Merge remote-tracking branch 'upstream/master' into HEAD

Conflicts:
	pkgs/applications/version-management/git-and-tools/git/default.nix
	pkgs/top-level/all-packages.nix
	pkgs/top-level/unix-tools.nix

lib/systems/parse.nix

@@ -34,7 +34,7 @@ rec {
 
   ################################################################################
 
-  types.openSignifiantByte = mkOptionType {
+  types.openSignificantByte = mkOptionType {
     name = "significant-byte";
     description = "Endianness";
     merge = mergeOneOption;
@@ -42,7 +42,7 @@ rec {
 
   types.significantByte = enum (attrValues significantBytes);
 
-  significantBytes = setTypes types.openSignifiantByte {
+  significantBytes = setTypes types.openSignificantByte {
     bigEndian = {};
     littleEndian = {};
   };

maintainers/maintainer-list.nix

@@ -305,6 +305,11 @@
     github = "akru";
     name = "Alexander Krupenkin ";
   };
+  alexchapman = {
+    name = "Alex Chapman";
+    email = "alex@farfromthere.net";
+    github = "AJChapman";
+  };
   alexvorobiev = {
     email = "alexander.vorobiev@gmail.com";
     github = "alexvorobiev";
@@ -3406,6 +3411,11 @@
     github = "grwlf";
     name = "Sergey Mironov";
   };
+  sna = {
+    email = "abouzahra.9@wright.edu";
+    github = "s-na";
+    name = "S. Nordin Abouzahra";
+  };
   snyh = {
     email = "snyh@snyh.org";
     github = "snyh";

nixos/modules/config/pulseaudio.nix

@@ -214,6 +214,8 @@ in {
     (mkIf cfg.enable {
       environment.systemPackages = [ overriddenPackage ];
 
+      sound.enable = true;
+
       environment.etc = [
         { target = "asound.conf";
           source = alsaConf; }

nixos/modules/installer/cd-dvd/channel.nix

@@ -21,7 +21,9 @@ let
       if [ ! -e $out/nixos/nixpkgs ]; then
         ln -s . $out/nixos/nixpkgs
       fi
+      echo -n ${config.system.nixos.revision} > $out/nixos/.git-revision
       echo -n ${config.system.nixos.versionSuffix} > $out/nixos/.version-suffix
+      echo ${config.system.nixos.versionSuffix} | sed -e s/pre// > $out/nixos/svn-revision
     '';
 
 in

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -585,7 +585,6 @@ $bootLoaderConfig
 
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.
-  # programs.bash.enableCompletion = true;
   # programs.mtr.enable = true;
   # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
 

nixos/modules/module-list.nix

@@ -547,6 +547,7 @@
   ./services/networking/searx.nix
   ./services/networking/seeks.nix
   ./services/networking/skydns.nix
+  ./services/networking/shadowsocks.nix
   ./services/networking/shairport-sync.nix
   ./services/networking/shout.nix
   ./services/networking/sniproxy.nix

nixos/modules/programs/bash/bash.nix

@@ -110,7 +110,7 @@ in
       };
 
       enableCompletion = mkOption {
-        default = false;
+        default = true;
         description = ''
           Enable Bash completion for all interactive bash shells.
         '';

nixos/modules/services/editors/emacs.nix

@@ -15,6 +15,25 @@ let
     fi
   '';
 
+desktopApplicationFile = pkgs.writeTextFile {
+  name = "emacsclient.desktop";
+  destination = "/share/applications/emacsclient.desktop";
+  text = ''
+[Desktop Entry]
+Name=Emacsclient
+GenericName=Text Editor
+Comment=Edit text
+MimeType=text/english;text/plain;text/x-makefile;text/x-c++hdr;text/x-c++src;text/x-chdr;text/x-csrc;text/x-java;text/x-moc;text/x-pascal;text/x-tcl;text/x-tex;application/x-shellscript;text/x-c;text/x-c++;
+Exec=emacseditor %F
+Icon=emacs
+Type=Application
+Terminal=false
+Categories=Development;TextEditor;
+StartupWMClass=Emacs
+Keywords=Text;Editor;
+'';
+};
+
 in {
 
   options.services.emacs = {
@@ -74,7 +93,7 @@ in {
       };
     } // optionalAttrs cfg.enable { wantedBy = [ "default.target" ]; };
 
-    environment.systemPackages = [ cfg.package editorScript ];
+    environment.systemPackages = [ cfg.package editorScript desktopApplicationFile ];
 
     environment.variables = {
       # This is required so that GTK applications launched from Emacs

nixos/modules/services/hardware/trezord.nix

@@ -38,7 +38,7 @@ in {
       path = [];
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${pkgs.trezord}/bin/trezord -f";
+        ExecStart = "${pkgs.trezord}/bin/trezord-go";
         User = "trezord";
       };
     };

nixos/modules/services/monitoring/grafana.nix

@@ -50,7 +50,7 @@ in {
     protocol = mkOption {
       description = "Which protocol to listen.";
       default = "http";
-      type = types.enum ["http" "https"];
+      type = types.enum ["http" "https" "socket"];
     };
 
     addr = mkOption {

nixos/modules/services/networking/dnscache.nix

@@ -9,12 +9,12 @@ let
     mkdir -p $out/{servers,ip}
 
     ${concatMapStrings (ip: ''
-      echo > "$out/ip/"${lib.escapeShellArg ip}
+      touch "$out/ip/"${lib.escapeShellArg ip}
     '') cfg.clientIps}
 
     ${concatStrings (mapAttrsToList (host: ips: ''
       ${concatMapStrings (ip: ''
-        echo ${lib.escapeShellArg ip} > "$out/servers/"${lib.escapeShellArg host}
+        echo ${lib.escapeShellArg ip} >> "$out/servers/"${lib.escapeShellArg host}
       '') ips}
     '') cfg.domainServers)}
 
@@ -34,33 +34,49 @@ in {
 
   options = {
     services.dnscache = {
+
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = "Whether to run the dnscache caching dns server";
+        description = "Whether to run the dnscache caching dns server.";
       };
 
       ip = mkOption {
         default = "0.0.0.0";
         type = types.str;
-        description = "IP address on which to listen for connections";
+        description = "IP address on which to listen for connections.";
       };
 
       clientIps = mkOption {
         default = [ "127.0.0.1" ];
         type = types.listOf types.str;
-        description = "client IP addresses (or prefixes) from which to accept connections";
+        description = "Client IP addresses (or prefixes) from which to accept connections.";
         example = ["192.168" "172.23.75.82"];
       };
 
       domainServers = mkOption {
         default = { };
         type = types.attrsOf (types.listOf types.str);
-        description = "table of {hostname: server} pairs to use as authoritative servers for hosts (and subhosts)";
+        description = ''
+          Table of {hostname: server} pairs to use as authoritative servers for hosts (and subhosts).
+          If entry for @ is not specified predefined list of root servers is used.
+        '';
         example = {
-          "example.com" = ["8.8.8.8" "8.8.4.4"];
+          "@" = ["8.8.8.8" "8.8.4.4"];
+          "example.com" = ["192.168.100.100"];
         };
       };
+
+      forwardOnly = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to treat root servers (for @) as caching
+          servers, requesting addresses the same way a client does. This is
+          needed if you want to use e.g. Google DNS as your upstream DNS.
+        '';
+      };
+
     };
   };
 
@@ -82,6 +98,7 @@ in {
       '';
       script = ''
         cd /var/lib/dnscache/
+        ${optionalString cfg.forwardOnly "export FORWARDONLY=1"}
         exec ./run
       '';
     };

nixos/modules/services/networking/prosody.nix

@@ -301,6 +301,18 @@ in
         default = "/var/lib/prosody";
       };
 
+      user = mkOption {
+        type = types.str;
+        default = "prosody";
+        description = "User account under which prosody runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "prosody";
+        description = "Group account under which prosody runs.";
+      };
+
       allowRegistration = mkOption {
         type = types.bool;
         default = false;
@@ -427,7 +439,7 @@ in
 
     environment.etc."prosody/prosody.cfg.lua".text = ''
 
-      pidfile = "${cfg.dataDir}/prosody.pid"
+      pidfile = "/run/prosody/prosody.pid"
 
       log = "*syslog"
 
@@ -475,15 +487,15 @@ in
         '') cfg.virtualHosts) }
     '';
 
-    users.extraUsers.prosody = {
+    users.extraUsers.prosody = mkIf (cfg.user == "prosody") {
       uid = config.ids.uids.prosody;
       description = "Prosody user";
       createHome = true;
-      group = "prosody";
+      inherit (cfg) group;
       home = "${cfg.dataDir}";
     };
 
-    users.extraGroups.prosody = {
+    users.extraGroups.prosody = mkIf (cfg.group == "prosody") {
       gid = config.ids.gids.prosody;
     };
 
@@ -494,9 +506,11 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."prosody/prosody.cfg.lua".source ];
       serviceConfig = {
-        User = "prosody";
+        User = cfg.user;
+        Group = cfg.group;
         Type = "forking";
-        PIDFile = "${cfg.dataDir}/prosody.pid";
+        RuntimeDirectory = [ "prosody" ];
+        PIDFile = "/run/prosody/prosody.pid";
         ExecStart = "${cfg.package}/bin/prosodyctl start";
       };
     };

nixos/modules/services/networking/shadowsocks.nix

@@ -0,0 +1,112 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.shadowsocks;
+
+  opts = {
+    server = cfg.localAddress;
+    server_port = cfg.port;
+    method = cfg.encryptionMethod;
+    mode = cfg.mode;
+    user = "nobody";
+    fast_open = true;
+  } // optionalAttrs (cfg.password != null) { password = cfg.password; };
+
+  configFile = pkgs.writeText "shadowsocks.json" (builtins.toJSON opts);
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.shadowsocks = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to run shadowsocks-libev shadowsocks server.
+        '';
+      };
+
+      localAddress = mkOption {
+        type = types.str;
+        default = "0.0.0.0";
+        description = ''
+          Local address to which the server binds.
+        '';
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8388;
+        description = ''
+          Port which the server uses.
+        '';
+      };
+
+      password = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Password for connecting clients.
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          Password file with a password for connecting clients.
+        '';
+      };
+
+      mode = mkOption {
+        type = types.enum [ "tcp_only" "tcp_and_udp" "udp_only" ];
+        default = "tcp_and_udp";
+        description = ''
+          Relay protocols.
+        '';
+      };
+
+      encryptionMethod = mkOption {
+        type = types.str;
+        default = "chacha20-ietf-poly1305";
+        description = ''
+          Encryption method. See <link xlink:href="https://github.com/shadowsocks/shadowsocks-org/wiki/AEAD-Ciphers"/>.
+        '';
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    assertions = singleton
+      { assertion = cfg.password == null || cfg.passwordFile == null;
+        message = "Cannot use both password and passwordFile for shadowsocks-libev";
+      };
+
+    systemd.services.shadowsocks-libev = {
+      description = "shadowsocks-libev Daemon";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.shadowsocks-libev ] ++ optional (cfg.passwordFile != null) pkgs.jq;
+      serviceConfig.PrivateTmp = true;
+      script = ''
+        ${optionalString (cfg.passwordFile != null) ''
+          cat ${configFile} | jq --arg password "$(cat "${cfg.passwordFile}")" '. + { password: $password }' > /tmp/shadowsocks.json
+        ''}
+        exec ss-server -c ${if cfg.passwordFile != null then "/tmp/shadowsocks.json" else configFile}
+      '';
+    };
+  };
+}

nixos/modules/services/torrent/transmission.nix

@@ -147,6 +147,7 @@ in
           ${getLib pkgs.libcap}/lib/libcap*.so*            mr,
           ${getLib pkgs.attr}/lib/libattr*.so*             mr,
           ${getLib pkgs.lz4}/lib/liblz4*.so*               mr,
+          ${getLib pkgs.libkrb5}/lib/lib*.so*              mr,
 
           @{PROC}/sys/kernel/random/uuid   r,
           @{PROC}/sys/vm/overcommit_memory r,

nixos/modules/tasks/filesystems/exfat.nix

@@ -5,7 +5,7 @@ with lib;
 {
   config = mkIf (any (fs: fs == "exfat") config.boot.supportedFilesystems) {
 
-    system.fsPackages = [ pkgs.exfat-utils pkgs.fuse_exfat ];
+    system.fsPackages = [ pkgs.exfat ];
 
   };
 }

nixos/modules/tasks/filesystems/zfs.nix

@@ -305,6 +305,8 @@ in
         }
       ];
 
+      virtualisation.lxd.zfsSupport = true;
+
       boot = {
         kernelModules = [ "spl" "zfs" ] ;
         extraModulePackages = with packages; [ spl zfs ];

nixos/modules/virtualisation/lxc.nix

@@ -74,6 +74,9 @@ in
     systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];
 
     security.apparmor.packages = [ pkgs.lxc ];
-    security.apparmor.profiles = [ "${pkgs.lxc}/etc/apparmor.d/lxc-containers" ];
+    security.apparmor.profiles = [
+      "${pkgs.lxc}/etc/apparmor.d/lxc-containers"
+      "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start"
+    ];
   };
 }

nixos/modules/virtualisation/lxd.nix

@@ -15,28 +15,34 @@ in
 
   options = {
 
-    virtualisation.lxd.enable =
+    virtualisation.lxd = {
-      mkOption {
+      enable = mkOption {
         type = types.bool;
         default = false;
-        description =
+        description = ''
-          ''
           This option enables lxd, a daemon that manages
           containers. Users in the "lxd" group can interact with
           the daemon (e.g. to start or stop containers) using the
           <command>lxc</command> command line tool, among others.
         '';
       };
-
+      zfsSupport = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          enables lxd to use zfs as a storage for containers.
+          This option is enabled by default if a zfs pool is configured
+          with nixos.
+        '';
+      };
+    };
   };
-
 
