Merge remote-tracking branch 'upstream/master' into HEAD

lib/maintainers.nix

@@ -327,6 +327,7 @@
   jirkamarsik = "Jirka Marsik <jiri.marsik89@gmail.com>";
   jlesquembre = "José Luis Lafuente <jl@lafuente.me>";
   jluttine = "Jaakko Luttinen <jaakko.luttinen@iki.fi>";
+  Jo = "Joachim Ernst <0x4A6F@shackspace.de>";
   joachifm = "Joachim Fasting <joachifm@fastmail.fm>";
   joamaki = "Jussi Maki <joamaki@gmail.com>";
   joelmo = "Joel Moberg <joel.moberg@gmail.com>";
@@ -369,6 +370,7 @@
   kristoff3r = "Kristoffer Søholm <k.soeholm@gmail.com>";
   ktosiek = "Tomasz Kontusz <tomasz.kontusz@gmail.com>";
   kuznero = "Roman Kuznetsov <roman@kuznero.com>";
+  lasandell = "Luke Sandell <lasandell@gmail.com>";
   lassulus = "Lassulus <lassulus@gmail.com>";
   layus = "Guillaume Maudoux <layus.on@gmail.com>";
   ldesgoui = "Lucas Desgouilles <ldesgoui@gmail.com>";
@@ -478,6 +480,7 @@
   mudri = "James Wood <lamudri@gmail.com>";
   muflax = "Stefan Dorn <mail@muflax.com>";
   myrl = "Myrl Hex <myrl.0xf@gmail.com>";
+  nadrieril = "Nadrieril Feneanar <nadrieril@gmail.com>";
   namore = "Roman Naumann <namor@hemio.de>";
   nand0p = "Fernando Jose Pando <nando@hex7.com>";
   Nate-Devv = "Nathan Moore <natedevv@gmail.com>";
@@ -661,6 +664,7 @@
   sternenseemann = "Lukas Epple <post@lukasepple.de>";
   stesie = "Stefan Siegl <stesie@brokenpipe.de>";
   steveej = "Stefan Junker <mail@stefanjunker.de>";
+  StijnDW = "Stijn DW <stekke@airmail.cc>";
   StillerHarpo = "Florian Engel <florianengel39@gmail.com>";
   stumoss = "Stuart Moss <samoss@gmail.com>";
   SuprDewd = "Bjarki Ágúst Guðmundsson <suprdewd@gmail.com>";
@@ -670,6 +674,7 @@
   symphorien = "Guillaume Girol <symphorien_nixpkgs@xlumurb.eu>";
   szczyp = "Szczyp <qb@szczyp.com>";
   sztupi = "Attila Sztupak <attila.sztupak@gmail.com>";
+  tadfisher = "Tad Fisher <tadfisher@gmail.com>";
   taeer = "Taeer Bar-Yam <taeer@necsi.edu>";
   tailhook = "Paul Colomiets <paul@colomiets.name>";
   taketwo = "Sergey Alexandrov <alexandrov88@gmail.com>";

nixos/modules/module-list.nix

@@ -75,6 +75,7 @@
   ./programs/cdemu.nix
   ./programs/chromium.nix
   ./programs/command-not-found/command-not-found.nix
+  ./programs/criu.nix
   ./programs/dconf.nix
   ./programs/environment.nix
   ./programs/fish.nix
@@ -92,6 +93,7 @@
   ./programs/nano.nix
   ./programs/npm.nix
   ./programs/oblogout.nix
+  ./programs/plotinus.nix
   ./programs/qt5ct.nix
   ./programs/rootston.nix
   ./programs/screen.nix
@@ -102,6 +104,7 @@
   ./programs/ssh.nix
   ./programs/ssmtp.nix
   ./programs/sysdig.nix
+  ./programs/systemtap.nix
   ./programs/sway.nix
   ./programs/thefuck.nix
   ./programs/tmux.nix

nixos/modules/programs/criu.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.programs.criu;
+in {
+
+  options = {
+    programs.criu = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Install <command>criu</command> along with necessary kernel options.
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    system.requiredKernelConfig = with config.lib.kernelConfig; [
+      (isYes "CHECKPOINT_RESTORE")
+    ];
+    boot.kernel.features.criu = true;
+    environment.systemPackages = [ pkgs.criu ];
+  };
+
+}

nixos/modules/programs/plotinus.nix

@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.plotinus;
+in
+{
+  meta = {
+    maintainers = pkgs.plotinus.meta.maintainers;
+    doc = ./plotinus.xml;
+  };
+
+  ###### interface
+
+  options = {
+    programs.plotinus = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Whether to enable the Plotinus GTK+3 plugin.  Plotinus provides a
+          popup (triggered by Ctrl-Shift-P) to search the menus of a
+          compatible application.
+        '';
+        type = types.bool;
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    environment.variables.XDG_DATA_DIRS = [ "${pkgs.plotinus}/share/gsettings-schemas/${pkgs.plotinus.name}" ];
+    environment.variables.GTK3_MODULES = [ "${pkgs.plotinus}/lib/libplotinus.so" ];
+  };
+}

nixos/modules/programs/plotinus.xml

@@ -0,0 +1,25 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-program-plotinus">
+
+<title>Plotinus</title>
+
+<para><emphasis>Source:</emphasis> <filename>modules/programs/plotinus.nix</filename></para>
+
+<para><emphasis>Upstream documentation:</emphasis> <link xlink:href="https://github.com/p-e-w/plotinus"/></para>
+
+<para>Plotinus is a searchable command palette in every modern GTK+ application.</para>
+
+<para>When in a GTK+3 application and Plotinus is enabled, you can press <literal>Ctrl+Shift+P</literal> to open the command palette.  The command palette provides a searchable list of of all menu items in the application.</para>
+
+<para>To enable Plotinus, add the following to your <filename>configuration.nix</filename>:
+
+<programlisting>
+programs.plotinus.enable = true;
+</programlisting>
+
+</para>
+
+</chapter>

nixos/modules/programs/systemtap.nix

@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.programs.systemtap;
+in {
+
+  options = {
+    programs.systemtap = {
+      enable = mkOption {
+        default = false;
+        description = ''
+          Install <command>systemtap</command> along with necessary kernel options.
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    system.requiredKernelConfig = with config.lib.kernelConfig; [
+      (isYes "DEBUG")
+    ];
+    boot.kernel.features.debug = true;
+    environment.systemPackages = [
+      config.boot.kernelPackages.systemtap
+    ];
+  };
+
+}

nixos/modules/rename.nix

@@ -205,6 +205,8 @@ with lib;
       "See the 16.09 release notes for more information.")
     (mkRemovedOptionModule [ "services" "phpfpm" "phpIni" ] "")
     (mkRemovedOptionModule [ "services" "dovecot2" "package" ] "")
+    (mkRemovedOptionModule [ "services" "firefox" "syncserver" "user" ] "")
+    (mkRemovedOptionModule [ "services" "firefox" "syncserver" "group" ] "")
     (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
     (mkRemovedOptionModule [ "services" "xserver" "displayManager" "sddm" "themes" ]
       "Set the option `services.xserver.displayManager.sddm.package' instead.")

nixos/modules/services/cluster/kubernetes/dashboard.nix

@@ -6,12 +6,12 @@ let
   cfg = config.services.kubernetes.addons.dashboard;
 
   name = "gcr.io/google_containers/kubernetes-dashboard-amd64";
-	version = "v1.6.3";
+	version = "v1.8.2";
 
   image = pkgs.dockerTools.pullImage {
     imageName = name;
     imageTag = version;
-    sha256 = "1sf54d96nkgic9hir9c6p14gw24ns1k5d5a0r1sg414kjrvic0b4";
+    sha256 = "11h0fz3wxp0f10fsyqaxjm7l2qg7xws50dv5iwlck5gb1fjmajad";
   };
 in {
   options.services.kubernetes.addons.dashboard = {

nixos/modules/services/cluster/kubernetes/default.nix

@@ -301,8 +301,8 @@ in {
           Kubernetes apiserver authorization mode (AlwaysAllow/AlwaysDeny/ABAC/RBAC). See
           <link xlink:href="http://kubernetes.io/docs/admin/authorization.html"/>
         '';
-        default = ["RBAC"];
+        default = ["RBAC" "Node"];
-        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC"]);
+        type = types.listOf (types.enum ["AlwaysAllow" "AlwaysDeny" "ABAC" "RBAC" "Node"]);
       };
 
       authorizationPolicy = mkOption {
@@ -344,7 +344,7 @@ in {
           Kubernetes admission control plugins to use. See
           <link xlink:href="http://kubernetes.io/docs/admin/admission-controllers/"/>
         '';
-        default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds"];
+        default = ["NamespaceLifecycle" "LimitRanger" "ServiceAccount" "ResourceQuota" "DefaultStorageClass" "DefaultTolerationSeconds" "NodeRestriction"];
         example = [
           "NamespaceLifecycle" "NamespaceExists" "LimitRanger"
           "SecurityContextDeny" "ServiceAccount" "ResourceQuota"

nixos/modules/services/hardware/fwupd.nix

@@ -87,4 +87,8 @@ in {
       "d /var/lib/fwupd 0755 root root -"
     ];
   };
+
+  meta = {
+    maintainers = pkgs.fwupd.maintainers;
+  };
 }

nixos/modules/services/networking/connman.nix

@@ -52,6 +52,15 @@ in {
         '';
       };
 
+      extraFlags = mkOption {
+        type = with types; listOf string;
+        default = [ ];
+        example = [ "--nodnsproxy" ];
+        description = ''
+          Extra flags to pass to connmand
+        '';
+      };
+
     };
 
   };
@@ -81,7 +90,7 @@ in {
         Type = "dbus";
         BusName = "net.connman";
         Restart = "on-failure";
-        ExecStart = "${pkgs.connman}/sbin/connmand --config=${configFile} --nodaemon";
+        ExecStart = "${pkgs.connman}/sbin/connmand --config=${configFile} --nodaemon ${toString cfg.extraFlags}";
         StandardOutput = "null";
       };
     };

nixos/modules/services/networking/dante.nix

@@ -47,7 +47,7 @@ in
 
     systemd.services.dante = {
       description   = "Dante SOCKS v4 and v5 compatible proxy server";
-      after         = [ "network.target" ];
+      after         = [ "network-online.target" ];
       wantedBy      = [ "multi-user.target" ];
 
       serviceConfig = {

nixos/modules/services/networking/firefox/sync-server.nix

@@ -33,6 +33,8 @@ let
 in
 
 {
+  meta.maintainers = with lib.maintainers; [ nadrieril ];
+
   options = {
     services.firefox.syncserver = {
       enable = mkOption {
@@ -70,18 +72,6 @@ in
         '';
       };
 
-      user = mkOption {
-        type = types.str;
-        default = "syncserver";
-        description = "User account under which syncserver runs.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "syncserver";
-        description = "Group account under which syncserver runs.";
-      };
-
       publicUrl = mkOption {
         type = types.str;
         default = "http://localhost:5000/";
@@ -137,7 +127,9 @@ in
   config = mkIf cfg.enable {
 
     systemd.services.syncserver = let
-      syncServerEnv = pkgs.python.withPackages(ps: with ps; [ syncserver pasteScript ]);
+      syncServerEnv = pkgs.python.withPackages(ps: with ps; [ syncserver pasteScript requests ]);
+      user = "syncserver";
+      group = "syncserver";
     in {
       after = [ "network.target" ];
       description = "Firefox Sync Server";
@@ -145,43 +137,43 @@ in
       path = [ pkgs.coreutils syncServerEnv ];
 
       serviceConfig = {
-        User = cfg.user;
+        User = user;
-        Group = cfg.group;
+        Group = group;
         PermissionsStartOnly = true;
       };
 
       preStart = ''
         if ! test -e ${cfg.privateConfig}; then
-          mkdir -m 700 -p $(dirname ${cfg.privateConfig})
+          mkdir -p $(dirname ${cfg.privateConfig})
           echo  > ${cfg.privateConfig} '[syncserver]'
+          chmod 600 ${cfg.privateConfig}
           echo >> ${cfg.privateConfig} "secret = $(head -c 20 /dev/urandom | sha1sum | tr -d ' -')"
         fi
-        chown ${cfg.user}:${cfg.group} ${cfg.privateConfig}
+        chmod 600 ${cfg.privateConfig}
+        chmod 755 $(dirname ${cfg.privateConfig})
+        chown ${user}:${group} ${cfg.privateConfig}
+
       '' + optionalString (cfg.sqlUri == defaultSqlUri) ''
         if ! test -e $(dirname ${defaultDbLocation}); then
           mkdir -m 700 -p $(dirname ${defaultDbLocation})
-          chown ${cfg.user}:${cfg.group} $(dirname ${defaultDbLocation})
+          chown ${user}:${group} $(dirname ${defaultDbLocation})
         fi
+
         # Move previous database file if it exists
         oldDb="/var/db/firefox-sync-server.db"
         if test -f $oldDb; then
           mv $oldDb ${defaultDbLocation}
-          chown ${cfg.user}:${cfg.group} ${defaultDbLocation}
+          chown ${user}:${group} ${defaultDbLocation}
         fi
       '';
       serviceConfig.ExecStart = "${syncServerEnv}/bin/paster serve ${syncServerIni}";
     };
 
-    users.extraUsers = optionalAttrs (cfg.user == "syncserver")
+    users.users.syncserver = {
-      (singleton {
+      group = "syncserver";
-        name = "syncserver";
+      isSystemUser = true;
-        group = cfg.group;
+    };
-        isSystemUser = true;
-      });
 
