Merge remote-tracking branch 'upstream/master' into HEAD

.github/CONTRIBUTING.md

@@ -15,7 +15,7 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
 * Format the commits in the following way:
 
   ```
-  (pkg-name | service-name): (from -> to | init at version | refactor | etc)
+  (pkg-name | nixos/<module>): (from -> to | init at version | refactor | etc)
   
   (Motivation for change. Additional information.)
   ```
@@ -24,10 +24,10 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
 
   * nginx: init at 2.0.1
   * firefox: 3.0 -> 3.1.1
-  * hydra service: add bazBaz option
+  * nixos/hydra: add bazBaz option
   
     Dual baz behavior is needed to do foo.
-  * nginx service: refactor config generation
+  * nixos/nginx: refactor config generation
     
     The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,6 +3,8 @@
 
 ###### Things done
 
+Please check what applies. Note that these are not hard requirements but mereley serve as information for reviewers.
+
 - [ ] Tested using sandboxing
   ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS,
     or option `build-use-sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file)

README.md

@@ -38,5 +38,5 @@ For pull-requests, please rebase onto nixpkgs `master`.
 
 Communication:
 
-* [Mailing list](http://lists.science.uu.nl/mailman/listinfo/nix-dev)
+* [Mailing list](https://groups.google.com/forum/#!forum/nix-devel)
 * [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)

doc/languages-frameworks/haskell.md

@@ -912,14 +912,14 @@ nix-build -A haskell.packages.integer-simple.ghc802.scientific
   - The *Journey into the Haskell NG infrastructure* series of postings
     describe the new Haskell infrastructure in great detail:
 
-      - [Part 1](http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015591.html)
+      - [Part 1](https://nixos.org/nix-dev/2015-January/015591.html)
         explains the differences between the old and the new code and gives
         instructions how to migrate to the new setup.
 
-      - [Part 2](http://lists.science.uu.nl/pipermail/nix-dev/2015-January/015608.html)
+      - [Part 2](https://nixos.org/nix-dev/2015-January/015608.html)
         looks in-depth at how to tweak and configure your setup by means of
         overrides.
 
-      - [Part 3](http://lists.science.uu.nl/pipermail/nix-dev/2015-April/016912.html)
+      - [Part 3](https://nixos.org/nix-dev/2015-April/016912.html)
         describes the infrastructure that keeps the Haskell package set in Nixpkgs
         up-to-date.

doc/quick-start.xml

@@ -212,7 +212,7 @@ $ nix-env -f . -iA libfoo</screen>
 
   <listitem>
     <para>Optionally commit the new package and open a pull request, or send a patch to
-    <literal>nix-dev@cs.uu.nl</literal>.</para>
+    <literal>https://groups.google.com/forum/#!forum/nix-devel</literal>.</para>
   </listitem>
 
 

lib/maintainers.nix

@@ -172,6 +172,7 @@
   ekleog = "Leo Gaspard <leo@gaspard.io>";
   elasticdog = "Aaron Bull Schaefer <aaron@elasticdog.com>";
   eleanor = "Dejan Lukan <dejan@proteansec.com>";
+  elijahcaine = "Elijah Caine <elijahcainemv@gmail.com>";
   elitak = "Eric Litak <elitak@gmail.com>";
   ellis = "Ellis Whitehead <nixos@ellisw.net>";
   eperuffo = "Emanuele Peruffo <info@emanueleperuffo.com>";
@@ -565,6 +566,7 @@
   tohl = "Tomas Hlavaty <tom@logand.com>";
   tokudan = "Daniel Frank <git@danielfrank.net>";
   tomberek = "Thomas Bereknyei <tomberek@gmail.com>";
+  tomsmeets = "Tom Smeets <tom@tsmeets.nl>";
   travisbhartwell = "Travis B. Hartwell <nafai@travishartwell.net>";
   trevorj = "Trevor Joynson <nix@trevor.joynson.io>";
   trino = "Hubert Mühlhans <muehlhans.hubert@ekodia.de>";

nixos/doc/manual/manual.xml

@@ -18,7 +18,7 @@
 
     <para>If you encounter problems, please report them on the
     <literal
-    xlink:href="http://lists.science.uu.nl/mailman/listinfo/nix-dev">nix-dev@lists.science.uu.nl</literal>
+    xlink:href="https://groups.google.com/forum/#!forum/nix-devel">nix-devel</literal>
     mailing list or on the <link
     xlink:href="irc://irc.freenode.net/#nixos">
     <literal>#nixos</literal> channel on Freenode</link>.  Bugs should

nixos/doc/manual/release-notes/rl-1509.xml

@@ -28,7 +28,7 @@ has the following highlights:</para>
     since version 0.0 as well as the most recent <link
     xlink:href="http://www.stackage.org/">Stackage Nightly</link>
     snapshot. The announcement <link
-    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2015-September/018138.html">&quot;Full
+    xlink:href="https://nixos.org/nix-dev/2015-September/018138.html">&quot;Full
     Stackage Support in Nixpkgs&quot;</link> gives additional
     details.</para>
   </listitem>

nixos/doc/manual/release-notes/rl-1609.xml

@@ -78,13 +78,13 @@ following incompatible changes:</para>
     our package set it loosely based on the latest available LTS release, i.e.
     LTS 7.x at the time of this writing. New releases of NixOS and Nixpkgs will
     drop those old names entirely. <link
-    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2016-June/020585.html">The
+    xlink:href="https://nixos.org/nix-dev/2016-June/020585.html">The
     motivation for this change</link> has been discussed at length on the
     <literal>nix-dev</literal> mailing list and in <link
     xlink:href="https://github.com/NixOS/nixpkgs/issues/14897">Github issue
     #14897</link>. Development strategies for Haskell hackers who want to rely
     on Nix and NixOS have been described in <link
-    xlink:href="http://lists.science.uu.nl/pipermail/nix-dev/2016-June/020642.html">another
+    xlink:href="https://nixos.org/nix-dev/2016-June/020642.html">another
     nix-dev article</link>.</para>
   </listitem>
 

nixos/modules/config/ldap.nix

@@ -19,7 +19,6 @@ let
       bind_policy ${config.users.ldap.bind.policy}
       ${optionalString config.users.ldap.useTLS ''
         ssl start_tls
-        tls_checkpeer no
       ''}
       ${optionalString (config.users.ldap.bind.distinguishedName != "") ''
         binddn ${config.users.ldap.bind.distinguishedName}

nixos/modules/module-list.nix

@@ -287,6 +287,7 @@
   ./services/misc/emby.nix
   ./services/misc/errbot.nix
   ./services/misc/etcd.nix
+  ./services/misc/exhibitor.nix
   ./services/misc/felix.nix
   ./services/misc/folding-at-home.nix
   ./services/misc/fstrim.nix
@@ -567,6 +568,7 @@
   ./services/system/earlyoom.nix
   ./services/system/kerberos.nix
   ./services/system/nscd.nix
+  ./services/system/saslauthd.nix
   ./services/system/uptimed.nix
   ./services/torrent/deluge.nix
   ./services/torrent/flexget.nix

nixos/modules/programs/zsh/oh-my-zsh.nix

@@ -15,6 +15,16 @@ in
           '';
         };
 
+        package = mkOption {
+          default = pkgs.oh-my-zsh;
+          defaultText = "pkgs.oh-my-zsh";
+          description = ''
+            Package to install for `oh-my-zsh` usage.
+          '';
+
+          type = types.package;
+        };
+
         plugins = mkOption {
           default = [];
           type = types.listOf(types.str);
@@ -46,11 +56,11 @@ in
       # Prevent zsh from overwriting oh-my-zsh's prompt
       programs.zsh.promptInit = mkDefault "";
 
-      environment.systemPackages = with pkgs; [ oh-my-zsh ];
+      environment.systemPackages = [ cfg.package ];
 
-      programs.zsh.interactiveShellInit = with pkgs; with builtins; ''
+      programs.zsh.interactiveShellInit = with builtins; ''
         # oh-my-zsh configuration generated by NixOS
-        export ZSH=${oh-my-zsh}/share/oh-my-zsh
+        export ZSH=${cfg.package}/share/oh-my-zsh
 
         ${optionalString (length(cfg.plugins) > 0)
           "plugins=(${concatStringsSep " " cfg.plugins})"

nixos/modules/services/games/factorio.nix

@@ -39,7 +39,7 @@ let
     admins = [];
   };
   serverSettingsFile = pkgs.writeText "server-settings.json" (builtins.toJSON (filterAttrsRecursive (n: v: v != null) serverSettings));
-  modDir = pkgs.factorio-mkModDirDrv cfg.mods;
+  modDir = pkgs.factorio-utils.mkModDirDrv cfg.mods;
 in
 {
   options = {

nixos/modules/services/misc/exhibitor.nix

@@ -0,0 +1,415 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.exhibitor;
+  exhibitor = cfg.package;
+  exhibitorConfig = ''
+    zookeeper-install-directory=${cfg.baseDir}/zookeeper
+    zookeeper-data-directory=${cfg.zkDataDir}
+    zookeeper-log-directory=${cfg.zkLogDir}
+    zoo-cfg-extra=${cfg.zkExtraCfg}
+    client-port=${toString cfg.zkClientPort}
+    connect-port=${toString cfg.zkConnectPort}
+    election-port=${toString cfg.zkElectionPort}
+    cleanup-period-ms=${toString cfg.zkCleanupPeriod}
+    servers-spec=${concatStringsSep "," cfg.zkServersSpec}
+    auto-manage-instances=${lib.boolToString cfg.autoManageInstances}
+    ${cfg.extraConf}
+  '';
+  configDir = pkgs.writeTextDir "exhibitor.properties" exhibitorConfig;
+  cliOptionsCommon = {
+    configtype = cfg.configType;
+    defaultconfig = "${configDir}/exhibitor.properties";
+    port = toString cfg.port;
+    hostname = cfg.hostname;
+    headingtext = if (cfg.headingText != null) then (lib.escapeShellArg cfg.headingText) else null;
+    nodemodification = lib.boolToString cfg.nodeModification;
+    configcheckms = toString cfg.configCheckMs;
+    jquerystyle = cfg.jqueryStyle;
+    loglines = toString cfg.logLines;
+    servo = lib.boolToString cfg.servo;
+    timeout = toString cfg.timeout;
+  };
+  s3CommonOptions = { s3region = cfg.s3Region; s3credentials = cfg.s3Credentials; };
+  cliOptionsPerConfig = {
+    s3 = {
+      s3config = "${cfg.s3Config.bucketName}:${cfg.s3Config.objectKey}";
+      s3configprefix = cfg.s3Config.configPrefix;
+    };
+    zookeeper = {
+      zkconfigconnect = concatStringsSep "," cfg.zkConfigConnect;
+      zkconfigexhibitorpath = cfg.zkConfigExhibitorPath;
+      zkconfigpollms = toString cfg.zkConfigPollMs;
+      zkconfigretry = "${toString cfg.zkConfigRetry.sleepMs}:${toString cfg.zkConfigRetry.retryQuantity}";
+      zkconfigzpath = cfg.zkConfigZPath;
+      zkconfigexhibitorport = toString cfg.zkConfigExhibitorPort; # NB: This might be null
+    };
+    file = {
+      fsconfigdir = cfg.fsConfigDir;
+      fsconfiglockprefix = cfg.fsConfigLockPrefix;
+      fsConfigName = fsConfigName;
+    };
+    none = {
+      noneconfigdir = configDir;
+    };
+  };
+  cliOptions = concatStringsSep " " (mapAttrsToList (k: v: "--${k} ${v}") (filterAttrs (k: v: v != null && v != "") (cliOptionsCommon //
+               cliOptionsPerConfig."${cfg.configType}" //
+               s3CommonOptions //
+               optionalAttrs cfg.s3Backup { s3backup = "true"; } //
+               optionalAttrs cfg.fileSystemBackup { filesystembackup = "true"; }
+               )));
+in
+{
+  options = {
+    services.exhibitor = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "
+          Whether to enable the exhibitor server.
+        ";
+      };
+      # See https://github.com/soabase/exhibitor/wiki/Running-Exhibitor for what these mean
+      # General options for any type of config
+      port = mkOption {
+        type = types.int;
+        default = 8080;
+        description = ''
+          The port for exhibitor to listen on and communicate with other exhibitors.
+        '';
+      };
+      baseDir = mkOption {
+        type = types.str;
+        default = "/var/exhibitor";
+        description = ''
+          Baseline directory for exhibitor runtime config.
+        '';
+      };
+      configType = mkOption {
+        type = types.enum [ "file" "s3" "zookeeper" "none" ];
+        description = ''
+          Which configuration type you want to use. Additional config will be
+          required depending on which type you are using.
+        '';
+      };
+      hostname = mkOption {
+        type = types.nullOr types.str;
+        description = ''
+          Hostname to use and advertise
+        '';
+        default = null;
+      };
+      nodeModification = mkOption {
+        type = types.bool;
+        description = ''
+          Whether the Explorer UI will allow nodes to be modified (use with caution).
+        '';
+        default = true;
+      };
+      configCheckMs = mkOption {
+        type = types.int;
+        description = ''
+          Period (ms) to check for shared config updates.
+        '';
+        default = 30000;
+      };
+      headingText = mkOption {
+        type = types.nullOr types.str;
+        description = ''
+          Extra text to display in UI header
+        '';
+        default = null;
+      };
+      jqueryStyle = mkOption {
+        type = types.enum [ "red" "black" "custom" ];
+        description = ''
+          Styling used for the JQuery-based UI.
+        '';
+        default = "red";
+      };
+      logLines = mkOption {
+        type = types.int;
+        description = ''
+        Max lines of logging to keep in memory for display.
+        '';
+        default = 1000;
+      };
+      servo = mkOption {
+        type = types.bool;
+        description = ''
+          ZooKeeper will be queried once a minute for its state via the 'mntr' four
+          letter word (this requires ZooKeeper 3.4.x+). Servo will be used to publish
+          this data via JMX.
+        '';
+        default = false;
+      };
+      timeout = mkOption {
+        type = types.int;
+        description = ''
+          Connection timeout (ms) for ZK connections.
+        '';
+        default = 30000;
+      };
+      autoManageInstances = mkOption {
+        type = types.bool;
+        description = ''
+          Automatically manage ZooKeeper instances in the ensemble
+        '';
+        default = false;
+      };
+      zkDataDir = mkOption {
+        type = types.str;
+        default = "${cfg.baseDir}/zkData";
+        description = ''
+          The Zookeeper data directory
+        '';
+      };
+      zkLogDir = mkOption {
+        type = types.path;
+        default = "${cfg.baseDir}/zkLogs";
+        description = ''
+          The Zookeeper logs directory
+        '';
+      };
+      extraConf = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          Extra Exhibitor configuration to put in the ZooKeeper config file.
+        '';
+      };
+      zkExtraCfg = mkOption {
+        type = types.str;
+        default = ''initLimit=5&syncLimit=2&tickTime=2000'';
+        description = ''
+          Extra options to pass into Zookeeper
+        '';
+      };
+      zkClientPort = mkOption {
+        type = types.int;
+        default = 2181;
+        description = ''
+          Zookeeper client port
+        '';
+      };
+      zkConnectPort = mkOption {
+        type = types.int;
+        default = 2888;
+        description = ''
+          The port to use for followers to talk to each other.
+        '';
+      };
+      zkElectionPort = mkOption {
+        type = types.int;
+        default = 3888;
+        description = ''
+          The port for Zookeepers to use for leader election.
+        '';
+      };
+      zkCleanupPeriod = mkOption {
+        type = types.int;
+        default = 0;
+        description = ''
+          How often (in milliseconds) to run the Zookeeper log cleanup task.
+        '';
+      };
+      zkServersSpec = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Zookeeper server spec for all servers in the ensemble.
+        '';
+        example = [ "S:1:zk1.example.com" "S:2:zk2.example.com" "S:3:zk3.example.com" "O:4:zk-observer.example.com" ];
+      };
+
+      # Backup options
+      s3Backup = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable backups to S3
+        '';
+      };
+      fileSystemBackup = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enables file system backup of ZooKeeper log files
+        '';
+      };
+
+      # Options for using zookeeper configType
+      zkConfigConnect = mkOption {
+        type = types.listOf types.str;
+        description = ''
+          The initial connection string for ZooKeeper shared config storage
+        '';
+        example = ["host1:2181" "host2:2181"];
+      };
+      zkConfigExhibitorPath = mkOption {
+        type = types.string;
+        description = ''
+          If the ZooKeeper shared config is also running Exhibitor, the URI path for the REST call
+        '';
+        default = "/";
+      };
+      zkConfigExhibitorPort = mkOption {
+        type = types.nullOr types.int;
+        description = ''
+          If the ZooKeeper shared config is also running Exhibitor, the port that
+          Exhibitor is listening on. IMPORTANT: if this value is not set it implies
+          that Exhibitor is not being used on the ZooKeeper shared config.
+        '';
+      };
+      zkConfigPollMs = mkOption {
+        type = types.int;
+        description = ''
+          The period in ms to check for changes in the config ensemble
+        '';
+        default = 10000;
+      };
+      zkConfigRetry = {
+        sleepMs = mkOption {
+          type = types.int;
+          default = 1000;
+          description = ''
+            Retry sleep time connecting to the ZooKeeper config
+          '';
+        };
+        retryQuantity = mkOption {
+          type = types.int;
+          default = 3;
+          description = ''
+            Retries connecting to the ZooKeeper config
+          '';
+        };
+      };
+      zkConfigZPath = mkOption {
+        type = types.str;
+        description = ''
+          The base ZPath that Exhibitor should use
+        '';
+        example = "/exhibitor/config";
+      };
+
+      # Config options for s3 configType
+      s3Config = {
+        bucketName = mkOption {
+          type = types.str;
+          description = ''
+            Bucket name to store config
+          '';
+        };
+        objectKey = mkOption {
+          type = types.str;
+          description = ''
+            S3 key name to store the config
+          '';
+        };
+        configPrefix = mkOption {
+          type = types.str;
+          description = ''
+            When using AWS S3 shared config files, the prefix to use for values such as locks
+          '';
+          default = "exhibitor-";
+        };
+      };
+
+      # The next two are used for either s3backup or s3 configType
+      s3Credentials = mkOption {
+        type = types.nullOr types.path;
+        description = ''
+          Optional credentials to use for s3backup or s3config. Argument is the path
+          to an AWS credential properties file with two properties:
+          com.netflix.exhibitor.s3.access-key-id and com.netflix.exhibitor.s3.access-secret-key
+        '';
+        default = null;
+      };
+      s3Region = mkOption {
+        type = types.nullOr types.str;
+        description = ''
+          Optional region for S3 calls
+        '';
+        default = null;
+      };
+
+      # Config options for file config type
+      fsConfigDir = mkOption {
+        type = types.path;
+        description = ''
+          Directory to store Exhibitor properties (cannot be used with s3config).
+          Exhibitor uses file system locks so you can specify a shared location
+          so as to enable complete ensemble management.
+        '';
+      };
+      fsConfigLockPrefix = mkOption {
+        type = types.str;
+        description = ''
+          A prefix for a locking mechanism used in conjunction with fsconfigdir
+        '';
+        default = "exhibitor-lock-";
+      };
+      fsConfigName = mkOption {
+        type = types.str;
+        description = ''
+          The name of the file to store config in
+        '';
+        default = "exhibitor.properties";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.exhibitor = {
+      description = "Exhibitor Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      environment = {
+        ZOO_LOG_DIR = cfg.baseDir;
+      };
+      serviceConfig = {
+        /***
+          Exhibitor is a bit un-nixy. It wants to present to you a user interface in order to
+          mutate the configuration of both itself and ZooKeeper, and to coordinate changes
+          among the members of the Zookeeper ensemble. I'm going for a different approach here,
+          which is to manage all the configuration via nix and have it write out the configuration
+          files that exhibitor will use, and to reduce the amount of inter-exhibitor orchestration.
+        ***/
+        ExecStart = ''
+          ${pkgs.exhibitor}/bin/startExhibitor.sh ${cliOptions}
+        '';
+        User = "zookeeper";
+        PermissionsStartOnly = true;
+      };
+      # This is a bit wonky, but the reason for this is that Exhibitor tries to write to
+      # ${cfg.baseDir}/zookeeper/bin/../conf/zoo.cfg
+      # I want everything but the conf directory to be in the immutable nix store, and I want defaults
+      # from the nix store
+      # If I symlink the bin directory in, then bin/../ will resolve to the parent of the symlink in the
+      # immutable nix store. Bind mounting a writable conf over the existing conf might work, but it gets very
+      # messy with trying to copy the existing out into a mutable store.
+      # Another option is to try to patch upstream exhibitor, but the current package just pulls down the
+      # prebuild JARs off of Maven, rather than building them ourselves, as Maven support in Nix isn't
+      # very mature. So, it seems like a reasonable compromise is to just copy out of the immutable store
+      # just before starting the service, so we're running binaries from the immutable store, but we work around
+      # Exhibitor's desire to mutate its current installation.
+      preStart = ''
+        mkdir -m 0700 -p ${cfg.baseDir}/zookeeper
+        # Not doing a chown -R to keep the base ZK files owned by root
+        chown zookeeper ${cfg.baseDir} ${cfg.baseDir}/zookeeper
+        cp -Rf ${pkgs.zookeeper}/* ${cfg.baseDir}/zookeeper
+        chown -R zookeeper ${cfg.baseDir}/zookeeper/conf
+        chmod -R u+w ${cfg.baseDir}/zookeeper/conf
+      '';
+    };
+    users.extraUsers = singleton {
+      name = "zookeeper";
+      uid = config.ids.uids.zookeeper;
+      description = "Zookeeper daemon user";
+      home = cfg.baseDir;
+    };
+  };
+}

