f7b1c06af67df181ed584e2.patch";
-        sha256 = "1m4szdyzalngd5klanmpjx5smgpc7rl5klky0lc0yhwbx210mla6";
-    })
-  ];
-
   # disable tests broken with python3.6: https://github.com/berkerpeksag/astor/issues/89
   checkInputs = [ pytest ];
   checkPhase = ''
@@ -28,7 +20,7 @@ buildPythonPackage rec {
                 and not test_codegen_from_root'
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Library for reading, writing and rewriting python AST";
     homepage = https://github.com/berkerpeksag/astor;
     license = licenses.bsd3;

pkgs/development/python-modules/awkward/default.nix

@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "0.12.16";
+  version = "0.12.17";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "df5380b96dc9c1b129e68057578e4a2d42d9b73a0ae97ff263a9072baf8f7a5e";
+    sha256 = "f794c926e726b3545035ffcb8e6defe6a4ea975c6266c0154024e4591739a253";
   };
 
   nativeBuildInputs = [ pytestrunner ];

pkgs/development/python-modules/aws-xray-sdk/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "aws-xray-sdk";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ce4adb60fe67ebe91f2fc57d5067b4e44df6e233652987be4fb2e549688cf9fe";
+    sha256 = "263a38f3920d9dc625e3acb92e6f6d300f4250b70f538bd009ce6e485676ab74";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/bottle/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bottle";
-  version = "0.12.17";
+  version = "0.12.18";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e9eaa412a60cc3d42ceb42f58d15864d9ed1b92e9d630b8130c871c5bb16107c";
+    sha256 = "0819b74b145a7def225c0e83b16a4d5711fde751cd92bae467a69efce720f69e";
   };
 
   propagatedBuildInputs = [ setuptools ];

pkgs/development/python-modules/caldav/default.nix

@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "caldav";
-  version = "0.6.1";
+  version = "0.6.2";
 
   propagatedBuildInputs = [ tzlocal requests vobject lxml nose ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eddb7f4e6a3eb5f02eaa2227817a53ac4372d4c4d51876536f4c6f00282f569e";
+    sha256 = "80c33b143539da3a471148ac89512f67d9df3a5286fae5a023e2ad3923246c0d";
   };
 
   meta = with lib; {

pkgs/development/python-modules/catalogue/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "catalogue";
-  version = "0.0.7";
+  version = "0.0.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0m7xp85fg57wi1l1vdsq2k0b8dv5bnfccds33lb04z9vrds4l3jv";
+    sha256 = "c407a51c22f51b0f938104b6396c489145bae234386e68eb1d56326c3b3e128e";
   };
 
   propagatedBuildInputs = [ importlib-metadata ];

pkgs/development/python-modules/cmd2/default.nix

@@ -6,11 +6,11 @@
 }:
 buildPythonPackage rec {
   pname = "cmd2";
-  version = "0.9.21";
+  version = "0.9.22";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0pxxxhcxf4wzxvlh6jvw30pzgk1nsciq1qfxilpa8idv06jzx048";
+    sha256 = "ba244b07c0b465ff54a6838dc61919599141dc92de1bf00bb0a70875189155e6";
   };
 
   LC_ALL="en_US.UTF-8";

pkgs/development/python-modules/colorama/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "colorama";
-  version = "0.4.1";
+  version = "0.4.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05eed71e2e327246ad6b38c540c4a3117230b19679b875190486ddd2d721422d";
+    sha256 = "e96da0d330793e2cb9485e9ddfd918d456036c7149416295932478192f4436a1";
   };
 
   # No tests in archive

pkgs/development/python-modules/configargparse/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "ConfigArgParse";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "baaf0fd2c1c108d007f402dab5481ac5f12d77d034825bf5a27f8224757bd0ac";
+    sha256 = "558738aff623d6667aa5b85df6093ad3828867de8a82b66a6d458fb42567beb3";
   };
 
   # no tests in tarball

pkgs/development/python-modules/ddt/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "ddt";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d13e6af8f36238e89d00f4ebccf2bda4f6d1878be560a6600689e42077e164e3";
+    sha256 = "9f79cf234064cf9b43492b72da35c473de3f03163d37bd13cec5bd8d200dda6b";
   };
 
   checkInputs = [ nose six pyyaml mock ];

pkgs/development/python-modules/django-mailman3/default.nix

@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "django-mailman3";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0wppv1q3jkkg2d66qsygc4dfpvhfcj5i2as2xpqnzf3l3w7dgja1";
+    sha256 = "b05cf04b2c36916d15b78e24610002206529f1441e2632253a26b2db6bfd3b27";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/django/2_1.nix