-    users.extraGroups = optionalAttrs (cfg.group == "syncserver")
+    users.groups.syncserver = {};
-      (singleton {
-        name = "syncserver";
-      });
   };
 }

nixos/modules/services/networking/freeradius.nix

@@ -0,0 +1,72 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.freeradius;
+
+  freeradiusService = cfg:
+  {
+    description = "FreeRadius server";
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+    preStart = ''
+      ${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout
+    '';
+
+    serviceConfig = {
+        ExecStart = "${pkgs.freeradius}/bin/radiusd -f -d ${cfg.configDir} -l stdout -xx";
+        ExecReload = [
+          "${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout"
+          "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
+        ];
+        User = "radius";
+        ProtectSystem = "full";
+        ProtectHome = "on";
+        Restart = "on-failure";
+        RestartSec = 2;
+    };
+  };
+
+  freeradiusConfig = {
+    enable = mkEnableOption "the freeradius server";
+
+    configDir = mkOption {
+      type = types.path;
+      default = "/etc/raddb";
+      description = ''
+        The path of the freeradius server configuration directory.
+      '';
+    };
+
+  };
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+    services.freeradius = freeradiusConfig;
+  };
+
+
+  ###### implementation
+
+  config = mkIf (cfg.enable) {
+
+    users = {
+      extraUsers.radius = {
+        /*uid = config.ids.uids.radius;*/
+        description = "Radius daemon user";
+      };
+    };
+
+    systemd.services.freeradius = freeradiusService cfg;
+
+  };
+
+}

nixos/modules/services/networking/prosody.nix

@@ -179,6 +179,19 @@ in
         description = "Whether to enable the prosody server";
       };
 
+      package = mkOption {
+        type = types.package;
+        description = "Prosody package to use";
+        default = pkgs.prosody;
+        defaultText = "pkgs.prosody";
+        example = literalExample ''
+          pkgs.prosody.override {
+            withExtraLibs = [ pkgs.luaPackages.lpty ];
+            withCommunityModules = [ "auth_external" ];
+          };
+        '';
+      };
+
       allowRegistration = mkOption {
         type = types.bool;
         default = false;
@@ -306,7 +319,7 @@ in
         User = "prosody";
         Type = "forking";
         PIDFile = "/var/lib/prosody/prosody.pid";
-        ExecStart = "${pkgs.prosody}/bin/prosodyctl start";
+        ExecStart = "${cfg.package}/bin/prosodyctl start";
       };
     };
 

nixos/modules/services/web-servers/nginx/default.nix

@@ -578,6 +578,7 @@ in
         mkdir -p ${cfg.stateDir}/logs
         chmod 700 ${cfg.stateDir}
         chown -R ${cfg.user}:${cfg.group} ${cfg.stateDir}
+        ${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir} -t
         '';
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir}";

nixos/modules/system/boot/kernel.nix

@@ -5,7 +5,7 @@ with lib;
 let
 
   inherit (config.boot) kernelPatches;
-
+  inherit (config.boot.kernel) features;
   inherit (config.boot.kernelPackages) kernel;
 
   kernelModulesConf = pkgs.writeText "nixos.conf"
@@ -21,11 +21,25 @@ in
 
   options = {
 
+    boot.kernel.features = mkOption {
+      default = {};
+      example = literalExample "{ debug = true; }";
+      internal = true;
+      description = ''
+        This option allows to enable or disable certain kernel features.
+        It's not API, because it's about kernel feature sets, that
+        make sense for specific use cases. Mostly along with programs,
+        which would have separate nixos options.
+        `grep features pkgs/os-specific/linux/kernel/common-config.nix`
+      '';
+    };
+
     boot.kernelPackages = mkOption {
       default = pkgs.linuxPackages;
       apply = kernelPackages: kernelPackages.extend (self: super: {
         kernel = super.kernel.override {
           kernelPatches = super.kernel.kernelPatches ++ kernelPatches;
+          features = lib.recursiveUpdate super.kernel.features features;
         };
       });
       # We don't want to evaluate all of linuxPackages for the manual
@@ -170,7 +184,7 @@ in
       [ "loglevel=${toString config.boot.consoleLogLevel}" ] ++
       optionals config.boot.vesa [ "vga=0x317" ];
 
-    boot.kernel.sysctl."kernel.printk" = config.boot.consoleLogLevel;
+    boot.kernel.sysctl."kernel.printk" = mkDefault config.boot.consoleLogLevel;
 
     boot.kernelModules = [ "loop" "atkbd" ];
 

nixos/modules/system/boot/networkd.nix

@@ -94,7 +94,7 @@ let
   checkNetwork = checkUnitConfig "Network" [
     (assertOnlyFields [
       "Description" "DHCP" "DHCPServer" "IPForward" "IPMasquerade" "IPv4LL" "IPv4LLRoute"
-      "LLMNR" "MulticastDNS" "Domains" "Bridge" "Bond"
+      "LLMNR" "MulticastDNS" "Domains" "Bridge" "Bond" "IPv6PrivacyExtensions"
     ])
     (assertValueOneOf "DHCP" ["both" "none" "v4" "v6"])
     (assertValueOneOf "DHCPServer" boolValues)
@@ -104,6 +104,7 @@ let
     (assertValueOneOf "IPv4LLRoute" boolValues)
     (assertValueOneOf "LLMNR" boolValues)
     (assertValueOneOf "MulticastDNS" boolValues)
+    (assertValueOneOf "IPv6PrivacyExtensions" ["yes" "no" "prefer-public" "kernel"])
   ];
 
   checkAddress = checkUnitConfig "Address" [

nixos/modules/system/boot/stage-1-init.sh

@@ -167,6 +167,7 @@ done
 # Load the required kernel modules.
 mkdir -p /lib
 ln -s @modulesClosure@/lib/modules /lib/modules
+ln -s @modulesClosure@/lib/firmware /lib/firmware
 echo @extraUtils@/bin/modprobe > /proc/sys/kernel/modprobe
 for i in @kernelModules@; do
     echo "loading module $(basename $i)..."

nixos/modules/system/boot/stage-1.nix

@@ -13,12 +13,14 @@ let
 
   kernelPackages = config.boot.kernelPackages;
   modulesTree = config.system.modulesTree;
+  firmware = config.hardware.firmware;
 
 
   # Determine the set of modules that we need to mount the root FS.
   modulesClosure = pkgs.makeModulesClosure {
     rootModules = config.boot.initrd.availableKernelModules ++ config.boot.initrd.kernelModules;
     kernel = modulesTree;
+    firmware = firmware;
     allowMissing = true;
   };
 

nixos/modules/tasks/network-interfaces-systemd.nix

@@ -91,6 +91,7 @@ in
             (if i.useDHCP != null then i.useDHCP else cfg.useDHCP && interfaceIps i == [ ]));
           address = flip map (interfaceIps i)
             (ip: "${ip.address}/${toString ip.prefixLength}");
+          networkConfig.IPv6PrivacyExtensions = "kernel";
         } ];
       })))
       (mkMerge (flip mapAttrsToList cfg.bridges (name: bridge: {

nixos/modules/tasks/network-interfaces.nix

@@ -155,6 +155,16 @@ let
         description = "Name of the interface.";
       };
 
+      preferTempAddress = mkOption {
+        type = types.bool;
+        default = cfg.enableIPv6;
+        defaultText = literalExample "config.networking.enableIpv6";
+        description = ''
+          When using SLAAC prefer a temporary (IPv6) address over the EUI-64
+          address for originating connections. This is used to reduce tracking.
+        '';
+      };
+
       useDHCP = mkOption {
         type = types.nullOr types.bool;
         default = null;
@@ -941,6 +951,11 @@ in
         message = ''
           The networking.interfaces."${i.name}" must not have any defined ips when it is a slave.
         '';
+      })) ++ (flip map interfaces (i: {
+        assertion = i.preferTempAddress -> cfg.enableIPv6;
+        message = ''
+          Temporary addresses are only needed when IPv6 is enabled.
+        '';
       })) ++ [
         {
           assertion = cfg.hostId == null || (stringLength cfg.hostId == 8 && isHexString cfg.hostId);
@@ -963,9 +978,10 @@ in
       "net.ipv6.conf.all.disable_ipv6" = mkDefault (!cfg.enableIPv6);
       "net.ipv6.conf.default.disable_ipv6" = mkDefault (!cfg.enableIPv6);
       "net.ipv6.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
-    } // listToAttrs (concatLists (flip map (filter (i: i.proxyARP) interfaces)
+    } // listToAttrs (flip concatMap (filter (i: i.proxyARP) interfaces)
-        (i: flip map [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${i.name}.proxy_arp" true))
+        (i: flip map [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${i.name}.proxy_arp" true)))
-      ));
+      // listToAttrs (flip map (filter (i: i.preferTempAddress) interfaces)
+        (i: nameValuePair "net.ipv6.conf.${i.name}.use_tempaddr" 2));
 
     # Capabilities won't work unless we have at-least a 4.3 Linux
     # kernel because we need the ambient capability

nixos/modules/virtualisation/lxd.nix

@@ -38,6 +38,15 @@ in
     environment.systemPackages =
       [ pkgs.lxd ];
 
+    security.apparmor = {
+      enable = true;
+      profiles = [
+        "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start"
+        "${pkgs.lxc}/etc/apparmor.d/lxc-containers"
+      ];
+      packages = [ pkgs.lxc ];
+    };
+
     systemd.services.lxd =
       { description = "LXD Container Management Daemon";
 
@@ -47,6 +56,10 @@ in
         # TODO(wkennington): Add lvm2 and thin-provisioning-tools
         path = with pkgs; [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute iptables ];
 
+        preStart = ''
+          mkdir -m 0755 -p /var/lib/lxc/rootfs
+        '';
+
         serviceConfig.ExecStart = "@${pkgs.lxd.bin}/bin/lxd lxd --syslog --group lxd";
         serviceConfig.Type = "simple";
         serviceConfig.KillMode = "process"; # when stopping, leave the containers alone

nixos/release.nix

@@ -258,8 +258,10 @@ in rec {
   tests.firefox = callTest tests/firefox.nix {};
   tests.firewall = callTest tests/firewall.nix {};
   tests.fleet = callTestOnTheseSystems ["x86_64-linux"] tests/fleet.nix {};
+  #tests.fwupd = callTest tests/fwupd.nix {}; # build during evaluation
   #tests.gitlab = callTest tests/gitlab.nix {};
   tests.gitolite = callTest tests/gitolite.nix {};
+  tests.gjs = callTest tests/gjs.nix {};
   tests.gocd-agent = callTest tests/gocd-agent.nix {};
   tests.gocd-server = callTest tests/gocd-server.nix {};
   tests.gnome3 = callTest tests/gnome3.nix {};
@@ -277,6 +279,7 @@ in rec {
   tests.ipv6 = callTest tests/ipv6.nix {};
   tests.jenkins = callTest tests/jenkins.nix {};
   tests.plasma5 = callTest tests/plasma5.nix {};
+  tests.plotinus = callTest tests/plotinus.nix {};
   tests.keymap = callSubTests tests/keymap.nix {};
   tests.initrdNetwork = callTest tests/initrd-network.nix {};
   tests.kafka_0_9 = callTest tests/kafka_0_9.nix {};

nixos/tests/docker-tools.nix

@@ -9,28 +9,31 @@ import ./make-test.nix ({ pkgs, ... }: {
   nodes = {
     docker =
       { config, pkgs, ... }: {
-        virtualisation.docker.enable = true;
+        virtualisation = {
+          diskSize = 1024;
+          docker.enable = true;
+        };
       };
   };
 
   testScript =
-    let
+    ''
-      dockerImage = pkgs.dockerTools.buildImage {
-        name = "hello-docker";
-        contents = [ pkgs.hello ];
-        tag = "sometag";
-
-        # TODO: create another test checking whether runAsRoot works as intended.
-
-        config = {
-          Cmd = [ "hello" ];
-        };
-      };
-
-    in ''
       $docker->waitForUnit("sockets.target");
-      $docker->succeed("docker load --input='${dockerImage}'");
-      $docker->succeed("docker run hello-docker:sometag");
-    '';
 
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
+      $docker->succeed("docker run ${pkgs.dockerTools.examples.bash.imageName} /bin/bash --version");
+
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.nix}'");
+      $docker->succeed("docker run ${pkgs.dockerTools.examples.nix.imageName} /bin/nix-store -qR ${pkgs.nix}");
+
+      # To test the pullImage tool
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.nixFromDockerHub}'");
+      $docker->succeed("docker run nixos/nix:1.11 nix-store --version");
+
+      # To test runAsRoot and entry point
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.nginx}'");
+      $docker->succeed("docker run --name nginx -d -p 8000:80 ${pkgs.dockerTools.examples.nginx.imageName}");
+      $docker->waitUntilSucceeds('curl http://localhost:8000/');
+      $docker->succeed("docker rm --force nginx");
+    '';
 })

nixos/tests/fwupd.nix

@@ -0,0 +1,19 @@
+# run installed tests
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "fwupd";
+
+  meta = {
+    maintainers = pkgs.fwupd.meta.maintainers;
+  };
+
+  machine = { config, pkgs, ... }: {
+    services.fwupd.enable = true;
+    environment.systemPackages = with pkgs; [ gnome-desktop-testing ];
+    environment.variables.XDG_DATA_DIRS = [ "${pkgs.fwupd.installedTests}/share" ];
+    virtualisation.memorySize = 768;
+  };
+
+  testScript = ''
+    $machine->succeed("gnome-desktop-testing-runner");
+  '';
+})

nixos/tests/gjs.nix

@@ -0,0 +1,19 @@
+# run installed tests
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "gjs";
+
+  meta = {
+    maintainers = pkgs.gnome3.gjs.meta.maintainers;
+  };
+
+  machine = { pkgs, ... }: {
+    imports = [ ./common/x11.nix ];
+    environment.systemPackages = with pkgs; [ gnome-desktop-testing ];
+    environment.variables.XDG_DATA_DIRS = [ "${pkgs.gnome3.gjs.installedTests}/share" ];
+  };
+
+  testScript = ''
+    $machine->waitForX;
+    $machine->succeed("gnome-desktop-testing-runner");
+  '';
+})

nixos/tests/kubernetes/base.nix

@@ -7,7 +7,7 @@ let
   mkKubernetesBaseTest =
     { name, domain ? "my.zyx", test, machines
     , pkgs ? import <nixpkgs> { inherit system; }
-    , certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; }
+    , certs ? import ./certs.nix { inherit pkgs; externalDomain = domain; kubelets = attrNames machines; }
     , extraConfiguration ? null }:
     let
       masterName = head (filter (machineName: any (role: role == "master") machines.${machineName}.roles) (attrNames machines));

nixos/tests/kubernetes/certs.nix

@@ -2,7 +2,8 @@
   pkgs ? import <nixpkgs> {},
   internalDomain ? "cloud.yourdomain.net",
   externalDomain ? "myawesomecluster.cluster.yourdomain.net",
-  serviceClusterIp ? "10.0.0.1"
+  serviceClusterIp ? "10.0.0.1",
+  kubelets
 }:
 let
   runWithCFSSL = name: cmd:
@@ -123,9 +124,10 @@ let
   };
 
   apiserver-client = {
-    kubelet = createClientCertKey {
+    kubelet = hostname: createClientCertKey {
       inherit ca;
-      cn = "apiserver-client-kubelet";
+      name = "apiserver-client-kubelet-${hostname}";
+      cn = "system:node:${hostname}.${externalDomain}";
       groups = ["system:nodes"];
     };
 