nixos/modules/services/misc/gitlab.nix

@@ -439,6 +439,8 @@ in {
       environment.GITLAB_SHELL_CONFIG_PATH = gitlabEnv.GITLAB_SHELL_CONFIG_PATH;
       path = with pkgs; [
         gitAndTools.git
+        gnutar
+        gzip
         openssh
         gitlab-workhorse
       ];

nixos/modules/services/printing/cupsd.nix

@@ -37,7 +37,7 @@ let
       [ cups.out additionalBackends cups-filters pkgs.ghostscript ]
       ++ optional cfg.gutenprint gutenprint
       ++ cfg.drivers;
-    pathsToLink = [ "/lib/cups" "/share/cups" "/bin" ];
+    pathsToLink = [ "/lib" "/share/cups" "/bin" ];
     postBuild = cfg.bindirCmds;
     ignoreCollisions = true;
   };

nixos/modules/services/security/oauth2_proxy.nix

@@ -21,21 +21,20 @@ let
     '';
 
     github = cfg: ''
-      $(optionalString (!isNull cfg.github.org) "--github-org=${cfg.github.org}") \
+      ${optionalString (!isNull cfg.github.org) "--github-org=${cfg.github.org}"} \
-      $(optionalString (!isNull cfg.github.team) "--github-org=${cfg.github.team}") \
+      ${optionalString (!isNull cfg.github.team) "--github-org=${cfg.github.team}"} \
     '';
 
     google = cfg: ''
       --google-admin-email=${cfg.google.adminEmail} \
       --google-service-account=${cfg.google.serviceAccountJSON} \
-      $(repeatedArgs (group: "--google-group=${group}") cfg.google.groups) \
+      ${repeatedArgs (group: "--google-group=${group}") cfg.google.groups} \
     '';
   };
 
   authenticatedEmailsFile = pkgs.writeText "authenticated-emails" cfg.email.addresses;
 
-  getProviderOptions = cfg: provider:
+  getProviderOptions = cfg: provider: providerSpecificOptions.${provider} or (_: "") cfg;
-    if providerSpecificOptions ? provider then providerSpecificOptions.provider cfg else "";
 
   mkCommandLine = cfg: ''
     --provider='${cfg.provider}' \

nixos/modules/services/system/saslauthd.nix

@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  nssModulesPath = config.system.nssModules.path;
+  cfg = config.services.saslauthd;
+
+in
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.saslauthd = {
+
+      enable = mkEnableOption "Whether to enable the Cyrus SASL authentication daemon.";
+
+      package = mkOption {
+        default = pkgs.cyrus_sasl.bin;
+        defaultText = "pkgs.cyrus_sasl.bin";
+        type = types.package;
+        description = "Cyrus SASL package to use.";
+      };
+
+      mechanism = mkOption {
+        type = types.str;
+        default = "pam";
+        description = "Auth mechanism to use";
+      };
+
+      config = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Configuration to use for Cyrus SASL authentication daemon.";
+      };
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    systemd.services.saslauthd = {
+      description = "Cyrus SASL authentication daemon";
+
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = "@${cfg.package}/sbin/saslauthd saslauthd -a ${cfg.mechanism} -O ${pkgs.writeText "saslauthd.conf" cfg.config}";
+        Type = "forking";
+        PIDFile = "/run/saslauthd/saslauthd.pid";
+        Restart = "always";
+      };
+    };
+  };
+}

nixos/modules/virtualisation/docker.nix

@@ -94,6 +94,38 @@ in
             <command>docker</command> daemon.
           '';
       };
+
+    autoPrune = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to periodically prune Docker resources. If enabled, a
+          systemd timer will run <literal>docker system prune -f</literal>
+          as specified by the <literal>dates</literal> option.
+        '';
+      };
+
+      flags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "--all" ];
+        description = ''
+          Any additional flags passed to <command>docker system prune</command>.
+        '';
+      };
+
+      dates = mkOption {
+        default = "weekly";
+        type = types.str;
+        description = ''
+          Specification (in the format described by
+          <citerefentry><refentrytitle>systemd.time</refentrytitle>
+          <manvolnum>7</manvolnum></citerefentry>) of the time at
+          which the prune will occur.
+        '';
+      };
+    };
   };
 
   ###### implementation
@@ -137,6 +169,22 @@ in
           SocketGroup = "docker";
         };
       };
+
+
+      systemd.services.docker-prune = {
+        description = "Prune docker resources";
+
+        restartIfChanged = false;
+        unitConfig.X-StopOnRemoval = false;
+
+        serviceConfig.Type = "oneshot";
+
+        script = ''
+          ${pkgs.docker}/bin/docker system prune -f ${toString cfg.autoPrune.flags}
+        '';
+
+        startAt = optional cfg.autoPrune.enable cfg.autoPrune.dates;
+      };
     }
   ]);
 

nixos/modules/virtualisation/google-compute-image.nix

@@ -3,13 +3,11 @@
 with lib;
 let
   diskSize = 1024; # MB
+  gce = pkgs.google-compute-engine;
 in
 {
   imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ./grow-partition.nix ];
 
-  # https://cloud.google.com/compute/docs/tutorials/building-images
-  networking.firewall.enable = mkDefault false;
-
   system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
     name = "google-compute-image";
     postVM = ''
@@ -49,12 +47,18 @@ in
   services.openssh.permitRootLogin = "prohibit-password";
   services.openssh.passwordAuthentication = mkDefault false;
 
+  # Use GCE udev rules for dynamic disk volumes
+  services.udev.packages = [ gce ];
+
   # Force getting the hostname from Google Compute.
   networking.hostName = mkDefault "";
 
   # Always include cryptsetup so that NixOps can use it.
   environment.systemPackages = [ pkgs.cryptsetup ];
 
+  # Rely on GCP's firewall instead
+  networking.firewall.enable = mkDefault false;
+
   # Configure default metadata hostnames
   networking.extraHosts = ''
     169.254.169.254 metadata.google.internal metadata
@@ -64,6 +68,132 @@ in
 
   networking.usePredictableInterfaceNames = false;
 
+  # allow the google-accounts-daemon to manage users
+  users.mutableUsers = true;
+  # and allow users to sudo without password
+  security.sudo.enable = true;
+  security.sudo.extraConfig = ''
+  %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
+  '';
+
+  # NOTE: google-accounts tries to write to /etc/sudoers.d but the folder doesn't exist
+  # FIXME: not such file or directory on dynamic SSH provisioning
+  systemd.services.google-accounts-daemon = {
+    description = "Google Compute Engine Accounts Daemon";
+    # This daemon creates dynamic users
+    enable = config.users.mutableUsers;
+    after = [
+      "network.target"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    wantedBy = [ "multi-user.target" ];
+    requires = ["network.target"];
+    path = with pkgs; [ shadow ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${gce}/bin/google_accounts_daemon --debug";
+    };
+  };
+
+  systemd.services.google-clock-skew-daemon = {
+    description = "Google Compute Engine Clock Skew Daemon";
+    after = [
+      "network.target"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    requires = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${gce}/bin/google_clock_skew_daemon --debug";
+    };
+  };
+
+  systemd.services.google-instance-setup = {
+    description = "Google Compute Engine Instance Setup";
+    after = ["fs.target" "network-online.target" "network.target" "rsyslog.service"];
+    before = ["sshd.service"];
+    wants = ["local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "sshd.service" "multi-user.target" ];
+    path = with pkgs; [ ethtool ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_instance_setup --debug";
+      Type = "oneshot";
+    };
+  };
+
+  systemd.services.google-ip-forwarding-daemon = {
+    description = "Google Compute Engine IP Forwarding Daemon";
+    after = ["network.target" "google-instance-setup.service" "google-network-setup.service"];
+    requires = ["network.target"];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [ iproute ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${gce}/bin/google_ip_forwarding_daemon --debug";
+    };
+  };
+
+  systemd.services.google-shutdown-scripts = {
+    description = "Google Compute Engine Shutdown Scripts";
+    after = [
+      "local-fs.target"
+      "network-online.target"
+      "network.target"
+      "rsyslog.service"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    wants = [ "local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.coreutils}/bin/true";
+      ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown";
+      Type = "oneshot";
+      RemainAfterExit = true;
+      TimeoutStopSec = 0;
+    };
+  };
+
+  systemd.services.google-network-setup = {
+    description = "Google Compute Engine Network Setup";
+    after = [
+      "local-fs.target"
+      "network-online.target"
+      "network.target"
+      "rsyslog.service"
+    ];
+    wants = [ "local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_network_setup --debug";
+      KillMode = "process";
+      Type = "oneshot";
+    };
+  };
+
+  systemd.services.google-startup-scripts = {
+    description = "Google Compute Engine Startup Scripts";
+    after = [
+      "local-fs.target"
+      "network-online.target"
+      "network.target"
+      "rsyslog.service"
+      "google-instance-setup.service"
+      "google-network-setup.service"
+    ];
+    wants = [ "local-fs.target" "network-online.target" "network.target"];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup";
+      KillMode = "process";
+      Type = "oneshot";
+    };
+  };
+
+  # TODO: remove this
   systemd.services.fetch-ssh-keys =
     { description = "Fetch host keys and authorized_keys for root user";
 
@@ -113,9 +243,13 @@ in
       serviceConfig.StandardOutput = "journal+console";
     };
 
-  # Setings taken from https://cloud.google.com/compute/docs/tutorials/building-images#providedkernel
+  # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
   boot.kernel.sysctl = {
-    # enables syn flood protection
+    # Turn on SYN-flood protections.  Starting with 2.6.26, there is no loss
+    # of TCP functionality/features under normal conditions.  When flood
+    # protections kick in under high unanswered-SYN load, the system
+    # should remain more stable, with a trade off of some loss of TCP
+    # functionality/features (e.g. TCP Window scaling).
     "net.ipv4.tcp_syncookies" = mkDefault "1";
 
     # ignores source-routed packets
@@ -169,6 +303,11 @@ in
     # randomizes addresses of mmap base, heap, stack and VDSO page
     "kernel.randomize_va_space" = mkDefault "2";
 
+    # Reboot the machine soon after a kernel panic.
+    "kernel.panic" = mkDefault "10";
+
+    ## Not part of the original config
+
     # provides protection from ToCToU races
     "fs.protected_hardlinks" = mkDefault "1";
 

nixos/tests/postgresql.nix

@@ -13,8 +13,10 @@ let
     INSERT INTO sth (id) VALUES (1);
     INSERT INTO sth (id) VALUES (1);
     INSERT INTO sth (id) VALUES (1);
+    CREATE TABLE xmltest ( doc xml );
+    INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
   '';
-  make-postgresql-test = postgresql-name: postgresql-package: {
+  make-postgresql-test = postgresql-name: postgresql-package: makeTest {
     name = postgresql-name;
     meta = with pkgs.stdenv.lib.maintainers; {
       maintainers = [ zagy ];
@@ -27,17 +29,23 @@ let
       };
 
     testScript = ''
+      sub check_count {
+        my ($select, $nlines) = @_;
+        return 'test $(sudo -u postgres psql postgres -tAc "' . $select . '"|wc -l) -eq ' . $nlines;
+      }
+
       $machine->start;
       $machine->waitForUnit("postgresql");
       # postgresql should be available just after unit start
-      $machine->succeed("cat ${test-sql} | psql postgres");
+      $machine->succeed("cat ${test-sql} | sudo -u postgres psql");
       $machine->shutdown; # make sure that postgresql survive restart (bug #1735)
       sleep(2);
       $machine->start;
       $machine->waitForUnit("postgresql");
-      $machine->fail('test $(psql postgres -tAc "SELECT * FROM sth;"|wc -l) -eq 3');
+      $machine->fail(check_count("SELECT * FROM sth;", 3));
-      $machine->succeed('test $(psql postgres -tAc "SELECT * FROM sth;"|wc -l) -eq 5');
+      $machine->succeed(check_count("SELECT * FROM sth;", 5));
-      $machine->fail('test $(psql postgres -tAc "SELECT * FROM sth;"|wc -l) -eq 4');
+      $machine->fail(check_count("SELECT * FROM sth;", 4));
+      $machine->succeed(check_count("SELECT xpath(\'/test/text()\', doc) FROM xmltest;", 1));
       $machine->shutdown;
     '';
 

pkgs/applications/altcoins/dapp.nix

@@ -3,18 +3,18 @@
 
 stdenv.mkDerivation rec {
   name = "dapp";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "dapphub";
     repo = "dapp";
     rev = "v${version}";
-    sha256 = "1529ml5r1l5g6xcak7k3h3ih214mgnk87jsxyk0rvk245jkard1y";
+    sha256 = "13b2krd02py8jnzjis44lay5i31d95z0myrsy5afzw7fa25giird";
   };
 
   nativeBuildInputs = [makeWrapper shellcheck];
   buildPhase = "true";
-  doCheck = false;
+  doCheck = true;
   checkPhase = "make test";
   makeFlags = ["prefix=$(out)"];
   postInstall = let path = lib.makeBinPath [

pkgs/applications/audio/flac123/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchurl, autoreconfHook, flac, libao, libogg, popt }:
+
+stdenv.mkDerivation rec {
+  name = "flac123-${version}";
+  version = "0.0.12";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/flac-tools/${name}-release.tar.gz";
+    sha256 = "0zg4ahkg7v81za518x32wldf42g0rrvlrcqhrg9sv3li9bayyxhr";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ flac libao libogg popt ];
+
+  meta = with stdenv.lib; {
+    homepage = http://flac-tools.sourceforge.net/;
+    description = "A command-line program for playing FLAC audio files";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+  };
+}

pkgs/applications/editors/android-studio/common.nix

@@ -1,3 +1,4 @@
+{ pname, version, build, src, meta }:
 { bash
 , buildFHSUserEnv
 , coreutils
@@ -32,12 +33,9 @@
 }:
 
 let
-
-  version = "2.3.3.0";
-  build = "162.4069837";
-
   androidStudio = stdenv.mkDerivation {
-    name = "android-studio";
+    inherit src meta;
+    name = "${pname}";
     buildInputs = [
       makeWrapper
       unzip
@@ -96,32 +94,21 @@ let
         --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
         --set FONTCONFIG_FILE ${fontsConf}
     '';
-    src = fetchurl {
-      url = "https://dl.google.com/dl/android/studio/ide-zips/${version}/android-studio-ide-${build}-linux.zip";
-      sha256 = "0zzis9m2xp44xwkj0zvcqw5rh3iyd3finyi5nqhgira1fkacz0qk";
-    };
-    meta = with stdenv.lib; {
-      description = "The Official IDE for Android";
-      homepage = https://developer.android.com/studio/index.html;
-      license = licenses.asl20;
-      platforms = [ "x86_64-linux" ];
-      maintainers = with maintainers; [ primeos ];
-    };
   };
 