@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "2.1.14";
+  version = "2.1.15";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d9159141fc354c4c28cc2b2586d55ba6d5e1531f5470218bb56a75be03d67398";
+    sha256 = "a794f7a2f4b7c928eecfbc4ebad03712ff27fb545abe269bf01aa8500781eb1c";
   };
 
   patches = stdenv.lib.optionals withGdal [

pkgs/development/python-modules/django_contrib_comments/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "django-contrib-comments";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "61b051d7bc3ff593e86b41a1ed5e969423cf55cc92768598af3315e2528e0890";
+    sha256 = "d1232bade3094de07dcc205fc833204384e71ba9d30caadcb5bb2882ce8e8d31";
   };
 
   propagatedBuildInputs = [ django ];

pkgs/development/python-modules/django_reversion/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "django-reversion";
-  version = "3.0.4";
+  version = "3.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ed46722389fb2441860d471c7538967dee545bcee891d3d907b04f4baa98f5fa";
+    sha256 = "1add55bb05311f4acd26683dd71af60729d4f33dfe42c608da8e15e679a32009";
   };
 
   # tests assume the availability of a mysql/postgresql database

pkgs/development/python-modules/dulwich/default.nix

@@ -4,12 +4,12 @@
 , git, glibcLocales }:
 
 buildPythonPackage rec {
-  version = "0.19.13";
+  version = "0.19.14";
   pname = "dulwich";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "aa628449c5f594a9a282f4d9e5993fef65481ef5e3b9b6c52ff31200f8f5dc95";
+    sha256 = "d1320232c859ab086fff79eee8fa6ddbcbcbe01ff0c64c9bed48eca470b00b46";
   };
 
   LC_ALL = "en_US.UTF-8";

pkgs/development/python-modules/faker/default.nix

@@ -17,11 +17,11 @@ assert pythonOlder "3.3" -> ipaddress != null;
 
 buildPythonPackage rec {
   pname = "Faker";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6327c665c0d8721280b3036d9c9e851c60092bc1f30c8394cc433f8723e2bda5";
+    sha256 = "29093e61f12745150774fd05ab499e87252a4fa51ed51e45c40179e854f87925";
   };
 
   nativeBuildInputs = [ pytestrunner ];

pkgs/development/python-modules/fiona/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "Fiona";
-  version = "1.8.11";
+  version = "1.8.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1e7ca9e051f5bffa1c43c70d573da9ca223fc076b84fa73380614fc02b9eb7f6";
+    sha256 = "5ec34898c8b983a723fb4e949dd3e0ed7e691c303e51f6bfd61e52ac9ac813ae";
   };
 
   CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";

pkgs/development/python-modules/foxdot/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "FoxDot";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "07ll1rh1bkq1dpb7gxd86jsjhxni73kp9iljiy0d2b86ji8h108p";
+    sha256 = "8b6d810f5389692c45d236dec89cecc4ff32ad053e4c878c91363acfa4508639";
   };
 
   propagatedBuildInputs = [ tkinter supercollider ];

pkgs/development/python-modules/hdbscan/default.nix

@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "hdbscan";
-  version = "0.8.23";
+  version = "0.8.24";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff60c66591452ceb6bdb7592c560a1ebc7e128a02dd3880e048861f7fea7f78d";
+    sha256 = "fe31a7ea0ce2c9babd190a195e491834ff9f64c74daa4ca94fa65a88f701269a";
   };
 
   checkInputs = [ nose ];

pkgs/development/python-modules/holoviews/default.nix

@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "holoviews";
-  version = "1.12.6";
+  version = "1.12.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "4f6ad184fb6136e5ee37a74b5276825fc3d5fce5033ff3c8db8831ec11ea2e75";
+    sha256 = "c63f76d1ce2261eb0cd147a24be25daff399e7df2c3d6ade3e813d2e9cb7d42f";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/homeassistant-pyozw/default.nix