@@ -175,10 +177,9 @@ in {
     paths = [
       (writeCFSSL (noKey ca))
       (writeCFSSL kubelet)
-      (writeCFSSL apiserver-client.kubelet)
       (writeCFSSL apiserver-client.kube-proxy)
       (writeCFSSL etcd-client)
-    ];
+    ] ++ map (hostname: writeCFSSL (apiserver-client.kubelet hostname)) kubelets;
   };
 
   admin = writeCFSSL apiserver-client.admin;

nixos/tests/kubernetes/dns.nix

@@ -3,7 +3,7 @@ with import ./base.nix { inherit system; };
 let
   domain = "my.zyx";
 
-  certs = import ./certs.nix { externalDomain = domain; };
+  certs = import ./certs.nix { externalDomain = domain; kubelets = [ "machine1" "machine2" ]; };
 
   redisPod = pkgs.writeText "redis-pod.json" (builtins.toJSON {
     kind = "Pod";

nixos/tests/kubernetes/kubernetes-common.nix

@@ -29,8 +29,8 @@ let
       tlsKeyFile = "${certs.worker}/kubelet-key.pem";
       hostname = "${config.networking.hostName}.${config.networking.domain}";
       kubeconfig = {
-        certFile = "${certs.worker}/apiserver-client-kubelet.pem";
+        certFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}.pem";
-        keyFile = "${certs.worker}/apiserver-client-kubelet-key.pem";
+        keyFile = "${certs.worker}/apiserver-client-kubelet-${config.networking.hostName}-key.pem";
       };
     };
     controllerManager = {

nixos/tests/networking.nix

@@ -476,6 +476,63 @@ let
         );
       '';
     };
+    privacy = {
+      name = "Privacy";
+      nodes.router = { config, pkgs, ... }: {
+        virtualisation.vlans = [ 1 ];
+        boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
+        networking = {
+          useNetworkd = networkd;
+          interfaces.eth1 = {
+            ipv6Address = "fd00:1234:5678:1::1";
+            ipv6PrefixLength = 64;
+          };
+        };
+        services.radvd = {
+          enable = true;
+          config = ''
+            interface eth1 {
+              AdvSendAdvert on;
+              AdvManagedFlag on;
+              AdvOtherConfigFlag on;
+
+              prefix fd00:1234:5678:1::/64 {
+                AdvAutonomous on;
+                AdvOnLink on;
+              };
+            };
+          '';
+        };
+      };
+      nodes.client = { config, pkgs, ... }: with pkgs.lib; {
+        virtualisation.vlans = [ 1 ];
+        networking = {
+          useNetworkd = networkd;
+          useDHCP = true;
+          interfaces.eth1 = {
+            preferTempAddress = true;
+            ip4 = mkOverride 0 [ ];
+            ip6 = mkOverride 0 [ ];
+          };
+        };
+      };
+      testScript = { nodes, ... }:
+        ''
+          startAll;
+
+          $client->waitForUnit("network.target");
+          $router->waitForUnit("network-online.target");
+
+          # Wait until we have an ip address
+          $client->waitUntilSucceeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'");
+
+          # Test vlan 1
+          $client->waitUntilSucceeds("ping -c 1 fd00:1234:5678:1::1");
+
+          # Test address used is temporary
+          $client->succeed("! ip route get fd00:1234:5678:1::1 | grep -q ':[a-f0-9]*ff:fe[a-f0-9]*:'");
+        '';
+    };
   };
 
 in mapAttrs (const (attrs: makeTest (attrs // {

nixos/tests/plotinus.nix

@@ -0,0 +1,27 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "plotinus";
+  meta = {
+    maintainers = pkgs.plotinus.meta.maintainers;
+  };
+
+  machine =
+    { config, pkgs, ... }:
+
+    { imports = [ ./common/x11.nix ];
+      programs.plotinus.enable = true;
+      environment.systemPackages = [ pkgs.gnome3.gnome-calculator pkgs.xdotool ];
+    };
+
+  testScript =
+    ''
+      $machine->waitForX;
+      $machine->execute("xterm -e 'gnome-calculator' &");
+      $machine->waitForWindow(qr/Calculator/);
+      $machine->execute("xdotool key ctrl+shift+p");
+      $machine->sleep(1); # wait for the popup
+      $machine->execute("xdotool key p r e f e r e n c e s Return");
+      $machine->waitForWindow(qr/Preferences/);
+      $machine->screenshot("screen");
+    '';
+
+})

pkgs/applications/audio/mp3blaster/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, ncurses }:
+stdenv.mkDerivation rec {
+
+  version = "3.2.6";
+
+  name = "mp3blaster-${version}";
+
+  src = fetchFromGitHub {
+    owner = "stragulus";
+    repo = "mp3blaster";
+    rev = "v${version}";
+    sha256 = "0pzwml3yhysn8vyffw9q9p9rs8gixqkmg4n715vm23ib6wxbliqs";
+  };
+
+  buildInputs = [ ncurses ];
+
+  buildFlags = [ "CXXFLAGS=-Wno-narrowing" ];
+
+  meta = with stdenv.lib; {
+    description = "An audio player for the text console";
+    homepage = http://www.mp3blaster.org/;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ earldouglas ];
+    platforms = platforms.all;
+  };
+
+}

pkgs/applications/audio/ncpamixer/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, cmake, ncurses, libpulseaudio, pkgconfig }:
+
+stdenv.mkDerivation rec {
+
+  name = "ncpamixer-${version}";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "fulhax";
+    repo = "ncpamixer";
+    rev = version;
+    sha256 = "01kvd0pg5yraymlln5xdzqj1r6adxfvvza84wxn2481kcxfral54";
+  };
+
+  buildInputs = [ ncurses libpulseaudio ];
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  configurePhase = ''
+    make PREFIX=$out build/Makefile
+  '';
+
+  buildPhase = ''
+    make build
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An ncurses mixer for PulseAudio inspired by pavucontrol";
+    homepage = https://github.com/fulhax/ncpamixer;
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ StijnDW ];
+  };
+}

pkgs/applications/audio/non/default.nix

@@ -4,12 +4,12 @@
 
 stdenv.mkDerivation rec {
   name = "non-${version}";
-  version = "2017-03-29";
+  version = "2018-02-15";
   src = fetchFromGitHub {
     owner = "original-male";
     repo = "non";
-    rev = "10c31e57291b6e42be53371567a722b62b32d220";
+    rev = "5ae43bb27c42387052a73e5ffc5d33efb9d946a9";
-    sha256 = "080rha4ffp7qycyg1mqcf4vj0s7z8qfvz6bxm0w29xgg2kkmb3fx";
+    sha256 = "1cljkkyi9dxqpqhx8y6l2ja4zjmlya26m26kqxml8gx08vyvddhx";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/audio/paprefs/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, libpulseaudio, gtkmm2, libglademm
+{ fetchurl, stdenv, pkgconfig, pulseaudioFull, gtkmm2, libglademm
 , dbus_glib, GConf, gconfmm, intltool }:
 
 stdenv.mkDerivation rec {
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1c5b3sb881szavly220q31g7rvpn94wr7ywlk00hqb9zaikml716";
   };
 
-  buildInputs = [ libpulseaudio gtkmm2 libglademm dbus_glib gconfmm ];
+  buildInputs = [ pulseaudioFull gtkmm2 libglademm dbus_glib gconfmm ];
 
   nativeBuildInputs = [ pkgconfig intltool ];
 

pkgs/applications/audio/sunvox/default.nix

@@ -0,0 +1,48 @@
+{ stdenv, fetchurl, unzip, alsaLib, libX11, libXi, SDL2 }:
+
+let
+  libPath = stdenv.lib.makeLibraryPath [ stdenv.cc.cc alsaLib libX11 libXi SDL2 ];
+  arch =
+    if stdenv.isAarch64
+    then "arm64"
+    else if stdenv.isArm
+    then "arm_armhf_raspberry_pi"
+    else if stdenv.is64bit
+    then "x86_64"
+    else "x86";
+in
+stdenv.mkDerivation rec {
+  name = "SunVox-${version}";
+  version = "1.9.3b";
+
+  src = fetchurl {
+    url = "http://www.warmplace.ru/soft/sunvox/sunvox-${version}.zip";
+    sha256 = "0k74rcq7niw4p17vj3zp9lpgi932896dmzqv4ln43g0pz7l18c8b";
+  };
+
+  buildInputs = [ unzip ];
+
+  unpackPhase = "unzip $src";
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share $out/bin
+    mv sunvox $out/share/
+
+    bin="$out/share/sunvox/sunvox/linux_${arch}/sunvox"
+    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+             --set-rpath "${libPath}" \
+             "$bin"
+
+    ln -s "$bin" $out/bin/sunvox
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Small, fast and powerful modular synthesizer with pattern-based sequencer";
+    license = licenses.unfreeRedistributable;
+    homepage = "http://www.warmplace.ru/soft/sunvox/";
+    maintainers = with maintainers; [ puffnfresh ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}

pkgs/applications/editors/android-studio/default.nix

@@ -6,6 +6,7 @@ let
     };
   };
 in rec {
+  # linux-bundle
   stable = mkStudio {
     pname = "android-studio";
     version = "3.0.1.0"; # "Android Studio 3.0.1"
@@ -25,11 +26,12 @@ in rec {
     };
   };
 
+  # linux-beta-bundle
   preview = mkStudio {
     pname = "android-studio-preview";
-    version = "3.1.0.10"; # "Android Studio 3.1 Beta 2"
+    version = "3.1.0.11"; # "Android Studio 3.1 Beta 3"
-    build = "173.4580418";
+    build = "173.4595152";
-    sha256Hash = "0s56vbyq6b1q75ss6pqvhzwqzb6xbp6841f3y5cwhrch2xalxjkc";
+    sha256Hash = "0106ggrf4mkxx3a2dn02km8rdq23sf15ifysykcay29skgdmq6wx";
 
     meta = stable.meta // {
       description = "The Official IDE for Android (preview version)";

pkgs/applications/misc/albert/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   name    = "albert-${version}";
-  version = "0.14.14";
+  version = "0.14.15";
 
   src = fetchFromGitHub {
     owner  = "albertlauncher";
     repo   = "albert";
     rev    = "v${version}";
-    sha256 = "1skh709f4y4p0vqabvvysn6fgws2yq8izbwkib7rfjc357chhmi7";
+    sha256 = "1rjp0bmzs8b9blbxz3sfcanyhgmds882pf1g3jx5qp85y64j8507";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/memo/default.nix

@@ -1,4 +1,4 @@
-{ fetchFromGitHub, ack , tree, stdenv, ... }:
+{ fetchFromGitHub, ag, tree, stdenv, ... }:
 
 stdenv.mkDerivation rec {
 
@@ -15,6 +15,9 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/{bin,share/man/man1,share/bash-completion/completions}
+    substituteInPlace memo \
+      --replace "ack "  "${ag}/bin/ag " \
+      --replace "tree " "${tree}/bin/tree "
     mv memo $out/bin/
     mv doc/memo.1 $out/share/man/man1/memo.1
     mv completion/memo.bash $out/share/bash-completion/completions/memo.sh
@@ -32,4 +35,4 @@ stdenv.mkDerivation rec {
     maintainers = [ stdenv.lib.maintainers.mrVanDalo ];
     platforms = stdenv.lib.platforms.all;
   };
-}
+}

pkgs/applications/misc/ranger/default.nix

@@ -6,7 +6,7 @@ with stdenv.lib;
 assert imagePreviewSupport -> w3m != null;
 
 pythonPackages.buildPythonApplication rec {
-  name = "ranger-v${version}";
+  name = "ranger-${version}";
   version = "1.9.0";
 
   src = fetchFromGitHub {

pkgs/applications/misc/slic3r-prusa3d/default.nix

@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, makeWrapper, which, cmake, perl, perlPackages,
-  boost, tbb, wxGTK30, pkgconfig, gtk3, fetchurl, gtk2, bash, mesa_glu }:
+  boost, tbb, wxGTK30, pkgconfig, gtk3, fetchurl, gtk2, bash, mesa_glu,
+  glew, eigen }:
 let
   AlienWxWidgets = perlPackages.buildPerlPackage rec {
     name = "Alien-wxWidgets-0.69";
@@ -34,10 +35,14 @@ stdenv.mkDerivation rec {
   name = "slic3r-prusa-edition-${version}";
   version = "1.38.7";
 