   # Android Studio downloads prebuilt binaries as part of the SDK. These tools
   # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
   # environment is used as a work around for that.
   fhsEnv = buildFHSUserEnv {
-    name = "android-studio-fhs-env";
+    name = "${pname}-fhs-env";
   };
 
 in writeTextFile {
-  name = "android-studio-${version}";
+  name = "${pname}-${version}";
-  destination = "/bin/android-studio";
+  destination = "/bin/${pname}";
   executable = true;
   text = ''
     #!${bash}/bin/bash
-    ${fhsEnv}/bin/android-studio-fhs-env ${androidStudio}/bin/studio.sh
+    ${fhsEnv}/bin/${pname}-fhs-env ${androidStudio}/bin/studio.sh
   '';
 }

pkgs/applications/editors/android-studio/packages.nix

@@ -0,0 +1,47 @@
+{  stdenv, callPackage, fetchurl, makeFontsConf }:
+let
+  mkStudio = opts: callPackage (import ./common.nix opts);
+in rec {
+  stable = mkStudio rec {
+    pname = "android-studio";
+    version = "2.3.3.0";
+    build = "162.4069837";
+
+    src = fetchurl {
+      url = "https://dl.google.com/dl/android/studio/ide-zips/${version}/android-studio-ide-${build}-linux.zip";
+      sha256 = "0zzis9m2xp44xwkj0zvcqw5rh3iyd3finyi5nqhgira1fkacz0qk";
+    };
+
+    meta = with stdenv.lib; {
+      description = "The Official IDE for Android";
+      homepage = https://developer.android.com/studio/index.html;
+      license = licenses.asl20;
+      platforms = [ "x86_64-linux" ];
+      maintainers = with maintainers; [ primeos ];
+    };
+  } {
+    fontsConf = makeFontsConf {
+      fontDirectories = [];
+    };
+  };
+
+  preview = mkStudio rec {
+    pname = "android-studio-preview";
+    version = "3.0.0.6";
+    build = "171.4182969";
+
+    src = fetchurl {
+      url = "https://dl.google.com/dl/android/studio/ide-zips/${version}/android-studio-ide-${build}-linux.zip";
+      sha256 = "0s26k5qr0qg6az77yw2mvnhavwi4aza4ifvd45ljank8aqr6sp5i";
+    };
+
+    meta = stable.meta // {
+      homepage = https://developer.android.com/studio/preview/index.html;
+      maintainers = with stdenv.lib.maintainers; [ tomsmeets ];
+    };
+  } {
+    fontsConf = makeFontsConf {
+      fontDirectories = [];
+    };
+  };
+}

pkgs/applications/editors/eclipse/plugins.nix

@@ -194,12 +194,12 @@ rec {
 
   checkstyle = buildEclipseUpdateSite rec {
     name = "checkstyle-${version}";
-    version = "7.3.0.201612142232";
+    version = "8.0.0.201707161819";
 
     src = fetchzip {
       stripRoot = false;
-      url = "mirror://sourceforge/project/eclipse-cs/Eclipse%20Checkstyle%20Plug-in/7.3.0/net.sf.eclipsecs-updatesite_${version}.zip";
+      url = "mirror://sourceforge/project/eclipse-cs/Eclipse%20Checkstyle%20Plug-in/8.0.0/net.sf.eclipsecs-updatesite_${version}.zip";
-      sha256 = "1mbiszwnakfmjx5mnh9h2rrp9jzizkmz89p8z4spq2m9kwy1lkqj";
+      sha256 = "1p07xcf71qc99sh73vqm9xxxgi819m58frv0cpvsn06y6ljr0aj2";
     };
 
     meta = with stdenv.lib; {

pkgs/applications/editors/jetbrains/default.nix

@@ -50,6 +50,9 @@ let
 
           patchelf --set-interpreter $interp bin/gdb/bin/gdb
           patchelf --set-interpreter $interp bin/gdb/bin/gdbserver
+          patchelf --set-interpreter $interp \
+            --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib zlib ]}:$lldbLibPath" \
+            bin/clang/clang-tidy
         )
       '';
     });
@@ -213,12 +216,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2017.1.3";
+    version = "2017.2"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "045pkbbf4ypk9qkhldz08i7hbc6vaq68a8v9axnpndnvcrf0vf7g";
+      sha256 = "de7f47ec959be9653aa4d2028fb27f8327800d8370daa0ab2d1093f3469f4b49"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion_Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -265,12 +268,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2017.1.5"; /* updated by script */
+    version = "2017.2";
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "830c662c517e8d0131dc2df150d6f75adb3d8becaf9de96393730b0f4ae6ccf0"; /* updated by script */
+      sha256 = "0z5abj41f5l9ilznr34lm4fsivrl2yjdxb2kdcis5abij6zl0g3f";
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IDEA_Release";

pkgs/applications/editors/nano/default.nix

@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "nano-${version}";
-  version = "2.8.5";
+  version = "2.8.6";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${name}.tar.xz";
-    sha256 = "1hl9gni3qmblr062a7w6vz16gvxbswgc5c19c923ja0bk48vyhyb";
+    sha256 = "0xjpm2ka56x5ycrgjh06v110na13xlbm42bs8qibk7g578m9cils";
   };
 
   patches = stdenv.lib.optional hostPlatform.isDarwin stdenv.secure-format-patch;

pkgs/applications/editors/vscode/default.nix

@@ -2,7 +2,7 @@
   makeWrapper, libXScrnSaver, libxkbfile }:
 
 let
-  version = "1.14.0";
+  version = "1.14.2";
   channel = "stable";
 
   plat = {
@@ -12,9 +12,9 @@ let
   }.${stdenv.system};
 
   sha256 = {
-    "i686-linux" = "04xv9fr11j7k0yfb7aa2sdmq74hh43aarlvx8nxppzbn2k18dgb3";
+    "i686-linux" = "0ladqwgy37imq957mmbdfslaxcnx8gcl9nb1q5p8r91vldvf31zd";
-    "x86_64-linux" = "1m252cpj4pck40rxnrbp1wapn5d4grn15x7d3s059xb965kga4k7";
+    "x86_64-linux" = "1nb9n6511v2p1nwcwh6kbpxgydfs66yn7q2nf1rmh42ha5yzqkja";
-    "x86_64-darwin" = "1hwjdrnrhvrmwbq935k4scgw68x817ms89gy471afbhpl65xmp8n";
+    "x86_64-darwin" = "0yk2yd8rzhmsh276xfgywp1gjjkvxypgnjhs8jaxvrgsj7aw1s39";
   }.${stdenv.system};
 
   archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";

pkgs/applications/graphics/PythonMagick/default.nix

@@ -1,3 +1,5 @@
+# This expression provides Python bindings to ImageMagick. Python libraries are supposed to be called via `python-packages.nix`.
+
 {stdenv, fetchurl, python, boost, pkgconfig, imagemagick}:
 
 stdenv.mkDerivation rec {

pkgs/applications/graphics/graphicsmagick/cmyka-bounds.patch

@@ -1,36 +0,0 @@
-# HG changeset patch
-# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
-# Date 1487905610 21600
-# Node ID 6156b4c2992d855ece6079653b3b93c3229fc4b8
-# Parent  0392c4305a4369984ec8069055acc470c0a73647
-Fix out of bounds access when reading CMYKA tiff which claims wrong samples/pixel.
-
-diff -r 0392c4305a43 -r 6156b4c2992d coders/tiff.c
---- a/coders/tiff.c	Sun Jan 29 10:04:57 2017 -0600
-+++ b/coders/tiff.c	Thu Feb 23 21:06:50 2017 -0600
-@@ -1230,8 +1230,8 @@
-                   case 0:
-                     if (samples_per_pixel == 1)
-                       *quantum_type=GrayQuantum;
--                      else
--                        *quantum_type=RedQuantum;
-+                    else
-+                      *quantum_type=RedQuantum;
-                     break;
-                   case 1:
-                     *quantum_type=GreenQuantum;
-@@ -1411,12 +1411,12 @@
-               }
-             else
-               {
--                if (image->matte)
-+                if (image->matte && samples_per_pixel >= 5)
-                   {
-                     *quantum_type=CMYKAQuantum;
-                     *quantum_samples=5;
-                   }
--                else
-+                else if (samples_per_pixel >= 4)
-                   {
-                     *quantum_type=CMYKQuantum;
-                     *quantum_samples=4;

pkgs/applications/graphics/graphicsmagick/default.nix

@@ -2,47 +2,18 @@
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
 , libwebp, quantumdepth ? 8, fixDarwinDylibNames }:
 
-let version = "1.3.25"; in
+let version = "1.3.26"; in
 
 stdenv.mkDerivation {
   name = "graphicsmagick-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "17xcc7pfcmiwpfr1g8ys5a7bdnvqzka53vg3kkzhwwz0s99gljyn";
+    sha256 = "122zgs96dqrys62mnh8x5yvfff6km4d3yrnvaxzg3mg5sprib87v";
   };
 
   patches = [
     ./disable-popen.patch
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-7996_CVE-2016-7997.patch";
-      sha256 = "0xsby2z8n7cnnln7szjznq7iaabq323wymvdjra59yb41aix74r2";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-7800_part1.patch";
-      sha256 = "02s0x9bkbnm5wrd0d2x9ld4d9z5xqpfk310lyylyr5zlnhqxmwgn";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-7800_part2.patch";
-      sha256 = "1h4xv3i1aq5avsd584rwa5sa7ca8f7w9ggmh7j2llqq5kymwsv5f";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-8682.patch";
-      sha256 = "1wfirw2yi5y72657kvnbgjs0f9b3rs9nvk8gjbwhb9a03z9ws0y5";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-8683.patch";
-      sha256 = "102252zb34nj6alk1nhh1wbn3apd2v9rzk7clmm237332yj72vif";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-5/debian/patches/CVE-2016-8684.patch";
-      sha256 = "1p36gpz904wnmbz1n64x4pdpg8lp9zs3gx0awklxqdvgl8m82vvy";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.net/data/main/g/graphicsmagick/1.3.25-7/debian/patches/CVE-2016-9830.patch";
-      sha256 = "0qh15sd7nx7vf9sld4453iml951bwsx2fx84hxc7plhds2k3gjpa";
-    })
-    ./cmyka-bounds.patch
   ];
 
   configureFlags = [

pkgs/applications/misc/houdini/default.nix

@@ -1,10 +1,9 @@
 { zsh, stdenv, callPackage, buildFHSUserEnv, undaemonize }:
 
 let
-  version = "16.0.633";
   houdini-runtime = callPackage ./runtime.nix { };
 in buildFHSUserEnv rec {
-  name = "houdini-${version}";
+  name = "houdini-${houdini-runtime.version}";
 
   extraBuildCommands = ''
     mkdir -p $out/usr/lib/sesi

pkgs/applications/misc/houdini/runtime.nix

@@ -1,4 +1,4 @@
-{ stdenv, requireFile, zlib, libpng, libSM, libICE, fontconfig, xorg, mesa_glu, bc }:
+{ stdenv, requireFile, zlib, libpng, libSM, libICE, fontconfig, xorg, mesa_glu, alsaLib, dbus, xkeyboardconfig, bc }:
 
 let
   ld_library_path = builtins.concatStringsSep ":" [
@@ -11,21 +11,29 @@ let
       xorg.libXext
       xorg.libX11
       xorg.libXrender
+      xorg.libXcursor
+      xorg.libXfixes
+      xorg.libXrender
+      xorg.libXcomposite
+      xorg.libXdamage
+      xorg.libXtst
+      alsaLib
       fontconfig
       libSM
       libICE
       zlib
       libpng
+      dbus
     ])
   ];
   license_dir = "~/.config/houdini";
 in
 stdenv.mkDerivation rec {
-  version = "16.0.633";
+  version = "16.0.671";
   name = "houdini-runtime-${version}";
   src = requireFile rec {
-    name = "houdini-16.0.633-linux_x86_64_gcc4.8.tar.gz";
+    name = "houdini-${version}-linux_x86_64_gcc4.8.tar.gz";
-    sha256 = "1laxncwgsr4hj53bn4pn9ibv3pkrpliwxlx0558wgnhq42js3wvl";
+    sha256 = "1d3c1a1128szlgaf3ilw5y20plz5azwp37v0ljawgm80y64hq15r";
     message = ''
       This nix expression requires that ${name} is already part of the store.
       Download it from https://sidefx.com and add it to the nix store with:
@@ -50,11 +58,13 @@ stdenv.mkDerivation rec {
                       --no-root-check \
                       --accept-EULA \
                       $out
-    sed -i "s|/usr/lib/sesi|${license_dir}|g" $out/houdini/Licensing.opt
+    echo -e "localValidatorDir = ${license_dir}\nlicensingMode = localValidator" > $out/houdini/Licensing.opt
     sed -i "s|/usr/lib/sesi|${license_dir}|g" $out/houdini/sbin/sesinetd_safe
     sed -i "s|/usr/lib/sesi|${license_dir}|g" $out/houdini/sbin/sesinetd.startup
     echo "export LD_LIBRARY_PATH=${ld_library_path}" >> $out/bin/app_init.sh
+    echo "export QT_XKB_CONFIG_ROOT="${xkeyboardconfig}/share/X11/xkb"" >> $out/bin/app_init.sh
     echo "export LD_LIBRARY_PATH=${ld_library_path}" >> $out/houdini/sbin/app_init.sh
+    echo "export QT_XKB_CONFIG_ROOT="${xkeyboardconfig}/share/X11/xkb"" >> $out/houdini/sbin/app_init.sh
   '';
   postFixup = ''
     INTERPRETER="$(cat "$NIX_CC"/nix-support/dynamic-linker)"

pkgs/applications/misc/keepass-plugins/keepasshttp/default.nix

@@ -1,14 +1,17 @@
 { stdenv, buildEnv, fetchFromGitHub, mono }:
 
 let
-  version = "1.8.4.1";
+  version = "1.8.4.2";
   drv = stdenv.mkDerivation {
     name = "keepasshttp-${version}";
     src = fetchFromGitHub {
       owner = "pfn";
       repo = "keepasshttp";
-      rev = "${version}";
+      #rev = "${version}";
-      sha256 = "1074yv0pmzdwfwkx9fh7n2igdqwsyxypv55khkyng6synbv2p2fd";
+      # for 1.8.4.2 the tag is at the wrong commit (they fixed stuff
+      # afterwards and didn't move the tag), hence reference by commitid
+      rev = "c2c4eb5388a02169400cba7a67be325caabdcc37";
+      sha256 = "0bkzxggbqx7sql3sp46bqham6r457in0vrgh3ai3lw2jrw79pwmh";
     };
 
     meta = {

pkgs/applications/misc/keepass/default.nix

@@ -8,11 +8,11 @@
 # plugin derivations in the Nix store and nowhere else.
 with builtins; buildDotnetPackage rec {
   baseName = "keepass";
-  version = "2.35";
+  version = "2.36";
 
   src = fetchurl {
     url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    sha256 = "1pv3x1lr2kymjpm6z26fqx997jivzy0diqsysq4diygj38wdkajz";
+    sha256 = "1j6qhy8h3z6higbpq3q9v04amvgbn90yj3kbsvj17azdkffkwzny";
   };
 
   sourceRoot = ".";

pkgs/applications/misc/mediainfo-gui/default.nix

@@ -2,11 +2,11 @@
 , desktop_file_utils, libSM, imagemagick }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.95";
+  version = "0.7.97";
   name = "mediainfo-gui-${version}";
   src = fetchurl {
     url = "http://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "0bil5hsjas585s83j0srxwlplzpw2wny2wklp8az8iayvxmmi20m";
+    sha256 = "10hp23a9hdlqvrhskssd9g15f4n55yq48cmbpjwdqwzfrblj598n";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];

pkgs/applications/misc/mediainfo/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libzen, libmediainfo, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.95";
+  version = "0.7.97";
   name = "mediainfo-${version}";
   src = fetchurl {
     url = "http://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "0bil5hsjas585s83j0srxwlplzpw2wny2wklp8az8iayvxmmi20m";
+    sha256 = "10hp23a9hdlqvrhskssd9g15f4n55yq48cmbpjwdqwzfrblj598n";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];

pkgs/applications/misc/terminal-notifier/default.nix

@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     cp -r terminal-notifier.app $out/Applications
     cat >$out/bin/terminal-notifier <<EOF
+    #!${stdenv.shell}
     cd $out/Applications/terminal-notifier.app
     exec ./Contents/MacOS/terminal-notifier "\$@"
     EOF

pkgs/applications/misc/tomboy/default.nix

@@ -4,7 +4,7 @@
 , makeWrapper, lib}:
 
 let
-  version = "1.15.7";
+  version = "1.15.9";
 in
 
 stdenv.mkDerivation {
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tomboy-notes/tomboy/releases/download/${version}/tomboy-${version}.tar.xz";
-    sha256 = "1i6sv6w2ms2x0nkgxq11agljiyg0yl4x2rzmcyvs2hxyf574hd1y";
+    sha256 = "0j5jmd079bm2fydqaic5ymbfdxna3qlx6fkp2mqhgcdr7prsbl3q";
   };
 
   buildInputs = [ itstool intltool pkgconfig

pkgs/applications/misc/veracrypt/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, pkgconfig, nasm, fuse, wxGTK30, devicemapper, makeself,
+{ fetchurl, stdenv, pkgconfig, yasm, fuse, wxGTK30, devicemapper, makeself,
   wxGUI ? true
 }:
 
@@ -6,21 +6,20 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "veracrypt-${version}";
-  version = "1.19";
+  version = "1.21";
 
   src = fetchurl {
-    url = "https://launchpad.net/veracrypt/trunk/${version}/+download/VeraCrypt_${version}_Source.tar.gz";
+    url = "https://launchpad.net/veracrypt/trunk/${version}/+download/VeraCrypt_${version}_Source.tar.bz2";
-    sha256 = "111xs1zmic82lpn5spn0ca33q0g4za04a2k4cvjwdb7k3vcicq6v";
+    sha256 = "0n036znmwnv70wy8r2j3b55bx2z3cch5fr83vnwjvzyyp0j7swa4";
   };
 