@@ -2,12 +2,12 @@
 
 python_openzwave.overridePythonAttrs (oldAttrs: rec {
   pname = "homeassistant_pyozw";
-  version = "0.1.4";
+  version = "0.1.7";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "a4ec26b95dba630df8c95c617c510e4a33db93a6a39e8a97056eec7dc9a49d1e";
+    sha256 = "2d500638270ee4f0e7e9e114d9b4402c94c232f314116cdcf88d7c1dc9a44427";
   };
 
   meta.homepage = https://github.com/home-assistant/python-openzwave;

pkgs/development/python-modules/identify/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "identify";
-  version = "1.4.7";
+  version = "1.4.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0vi9qxgnjgxdk4wj3c5ha3hjmc97j3pw1zh2cg39jprapn4rb4fq";
+    sha256 = "7782115794ec28b011702815d9f5e532244560cd2bf0789c4f09381d43befd90";
   };
 
   # Tests not included in PyPI tarball

pkgs/development/python-modules/joblib/default.nix

@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "joblib";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1zwkl6hgi8wbygcc6ql6yk1if665hwk43sa9shglb2afrfm5gk3g";
+    sha256 = "0630eea4f5664c463f23fbf5dcfc54a2bc6168902719fa8e19daf033022786c8";
   };
 
   checkInputs = [ sphinx numpydoc pytest ];

pkgs/development/python-modules/junos-eznc/default.nix

@@ -15,11 +15,11 @@
 
 buildPythonPackage rec {
   pname = "junos-eznc";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c0f853cdad12256ae8c33a80ff6c31a3ce867c481f805b085d554fbb5b5b084f";
+    sha256 = "0f8c4763fe2281979bc00350b93d510368992dbae0dae4fea0bafee5904a7e68";
   };
 
 

pkgs/development/python-modules/kajiki/default.nix

@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "Kajiki";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "85202ff7c2ce2466e9da82f06b25d1d6753d411d0e1b3ab3b145ed1e04c46782";
+    sha256 = "bbec46b19285d42769d7c4f5a8a0195b72a62b54cd360a26a8875319d58efef6";
   };
 
   propagatedBuildInputs = [ Babel pytz nine ];

pkgs/development/python-modules/kombu/default.nix

@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "4.6.6";
+  version = "4.6.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1760b54b1d15a547c9a26d3598a1c8cdaf2436386ac1f5561934bc8a3cbbbd86";
+    sha256 = "67b32ccb6fea030f8799f8fd50dd08e03a4b99464ebc4952d71d8747b1a52ad1";
   };
 
   postPatch = ''

pkgs/development/python-modules/lightgbm/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "lightgbm";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "37225b9f816ea3365ff5988fc8a3717e46ac99a5f223986c86c86cec4f111b54";
+    sha256 = "bd1817be401e74c0d8b049e97ea2f35d2ce155cfa130119ce4195ea207bd6388";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/marionette-harness/mozdevice.nix

@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "mozdevice";
-  version = "3.0.5";
+  version = "3.0.6";
   format = "wheel";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1gpz0y81407pk71p9yzf15kqqk10fcansw8a607488d11m1jn3yf";
+    sha256 = "4cbeb4558f952cb08f53c4b57a405981b5683f38df0b293f0e7d20b6f4c17d84";
     format = "wheel";
   };
 

pkgs/development/python-modules/matplotlib/default.nix

@@ -20,14 +20,14 @@ assert enableTk -> (tcl != null)
 assert enableQt -> pyqt5 != null;
 
 buildPythonPackage rec {
-  version = "3.1.1";
+  version = "3.1.2";
   pname = "matplotlib";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1febd22afe1489b13c6749ea059d392c03261b2950d1d45c17e3aed812080c93";
+    sha256 = "8e8e2c2fe3d873108735c6ee9884e6f36f467df4a143136209cff303b183bada";
   };
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin "-I${libcxx}/include/c++/v1";

pkgs/development/python-modules/mysqlclient/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05ifrfz7rrl7j4gq4xz5acd76lrnmry9vrvg98hknakm72damzgk";
+    sha256 = "f3fdaa9a38752a3b214a6fe79d7cae3653731a53e577821f9187e67cbecb2e16";
   };
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/nest-asyncio/default.nix

@@ -5,13 +5,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.2.0";
+  version = "1.2.1";
   pname = "nest_asyncio";
   disabled = !(pythonAtLeast "3.5");
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f5b22dd23ee6195cea509c344d9ec34274f45bff078d8f18e9dc322dc74c6008";
+    sha256 = "7d4d7c1ca2aad0e5c2706d0222c8ff006805abfd05caa97e6127c8811d0f6adc";
   };
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/nipype/neurdflib.nix