   ###### implementation
 
   config = mkIf cfg.enable {
 
-    environment.systemPackages =
+    environment.systemPackages = [ pkgs.lxd ];
-      [ pkgs.lxd ];
 
     security.apparmor = {
       enable = true;
@@ -47,22 +53,24 @@ in
       packages = [ pkgs.lxc ];
     };
 
-    systemd.services.lxd =
+    systemd.services.lxd = {
-      { description = "LXD Container Management Daemon";
+      description = "LXD Container Management Daemon";
 
       wantedBy = [ "multi-user.target" ];
       after = [ "systemd-udev-settle.service" ];
 
-        # TODO(wkennington): Add lvm2 and thin-provisioning-tools
+      path = lib.optional cfg.zfsSupport pkgs.zfs;
-        path = with pkgs; [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute iptables ];
 
       preStart = ''
         mkdir -m 0755 -p /var/lib/lxc/rootfs
       '';
 
-        serviceConfig.ExecStart = "@${pkgs.lxd.bin}/bin/lxd lxd --syslog --group lxd";
+      serviceConfig = {
-        serviceConfig.Type = "simple";
+        ExecStart = "@${pkgs.lxd.bin}/bin/lxd lxd --group lxd";
-        serviceConfig.KillMode = "process"; # when stopping, leave the containers alone
+        Type = "simple";
+        KillMode = "process"; # when stopping, leave the containers alone
+      };
+
     };
 
     users.extraGroups.lxd.gid = config.ids.gids.lxd;
@@ -71,7 +79,5 @@ in
       subUidRanges = [ { startUid = 1000000; count = 65536; } ];
       subGidRanges = [ { startGid = 1000000; count = 65536; } ];
     };
-
   };
-
 }

nixos/release.nix

@@ -166,8 +166,12 @@ in rec {
     inherit system;
   });
 
-  sd_image = forMatchingSystems [ "aarch64-linux" ] (system: makeSdImage {
+  sd_image = forMatchingSystems [ "armv6l-linux" "armv7l-linux" "aarch64-linux" ] (system: makeSdImage {
-    module = ./modules/installer/cd-dvd/sd-image-aarch64.nix;
+    module = {
+        armv6l-linux = ./modules/installer/cd-dvd/sd-image-raspberrypi.nix;
+        armv7l-linux = ./modules/installer/cd-dvd/sd-image-armv7l-multiplatform.nix;
+        aarch64-linux = ./modules/installer/cd-dvd/sd-image-aarch64.nix;
+      }.${system};
     inherit system;
   });
 
@@ -266,6 +270,7 @@ in rec {
   tests.couchdb = callTest tests/couchdb.nix {};
   tests.docker = callTestOnMatchingSystems ["x86_64-linux"] tests/docker.nix {};
   tests.docker-tools = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools.nix {};
+  tests.docker-tools-overlay = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools-overlay.nix {};
   tests.docker-edge = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-edge.nix {};
   tests.dovecot = callTest tests/dovecot.nix {};
   tests.dnscrypt-proxy = callTestOnMatchingSystems ["x86_64-linux"] tests/dnscrypt-proxy.nix {};

nixos/tests/docker-tools-overlay.nix

@@ -0,0 +1,32 @@
+# this test creates a simple GNU image with docker tools and sees if it executes
+
+import ./make-test.nix ({ pkgs, ... }:
+{
+  name = "docker-tools-overlay";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ lnl7 ];
+  };
+
+  nodes = {
+    docker =
+      { config, pkgs, ... }:
+      {
+        virtualisation.docker.enable = true;
+        virtualisation.docker.storageDriver = "overlay";  # defaults to overlay2
+      };
+  };
+
+  testScript =
+    ''
+      $docker->waitForUnit("sockets.target");
+
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
+      $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version");
+
+      # Check if the nix store has correct user permissions depending on what
+      # storage driver is used, incorrectly built images can show up as readonly.
+      # drw-------  3 0 0   3 Apr 14 11:36 /nix
+      # drw------- 99 0 0 100 Apr 14 11:36 /nix/store
+      $docker->succeed("docker run --rm -u 1000:1000 ${pkgs.dockerTools.examples.bash.imageName} bash --version");
+    '';
+})

nixos/tests/docker-tools.nix

@@ -3,7 +3,7 @@
 import ./make-test.nix ({ pkgs, ... }: {
   name = "docker-tools";
   meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ ];
+    maintainers = [ lnl7 ];
   };
 
   nodes = {
@@ -21,12 +21,12 @@ import ./make-test.nix ({ pkgs, ... }: {
       $docker->waitForUnit("sockets.target");
 
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.bash}'");
-      $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.bash.imageName} /bin/bash --version");
+      $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version");
       $docker->succeed("docker rmi ${pkgs.dockerTools.examples.bash.imageName}");
 
       # Check if the nix store is correctly initialized by listing dependencies of the installed Nix binary
       $docker->succeed("docker load --input='${pkgs.dockerTools.examples.nix}'");
-      $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.nix.imageName} /bin/nix-store -qR ${pkgs.nix}");
+      $docker->succeed("docker run --rm ${pkgs.dockerTools.examples.nix.imageName} nix-store -qR ${pkgs.nix}");
       $docker->succeed("docker rmi ${pkgs.dockerTools.examples.nix.imageName}");
 
       # To test the pullImage tool

nixos/tests/kernel-copperhead.nix

@@ -6,14 +6,14 @@ import ./make-test.nix ({ pkgs, ...} : {
 
   machine = { config, lib, pkgs, ... }:
     {
-      boot.kernelPackages = pkgs.linuxPackages_hardened_copperhead;
+      boot.kernelPackages = pkgs.linuxPackages_copperhead_hardened;
     };
 
   testScript =
     ''
       $machine->succeed("uname -a");
       $machine->succeed("uname -s | grep 'Linux'");
-      $machine->succeed("uname -a | grep '${pkgs.linuxPackages_hardened_copperhead.kernel.modDirVersion}'");
+      $machine->succeed("uname -a | grep '${pkgs.linuxPackages_copperhead_hardened.kernel.modDirVersion}'");
       $machine->succeed("uname -a | grep 'hardened'");
     '';
 })

pkgs/applications/audio/asunder/default.nix

@@ -12,11 +12,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "2.9.2";
+  version = "2.9.3";
   name = "asunder-${version}";
   src = fetchurl {
     url = "http://littlesvr.ca/asunder/releases/${name}.tar.bz2";
-    sha256 = "0vjbxrrjih4c673sc39wj5whp81xp9kmnwqxwzfnmhkky970rg5r";
+    sha256 = "1630i1df06y840v3fgdf75jxw1s8kwbfn5bhi0686viah0scccw5";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/audio/caps/default.nix

@@ -9,9 +9,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchurl {
-      url = "https://anonscm.debian.org/cgit/pkg-multimedia/caps.git/plain/debian/patches/0001-Avoid-ambiguity-in-div-invocation.patch";
+      url = "https://salsa.debian.org/multimedia-team/caps/raw/9a99c225/debian/patches/0001-Avoid-ambiguity-in-div-invocation.patch";
       sha256 = "1b1pb5yfskiw8zi1lkj572l2ajpirh4amq538vggwvlpv1fqfway";
     })
+    (fetchurl {
+      url = "https://salsa.debian.org/multimedia-team/caps/raw/a411203d/debian/patches/0002-Use-standard-exp10f-instead-of-pow10f.patch";
+      sha256 = "18ciklnscabr77l8b89xmbagkk79w4iqfpzr2yhn2ywv2jp8akx9";
+    })
   ];
 
   configurePhase = ''

pkgs/applications/audio/eq10q/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, cmake, fftw, gtkmm2, libxcb, lv2, pkgconfig, xorg }:
+{ stdenv, fetchurl, fetchpatch, cmake, fftw, gtkmm2, libxcb, lv2, pkgconfig
+, xorg }:
 stdenv.mkDerivation rec {
   name = "eq10q-${version}";
   version = "2.2";
@@ -10,6 +11,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake fftw gtkmm2 libxcb lv2 xorg.libpthreadstubs xorg.libXdmcp xorg.libxshmfence ];
 
+  patches = [
+    (fetchpatch {
+      # glibc 2.27 compatibility
+      url = https://sources.debian.org/data/main/e/eq10q/2.2~repack0-2.1/debian/patches/05-pow10.patch;
+      sha256 = "07b0wf6k4xqgigv4h095bzfaw8r218wa36r9w1817jcys13r6c5r";
+    })
+  ];
+
   installFlags = ''
     DESTDIR=$(out)
   '';

pkgs/applications/audio/ncmpcpp/default.nix

@@ -12,11 +12,11 @@ assert taglibSupport -> (taglib != null);
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "ncmpcpp-${version}";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchurl {
     url = "https://ncmpcpp.rybczak.net/stable/${name}.tar.bz2";
-    sha256 = "1zw8d07b2bkssbsybg6jnmpq001w525viajrnz4jvfml3l55gyad";
+    sha256 = "0m0mjb049sl62vx13h9waavysa30mk0rphacksnvf94n13la62v5";
   };
 
   configureFlags = [ "BOOST_LIB_SUFFIX=" ]

pkgs/applications/audio/spotify/default.nix

@@ -9,7 +9,7 @@ let
   # Latest version number can be found at:
   # http://repository-origin.spotify.com/pool/non-free/s/spotify-client/
   # Be careful not to pick the testing version.
-  version = "1.0.72.117.g6bd7cc73-35";
+  version = "1.0.77.338.g758ebd78-41";
 
   deps = [
     alsaLib
@@ -54,7 +54,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://repository-origin.spotify.com/pool/non-free/s/spotify-client/spotify-client_${version}_amd64.deb";
-    sha256 = "0yicwvg6jx8r657ff53326akq3g4ayiinlracjw5jrcs8x9whjap";
+    sha256 = "1971jc0431pl8yixpl37ryl2l0pqdf0xjvkg59nqdwj3vbdx5606";
   };
 
   buildInputs = [ dpkg makeWrapper ];

pkgs/applications/editors/ghostwriter/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ghostwriter";
-  version = "1.6.1";
+  version = "1.6.2";
   name = "${pname}-${version}";
 
   src = fetchFromGitHub {
     owner = "wereturtle";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ihdr4xk0j83q83xknbikxb7yf9qhlkgvc89w33lhj090cv376gd";
+    sha256 = "0251563zy0q69fzfacvalpx43y15cshb0bhshyd4w37061gh1c12";
   };
 
   nativeBuildInputs = [ qmake pkgconfig ];

pkgs/applications/editors/sublime/3/packages.nix

@@ -5,9 +5,9 @@ let
 in
   rec {
     sublime3-dev = common {
-      buildVersion = "3161";
+      buildVersion = "3162";
-      x32sha256 = "0qrm2qmfsj71lr83c8zas2n3xk8hk9k4w8ygnasjhggmyjm3wy0q";
+      x32sha256 = "190il02hqvv64w17w7xc1fz2wkbhk5a5y96jb25dvafmslm46d4i";
-      x64sha256 = "0cgadylm68s2jly10r038q1fvmbzmpc2nvqy86vlyq9avgqbm5pc";
+      x64sha256 = "1nsjhjs6zajhx7m3dk7i450krg6pb03zffm1n3m1v0xb9zr37xz3";
     } {};
 
     sublime3 = common {

pkgs/applications/editors/vscode/default.nix

@@ -2,7 +2,7 @@
   makeWrapper, libXScrnSaver, libxkbfile, libsecret }:
 
 let
-  version = "1.22.1";
+  version = "1.22.2";
   channel = "stable";
 
   plat = {
@@ -12,9 +12,9 @@ let
   }.${stdenv.system};
 
   sha256 = {
-    "i686-linux" = "1w1ywf21vcwmfq5ngag1y076nxbdqg3qav90ilxgd3dkv5j6fkjr";
+    "i686-linux" = "17iqqg6vdccbl1k4k2ks3kkgg7619j6qdvca4k27pjfqm17mvw5n";
-    "x86_64-linux" = "14phpsrkkv09dgr7phqhgjzfhm3zzbh3w2yhyng0cj3vwzysikcs";
+    "x86_64-linux" = "1ng2jhhaghsf7a2dmrimazh817jh0ag88whija179ywgrg3i6xam";
-    "x86_64-darwin" = "0fqsr4ramanl7v1damf01zkmg75s9nlfkj6298h9sjvhc93pfcll";
+    "x86_64-darwin" = "083hizigzxm45hcy6yqwznj9ibqdaxg2xv8rsyas4ig9x55irrcj";
   }.${stdenv.system};
 
   archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";

pkgs/applications/gis/grass/default.nix

@@ -35,6 +35,9 @@ stdenv.mkDerivation {
     "--with-blas"
   ];
 