-  # The source archive appears to be compressed twice ...
   unpackPhase =
     ''
-      gzip -dc $src | tar xz
+      tar xjf $src
-      cd Vera*/src
+      cd src
     '';
 
-  nativeBuildInputs = [ makeself nasm pkgconfig ];
+  nativeBuildInputs = [ makeself yasm pkgconfig ];
   buildInputs = [ fuse devicemapper ]
     ++ optional wxGUI wxGTK30;
   makeFlags = optionalString (!wxGUI) "NOGUI=1";

pkgs/applications/networking/browsers/chromium/common.nix

@@ -1,4 +1,4 @@
-{ stdenv, ninja, which, nodejs
+{ stdenv, ninja, which, nodejs, fetchurl, gnutar
 
 # default dependencies
 , bzip2, flac, speex, libopus
@@ -14,6 +14,7 @@
 , glib, gtk2, gtk3, dbus_glib
 , libXScrnSaver, libXcursor, libXtst, mesa
 , protobuf, speechd, libXdamage, cups
+, ffmpeg, harfbuzz, harfbuzz-icu, libxslt, libxml2
 
 # optional dependencies
 , libgcrypt ? null # gnomeSupport || cupsSupport
@@ -36,6 +37,8 @@ buildFun:
 
 with stdenv.lib;
 
+# see http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html
+
 let
   # The additional attributes for creating derivations based on the chromium
   # source tree.
@@ -57,7 +60,7 @@ let
     in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
 
   gnSystemLibraries = [
-    "flac" "libwebp" "snappy" "yasm"
+    "ffmpeg" "flac" "harfbuzz-ng" "libwebp" "libxslt" "yasm" "snappy" # "libpng" "libjpeg"
   ];
 
   opusWithCustomModes = libopus.override {
@@ -70,6 +73,7 @@ let
     libpng libcap
     xdg_utils yasm minizip libwebp
     libusb1 re2 zlib
+    ffmpeg harfbuzz libxslt harfbuzz-icu libxml2
   ];
 
   # build paths and release info
@@ -78,6 +82,11 @@ let
   buildPath = "out/${buildType}";
   libExecPath = "$out/libexec/${packageName}";
 
+  freetype_source = fetchurl {
+    url = http://anduin.linuxfromscratch.org/BLFS/other/chromium-freetype.tar.xz;
+    sha256 = "1vhslc4xg0d6wzlsi99zpah2xzjziglccrxn55k7qna634wyxg77";
+  };
+
   base = rec {
     name = "${packageName}-${version}";
     inherit (upstream-info) version;
@@ -88,6 +97,7 @@ let
     nativeBuildInputs = [
       ninja which python2Packages.python perl pkgconfig
       python2Packages.ply python2Packages.jinja2 nodejs
+      gnutar
     ];
 
     buildInputs = defaultDependencies ++ [
@@ -108,6 +118,7 @@ let
       # To enable ChromeCast, go to chrome://flags and set "Load Media Router Component Extension" to Enabled
       # Fixes Chromecast: https://bugs.chromium.org/p/chromium/issues/detail?id=734325
       ./patches/fix_network_api_crash.patch
+      ./patches/chromium-59.0.3071.115-system_ffmpeg-1.patch
     ] ++ optional (versionOlder version "57.0") ./patches/glibc-2.24.patch
       ++ optional enableWideVine ./patches/widevine.patch;
 
@@ -139,6 +150,22 @@ let
       # use our own nodejs
       mkdir -p third_party/node/linux/node-linux-x64/bin
       ln -s $(which node) third_party/node/linux/node-linux-x64/bin/node
+
+      # use patched freetype
+      # FIXME https://bugs.chromium.org/p/pdfium/issues/detail?id=733
+      # FIXME http://savannah.nongnu.org/bugs/?51156
+      tar -xJf ${freetype_source}
+
+      # remove unused third-party
+      for lib in ${toString gnSystemLibraries}; do
+        find -type f -path "*third_party/$lib/*"     \
+            \! -path "*third_party/$lib/chromium/*"  \
+            \! -path "*third_party/$lib/google/*"    \
+            \! -path "*base/third_party/icu/*"       \
+            \! -path "*base/third_party/libevent/*"  \
+            \! -regex '.*\.\(gn\|gni\|isolate\|py\)' \
+            -delete
+      done
     '';
 
     gnFlags = mkGnFlags ({

pkgs/applications/networking/browsers/chromium/patches/chromium-59.0.3071.115-system_ffmpeg-1.patch

@@ -0,0 +1,63 @@
+Submitted By:            DJ Lucas <dj_AT_linuxfromscratch_DOT_org>
+Date:                    2017-06-25
+Initial Package Version: 57.0.2987.110
+Upstream Status:         Not submitted
+Origin:                  Gentoo: https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/files/chromium-system-ffmpeg-r4.patch
+Description:             Allows building with system provided ffmpeg. Rediffed
+                         for chromium-59.0.3071.109.
+
+diff -Naurp chromium-59.0.3071.109-orig/media/ffmpeg/ffmpeg_common.h chromium-59.0.3071.109/media/ffmpeg/ffmpeg_common.h
+--- chromium-59.0.3071.109-orig/media/ffmpeg/ffmpeg_common.h	2017-06-20 17:03:19.000000000 -0500
++++ chromium-59.0.3071.109/media/ffmpeg/ffmpeg_common.h	2017-06-23 00:21:10.551912699 -0500
+@@ -23,10 +23,6 @@
+ 
+ // Include FFmpeg header files.
+ extern "C" {
+-// Disable deprecated features which result in spammy compile warnings.  This
+-// list of defines must mirror those in the 'defines' section of FFmpeg's
+-// BUILD.gn file or the headers below will generate different structures!
+-#define FF_API_CONVERGENCE_DURATION 0
+ // Upstream libavcodec/utils.c still uses the deprecated
+ // av_dup_packet(), causing deprecation warnings.
+ // The normal fix for such things is to disable the feature as below,
+@@ -40,7 +36,6 @@ extern "C" {
+ MSVC_PUSH_DISABLE_WARNING(4244);
+ #include <libavcodec/avcodec.h>
+ #include <libavformat/avformat.h>
+-#include <libavformat/internal.h>
+ #include <libavformat/avio.h>
+ #include <libavutil/avutil.h>
+ #include <libavutil/imgutils.h>
+diff -Naurp chromium-59.0.3071.109-orig/media/filters/ffmpeg_demuxer.cc chromium-59.0.3071.109/media/filters/ffmpeg_demuxer.cc
+--- chromium-59.0.3071.109-orig/media/filters/ffmpeg_demuxer.cc	2017-06-20 17:03:19.000000000 -0500
++++ chromium-59.0.3071.109/media/filters/ffmpeg_demuxer.cc	2017-06-23 00:22:56.289311692 -0500
+@@ -1223,29 +1223,6 @@ void FFmpegDemuxer::OnFindStreamInfoDone
+   // If no estimate is found, the stream entry will be kInfiniteDuration.
+   std::vector<base::TimeDelta> start_time_estimates(format_context->nb_streams,
+                                                     kInfiniteDuration);
+-  const AVFormatInternal* internal = format_context->internal;
+-  if (internal && internal->packet_buffer &&
+-      format_context->start_time != static_cast<int64_t>(AV_NOPTS_VALUE)) {
+-    struct AVPacketList* packet_buffer = internal->packet_buffer;
+-    while (packet_buffer != internal->packet_buffer_end) {
+-      DCHECK_LT(static_cast<size_t>(packet_buffer->pkt.stream_index),
+-                start_time_estimates.size());
+-      const AVStream* stream =
+-          format_context->streams[packet_buffer->pkt.stream_index];
+-      if (packet_buffer->pkt.pts != static_cast<int64_t>(AV_NOPTS_VALUE)) {
+-        const base::TimeDelta packet_pts =
+-            ConvertFromTimeBase(stream->time_base, packet_buffer->pkt.pts);
+-        // We ignore kNoTimestamp here since -int64_t::min() is possible; see
+-        // https://crbug.com/700501. Technically this is a valid value, but in
+-        // practice shouldn't occur, so just ignore it when estimating.
+-        if (packet_pts != kNoTimestamp && packet_pts != kInfiniteDuration &&
+-            packet_pts < start_time_estimates[stream->index]) {
+-          start_time_estimates[stream->index] = packet_pts;
+-        }
+-      }
+-      packet_buffer = packet_buffer->next;
+-    }
+-  }
+ 
+   std::unique_ptr<MediaTracks> media_tracks(new MediaTracks());
+ 

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "1lr8yc1inj0r0znak4rq37c9r0jhmag0ny9dqxng2jpgqq7mkp2g";
+    sha256 = "086j8s8wjwk26gfb7hdqn1lsmwgr9mmw93yfi6s4wia9ra0ccwj2";
-    sha256bin64 = "1yyw7i50jkgkwrgp4by83m0xwsi44bkxsyw47lrqbfzask3zazbm";
+    sha256bin64 = "0z1dshxzyn5zhr4xg5mvrq70jxsfkwv50achq802322y4jz52f7n";
-    version = "60.0.3112.40";
+    version = "60.0.3112.66";
   };
   dev = {
-    sha256 = "1xhv32bxiwz56gcbw47syl88a54x5gira4drh378zp8cwgh9pz4z";
+    sha256 = "1hbf7hv4934686dp0dbqy06vbwb2kq4wz5hjfdxrgafrzqac2j7g";
-    sha256bin64 = "18k3wml6yl2qghhnxb2w2d0k2397i0829nk0sqc38qz2sjbbvzna";
+    sha256bin64 = "1gg1a3k80qncr7dpw9gycndv52396cqyq9zfmzf6c4njpn2khjfv";
-    version = "61.0.3135.4";
+    version = "61.0.3153.4";
   };
   stable = {
-    sha256 = "1naqlxz9w07nlnwxkmxwf9jnxvmagj88xcjqh9r873a26wsypyl3";
+    sha256 = "0w1i4q7w5lcajc18jrchrhhm00x0jzm846l5x7a5rcp3baawkjrp";
-    sha256bin64 = "1h086irdsjs27n7ch54hy7zbiypc4swr8wnxjha1q39wc1bpc7hl";
+    sha256bin64 = "1naq20508qjm9hlwlpj686a0lawca58rnr35ws2gh2gsyxrxnmx1";
-    version = "59.0.3071.109";
+    version = "59.0.3071.115";
   };
 }

pkgs/applications/networking/instant-messengers/qtox/default.nix

@@ -1,8 +1,9 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, pkgconfig, openal, opencv,
+{ mkDerivation, lib, fetchFromGitHub, cmake, pkgconfig,
-  libtoxcore, libsodium, libXScrnSaver, glib, gdk_pixbuf, gtk2, cairo, xorg,
+  libtoxcore,
-  pango, atk, qrencode, ffmpeg, filter-audio,
+  libpthreadstubs, libXdmcp, libXScrnSaver,
-  qtbase, qtsvg, qttools, qttranslations, sqlcipher,
+  qtbase, qtsvg, qttools, qttranslations,
-  libvpx, libopus }:
+  atk, cairo, ffmpeg, filter-audio, gdk_pixbuf, glib, gtk2, libsodium, libopus,
+  libvpx, openal, opencv, pango, pcre, qrencode, sqlcipher }:
 
 mkDerivation rec {
   name = "qtox-${version}";
@@ -16,14 +17,12 @@ mkDerivation rec {
   };
 
   buildInputs = [
-    libtoxcore openal opencv libsodium filter-audio
+    libtoxcore
-    qtbase qttools qtsvg libXScrnSaver glib gtk2 cairo
+    libpthreadstubs libXdmcp libXScrnSaver
-    pango atk qrencode ffmpeg qttranslations
+    qtbase qtsvg qttools qttranslations
-    sqlcipher
+    atk cairo ffmpeg filter-audio gdk_pixbuf glib gtk2 libopus libsodium
-    libopus libvpx
+    libvpx openal opencv pango pcre qrencode sqlcipher
-  ] ++ (with xorg; [
+  ];
-    libpthreadstubs libXdmcp
-  ]);
 
   nativeBuildInputs = [ cmake pkgconfig ];
 

pkgs/applications/networking/owncloud-client/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "owncloud-client-${version}";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "https://download.owncloud.com/desktop/stable/owncloudclient-${version}.tar.xz";
-    sha256 = "051rky4rpm73flxxkhfdxqq23ncnk4ixhscbg74w82sa4d93f54k";
+    sha256 = "02az9wq0d1vsgcdipddipdjwj2faf7jag8hizwd0ha3sjlmrs6d1";
   };
 
   nativeBuildInputs = [ pkgconfig cmake ];

pkgs/applications/networking/sync/rclone/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "rclone-${version}";
-  version = "1.36";
+  version = "1.37";
 
   goPackagePath = "github.com/ncw/rclone";
 
@@ -10,9 +10,15 @@ buildGoPackage rec {
     owner = "ncw";
     repo = "rclone";
     rev = "v${version}";
-    sha256 = "1vx75ihg2j0chml8hwvngjkjw647cai9gicfy8ss6xsrm46w59b3";
+    sha256 = "0krmdwzl4c68vxpbycqy2xba8vvqbka7xh3k2q6ldxsd8y2rypym";
   };
 
+  outputs = [ "bin" "out" "man" ];
+
+  postInstall = ''
+    install -D -m644 $src/rclone.1 $man/share/man/man1/rclone.1
+  '';
+
   meta = with stdenv.lib; {
     description = "Command line program to sync files and directories to and from major cloud storage";
     homepage = "http://rclone.org";

pkgs/applications/networking/sync/rsync/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [libiconv zlib popt] ++ stdenv.lib.optional enableACLs acl;
   nativeBuildInputs = [perl];
 
-  configureFlags = ["--with-nobody-group=nogroup" "--without-included-zlib"];
+  configureFlags = ["--with-nobody-group=nogroup"];
 
   meta = base.meta // {
     description = "A fast incremental file transfer utility";

pkgs/applications/science/logic/boolector/default.nix

@@ -1,48 +1,23 @@
-{ stdenv, fetchurl, zlib, useV16 ? false }:
+{ stdenv, fetchurl }:
 
-let
+stdenv.mkDerivation rec {
-  v15 = rec {
   name    = "boolector-${version}";
-    version = "1.5.118";
+  version = "2.4.1";
   src = fetchurl {
-      url    = "http://fmv.jku.at/boolector/${name}-with-sat-solvers.tar.gz";
+    url    = "http://fmv.jku.at/boolector/boolector-${version}-with-lingeling-bbc.tar.bz2";
-      sha256 = "17j7q02rryvfwgvglxnhx0kv8hxwy8wbhzawn48lw05i98vxlmk9";
+    sha256 = "0mdf7hwix237pvknvrpazcx6s3ininj5k7vhysqjqgxa7lxgq045";
   };
-  };
-
-  v16 = rec {
-    name    = "boolector-${version}";
-    version = "1.6.0";
-    src = fetchurl {
-      url    = "http://fmv.jku.at/boolector/${name}-with-sat-solvers.tar.gz";
-      sha256 = "0jka4r6bc3i24axgdp6qbq6gjadwz9kvi11s2c5sbwmdnjd7cp85";
-    };
-  };
-
-  boolectorPkg = if useV16 then v16 else v15;
-  license = with stdenv.lib.licenses; if useV16 then unfreeRedistributable else gpl3;
-in
-stdenv.mkDerivation (boolectorPkg // {
-  buildInputs = [
-    zlib zlib.static (stdenv.lib.getOutput "static" stdenv.cc.libc)
-  ];
-
-  enableParallelBuilding = false;
 
   installPhase = ''
-    mkdir -p $out/bin $out/lib $out/include
+    mkdir $out
-    cp boolector/boolector      $out/bin
+    mv boolector/bin $out
-    cp boolector/deltabtor      $out/bin
-    cp boolector/synthebtor     $out/bin
-    cp boolector/libboolector.a $out/lib
-    cp boolector/boolector.h    $out/include
   '';
 
   meta = {
-    inherit license;
+    license = stdenv.lib.licenses.unfreeRedistributable;
     description = "An extremely fast SMT solver for bit-vectors and arrays";
     homepage    = "http://fmv.jku.at/boolector";
     platforms   = stdenv.lib.platforms.linux;
     maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
   };
-})
+}

pkgs/applications/science/medicine/aliza/default.nix

@@ -0,0 +1,52 @@
+{ stdenv, fetchurl, rpmextract, makeWrapper, patchelf, qt4, zlib, libX11, libXt, libSM, libICE, libXext, mesa }:
+
+with stdenv.lib;
+stdenv.mkDerivation {
+  name = "aliza";
+  src = fetchurl {
+    # Hosted on muoniurn's google drive
+    url = "https://drive.google.com/uc?export=download&id=0B0s_Yf4jjfZ4WUJaSERHN3FsNFE";
+    sha256 = "1nfp3ghjnfxmxiclg76gcn7a3mhvi6h7s5wmd9v9l6w8lfq9vj5h";
+    name = "aliza.rpm";
+  };
+
+  buildInputs = [ rpmextract makeWrapper ];
+
+  unpackCmd = "rpmextract $curSrc";
+
+  patchPhase = ''
+    sed -i 's/^Exec.*$/Exec=aliza %F/' share/applications/aliza.desktop
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r bin share $out
+
+    runHook postInstall
+  '';
+
+  postInstall = let
+    libs = stdenv.lib.makeLibraryPath [ qt4 zlib stdenv.cc.cc libSM libICE libX11 libXext libXt mesa ];
+  in ''
+    ${patchelf}/bin/patchelf \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      $out/bin/aliza
+
+    ${patchelf}/bin/patchelf \
+      --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      $out/bin/aliza-vtkvol
+
+    wrapProgram $out/bin/aliza \
+      --prefix LD_LIBRARY_PATH : ${libs}
+
+    wrapProgram $out/bin/aliza-vtkvol \
+      --prefix LD_LIBRARY_PATH : ${libs}
+  '';
+
+  meta = {
+    description = "Medical imaging software with 2D, 3D and 4D capabilities";
+    homepage = "http://www.aliza-dicom-viewer.com";
+    license = licenses.unfreeRedistributable;
+    maintainers = with maintainers; [ mounium ];
+  };
+}

pkgs/applications/science/misc/root/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "root-${version}";
-  version = "6.10.00";
+  version = "6.10.02";
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "1rxqcpqf1b3sxig5xbh3mkvarhg9lgj2f0gv0j48klfw8kgfwlsp";
+    sha256 = "1ryp9397xpbnxha6s222c10pa50lf2qf5s35n31lc29s90p8s9kc";
   };
 
   buildInputs = [ cmake pcre pkgconfig python2 zlib libxml2 lzma gsl ]

pkgs/applications/version-management/blackbox/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "1.20170611";
+  pname   = "blackbox";
+  name    = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner  = "stackexchange";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "1jnzhlj54c0szw9l9wib07i2375pbm402bx9wagspcmwc0qw43p6";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin && cp -r bin/* $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Safely store secrets in a VCS repo";
+    maintainers = with maintainers; [ ericsagnes ];
+    license     = licenses.mit;
+    platforms   = platforms.all;
+  };
+}

pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "diff-so-fancy-${version}";
-  version = "0.11.4";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "so-fancy";
     repo = "diff-so-fancy";
     rev = "v${version}";
-    sha256 = "1za2rm8jzcdc6bkpl198nrqf5bc05nw53vlkk15nmmb9snnb69ig";
+    sha256 = "0wd9npcfp41ggvddrbif8qr25pm7jlzxzd3xn5rlq0y0frwx5akj";
   };
 