@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "neurdflib";
-  version = "5.0.0.post1";
+  version = "5.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1qgmprixqxycxpjk9wjdmjykma14qqa2wcbx4nsldxi0ga7i7vv5";
+    sha256 = "d34493cee15029ff5db16157429585ff863ba5542675a4d8a94a0da1bc6e3a50";
   };
 
   propagatedBuildInputs = [ isodate html5lib SPARQLWrapper ];

pkgs/development/python-modules/openpyxl/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "openpyxl";
-  version = "3.0.1";
+  version = "3.0.2";
   disabled = isPy27; # 2.6.4 was final python2 release
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a3ee361d3ff04af6048d594775b3a54ffdf215d40fa5c6c78b2a41c0d0b020d3";
+    sha256 = "eb68c08a72ac6d9812df181e88ebece3a68436364353eb6eda3bed863e3d73a6";
   };
 
   checkInputs = [ pytest ];

pkgs/development/python-modules/pafy/default.nix

@@ -1,11 +1,11 @@
 { lib, buildPythonPackage, youtube-dl, fetchPypi }:
 buildPythonPackage rec {
   pname = "pafy";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e842dc589a339a870b5869cc3802f2e95824edf347f65128223cd5ebdff21024";
+    sha256 = "364f1d1312c89582d97dc7225cf6858cde27cb11dfd64a9c2bab1a2f32133b1e";
   };
 
   # No tests included in archive

pkgs/development/python-modules/parameterized/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "parameterized";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d8c8837fb677ed2d5a93b9e2308ce0da3aeb58cf513120d501e0b7af14da78d5";
+    sha256 = "6a94dbea30c6abde99fd4c2f2042c1bf7f980e48908bf92ead62394f93cf57ed";
   };
 
   # Tests require some python3-isms but code works without.

pkgs/development/python-modules/passlib/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "passlib";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3d948f64138c25633613f303bcc471126eae67c04d5e3f6b7b8ce6242f8653e0";
+    sha256 = "8d666cef936198bc2ab47ee9b0410c94adf2ba798e5a84bf220be079ae7ab6a8";
   };
 
   checkInputs = [ nose ];

pkgs/development/python-modules/pbr/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2c8e420cd4ed4cec4e7999ee47409e876af575d4c35a45840d59e8b5f3155ab8";
+    sha256 = "139d2625547dbfa5fb0b81daebb39601c478c21956dc57e2e07b74450a8c506b";
   };
 
   # circular dependencies with fixtures

pkgs/development/python-modules/pgspecial/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "pgspecial";
-  version = "1.11.8";
+  version = "1.11.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c53fa2b2490fa9ec34ede4eafff8ddbe8bce5cba3dcae96509be36ec8c75575";
+    sha256 = "77f8651450ccbde7d3036cfe93486a4eeeb5ade28d1ebc4b2ba186fea0023c56";
   };
 
   checkInputs = [ pytest ];

pkgs/development/python-modules/pluggy/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pluggy";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "fa5fa1622fa6dd5c030e9cad086fa19ef6a0cf6d7a2d12318e10cb49d6d68f34";
+    sha256 = "15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0";
   };
 
   checkPhase = ''

pkgs/development/python-modules/preggy/default.nix

@@ -2,14 +2,14 @@
 
 buildPythonPackage rec {
   pname = "preggy";
-  version = "1.4.2";
+  version = "1.4.4";
 
   propagatedBuildInputs = [ six unidecode ];
   checkInputs = [ nose yanc ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0g4ifjh01dkmdzs4621ahk8hpkngid1xxhl51jvzy4h4li4590hw";
+    sha256 = "25ba803afde4f35ef543a60915ced2e634926235064df717c3cb3e4e3eb4670c";
   };
 
   checkPhase = ''

pkgs/development/python-modules/psd-tools/default.nix

@@ -4,7 +4,7 @@
 
 buildPythonPackage rec {
   pname = "psd-tools";
-  version = "1.8.30";
+  version = "1.8.32";
 
   meta = {
     description = "Python package for reading Adobe Photoshop PSD files";
@@ -14,7 +14,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "101d7df09f9a745f7729c25a1621428e501910ed6436d639e1aded4b03c14e02";
+    sha256 = "fff16658c9ca6bc586adbe0ab060a7d0b7d057eb2a600c3b2001c0558873fb94";
   };
 
   propagatedBuildInputs = [ docopt pillow ];

pkgs/development/python-modules/psutil/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.6.5";
+  version = "5.6.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d051532ac944f1be0179e0506f6889833cf96e466262523e57a871de65a15147";
+    sha256 = "ffad8eb2ac614518bbe3c0b8eb9dffdb3a8d2e3a7d5da51c5b974fb723a5c5aa";
   };
 