+  enableParallelBuilding = true;
+
   buildInputs = [
     cmake
     perl
     makeWrapper
+    eigen
+    glew
     tbb
     which
     Wx

pkgs/applications/misc/welle-io/default.nix

@@ -3,7 +3,7 @@
 , faad2, rtl-sdr, libusb, fftwSinglePrec }:
 let
 
-  version = "1.0-rc1";
+  version = "1.0-rc2";
 
 in stdenv.mkDerivation {
 
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     owner = "AlbrechtL";
     repo = "welle.io";
     rev = "V${version}";
-    sha256 = "1xi59rmk3rdqqxxxrm2pbllrlsql46vxs95l1pkfx7bp8f7n7rsv";
+    sha256 = "01x4ldq6lvmdrmxi857594nj9xpn2h7848vvf3f54sh1zrawn4k4";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];

pkgs/applications/misc/wsjtx/default.nix

@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, asciidoc, asciidoctor, autoconf, automake, cmake,
+  docbook_xsl, fftw, fftwFloat, gfortran, libtool, libpulseaudio, qtbase,
+  qtmultimedia, qtserialport, texinfo, libusb1 }:
+
+stdenv.mkDerivation rec {
+  name = "wsjtx-${version}";
+  version = "1.8.0";
+
+  # This is a composite source tarball containing both wsjtx and a hamlib fork
+  src = fetchurl {
+    url = "http://physics.princeton.edu/pulsar/K1JT/wsjtx-${version}.tgz";
+    sha256 = "21603ad4d5f43cd9c79a6e8cf468bde88c554654012b2c6c1ef9144cfbf668ce";
+  };
+
+  # Hamlib builds with autotools, wsjtx builds with cmake
+  # Omitting pkgconfig because it causes issues locating the built hamlib
+  nativeBuildInputs = [
+    asciidoc asciidoctor autoconf automake cmake docbook_xsl gfortran libtool
+    texinfo
+  ];
+  buildInputs = [ fftw fftwFloat libusb1 qtbase qtmultimedia qtserialport ];
+
+  # Composite build has its own patch step after it extracts the inner archives
+  postPatch = "cp ${./wsjtx.patch} wsjtx.patch";
+
+  meta = with stdenv.lib; {
+    description = "Weak-signal digital communication modes for amateur radio";
+    longDescription = ''
+      WSJT-X implements communication protocols or "modes" called FT8, JT4, JT9,
+      JT65, QRA64, ISCAT, MSK144, and WSPR, as well as one called Echo for
+      detecting and measuring your own radio signals reflected from the Moon.
+      These modes were all designed for making reliable, confirmed ham radio
+      contacts under extreme weak-signal conditions.
+    '';
+    homepage = http://physics.princeton.edu/pulsar/k1jt/wsjtx.html;
+    # Older licenses are for the statically-linked hamlib
+    license = with licenses; [ gpl3Plus gpl2Plus lgpl21Plus ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.lasandell ];
+  };
+}

pkgs/applications/misc/wsjtx/wsjtx.patch

@@ -0,0 +1,12 @@
+Index: wsjtx/CMakeLists.txt
+===================================================================
+--- wsjtx/CMakeLists.txt	(revision 8382)
++++ wsjtx/CMakeLists.txt	(working copy)
+@@ -866,6 +866,7 @@
+ find_package (Qt5Widgets 5 REQUIRED)
+ find_package (Qt5Multimedia 5 REQUIRED)
+ find_package (Qt5PrintSupport 5 REQUIRED)
++find_package (Qt5SerialPort 5 REQUIRED)
+ 
+ if (WIN32)
+   add_definitions (-DQT_NEEDS_QTMAIN)

pkgs/applications/misc/zathura/core/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, makeWrapper, pkgconfig
 , gtk, girara, ncurses, gettext, docutils
-, file, sqlite, glib, texlive
+, file, sqlite, glib, texlive, libintlOrEmpty
-, synctexSupport ? true
+, gtk-mac-integration, synctexSupport ? true
 }:
 
 assert synctexSupport -> texlive != null;
@@ -19,12 +19,17 @@ stdenv.mkDerivation rec {
 
   icon = ./icon.xpm;
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [
+    pkgconfig
+  ] ++ optional stdenv.isDarwin [ libintlOrEmpty ];
+
   buildInputs = [
     file gtk girara
     gettext makeWrapper sqlite glib
-  ] ++ optional synctexSupport texlive.bin.core;
+  ] ++ optional synctexSupport texlive.bin.core
+    ++ optional stdenv.isDarwin [ gtk-mac-integration ];
 
+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
   NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   makeFlags = [
@@ -50,7 +55,7 @@ stdenv.mkDerivation rec {
     homepage    = http://pwmt.org/projects/zathura/;
     description = "A core component for zathura PDF viewer";
     license     = licenses.zlib;
-    platforms   = platforms.linux;
+    platforms   = platforms.unix;
     maintainers = with maintainers; [ garbas ];
   };
 }

pkgs/applications/misc/zathura/djvu/default.nix

@@ -13,6 +13,13 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gtkflags.patch ];
 
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    string1='-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}'
+    string2='-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}'
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    echo "''${makefileC1/$string1/$string2}" > Makefile
+  '';
+
   makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];
 
   meta = with stdenv.lib; {
@@ -23,7 +30,7 @@ stdenv.mkDerivation rec {
       djvulibre library.
     '';
     license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ garbas ];
   };
 }

pkgs/applications/misc/zathura/pdf-mupdf/default.nix

@@ -1,5 +1,6 @@
-{ stdenv, lib, fetchurl, pkgconfig, zathura_core, gtk, girara, mupdf, openssl
+{ stdenv, lib, fetchurl, pkgconfig, zathura_core, gtk,
-, libjpeg, jbig2dec, openjpeg, fetchpatch }:
+gtk-mac-integration, girara, mupdf, openssl , libjpeg, jbig2dec,
+openjpeg, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "0.3.2";
@@ -11,7 +12,19 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ zathura_core gtk girara openssl mupdf libjpeg jbig2dec openjpeg ];
+
+  buildInputs = [
+    zathura_core gtk girara openssl mupdf libjpeg jbig2dec openjpeg
+  ] ++ stdenv.lib.optional stdenv.isDarwin [
+    gtk-mac-integration
+  ];
+
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    string1='-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}'
+    string2='-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}'
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    echo "''${makefileC1/$string1/$string2}" > Makefile
+  '';
 
   makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];
 
@@ -23,7 +36,7 @@ stdenv.mkDerivation rec {
       using the mupdf rendering library.
     '';
     license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ cstrahan ];
   };
 }

pkgs/applications/misc/zathura/pdf-poppler/default.nix

@@ -9,11 +9,18 @@ stdenv.mkDerivation rec {
     sha256 = "1m55m7s7f8ng8a7lmcw9z4n5zv7xk4vp9n6fp9j84z6rk2imf7a2";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig zathura_core ];
-  buildInputs = [ poppler zathura_core girara ];
+  buildInputs = [ poppler girara ];
 
   makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];
 
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    string1='-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}'
+    string2='-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}'
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    echo "''${makefileC1/$string1/$string2}" > Makefile
+  '';
+
   meta = with lib; {
     homepage = http://pwmt.org/projects/zathura/;
     description = "A zathura PDF plugin (poppler)";
@@ -22,7 +29,7 @@ stdenv.mkDerivation rec {
       using the poppler rendering library.
     '';
     license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ cstrahan garbas ];
   };
 }

pkgs/applications/misc/zathura/ps/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig, gtk, zathura_core, girara, libspectre, gettext }:
+{ stdenv, lib, fetchurl, pkgconfig, gtk2, zathura_core, girara, libspectre, gettext }:
 
 stdenv.mkDerivation rec {
   name = "zathura-ps-0.2.5";
@@ -9,10 +9,17 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libspectre gettext zathura_core gtk girara ];
+  buildInputs = [ libspectre gettext zathura_core gtk2 girara ];
 
   patches = [ ./gtkflags.patch ];
 
+  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    makefileC1=$(sed -r 's/\.so/.dylib/g' Makefile)
+    makefileC2=$(echo "$makefileC1" | sed 's|-shared ''${LDFLAGS} -o $@ ''$(OBJECTS) ''${LIBS}|-Wl,-dylib_install_name,''${PLUGIN}.dylib -Wl,-bundle_loader,${zathura_core}/bin/.zathura-wrapped -bundle ''${LDFLAGS} -o $@ ''${OBJECTS} ''${LIBS}|g' )
+    echo "$makefileC2" > Makefile
+    echo "$makefileC2"
+  '';
+
   makeFlags = [ "PREFIX=$(out)" "PLUGINDIR=$(out)/lib" ];
 
   meta = with lib; {
@@ -23,7 +30,7 @@ stdenv.mkDerivation rec {
       libspectre library.
       '';
     license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ cstrahan garbas ];
   };
 }

pkgs/applications/misc/zathura/wrapper.nix

@@ -11,8 +11,7 @@ in symlinkJoin {
   buildInputs = [ makeWrapper ];
 
   postBuild = ''
-    wrapProgram $out/bin/zathura \
+    wrapProgram $out/bin/zathura --add-flags --plugins-dir=${pluginsPath}
-      --add-flags --plugins-dir=${pluginsPath}
   '';
 
   meta = with lib; {
@@ -25,7 +24,7 @@ in symlinkJoin {
       as well as an easy usage that mainly focuses on keyboard interaction.
     '';
     license = licenses.zlib;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers;[ garbas smironov ];
   };
 }

pkgs/applications/networking/browsers/chromium/common.nix

@@ -144,9 +144,16 @@ let
       # for updated patches and hints about build flags
 
     # (gentooPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000")
-    ] ++ optionals (versionRange "64" "65") [
+    ]  ++ optionals (versionRange "64" "65") [
       (gentooPatch "chromium-cups-r0.patch" "0hyjlfh062c8h54j4b27y4dq5yzd4w6mxzywk3s02yf6cj3cbkrl")
       (gentooPatch "chromium-angle-r0.patch" "0izdrqwsyr48117dhvwdsk8c6dkrnq2njida1q4mb1lagvwbz7gc")
+    ]  ++ optionals (versionRange "65" "66") [
+      #(gentooPatch "chromium-gcc-r0.patch" "127xdwabizn5gz8rf1qsw62i7m0b5bsfjqxv4kdbsnizmjanddf8")
+      #(gentooPatch "chromium-memcpy-r0.patch" "1d3vra59wjg2lva7ddv55ff6l57mk9k50llsplr0b7vxk0lh0ps5")
+      (gentooPatch "chromium-webrtc-r0.patch" "0qj5b4w9kav51ylpdf38vm5w7p2gx4qp8p45vrfggp7miicg9cmw")
+      #(gentooPatch "chromium-vulkan-r0.patch" "1wphsbc6kyck5qanbc4bv14iw2s67fvp1c0kwz29a2avzkz19s84")
+      #(gentooPatch "chromium-ffmpeg-r0.patch" "0j58g24j6n6vpy6v9wwv34x0dd43m52wg0xcrfkzp72km9wiahff")
+      #(gentooPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000")
     ]  ++ optional enableWideVine ./patches/widevine.patch;
 
     postPatch = ''

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "1ki9ii3r9iv6k7df2zr14ysm6w3fkvhvcwaw3qjm4b4q6ymznshl";
+    sha256 = "1ggj1a7v2n4v34kb8gx2hcswlayryr9g62zqlry26bwmvz6qzsx9";
-    sha256bin64 = "0i1g0hv2vji8jx9c973x8nr1ynzsvqjaqcncxj77x6vj9wp0v41p";
+    sha256bin64 = "1ah8088d8p674dj5bijk5maapmiq9iap1w2i81dl0hhpyqxx3h3i";
-    version = "64.0.3282.140";
+    version = "65.0.3325.73";
   };
   dev = {
-    sha256 = "1b3gyj55xyqsb439szisfn8c4mnpws3pfzrndrl5kgdd239qrfqz";
+    sha256 = "13klppyl6rbkd3ffp8y8d95l4mc72gmj45y34wynyfap6b4z1lmh";
-    sha256bin64 = "1hmkinzn4gpikjfd8c9j30px3i0x6y8dddn9pyvjzsk6dzfcvknz";
+    sha256bin64 = "0w1ipy858p9lbpcrjhs44kncgw7c5qv1929h0w65ybgsggjqh0gz";
-    version = "65.0.3325.31";
+    version = "66.0.3343.3";
   };
   stable = {
-    sha256 = "1ki9ii3r9iv6k7df2zr14ysm6w3fkvhvcwaw3qjm4b4q6ymznshl";
+    sha256 = "0mf4qjmrjnxs7mx9c5pymavmib7l2a2kxiy0kqk3mma1y90qnc7k";
-    sha256bin64 = "1zsgcnilip9rxbs51xvnchp87gh4fmgxzrcf9dhfrnldhji17ikj";
+    sha256bin64 = "0idij274g53lzvgz9h5xxi8l841vvvr78hp25ndbmpv4a2p1d83b";
-    version = "64.0.3282.140";
+    version = "64.0.3282.167";
   };
 }

pkgs/applications/networking/browsers/falkon/default.nix

@@ -2,16 +2,17 @@
 , libpthreadstubs, libxcb, libXdmcp, qtsvg, qttools, qtwebengine, qtx11extras, kwallet, openssl }:
 
 stdenv.mkDerivation rec {
-  # Last qupvilla release is 2.1.2 so we add the .1 although it isn't actually a
+  # KDE hasn't made a release of falkon yet so we just track git for now which is
-  # release but it is basically 2.1.2 with the falkon name
+  # based on the most recent release of qupzilla
+  # This wip version is 2.1.99 so we add the .1
   name = "falkon-${version}.1";
-  version = "2.1.2";
+  version = "2.1.99";
 
   src = fetchFromGitHub {
     owner  = "KDE";
     repo   = "falkon";
-    rev    = "eecaf2e9d6b572a7f7d2e6dc324e3d79b61c31db";
+    rev    = "dd3c570c41b4b3d0ad17202b78bf14cf1ac56495";
-    sha256 = "01r5aw10jd0qz7xvad0cqzjbnsj7vwblh54wbq4x1m6xbkp6xcgy";
+    sha256 = "07d40cpckaprj74mr06k3mfriwb471bdmq60smls34y62ss55q9d";
   };
 
   preConfigure = ''
@@ -21,8 +22,6 @@ stdenv.mkDerivation rec {
     export FALKON_PREFIX=$out
   '';
 