   # Perl is needed here for patchShebangs
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     # itself, so we are copying executable to lib, and only symlink it
     # from bin/
     cp diff-so-fancy $out/lib/diff-so-fancy
-    cp -r libexec $out/lib/diff-so-fancy
+    cp -r lib $out/lib/diff-so-fancy
     ln -s $out/lib/diff-so-fancy/diff-so-fancy $out/bin
 
     # ncurses is needed for `tput`
@@ -43,5 +43,6 @@ stdenv.mkDerivation rec {
       diff-so-fancy builds on the good-lookin' output of git contrib's
       diff-highlight to upgrade your diffs' appearances.
     '';
+    maintainers = with maintainers; [ fpletz ];
   };
 }

pkgs/applications/video/handbrake/handbrake-0.10.3-nolibav.patch

@@ -1,76 +0,0 @@
-From 75549414927212d4d1666730133805b33447de79 Mon Sep 17 00:00:00 2001
-From: John Stebbins <jstebbins.hb@gmail.com>
-Date: Tue, 3 Nov 2015 10:16:01 -0800
-Subject: [PATCH] muxavformat: add support for mp4 fallback audio signalling
-
----
-diff --git a/libhb/muxavformat.c b/libhb/muxavformat.c
-index 0d70597..373c2ab 100644
---- a/libhb/muxavformat.c
-+++ b/libhb/muxavformat.c
-@@ -121,7 +121,7 @@ static int avformatInit( hb_mux_object_t * m )
-     hb_mux_data_t * track;
-     int meta_mux;
-     int max_tracks;
--    int ii, ret;
-+    int ii, jj, ret;
- 
-     int clock_min, clock_max, clock;
-     hb_video_framerate_get_limits(&clock_min, &clock_max, &clock);
-@@ -589,6 +589,56 @@ static int avformatInit( hb_mux_object_t * m )
-         }
-     }
- 
-+    // Check for audio track associations
-+    for (ii = 0; ii < hb_list_count(job->list_audio); ii++)
-+    {
-+        audio = hb_list_item(job->list_audio, ii);
-+        switch (audio->config.out.codec & HB_ACODEC_MASK)
-+        {
-+            case HB_ACODEC_FFAAC:
-+            case HB_ACODEC_CA_AAC:
-+            case HB_ACODEC_CA_HAAC:
-+            case HB_ACODEC_FDK_AAC:
-+            case HB_ACODEC_FDK_HAAC:
-+                break;
-+
-+            default:
-+            {
-+                // Mark associated fallback audio tracks for any non-aac track
-+                for(jj = 0; jj < hb_list_count( job->list_audio ); jj++ )
-+                {
-+                    hb_audio_t    * fallback;
-+                    int             codec;
-+
-+                    if (ii == jj) continue;
-+
-+                    fallback = hb_list_item( job->list_audio, jj );
-+                    codec = fallback->config.out.codec & HB_ACODEC_MASK;
-+                    if (fallback->config.in.track == audio->config.in.track &&
-+                        (codec == HB_ACODEC_FFAAC ||
-+                         codec == HB_ACODEC_CA_AAC ||
-+                         codec == HB_ACODEC_CA_HAAC ||
-+                         codec == HB_ACODEC_FDK_AAC ||
-+                         codec == HB_ACODEC_FDK_HAAC))
-+                    {
-+                        hb_mux_data_t * fallback_track;
-+                        int           * sd;
-+
-+                        track = audio->priv.mux_data;
-+                        fallback_track = fallback->priv.mux_data;
-+                        sd = (int*)av_stream_new_side_data(track->st,
-+                                                     AV_PKT_DATA_FALLBACK_TRACK,
-+                                                     sizeof(int));
-+                        if (sd != NULL)
-+                        {
-+                            *sd = fallback_track->st->index;
-+                        }
-+                    }
-+                }
-+            } break;
-+        }
-+    }
-+
-     char * subidx_fmt =
-         "size: %dx%d\n"
-         "org: %d, %d\n"

pkgs/applications/video/mpv/default.nix

@@ -33,6 +33,7 @@
 , vaapiSupport       ? true,  libva         ? null
 , drmSupport         ? !stdenv.isDarwin,  libdrm        ? null
 , vapoursynthSupport ? false, vapoursynth   ? null
+, archiveSupport     ? false, libarchive    ? null
 , jackaudioSupport   ? false, libjack2      ? null
 
 # scripts you want to be loaded by default
@@ -65,6 +66,7 @@ assert libpngSupport      -> available libpng;
 assert youtubeSupport     -> available youtube-dl;
 assert vapoursynthSupport -> available vapoursynth;
 assert jackaudioSupport   -> available libjack2;
+assert archiveSupport     -> available libarchive;
 assert vaapiSupport       -> available libva;
 assert drmSupport         -> available libdrm;
 
@@ -79,13 +81,13 @@ let
   };
 in stdenv.mkDerivation rec {
   name = "mpv-${version}";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "mpv-player";
     repo  = "mpv";
     rev    = "v${version}";
-    sha256 = "16r3fyq472hzxnh6g3gm520pmw1ybslaki3pqjm2d9jnd2md1pa5";
+    sha256 = "0d9pvsknjqmxj907y85fxh9xcbb5dafw2bh7rpwhgs9x4wdrbvv0";
   };
 
   patchPhase = ''
@@ -101,6 +103,9 @@ in stdenv.mkDerivation rec {
     "--disable-libmpv-static"
     "--disable-static-build"
     "--disable-build-date" # Purity
+    (enableFeature archiveSupport "libarchive")
+    (enableFeature dvdreadSupport "dvdread")
+    (enableFeature dvdnavSupport "dvdnav")
     (enableFeature vaapiSupport "vaapi")
     (enableFeature waylandSupport "wayland")
   ];
@@ -136,6 +141,7 @@ in stdenv.mkDerivation rec {
     ++ optional vaapiSupport       libva
     ++ optional drmSupport         libdrm
     ++ optional vapoursynthSupport vapoursynth
+    ++ optional archiveSupport     libarchive
     ++ optionals dvdnavSupport     [ libdvdnav libdvdnav.libdvdread ]
     ++ optionals x11Support        [ libX11 libXext mesa libXxf86vm ]
     ++ optionals waylandSupport    [ wayland libxkbcommon ];
@@ -154,7 +160,7 @@ in stdenv.mkDerivation rec {
     ln -s ${freefont_ttf}/share/fonts/truetype/FreeSans.ttf $out/share/mpv/subfont.ttf
     # Ensure youtube-dl is available in $PATH for MPV
     wrapProgram $out/bin/mpv \
-      --add-flags "--script=${concatStringsSep "," scripts}" \
+      --add-flags "--scripts=${concatStringsSep "," scripts}" \
   '' + optionalString youtubeSupport ''
       --prefix PATH : "${youtube-dl}/bin" \
   '' + optionalString vapoursynthSupport ''

pkgs/applications/virtualization/bochs/default.nix

@@ -1,11 +1,10 @@
-{ stdenv, fetchurl, config
+{ stdenv, fetchurl
 , pkgconfig, libtool
 , gtk2, mesa, readline, libX11, libXpm
 , docbook_xml_dtd_45, docbook_xsl
 , sdlSupport ? true, SDL2 ? null
-, termSupport ? true , ncurses ? null
+, termSupport ? true, ncurses ? null
 , wxSupport ? true, wxGTK ? null
-# Optional, undocumented dependencies
 , wgetSupport ? false, wget ? null
 , curlSupport ? false, curl ? null
 }:
@@ -16,58 +15,17 @@ assert wxSupport -> (gtk2 != null && wxGTK != null);
 assert wgetSupport -> (wget != null);
 assert curlSupport -> (curl != null);
 
+with stdenv.lib;
 stdenv.mkDerivation rec {
 
   name = "bochs-${version}";
-  version = "2.6.8";
+  version = "2.6.9";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/bochs/bochs/${version}/${name}.tar.gz";
-    sha256 = "1kl5cmbz6qgg33j5vv9898nzdppp1rqgy24r5pv762aaj7q0ww3r";
+    sha256 = "1379cq4cnfprhw8mgh60i0q9j8fz8d7n3d5fnn2g9fdiv5znfnzf";
   };
 
-  # The huge list of configurable options
-  # Blatantly based on ffmpeg expressions
-
-  termSupport = config.bochs.termSupport or true;
-  sdlSupport = config.bochs.sdlSupport or true;
-  wxSupport = config.bochs.wxSupport or false;
-  largefile = config.bochs.largefile or true;
-  idleHack = config.bochs.idleHack or true;
-  plugins = config.bochs.plugins or false; # Warning! Broken
-  a20Pin = config.bochs.a20Pin or true;
-  emulate64Bits = config.bochs.emulate64Bits or false;
-  smp = config.bochs.smp or false;
-  largeRamfile = config.bochs.largeRamfile or true;
-  repeatSpeedups = config.bochs.repeatSpeedups or false;
-  handlersChaining = config.bochs.handlersChaining or false;
-  traceLinking = config.bochs.traceLinking or false;
-  configurableMSRegs = config.bochs.configurableMSRegs or false;
-  showIPS = config.bochs.showIPS or true;
-  debugger = config.bochs.debugger or false;
-  disasm = config.bochs.disasm or false;
-  debuggerGui = config.bochs.debuggerGui or false;
-  gdbStub = config.bochs.gdbStub or false;
-  IODebug = config.Bochs.IODebug or false;
-  fpu = config.bochs.fpu or true;
-  svm = config.bochs.svm or false;
-  avx = config.bochs.avx or false;
-  evex = config.bochs.evex or false;
-  x86Debugger = config.bochs.x86Debugger or false;
-  pci = config.bochs.pci or true;
-  uhci = config.bochs.uhci or false;
-  ohci = config.bochs.ohci or false;
-  ne2k = config.bochs.ne2k or true;
-  pNIC = config.bochs.pNIC or true;
-  e1000 = config.bochs.e1000 or true;
-  clgd54xx = config.bochs.clgd54xx or true;
-  voodoo = config.bochs.voodoo or true;
-  cdrom = config.bochs.cdrom or true;
-  sb16 = config.bochs.sb16 or true;
-  es1370 = config.bochs.es1370 or true;
-  gameport = config.bochs.gameport or true;
-  busMouse = config.bochs.busMouse or false;
-
   buildInputs = with stdenv.lib;
   [ pkgconfig libtool gtk2 mesa readline libX11 libXpm docbook_xml_dtd_45 docbook_xsl ]
   ++ optionals termSupport [ ncurses ]
@@ -83,7 +41,6 @@ stdenv.mkDerivation rec {
     "--with-rfb=no"
     "--with-vncsrv=no"
     "--with-svga=no" # it doesn't compile on NixOS
-    "--with-wx=no"
 
     # These will always be "yes" on NixOS
     "--enable-ltdl-install=yes"
@@ -100,69 +57,69 @@ stdenv.mkDerivation rec {
 
     # Dangerous options - they are marked as "incomplete/experimental" on Bochs documentation
     "--enable-3dnow=no"
-    "--enable-usb-xhci=no"
     "--enable-monitor-mwait=no"
     "--enable-raw-serial=no" ]
     # Boolean flags
-    ++ stdenv.lib.optional termSupport "--with-term"
+    ++ optionals termSupport [ "--with-term" ]
-    ++ stdenv.lib.optional sdlSupport "--with-sdl2"
+    ++ optionals sdlSupport [ "--with-sdl2" ]
-    ++ stdenv.lib.optional wxSupport "--with-wx"
+    ++ optionals wxSupport [ "--with-wx" ]
-    ++ stdenv.lib.optional largefile "--enable-largefile"
+    # These are completely configurable, and they don't depend of external tools
-    ++ stdenv.lib.optional idleHack "--enable-idle-hack"
+    ++ [ "--enable-cpu-level=6" # from 3 to 6
-    ++ stdenv.lib.optional plugins "--enable-plugins"
+         "--enable-largefile"
-    ++ stdenv.lib.optional a20Pin "--enable-a20-pin"
+         "--enable-idle-hack"
-    ++ stdenv.lib.optional emulate64Bits "--enable-x86-64"
+         "--enable-plugins=no" # Plugins are a bit buggy in Bochs
-    ++ stdenv.lib.optional smp "--enable-smp"
+         "--enable-a20-pin"
-    ++ stdenv.lib.optional largeRamfile "--enable-large-ramfile"
+         "--enable-x86-64"
-    ++ stdenv.lib.optional repeatSpeedups "--enable-repeat-speedups"
+         "--enable-smp"
-    ++ stdenv.lib.optional handlersChaining "--enable-handlers-chaining"
+         "--enable-large-ramfile"
-    ++ stdenv.lib.optional traceLinking "--enable-trace-linking"
+         "--enable-repeat-speedups"
-    ++ stdenv.lib.optional configurableMSRegs "--enable-configurable-msrs"
+         "--enable-handlers-chaining"
-    ++ stdenv.lib.optional showIPS "--enable-show-ips"
+         "--enable-trace-linking"
-    ++ stdenv.lib.optional debugger "--enable-debugger"
+         "--enable-configurable-msrs"
-    ++ stdenv.lib.optional disasm "--enable-disasm"
+         "--enable-show-ips"
-    ++ stdenv.lib.optional debuggerGui "--enable-debugger-gui"
+         "--enable-debugger" #conflicts with gdb-stub option
-    ++ stdenv.lib.optional gdbStub "--enable-gdb-stub"
+         "--enable-disasm"
-    ++ stdenv.lib.optional IODebug "--enable-iodebug"
+         "--enable-debugger-gui"
-    ++ stdenv.lib.optional fpu "--enable-fpu"
+         "--enable-gdb-stub=no" # conflicts with debugger option
-    ++ stdenv.lib.optional svm "--enable-svm"
+         "--enable-iodebug"
-    ++ stdenv.lib.optional avx "--enable-avx"
+         "--enable-fpu"
-    ++ stdenv.lib.optional evex "--enable-evex"
+         "--enable-svm"
-    ++ stdenv.lib.optional x86Debugger "--enable-x86-debugger"
+         "--enable-avx"
-    ++ stdenv.lib.optional pci "--enable-pci"
+         "--enable-evex"
-    ++ stdenv.lib.optional uhci "--enable-usb"
+         "--enable-x86-debugger"
-    ++ stdenv.lib.optional ohci "--enable-usb-ohci"
+         "--enable-pci"
-    ++ stdenv.lib.optional ne2k "--enable-ne2000"
+         "--enable-usb"
-    ++ stdenv.lib.optional pNIC "--enable-pnic"
+         "--enable-usb-ohci"
-    ++ stdenv.lib.optional e1000 "--enable-e1000"
+         "--enable-usb-ehci"
-    ++ stdenv.lib.optional clgd54xx "--enable-clgd54xx"
+         "--enable-usb-xhci"
-    ++ stdenv.lib.optional voodoo "--enable-voodoo"
+         "--enable-ne2000"
-    ++ stdenv.lib.optional cdrom "--enable-cdrom"
+         "--enable-pnic"
-    ++ stdenv.lib.optional sb16 "--enable-sb16"
+         "--enable-e1000"
-    ++ stdenv.lib.optional es1370 "--enable-es1370"
+         "--enable-clgd54xx"
-    ++ stdenv.lib.optional busMouse "--enable-busmouse"
+         "--enable-voodoo"
-    ;
+         "--enable-cdrom"
+         "--enable-sb16"
+         "--enable-es1370"
+         "--enable-busmouse" ];
 
   NIX_CFLAGS_COMPILE="-I${gtk2.dev}/include/gtk-2.0/ -I${libtool}/include/";
   NIX_LDFLAGS="-L${libtool.lib}/lib";
 
   hardeningDisable = [ "format" ];
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "An open-source IA-32 (x86) PC emulator";
     longDescription = ''
-    Bochs is an open-source (LGPL), highly portable IA-32 PC emulator,
+      Bochs is an open-source (LGPL), highly portable IA-32 PC emulator, written
-    written in C++, that runs on most popular platforms. It includes
+      in C++, that runs on most popular platforms. It includes emulation of the
-    emulation of the Intel x86 CPU, common I/O devices, and a custom
+      Intel x86 CPU, common I/O devices, and a custom BIOS.
-    BIOS.
     '';
     homepage = http://bochs.sourceforge.net/;
     license = licenses.lgpl2Plus;
     maintainers = [ maintainers.AndersonTorres ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
-
+# TODO: plugins
-# TODO: study config.bochs.* implementation (like config.ffmpeg.* options)
+# TODO: svga support - the Bochs sources explicitly cite /usr/include/vga.h
-# TODO: investigate the wxWidgets problem (maybe upstream devteam didn't update wxGTK GUI)
+# TODO: a better way to organize the options
-# TODO: investigate svga support - the Bochs sources explicitly cite /usr/include/svga.h

pkgs/applications/virtualization/docker/default.nix

@@ -137,8 +137,8 @@ rec {
       echo "Generate man pages from cobra"
       cd ./components/cli
       mkdir -p ./man/man1
-      go build -o /tmp/gen-manpages github.com/docker/cli/man
+      go build -o ./gen-manpages github.com/docker/cli/man
-      /tmp/gen-manpages --root . --target ./man/man1
+      ./gen-manpages --root . --target ./man/man1
 