+  # Otherwise a very confusing "Can't load GDAL library" error
+  makeFlags = stdenv.lib.optional stdenv.isDarwin "GDAL_DYNAMIC=";
+
   /* Ensures that the python script run at build time are actually executable;
    * otherwise, patchShebangs ignores them.  */
   postConfigure = ''
@@ -73,6 +76,7 @@ stdenv.mkDerivation {
     --set GRASS_PYTHON ${python2Packages.python}/bin/${python2Packages.python.executable} \
     --suffix LD_LIBRARY_PATH ':' '${gdal}/lib'
     ln -s $out/grass-*/lib $out/lib
+    ln -s $out/grass-*/include $out/include
   '';
 
   enableParallelBuilding = true;
@@ -82,5 +86,6 @@ stdenv.mkDerivation {
     description = "GIS software suite used for geospatial data management and analysis, image processing, graphics and maps production, spatial modeling, and visualization";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.all;
+    maintainers = with stdenv.lib.maintainers; [mpickering];
   };
 }

pkgs/applications/gis/qgis/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, fetchpatch, gdal, cmake, qt4, flex, bison, proj, geos, xlibsWrapper, sqlite, gsl
 , qwt, fcgi, python2Packages, libspatialindex, libspatialite, qscintilla, postgresql, makeWrapper
 , qjson, qca2, txt2tags, openssl, darwin, pkgconfig
-, withGrass ? false, grass, IOKit, ApplicationServices
+, withGrass ? true, grass, IOKit, ApplicationServices
 }:
 
 stdenv.mkDerivation rec {
@@ -58,11 +58,13 @@ stdenv.mkDerivation rec {
           '') +
     (stdenv.lib.optionalString stdenv.isDarwin ''
       # Necessary for QGIS to find the correct default GRASS path
+      # Plugins look for gdal tools like deminfo on the PATH
       ${stdenv.lib.optionalString withGrass "ln -sf ${grass} $out/QGIS.app/Contents/MacOS/grass"}
       for file in $(find $out -type f -name "QGIS"); do
         wrapProgram "$file" \
           --prefix DYLD_LIBRARY_PATH : "${qwt}/lib" \
           --prefix DYLD_LIBRARY_PATH : "${qscintilla}/lib" \
+          --prefix PATH : "${gdal}/bin" \
           ${stdenv.lib.optionalString withGrass "--prefix PATH : ${grass}/bin"} \
           --set PYTHONPATH $PYTHONPATH
       done
@@ -75,6 +77,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.qgis.org;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = with stdenv.lib.platforms; unix;
-    maintainers = with stdenv.lib.maintainers; [viric];
+    maintainers = with stdenv.lib.maintainers; [viric mpickering];
   };
 }

pkgs/applications/graphics/dosage/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, pythonPackages, fetchFromGitHub }:
+
+pythonPackages.buildPythonApplication rec {
+  name = "${pname}-${version}";
+  pname = "dosage";
+  version = "2018.04.08";
+  PBR_VERSION = version;
+
+  src = fetchFromGitHub {
+    owner = "webcomics";
+    repo = "dosage";
+    rev = "b2fdc13feb65b93762928f7e99bac7b1b7b31591";
+    sha256 = "1p6vllqaf9s6crj47xqp97hkglch1kd4y8y4lxvzx3g2shhhk9hh";
+  };
+  buildInputs = with pythonPackages; [ pytest responses ];
+  propagatedBuildInputs = with pythonPackages; [ colorama lxml requests pbr ];
+
+  disabled = pythonPackages.pythonOlder "3.3";
+
+  checkPhase = ''
+    py.test tests/
+  '';
+
+  meta = {
+    description = "A comic strip downloader and archiver";
+    homepage = http://dosage.rocks/;
+  };
+}

pkgs/applications/graphics/k3d/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, fetchpatch, unzip, ftgl, glew, asciidoc
-, cmake, libGLU_combined, zlib, python, expat, libxml2, libsigcxx, libuuid, freetype
+, cmake, ninja, libGLU_combined, zlib, python, expat, libxml2, libsigcxx, libuuid, freetype
 , libpng, boost, doxygen, cairomm, pkgconfig, imagemagick, libjpeg, libtiff
 , gettext, intltool, perl, gtkmm2, glibmm, gtkglext, pangox_compat, libXmu }:
 
@@ -20,24 +20,25 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  cmakeFlags = "-DK3D_BUILD_DOCS=false -DK3D_BUILD_GUIDE=false";
+  cmakeFlags = [
+    "-DK3D_BUILD_DOCS=false"
+    "-DK3D_BUILD_GUIDE=false"
+  ];
 
   preConfigure = ''
     export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/build/lib"
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE  -I$(echo ${gtkglext}/include/gtkglext-*) -I$(echo ${gtkglext}/lib/gtkglext-*/include)"
   '';
 
+  nativeBuildInputs = [ cmake ninja gettext intltool doxygen pkgconfig perl asciidoc ];
+
   buildInputs = [
-     cmake libGLU_combined zlib python expat libxml2 libsigcxx libuuid freetype libpng
+     libGLU_combined zlib python expat libxml2 libsigcxx libuuid freetype libpng
-     boost doxygen cairomm pkgconfig imagemagick libjpeg libtiff
+     boost cairomm imagemagick libjpeg libtiff
-     gettext intltool perl unzip ftgl glew asciidoc
+     ftgl glew gtkmm2 glibmm gtkglext pangox_compat libXmu
-     gtkmm2 glibmm gtkglext pangox_compat libXmu
     ];
 
   #doCheck = false;
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "A 3D editor with support for procedural editing";
     homepage = http://www.k-3d.org/;

pkgs/applications/graphics/paraview/default.nix

@@ -1,5 +1,5 @@
 {
-stdenv, fetchFromGitHub, cmake
+stdenv, fetchFromGitHub, cmake, makeWrapper
 ,qtbase, qttools, python, libGLU_combined
 ,libXt, qtx11extras, qtxmlpatterns
 }:
@@ -35,10 +35,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
+    makeWrapper
   ];
 
   buildInputs = [
     python
+    python.pkgs.numpy
     libGLU_combined
     libXt
     qtbase
@@ -47,6 +49,16 @@ stdenv.mkDerivation rec {
     qtxmlpatterns
   ];
 
+  # Paraview links into the Python library, resolving symbolic links on the way,
+  # so we need to put the correct sitePackages (with numpy) back on the path
+  postInstall = ''
+    wrapProgram $out/bin/paraview \
+      --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+    wrapProgram $out/bin/pvbatch \
+      --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+    wrapProgram $out/bin/pvpython \
+      --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+  '';
 
   meta = {
     homepage = http://www.paraview.org/;

pkgs/applications/graphics/shotwell/default.nix

@@ -7,13 +7,13 @@
 
 let
   pname = "shotwell";
-  version = "0.28.1";
+  version = "0.28.2";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1ywikm5kdsr7q8hklh146x28rzvqkqfjs8kdpw7zcc15ri0dkzya";
+    sha256 = "0pa7lb33i4hdnz7hr7x938d48ilrnj47jzb99la79rmm08yyin8n";
   };
 
   nativeBuildInputs = [

pkgs/applications/kde/default.nix

@@ -84,6 +84,7 @@ let
       incidenceeditor = callPackage ./incidenceeditor.nix {};
       k3b = callPackage ./k3b.nix {};
       kaddressbook = callPackage ./kaddressbook.nix {};
+      kalarm = callPackage ./kalarm.nix {};
       kalarmcal = callPackage ./kalarmcal.nix {};
       kate = callPackage ./kate.nix {};
       kcachegrind = callPackage ./kcachegrind.nix {};

pkgs/applications/kde/kalarm.nix

@@ -0,0 +1,37 @@
+{
+  mkDerivation, lib,
+  extra-cmake-modules,
+
+  kauth, kcodecs, kcompletion, kconfig, kconfigwidgets, kdbusaddons, kdoctools,
+  kguiaddons, ki18n, kiconthemes, kjobwidgets, kcmutils, kdelibs4support, kio,
+  knotifications, kservice, kwidgetsaddons, kwindowsystem, kxmlgui, phonon,
+
+  kimap, akonadi, akonadi-contacts, akonadi-mime, kalarmcal, kcalcore, kcalutils,
+  kholidays, kidentitymanagement, libkdepim, mailcommon, kmailtransport, kmime,
+  pimcommon, kpimtextedit, kdepim-apps-libs, messagelib,
+
+  qtx11extras,
+
+  kdepim-runtime
+}:
+
+mkDerivation {
+  name = "kalarm";
+  meta = {
+    license = with lib.licenses; [ gpl2 ];
+    maintainers = [ lib.maintainers.rittelle ];
+  };
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  buildInputs = [
+    kauth kcodecs kcompletion kconfig kconfigwidgets kdbusaddons kdoctools
+    kguiaddons ki18n kiconthemes kjobwidgets kcmutils kdelibs4support kio
+    knotifications kservice kwidgetsaddons kwindowsystem kxmlgui phonon
+
+    kimap akonadi akonadi-contacts akonadi-mime kalarmcal kcalcore kcalutils
+    kholidays kidentitymanagement libkdepim mailcommon kmailtransport kmime
+    pimcommon kpimtextedit kdepim-apps-libs messagelib
+
+    qtx11extras
+  ];
+  propagatedUserEnvPkgs = [ kdepim-runtime ];
+}

pkgs/applications/misc/alacritty/default.nix

@@ -13,6 +13,7 @@
   libXxf86vm,
   libXi,
   libXrandr,
+  libGL,
   xclip }:
 
 with rustPlatform;
@@ -26,6 +27,7 @@ let
     libXcursor
     libXxf86vm
     libXrandr
+    libGL
     libXi
   ];
 in buildRustPackage rec {

pkgs/applications/misc/cbatticon/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   name = "cbatticon-${version}";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchFromGitHub {
     owner = "valr";
     repo = "cbatticon";
     rev = version;
-    sha256 = "0rm1rpq81cxjwd4f11c3ivg5hwsd08qm47vdn16yr1cmm2cw4r2d";
+    sha256 = "16g26vin1693dbdr9qsnw36fdchx394lp79gvp7gcbw0w1ny9av6";
   };
 
   makeFlags = "PREFIX=$(out)";

pkgs/applications/misc/guake/default.nix

@@ -1,76 +1,38 @@
-/* Beware!
+{ stdenv, fetchFromGitHub, python3, gettext, gobjectIntrospection, wrapGAppsHook, glibcLocales
-After starting Guake it will give the error message "Guake can not init! Gconf Error. Have you installed guake.schemas properly?",
+, gtk3, keybinder3, libnotify, libutempter, vte }:
-which will have to be resolved manually, because I have not found a way to automate this, without being impure.
-
-If you have Guake installed, you can use `nix-build -A gnome3.guake` to get the path to the build directory in the nix store,
-which then can be used in the following command to install the schemas file of Guake:
-gconftool-2 --install-schema-file /path/returned/by/nix-build/share/gconf/schemas/guake.schemas
-
-It can be removed again by the following command:
-gconftool-2 --recursive-unset /apps/guake
-*/
-{ stdenv, fetchurl, lib
-, pkgconfig, libtool, intltool, makeWrapper
-, dbus, gtk2, gconf, python2Packages, libutempter, vte, keybinder, gnome2, gnome3 }:
-
-with lib;
 
 let
-  inherit (python2Packages) python;
+  version = "3.2.0";
-  inputs = [ dbus gtk2 gconf python libutempter vte keybinder gnome3.gnome-common ];
+in python3.pkgs.buildPythonApplication rec {
-  pyPath = makeSearchPathOutput "lib" python.sitePackages (attrVals [ "dbus-python" "notify" "pyGtkGlade" "pyxdg" ] python2Packages ++ [ gnome2.gnome_python ]);
- in stdenv.mkDerivation rec {
   name = "guake-${version}";
-  version = "0.8.3";
+  format = "other";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/Guake/guake/archive/${version}.tar.gz";
+    owner = "Guake";
-    sha256 = "1lbmdz3i9a97840h8239s360hd37nmhy3hs6kancxbzl1512ak1y";
+    repo = "guake";
+    rev = version;
+    sha256 = "1qghapg9sslj9fdrl2mnbi10lgqgqa36gdag74wn7as9wak4qc3d";
   };
 
-  nativeBuildInputs = [ pkgconfig libtool intltool makeWrapper ];
+  nativeBuildInputs = [ gettext gobjectIntrospection wrapGAppsHook python3.pkgs.pip glibcLocales ];
 
-  buildInputs = inputs ++ (with python2Packages; [ pyGtkGlade pyxdg ]);
+  buildInputs = [ gtk3 keybinder3 libnotify python3 vte ];
 
-  propagatedUserEnvPkgs = [ gconf.out ];
+  propagatedBuildInputs = with python3.pkgs; [ dbus-python pbr pycairo pygobject3 ];
 
-  patchPhase = ''
+  LC_ALL = "en_US.UTF-8"; # fixes weird encoding error, see https://github.com/NixOS/nixpkgs/pull/38642#issuecomment-379727699
-    patchShebangs .
-  '';
 
-  configureScript = "./autogen.sh";
+  PBR_VERSION = version; # pbr needs either .git directory, sdist, or env var
 
-  configureFlags = [
+  makeFlags = [
-    "--sysconfdir=/etc"
+    "prefix=$(out)"
-    "--localstatedir=/var"
-    "--disable-schemas-install"
   ];
 
-  installFlags = [
+  preFixup = ''
-    # Configuring the installation to not install gconf schemas is not always supported,
+    gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ libutempter ]}")
-    # therefore gconftool-2 has this variable, which will make gconftool-2 not update any of the databases.
-    "GCONF_DISABLE_MAKEFILE_SCHEMA_INSTALL=1"
-    "sysconfdir=\${out}/etc"
-    "localstatedir=\${TMPDIR}"
-  ];
-
-  postInstall = ''
-    mkdir -p $out/share/gconf/schemas
-    cp data/guake.schemas $out/share/gconf/schemas
   '';
 