-  dontUseCmakeConfigure = true;
-
   buildInputs = [
     libpthreadstubs libxcb libXdmcp
     kwallet
@@ -31,8 +30,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkgconfig qmake qttools ];
 
-  # on 2.1.2: RCC: Error in 'autoscroll.qrc': Cannot find file 'locale/ar_SA.qm'
+  enableParallelBuilding = true;
-  enableParallelBuilding = false;
 
   meta = with stdenv.lib; {
     description = "QtWebEngine based cross-platform web browser";
@@ -40,6 +38,5 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl3;
     maintainers = with maintainers; [ peterhoeg ];
     platforms   = platforms.unix;
-    broken      = true;
   };
 }

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -12,12 +12,23 @@ rec {
       sha512 = "ff748780492fc66b3e44c7e7641f16206e4c09514224c62d37efac2c59877bdf428a3670bfb50407166d7b505d4e2ea020626fd776b87f6abb6bc5d2e54c773f";
     };
 
-    patches =
+    patches = [
-      [ ./no-buildconfig.patch ./env_var_for_system_dir.patch ]
+      ./no-buildconfig.patch
-      ++ lib.optional stdenv.isi686 (fetchpatch {
+      ./env_var_for_system_dir.patch
-        url = "https://hg.mozilla.org/mozilla-central/raw-rev/15517c5a5d37";
+
-        sha256 = "1ba487p3hk4w2w7qqfxgv1y57vp86b8g3xhav2j20qd3j3phbbn7";
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1430274
-      });
+      # Scheduled for firefox 59
+      (fetchpatch {
+        url = "https://bug1430274.bmoattachments.org/attachment.cgi?id=8943426";
+        sha256 = "12yfss3k61yilrb337dh2rffy5hh83d2f16gqrf5i56r9c33f7hf";
+      })
+
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1388981
+      # Should have been fixed in firefox 57
+    ] ++ lib.optional stdenv.isi686 (fetchpatch {
+      url = "https://hg.mozilla.org/mozilla-central/raw-rev/15517c5a5d37";
+      sha256 = "1ba487p3hk4w2w7qqfxgv1y57vp86b8g3xhav2j20qd3j3phbbn7";
+    });
 
     meta = {
       description = "A web browser built from Firefox source tree";

pkgs/applications/networking/browsers/google-chrome/default.nix

@@ -5,6 +5,7 @@
 , libXcursor, libXext, libXfixes, libXrender, libXScrnSaver, libXcomposite, libxcb
 , alsaLib, libXdamage, libXtst, libXrandr, expat, cups
 , dbus_libs, gtk2, gtk3, gdk_pixbuf, gcc-unwrapped, at_spi2_atk
+, kerberos
 
 # command line arguments which are always set e.g "--disable-gpu"
 , commandLineArgs ? ""
@@ -57,6 +58,7 @@ let
     liberation_ttf curl utillinux xdg_utils wget
     flac harfbuzz icu libpng opusWithCustomModes snappy speechd
     bzip2 libcap at_spi2_atk
+    kerberos
   ] ++ optional pulseSupport libpulseaudio
     ++ [ gtk ];
 

pkgs/applications/networking/cluster/kubecfg/default.nix

@@ -1,6 +1,6 @@
 { lib, buildGoPackage, fetchFromGitHub, ... }:
 
-let version = "0.5.0"; in
+let version = "0.6.0"; in
 
 buildGoPackage {
   name = "kubecfg-${version}";
@@ -9,7 +9,7 @@ buildGoPackage {
     owner = "ksonnet";
     repo = "kubecfg";
     rev = "v${version}";
-    sha256 = "1s8w133p8qkj3dr73jimajm9ddp678lw9k9symj8rjw5p35igr93";
+    sha256 = "12kv1p707kdxjx5l8rcikd1gjwp5xjxdmmyvlpnvyagrphgrwpsf";
   };
 
   goPackagePath = "github.com/ksonnet/kubecfg";

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -8,8 +8,6 @@
     "cmd/kube-controller-manager"
     "cmd/kube-proxy"
     "plugin/cmd/kube-scheduler"
-    "federation/cmd/federation-apiserver"
-    "federation/cmd/federation-controller-manager"
     "test/e2e/e2e.test"
   ]
 }:
@@ -18,13 +16,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "kubernetes-${version}";
-  version = "1.7.9";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "0lxagvv8mysw6n0vp5vsccl87b628dgsjrf298dx2dqx7wn7zjgi";
+    sha256 = "1dmq2g138h7fsswmq4l47b44gsl9anmm3ywqyi7y48f1rkvc11mk";
   };
 
   buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];

pkgs/applications/networking/feedreaders/rss2email/default.nix

@@ -14,12 +14,30 @@ buildPythonApplication rec {
     sha256 = "02wj9zhmc2ym8ba1i0z9pm1c622z2fj7fxwagnxbvpr1402ahmr5";
   };
 
-  postInstall = ''
+  outputs = [ "out" "man" "doc" ];
-    install -Dm 644 r2e.1 $out/share/man/man1/r2e.1
+
-    # an alias for better finding the manpage
+  postPatch = ''
-    ln -s -T r2e.1 $out/share/man/man1/rss2email.1
+    # sendmail executable is called from PATH instead of sbin by default
+    sed -e 's|/usr/sbin/sendmail|sendmail|' \
+        -i rss2email/config.py
   '';
 
+  postInstall = ''
+    install -Dm 644 r2e.1 $man/share/man/man1/r2e.1
+    # an alias for better finding the manpage
+    ln -s -T r2e.1 $man/share/man/man1/rss2email.1
+
+    # copy documentation
+    mkdir -p $doc/share/doc/rss2email
+    cp AUTHORS COPYING CHANGELOG README $doc/share/doc/rss2email/
+  '';
+
+  # The tests currently fail, see
+  # https://github.com/rss2email/rss2email/issues/14
+  # postCheck = ''
+  #   env PYTHONPATH=.:$PYTHONPATH python ./test/test.py
+  # '';
+
   meta = with lib; {
     description = "A tool that converts RSS/Atom newsfeeds to email.";
     homepage = https://pypi.python.org/pypi/rss2email;

pkgs/applications/networking/gns3/server.nix

@@ -4,6 +4,16 @@
 
 let
   pythonPackages = python3Packages;
+  aiohttp = (stdenv.lib.overrideDerivation pythonPackages.aiohttp
+    (oldAttrs:
+      rec {
+        pname = "aiohttp";
+        version = "2.3.10";
+        src = pythonPackages.fetchPypi {
+          inherit pname version;
+          sha256 = "8adda6583ba438a4c70693374e10b60168663ffa6564c5c75d3c7a9055290964";
+        };
+      }));
   aiohttp-cors = (stdenv.lib.overrideDerivation pythonPackages.aiohttp-cors
     (oldAttrs:
       rec {
@@ -14,6 +24,10 @@ let
           inherit pname version;
           sha256 = "11b51mhr7wjfiikvj3nc5s8c7miin2zdhl3yrzcga4mbpkj892in";
         };
+        propagatedBuildInputs = [ aiohttp ]
+          ++ stdenv.lib.optional
+               (pythonPackages.pythonOlder "3.5")
+               pythonPackages.typing;
       }));
 in pythonPackages.buildPythonPackage rec {
   name = "${pname}-${version}";

pkgs/applications/networking/instant-messengers/stride/default.nix

@@ -0,0 +1,68 @@
+{ stdenv, fetchurl, dpkg, alsaLib, atk, cairo, cups, dbus, expat, fontconfig
+, freetype, gdk_pixbuf, glib, gnome2, nspr, nss, pango, udev, xorg }:
+let
+  fullPath = stdenv.lib.makeLibraryPath [
+    alsaLib
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    fontconfig
+    freetype
+    gdk_pixbuf
+    glib
+    gnome2.GConf
+    gnome2.gtk
+    nspr
+    nss
+    pango
+    udev
+    xorg.libX11
+    xorg.libXScrnSaver
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXtst
+    xorg.libxcb
+  ] + ":${stdenv.cc.cc.lib}/lib64";
+in
+stdenv.mkDerivation rec {
+  version = "1.8.18";
+  name = "stride-${version}";
+
+  src = fetchurl {
+    url = "https://packages.atlassian.com/stride-apt-client/pool/stride_${version}_amd64.deb";
+    sha256 = "0hpj3i3xbvckxm7fphqqb3scb31w2cg4riwp593y0gnbivpc0hym";
+  };
+
+  dontBuild = true;
+  dontFixup = true;
+
+  buildInputs = [ dpkg ];
+
+  unpackPhase = ''
+    dpkg-deb -x ${src} ./
+  '';
+
+  installPhase =''
+    mkdir "$out"
+    mv usr/* "$out/"
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${fullPath}:\$ORIGIN" \
+      "$out/bin/stride"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Desktop client for Atlassian Stride";
+    homepage = https://www.stride.com/;
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ puffnfresh ];
+  };
+}

pkgs/applications/networking/irc/irssi/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, pkgconfig, ncurses, glib, openssl, perl, libintlOrEmpty }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.0";
+  version = "1.1.1";
   name = "irssi-${version}";
 
   src = fetchurl {
     url = "https://github.com/irssi/irssi/releases/download/${version}/${name}.tar.gz";
-    sha256 = "0y362v6ncgs77q5axv7vgjm6vcxiaj5chsxj1ha07jaxsr1z7285";
+    sha256 = "09a9p1yfg0m3w7n2a4axvn8874002ly8x0b543sxihzqk29radpa";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, which, autoreconfHook, makeWrapper, writeScript,
+{ stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
-ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl,
+, ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, notmuch, openssl
-lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mime-types }:
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mime-types }:
 
 let
   muttWrapper = writeScript "mutt" ''
@@ -15,14 +15,14 @@ let
   '';
 
 in stdenv.mkDerivation rec {
-  version = "20171208";
+  version = "20171215";
   name = "neomutt-${version}";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = "neomutt-${version}";
-    sha256 = "1fn28q4akfz0nq3ysp8n53j8yqp2mx6yhbvb59c4zm6zgd4qzgp1";
+    sha256 = "1c7vjl5cl0k41vrxp6l1sj72idz70r2rgaxa2m1yir6zb6qsrsd8";
   };
 
   buildInputs = [
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    autoreconfHook docbook_xsl docbook_xml_dtd_42 libxslt.bin which makeWrapper
+    docbook_xsl docbook_xml_dtd_42 gettext libxslt.bin makeWrapper tcl which
   ];
 
   enableParallelBuilding = true;
@@ -51,18 +51,14 @@ in stdenv.mkDerivation rec {
   '';
 
   configureFlags = [
-    "--enable-debug"
+    "--gpgme"
-    "--enable-gpgme"
+    "--gss"
-    "--enable-notmuch"
+    "--lmdb"
-    "--with-curses"
+    "--notmuch"
-    "--with-gss"
+    "--ssl"
+    "--sasl"
     "--with-homespool=mailbox"
-    "--with-idn"
-    "--with-lmdb"
     "--with-mailpath="
-    "--with-sasl"
-    "--with-ssl"
-
     # Look in $PATH at runtime, instead of hardcoding /usr/bin/sendmail
     "ac_cv_path_SENDMAIL=sendmail"
   ];

pkgs/applications/networking/nextcloud-client/default.nix

@@ -36,7 +36,10 @@ stdenv.mkDerivation rec {
     "-DINOTIFY_INCLUDE_DIR=${inotify-tools}/include"
   ];
 
-  postInstall = stdenv.lib.optionalString (withGnomeKeyring) ''
+  postInstall = ''
+    sed -i 's/\(Icon.*\)=nextcloud/\1=Nextcloud/g' \
+      $out/share/applications/nextcloud.desktop
+  '' + stdenv.lib.optionalString (withGnomeKeyring) ''
     wrapProgram "$out/bin/nextcloud" \
       --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libgnome_keyring ]}
   '';

pkgs/applications/networking/syncthing/add-stcli-target.patch

@@ -0,0 +1,17 @@
+diff --git i/build.go w/build.go
+index 7d400d6f..1b5e1d25 100644
+--- i/build.go
++++ w/build.go
+@@ -175,6 +175,12 @@ var targets = map[string]target{
+ 			{src: "AUTHORS", dst: "deb/usr/share/doc/syncthing-relaypoolsrv/AUTHORS.txt", perm: 0644},
+ 		},
+ 	},
++	"stcli": {
++		name:        "stcli",
++		description: "Syncthing CLI",
++		buildPkg:    "github.com/syncthing/syncthing/cmd/stcli",
++		binaryName:  "stcli", // .exe will be added automatically for Windows builds
++	},
+ }
+ 
+ func init() {

pkgs/applications/networking/syncthing/default.nix

@@ -1,57 +1,103 @@
-{ stdenv, lib, fetchFromGitHub, go, procps, removeReferencesTo }:
+{ stdenv, lib, go, procps, removeReferencesTo, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+let
-  version = "0.14.44";
+  common = { stname, target, patches ? [], postInstall ? "" }:
-  name = "syncthing-${version}";
+    stdenv.mkDerivation rec {
+      version = "0.14.44";
+      name = "${stname}-${version}";
 