       # Generate legacy pages from markdown
       echo "Generate legacy manpages"

pkgs/build-support/fetchzip/default.nix

@@ -23,7 +23,6 @@ lib.overrideDerivation (fetchurl ({
   postFetch =
     ''
       export PATH=${unzip}/bin:$PATH
-      mkdir $out
 
       unpackDir="$TMPDIR/unpack"
       mkdir "$unpackDir"
@@ -32,8 +31,6 @@ lib.overrideDerivation (fetchurl ({
       renamed="$TMPDIR/${baseNameOf url}"
       mv "$downloadedFile" "$renamed"
       unpackFile "$renamed"
-
-      shopt -s dotglob
     ''
     + (if stripRoot then ''
       if [ $(ls "$unpackDir" | wc -l) != 1 ]; then
@@ -43,12 +40,11 @@ lib.overrideDerivation (fetchurl ({
       fi
       fn=$(cd "$unpackDir" && echo *)
       if [ -f "$unpackDir/$fn" ]; then
-        mv "$unpackDir/$fn" "$out"
+        mkdir $out
-      else
-        mv "$unpackDir/$fn"/* "$out/"
       fi
+      mv "$unpackDir/$fn" "$out"
     '' else ''
-      mv "$unpackDir"/* "$out/"
+      mv "$unpackDir" "$out"
     '') #*/
     + extraPostFetch;
 } // removeAttrs args [ "stripRoot" "extraPostFetch" ]))

pkgs/data/fonts/emacs-all-the-icons-fonts/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "emacs-all-the-icons-fonts-${version}";
-  version = "2.6.4";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "domtronn";
     repo = "all-the-icons.el";
     rev = version;
-    sha256 = "0xwj8wyj0ywpy4rcqxz15hkr8jnffn7nrp5fnq56j360v8858q8x";
+    sha256 = "0h8a2jvn2wfi3bqd35scmhm8wh20mlk09sy68m1whi9binzkm8rf";
   };
 
   installPhase = ''

pkgs/data/icons/papirus-icon-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "papirus-icon-theme-${version}";
-  version = "20170616";
+  version = "20170715";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = "papirus-icon-theme";
     rev = "${version}";
-    sha256 = "008nkmxp3f9qqljif3v9ns3a8mflzffv2mm5zgjng9pmdl5x70j4";
+    sha256 = "0mpmgpjwc7azhypvrlnxaa0c4jc6g7vgy242apxrn8jcv9ndmwyk";
   };
 
   dontBuild = true;

pkgs/desktops/enlightenment/econnman.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, efl, python2Packages, dbus, makeWrapper }:
+{ stdenv, fetchurl, pkgconfig, efl, python2Packages, dbus, curl, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "econnman-${version}";
@@ -11,12 +11,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper pkgconfig python2Packages.wrapPython ];
 
-  buildInputs = [ efl python2Packages.python dbus ];
+  buildInputs = [ efl python2Packages.python dbus curl ];
 
   pythonPath = [ python2Packages.pythonefl python2Packages.dbus-python ];
 
   postInstall = ''
     wrapPythonPrograms
+    wrapProgram $out/bin/econnman-bin --prefix LD_LIBRARY_PATH : ${curl.out}/lib
   '';
 
   meta = {

pkgs/desktops/enlightenment/ephoto.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, efl }:
+{ stdenv, fetchurl, pkgconfig, efl, curl, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "ephoto-${version}";
@@ -9,13 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "0l6zrk22fap6pylmzxwp6nycy8l5wdc7jza890h4zrwmpfag8w31";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
-    pkgconfig
-  ];
 
-  buildInputs = [
+  buildInputs = [ efl curl ];
-    efl
- ];
 
   NIX_CFLAGS_COMPILE = [
     "-I${efl}/include/ecore-con-1"
@@ -29,6 +25,10 @@ stdenv.mkDerivation rec {
     "-I${efl}/include/ethumb-client-1"
   ];
 
+  postInstall = ''
+    wrapProgram $out/bin/ephoto --prefix LD_LIBRARY_PATH : ${curl.out}/lib
+  '';
+
   meta = {
     description = "Image viewer and editor written using the Enlightenment Foundation Libraries";
     homepage = http://smhouston.us/ephoto/;

pkgs/desktops/enlightenment/rage.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, efl, gst_all_1, wrapGAppsHook }:
+{ stdenv, fetchurl, pkgconfig, efl, gst_all_1, curl, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "rage-${version}";
@@ -21,6 +21,7 @@ stdenv.mkDerivation rec {
     gst_all_1.gst-plugins-good
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-libav
+    curl
  ];
 
   NIX_CFLAGS_COMPILE = [
@@ -38,6 +39,10 @@ stdenv.mkDerivation rec {
     "-I${efl}/include/ethumb-client-1"
   ];
 
+  postInstall = ''
+    wrapProgram $out/bin/rage --prefix LD_LIBRARY_PATH : ${curl.out}/lib
+  '';
+
   meta = {
     description = "Video + Audio player along the lines of mplayer";
     homepage = http://enlightenment.org/;

pkgs/desktops/enlightenment/terminology.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, efl }:
+{ stdenv, fetchurl, pkgconfig, efl, curl, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "terminology-${version}";
@@ -9,9 +9,9 @@ stdenv.mkDerivation rec {
     sha256 = "1x4j2q4qqj10ckbka0zaq2r2zm66ff1x791kp8slv1ff7fw45vdz";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
 
-  buildInputs = [ efl ];
+  buildInputs = [ efl curl ];
 
   NIX_CFLAGS_COMPILE = [
     "-I${efl}/include/ecore-con-1"
@@ -22,6 +22,12 @@ stdenv.mkDerivation rec {
     "-I${efl}/include/ethumb-1"
   ];
 
+  postInstall = ''
+    for f in $out/bin/*; do
+      wrapProgram $f --prefix LD_LIBRARY_PATH : ${curl.out}/lib
+    done
+  '';
+
   meta = {
     description = "The best terminal emulator written with the EFL";
     homepage = http://enlightenment.org/;

pkgs/desktops/gnome-3/extensions/topicons-plus/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-shell-extension-topicons-plus-${version}";
-  version = "v20";
+  version = "20";
 
   src = fetchFromGitHub {
     owner = "phocean";

pkgs/development/compilers/openjdk/8.nix

@@ -21,42 +21,42 @@ let
     else
       throw "openjdk requires i686-linux or x86_64 linux";
 
-  update = "131";
+  update = "141";
-  build = "11";
+  build = "15";
   baseurl = "http://hg.openjdk.java.net/jdk8u/jdk8u";
   repover = "jdk8u${update}-b${build}";
   paxflags = if stdenv.isi686 then "msp" else "m";
   jdk8 = fetchurl {
              url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = "1k401wsickbdy50yxjd26v8qm9519kxayaj3b103cr6ygp2rd9s6";
+             sha256 = "0b2nf1x2wcjn0ijyxhnrhcap4vq43sbblh5kf0qcqmx83cs3z6yh";
           };
   langtools = fetchurl {
              url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = "1qj75bb17a9czvxz7rm246w97cavglrssx0l1mkbickx0i0wamm8";
+             sha256 = "1mirjjywv7mnirrxj5sx3zg6j2864vjvphkn9mxx1pad49by7157";
           };
   hotspot = fetchurl {
              url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = "0kh8rk5y3n4g3hyjzflc8nwc0kyakjivpwlpj1bncsm1sykw8lr8";
+             sha256 = "0hhvsrclx58i7ns2v7la2wncnndblppwjncniwcvhnhgl5zhpp31";
           };
   corba = fetchurl {
              url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = "0gqa58mwwyf6mbgp48j1akv1y8yq55zpwfziqrbdbpkcsaf603n7";
+             sha256 = "1brr72rlpaz70ihymdyp808vw433cr8b11l5qdc76aic2ywbwjyp";
           };
   jdk = fetchurl {
              url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = "0ymvvi7srr9qkss20s1yg3x2mjw178bscrnxa6s8y82gsw02y820";
+             sha256 = "1d4q531jswzk00kdskzfkgr0f4qmxpc7pg9w8p1gq84yz93wz11k";
           };
   jaxws = fetchurl {
              url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = "0507mxvir4s536pdz45pvmahwa6s3h2yhg6rwdzrb568ab06asmi";
+             sha256 = "0haw5095p45w33m8pafnp5r5j2lif8c1271chad5sp4gbbk40ai4";
           };
   jaxp = fetchurl {
              url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = "0igbg8axk028kqs9q11m8hb5bg2fa0qcwffbpfbhilyw5gmf7cy8";
+             sha256 = "0pm2cccy31d9rnkgc2hcxbpjjhf4wbayx18qn736nncvwcwa76bj";
           };
   nashorn = fetchurl {
              url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = "0l63zm5a7ql3xvfxy5kzazq2184mpx0zyqzinjmq7v0q573g8xak";
+             sha256 = "1g05vfggjjg51dki28zby27pnd4z1b23fv9kyc3hdmc4bcj306x0";
           };
   openjdk8 = stdenv.mkDerivation {
     name = "openjdk-8u${update}b${build}";

pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix

@@ -1,9 +1,9 @@
 import ./jdk-linux-base.nix {
   productVersion = "8";
-  patchVersion = "131";
+  patchVersion = "141";
   downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
-  sha256_i686 = "0m3i1n1im1nlwb06wlsdajv19cd3zhrjkw8zbyjfznydn6qs4s80";
+  sha256_i686 = "0jq8zq7hgjqbza1wmc1s8r4iz1r1s631snacn29wdsb5i2yg4qk5";
-  sha256_x86_64 = "0dhj623ya01glcl3iir9ajifcrf6awhvpk936x9cxfj8zfyibck2";
+  sha256_x86_64 = "0kxs765dra47cw39xmifmxrib49j1lfya5cc3kldfv7azcc54784";
   sha256_armv7l = "0ja97nqn4x0ji16c7r6i9nnnj3745br7qlbj97jg1s8m2wk7f9jd";
   jceName = "jce_policy-8.zip";
   jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;

pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix

@@ -1,9 +1,9 @@
 import ./jdk-linux-base.nix {
   productVersion = "8";
-  patchVersion = "131";
+  patchVersion = "141";
   downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
-  sha256_i686 = "0m3i1n1im1nlwb06wlsdajv19cd3zhrjkw8zbyjfznydn6qs4s80";
+  sha256_i686 = "0jq8zq7hgjqbza1wmc1s8r4iz1r1s631snacn29wdsb5i2yg4qk5";
-  sha256_x86_64 = "0dhj623ya01glcl3iir9ajifcrf6awhvpk936x9cxfj8zfyibck2";
+  sha256_x86_64 = "0kxs765dra47cw39xmifmxrib49j1lfya5cc3kldfv7azcc54784";
   sha256_armv7l = "0ja97nqn4x0ji16c7r6i9nnnj3745br7qlbj97jg1s8m2wk7f9jd";
   jceName = "jce_policy-8.zip";
   jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;

pkgs/development/compilers/owl-lisp/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, coreutils }:
+
+stdenv.mkDerivation rec {
+  name    = "owl-lisp-${version}";
+  version = "0.1.14";
+
+  src = fetchFromGitHub {
+    owner  = "aoh";
+    repo   = "owl-lisp";
+    rev    = "v${version}";
+    sha256 = "1rr0icprna3zs834q1pj4xy21cql3pcfknfkqipq01rhnl2893sz";
+  };
+
+  prePatch = ''
+    substituteInPlace Makefile --replace /usr $out
+
+    for f in tests/run tests/exec.sh ; do
+      substituteInPlace $f --replace /bin/echo ${coreutils}/bin/echo
+    done
+  '';
+
+  # tests are already run as part of the compilation process
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    descripton  = "A functional lisp";
+    homepage    = https://github.com/aoh/owl-lisp;
+    license     = licenses.mit;
+    maintainers = with maintainers; [ peterhoeg ];
+  };
+}

pkgs/development/coq-modules/CoLoR/default.nix

@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, coq }:
+
+stdenv.mkDerivation {
+  name = "coq${coq.coq-version}-CoLoR-1.3.0";
+
+  src = fetchurl {
+    url = https://gforge.inria.fr/frs/download.php/file/36399/color.1.3.0.tar.gz;
+    sha256 = "0n7431mc4a5bn9fsyk5167j2vnbxz4vgggjch4pm0x58lda8mxv1";
+  };
+
+  buildInputs = [ coq ];
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    make -f Makefile.coq COQLIB=$out/lib/coq/${coq.coq-version}/ install
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://color.inria.fr/;
+    description = "CoLoR is a library of formal mathematical definitions and proofs of theorems on rewriting theory and termination whose correctness has been mechanically checked by the Coq proof assistant.";
+    maintainers = with maintainers; [ jwiegley ];
+    platforms = coq.meta.platforms;
+  };
+}

pkgs/development/coq-modules/math-classes/default.nix

@@ -1,15 +1,20 @@
-{ stdenv, fetchFromGitHub, coq }:
+{ stdenv, fetchurl, coq }:
 
 stdenv.mkDerivation {
-  name = "coq${coq.coq-version}-math-classes-2016-06-08";
+  name = "coq${coq.coq-version}-math-classes-1.0.6";
 
-  src = fetchFromGitHub {
+  src = fetchurl {
-    owner  = "math-classes";
+    url = https://github.com/math-classes/math-classes/archive/1.0.6.tar.gz;
-    repo   = "math-classes";
+    sha256 = "071hgjk4bz2ybci7dp2mw7xqmxmm2zph7kj28xcdg28iy796lf02";
-    rev    = "751e63b260bd2f78b280f2566c08a18034bd40b3";
-    sha256 = "0kjc2wzb6n9hcqb2ijx2pckn8jk5g09crrb87yb4s9m0mrw79smr";
   };
 
+  # src = fetchFromGitHub {
+  #   owner  = "math-classes";
+  #   repo   = "math-classes";
+  #   rev    = "1d426a08c2fbfd68bd1b3622fe8f31dd03712e6c";
+  #   sha256 = "3kjc2wzb6n9hcqb2ijx2pckn8jk5g09crrb87yb4s9m0mrw79smr";
+  # };
+
   buildInputs = [ coq ];
   enableParallelBuilding = true;
   installFlags = "COQLIB=$(out)/lib/coq/${coq.coq-version}/";
@@ -17,7 +22,7 @@ stdenv.mkDerivation {
   meta = with stdenv.lib; {
     homepage = https://math-classes.github.io;
     description = "A library of abstract interfaces for mathematical structures in Coq.";
-    maintainers = with maintainers; [ siddharthist ];
+    maintainers = with maintainers; [ siddharthist jwiegley ];
     platforms = coq.meta.platforms;
   };
 }

pkgs/development/haskell-modules/configuration-common.nix

@@ -274,7 +274,6 @@ self: super: {
   cabal-bounds = dontCheck super.cabal-bounds;          # http://hydra.cryp.to/build/496935/nixlog/1/raw
   cabal-meta = dontCheck super.cabal-meta;              # http://hydra.cryp.to/build/497892/log/raw
   camfort = dontCheck super.camfort;
-  cautious-file = dontCheck super.cautious-file;        # http://hydra.cryp.to/build/499730/log/raw
   cjk = dontCheck super.cjk;
   CLI = dontCheck super.CLI;                            # Upstream has no issue tracker.
   command-qq = dontCheck super.command-qq;              # http://hydra.cryp.to/build/499042/log/raw
@@ -376,7 +375,6 @@ self: super: {
   static-resources = dontCheck super.static-resources;
   strive = dontCheck super.strive;                      # fails its own hlint test with tons of warnings
   svndump = dontCheck super.svndump;
-  symengine = dontCheck super.symengine;
   tar = dontCheck super.tar; #http://hydra.nixos.org/build/25088435/nixlog/2 (fails only on 32-bit)
   th-printf = dontCheck super.th-printf;
   thumbnail-plus = dontCheck super.thumbnail-plus;
@@ -876,4 +874,7 @@ self: super: {
   # Needs a newer version of hsyslog than lts-8.x provides.
   logging-facade-syslog = super.logging-facade-syslog.override { hsyslog = self.hsyslog_5_0_1; };
 
+  # Has a dependency on outdated versions of directory.
+  cautious-file = doJailbreak (dontCheck super.cautious-file);
+
 }

pkgs/development/interpreters/elixir/1.5.nix

@@ -1,7 +1,7 @@
 { mkDerivation }:
 
 mkDerivation rec {
-  version = "1.5.0-rc.1";
+  version = "1.5.0-rc.2";
-  sha256 = "1aqbhyzwjqg57f99kwqzxkk4gjaqgwb7nmgpgdp7psa0ly742i9q";
+  sha256 = "0wfxsfz1qbb6iapg8j1qskva6j4mccxqvv79xbz08fzzb6n1wvxa";
   minimumOTPVersion = "18";
 }

pkgs/development/interpreters/jruby/default.nix

@@ -1,6 +1,9 @@
-{ stdenv, fetchurl, makeWrapper, jre }:
+{ stdenv, callPackage, fetchurl, makeWrapper, jre }:
 
-stdenv.mkDerivation rec {
+let
+# The version number here is whatever is reported by the RUBY_VERSION string
+rubyVersion = callPackage ../ruby/ruby-version.nix {} "2" "3" "3" "";
+jruby = stdenv.mkDerivation rec {
   name = "jruby-${version}";
 
   version = "9.1.12.0";
@@ -18,16 +21,42 @@ stdenv.mkDerivation rec {
      rm $out/bin/*.{bat,dll,exe,sh}
      mv $out/COPYING $out/LICENSE* $out/docs
 