-  postFixup = ''
+  meta = with stdenv.lib; {
-    for bin in $out/bin/{guake,guake-prefs}; do
-      substituteInPlace $bin \
-        --replace '/usr/bin/env python2' ${python.interpreter}
-      wrapProgram $bin \
-        --prefix XDG_DATA_DIRS : "$out/share:$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
-        --prefix LD_LIBRARY_PATH : ${makeLibraryPath inputs} \
-        --prefix PYTHONPATH : "$out/${python.sitePackages}:${pyPath}:$PYTHONPATH"
-    done
-  '';
-
-  meta = {
     description = "Drop-down terminal for GNOME";
     homepage = http://guake-project.org;
     license = licenses.gpl2;

pkgs/applications/misc/masterpdfeditor/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, glibc, sane-backends, qtbase, qtsvg, libXext, libX11, libXdmcp, libXau, libxcb }:
   let
-    version = "4.3.82";
+    version = "4.3.89";
   in
     stdenv.mkDerivation {
       name = "masterpdfeditor-${version}";
       src = fetchurl {
         url = "http://get.code-industry.net/public/master-pdf-editor-${version}_qt5.amd64.tar.gz";
-        sha256 = "0bfqnpg2p5jxygcahqqljyb0gd2z28hj5n1j9g1x7px8f7wwiwl4";
+        sha256 = "0k5bzlhqglskiiq86nmy18mnh5bf2w3mr9cq3pibrwn5pisxnxxc";
       };
       libPath = stdenv.lib.makeLibraryPath [
         stdenv.cc.cc

pkgs/applications/misc/slic3r-prusa3d/default.nix

@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
     ClassXSAccessor
     EncodeLocale
     ExtUtilsMakeMaker
+    ExtUtilsTypemapsDefault
     ExtUtilsXSpp
     GrowlGNTP
     ImportInto
@@ -62,7 +63,7 @@ stdenv.mkDerivation rec {
     MathConvexHullMonotoneChain
     MathGeometryVoronoi
     MathPlanePath
-    ModuleBuild
+    ModuleBuildWithXSpp
     Moo
     NetDBus
     OpenGL

pkgs/applications/misc/terminator/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, pythonPackages, keybinder, vte, gettext, intltool, file, gtk3, gobjectIntrospection, cairo
+{ stdenv, fetchurl, python2, keybinder3, intltool, file, gtk3, gobjectIntrospection
-, wrapGAppsHook, gnome3
+, libnotify, wrapGAppsHook, gnome3
 }:
 
-pythonPackages.buildPythonApplication rec {
+python2.pkgs.buildPythonApplication rec {
   name = "terminator-${version}";
   version = "1.91";
 
@@ -11,13 +11,9 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "95f76e3c0253956d19ceab2f8da709a496f1b9cf9b1c5b8d3cd0b6da3cc7be69";
   };
 
-  nativeBuildInputs = [ file intltool wrapGAppsHook ];
+  nativeBuildInputs = [ file intltool wrapGAppsHook gobjectIntrospection ];
-  buildInputs = [ gtk3 gnome3.vte gobjectIntrospection cairo ];
+  buildInputs = [ gtk3 gnome3.vte libnotify keybinder3 ];
-
+  propagatedBuildInputs = with python2.pkgs; [ pygobject3 psutil pycairo ];
-  pythonPath = with pythonPackages; [
-    pygobject3 vte keybinder notify gettext psutil
-    pycairo
-  ];
 
   postPatch = ''
     patchShebangs .

pkgs/applications/misc/xtermcontrol/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "3.3";
+  version = "3.4";
   name = "xtermcontrol-${version}";
 
   src = fetchurl {
     url = "http://thrysoee.dk/xtermcontrol/xtermcontrol-${version}.tar.gz";
-    sha256 = "1v2c1cnx43apmspga7icssh5ndbhzy5h82y6vm8fda40flq9mxj5";
+    sha256 = "1g81v9gfn08gjn1269j0qx12x36s9j6x39gl91ycay391flgzr5l";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -174,6 +174,8 @@ stdenv.mkDerivation {
 
   passthru.ffmpegSupport = true;
   passthru.gssSupport = true;
+  # update with:
+  # $ nix-shell maintainers/scripts/update.nix --argstr package firefox-bin-unwrapped
   passthru.updateScript = import ./update.nix {
     inherit name channel writeScript xidel coreutils gnused gnugrep gnupg curl;
     baseUrl =

pkgs/applications/networking/c14/default.nix

@@ -1,17 +1,16 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
-  name = "c14-cli-unstable-${version}";
+  name = "c14-cli-${version}";
-  version = "2017-05-15";
+  version = "0.3";
-  rev = "97f437ef5133f73edd551c883db3076c76cb1f6b";
 
   goPackagePath = "github.com/online-net/c14-cli";
 
   src = fetchFromGitHub {
     owner = "online-net";
     repo = "c14-cli";
-    inherit rev;
+    rev = "${version}";
-    sha256 = "1b44bh0zhh6rhw4d3nprnnxhjgaskl9kzp2cvwwyli5svhjxrfdj";
+    sha256 = "0b1piviy6vvdbak8y8bc24rk3c1fi67vv3352pmnzvrhsar2r5yf";
   };
 
   goDeps = ./deps.nix;

pkgs/applications/networking/cluster/heptio-ark/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  name = "heptio-ark-${version}";
+  version = "0.7.1";
+
+  goPackagePath = "github.com/heptio/ark";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "heptio";
+    repo = "ark";
+    sha256 = "0j3x9zxcffxhlw0fxq2cw9ph37bqw90cbmf9xshmnj8yl9rbxp7y";
+  };
+
+  postInstall = "rm $bin/bin/generate";
+
+  meta = with stdenv.lib; {
+    description = "A utility for managing disaster recovery, specifically for your Kubernetes cluster resources and persistent volumes";
+    homepage = https://heptio.github.io/ark/;
+    license = licenses.asl20;
+    maintainers = [maintainers.mbode];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/instant-messengers/hipchat/default.nix

@@ -4,7 +4,7 @@
 
 let
 
-  version = "4.30.3.1670";
+  version = "4.30.4.1672";
 
   rpath = stdenv.lib.makeLibraryPath [
     xdg_utils
@@ -44,7 +44,7 @@ let
     if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "https://atlassian.artifactoryonline.com/atlassian/hipchat-apt-client/pool/HipChat4-${version}-Linux.deb";
-        sha256 = "0alqzay6bvi7ybrrdk5r0xkg4sx6qjsqbgmr16bkqxncxhb215ay";
+        sha256 = "1xrwndhbyhcmjcg8h1ib8lp1g51f7jxdhc6p7776zmhlfw94n3rx";
       }
     else
       throw "HipChat is not supported on ${stdenv.system}";

pkgs/applications/networking/instant-messengers/nheko/default.nix

@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
   name = "nheko-${version}";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "mujx";
     repo = "nheko";
     rev = "v${version}";
-    sha256 = "178z64vkl7nmr1amgsgvdcwipj8czp7vbvidxllxiwal21yvqpky";
+    sha256 = "1dqd698p6wicz0x1lb6mzlwcp68sjkivanb9lwz3yy1mlmy8i3jn";
   };
 
   # This patch is likely not strictly speaking needed, but will help detect when

pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-discord/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, pkgconfig, pidgin, json_glib }:
+
+stdenv.mkDerivation rec {
+  name = "purple-discord-${version}";
+  version = "unstable-2018-04-10";
+
+  src = fetchFromGitHub {
+    owner = "EionRobb";
+    repo = "purple-discord";
+    rev = "9a97886d15a1f028de54b5e6fc54e784531063b0";
+    sha256 = "0dc344zh1v4yh9c8javcw5ylzwc1wpx0ih8bww8p8cjmhr8kcl32";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ pidgin json_glib ];
+
+  makeFlags = [
+    "DESTDIR=$(out)"
+  ];
+
+  PKG_CONFIG_PURPLE_PLUGINDIR = "/lib/purple-2";
+  PKG_CONFIG_PURPLE_DATADIR = "/share";
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/EionRobb/purple-discord;
+    description = "Discord plugin for Pidgin";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ sna ];
+  };
+}

pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-hangouts/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "purple-hangouts-hg-${version}";
-  version = "2017-10-08";
+  version = "2018-03-28";
 
   src = fetchhg {
     url = "https://bitbucket.org/EionRobb/purple-hangouts/";
-    rev = "5e769791d282a6e5ae4d94dc66a1ff9d6904ec9c";
+    rev = "0e137e6bf9e95c5a0bd282f3ad4a5bd00a6968ab";
-    sha256 = "0cs7dcd44lkc2anradyddjvmfvnl46ixw4idaf1m9fd7j35mg7b1";
+    sha256 = "04vjgz6qyd9ilv1c6n08r45vc683vxs1rgfwhh65pag6q4rbzlb9";
   };
 
   buildInputs = [ pidgin glib json-glib protobuf protobufc ];

pkgs/applications/networking/instant-messengers/riot/riot-web.nix

@@ -3,11 +3,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
   name= "riot-web-${version}";
-  version = "0.13.5";
+  version = "0.14.0";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1ap62ksi3dg7qijxxysjpnlmngzgh2jdldvb8s1jx14avanccch6";
+    sha256 = "0san8d3dghjkqqv0ypampgl7837mxk9w64ci6fzy1k5d5dmdgvsi";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -40,13 +40,13 @@ in
   stdenv.mkDerivation rec {
     name = "signal-desktop-${version}";
 
-    version = "1.6.1";
+    version = "1.7.1";
 
     src =
       if stdenv.system == "x86_64-linux" then
         fetchurl {
           url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-          sha256 = "0q2qzl84ifnhcn1qbq38fdpj8ry748h6dlzp2mdpkslsh8mc46as";
+          sha256 = "02zx8ynbvvs260mrvqbsg0fi561da4ni3i9f4bjh53vqn92vhvvq";
         }
       else
         throw "Signal for Desktop is not currently supported on ${stdenv.system}";

pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "mutt-${version}";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${name}.tar.gz";
-    sha256 = "1pxmw5yyizb9bqbai6lihv6zxmw0znjfb60zaldwh6hc6lkbzlgl";
+    sha256 = "0lsp72lm3cw490x7lhzia7h8f591bab2mr7qpscaj22fmrj7wqdz";
   };
 
   patches = optional smimeSupport (fetchpatch {

pkgs/applications/networking/sync/backintime/qt4.nix

@@ -1,7 +1,7 @@
 {stdenv, fetchurl, makeWrapper, gettext, pkgconfig, libtool, backintime-common, python3, python3Packages }:
 
 stdenv.mkDerivation rec {
-  inherit (backintime-common) version src installFlags meta;
+  inherit (backintime-common) version src installFlags;
 
   name = "backintime-qt4-${version}";
 
@@ -22,4 +22,7 @@ stdenv.mkDerivation rec {
         --prefix PATH : "${backintime-common}/bin:$PATH"
     '';
 
+  meta = with stdenv.lib; {
+    broken = true;
+  };
 }

pkgs/applications/networking/testssl/default.nix

@@ -1,9 +1,8 @@
-{ stdenv, fetchFromGitHub, pkgs }:
+{ stdenv, fetchFromGitHub, makeWrapper, lib
+, dnsutils, coreutils, openssl, nettools, utillinux, procps }:
 
 let
-  version = "2.9.5-4";
+  version = "2.9.5-5";
-  pwdBinPath = "${stdenv.lib.makeBinPath (with pkgs; [ coreutils ])}/pwd";
-  opensslBinPath = "${stdenv.lib.makeBinPath (with pkgs; [ openssl ])}/openssl";
 
 in stdenv.mkDerivation rec {
   name = "testssl.sh-${version}";
@@ -12,22 +11,32 @@ in stdenv.mkDerivation rec {
     owner = "drwetter";
     repo = "testssl.sh";
     rev = "v${version}";
-    sha256 = "0pfp7r4jhvkh06vawqlvq7vp4imwp6dpq6jx8m0k3j85ywwp45pd";
+    sha256 = "0zgj9vhd8fv3a1cn8dxqmjd8qmgryc867gq7zbvbr41lkqc06a1r";
   };
 
