jpas · pull · Jul 6, 2020 · Jun 18, 2020 · Jul 3, 2020 · Jul 4, 2020
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
@@ -302,6 +302,11 @@ in
                 lpath = "acme/${cert}";
                 apath = "/var/lib/${lpath}";
                 spath = "/var/lib/acme/.lego/${cert}";
+                keyName = builtins.replaceStrings ["*"] ["_"] data.domain;
+                requestedDomains = pipe ([ data.domain ] ++ (attrNames data.extraDomains)) [
+                  (domains: sort builtins.lessThan domains)
+                  (domains: concatStringsSep "," domains)
+                ];
                 fileMode = if data.allowKeysForGroup then "640" else "600";
                 globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ]
                           ++ optionals (cfg.acceptTerms) [ "--accept-tos" ]
@@ -316,6 +321,7 @@ in
                   certOpts ++ data.extraLegoRenewFlags);
                 acmeService = {
                   description = "Renew ACME Certificate for ${cert}";
+                  path = with pkgs; [ openssl ];
                   after = [ "network.target" "network-online.target" ];
                   wants = [ "network-online.target" ];
                   wantedBy = mkIf (!config.boot.isContainer) [ "multi-user.target" ];
@@ -332,11 +338,18 @@ in
                     ExecStart = pkgs.writeScript "acme-start" ''
                       #!${pkgs.runtimeShell} -e
                       test -L ${spath}/accounts -o -d ${spath}/accounts || ln -s ../accounts ${spath}/accounts
-                      ${pkgs.lego}/bin/lego ${renewOpts} || ${pkgs.lego}/bin/lego ${runOpts}
+                      LEGO_ARGS=(${runOpts})
+                      if [ -e ${spath}/certificates/${keyName}.crt ]; then
+                        REQUESTED_DOMAINS="${requestedDomains}"
+                        EXISTING_DOMAINS="$(openssl x509 -in ${spath}/certificates/${keyName}.crt -noout -ext subjectAltName | tail -n1 | sed -e 's/ *DNS://g')"
+                        if [ "''${REQUESTED_DOMAINS}" == "''${EXISTING_DOMAINS}" ]; then
+                          LEGO_ARGS=(${renewOpts})
+                        fi
+                      fi
+                      ${pkgs.lego}/bin/lego ''${LEGO_ARGS[@]}
                     '';
                     ExecStartPost =
                       let
-                        keyName = builtins.replaceStrings ["*"] ["_"] data.domain;
                         script = pkgs.writeScript "acme-post-start" ''
                           #!${pkgs.runtimeShell} -e
                           cd ${apath}

diff --git a/pkgs/applications/audio/osmid/default.nix b/pkgs/applications/audio/osmid/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osmid";
-  version = "0.6.8";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "llloret";
     repo = "osmid";
     rev = "v${version}";
-    sha256 = "1yl25abf343yvd49nfsgxsz7jf956zrsi5n4xyqb5ldlp2hifk15";
+    sha256 = "1s1wsrp6g6wb0y61xzxvaj59mwycrgy52r4h456086zkz10ls6hw";
   };
 
   nativeBuildInputs = [ cmake ];

diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -40,11 +40,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bluejeans";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans.rpm";
-    sha256 = "06lcpkga8h0zpl2wlysj6n979f0yg361frp3zr0vwzln3fiil2a7";
+    sha256 = "180hc854ngwfn6y6nsrfn74rv78cxhq6sgshrca5zqv6wq3l98g0";
   };
 
   nativeBuildInputs = [ rpmextract makeWrapper ];

diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "19.12.27";
+  version = "20.06.07";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "0za44h7f4vk37yl30xlaa6w76maiipb6p63gl9hl1rshdn9nxq0y";
+    sha256 = "1j1i5w3pfw61axcqh8jdkcv20fkmwq0mslfhq725sp3jwv9wyqy2";
   };
 
   nativeBuildInputs = [ gtk3 ];

diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "19.12.27";
+  version = "20.06.07";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "0pjbi2g7wk8gyr4lvp8fvcb8z29kc3l6v19a45axgadnc609hqw7";
+    sha256 = "0irib8qywc32cqxchb4z20p0vnyvlgxk8z4vqa5lzx7cd4xmflm1";
   };
 
   nativeBuildInputs = [ gtk3 ];

diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-icon-theme";
-  version = "20200602";
+  version = "20200702";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = pname;
     rev = version;
-    sha256 = "0cms5dn8qfasi9xpfcq1hsdyvcb39vkh97mjvi7zrng4iyihq06y";
+    sha256 = "0p1grfgnmqawayk15qxnl09jai96avx9731qladmcbm2lik4qdpl";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, pythonOlder, fetchFromGitHub, async-timeout, pytest, pytest-asyncio }:
 buildPythonPackage rec {
-  version = "3.2.7";
+  version = "3.2.10";
   pname = "asgiref";
 
   disabled = pythonOlder "3.5";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = pname;
     rev = version;
-    sha256 = "1qf29blzhh6sljaj1adc0p8cnyxh9ar6hky9ccdfbgmrk4rw5kwc";
+    sha256 = "1sj4yy2injaskwfi5pkb542jl8s6ljijnyra81gpw0pgd3d0bgxv";
   };
 
   propagatedBuildInputs = [ async-timeout ];

diff --git a/pkgs/development/python-modules/boolean-py/default.nix b/pkgs/development/python-modules/boolean-py/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "boolean.py";
-  version = "3.7";
+  version = "3.8";
 
   src = fetchFromGitHub {
     owner = "bastikr";
     repo = "boolean.py";
     rev = "v${version}";
-    sha256 = "1q9ji2jq07qr6vgp9yv6y8lx6h0zyi07fqjga3yi3vpfk46h2jn1";
+    sha256 = "02jznrfrihhk69ai1vnh26s3rshl4kfc2id7li6xccavc2ws5y3b";
   };
 
   meta = with lib; {

diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname =  "boto3";
-  version = "1.14.3"; # N.B: if you change this, change botocore too
+  version = "1.14.16"; # N.B: if you change this, change botocore too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1qapj3hbbj116x7yca3m9ivl44iisrk0cppri9sk3b1mpv371a0v";
+    sha256 = "1yywn4wbzn37b5gbkmksqpxnabw1yjvbp710chc3v6cymyv4lnnf";
   };
 
   propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.17.3"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.17.16"; # N.B: if you change this, change boto3 and awscli to a matching version
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0mrkkb7vc7jdxrr9gyg92i6ar801kpss53nfqp1di6xfi4jxkx0k";
+    sha256 = "0k4bx4anj0xjjfj4jx3v1fhzrmk5k9qgdpxqghxzyzmnsry4y37y";
   };
 
   propagatedBuildInputs = [

diff --git a/pkgs/development/python-modules/mahotas/default.nix b/pkgs/development/python-modules/mahotas/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "mahotas";
-  version = "1.4.9";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner = "luispedro";
     repo = "mahotas";
     rev = "v${version}";
-    sha256 = "151hri3lwcm9p7w1nyw99h8c70j51698cvzaiazvwb6gl4khwavv";
+    sha256 = "0fjiyl82wj1a6xzr9mss2y2rydl4zchl2cbdbg0jm0fcrs99q4hw";
   };
 