-     for i in $out/bin/*; do
+     for i in $out/bin/jruby{,.bash}; do
        wrapProgram $i \
          --set JAVA_HOME ${jre}
      done
+
+     ln -s $out/bin/jruby $out/bin/ruby
+
+     # Bundler tries to create this directory
+     mkdir -pv $out/${passthru.gemPath}
+     mkdir -p $out/nix-support
+     cat > $out/nix-support/setup-hook <<EOF
+       addGemPath() {
+         addToSearchPath GEM_PATH \$1/${passthru.gemPath}
+       }
+
+       envHooks+=(addGemPath)
+     EOF
   '';
 
+  passthru = rec {
+    rubyEngine = "jruby";
+    gemPath = "lib/${rubyEngine}/gems/${rubyVersion.libDir}";
+    libPath = "lib/${rubyEngine}/${rubyVersion.libDir}";
+  };
+
   meta = {
     description = "Ruby interpreter written in Java";
     homepage = http://jruby.org/;
     license = with stdenv.lib.licenses; [ cpl10 gpl2 lgpl21 ];
     platforms = stdenv.lib.platforms.unix;
   };
-}
+};
+in jruby.overrideAttrs (oldAttrs: {
+  passthru = oldAttrs.passthru // {
+    devEnv = callPackage ../ruby/dev.nix {
+      ruby = jruby;
+    };
+  };
+})

pkgs/development/libraries/ace/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ace-${version}";
-  version = "6.4.2";
+  version = "6.4.3";
 
   src = fetchurl {
     url = "http://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "0dscvlgxy0fwma63azjkdbc85mh8k751ik67s88w6w75j0psld73";
+    sha256 = "07dvpi3abmjvg7m0aak4x82aj8cvw5zl2cqj525wd3fl6y0pn3mq";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/armadillo/default.nix

@@ -12,7 +12,12 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ openblasCompat superlu hdf5 ];
 
-  cmakeFlags = [ "-DDETECT_HDF5=ON" ];
+  cmakeFlags = let
+    libSuff = if stdenv.isDarwin then "dylib" else "so";
+  in [
+    "-DLAPACK_LIBRARY=${openblasCompat}/lib/libopenblas.${libSuff}"
+    "-DDETECT_HDF5=ON"
+  ];
 
   patches = [ ./use-unix-config-on-OS-X.patch ];
 

pkgs/development/libraries/c-ares/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "c-ares-1.12.0";
+  name = "c-ares-1.13.0";
 
   src = fetchurl {
     url = "http://c-ares.haxx.se/download/${name}.tar.gz";
-    sha256 = "1yv5ygkd813glz8hbagykgp1hlb6450chig061hr7pyw7i0gk4l6";
+    sha256 = "19qxhv9aiw903fr808y77r6l9js0fq9m3gcaqckan9jan7qhixq3";
   };
 
   meta = with stdenv.lib; {

pkgs/development/libraries/cyrus-sasl/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, openssl, kerberos, db, gettext, pam, fixDarwinDylibNames, autoreconfHook }:
+{ lib, stdenv, fetchurl, openssl, openldap, kerberos, db, gettext, pam, fixDarwinDylibNames, autoreconfHook, enableLdap ? false }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
@@ -14,6 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ openssl db gettext kerberos ]
+    ++ lib.optional enableLdap openldap
     ++ lib.optional stdenv.isFreeBSD autoreconfHook
     ++ lib.optional stdenv.isLinux pam
     ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
@@ -29,12 +30,11 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-openssl=${openssl.dev}"
-  ];
+  ] ++ lib.optional enableLdap "--with-ldap=${openldap.dev}";
 
   # Set this variable at build-time to make sure $out can be evaluated.
   preConfigure = ''
     configureFlagsArray=( --with-plugindir=$out/lib/sasl2
-                          --with-configdir=$out/lib/sasl2
                           --with-saslauthd=/run/saslauthd
                           --enable-login
                         )

pkgs/development/libraries/gsoap/default.nix

@@ -1,15 +1,28 @@
-{ stdenv, fetchurl, unzip, m4, bison, flex, openssl, zlib }:
+{ stdenv, fetchurl, autoreconfHook, unzip, m4, bison, flex, openssl, zlib }:
 
-stdenv.mkDerivation rec {
+let
+  majorVersion = "2.8";
+
+in stdenv.mkDerivation rec {
   name = "gsoap-${version}";
-  version = "2.8.42";
+  version = "${majorVersion}.49";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/gsoap2/gsoap-2.8/gsoap_${version}.zip";
+    url = "mirror://sourceforge/project/gsoap2/gsoap-${majorVersion}/gsoap_${version}.zip";
-    sha256 = "0fav4lhdibwggkf495pggmqna632jxkh6q2mi32b9hsn883pg5m7";
+    sha256 = "0414q7zabkq3iiccl2yql3vbihbr7ach9d517b37zv3mp7nhj2aj";
   };
 
-  buildInputs = [ unzip m4 bison flex openssl zlib ];
+  buildInputs = [ openssl zlib ];
+  nativeBuildInputs = [ autoreconfHook bison flex m4 unzip ];
+  # Parallel building doesn't work as of 2.8.49
+  enableParallelBuilding = false;
+
+  # Future versions of automake require subdir-objects if the source is structured this way
+  # As of 2.8.49 (maybe earlier) this is needed to silence warnings
+  prePatch = ''
+    substituteInPlace configure.ac \
+      --replace 'AM_INIT_AUTOMAKE([foreign])' 'AM_INIT_AUTOMAKE([foreign subdir-objects])'
+  '';
 
   meta = with stdenv.lib; {
     description = "C/C++ toolkit for SOAP web services and XML-based applications";
@@ -27,6 +40,6 @@ stdenv.mkDerivation rec {
     #    restrictions)
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
+    maintainers = with maintainers; [ bjornfor ];
   };
 }

pkgs/development/libraries/libmediainfo/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig, libzen, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.95";
+  version = "0.7.97";
   name = "libmediainfo-${version}";
   src = fetchurl {
     url = "http://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    sha256 = "0snrcashc5c5gcwvfh7sl7z4h523d8vxbfin3gb6g81zv43d2b23";
+    sha256 = "0rpxxbszi7i4hspdzdif9inhlwxdkf0iggaim6682clqb6pv7sld";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];

pkgs/development/libraries/libressl/2.4.nix

@@ -1,22 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "libressl-${version}";
-  version = "2.4.5";
-
-  src = fetchurl {
-    url    = "mirror://openbsd/LibreSSL/${name}.tar.gz";
-    sha256 = "0is3zqjcxxncycq44m3if6s5hiq31kpq85pxdnpm3sdfb3iw806k";
-  };
-
-  enableParallelBuilding = true;
-
-  outputs = [ "bin" "dev" "out" "man" ];
-
-  meta = with stdenv.lib; {
-    description = "Free TLS/SSL implementation";
-    homepage    = "http://www.libressl.org";
-    platforms   = platforms.all;
-    maintainers = with maintainers; [ thoughtpolice wkennington fpletz globin ];
-  };
-}

pkgs/development/libraries/libressl/2.5.nix

@@ -1,24 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "libressl-${version}";
-  version = "2.5.4";
-
-  src = fetchurl {
-    url    = "mirror://openbsd/LibreSSL/${name}.tar.gz";
-    sha256 = "1ykf6dqlbafafhbdfmcj19pjj1z6wmsq0rmyqga1i0xv5x95nyhh";
-  };
-
-  enableParallelBuilding = true;
-
-  outputs = [ "bin" "dev" "out" "man" ];
-
-  dontGzipMan = if stdenv.isDarwin then true else null; # not sure what's wrong
-
-  meta = with stdenv.lib; {
-    description = "Free TLS/SSL implementation";
-    homepage    = "http://www.libressl.org";
-    platforms   = platforms.all;
-    maintainers = with maintainers; [ thoughtpolice wkennington fpletz globin ];
-  };
-}

pkgs/development/libraries/libressl/default.nix

@@ -0,0 +1,39 @@
+{ stdenv, fetchurl }:
+
+let
+
+  generic = { version, sha256 }: stdenv.mkDerivation rec {
+    name = "libressl-${version}";
+    inherit version;
+
+    src = fetchurl {
+      url = "mirror://openbsd/LibreSSL/${name}.tar.gz";
+      inherit sha256;
+    };
+
+    enableParallelBuilding = true;
+
+    outputs = [ "bin" "dev" "out" "man" ];
+
+    dontGzipMan = if stdenv.isDarwin then true else null; # not sure what's wrong
+
+    meta = with stdenv.lib; {
+      description = "Free TLS/SSL implementation";
+      homepage    = "http://www.libressl.org";
+      platforms   = platforms.all;
+      maintainers = with maintainers; [ thoughtpolice wkennington fpletz globin ];
+    };
+  };
+
+in {
+
+  libressl_2_5 = generic {
+    version = "2.5.5";
+    sha256 = "1i77viqy1afvbr392npk9v54k9zhr9zq2vhv6pliza22b0ymwzz5";
+  };
+
+  libressl_2_6 = generic {
+    version = "2.6.0";
+    sha256 = "0lwapvfda4zj4r0kxn9ys43l5wyfgpljmhq0j1lr45spfis5b3g4";
+  };
+}

pkgs/development/libraries/libvirt/default.nix

@@ -12,11 +12,11 @@ with stdenv.lib;
 # if you update, also bump pythonPackages.libvirt or it will break
 stdenv.mkDerivation rec {
   name = "libvirt-${version}";
-  version = "3.1.0";
+  version = "3.5.0";
 
   src = fetchurl {
     url = "http://libvirt.org/sources/${name}.tar.xz";
-    sha256 = "1a9j6yqfy7i5yv414wk6nv26a5bpfyyg0rpcps6ybi6a1yd04ybq";
+    sha256 = "05mm4xdw6g960rwvc9189nhxpm1vrilnmpl4h4m1lha11pivlqr9";
   };
 
   patches = [ ./build-on-bsd.patch ];
@@ -59,6 +59,7 @@ stdenv.mkDerivation rec {
     "--with-virtualport"
     "--with-init-script=systemd+redhat"
     "--with-storage-disk"
+  ] ++ optionals (stdenv.isLinux && zfs != null) [
     "--with-storage-zfs"
   ] ++ optionals stdenv.isDarwin [
     "--with-init-script=none"

pkgs/development/libraries/libzen/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "0.4.34";
+  version = "0.4.35";
   name = "libzen-${version}";
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libzen/${version}/libzen_${version}.tar.bz2";
-    sha256 = "02krmhl6dplidz6h251ajpzzdhzzm0hp0lwwv9rgn55xjgh4yxw3";
+    sha256 = "12a1icgcffgv503ii2k1453kxg5hfly09mf4zjcc80aq8a6rf8by";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/development/libraries/lucene++/default.nix

@@ -2,33 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "lucene++-${version}";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchurl {
     url = "https://github.com/luceneplusplus/LucenePlusPlus/"
         + "archive/rel_${version}.tar.gz";
-    sha256 = "068msvh05gsbfj1wwdqj698kxxfjdqy8zb6pqvail3ayjfj94w1y";
+    sha256 = "032yb35b381ifm7wb8cy2m3yndklnxyi5cgprjh48jqy641z46bc";
   };
 
-  patches = let
-    baseurl = "https://github.com/luceneplusplus/LucenePlusPlus";
-  in [
-    (fetchpatch {
-      url = "${baseurl}/pull/62.diff";
-      sha256 = "0v314877mjb0hljg4mcqi317m1p1v27rgsgf5wdr9swix43vmhgw";
-    })
-    (fetchpatch {
-      url = "${baseurl}/commit/994f03cf736229044a168835ae7387696041658f.diff";
-      sha256 = "0fcm5b87nxw062wjd7b4qrfcwsyblmcw19s64004pklj9grk30zz";
-    })
-  ];
-
   postPatch = ''
     sed -i -e '/Subversion *REQUIRED/d' \
            -e '/include.*CMakeExternal/d' \
            CMakeLists.txt
-    # not using -f because we want it to fail for the next release
-    rm CMakeExternal.txt
   '';
 
   cmakeFlags = [ "-DGTEST_INCLUDE_DIR=${gtest}/include" ];

pkgs/development/libraries/physics/fastnlo/default.nix

@@ -1,17 +1,21 @@
-{ stdenv, fetchurl, boost, lhapdf, root, yoda }:
+{ stdenv, fetchurl, boost, fastjet, gfortran, lhapdf, python2, root, yoda, zlib }:
 
 stdenv.mkDerivation rec {
   name = "fastnlo_toolkit-${version}";
-  version = "2.3.1pre-2212";
+  version = "2.3.1pre-2402";
 
   src = fetchurl {
     url = "http://fastnlo.hepforge.org/code/v23/${name}.tar.gz";
-    sha256 = "0xgnnwc002awvz6dhn7792jc8kdff843yjgvwmgcs60yvcj6blgp";
+    sha256 = "1h41xnqcz401x3zbs8i2dsb4xlhbv8i5ps0561p6y7gcyridgcbl";
   };
 
-  buildInputs = [ boost lhapdf root yoda ];
+  buildInputs = [ boost fastjet gfortran gfortran.cc.lib lhapdf python2 root yoda ];
+  propagatedBuildInputs = [ zlib ];
 
-  CXXFLAGS="-std=c++11"; # for yoda
+  preConfigure = ''
+    substituteInPlace ./fastnlotoolkit/Makefile.in \
+      --replace "-fext-numeric-literals" ""
+  '';
 
   configureFlags = [
     "--with-yoda=${yoda}"

pkgs/development/libraries/physics/herwig/default.nix

@@ -2,31 +2,21 @@
 
 stdenv.mkDerivation rec {
   name = "herwig-${version}";
-  version = "7.0.4";
+  version = "7.1.1";
 
   src = fetchurl {
     url = "http://www.hepforge.org/archive/herwig/Herwig-${version}.tar.bz2";
-    sha256 = "1vac5y5cyyn1z1ii1a6x1ysx2znxmfq9a51gxqib0i19mrn5y9p6";
+    sha256 = "13xaykwr7x6mp2bi22wz6dyzx3dxhcv6aw9cg8p29bh9l890g63j";
   };
 
-  patches = [
-    # Otherwise it causes an error
-    # lib/Herwig/HwMatchboxScales.so: undefined symbol: _Z8renScaleSt6vectorIN6ThePEG14Lorentz5VectorIdEESaIS2_EES4_S4_
-    (fetchpatch {
-      url = "https://herwig.hepforge.org/hg/herwig/rev/fe543583fa02?style=raw";
-      sha256 = "1y6a9q93wicw3c73xni74w5k25vidgcr60ffi2b2ymhb390jas83";
-    })
-  ];
-
   nativeBuildInputs = [ autoconf automake libtool ];
 
   buildInputs = [ boost fastjet gfortran gsl thepeg zlib ]
     # There is a bug that requires for MMHT PDF's to be presend during the build
     ++ (with lhapdf.pdf_sets; [ MMHT2014lo68cl MMHT2014nlo68cl ]);
 
-  preConfigure = ''
+  postPatch = ''
-    # needed for the patch above
+    patchShebangs ./cat_with_cpplines
-    autoreconf -i
   '';
 
   configureFlags = [

pkgs/development/libraries/physics/lhapdf/default.nix

@@ -1,19 +1,15 @@
-{ stdenv, fetchurl, boost, python2 }:
+{ stdenv, fetchurl, python2 }:
 
 stdenv.mkDerivation rec {
   name = "lhapdf-${version}";
-  version = "6.1.6";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "http://www.hepforge.org/archive/lhapdf/LHAPDF-${version}.tar.gz";
-    sha256 = "1sgbaxv8clcfy4d96fkwfyqcd4b29i0hwv32ry4vy69j5qiki0f2";
+    sha256 = "0gfjps7v93n0rrdndkhp22d93y892bf76pnzdhqbish0cigkkxph";
   };
 
-  buildInputs = [ boost python2 ];
+  buildInputs = [ python2 ];
-
-  patches = [ ./distutils-c++.patch ];
-
-  configureFlags = "--with-boost=${boost.dev}";
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/physics/lhapdf/distutils-c++.patch

@@ -1,24 +0,0 @@
---- a/wrappers/python/Makefile.am
-+++ b/wrappers/python/Makefile.am
-@@ -25,7 +25,7 @@ fix-out-of-source: $(FIXSOURCES)
- 
- if WITH_PYTHON
- 
--PYEXT_ENV = CC=$(CC) CXX=$(CXX)
-+PYEXT_ENV = CC=$(CXX) CXX=$(CXX)
- 
- ## Always force setup.py, it's not good at guessing what needs to rebuild
- all-local: fix-out-of-source
-diff --git a/wrappers/python/Makefile.in b/wrappers/python/Makefile.in
-index 925460c..fdc8888 100644
---- a/wrappers/python/Makefile.in
-+++ b/wrappers/python/Makefile.in
-@@ -266,7 +266,7 @@ top_builddir = @top_builddir@
- top_srcdir = @top_srcdir@
- EXTRA_DIST = lhapdf.cpp lhapdf.pyx clhapdf.pxd
- FIXSOURCES = $(EXTRA_DIST) 
--@WITH_PYTHON_TRUE@PYEXT_ENV = CC=$(CC) CXX=$(CXX)
-+@WITH_PYTHON_TRUE@PYEXT_ENV = CC=$(CXX) CXX=$(CXX)
- all: all-am
- 
- .SUFFIXES:

pkgs/development/libraries/physics/lhapdf/maintainer.sh

@@ -2,7 +2,7 @@
 
 set -e
 
-BASE_URL="https://www.hepforge.org/archive/lhapdf/pdfsets/6.1/"
+BASE_URL="https://www.hepforge.org/archive/lhapdf/pdfsets/6.2/"
 
 for pdf_set in `curl $BASE_URL 2>/dev/null | gsed -e "s/.*<a href=\"\([^\"]*.tar.gz\)\".*/\1/;tx;d;:x"`; do
 	echo -n "    \"${pdf_set%.tar.gz}\" = \""

pkgs/development/libraries/physics/lhapdf/pdf_sets.nix

@@ -6,7 +6,7 @@ let
       inherit name;
 
       src = fetchurl {
-        url = "https://www.hepforge.org/archive/lhapdf/pdfsets/6.1/${name}.tar.gz";
+        url = "https://www.hepforge.org/archive/lhapdf/pdfsets/6.2/${name}.tar.gz";
         inherit sha256;
       };
 