-  patches = [ ./testssl.patch ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [
+    coreutils # for pwd and printf
+    dnsutils  # for dig
+    nettools  # for hostname
+    openssl   # for openssl
+    procps    # for ps
+    utillinux # for hexdump
+  ];
 
   postPatch = ''
     substituteInPlace testssl.sh                                               \
-      --replace /bin/pwd                    ${pwdBinPath}                      \
+      --replace /bin/pwd                    pwd                                \
-      --replace TESTSSL_INSTALL_DIR:-\"\"   TESTSSL_INSTALL_DIR:-\"$out\"      \
+      --replace TESTSSL_INSTALL_DIR:-\"\"   TESTSSL_INSTALL_DIR:-\"$out\"
-      --replace @@openssl-path@@            ${opensslBinPath}
   '';
 
   installPhase = ''
-    mkdir -p $out/bin $out/etc
+    install -Dt $out/bin testssl.sh
-    cp -r etc/ $out/
+
-    cp testssl.sh $out/bin/testssl.sh
+    wrapProgram $out/bin/testssl.sh                                            \
+      --prefix PATH ':' ${lib.makeBinPath buildInputs}
+
+    cp -r etc $out
   '';
 
   meta = with stdenv.lib; {
@@ -38,6 +47,6 @@ in stdenv.mkDerivation rec {
     '';
     homepage = https://testssl.sh/;
     license = licenses.gpl2;
-    maintainers = [ maintainers.etu ];
+    maintainers = with maintainers; [ etu ];
   };
 }

pkgs/applications/networking/testssl/testssl.patch

@@ -1,10 +0,0 @@
---- testssl/testssl.sh	2017-09-24 16:53:29.395263437 +0200
-+++ testssl-new/testssl.sh	2017-09-24 16:53:41.221154492 +0200
-@@ -165,6 +165,7 @@
- # following variables make use of $ENV, e.g. OPENSSL=<myprivate_path_to_openssl> ./testssl.sh <host>
- # 0 means (normally) true here. Some of the variables are also accessible with a command line switch, see --help
- declare -x OPENSSL OPENSSL_TIMEOUT
-+OPENSSL=${OPENSSL:-"@@openssl-path@@"}
- FAST_SOCKET=${FAST_SOCKET:-false}       # EXPERIMENTAL feature to accelerate sockets -- DO NOT USE it for production
- COLOR=${COLOR:-2}                       # 2: Full color, 1: b/w+positioning, 0: no ESC at all
- COLORBLIND=${COLORBLIND:-false}         # if true, swap blue and green in the output

pkgs/applications/office/libreoffice/still.nix

@@ -2,7 +2,7 @@
 , CompressZlib, zlib, libjpeg, expat, pkgconfigUpstream, freetype, libwpd
 , libxml2, db, sablotron, curl, fontconfig, libsndfile, neon
 , bison, flex, zip, unzip, gtk3, gtk2, libmspack, getopt, file, cairo, which
-, icu, boost, jdk, ant, cups, xorg, libcmis
+, icu, boost, jdk, ant, cups, xorg, libcmis, carlito
 , openssl, gperf, cppunit, GConf, ORBit2, poppler
 , librsvg, gnome_vfs, libGLU_combined, bsh, CoinMP, libwps, libabw
 , autoconf, automake, openldap, bash, hunspell, librdf_redland, nss, nspr
@@ -106,6 +106,11 @@ in stdenv.mkDerivation rec {
 
     # BLFS patch for Glibc 2.23 renaming isnan
     sed -ire "s@isnan@std::&@g" xmloff/source/draw/ximp3dscene.cxx
+
+    # This is required as some cppunittests require fontconfig configured
+    cp "${fontsConf}" fonts.conf
+    sed -e '/include/i<include>${carlito}/etc/fonts/conf.d</include>' -i fonts.conf
+    export FONTCONFIG_FILE="$PWD/fonts.conf"
   '';
 
   # fetch_Download_item tries to interpret the name as a variable name

pkgs/applications/office/libreoffice/wrapper.sh

@@ -3,22 +3,13 @@ export JAVA_HOME="${JAVA_HOME:-@jdk@}"
 export SAL_USE_VCLPLUGIN="${SAL_USE_VCLPLUGIN:-gen}"
 
 if uname | grep Linux > /dev/null && 
-       ! ( test -n "$DBUS_SESSION_BUS_ADDRESS" && 
+       ! ( test -n "$DBUS_SESSION_BUS_ADDRESS" ); then
-         test -n "$DBUS_SYSTEM_BUS_ADDRESS" ); then
     dbus_tmp_dir="/run/user/$(id -u)/libreoffice-dbus"
     mkdir "$dbus_tmp_dir"
     dbus_socket_dir="$(mktemp -d -p "$dbus_tmp_dir")"
-    cat "@dbus@/share/dbus-1/system.conf" |
-        grep -v '[<]user[>]messagebus' > "$dbus_socket_dir/system.conf"
-    if test -z "$DBUS_SESSION_BUS_ADDRESS"; then
     "@dbus@"/bin/dbus-daemon --nopidfile --nofork --config-file "@dbus@"/share/dbus-1/session.conf --address "unix:path=$dbus_socket_dir/session"  >&2 &
     export DBUS_SESSION_BUS_ADDRESS="unix:path=$dbus_socket_dir/session"
 fi
-    if test -z "$DBUS_SYSTEM_BUS_ADDRESS"; then
-        "@dbus@"/bin/dbus-daemon --nopidfile --nofork --config-file "$dbus_socket_dir/system.conf" --address "unix:path=$dbus_socket_dir/system" >&2 &
-        export DBUS_SYSTEM_BUS_ADDRESS="unix:path=$dbus_socket_dir/system"
-    fi
-fi
 
 "@libreoffice@/bin/$(basename "$0")" "$@"
 code="$?"

pkgs/applications/office/marp/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "marp-${version}";
-  version = "0.0.11";
+  version = "0.0.12";
 
   src = fetchurl {
     url = "https://github.com/yhatt/marp/releases/download/v${version}/${version}-Marp-linux-x64.tar.gz";
-    sha256 = "06kka6kxrj35w23n34in6ks3vax9arl756jg720jhfy14vavyk0f";
+    sha256 = "0pljjkis9vb819d0akqmqnyakwgnvc3qqyg20yr13xms9a5iqv32";
   };
   sourceRoot = ".";
 

pkgs/applications/science/astronomy/celestia/default.nix

@@ -56,12 +56,10 @@ stdenv.mkDerivation {
     patch -Np1 -i "${gcc47Patch}"
   '';
 
-  configureFlags = "--with-gtk --with-lua=${lua}";
+  configureFlags = [
-  CPPFLAGS = "-DNDEBUG";
+    "--with-gtk"
-  CFLAGS = "-O2 -fsigned-char";
+    "--with-lua=${lua}"
-  CXXFLAGS = "-O2 -fsigned-char";
+  ];
-  GTK_CFLAGS = "-I${gtk2.dev}/include/gtk-2.0 -I${gtk2.out}/lib/gtk-2.0/include -I${glib.dev}/include/glib-2.0 -I${glib.out}/lib/glib-2.0/include -I${cairo.dev}/include/cairo -I${pango.dev}/include/pango-1.0 -I${gdk_pixbuf.dev}/include/gdk-pixbuf-2.0 -I${atk.dev}/include/atk-1.0 -I${gtkglext}/include/gtkglext-1.0 -I${gtkglext}/lib/gtkglext-1.0/include";
-  GTK_LIBS = "-lgtk-x11-2.0 -lgtkglext-x11-1.0 -lcairo -lgdk_pixbuf-2.0 -lpango-1.0 -lgobject-2.0";
 
   installPhase = ''make MKDIR_P="mkdir -p" install'';
 
@@ -69,7 +67,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Free space simulation";
-    homepage = http://www.shatters.net/celestia/;
+    homepage = https://celestia.space/;
     license = stdenv.lib.licenses.gpl2;
 
     platforms = stdenv.lib.platforms.linux;

pkgs/applications/science/logic/elan/default.nix

@@ -2,7 +2,7 @@
 
 rustPlatform.buildRustPackage rec {
   name = "elan-${version}";
-  version = "0.3.0";
+  version = "0.3.2";
 
   cargoSha256 = "01d3s47fjszxx8s5gr3haxq3kz3hswkrkr8x97wx8l4nfhm8ndd2";
 
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage rec {
     owner = "kha";
     repo = "elan";
     rev = "v${version}";
-    sha256 = "116v9v1v5a6fr6h4dgxzwczpy4pbf96cnx6nss6a5y8vbhx9c1mj";
+    sha256 = "13r110382dh7848lpn3mrhc5bgmj373sbpx1326ryx3wl5kfp8rs";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/science/math/maxima/default.nix

@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, sbcl, texinfo, perl, python, makeWrapper, rlwrap ? null,
+{ stdenv, fetchurl, fetchpatch, sbcl, texinfo, perl, python, makeWrapper, rlwrap ? null
-tk ? null, gnuplot ? null, ecl ? null, ecl-fasl ? false
+, tk ? null, gnuplot ? null, ecl ? null, ecl-fasl ? false
 }:
 
 let
@@ -11,6 +11,7 @@ let
       (stdenv.lib.filter (x: x != null) [ sbcl ecl rlwrap tk gnuplot ]);
 in
 stdenv.mkDerivation ({
+  inherit version;
   name = "${name}-${version}";
 
   src = fetchurl {
@@ -18,8 +19,9 @@ stdenv.mkDerivation ({
     sha256 = "0x0n81z0s4pl8nwpf7ivlsbvsdphm9w42250g7qdkizl0132by6s";
   };
 
-  buildInputs = stdenv.lib.filter (x: x != null)
+  buildInputs = stdenv.lib.filter (x: x != null) [
-    [sbcl ecl texinfo perl python makeWrapper];
+    sbcl ecl texinfo perl python makeWrapper
+  ];
 
   postInstall = ''
     # Make sure that maxima can find its runtime dependencies.
@@ -36,6 +38,39 @@ stdenv.mkDerivation ({
    '')
   ;
 
+  patches = [
+    # fix path to info dir (see https://trac.sagemath.org/ticket/11348)
+    (fetchpatch {
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/infodir.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
+      sha256 = "09v64n60f7i6frzryrj0zd056lvdpms3ajky4f9p6kankhbiv21x";
+    })
+
+    # fix https://sourceforge.net/p/maxima/bugs/2596/
+    (fetchpatch {
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/matrixexp.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
+      sha256 = "06961hn66rhjijfvyym21h39wk98sfxhp051da6gz0n9byhwc6zg";
+    })
+
+    # undo https://sourceforge.net/p/maxima/code/ci/f5e9b0f7eb122c4e48ea9df144dd57221e5ea0ca, see see https://trac.sagemath.org/ticket/13364#comment:93
+    (fetchpatch {
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/undoing_true_false_printing_patch.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
+      sha256 = "0fvi3rcjv6743sqsbgdzazy9jb6r1p1yq63zyj9fx42wd1hgf7yx";
+    })
+
+    # upstream bug https://sourceforge.net/p/maxima/bugs/2520/ (not fixed)
+    # introduced in https://trac.sagemath.org/ticket/13364
+    (fetchpatch {
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/0001-taylor2-Avoid-blowing-the-stack-when-diff-expand-isn.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
+      sha256 = "0xa0b6cr458zp7lc7qi0flv5ar0r3ivsqhjl0c3clv86di2y522d";
+    })
+  ] ++ stdenv.lib.optionals ecl-fasl [
+    # build fasl, needed for ECL support
+    (fetchpatch {
+      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/maxima.system.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
+      sha256 = "18zafig8vflhkr80jq2ivk46k92dkszqlyq8cfmj0b2vcfjwwbar";
+    })
+  ];
+
   # Failures in the regression test suite won't abort the build process. We run
   # the suite only so that potential errors show up in the build log. See also:
   # http://sourceforge.net/tracker/?func=detail&aid=3365831&group_id=4933&atid=104933.
@@ -57,10 +92,5 @@ stdenv.mkDerivation ({
 
     platforms = stdenv.lib.platforms.unix;
     maintainers = [ stdenv.lib.maintainers.peti ];
-    broken = ecl != null;
   };
-} // (stdenv.lib.optionalAttrs ecl-fasl {
+})
-  preConfigure = ''
-    sed -e '/c::build-program "binary-ecl\/maxima"/i(c::build-fasl "binary-ecl\/maxima.fasl" :lisp-files obj :ld-flags (let ((x (symbol-value (find-symbol "*AUTOCONF-LD-FLAGS*" (find-package "MAXIMA"))))) (if (and x (not (string= x ""))) (list x))))' -i src/maxima.system
-  '';
-}))

pkgs/applications/science/math/singular/default.nix

@@ -1,23 +1,52 @@
 { stdenv, fetchurl, gmp, bison, perl, autoconf, ncurses, readline, coreutils, pkgconfig
-, asLibsingular ? false
+, autoreconfHook
+, flint
+, ntl
+, cddlib
+, enableFactory ? true
+, enableGfanlib ? true
 }:
 
 stdenv.mkDerivation rec {
-  name = "singular-${version}";
+  name = "singular-${version}${patchVersion}";
-  version="3-1-7";
+  version = "4.1.1";
+  patchVersion = "p1";
 
+  urlVersion = builtins.replaceStrings [ "." ] [ "-" ] version;
   src = fetchurl {
-    url = "http://www.mathematik.uni-kl.de/ftp/pub/Math/Singular/SOURCES/${version}/Singular-${version}.tar.gz";
+    url = "http://www.mathematik.uni-kl.de/ftp/pub/Math/Singular/SOURCES/${urlVersion}/singular-${version}${patchVersion}.tar.gz";
-    sha256 = "1j4mcpnwzdp3h4qspk6ww0m67rmx4s11cy17pvzbpf70lm0jzzh2";
+    sha256 = "0wvgz7l1b7zkpmim0r3mvv4fp8xnhlbz4c7hc90rn30snlansnf1";
   };
 
-  buildInputs = [ gmp perl ncurses readline ];
+  configureFlags = stdenv.lib.optionals enableFactory [
-  nativeBuildInputs = [ autoconf bison pkgconfig ];
+    "--enable-factory"
+  ] ++ stdenv.lib.optionals enableGfanlib [
+    "--enable-gfanlib"
+  ];
+
+  postUnpack = ''
+    patchShebangs .
+  '';
+
+  # For reference (last checked on commit 75f460d):
+  # https://github.com/Singular/Sources/blob/spielwiese/doc/Building-Singular-from-source.md
+  # https://github.com/Singular/Sources/blob/spielwiese/doc/external-packages-dynamic-modules.md
+  buildInputs = [
+    # necessary
+    gmp
+    # by upstream recommended but optional
+    ncurses
+    readline
+    ntl
+    flint
+  ] ++ stdenv.lib.optionals enableGfanlib [
+    cddlib
+  ];
+  nativeBuildInputs = [ autoconf bison perl pkgconfig autoreconfHook ];
 
   preConfigure = ''
     find . -type f -exec sed -e 's@/bin/rm@${coreutils}&@g' -i '{}' ';'
     find . -type f -exec sed -e 's@/bin/uname@${coreutils}&@g' -i '{}' ';'
-    ${stdenv.lib.optionalString asLibsingular ''NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -DLIBSINGULAR"''}
   '';
 
   hardeningDisable = stdenv.lib.optional stdenv.isi686 "stackprotector";
@@ -27,17 +56,21 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p "$out"
-    cp -r Singular/LIB "$out/LIB"
+    cp -r Singular/LIB "$out/lib"
-    make install${stdenv.lib.optionalString asLibsingular "-libsingular"}
+    make install
 