-  src = fetchFromGitHub {
+      src = fetchFromGitHub {
-    owner  = "syncthing";
+        owner  = "syncthing";
-    repo   = "syncthing";
+        repo   = "syncthing";
-    rev    = "v${version}";
+        rev    = "v${version}";
-    sha256 = "1gdkx6lbzmdz2hqc9slbq41rwgkxmdisnj0iywx4mppmc2b4v6wh";
+        sha256 = "1gdkx6lbzmdz2hqc9slbq41rwgkxmdisnj0iywx4mppmc2b4v6wh";
+      };
+
+      inherit patches;
+
+      buildInputs = [ go ];
+      nativeBuildInputs = [ removeReferencesTo ];
+
+      buildPhase = ''
+        # Syncthing expects that it is checked out in $GOPATH, if that variable is
+        # set.  Since this isn't true when we're fetching source, we can explicitly
+        # unset it and force Syncthing to set up a temporary one for us.
+        env GOPATH= BUILD_USER=nix BUILD_HOST=nix go run build.go -no-upgrade -version v${version} build ${target}
+      '';
+
+      installPhase = ''
+        install -Dm755 ${target} $out/bin/${target}
+        runHook postInstall
+      '';
+
+      inherit postInstall;
+
+      preFixup = ''
+        find $out/bin -type f -exec remove-references-to -t ${go} '{}' '+'
+      '';
+
+      meta = with lib; {
+        homepage = https://www.syncthing.net/;
+        description = "Open Source Continuous File Synchronization";
+        license = licenses.mpl20;
+        maintainers = with maintainers; [ pshendry joko peterhoeg andrew-d ];
+        platforms = platforms.unix;
+      };
+    };
+
+in {
+  syncthing = common {
+    stname = "syncthing";
+    target = "syncthing";
+
+    postInstall = ''
+      # This installs man pages in the correct directory according to the suffix
+      # on the filename
+      for mf in man/*.[1-9]; do
+        mantype="$(echo "$mf" | awk -F"." '{print $NF}')"
+        mandir="$out/share/man/man$mantype"
+        install -Dm644 "$mf" "$mandir/$(basename "$mf")"
+      done
+
+    '' + lib.optionalString (stdenv.isLinux) ''
+      mkdir -p $out/lib/systemd/{system,user}
+
+      substitute etc/linux-systemd/system/syncthing-resume.service \
+                 $out/lib/systemd/system/syncthing-resume.service \
+                 --replace /usr/bin/pkill ${procps}/bin/pkill
+
+      substitute etc/linux-systemd/system/syncthing@.service \
+                 $out/lib/systemd/system/syncthing@.service \
+                 --replace /usr/bin/syncthing $out/bin/syncthing
+
+      substitute etc/linux-systemd/user/syncthing.service \
+                 $out/lib/systemd/user/syncthing.service \
+                 --replace /usr/bin/syncthing $out/bin/syncthing
+    '';
   };
 
-  buildInputs = [ go removeReferencesTo ];
+  syncthing-cli = common {
+    stname = "syncthing-cli";
 
-  buildPhase = ''
+    patches = [ ./add-stcli-target.patch ];
-    mkdir -p src/github.com/syncthing
+    target = "stcli";
-    ln -s $(pwd) src/github.com/syncthing/syncthing
+  };
-    export GOPATH=$(pwd)
 
-    # Syncthing's build.go script expects this working directory
+  syncthing-discovery = common {
-    cd src/github.com/syncthing/syncthing
+    stname = "syncthing-discovery";
+    target = "stdiscosrv";
+  };
 
-    go run build.go -no-upgrade -version v${version} build
+  syncthing-relay = common {
-  '';
+    stname = "syncthing-relay";
+    target = "strelaysrv";
 
-  installPhase = ''
+    postInstall = lib.optionalString (stdenv.isLinux) ''
-    mkdir -p $out/lib/systemd/{system,user}
+      mkdir -p $out/lib/systemd/system
 
-    install -Dm755 syncthing $out/bin/syncthing
+      substitute cmd/strelaysrv/etc/linux-systemd/strelaysrv.service \
-
+                 $out/lib/systemd/system/strelaysrv.service \
-  '' + lib.optionalString (stdenv.isLinux) ''
+                 --replace /usr/bin/strelaysrv $out/bin/strelaysrv
-    substitute etc/linux-systemd/system/syncthing-resume.service \
+    '';
-               $out/lib/systemd/system/syncthing-resume.service \
-               --replace /usr/bin/pkill ${procps}/bin/pkill
-
-    substitute etc/linux-systemd/system/syncthing@.service \
-               $out/lib/systemd/system/syncthing@.service \
-               --replace /usr/bin/syncthing $out/bin/syncthing
-
-    substitute etc/linux-systemd/user/syncthing.service \
-               $out/lib/systemd/user/syncthing.service \
-               --replace /usr/bin/syncthing $out/bin/syncthing
-  '';
-
-  preFixup = ''
-    find $out/bin -type f -exec remove-references-to -t ${go} '{}' '+'
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = https://www.syncthing.net/;
-    description = "Open Source Continuous File Synchronization";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ pshendry joko peterhoeg ];
-    platforms = platforms.unix;
   };
 }

pkgs/applications/science/logic/coq/default.nix

@@ -21,6 +21,7 @@ let
    "8.6.1"     = "0llrxcxwy5j87vbbjnisw42rfw1n1pm5602ssx64xaxx3k176g6l";
    "8.7.0"     = "1h18b7xpnx3ix9vsi5fx4zdcbxy7bhra7gd5c5yzxmk53cgf1p9m";
    "8.7.1"     = "0gjn59jkbxwrihk8fx9d823wjyjh5m9gvj9l31nv6z6bcqhgdqi8";
+   "8.7.2"     = "0a0657xby8wdq4aqb2xsxp3n7pmc2w4yxjmrb2l4kccs1aqvaj4w";
   }."${version}";
   coq-version = builtins.substring 0 3 version;
   camlp5 = ocamlPackages.camlp5_strict;

pkgs/applications/science/logic/eprover/default.nix

@@ -1,4 +1,5 @@
 { stdenv, fetchurl, which }:
+
 stdenv.mkDerivation rec {
   name = "eprover-${version}";
   version = "2.0";
@@ -11,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ which ];
 
   preConfigure = ''
-    sed -e 's/ *CC *= gcc$//' -i Makefile.vars
+    sed -e 's/ *CC *= *gcc$//' -i Makefile.vars
   '';
   configureFlags = "--exec-prefix=$(out) --man-prefix=$(out)/share/man";
 

pkgs/build-support/kernel/modules-closure.nix

@@ -3,13 +3,13 @@
 # the modules identified by `rootModules', plus their dependencies.
 # Also generate an appropriate modules.dep.
 
-{ stdenvNoCC, kernel, nukeReferences, rootModules
+{ stdenvNoCC, kernel, firmware, nukeReferences, rootModules
 , kmod, allowMissing ? false }:
 
 stdenvNoCC.mkDerivation {
   name = kernel.name + "-shrunk";
   builder = ./modules-closure.sh;
   buildInputs = [ nukeReferences kmod ];
-  inherit kernel rootModules allowMissing;
+  inherit kernel firmware rootModules allowMissing;
   allowedReferences = ["out"];
 }

pkgs/build-support/kernel/modules-closure.sh

@@ -33,4 +33,13 @@ for module in $closure; do
     echo $target >> $out/insmod-list
 done
 
+mkdir -p $out/lib/firmware
+for module in $closure; do
+    for i in $(modinfo -F firmware $module); do
+        mkdir -p "$out/lib/firmware/$(dirname "$i")"
+        echo "firmware for $module: $i"
+        cp "$firmware/lib/firmware/$i" "$out/lib/firmware/$i" 2>/dev/null || if test -z "$allowMissing"; then exit 1; fi
+    done
+done
+
 depmod -b $out -a $version

pkgs/build-support/vm/default.nix

@@ -26,6 +26,7 @@ rec {
 
   modulesClosure = makeModulesClosure {
     inherit kernel rootModules;
+    firmware = kernel;
   };
 
 

pkgs/common-updater/scripts/update-source-version

@@ -74,7 +74,7 @@ fi
 if [ -z "$newHash" ]; then
     nix-build --no-out-link -A "$attr.src" 2>"$attr.fetchlog" >/dev/null || true
     # FIXME: use nix-build --hash here once https://github.com/NixOS/nix/issues/1172 is fixed
-    newHash=$(egrep -v "killing process|dependencies couldn't be built" "$attr.fetchlog" | tail -n2 | grep "output path .* has .* hash .* when .* was expected" | head -n1 | tr -dc '\040-\177' | tr -d "'" | awk '{ print $(NF-4) }')
+    newHash=$(egrep -v "killing process|dependencies couldn't be built" "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash \(.*\) when .* was expected|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'~\1\2~" | head -n1)
 fi
 
 if [ -z "$newHash" ]; then

pkgs/data/fonts/tex-gyre/default.nix

@@ -0,0 +1,90 @@
+{ stdenv, fetchzip }:
+
+let
+  mkVariant = variant: { displayName, version, abbreviation, sha256, outputHash }: stdenv.mkDerivation {
+    name = "tex-gyre-${variant}-${version}";
+    inherit version;
+
+    src = fetchzip {
+      url = "http://www.gust.org.pl/projects/e-foundry/tex-gyre/${variant}/${abbreviation}${version}otf.zip";
+      stripRoot = false;
+      inherit sha256;
+    };
+
+    installPhase = ''
+      mkdir -p $out/share/fonts/opentype/
+      cp -v *.otf $out/share/fonts/opentype/
+    '';
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = outputHash;
+
+    meta = with stdenv.lib; {
+      homepage = http://www.gust.org.pl/projects/e-foundry/tex-gyre;
+      # "The TeX Gyre fonts are licensed under the GUST Font License (GFL),
+      # which is a free license, legally equivalent to the LaTeX Project Public
+      # License (LPPL), version 1.3c or later." - GUST website
+      license = licenses.lppl13c;
+      maintainers = with maintainers; [ jtojnar ];
+      platforms = platforms.all;
+    };
+  };
+in stdenv.lib.mapAttrs mkVariant {
+  adventor = {
+    displayName = "Adventor";
+    version = "2.003";
+    sha256 = "13wnb04z9f766ij30x8bpkn4xzv7n466g07dlbimx7qvglxl605g";
+    outputHash = "1cz0lkk2a5fg8r8175h454va499hzln3s99dadxhh147nx1914pm";
+    abbreviation = "qag";
+  };
+  bonum = {
+    displayName = "Bonum";
+    version = "2.004";
+    sha256 = "0qbrs98knx4h0b297c5n3vav4mkal1a95ai2dzmdc10pghfzl8vv";
+    outputHash = "0bid8gzwz50ylmm8jyqf9s4nfvy6cp1x34wbyrh4gyk1ki6hf3z1";
+    abbreviation = "qbk";
+  };
+  chorus = {
+    displayName = "Chorus";
+    version = "2.003";
+    sha256 = "1b0zak27fzmapwbf2jasvsd95vhnqyc92n985d1lc1ivwja1zgfa";
+    outputHash = "0fqifd45c1ys6y98b66lmldfbv7wjb2414fs9swicv4n7xvl3cp1";
+    abbreviation = "qzc";
+  };
+  cursor = {
+    displayName = "Cursor";
+    version = "2.004";
+    sha256 = "0ck3jm33bk2xsxp5d2irzd3j24zb49f0gnjvd1nikg1ivk8w85ng";
+    outputHash = "0i76835xqlkrnlx303mx63m0f4899j056c2ag2fl6p9qk8s4rskp";
+    abbreviation = "qcr";
+  };
+  heros = {
+    displayName = "Heros";
+    version = "2.004";
+    sha256 = "1fj2srxxf6ap913y5yd3dn4jzg828j7381gifs39nm5lnzmgw78y";
+    outputHash = "16y76ab46fxm9k8wfmwx4w0cl96yrmjywz587lyr08s0agp1v3kf";
+    abbreviation = "qhv";
+  };
+  pagella = {
+    displayName = "Pagella";
+    version ="2.004";
+    sha256 = "0b2pjhw1ihnl951slln6d6vafjd3i6p4i947lwybvg8081qfvd9z";
+    outputHash = "0c6s0r14qax3b4amvm9nffwzby8mm4p7r2hfb8yv9jzhjwa5z8rd";
+    abbreviation = "qpl";
+  };
+  schola = {
+    displayName = "Schola";
+    version = "2.005";
+    sha256 = "05z3gk4mm0sa7wwjcv31j2xlzqhwhcncpamn0kn9y0221cdknyp8";
+    outputHash = "1yqq1ngcylhldrh1v35l439k72szq9m4gx6g0wh235fk65chb2bm";
+    abbreviation = "qcs";
+  };
+  termes = {
+    displayName = "Termes";
+    version = "2.004";
+    sha256 = "1aq3yqbgkc3z20dkcqyhicsyq0afbgg4l397z96sd8a16jyz2x8k";
+    outputHash = "1igw821m601h8937pix6yish4d8fxmz3h4j9hripf41bxsiafzzg";
+    abbreviation = "qtm";
+  };
+}

pkgs/desktops/gnome-3/core/gjs/default.nix

@@ -1,21 +1,41 @@
-{ fetchurl, stdenv, pkgconfig, gnome3, gtk3, gobjectIntrospection
+{ fetchurl, stdenv, pkgconfig, gnome3, gtk3, atk, gobjectIntrospection
-, spidermonkey_52, pango, readline, glib, libxml2, dbus }:
+, spidermonkey_52, pango, readline, glib, libxml2, dbus, gdk_pixbuf
+, makeWrapper }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
 