   # No tests in archive

pkgs/development/python-modules/publicsuffix/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "publicsuffix";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1adx520249z2cy7ykwjr1k190mn2888wqn9jf8qm27ly4qymjxxf";
+    sha256 = "22ce1d65ab6af5e9b2122e2443facdb93fb5c4abf24138099cb10fe7989f43b6";
   };
 
 

pkgs/development/python-modules/pybullet/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "pybullet";
-  version = "2.5.7";
+  version = "2.5.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "82a235a8fe3c8dee753d765c295ff0da92bcb5096209d26a0cfc3f5c6054e374";
+    sha256 = "5824e902e0dd8bf7177ce5d9e038c6b04be65f72621fe13f93ec15c9d9c85a49";
   };
 
   buildInputs = [

pkgs/development/python-modules/pyfaidx/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "pyfaidx";
-  version = "0.5.5.2";
+  version = "0.5.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1akc8hk8rlw7sv07bv1n2r471acvmxwc57gb69frjpcwggf2phls";
+    sha256 = "512c409b36eadfe39c40e46112d8f96b29fdc1032dc424da2bdc783d476f5b0a";
   };
 
   propagatedBuildInputs = [ six ];

pkgs/development/python-modules/pygobject/default.nix

@@ -2,21 +2,17 @@
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "2.28.6";
+  version = "2.28.7";
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/pygobject/2.28/${pname}-${version}.tar.xz";
-    sha256 = "1f5dfxjnil2glfwxnqr14d2cjfbkghsbsn8n04js2c2icr7iv2pv";
+    sha256 = "0nkam61rsn7y3wik3vw46wk5q2cjfh2iph57hl9m39rc8jijb7dv";
   };
 
   outputs = [ "out" "devdoc" ];
 
-  patches = [
+  patches = stdenv.lib.optionals stdenv.isDarwin [
-    # Fix warning spam
-    ./pygobject-2.28.6-set_qdata.patch
-    ./pygobject-2.28.6-gio-types-2.32.patch
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [
     ./pygobject-2.0-fix-darwin.patch
   ];
 
@@ -38,8 +34,8 @@ buildPythonPackage rec {
   '';
 
   meta = {
-    homepage = http://live.gnome.org/PyGObject;
+    homepage = "https://pygobject.readthedocs.io/";
-    description = "Python bindings for Glib";
+    description = "Python bindings for GLib";
     platforms = stdenv.lib.platforms.unix;
   };
 }

pkgs/development/python-modules/pygobject/pygobject-2.28.6-gio-types-2.32.patch

@@ -1,50 +0,0 @@
-From 42d01f060c5d764baa881d13c103d68897163a49 Mon Sep 17 00:00:00 2001
-From: Ryan Lortie <desrt@desrt.ca>
-Date: Mon, 12 Mar 2012 16:44:14 -0400
-Subject: [PATCH] gio-types.defs: change some enums to flags
-
-These flags types were originally incorrectly handled in glib as being
-enums.  That bug was fixed, but they're still enums here, leading to
-warnings about the mismatch.
-
-Change them to flags.
-
-https://bugzilla.gnome.org/show_bug.cgi?id=668522
----
- gio/gio-types.defs |    6 +++---
- 1 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/gio/gio-types.defs b/gio/gio-types.defs
-index 331e0bc..7eee5c8 100644
---- a/gio/gio-types.defs
-+++ b/gio/gio-types.defs
-@@ -526,7 +526,7 @@
-   )
- )
- 
--(define-enum MountMountFlags
-+(define-flags MountMountFlags
-   (in-module "gio")
-   (c-name "GMountMountFlags")
-   (gtype-id "G_TYPE_MOUNT_MOUNT_FLAGS")
-@@ -545,7 +545,7 @@
-   )
- )
- 
--(define-enum DriveStartFlags
-+(define-flags DriveStartFlags
-   (in-module "gio")
-   (c-name "GDriveStartFlags")
-   (gtype-id "G_TYPE_DRIVE_START_FLAGS")
-@@ -770,7 +770,7 @@
-   )
- )
- 
--(define-enum SocketMsgFlags
-+(define-flags SocketMsgFlags
-   (in-module "gio")
-   (c-name "GSocketMsgFlags")
-   (gtype-id "G_TYPE_SOCKET_MSG_FLAGS")
--- 
-1.7.8.5
-