-    binaries="$(find "$out"/* \( -type f -o -type l \) -perm -111 \! -name '*.so' -maxdepth 1)"
+    # Make sure patchelf picks up the right libraries
-    ln -s "$out"/*/{include,lib} "$out"
+    rm -rf libpolys factory resources omalloc Singular
-    mkdir -p "$out/bin"
+  '';
-    for b in $binaries; do
+
-      bbn="$(basename "$b")"
+  # simple test to make sure singular starts and finds its libraries
-      echo -e '#! ${stdenv.shell}\n"'"$b"'" "$@"' > "$out/bin/$bbn"
+  doInstallCheck = true;
-      chmod a+x "$out/bin/$bbn"
+  installCheckPhase = ''
-    done
+    $out/bin/Singular -c 'LIB "freegb.lib"; exit;'
+    if [ $? -ne 0 ]; then
+        echo >&2 "Error loading the freegb library in Singular."
+        exit 1
+    fi
   '';
 
   enableParallelBuilding = true;
@@ -47,7 +80,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ raskin ];
     platforms = subtractLists platforms.i686 platforms.linux;
     license = licenses.gpl3; # Or GPLv2 at your option - but not GPLv4
-    homepage = http://www.singular.uni-kl.de/index.php;
+    homepage = http://www.singular.uni-kl.de;
     downloadPage = "http://www.mathematik.uni-kl.de/ftp/pub/Math/Singular/SOURCES/";
   };
 }

pkgs/applications/version-management/cvs/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nano }:
+{ stdenv, fetchurl, fetchpatch, nano }:
 
 stdenv.mkDerivation {
   name = "cvs-1.12.13";
@@ -12,6 +12,10 @@ stdenv.mkDerivation {
     ./getcwd-chroot.patch
     ./CVE-2012-0804.patch
     ./CVE-2017-12836.patch
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/Homebrew/formula-patches/24118ec737c7/cvs/vasnprintf-high-sierra-fix.diff";
+      sha256 = "1ql6aaia7xkfq3vqhlw5bd2z2ywka82zk01njs1b2szn699liymg";
+    })
   ];
 
   hardeningDisable = [ "fortify" "format" ];

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "2.17.0";
+  version = "2.16.3";
   svn = subversionClient.override { perlBindings = true; };
 in
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "1ismz7nsz8dgjmk782xr9s0mr2qh06f72pdcgbxfmnw1bvlya5p9";
+    sha256 = "0j1dwvg5llnj3g0fp8hdgpms4hp90qw9f6509vqw30dhwplrjpfn";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/version-management/sit/default.nix

@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   name = "sit-${version}";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "sit-it";
     repo = "sit";
     rev = "v${version}";
-    sha256 = "1gcw5fqaqpxl2xgry0w8750g2msrk884zj1slym6r3nj7s2m9j22";
+    sha256 = "1si4fg02wxi35hpkr58na06h19yjw6qd9c5mbb9xfkkzgz5mnssj";
   };
 
-  cargoSha256 = "0hb82j97m8vw8m6gpb6s3bbi31xxv9nqh3aq7hkbmp1pqc02sg3q";
+  cargoSha256 = "083p7z7blj064840ddgnxvqjmih4bmy92clds3qgv5v7lh63wfmn";
 
   meta = with stdenv.lib; {
-    description = "SCM-agnostic, file-based, offline-first, immutable issue tracker";
+    description = "Serverless Information Tracker";
     homepage = http://sit-it.org/;
     license = with licenses; [ asl20 /* or */ mit ];
     maintainers = with maintainers; [ dywedir ];

pkgs/applications/version-management/vcsh/default.nix

@@ -1,30 +1,23 @@
-{ stdenv, fetchpatch, fetchFromGitHub, which, git, ronn, perl, ShellCommand, TestMost }:
+{ stdenv, fetchFromGitHub, which, git, ronn, perl, ShellCommand
+, TestMost, TestDifferences, TestDeep, TestException, TestWarn
+}:
 
 stdenv.mkDerivation rec {
-  version = "1.20170226";       # date of commit we're pulling
+  version = "1.20170915";       # date of commit we're pulling
   name = "vcsh-${version}";
 
   src = fetchFromGitHub {
     owner = "RichiH";
     repo = "vcsh";
-    rev = "36a7cedf196793a6d99f9d3ba2e69805cfff23ab";
+    rev = "eadb8df6aa71a76e5be36492edcadb118bd862ac";
-    sha256 = "16lb28m4k7n796cc1kifyc1ixry4bg69q9wqivjzygdsb77awgln";
+    sha256 = "1wfzp8167lcq6akdpbi8fikjv0z3h1i5minh3423dljc04q0klm1";
   };
 
-  patches =
+  buildInputs = [
-    [
+    which git ronn perl ShellCommand TestMost TestDifferences TestDeep
-      (fetchpatch {
+    TestException TestWarn
-        url = "https://patch-diff.githubusercontent.com/raw/RichiH/vcsh/pull/222.patch";
-        sha256 = "0grdbiwq04x5qj0a1yd9a78g5v28dxhwl6mwxvgvvmzs6k5wnl3k";
-      })
-      (fetchpatch {
-        url = "https://patch-diff.githubusercontent.com/raw/RichiH/vcsh/pull/228.patch";
-        sha256 = "0sdn4mzrhaynw85knia2iw5b6rgy0l1rd6dwh0lwspnh668wqgam";
-      })
   ];
 
-  buildInputs = [ which git ronn perl ShellCommand TestMost ];
-
   installPhase = "make install PREFIX=$out";
 
   meta = with stdenv.lib; {

pkgs/applications/video/avidemux/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, cmake, pkgconfig, lndir
+{ stdenv, lib, fetchurl, fetchpatch, cmake, pkgconfig, lndir
 , zlib, gettext, libvdpau, libva, libXv, sqlite
 , yasm, freetype, fontconfig, fribidi
 , makeWrapper, libXext, libGLU, qttools, qtbase
@@ -32,7 +32,15 @@ stdenv.mkDerivation rec {
     sha256 = "1bf4l9qwxq3smc1mx5pybydc742a4qqsk17z50j9550d9iwnn7gy";
   };
 
-  patches = [ ./dynamic_install_dir.patch ./bootstrap_logging.patch ];
+  patches = [
+    ./dynamic_install_dir.patch
+    ./bootstrap_logging.patch
+    # glibc 2.27 compat
+    (fetchpatch {
+      url = https://github.com/mean00/avidemux2/commit/afdd9c4b876d77a4974d3fa7d9f25caeffbdf13d.patch;
+      sha256 = "0mf8vpfdqybziqsfyvxwcdm3zsmnp64293icinhvfpq9xp5b6vn6";
+    })
+  ];
 
   nativeBuildInputs = [ yasm cmake pkgconfig ];
   buildInputs = [

pkgs/applications/video/handbrake/default.nix

@@ -13,13 +13,13 @@
   python2, pkgconfig, yasm, harfbuzz, zlib,
   autoconf, automake, cmake, libtool, m4, jansson,
   libass, libiconv, libsamplerate, fribidi, libxml2, bzip2,
-  libogg, libopus, libtheora, libvorbis, libdvdcss, a52dec, fdk_aac,
+  libogg, libopus, libtheora, libvorbis, libdvdcss, a52dec,
   lame, ffmpeg, libdvdread, libdvdnav, libbluray,
   mp4v2, mpeg2dec, x264, x265, libmkv,
   fontconfig, freetype, hicolor-icon-theme,
   glib, gtk3, intltool, libnotify,
   gst_all_1, dbus-glib, udev, libgudev, libvpx,
-  useGtk ? true, wrapGAppsHook ? null, libappindicator-gtk3 ? null
+  useGtk ? true, wrapGAppsHook ? null, libappindicator-gtk3 ? null, useFdk ? false, fdk_aac ? null
 }:
 
 stdenv.mkDerivation rec {
@@ -42,13 +42,13 @@ stdenv.mkDerivation rec {
   buildInputs = [
     fribidi fontconfig freetype jansson zlib
     libass libiconv libsamplerate libxml2 bzip2
-    libogg libopus libtheora libvorbis libdvdcss a52dec libmkv fdk_aac
+    libogg libopus libtheora libvorbis libdvdcss a52dec libmkv
     lame ffmpeg libdvdread libdvdnav libbluray mp4v2 mpeg2dec x264 x265 libvpx
   ] ++ (lib.optionals useGtk [
     glib gtk3 libappindicator-gtk3 libnotify
     gst_all_1.gstreamer gst_all_1.gst-plugins-base dbus-glib udev
     libgudev
-  ]);
+  ]) ++ (lib.optionals useFdk [fdk_aac]);
 
   dontUseCmakeConfigure = true;
 
@@ -75,8 +75,8 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-df-fetch"
     "--disable-df-verify"
-    "--enable-fdk-aac"
     (if useGtk then "--disable-gtk-update-checks" else "--disable-gtk")
+    (if useFdk then "--enable-fdk-aac"            else "")
   ];
 
   NIX_LDFLAGS = [

pkgs/applications/video/kazam/bug_1190693.patch

@@ -1,14 +0,0 @@
-=== modified file 'kazam/frontend/indicator.py'
---- a/kazam/frontend/indicator.py	2013-01-26 01:53:53 +0000
-+++ b/kazam/frontend/indicator.py	2013-06-13 18:18:37 +0000
-@@ -291,3 +291,9 @@
-         def start_recording(self):
-             logger.debug("Recording started.")
-             self.indicator.set_from_icon_name("kazam-recording")
-+
-+        def hide_it(self):
-+            self.indicator.set_visible(False)
-+
-+        def show_it(self):
-+            self.indicator.set_visible(True)
-

pkgs/applications/video/kazam/datadir.patch

@@ -1,11 +0,0 @@
---- a/bin/kazam       2014-02-03 23:11:38.465614061 +0100
-+++ b/bin/kazam-1     2014-02-03 23:12:28.447058700 +0100
-@@ -68,7 +68,7 @@
-         # when base install path is not /usr
-         curpath = os.path.abspath(__file__)
-         curpath = os.path.realpath(curpath)
--        datadir = curpath.split('bin/')[0] + "share/kazam/"
-+        datadir = os.path.realpath(os.path.join(curpath, "./../../", "share/kazam/"))
- 
-     try:
-         import platform

pkgs/applications/video/kazam/default.nix

@@ -1,46 +1,41 @@
-{ stdenv, fetchurl, python3Packages, gst_all_1, makeWrapper, gobjectIntrospection
+{ stdenv, fetchurl, substituteAll, python3, gst_all_1, wrapGAppsHook, gobjectIntrospection
-, gtk3, libwnck3, keybinder, intltool, libcanberra-gtk2 }:
+, gtk3, libwnck3, keybinder3, intltool, libcanberra-gtk3, libappindicator-gtk3, libpulseaudio }:
 
-
+python3.pkgs.buildPythonApplication rec {
-python3Packages.buildPythonApplication rec {
   name = "kazam-${version}";
-  version = "1.4.3";
+  version = "1.4.5";
   namePrefix = "";
 
   src = fetchurl {
     url = "https://launchpad.net/kazam/stable/${version}/+download/kazam-${version}.tar.gz";
-    sha256 = "00bcn0yj9xrv87sf6xd3wpilsjgjpsj15zzpjh351ffpjnr0ica8";
+    sha256 = "1qygnrvm6aqixbyivhssp70hs0llxwk7lh3j7idxa2jbkk06hj4f";
   };
 
-  # TODO: keybinder, appindicator3
+  nativeBuildInputs = [ gobjectIntrospection python3.pkgs.distutils_extra intltool wrapGAppsHook ];
-  buildInputs = with python3Packages;
+  buildInputs = [
-    [ pygobject3 pyxdg pycairo gst_all_1.gstreamer gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good gtk3 libwnck3
-      gst_all_1.gst-plugins-good gobjectIntrospection gtk3 libwnck3 distutils_extra
+    keybinder3 libappindicator-gtk3
-      intltool dbus-python ];
+  ];
 
-  # TODO: figure out why PYTHONPATH is not passed automatically for those programs
+  propagatedBuildInputs = with python3.pkgs; [ pygobject3 pyxdg pycairo dbus-python ];
-  pythonPath = with python3Packages;
-    [ pygobject3 pyxdg pycairo dbus-python ];
 
-  patches = [ ./datadir.patch ./bug_1190693.patch ];
+  patches = [
-  prePatch = ''
+    # Fix paths
-    rm setup.cfg
+    (substituteAll {
-    substituteInPlace kazam/backend/grabber.py --replace "/usr/bin/canberra-gtk-play" "${libcanberra-gtk2}/bin/canberra-gtk-play"
+      src = ./fix-paths.patch;
-  '';
+      libcanberra = libcanberra-gtk3;
+      inherit libpulseaudio;
+    })
+    # Fix compability with Python 3.4
+    (fetchurl {
+      url = https://sources.debian.org/data/main/k/kazam/1.4.5-2/debian/patches/configparser_api_changes.patch;
+      sha256 = "0yvmipnh98s7y07cp1f113l0qqfw65k13an96byq707z3ymv1c2h";
+    })
+  ];
 