-  nativeBuildInputs = [ pkgconfig ];
+  outputs = [ "out" "installedTests" ];
+
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
   buildInputs = [ libxml2 gobjectIntrospection gtk3 glib pango readline dbus ];
 
   propagatedBuildInputs = [ spidermonkey_52 ];
 
+  configureFlags = [
+    "--enable-installed-tests"
+  ];
+
+  postPatch = ''
+    for f in installed-tests/*.test.in; do
+      substituteInPlace "$f" --subst-var-by pkglibexecdir "$installedTests/libexec/gjs"
+    done
+  '';
+
   postInstall = ''
     sed 's|-lreadline|-L${readline.out}/lib -lreadline|g' -i $out/lib/libgjs.la
+
+    moveToOutput "share/installed-tests" "$installedTests"
+    moveToOutput "libexec/gjs/installed-tests" "$installedTests"
+
+    wrapProgram "$installedTests/libexec/gjs/installed-tests/minijasmine" \
+      --prefix GI_TYPELIB_PATH : "${stdenv.lib.makeSearchPath "lib/girepository-1.0" [ gtk3 atk pango.out gdk_pixbuf ]}:$installedTests/libexec/gjs/installed-tests"
   '';
 
   meta = with stdenv.lib; {
+    description = "JavaScript bindings for GNOME";
     maintainers = gnome3.maintainers;
     platforms = platforms.linux;
+    license = licenses.lgpl2Plus;
   };
-
 }

pkgs/desktops/gnome-3/core/gjs/src.nix

@@ -1,10 +1,10 @@
 # Autogenerated by maintainers/scripts/gnome.sh update
 
 fetchurl: {
-  name = "gjs-1.50.2";
+  name = "gjs-1.50.4";
 
   src = fetchurl {
-    url = mirror://gnome/sources/gjs/1.50/gjs-1.50.2.tar.xz;
+    url = mirror://gnome/sources/gjs/1.50/gjs-1.50.4.tar.xz;
-    sha256 = "2fad902cf7a7806454121c03918755c646fcfd6b08b52d488987db4e2d691ff3";
+    sha256 = "b336e8709347e3c94245f6cbc3465f9a49f3ae491a25f49f8a97268f5235b93a";
   };
 }

pkgs/desktops/gnome-3/extensions/appindicator/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "gnome-shell-extension-appindicator-${version}";
+  version = "22";
+
+  src = fetchFromGitHub {
+    owner = "Ubuntu";
+    repo = "gnome-shell-extension-appindicator";
+    rev = "v${version}";
+    sha256 = "1gqw54d55hxjj2hh04p0dx2j40bhi4ck9hgwlz8f7j4v7r37z0qw";
+  };
+
+  # This package has a Makefile, but it's used for building a zip for
+  # publication to extensions.gnome.org. Disable the build phase so
+  # installing doesn't build an unnecessary release.
+  dontBuild = true;
+
+  uuid = "appindicatorsupport@rgcjonas.gmail.com";
+  installPhase = ''
+    mkdir -p $out/share/gnome-shell/extensions/${uuid}
+    cp *.js $out/share/gnome-shell/extensions/${uuid}
+    cp -r interfaces-xml $out/share/gnome-shell/extensions/${uuid}
+    cp metadata.json $out/share/gnome-shell/extensions/${uuid}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "AppIndicator/KStatusNotifierItem support for GNOME Shell";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ jonafato ];
+    homepage = https://github.com/Ubuntu/gnome-shell-extension-appindicator;
+  };
+}

pkgs/desktops/gnome-3/misc/geary/default.nix

@@ -8,11 +8,11 @@ let
   majorVersion = "0.12";
 in
 stdenv.mkDerivation rec {
-  name = "geary-${majorVersion}.0";
+  name = "geary-${majorVersion}.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/geary/${majorVersion}/${name}.tar.xz";
-    sha256 = "0ii4qaqfqx90kvqwg0g9jahygkir4mb03ja55fa55yyx6cq0kwff";
+    sha256 = "12hbpd5j3rb122nrsqmgsg31x82xl0ksm0nmsl614v1dd7crqnh6";
   };
 
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];

pkgs/development/compilers/compcert/default.nix

@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postPatch = ''
+    sed -i -e 's/8\.6\.1|8\.7\.0|8\.7\.1)/8.6.1|8.7.0|8.7.1|8.7.2)/' configure
+  '';
+
   configurePhase = ''
     substituteInPlace ./configure --replace '{toolprefix}gcc' '{toolprefix}cc'
     ./configure -clightgen -prefix $out -toolprefix ${tools}/bin/ '' +

pkgs/development/compilers/dmd/default.nix

@@ -3,9 +3,9 @@
 , curl, tzdata, gdb, darwin
 , callPackage
 , bootstrapVersion ? false
-, version ? "2.078.1"
+, version ? "2.078.2"
-, dmdSha256 ? "0b9lphh4g3r9cyzv4wcfppv9j3w952vvwv615za23acgwav3mqg2"
+, dmdSha256 ? "0x9q4aw4jl36dz7m5111y2sm8jdaj3zg36zhj6vqg1lqpdn3bhls"
-, druntimeSha256 ? "16jv40m073cflpkyl0vmg1g58cianybfcsgcvwli7pfryxbgsbrr"
+, druntimeSha256 ? "0nfqjcmwqc490bzi3582x1c3zigkf306g4nyd1cyd3vs8lfm6x66"
 , phobosSha256 ? "08ircpf4ilznz638kra272hz8fi5ccvw2cswj5hqckssl1lyqzs8"
 }:
 
@@ -111,7 +111,7 @@ let
     ''
 
     + stdenv.lib.optionalString stdenv.hostPlatform.isLinux ''
-        # See https://github.com/NixOS/nixpkgs/issues/29443
+        # See https://github.com/dlang/phobos/pull/5960
         substituteInPlace phobos/std/path.d \
             --replace "\"/root" "\"${ROOT_HOME_DIR}"
     '';

pkgs/development/compilers/gambit/default.nix

@@ -1,19 +1,20 @@
-{ stdenv, fetchurl, fetchgit, git, openssl, autoconf, pkgs }:
+{ stdenv, fetchurl, fetchgit, git, openssl, autoconf, pkgs, makeStaticLibraries }:
 
 # TODO: distinct packages for gambit-release and gambit-devel
 
 stdenv.mkDerivation rec {
   name    = "gambit-${version}";
-  version = "4.8.8-427-g37b111a5";
+  version = "4.8.8-435-gd1991ba7";
   bootstrap = import ./bootstrap.nix ( pkgs );
 
   src = fetchgit {
     url = "https://github.com/feeley/gambit.git";
-    rev = "37b111a5ca3aeff9dc6cb8be470277a8c1e80f24";
+    rev = "d1991ba7e90ed0149964320f7cafa1a8289e61f0";
-    sha256 = "14l7jql9nh7bjs6c822a17rcp9583l6bb5kiq95allgyf229vy50";
+    sha256 = "02harwcsqxxcxgn2yc1y9kyxdp32mampyvnbxrzg2jzfmnp5g6cm";
   };
 
-  buildInputs = [ openssl git autoconf bootstrap ];
+  # Use makeStaticLibraries to enable creation of statically linked binaries
+  buildInputs = [ git autoconf bootstrap openssl (makeStaticLibraries openssl)];
 
   configurePhase = ''
     options=(

pkgs/development/compilers/gerbil/default.nix

@@ -1,24 +1,26 @@
-{ stdenv, fetchurl, fetchgit, gambit,
+{ stdenv, lib, fetchurl, fetchgit, makeStaticLibraries, gambit,
   coreutils, rsync, bash,
-  openssl, zlib, sqlite, libxml2, libyaml, mysql, lmdb, leveldb }:
+  openssl, zlib, sqlite, libxml2, libyaml, mysql, lmdb, leveldb, postgresql }:
 
 # TODO: distinct packages for gerbil-release and gerbil-devel
+# TODO: make static compilation work
 
 stdenv.mkDerivation rec {
   name    = "gerbil-${version}";
 
-  version = "0.12-DEV-1030-gbbed3bc";
+  version = "0.12-DEV-1404-g0a266db";
   src = fetchgit {
     url = "https://github.com/vyzo/gerbil.git";
-    rev = "bbed3bc4cf7bcaa64eaabdf097192bfcc2bfc928";
+    rev = "0a266db5e2e241272711bc150cc2607204bf2b78";
-    sha256 = "1dc0j143j860yq72lfjp71fin7hpsy1426azz7rl1szxvjfb7h4r";
+    sha256 = "1lvawqn8havfyxkkgfqffc213zq2pgm179l42yj49fy3fhpzia4m";
   };
 
-  buildInputs = [
+  # Use makeStaticLibraries to enable creation of statically linked binaries
-    gambit
+  buildInputs_libraries = [ openssl zlib sqlite libxml2 libyaml mysql.connector-c lmdb leveldb postgresql ];
-    coreutils rsync bash
+  buildInputs_staticLibraries = map makeStaticLibraries buildInputs_libraries;
-    openssl zlib sqlite libxml2 libyaml mysql.connector-c lmdb leveldb
+
-  ];
+  buildInputs = [ gambit coreutils rsync bash ]
+    ++ buildInputs_libraries ++ buildInputs_staticLibraries;
 
   NIX_CFLAGS_COMPILE = [ "-I${mysql.connector-c}/include/mysql" "-L${mysql.connector-c}/lib/mysql" ];
 
@@ -30,6 +32,18 @@ stdenv.mkDerivation rec {
     find . -type f -executable -print0 | while IFS= read -r -d ''$'\0' f; do
       substituteInPlace "$f" --replace '#!/usr/bin/env' '#!${coreutils}/bin/env'
     done
+
+    cat > etc/gerbil_static_libraries.sh <<EOF
+#OPENSSL_LIBCRYPTO=${makeStaticLibraries openssl}/lib/libcrypto.a # MISSING!
+#OPENSSL_LIBSSL=${makeStaticLibraries openssl}/lib/libssl.a # MISSING!
+ZLIB=${makeStaticLibraries zlib}/lib/libz.a
+# SQLITE=${makeStaticLibraries sqlite}/lib/sqlite.a # MISSING!
+# LIBXML2=${makeStaticLibraries libxml2}/lib/libxml2.a # MISSING!
+# YAML=${makeStaticLibraries libyaml}/lib/libyaml.a # MISSING!
+MYSQL=${makeStaticLibraries mysql.connector-c}/lib/mariadb/libmariadb.a
+# LMDB=${makeStaticLibraries lmdb}/lib/mysql/libmysqlclient_r.a # MISSING!
+LEVELDB=${makeStaticLibraries lmdb}/lib/libleveldb.a
+EOF
   '';
 
   buildPhase = ''

pkgs/development/haskell-modules/configuration-common.nix

@@ -607,7 +607,7 @@ self: super: {
   };
 
   # Need newer versions of their dependencies than the ones we have in LTS-10.x.
-  cabal2nix = super.cabal2nix.override { hpack = self.hpack_0_25_0; };
+  cabal2nix = super.cabal2nix.override { hpack = self.hpack_0_27_0; };
   hlint = super.hlint.overrideScope (self: super: { haskell-src-exts = self.haskell-src-exts_1_20_1; });
 
   # https://github.com/bos/configurator/issues/22
@@ -1000,21 +1000,13 @@ self: super: {
     '';
   });
 
-  # Add a flag to enable building against GHC with D4388 applied (the
-  # deterministic profiling symbols patch). The flag is disabled by
-  # default, so we can apply this patch globally.
-  #
-  # https://github.com/ucsd-progsys/liquidhaskell/pull/1233
-  liquidhaskell =
-    let patch = pkgs.fetchpatch
-          { url = https://github.com/ucsd-progsys/liquidhaskell/commit/1aeef1871760b2be46cc1cabd51311997d1d0bc0.patch;
-            sha256 = "0i55n6p3x9as648as0lvxy2alqb1n7c10xv9gp15cvq7zx6c8ydg";
-          };
-    in appendPatch super.liquidhaskell patch;
-
   # https://github.com/nick8325/twee/pull/1
   twee-lib = dontHaddock super.twee-lib;
 
   # Needs older hlint
   hpio = dontCheck super.hpio;
+
+  # https://github.com/ucsd-progsys/liquidhaskell/issues/1238
+  liquidhaskell = dontHaddock super.liquidhaskell;
+
 }

pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix

@@ -104,13 +104,6 @@ self: super: {
   ## hspec-discover ==2.4.7
   hspec-discover = super.hspec-discover_2_4_8;
 
-  ## Needs bump to a versioned attribute
-  ## 
-  ##     • No instance for (Semigroup Metadatas)
-  ##         arising from the superclasses of an instance declaration
-  ##     • In the instance declaration for ‘Monoid Metadatas’
-  JuicyPixels = super.JuicyPixels_3_2_9_4;
-
   ## Needs bump to a versioned attribute
   ## 
   ##     • Could not deduce (Semigroup (a :->: b))
@@ -135,16 +128,7 @@ self: super: {
   ##     • Could not deduce (Semigroup (Traversal f))
   ##         arising from the superclasses of an instance declaration
   ##       from the context: Applicative f
-  tasty = super.tasty_1_0_0_1;
+  tasty = super.tasty_1_0_1;
-
-  ## Needs bump to a versioned attribute
-  ## 
-  ## Setup: Encountered missing dependencies:
-  ## template-haskell >=2.4 && <2.13
-  ## builder for ‘/nix/store/sq6cc33h4zk1wns2fsyv8cj6clcf6hwi-th-lift-0.7.7.drv’ failed with exit code 1
-  ## error: build of ‘/nix/store/sq6cc33h4zk1wns2fsyv8cj6clcf6hwi-th-lift-0.7.7.drv’ failed
-  th-lift = super.th-lift_0_7_8;
-
 