   # remove this as soon as https://github.com/luispedro/mahotas/issues/97 is fixed

diff --git a/pkgs/os-specific/linux/e1000e/default.nix b/pkgs/os-specific/linux/e1000e/default.nix
@@ -4,19 +4,20 @@ assert stdenv.lib.versionOlder kernel.version "4.10";
 
 stdenv.mkDerivation rec {
   name = "e1000e-${version}-${kernel.version}";
-  version = "3.3.5.3";
+  version = "3.8.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/e1000/e1000e-${version}.tar.gz";
-    sha256 = "1ajz3vdnf1y307k585w95r6jlh4ah8d74bq36gdkjl1z5hgiqi9q";
+    sha256 = "1q8dbqh14c7r15q6k6iv5k0d6xpi74i71d5r54py60gr099m2ha4";
   };
 
   hardeningDisable = [ "pic" ];
 
   configurePhase = ''
     cd src
     kernel_version=${kernel.modDirVersion}
-    sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' Makefile
+    substituteInPlace common.mk \
+      --replace "/lib/modules" "${kernel.dev}/lib/modules"
     export makeFlags="BUILD_KERNEL=$kernel_version"
   '';
 

diff --git a/pkgs/servers/monitoring/plugins/wmiplus/default.nix b/pkgs/servers/monitoring/plugins/wmiplus/default.nix
@@ -4,15 +4,15 @@
 
 stdenv.mkDerivation rec {
   pname = "check-wmiplus";
-  version = "1.64";
+  version = "1.65";
 
   # We fetch from github.com instead of the proper upstream as nix-build errors
   # out with 406 when trying to fetch the sources
   src = fetchFromGitHub {
     owner = "speartail";
     repo = "checkwmiplus";
     rev = "v${version}";
-    sha256 = "1m36rd2wnc5dk4mm9q4ch67w19144dl112p9s6lhc1sh6h25ln6r";
+    sha256 = "1as0iyhy4flpm37mb7lvah7rnd6ax88appjm1icwhy7iq03wi8pl";
   };
 
   patches = [

diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.34.1";
+  version = "1.34.2";
 
   src = with stdenv.lib; fetchurl {
     url = "https://releases.wikimedia.org/mediawiki/${versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "0jg1ls5xy2bmvvd63lpvnkj53rfmik6sy2px14mphxba3gbcpf5c";
+    sha256 = "1mi46a14b2080x6mh61mb49xq0ky27g0lbm3gqgvkgckc1zmbp0f";
   };
 
   prePatch = ''

diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, writeText }:
 
 let
-  version = "3.8.3";
+  version = "3.9";
   stableVersion = builtins.substring 0 2 (builtins.replaceStrings ["."] [""] version);
 in
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "1anjv4gvbb6833j04a1b4aaysnl4h0x96sr1hhm4nm5kq2fimjd1";
+    sha256 = "1splsxdxzwf49zxrdb4q05fj60agqyzv0ikvk05gaf49qqd8rznz";
   };
 
   phpConfig = writeText "config.php" ''

diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
@@ -19,11 +19,11 @@ let
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "awscli";
-  version = "1.18.80"; # N.B: if you change this, change botocore to a matching version too
+  version = "1.18.93"; # N.B: if you change this, change botocore to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0519rlc0m0888ag7s55lz516vsgif5pws6rzhmclbbw38g4wmb2k";
+    sha256 = "1kl0sa125k4q4ximg0p9rriz18w90lj3nhc7racqnc3bhig7w1ih";
   };
 
   postPatch = ''

diff --git a/pkgs/tools/text/kdiff3/default.nix b/pkgs/tools/text/kdiff3/default.nix
@@ -6,11 +6,11 @@
 
 mkDerivation rec {
   pname = "kdiff3";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0s5vsm1avzv88b6mf2pp20c2sz0srrj52iiqpnwi3p4ihivm8wgv";
+    sha256 = "1awb62y09kbkjhz22mdkrppd6w5aihd3l0ssvpil8c9hg8syjd9g";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];

diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "govc";
-  version = "0.23.0";
+  version = "0.23.1";
 
   goPackagePath = "github.com/vmware/govmomi";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "05nb5xd90kbazdx4l9bw72729dh5hrcaqdi9wpf5ma7bz7mw9wzi";
+    sha256 = "05f6i7v8v9g3w3cmz8c952djl652mj6qcwjx9iyl23h6knd1d9b1";
   };
 
   meta = {