   # no tests
   doCheck = false;
 
-  preFixup = ''
-    wrapProgram $out/bin/kazam \
-      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --prefix LD_LIBRARY_PATH ":" "${stdenv.lib.makeLibraryPath [ gtk3 gst_all_1.gstreamer keybinder ]}" \
-      --prefix GST_PLUGIN_SYSTEM_PATH : "$GST_PLUGIN_SYSTEM_PATH" \
-      --prefix XDG_DATA_DIRS : "${gtk3.out}/share" \
-      --set GST_REGISTRY "/tmp/kazam.gstreamer.registry";
-  '';
-
-
   meta = with stdenv.lib; {
     description = "A screencasting program created with design in mind";
     homepage = https://code.launchpad.net/kazam;

pkgs/applications/video/kazam/fix-paths.patch

@@ -0,0 +1,22 @@
+--- a/kazam/backend/grabber.py
++++ b/kazam/backend/grabber.py
+@@ -72,7 +72,7 @@
+         #
+         if prefs.shutter_sound and (not self.god):
+             soundfile = os.path.join(prefs.datadir, 'sounds', prefs.sound_files[prefs.shutter_type])
+-            subprocess.call(['/usr/bin/canberra-gtk-play', '-f', soundfile])
++            subprocess.call(['@libcanberra@/bin/canberra-gtk-play', '-f', soundfile])
+ 
+         if self.xid:
+             if prefs.capture_borders_pic:
+--- a/kazam/pulseaudio/ctypes_pulseaudio.py
++++ b/kazam/pulseaudio/ctypes_pulseaudio.py
+@@ -20,7 +20,7 @@
+ #       MA 02110-1301, USA.
+ 
+ from ctypes import *
+-PA = CDLL('libpulse.so.0')
++PA = CDLL('@libpulseaudio@/lib/libpulse.so.0')
+ 
+ #
+ # Pulse Audio constants and defines

pkgs/applications/virtualization/xen/4.8.nix

@@ -41,6 +41,12 @@ let
     sha256 = "1ki295pymbcfc64sjb9wqfwpv19p8vwgmnxankada3vm4fxg2rhq";
   });
 
+  qemuMemfdBuildFix = fetchpatch {
+    name = "xen-4.8-memfd-build-fix.patch";
+    url = https://github.com/qemu/qemu/commit/75e5b70e6b5dcc4f2219992d7cffa462aa406af0.patch;
+    sha256 = "0gaz93kb33qc0jx6iphvny0yrd17i8zhcl3a9ky5ylc2idz0wiwa";
+  };
+
   qemuDeps = [
     udev pciutils xorg.libX11 SDL pixman acl glusterfs spice-protocol usbredir
     alsaLib
@@ -63,6 +69,9 @@ callPackage (import ./generic.nix (rec {
         rev = "refs/tags/qemu-xen-${version}";
         sha256 = "0lb7zd5nvr6znx47z93nbq4gj8xfb3622s8r2cvmpqmwnmlc3nd4";
       };
+      patches = [
+        qemuMemfdBuildFix
+      ];
       buildInputs = qemuDeps;
       meta.description = "Xen's fork of upstream Qemu";
     };

pkgs/applications/window-managers/sway/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   name = "sway-${version}";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "sway";
     rev = version;
-    sha256 = "00prns3dnafd19ap774p8v994i3p185ji0dnp2xxbkgh2z7sbwpi";
+    sha256 = "1p9j5gv85lsgj4z28qja07dqyvqk41w6mlaflvvm9yxafx477g5n";
   };
 
   nativeBuildInputs = [

pkgs/build-support/bintools-wrapper/macos-sierra-reexport-hack.bash

@@ -2,107 +2,245 @@
 
 set -eu -o pipefail
 
+# For cmd | while read; do ...; done
+shopt -s lastpipe
+
 path_backup="$PATH"
 if [ -n "@coreutils_bin@" ]; then
   PATH="@coreutils_bin@/bin"
 fi
 
-declare -r recurThreshold=300
+declare -ri recurThreshold=200
+declare -i overflowCount=0
 
-declare overflowCount=0
+declare -ar origArgs=("$@")
-for ((n=0; n < $#; ++n)); do
-    case "${!n}" in
-        -l*) let overflowCount+=1 ;;
-        -reexport-l*) let overflowCount+=1 ;;
-        *) ;;
-    esac
-done
 
-declare -a allArgs=()
+# Throw away what we won't need
-
+declare -a parentArgs=()
-if (( "$overflowCount" <= "$recurThreshold" )); then
-    allArgs=("$@")
-else
-    declare -a childrenLookup=() childrenLink=()
 
 while (( $# )); do
     case "$1" in
-            -L/*)
-                childrenLookup+=("$1")
-                allArgs+=("$1")
-                ;;
-            -L)
-                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
-                exit 1
-                ;;
         -l)
-                echo "cctools LD does not support '-L foo' or '-l foo'" >&2
+            echo "cctools LD does not support '-l foo'" >&2
             exit 1
             ;;
-            -lazy_library | -lazy_framework | -lto_library)
+        -lazy_library | -reexport_library | -upward_library | -weak_library)
-                # We aren't linking any "azy_library", "to_library", etc.
+            overflowCount+=1
-                allArgs+=("$1")
+            shift 2
             ;;
-            -lazy-l | -weak-l)    allArgs+=("$1") ;;
+        -l* | *.so.* | *.dylib | -lazy-l* | -reexport-l* | -upward-l* | -weak-l*)
-                # We can't so easily prevent header issues from these.
+            overflowCount+=1
-            -lSystem)             allArgs+=("$1") ;;
+            shift 1
-                # Special case as indirection seems like a bad idea for something
+            ;;
-                # so fundamental. Can be removed for simplicity.
+        *.a | *.o)
-            -l?* | -reexport-l?*) childrenLink+=("$1") ;;
+            shift 1
-            *)                    allArgs+=("$1") ;;
+            ;;
-        esac
+        -L | -F)
-
+            # Evidentally ld doesn't like using the child's RPATH, so it still
-        shift
+            # needs these.
-    done
+            parentArgs+=("$1" "$2")
-
+            shift 2
-    declare n=0
+            ;;
-    while (( $n < "${#childrenLink[@]}" )); do
+        -L?* | -F?*)
-        if [[ "${childrenLink[n]}" = -l* ]]; then
+            parentArgs+=("$1")
-            childrenLink[n]="-reexport${childrenLink[n]}"
+            shift 1
+            ;;
+        -o)
+            outputName="$2"
+            parentArgs+=("$1" "$2")
+            shift 2
+            ;;
+        -install_name | -dylib_install_name | -dynamic-linker | -plugin)
+            parentArgs+=("$1" "$2")
+            shift 2
+            ;;
+        -rpath)
+            # Only an rpath to the child is needed, which we will add
+            shift 2
+            ;;
+        *)
+            if [[ -f "$1" ]]; then
+                # Propabably a non-standard object file like Haskell's
+                # `.dyn_o`. Skip it like other inputs
+                :
+            else
+                parentArgs+=("$1")
             fi
-        let ++n
+            shift 1
+            ;;
+    esac
 done
-    unset n
 
-    declare -r outputNameLibless=$(basename $( \
+
+
+if (( "$overflowCount" <= "$recurThreshold" )); then
+    if [ -n "${NIX_DEBUG:-}" ]; then
+        echo "ld-wrapper: Only ${overflowCount} inputs counted while ${recurThreshold} is the ceiling, linking normally. " >&2
+    fi
+    PATH="$path_backup"
+    exec @prog@ "${origArgs[@]}"
+fi
+
+
+
+if [ -n "${NIX_DEBUG:-}" ]; then
+    echo "ld-wrapper: ${overflowCount} inputs counted when ${recurThreshold} is the ceiling, inspecting further. " >&2
+fi
+
+# Collect the normalized linker input
+declare -a norm=()
+
+# Arguments are null-separated
+@prog@ --dump-normalized-lib-args "${origArgs[@]}" |
+    while IFS= read -r -d '' input; do
+        norm+=("$input")
+    done
+
+declare -i leafCount=0
+declare lastLeaf=''
+declare -a childrenInputs=() trailingInputs=()
+while (( "${#norm[@]}" )); do
+    case "${norm[0]}" in
+        -lazy_library | -upward_library)
+            # TODO(@Ericson2314): Don't do that, but intersperse children
+            # between such args.
+            echo "ld-wrapper: Warning: Potentially changing link order" >&2
+            trailingInputs+=("${norm[0]}" "${norm[1]}")
+            norm=("${norm[@]:2}")
+            ;;
+        -reexport_library | -weak_library)
+            childrenInputs+=("${norm[0]}" "${norm[1]}")
+            if [[ "${norm[1]}" != "$lastLeaf" ]]; then
+                leafCount+=1
+                lastLeaf="${norm[1]}"
+            fi
+            norm=("${norm[@]:2}")
+            ;;
+        *.so | *.dylib)
+            childrenInputs+=(-reexport_library "${norm[0]}")
+            if [[ "${norm[0]}" != "$lastLeaf" ]]; then
+                leafCount+=1
+                lastLeaf="${norm[0]}"
+            fi
+            norm=("${norm[@]:1}")
+            ;;
+        *.o | *.a)
+            # Don't delegate object files or static libs
+            parentArgs+=("${norm[0]}")
+            norm=("${norm[@]:1}")
+            ;;
+        *)
+            if [[ -f "${norm[0]}" ]]; then
+                # Propabably a non-standard object file. We'll let it by.
+                parentArgs+=("${norm[0]}")
+                norm=("${norm[@]:1}")
+            else
+                echo "ld-wrapper: Internal Error: Invalid normalized argument" >&2
+                exit -1
+            fi
+            ;;
+    esac
+done
+
+
+
+if (( "$leafCount" <= "$recurThreshold" )); then
+    if [ -n "${NIX_DEBUG:-}" ]; then
+        echo "ld-wrapper: Only ${leafCount} *dynamic* inputs counted while ${recurThreshold} is the ceiling, linking normally. " >&2
+    fi
+    PATH="$path_backup"
+    exec @prog@ "${origArgs[@]}"
+fi
+
+
+
+if [ -n "${NIX_DEBUG:-}" ]; then
+    echo "ld-wrapper: ${leafCount} *dynamic* inputs counted when ${recurThreshold} is the ceiling, delegating to children. " >&2
+fi
+
+declare -r outputNameLibless=$( \
     if [[ -z "${outputName:+isUndefined}" ]]; then
         echo unnamed
-        elif [[ "${outputName:0:3}" = lib ]]; then
+        return 0;
-            echo "${outputName:3}"
+    fi
-        else
+    baseName=$(basename ${outputName})
-            echo "${outputName}"
+    if [[ "$baseName" = lib* ]]; then
-        fi))
+        baseName="${baseName:3}"
-    declare -ra children=("$outputNameLibless-reexport-delegate-0" \
+    fi
-                          "$outputNameLibless-reexport-delegate-1")
+    echo "$baseName")
+
+declare -ra children=(
+    "$outputNameLibless-reexport-delegate-0"
+    "$outputNameLibless-reexport-delegate-1"
+)
 
 mkdir -p "$out/lib"
 
-    PATH="$PATH:@out@/bin"
-
 symbolBloatObject=$outputNameLibless-symbol-hack.o
-    if [[ ! -e $symbolBloatObject ]]; then
+if [[ ! -f $symbolBloatObject ]]; then
     # `-Q` means use GNU Assembler rather than Clang, avoiding an awkward
     # dependency cycle.
-        printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' \
+    printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' |
-            | @targetPrefix@as -Q -- -o $symbolBloatObject
+        PATH="$PATH:@out@/bin" @targetPrefix@as -Q -- -o $symbolBloatObject
 fi
 
-    # first half of libs
+# Split inputs between children
-    @targetPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+declare -a child0Inputs=() child1Inputs=("${childrenInputs[@]}")
+let "countFirstChild = $leafCount / 2" || true
+lastLeaf=''
+while (( "$countFirstChild" )); do
+    case "${child1Inputs[0]}" in
+        -reexport_library | -weak_library)
+            child0Inputs+=("${child1Inputs[0]}" "${child1Inputs[1]}")
+            if [[ "${child1Inputs[1]}" != "$lastLeaf" ]]; then
+                let countFirstChild-=1 || true
+                lastLeaf="${child1Inputs[1]}"
+            fi
+            child1Inputs=("${child1Inputs[@]:2}")
+            ;;
+        *.so | *.dylib)
+            child0Inputs+=(-reexport_library "${child1Inputs[0]}")
+            if [[ "${child1Inputs[0]}" != "$lastLeaf" ]]; then
+                let countFirstChild-=1 || true
+                lastLeaf="${child1Inputs[1]}"
+            fi
+            child1Inputs=("${child1Inputs[@]:2}")
+            ;;
+        *)
+            echo "ld-wrapper: Internal Error: Invalid delegated input" >&2
+            exit -1
+            ;;
+    esac
+done
+
+
+# First half of libs
+@out@/bin/@targetPrefix@ld \
+  -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
   -o "$out/lib/lib${children[0]}.dylib" \
   -install_name "$out/lib/lib${children[0]}.dylib" \
-      "${childrenLookup[@]}" "$symbolBloatObject" \
+  "$symbolBloatObject" "${child0Inputs[@]}" "${trailingInputs[@]}"
-      "${childrenLink[@]:0:$((${#childrenLink[@]} / 2 ))}"
 