   ## On Hackage:
 

pkgs/development/haskell-modules/generic-builder.nix

@@ -191,7 +191,7 @@ assert allPkgconfigDepends != [] -> pkgconfig != null;
 stdenv.mkDerivation ({
   name = "${pname}-${version}";
 
-  outputs = if (args ? outputs) then args.outputs else ([ "out" ] ++ (optional enableSeparateDataOutput "data") ++ (optional enableSeparateDocOutput "doc"));
+  outputs = [ "out" ] ++ (optional enableSeparateDataOutput "data") ++ (optional enableSeparateDocOutput "doc");
   setOutputFlags = false;
 
   pos = builtins.unsafeGetAttrPos "pname" args;

pkgs/development/idris-modules/build-builtin-package.nix

@@ -1,4 +1,4 @@
-# Build one of the packages that come with idris
+# Build one of the packages that comes with idris
 # name: The name of the package
 # deps: The dependencies of the package
 { idris, build-idris-package, lib }: name: deps:
@@ -6,20 +6,16 @@ let
   inherit (builtins.parseDrvName idris.name) version;
 in
 build-idris-package {
-  name = "${name}-${version}";
-
-  propagatedBuildInputs = deps;
 
+  inherit name version;
   inherit (idris) src;
 
+  idrisDeps = deps;
+
   postUnpack = ''
     sourceRoot=$sourceRoot/libs/${name}
   '';
 
-  postPatch = ''
-    sed -i ${name}.ipkg -e "/^opts/ s|-i \\.\\./|-i $IDRIS_LIBRARY_PATH/|g"
-  '';
-
   meta = idris.meta // {
     description = "${name} builtin Idris library";
   };

pkgs/development/idris-modules/build-idris-package.nix

@@ -1,23 +1,46 @@
 # Build an idris package
-#
+{ stdenv, idrisPackages, gmp }:
-# args: Additional arguments to pass to mkDerivation. Generally should include at least
+  { idrisDeps ? []
-#       name and src.
+  , name
-{ stdenv, idris, gmp }: args: stdenv.mkDerivation ({
+  , version
-  buildPhase = ''
+  , src
-    idris --build *.ipkg
+  , meta
+  , extraBuildInputs ? []
+  , postUnpack ? ""
+  , doCheck ? true
+  }:
+let
+  idris-with-packages = idrisPackages.with-packages idrisDeps;
+in
+stdenv.mkDerivation ({
+
+  name = "${name}-${version}";
+
+  inherit postUnpack src doCheck meta;
+
+
+  # Some packages use the style
+  # opts = -i ../../path/to/package
+  # rather than the declarative pkgs attribute so we have to rewrite the path.
+  postPatch = ''
+    sed -i *.ipkg -e "/^opts/ s|-i \\.\\./|-i ${idris-with-packages}/libs/|g"
   '';
 
-  doCheck = true;
+  buildPhase = ''
+    ${idris-with-packages}/bin/idris --build *.ipkg
+  '';
 
   checkPhase = ''
     if grep -q test *.ipkg; then
-      idris --testpkg *.ipkg
+      ${idris-with-packages}/bin/idris --testpkg *.ipkg
     fi
   '';
 
   installPhase = ''
-    idris --install *.ipkg --ibcsubdir $IBCSUBDIR
+    ${idris-with-packages}/bin/idris --install *.ipkg --ibcsubdir $out/libs
   '';
 
-  buildInputs = [ gmp idris ];
+  buildInputs = [ gmp ] ++ extraBuildInputs;
-} // args)
+
+  propagatedBuildInputs = idrisDeps;
+})

pkgs/development/idris-modules/default.nix

@@ -25,14 +25,8 @@
       pruviloj = [ self.prelude self.base ];
     };
 
-    files = builtins.filter (n: n != "default") (pkgs.lib.mapAttrsToList (name: type: let
+  in
-      m = builtins.match "(.*)\\.nix" name;
+    {
-    in if m == null then "default" else builtins.head m) (builtins.readDir ./.));
-  in (builtins.listToAttrs (map (name: {
-    inherit name;
-
-    value = callPackage (./. + "/${name}.nix") {};
-  }) files)) // {
     inherit idris-no-deps callPackage;
     # See #10450 about why we have to wrap the executable
     idris =
@@ -40,7 +34,28 @@
           idris-no-deps
           { path = [ pkgs.gcc ]; lib = [pkgs.gmp]; };
 
+
+    with-packages = callPackage ./with-packages.nix {} ;
+
+    build-builtin-package = callPackage ./build-builtin-package.nix {};
+
+    build-idris-package = callPackage ./build-idris-package.nix {};
+
+    # Libraries
+
     # A list of all of the libraries that come with idris
     builtins = pkgs.lib.mapAttrsToList (name: value: value) builtins_;
+
+    httpclient = callPackage ./httpclient.nix {};
+
+    lightyear = callPackage ./lightyear.nix {};
+
+    optparse = callPackage ./optparse.nix {};
+
+    wl-pprint = callPackage ./wl-pprint.nix {};
+
+    specdris = callPackage ./specdris.nix {};
+
+
   } // builtins_;
 in fix' (extends overrides idrisPackages)

pkgs/development/idris-modules/httpclient.nix

@@ -1,17 +1,20 @@
-{ pkgs
+{ curl
 , build-idris-package
 , fetchFromGitHub
 , lightyear
 , contrib
+, effects
+, prelude
+, base
 , lib
 , idris
 }:
 
 let
-  date = "2016-12-20";
 in
 build-idris-package {
-  name = "httpclient-${date}";
+  name = "httpclient";
+  version = "2016-12-20";
 
   src = fetchFromGitHub {
     owner = "justjoheinz";
@@ -20,11 +23,14 @@ build-idris-package {
     sha256 = "0sy0q7gri9lwbqdmx9720pby3w1470w7wzn62bf2rir532219hhl";
   };
 
-  propagatedBuildInputs = [ pkgs.curl lightyear contrib ];
+  idrisDeps = [ prelude base effects lightyear contrib ];
+
+  extraBuildInputs = [ curl ];
 
   meta = {
     description = "HTTP Client for Idris";
     homepage = https://github.com/justjoheinz/idris-httpclient;
     inherit (idris.meta) platforms;
+    broken = true;
   };
 }

pkgs/development/idris-modules/idris-wrapper.nix

@@ -10,8 +10,5 @@ symlinkJoin {
     wrapProgram $out/bin/idris \
       --suffix PATH : ${ stdenv.lib.makeBinPath path } \
       --suffix LIBRARY_PATH : ${stdenv.lib.makeLibraryPath lib}
-
-    mkdir -p $out/nix-support
-    substituteAll ${./setup-hook.sh} $out/nix-support/setup-hook
       '';
   }

pkgs/development/idris-modules/lightyear.nix

@@ -10,8 +10,11 @@
 let
   date = "2017-09-10";
 in
-build-idris-package {
+build-idris-package  {
-  name = "lightyear-${date}";
+  name = "lightyear";
+  version = date;
+
+  idrisDeps = [ prelude base effects ];
 
   src = fetchFromGitHub {
     owner = "ziman";
@@ -20,8 +23,6 @@ build-idris-package {
     sha256 = "05x66abhpbdm6yr0afbwfk6w04ysdk78gylj5alhgwhy4jqakv29";
   };
 
-  propagatedBuildInputs = [ prelude base effects ];
-
   meta = {
     description = "Parser combinators for Idris";
     homepage = https://github.com/ziman/lightyear;

pkgs/development/idris-modules/setup-hook.sh

@@ -1,16 +0,0 @@
-# Library import path
-export IDRIS_LIBRARY_PATH=$PWD/idris-libs
-mkdir -p $IDRIS_LIBRARY_PATH
-
-# Library install path
-export IBCSUBDIR=$out/lib/@name@
-mkdir -p $IBCSUBDIR
-
-addIdrisLibs () {
-  if [ -d $1/lib/@name@ ]; then
-    ln -sv $1/lib/@name@/* $IDRIS_LIBRARY_PATH
-  fi
-}
-
-# All run-time deps
-addEnvHooks 1 addIdrisLibs

pkgs/development/idris-modules/specdris.nix

@@ -11,7 +11,8 @@ let
   date = "2017-11-11";
 in
 build-idris-package {
-  name = "specdris-${date}";
+  name = "specdris";
+  version = date;
 
   src = fetchgit {
     url = "https://github.com/pheymann/specdris";
@@ -19,21 +20,10 @@ build-idris-package {
     sha256 = "4813c4be1d4c3dd1dad35964b085f83cf9fb44b16824257c72b468d4bafd0e4f";
   };
 
-  propagatedBuildInputs = [ prelude base effects ];
+  idrisDeps = [ prelude base effects idris ];
 
-  buildPhase = ''
+  # The tests attribute is very strange as the tests are a different ipkg
-    ${idris}/bin/idris --build specdris.ipkg
+  doCheck = false;
-  '';
-
-  checkPhase = ''
-      cd test/
-      ${idris}/bin/idris --testpkg test.ipkg
-      cd ../
-    '';
-
-  installPhase = ''
-    ${idris}/bin/idris --install specdris.ipkg --ibcsubdir $IBCSUBDIR
-  '';
 
   meta = {
     description = "A testing library for Idris";

pkgs/development/idris-modules/with-packages.nix

@@ -1,46 +1,20 @@
 # Build a version of idris with a set of packages visible
 # packages: The packages visible to idris
-{ stdenv, idris }: packages: stdenv.mkDerivation {
+{ stdenv, idris, symlinkJoin, makeWrapper }: packages:
-  inherit (idris) name;
 
-  buildInputs = packages;
+let paths = stdenv.lib.closePropagation packages;
+in
+symlinkJoin {
 
-  preHook = ''
+  name = idris.name + "-with-packages";
-    mkdir -p $out/lib/${idris.name}
 
-    installIdrisLib () {
+  paths = paths ++ [idris] ;
-      if [ -d $1/lib/${idris.name} ]; then
-        ln -fsv $1/lib/${idris.name}/* $out/lib/${idris.name}
-      fi
-    }
 
-    envHostTargetHooks+=(installIdrisLib)
+  buildInputs = [ makeWrapper ];
-  '';
 
-  unpackPhase = ''
+  postBuild = ''
-    cat >idris.c <<EOF
+    wrapProgram $out/bin/idris \
-    #include <stdlib.h>
+      --set IDRIS_LIBRARY_PATH $out/libs
-    #include <unistd.h>
+      '';
-    #include <stdio.h>
 
-    int main (int argc, char ** argv) {
-      /* idris currently only supports a single library path, so respect it if the user set it */
-      setenv("IDRIS_LIBRARY_PATH", "$out/lib/${idris.name}", 0);
-      execv("${idris}/bin/idris", argv);
-      perror("executing ${idris}/bin/idris");
-      return 127;
-    }
-    EOF
-  '';
-
-  buildPhase = ''
-    $CC -O3 -o idris idris.c
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv idris $out/bin
-  '';
-
-  stripAllList = [ "bin" ];
 }

pkgs/development/idris-modules/wl-pprint.nix

@@ -6,7 +6,8 @@
 , idris
 }:
 build-idris-package {
-  name = "wl-pprint-2016-09-28";
+  pkName = "wl-pprint";
+  version = "2016-09-28";
 
   src = fetchFromGitHub {
     owner = "shayan-najd";
@@ -19,7 +20,7 @@ build-idris-package {
   # updating this package again.
   doCheck = false;
 
-  propagatedBuildInputs = [ prelude base ];
+  idrisDeps = [ prelude base ];
 
   meta = {
     description = "Wadler-Leijen pretty-printing library";

pkgs/development/interpreters/clojure/default.nix

@@ -1,16 +1,16 @@
-{ stdenv, fetchurl, jdk, makeWrapper }:
+{ stdenv, fetchurl, jdk, rlwrap, makeWrapper }:
 
-let version = "1.9.0.273"; in
+let version = "1.9.0.326"; in
 
 stdenv.mkDerivation {
   name = "clojure-${version}";
 
   src = fetchurl {
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "0xmrq3xvr002jgq8m1j0y5ld0rcr49608g3gqxgyxzjqswacglb4";
+    sha256 = "0sf8gy39iz4jxj2wic1lbdwdwbj90k3awhr0kq76gr1z1dwbj6s9";
   };
 
-  buildInputs = [ jdk makeWrapper ];
+  buildInputs = [ makeWrapper ];
 
   installPhase = ''
     pwd
@@ -20,6 +20,9 @@ stdenv.mkDerivation {
     cp -f clojure-tools-${version}.jar $out/libexec
     sed -i -e "s@PREFIX@$out@g" clojure
     cp -f clj clojure $out/bin
+    for program in $out/bin/{clojure,clj}; do
+      wrapProgram $program --suffix PATH : $out/bin:${jdk.jre}/bin:${rlwrap}/bin
+    done
   '';
 
   meta = with stdenv.lib; {

pkgs/development/libraries/acl/default.nix

@@ -20,13 +20,14 @@ stdenv.mkDerivation rec {
     sed -e '/^\/\//d' -i include/acl.h
   '';
 
-  configureFlags = "MAKE=make MSGFMT=msgfmt MSGMERGE=msgmerge XGETTEXT=xgettext ZIP=gzip ECHO=echo SED=sed AWK=gawk";
+  configureFlags = [ "MAKE=make" "MSGFMT=msgfmt" "MSGMERGE=msgmerge" "XGETTEXT=xgettext" "ZIP=gzip" "ECHO=echo" "SED=sed" "AWK=gawk" ];
 
-  installTargets = "install install-lib install-dev";
+  installTargets = [ "install" "install-lib" "install-dev" ];
 
-  meta = {
+  meta = with stdenv.lib; {
-    homepage = http://savannah.nongnu.org/projects/acl;
+    homepage = "http://savannah.nongnu.org/projects/acl";
     description = "Library and tools for manipulating access control lists";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
   };
 }