pkgs/development/python-modules/pygobject/pygobject-2.28.6-set_qdata.patch

@@ -1,28 +0,0 @@
-From 42d871eb0b08ee6d55e95cc7e4b90844919555b9 Mon Sep 17 00:00:00 2001
-From: Ivan Stankovic <ivan.stankovic@avl.com>
-Date: Tue, 21 Feb 2012 12:24:58 +0100
-Subject: [PATCH] Fix set_qdata warning on accessing NULL gobject property
-
-https://bugzilla.gnome.org/show_bug.cgi?id=661155
----
- gobject/pygobject.c |    4 +++-
- 1 files changed, 3 insertions(+), 1 deletions(-)
-
-diff --git a/gobject/pygobject.c b/gobject/pygobject.c
-index 6c2f06c..70dc89a 100644
---- a/gobject/pygobject.c
-+++ b/gobject/pygobject.c
-@@ -991,7 +991,9 @@ pygobject_new(GObject *obj)
- PyObject *
- pygobject_new_sunk(GObject *obj)
- {
--    g_object_set_qdata (obj, pygobject_ref_sunk_key, GINT_TO_POINTER (1));
-+    if (obj)
-+       g_object_set_qdata (obj, pygobject_ref_sunk_key, GINT_TO_POINTER (1));
-+       
-     return pygobject_new_full(obj, TRUE, NULL);
- }
- 
--- 
-1.7.8.5
-

pkgs/development/python-modules/pyhomematic/default.nix

@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pyhomematic";
-  version = "0.1.61";
+  version = "0.1.62";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7ef0f3b2ed30023297840d365cf94dcf81b7ee6d2be62fff14730e9eb7b59c00";
+    sha256 = "3547ad176f287a9d3b4409692485b6fb456107d70350a32071423e13803cfdab";
   };
 
   # PyPI tarball does not include tests/ directory

pkgs/development/python-modules/pyopengl/default.nix

@@ -7,11 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pyopengl";
-  version = "3.1.0";
+  version = "3.1.4";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyOpenGL";
-    sha256 = "9b47c5c3a094fa518ca88aeed35ae75834d53e4285512c61879f67a48c94ddaf";
+    inherit version;
+    sha256 = "0bdf5ed600df30c8830455702338902528717c0af85ac5914f1dc5aa0bfa6eee";
   };
 
   propagatedBuildInputs = [ pkgs.libGLU pkgs.libGL pkgs.freeglut pillow ];

pkgs/development/python-modules/pyrsistent/default.nix

@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pyrsistent";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "eb6545dbeb1aa69ab1fb4809bfbf5a8705e44d92ef8fc7c2361682a47c46c778";
+    sha256 = "f3b280d030afb652f79d67c5586157c5c1355c9a58dfc7940566e28d28f3df1b";
   };
 
   propagatedBuildInputs = [ six ];

pkgs/development/python-modules/pytest/4.nix

@@ -3,7 +3,7 @@
 , atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy
 }:
 buildPythonPackage rec {
-  version = "4.6.6";
+  version = "4.6.7";
   pname = "pytest";
 
   preCheck = ''
@@ -13,7 +13,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "692d9351353ef709c1126266579edd4fd469dcf6b5f4f583050f72161d6f3592";
+    sha256 = "9ea149066f566c943d3122f4b1cf1b577cab73189d11f490b54703fa5fa9df50";
   };
 
   checkInputs = [ hypothesis mock ];

pkgs/development/python-modules/pyvcd/default.nix

@@ -6,12 +6,12 @@
 , pytest }:
 
 buildPythonPackage rec {
-  version = "0.1.4";
+  version = "0.1.5";
   pname = "pyvcd";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0dv9wac5y5z9j54ypyc59csxdiy9ybpphw9ipxp1k8nfg65q9jxx";
+    sha256 = "9e796f8d00d8392716bef9759f118231f5d77d2fff79d8a32151e3bb5579ff25";
   };
 
   buildInputs = [ setuptools_scm ];

pkgs/development/python-modules/pywebpush/default.nix

@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "pywebpush";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "de8b7e638c6b595c6405f16fd5356e92d2feb8237ab4e50a89770e4ed93aebd6";
+    sha256 = "e80ae0ea978b2e3b7860d2a9ae836528f5fa2e13936673e0b6613589965937ee";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/responses/default.nix