-    # second half of libs
+# Second half of libs
-    @targetPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
+@out@/bin/@targetPrefix@ld \
+  -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
   -o "$out/lib/lib${children[1]}.dylib" \
   -install_name "$out/lib/lib${children[1]}.dylib" \
-      "${childrenLookup[@]}" "$symbolBloatObject" \
+  "$symbolBloatObject" "${child1Inputs[@]}" "${trailingInputs[@]}"
-      "${childrenLink[@]:$((${#childrenLink[@]} / 2 ))}"
 
-    allArgs+=("-L$out/lib" "-l${children[0]}" "-l${children[1]}")
+parentArgs+=("-L$out/lib" -rpath "$out/lib")
+if [[ $outputName != *reexport-delegate* ]]; then
+	parentArgs+=("-l${children[0]}" "-l${children[1]}")
+else
+    parentArgs+=("-reexport-l${children[0]}" "-reexport-l${children[1]}")
+fi
+
+parentArgs+=("${trailingInputs[@]}")
+
+if [ -n "${NIX_DEBUG:-}" ]; then
+    echo "flags using delegated children to @prog@:" >&2
+    printf "  %q\n" "${parentArgs[@]}" >&2
 fi
 
 PATH="$path_backup"
-exec @prog@ "${allArgs[@]}"
+exec @prog@ "${parentArgs[@]}"

pkgs/build-support/build-setupcfg/default.nix

@@ -5,18 +5,20 @@
 # * meta: Standard nixpkgs metadata.
 # * application: Whether this package is a python library or an
 #   application which happens to be written in python.
-pythonPackages: { src, info, meta ? {}, application ? false }: let
+# * doCheck: Whether to run the test suites.
+pythonPackages:
+{ src, info, meta ? {}, application ? false, doCheck ? true }: let
   build = if application
     then pythonPackages.buildPythonApplication
   else pythonPackages.buildPythonPackage;
 in build {
   inherit (info) pname version;
 
-  inherit src meta;
+  inherit src meta doCheck;
 
   nativeBuildInputs = map (p: pythonPackages.${p}) (
     (info.setup_requires or []) ++
-    (info.tests_require or []));
+    (if doCheck then (info.tests_require or []) else []));
 
   propagatedBuildInputs = map (p: pythonPackages.${p})
     (info.install_requires or []);

pkgs/build-support/kernel/modules-closure.sh

@@ -1,5 +1,19 @@
 source $stdenv/setup
 
+# When no modules are built, the $out/lib/modules directory will not
+# exist. Because the rest of the script assumes it does exist, we
+# handle this special case first.
+if ! test -d "$kernel/lib/modules"; then
+    if test -z "$rootModules" || test -n "$allowMissing"; then
+        mkdir -p "$out"
+        exit 0
+    else
+        echo "Required modules: $rootModules"
+        echo "Can not derive a closure of kernel modules because no modules were provided."
+        exit 1
+    fi
+fi
+
 version=$(cd $kernel/lib/modules && ls -d *)
 
 echo "kernel version is $version"

pkgs/build-support/trivial-builders.nix

@@ -170,6 +170,7 @@ rec {
         ***
 
         _EOF_
+        exit 1
       '';
     };
 

pkgs/data/icons/papirus-icon-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "papirus-icon-theme-${version}";
-  version = "20180214";
+  version = "20180401";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "papirus-icon-theme";
     rev = version;
-    sha256 = "0lsp5cmq5wdqw6vyh6hqqrshgpzxfj8dx87l7qdlgrk73dajjmki";
+    sha256 = "1cbzv3igc6j05h0mq2850fwfd8sxxwixzgmhh85mc1k326rvncil";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/desktops/gnome-2/platform/gtkglext/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, gtk, libGLU_combined, pango, pangox_compat, xorg }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, glib, gtk, libGLU_combined, pango, pangox_compat, xorg }:
 
 stdenv.mkDerivation rec {
   name = "gtkglext-1.2.0";
@@ -12,9 +12,20 @@ stdenv.mkDerivation rec {
     [ pkgconfig glib gtk libGLU_combined pango libX11 libXmu ];
   propagatedBuildInputs = [ pangox_compat ];
 
+  patches = [
     # The library uses `GTK_WIDGET_REALIZED', `GTK_WIDGET_TOPLEVEL', and
     # `GTK_WIDGET_NO_WINDOW', all of which appear to be deprecated nowadays.
-  CPPFLAGS = "-UGTK_DISABLE_DEPRECATED";
+    (fetchpatch {
+      name = "02_fix_gtk-2.20_deprecated_symbols.diff";
+      url = https://git.gnome.org/browse/gtkglext/patch/?id=d8f285d1397f6c41099c67e668288eecc1cdae67;
+      sha256 = "1zxak73plhy3m6psil1q9ssvjh9aqrif7kcbcz69y480qfb4ja08";
+    })
+    # Fix build with glibc ≥ 2.27
+    (fetchurl {
+      url = https://salsa.debian.org/gewo/gtkglext/raw/3b002677c907890c7de002c9f5b4b3ec71d11b31/debian/patches/04_glibc2.27-ftbfs.diff;
+      sha256 = "1l1swkjkai6pnah23xfsfpbq2fgbhp5pzj3l0ybsx6b858cxqzj5";
+    })
+  ];
 
   meta = with stdenv.lib; {
     homepage = https://projects.gnome.org/gtkglext/;

pkgs/desktops/gnome-3/apps/bijiben/default.nix

@@ -5,13 +5,13 @@
 , gnome3, libxml2 }:
 
 let
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
   name = "bijiben-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/bijiben/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "047w8kigrdmphd17dma2lldf6r60sgx3zybai9bz9yr0hm601kr6";
+    sha256 = "0ivx3hbpg7qaqzpbbn06lz9w3q285vhwgfr353b14bg0nsidwy17";
   };
 
   doCheck = true;

pkgs/desktops/gnome-3/apps/evolution/default.nix

@@ -5,13 +5,13 @@
 , libcanberra-gtk3, bogofilter, gst_all_1, procps, p11-kit, openldap }:
 
 let
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
   name = "evolution-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0b6yw664jdfc8ppd78akmrl36iximh7ipknf5mlzgga6lr6pl2nf";
+    sha256 = "0sdv5lg2vlz5f4raymz9d8a5jq4j18vbqyigaip6508p3bjnfj8l";
   };
 
   propagatedUserEnvPkgs = [ gnome3.evolution-data-server ];

pkgs/desktops/gnome-3/apps/gedit/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "gedit-${version}";
-  version = "3.28.0";
+  version = "3.28.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gedit/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0pyam0zi44xq776x20ycqnvmf86l98jns8ldv4m81gnp9wnhmycv";
+    sha256 = "0791r07d3ixmmfk68lvhp3d5i4vnlrnx10csxwgpfqyfb04vwx7i";
   };
 
   nativeBuildInputs = [ pkgconfig wrapGAppsHook intltool itstool libxml2 ];

pkgs/desktops/gnome-3/apps/glade/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "glade-${version}";
-  version = "3.22.0";
+  version = "3.22.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glade/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1j7kpy4jisz4nkd3yb5af4vd4bapyqchvp2gvq6ypfw3b0x88rkc";
+    sha256 = "16p38xavpid51qfy0s26n0n21f9ws1w9k5s65bzh1w7ay8p9my6z";
   };
 
   passthru = {

pkgs/desktops/gnome-3/apps/gnome-boxes/default.nix

@@ -9,13 +9,13 @@
 # TODO: ovirt (optional)
 
 let
-  version = "3.27.92";
+  version = "3.28.2";
 in stdenv.mkDerivation rec {
   name = "gnome-boxes-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-boxes/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1v1br4zh2w3w70np5imi31md6lnqamabiin521f806rdrxsnyggq";
+    sha256 = "0xss6wrs4hkmr0aa9qxr9b6wxbygrkjz4p0c4xnymicq97jnwra1";
   };
 
   doCheck = true;

pkgs/desktops/gnome-3/apps/gnome-calendar/default.nix

@@ -4,13 +4,13 @@
 
 let
   pname = "gnome-calendar";
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1y5d6rgw7j5hy147i3ff73q9kkwj3nbyms7j705nfhri3s1ypqgs";
+    sha256 = "1jacznnjql5jgzvzcp5kh2k0cd0y41cri6qz2bsakpllf7adbrq6";
   };
 
   passthru = {

pkgs/desktops/gnome-3/apps/gnome-getting-started-docs/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-getting-started-docs-${version}";
-  version = "3.28.0";
+  version = "3.28.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-getting-started-docs/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "09khgzrbvcqvgjkqh8rp609bx818v5c8gzq61nxy5582s8habg8g";
+    sha256 = "0x60aava6ba4xliy4p4i6jm5d2nq8hx9aqgnaw4d34fvmcpcy5w0";
   };
 
   passthru = {

pkgs/desktops/gnome-3/apps/gnome-maps/default.nix

@@ -5,13 +5,13 @@
 
 let
   pname = "gnome-maps";
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1imcgw67cw1qkfz8m2my0f4qmss11fbqqqi4w7afcfq9p0rplgy0";
+    sha256 = "19xx1v25ycr8ih4jwb1vc662jcx6kynaf7baj4i569ccrcwaj2d5";
   };
 
   doCheck = true;

pkgs/desktops/gnome-3/apps/gnome-music/default.nix

@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gnome-music";
-  version = "3.28.0.1";
+  version = "3.28.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${pname}-${version}.tar.xz";
-    sha256 = "0yyysmxwmk167n8wghcbmxz73kgl1y1j9js3mgkjjqsmkd9brk65";
+    sha256 = "0xbwndfl72292dx4x99vm0iyrcy8xw2i5fhsch7b073rk4ydbyfx";
   };
 
   nativeBuildInputs = [ meson ninja gettext itstool pkgconfig libxml2 wrapGAppsHook desktop-file-utils appstream-glib gobjectIntrospection ];

pkgs/desktops/gnome-3/core/eog/default.nix

@@ -4,13 +4,13 @@
 
 let
   pname = "eog";
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0d8fi5ydsh8n7d85dps8svl1bhid1p8jbnlwiqywj2gd2wpxpyjv";
+    sha256 = "1v3s4x4xdmfa488drwvxfps33jiyh3qz9z8v8s3779n1jn92rmbq";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig gettext itstool wrapGAppsHook libxml2 gobjectIntrospection ];

pkgs/desktops/gnome-3/core/epiphany/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "epiphany-${version}";
-  version = "3.28.0.1";
+  version = "3.28.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "023q6xnwsafac38lavxwgph5lcd2igxpiwqb4kr72mv56xlb0m3i";
+    sha256 = "0zvxrwlswxadq4zbr4f73ms141d08j0lhi6rzmj83j1s3gan88md";
   };
 
   # Tests need an X display

pkgs/desktops/gnome-3/core/evince/default.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   name = "evince-${version}";
-  version = "3.28.0";
+  version = "3.28.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1a3kcls18dcz1lj8hrx8skcli9xxfyi71c17xjwayh71cm5jc8zs";
+    sha256 = "1qbk1x2c7iacmmfwjzh136v2sdacrkqn9d6bnqid7xn9hlnx4m89";
   };
 
   passthru = {

pkgs/desktops/gnome-3/core/evolution-data-server/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "evolution-data-server-${version}";
-  version = "3.28.0";
+  version = "3.28.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1ybyyy6nls11az8lbri1y9527snz5h7qbhyfqvk0vc6vzvald5gv";
+    sha256 = "12b9lfgwd57rzn9394xrbvl9ym5aqldpz9v7c9a421dsv8dgq13b";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome-3/core/gdm/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "gdm-${version}";
-  version = "3.28.0";
+  version = "3.28.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdm/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "0i5rzr6fdvlm88gl85gvql1wf1yflkmg90x81dqjf39as3ixs81s";
+    sha256 = "1yxjjyrp0ywrc25cp81bsdhp79zn0c0jag48hlp00b5wfnkqy1kp";
   };
 
   passthru = {

pkgs/desktops/gnome-3/core/gjs/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "gjs-${version}";
-  version = "1.52.0";
+  version = "1.52.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1jm40imin4sxzfcxcbmf4v71apk8y9icccq1a4m4mlz1wm2s092m";
+    sha256 = "1s1m8xv3ixgl0hah3r364ws249d6w8yn56q2ahfn3dg2j54rmz58";
   };
 
   passthru = {

pkgs/desktops/gnome-3/core/gnome-calculator/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-calculator-${version}";
-  version = "3.28.0";
+  version = "3.28.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-calculator/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1qnfvmf615v52c8h1f6zxbvpywi3512hnzyf9azvxb8a6q0rx1vn";
+    sha256 = "05zpdp9mkfjz22hs7hfjikkxhzmvy02mxrldrjxsv8ff17w9xvic";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome-3/core/gnome-contacts/default.nix

@@ -5,13 +5,13 @@
 , vala, meson, ninja }:
 
 let
-  version = "3.28.0";
+  version = "3.28.1";
 in stdenv.mkDerivation rec {
   name = "gnome-contacts-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-contacts/${gnome3.versionBranch version}/${name}.tar.xz";
-    sha256 = "1qqj6k5rvmvg6v6vg4cak98w6rqknpqfsm0vfrwva6l6wbql2v8i";
+    sha256 = "17iinxqf221kk9yppv3yhg0m7jxk5zvwxmdf3hjygf9xgfw7z3zi";
   };
 
   propagatedUserEnvPkgs = [ evolution-data-server ];