@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "responses";
-  version = "0.10.6";
+  version = "0.10.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "502d9c0c8008439cfcdef7e251f507fcfdd503b56e8c0c87c3c3e3393953f790";
+    sha256 = "46d4e546a19fc6106bc7e804edd4551ef04690405e41e7e750ebc295d042623b";
   };
 
   propagatedBuildInputs = [ cookies mock requests six ];

pkgs/development/python-modules/runsnakerun/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "runsnakerun";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "61d03a13f1dcb3c1829f5a146da1fe0cc0e27947558a51e848b6d469902815ef";
+    sha256 = "a66a0cdf0333dc3c0830c18e2f3d62f741dea197cd01a7e0059da4886a3a123f";
   };
 
   propagatedBuildInputs = [ squaremap wxPython ];

pkgs/development/python-modules/runway-python/default.nix

@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "runway-python";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "30046ced74b5502eca604b1ae766fd3daa1b5ed6379fbe1210730710c752d4f6";
+    sha256 = "c5293bca6589747db687c593b81f52dc9df8155367ffa57ddc1993a6f9d95bde";
   };
 
   propagatedBuildInputs = [ flask flask-cors numpy pillow gevent wget six colorcet ];

pkgs/development/python-modules/scipy/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "scipy";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a03939b431994289f39373c57bbe452974a7da724ae7f9620a1beee575434da4";
+    sha256 = "64bf4e8ae0db2d42b58477817f648d81e77f0b381d0ea4427385bba3f959380a";
   };
 
   checkInputs = [ nose pytest ];

pkgs/development/python-modules/semantic-version/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "semantic_version";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "71c716e99086c44d068262b86e4775aa6db7fabee0743e4e33b00fbf6f672585";
+    sha256 = "9dcc6fbad58da3c4d5eee2287025e226bb05c39463f14b741357801baae9dcce";
   };
 
   # ModuleNotFoundError: No module named 'tests'

pkgs/development/python-modules/sentry-sdk/default.nix

@@ -20,11 +20,11 @@
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "0.13.2";
+  version = "0.13.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ff1fa7fb85703ae9414c8b427ee73f8363232767c9cd19158f08f6e4f0b58fc7";
+    sha256 = "c6b919623e488134a728f16326c6f0bcdab7e3f59e7f4c472a90eea4d6d8fe82";
   };
 
   checkInputs = [ django flask tornado bottle rq falcon ]

pkgs/development/python-modules/setuptools/default.nix

@@ -13,7 +13,7 @@
 
 let
   pname = "setuptools";
-  version = "41.6.0";
+  version = "42.0.2";
 
   # Create an sdist of setuptools
   sdist = stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ let
       owner = "pypa";
       repo = pname;
       rev = "v${version}";
-      sha256 = "0j7bfxq9fwa55ijzw8zn9aa2z2zx4lw2n4jbn1662pjg7v62knv1";
+      sha256 = "1xqx3sha5ir40g1h15r7q063bcbl9bvh967vig574k3jgwxrz2ik";
       name = "${pname}-${version}-source";
     };
 

pkgs/development/python-modules/sqlmap/default.nix

@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.3.11";
+  version = "1.3.12";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "27ef900b1116776128d0d09bff21f8d2f6bb2ea887cd59fe1a32aec5563aacb0";
+    sha256 = "3bad3275e2f29ffa54d4013a2ac2c77e87d01a1d745065d54ed5e60bc68dfbf0";
   };
 
   # No tests in archive

pkgs/development/python-modules/squaremap/default.nix

@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "squaremap";
-  version = "1.0.4";
+  version = "1.0.5";
   disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "feab6cb3b222993df68440e34825d8a16de2c74fdb290ae3974c86b1d5f3eef8";
+    sha256 = "b16ce5950cbfa63e3284015095293cd26ed5e26045fd14d488fb825b4f95e9a8";
   };
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/statsmodels/default.nix

@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "statsmodels";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "320659a80f916c2edf9dfbe83512d9004bb562b72eedb7d9374562038697fa10";
+    sha256 = "9cd2194c6642a8754e85f9a6e6912cdf996bebf6ff715d3cc67f65dadfd37cc9";
   };
 
   checkInputs = with self; [ nose ];

pkgs/development/python-modules/testfixtures/default.nix

@@ -3,11 +3,11 @@
 
 buildPythonPackage rec {
   pname = "testfixtures";
-  version = "6.10.2";
+  version = "6.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c0eb9d20ce3b53e0cf543da7c46c263cc9792f13223def8b26edb6180ecdc895";
+    sha256 = "8f22100d4fb841b958f64e71c8820a32dc46f57d4d7e077777b932acd87b7327";
   };
 
   checkInputs = [ pytest mock sybil zope_component twisted ];

pkgs/development/python-modules/tifffile/default.nix

@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "tifffile";
-  version = "2019.7.26";
+  version = "2019.7.26.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "82c5c72de4dc19cc7011e4e8c45492e17121bd02cfa98c015ddd2a83e36f09bc";
+    sha256 = "2abb91c3a23a61593c5635ac1a19f67e732b46291c305fcee0eeaad41181a13f";
   };
 
   patches = lib.optional isPy27 ./python2-regex-compat.patch;

pkgs/development/python-modules/tox/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "tox";
-  version = "3.14.1";
+  version = "3.14.2";
 
   buildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ packaging pluggy py six virtualenv toml filelock ];
@@ -22,7 +22,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bcfa3e40abc1e9b70607b56adfd976fe7dc8286ad56aab44e3151daca7d2d0d0";
+    sha256 = "7efd010a98339209f3a8292f02909b51c58417bfc6838ab7eca14cf90f96117a";
   };
 
   meta = with lib; {

pkgs/development/python-modules/uamqp/default.nix

@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "uamqp";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9d15cb12d61a6481f7de412c2d53a99f87650e0d1e5394b047aeee5514964fb8";
+    sha256 = "efb53d244bbe336557bad206f9e48159661934baeb0bfe0addfadc1f69796137";
   };
 
   buildInputs = [

pkgs/development/python-modules/validators/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "validators";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1bhla1l8gbks572zp4f254acz23822dz2mp122djxvp328i87b7h";
+    sha256 = "0bfe836a1af37bb266d71ec1e98b530c38ce11bc7fbe0c4c96ef7b1532d019e5";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/virtualenv/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "16.7.7";
+  version = "16.7.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d257bb3773e48cac60e475a19b608996c73f4d333b3ba2e4e57d5ac6134e0136";
+    sha256 = "116655188441670978117d0ebb6451eb6a7526f9ae0796cc0dee6bd7356909b0";
   };
 
   # Doubt this is needed - FRidh 2017-07-07

pkgs/development/python-modules/wasabi/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "wasabi";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0w2jkgrf0x58v8x90v4nifbwcb87pp613vp3sld1fk2avn80imnw";
+    sha256 = "9af48b37709000dac34653be376aaac2e3e15392b8c78d0898124c52e083d088";
   };
 
   checkInputs = [

pkgs/development/python-modules/xarray/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "xarray";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "a8b93e1b0af27fa7de199a2d36933f1f5acc9854783646b0f1b37fed9b4da091";
+    sha256 = "04b2f4d24707b8871a7ffa37328d0a2de74e81bd30791c9608712612601abd23";
   };
 
   checkInputs = [ pytest ];

pkgs/development/python-modules/xattr/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "xattr";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7cb1b28eeab4fe99cc4350e831434142fce658f7d03f173ff7722144e6a47458";
+    sha256 = "b0bbca828e04ef2d484a6522ae7b3a7ccad5e43fa1c6f54d78e24bb870f49d44";
   };
 
   propagatedBuildInputs = [ cffi ];

pkgs/os-specific/linux/bluez/default.nix

@@ -77,6 +77,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "rulesdir=${placeholder "out"}/lib/udev/rules.d" ];
 
+  doCheck = stdenv.hostPlatform.isx86_64;
+
   postInstall = ''
     mkdir -p $test/{bin,test}
     cp -a test $test

pkgs/os-specific/linux/kernel/patches.nix

@@ -6,6 +6,11 @@
       patch = ./bridge-stp-helper.patch;
     };
 
+  request_key_helper =
+    { name = "request-key-helper";
+      patch = ./request-key-helper.patch;
+    };
+
   p9_fixes =
     { name = "p9-fixes";
       patch = ./p9-fixes.patch;

pkgs/os-specific/linux/kernel/request-key-helper.patch

@@ -0,0 +1,13 @@
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 957b9e3e1492..5436a0d8b81d 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -114,7 +114,7 @@ static int call_usermodehelper_keys(const char *path, char **argv, char **envp,
+  */
+ static int call_sbin_request_key(struct key *authkey, void *aux)
+ {
+-	static char const request_key[] = "/sbin/request-key";
++	static char const request_key[] = "/run/current-system/sw/bin/request-key";
+ 	struct request_key_auth *rka = get_request_key_auth(authkey);
+ 	const struct cred *cred = current_cred();
+ 	key_serial_t prkey, sskey;