@@ -21,8 +21,26 @@ let
     };
 in
   stdenv.lib.mapAttrs mkPdfSet {
-    "ATLAS-epWZ12-EIG" = "01nj0zn19sk2ir4fk1202jsz457yrpqrsm99gn60a6rbamjybk73";
+    "ABMP15_3_nnlo" = "028q5xixxjxhb8sr7l5v5mwh9mkszm5m59fgnpb69yxvv40a70v0";
-    "ATLAS-epWZ12-VAR" = "13kra15c5ahjldprdvp343c7gd875g8hca7r1bx9ccz6nffxram6";
+    "ABMP15_4_nnlo" = "11zjp4dxmgp69kdkmdwqkpsajvwjrbwylmwgs56mgjb0vgb8wk0i";
+    "ABMP15_5_nnlo" = "0z47g5fwh53gg5ws5bbip5q2m5mm7vl09q2w58g6ah9dk25r10ll";
+    "ABMP16_3_nnlo" = "0bwirm3wqyjj6i3asya7kjmmjhqi69l1rnc6gnq7v136ajmv96y0";
+    "ABMP16_4_nnlo" = "1cw52ijyrhgvyqc28pp278bavy9acvs6qywysgc7qjifygb14mca";
+    "ABMP16_5_nnlo" = "0iyypvj4645g7nh8w6v88pz37p81bxilgc4p7wlkaa90hiq0wrk0";
+    "ABMP16als112_5_nnlo" = "17kg6gvl09p5gm99yb9d8hkl1q51904qflsziv3r5ybxs18ym5g8";
+    "ABMP16als113_5_nnlo" = "1gaiyq70zxx7c7c0gkkad3ygbhdwc563al2a6ksy78q8is3bhdy9";
+    "ABMP16als114_5_nnlo" = "1gd41d8ay8i8m35qfqsm96jcv8vx6hpdsrdzsj415f4zpw5j29fm";
+    "ABMP16als115_5_nnlo" = "0i70z8i0qgzr875szdh8sa6x3xcdkvrfsba97a6ha7b6km4p1yjk";
+    "ABMP16als116_5_nnlo" = "11rph6vmmvvsi8msfp2agb7747n7xjgxb7z766i5jkvnggbmz75m";
+    "ABMP16als117_5_nnlo" = "1sz9hy2m983aiwyssg60v4kq1zvz4xxvbzrgsdik1qv13bj4wx9w";
+    "ABMP16als118_5_nnlo" = "1slvr5ygwwryk63mah45xp5x31qwrf0gkrnh4p9fvl4rdkji6z0z";
+    "ABMP16als119_5_nnlo" = "1iqs1bi8r22awflf698cj39q8s2w86fwvdfgqb6sr8csm36ih6qp";
+    "ABMP16als120_5_nnlo" = "051bqfyh2017vnvlisvkm1ik6x7n829p8205f5algsw7wi1s7b9v";
+    "ATLAS-epWZ12-EIG" = "010ddmyfrmscgd1xdjsxsjc773jlvbh3s6mjbwk9zd298i3bf4kx";
+    "ATLAS-epWZ12-VAR" = "1r9ip8549dzhs02skm8v00g6nsh7q1rwd3syz3bd6cl4sqhs0k37";
+    "ATLAS-epWZ16-EIG" = "0b1zzp8p0kh4xjn76nm6waqlvdpqvnwyqsnnqdp2n7b9r9ssryyf";
+    "ATLAS-epWZ16-THEO" = "0b0wqa203b2x159y54xhf9yh34lkchp48vp9693k51g9aznx8gjm";
+    "ATLAS-epWZ16-VAR" = "1zkhlv8yxfla46gj57119w9prsd3zyy5vg275bayfwa6b71gmc0b";
     "CJ12max" = "1vk2zkaiqbl6fixaxy7mrggmmxv7lvnw736lxm5sh25dapg6s8ag";
     "CJ12mid" = "0s2558ihypn0l9qqx25qwnawbc7fkbi2wwwhbyb108rjk2klaf8v";
     "CJ12min" = "1kdla638m3axr65ndid9irmqhby4gl084r297xw3jxxlrb0b7hj9";
@@ -99,6 +117,10 @@ in
     "CT10wnlo_as_0127" = "1svmgs55kg74rifjyns38lggv1c18mzmpmvsv116rrllklb19pfp";
     "CT10wnlo_nf3" = "1m13if0d9xijq695x41snpwwrsgs5a0jvil6j2ww8cspc33d7vr3";
     "CT10wnlo_nf4" = "1b9lz23rn2w7fqwxxgf6fcg620ac58dnb1ssj3ml3vfn7z88yx43";
+    "CT14MC1nlo" = "0z82q7xr9agq8iyw7w2rcclh27mry5snn5jswn3cxpgnalls50rx";
+    "CT14MC1nnlo" = "0fj6hjdv82fp4iv7iyk9gna7sksnpkgqx0bsrl2wjbigm4ys031g";
+    "CT14MC2nlo" = "1x6a6js1jpvkykagz6w3klh6hb2wf56r3kh65i6qlnzak4m7b8sq";
+    "CT14MC2nnlo" = "0hbdz8agjm16mm51hclpl2nsa5ji88zpqdsn682xgihq64kahsnb";
     "CT14llo" = "0sz2ni8xcjjg8034qjrhb77ak1akzlf5fwq00qs9c196lk5b2x7s";
     "CT14llo_NF3" = "07zzs3jprh0haqx5bcsii213m99m2nh9vki76d9cbhicyzx23pc1";
     "CT14llo_NF4" = "0bxkw5qms6dpab0zf1hhd8dllrjip2izbv23aqpg72d5rqxb6ny4";
@@ -146,6 +168,20 @@ in
     "CT14qed_inc_proton" = "0gv0rlr6l62gidqp02ifn75d1ribvbihgpaqc92fww73zwilr7l0";
     "CT14qed_neutron" = "0ck1vmqk17i7rq42hra79cz2rm8ngxv4da6dvz62l6m2nrga3l2k";
     "CT14qed_proton" = "1gijxkq5gpsljijblzd13kgr7xjjvnjv18v02jivylf73igsakd7";
+    "EPPS16nlo_CT14nlo_Ag108" = "1p7gckhv44h04rvknd6fdizy9c1jqfwic7ppf0ra14ic8wp1g7wg";
+    "EPPS16nlo_CT14nlo_Al27" = "0hxyakfgknmixxndfj14i44afp5gcfz9afjvjdaj702sv42a7qa8";
+    "EPPS16nlo_CT14nlo_Au197" = "1g272110y3a1fr6raxdfhagn68i0lcnwbdhiiqg4j6wb6v4m3p6i";
+    "EPPS16nlo_CT14nlo_Be9" = "0zxsdmvz919ajwwb917613byshhpr876jcg9kik0pkz8c4ddr2z0";
+    "EPPS16nlo_CT14nlo_C12" = "0mjmjk9n36aikhm8i6zwzfszyb5zcy1syn13vs2rm12x535j6dm5";
+    "EPPS16nlo_CT14nlo_Ca40" = "18vd67splj75sjijfvhyq0q6068yr8l083sczamwpmy8z3l798ih";
+    "EPPS16nlo_CT14nlo_Cu64" = "0g64gpc5cssmwl1sn7cl0ramsg2zfq7snr9bzr41q2dznbvqahgd";
+    "EPPS16nlo_CT14nlo_Fe56" = "0dxfzpx99ha9g27bxx6xzxxh87va91qqwq6hnz1qsligjfx7q4yz";
+    "EPPS16nlo_CT14nlo_He4" = "1ln5kz3270kyx6m3ji6q5xyp5a23f3kbwh9z9dmdwwsw7q9n8way";
+    "EPPS16nlo_CT14nlo_Li6" = "04rviiml0rnym9qppsczcydw37r923ljx8hj63vv6dxng0g617qb";
+    "EPPS16nlo_CT14nlo_Pb208" = "1b2zibpigdvvkg29zh7zm32jpdr2prm35jasafh17pfpwlfc55mb";
+    "EPPS16nlo_CT14nlo_Pt195" = "14v1gicvm8i8z9d98rlv5rbhaglkbi9fhs3z465p4d764al6znnc";
+    "EPPS16nlo_CT14nlo_Sn119" = "10nxn6rdp7svsrkdcdwxryjmirn1s871yj1w493adpfcy3chqw9k";
+    "EPPS16nlo_CT14nlo_W184" = "1x8ndmkzmnl79vz1bgi9972190x03asvgnls6qiz746xl37q4ky7";
     "GRVPI0" = "0i5icsw9hf4jm25d0szxqc3r1131n417lv8b4gslg93xqj4ry1hf";
     "GRVPI1" = "05j3mcrb0sq4nzv7y0k68f2m3v8vnd13mzbhq43gjq712cbj126p";
     "HERAPDF15LO_EIG" = "12cqj3vqwi86sfgxkiwbd7rnpw1awnbqbc852b0x32d9j18nz9c2";
@@ -213,7 +249,7 @@ in
     "HERAPDF20_NNLO_ALPHAS_115" = "0nlimqmfhx2ijx48ylciih5diwlsb5zzkli82rgnnxci3r4ycjq4";
     "HERAPDF20_NNLO_ALPHAS_116" = "0nr8svx60zrf42nxg74v0h759y9lwg54892xpdmswg7mw0nwcrm9";
     "HERAPDF20_NNLO_ALPHAS_117" = "0xiqdr2r5dyyp5q56b3w04wy3raqrh1mjsv1fm05xswxn2xwyhlq";
-    "HERAPDF20_NNLO_ALPHAS_118" = "";
+    "HERAPDF20_NNLO_ALPHAS_118" = "0d0w0f077g11s4clx1556y9xx5nn1dgm8zcp0bk92v4lapngf33c";
     "HERAPDF20_NNLO_ALPHAS_119" = "1w9nl0pnfc1cii4knmqdq4cnh6shhhgj8pg4a42bx20lvqc3aqgb";
     "HERAPDF20_NNLO_ALPHAS_120" = "1lksn0rcxq2scwpnps8dawlzijhvwbg0pn2is4r29igbqck2jvb3";
     "HERAPDF20_NNLO_ALPHAS_121" = "03d58rbibvgcvmsw86q3030qnw5nnvq8p6diqscd9srb8br06p8m";
@@ -234,7 +270,7 @@ in
     "JR14NNLO08VF" = "0kzszj1r141fcg9vbf53480224nxcc5wfk9zmpmzbmrxzi0w127r";
     "JR14NNLO20FF" = "0wc3qib90dpd1wgiymrn5lzwhqmh58ji2s92vpj2v9v4spws7pdq";
     "JR14NNLO20VF" = "18l4ipn80gmh9kdw7a1k49fwgbl7b1frgc0hsa04vbwnv6hm73hn";
-    "LUXqed_plus_PDF4LHC15_nnlo_100" = "009wb1ibh4yfbqh5fsznc2g9g50rl6g0pq0x9qf7iiq2vd40rzsz";
+    "LUXqed_plus_PDF4LHC15_nnlo_100" = "08jzl4wcsrr9agycq1r5kd5bqxsx4b637nxk34s82vs7vwpq7qib";
     "METAv10LHC" = "1vn4wnx1blz6wylbzirswdqqf0knmyh1pcfh62wvj695mh7i0w16";
     "METAv10LHCH" = "1p4wy7m1ksz0r1fylwz3cbq7jl8s58v817n3d898l83ic2ghp4vj";
     "METAv10LHCHfull" = "1w623939fjdyx1316rxyaavf6kmxff19himr00br57jrw3v49nfg";
@@ -341,6 +377,33 @@ in
     "MSTW2008nnlo_mcrange_fixasmz" = "05c8z2q2866550clx2mwb1jvhpn0agkyg82vvrswi3h4hgkvlfjx";
     "MSTW2008nnlo_mcrange_fixasmz_nf3" = "0r86xsl1wfphwdj2hhlilkwc2949m7bcn42dms14g7w45i24g6id";
     "MSTW2008nnlo_mcrange_nf3" = "1c9lsggncwghvw9mgd18h50ljrnlpp1p5r2zlzf8z3g8i4f3aaih";
+    "NNFF10_KAm_lo" = "19wn44svz61lhk33kzc6id18w6qbkw4bfnwncar19phrjjp965v6";
+    "NNFF10_KAm_nlo" = "191db9pj5yspiqc7598r147j9wvfc4s6cm0q805m5vmzpfg2cgr6";
+    "NNFF10_KAm_nnlo" = "1hm8vhk1p31zdn72bgcyyq0w5qii1ba0cf81wjlbhwv4fadfd4sy";
+    "NNFF10_KAp_lo" = "13yas11c7xxij45zrd3r6njjvx33kn9lg8i28ki0y4nw6ss21w3b";
+    "NNFF10_KAp_nlo" = "1jza83klbcb3j2pcg2xhgj2imh4llb6hsfkbfj294q0isqypgzsv";
+    "NNFF10_KAp_nnlo" = "0xwl34a31ajxwlgx6bhzzyf9b2xiq7bpv51p4zi6k1xihs91vwzc";
+    "NNFF10_KAsum_lo" = "128cj81qp09hn99dnkm9q06wf2dr7xjq9qmwvrmdizrd8cwfa4l1";
+    "NNFF10_KAsum_nlo" = "19pglfl1i5qg8sj3hg0qnhr1f66isfbrv7f901hnxniibbdjxib2";
+    "NNFF10_KAsum_nnlo" = "1769ybc49a94appmiw0bbn3kkvcpw82sggxgvvda5jq9m36m9yzb";
+    "NNFF10_PIm_lo" = "095xl0cs6p5z44hydfa963ylxvzqxdwwj1n8jn7n0c48rwssx357";
+    "NNFF10_PIm_nlo" = "1fn8863092fn4aqacprbsdxlgz27q6pam08pccwq9ps0dwjn7cc5";
+    "NNFF10_PIm_nnlo" = "0j4p50k821pphy8i6s73h3c29d7jb3bp5s4l8rl3bfb0nfx4p6hq";
+    "NNFF10_PIp_lo" = "0hhw2ympx1a8d3sl953k27yzww0j2f5m9b865gv1ybb3l9ccv1i6";
+    "NNFF10_PIp_nlo" = "18k3s7i1xvh8717n5cdllbb6zs8svh2bkw0k2zf4ql5ijiypvc10";
+    "NNFF10_PIp_nnlo" = "16mywhpc3439dpk2c1i6gxrv9khyyg0kl4gsc41qyi3r4d7k6n2c";
+    "NNFF10_PIsum_lo" = "1yh3hxfmgzgpwqidmzlc189syjbsj4vyswc4kch7yykxw4dqf6sa";
+    "NNFF10_PIsum_nlo" = "12rgg0nc9rjvwfpf0y9kl1w9814a4pv4b17p46h8qm6kfyqqwjia";
+    "NNFF10_PIsum_nnlo" = "19iz4q31apgm2il9478c7zmmc6kgz2wyp84qja761jvyl6z0img5";
+    "NNFF10_PRm_lo" = "0c5pavhf5flx2nmld2dprgp1lsbvsrjw5mqdzvgkks7ibvq0ap5j";
+    "NNFF10_PRm_nlo" = "0nfwhp9hacnm95w2qa5hvmfwaj7drc0w7lxqw1lrdp074bpd0ma3";
+    "NNFF10_PRm_nnlo" = "084dz4xxmydf71vkhcrmj03jkwyj56jxvmbzm22mdh2dxmkz3l1g";
+    "NNFF10_PRp_lo" = "014m0vjzrr4rbi84qxzmrym07kc4wax29fs66mfxkmrimxpb9l21";
+    "NNFF10_PRp_nlo" = "0lrzw2618kgk7vsksbr1qxqc4h9lza573bz6208hwdgkmh7awasc";
+    "NNFF10_PRp_nnlo" = "0bv07hh5rxvqw58jcam3piiiy19w325nrwivrifyv5wii8sybz8r";
+    "NNFF10_PRsum_lo" = "1a9m77rl49wzzgdkr6x618bzcm2p50f915bbggknx5xjw550dqd1";
+    "NNFF10_PRsum_nlo" = "1qambqywda7lvvkd6kx2r1g60v6lnqcamdd51396id33fvw3k45h";
+    "NNFF10_PRsum_nnlo" = "1kijaxw6v1w33q6l89raz7ic59zcmd3nx5djp83lyg134a15crmw";
     "NNPDF21_lo_as_0119_100" = "19qw2hp1yk82qgcrpx8wp2fg8wklaj6rr653m6mndhhr0aa0w80v";
     "NNPDF21_lo_as_0130_100" = "0p5cw77dg5pkhl3d0y6r3k8vhw4m467wf3gd8kp2l5vcbdwb4izv";
     "NNPDF21_lostar_as_0119_100" = "0i23axf0xl11nb2dn6p34bnm1xfisnn3a82db9dz863n60gqb5x4";
@@ -465,7 +528,7 @@ in
     "NNPDF30_nlo_as_0118_atlas" = "034h2wgakbm3mx70034nwb44ii38rca7xv3az3fhcnjbpg9vnf0p";
     "NNPDF30_nlo_as_0118_cms" = "08g9315fpc4khwfjf76vvyqa9nannvwq0bpc42f9f7yc0pck71qa";
     "NNPDF30_nlo_as_0118_cons" = "1lw0fhy9gwk3zr7vq7qh9p6zprbyd4faln3npnxs2snncic1mnz6";
-    "NNPDF30_nlo_as_0118_hera" = "0ndgfpxl9mrf1fk6w5q9ag3qm9rr4q3jkymfnr4frkmzcdxjnvzn";
+    "NNPDF30_nlo_as_0118_hera" = "1833gd9h3gg75hblxf5qh5hp61k7n9vavb91ll9lbqmcbfr34aas";
     "NNPDF30_nlo_as_0118_hera_1000" = "0lljb96d3q25yw3fz3cbk2in90q6srpc4alkz95nyrvgp25xgbgy";
     "NNPDF30_nlo_as_0118_hessian" = "0h8d2zc02ccr1rmlsf4xd5a41irbs9q9wx68caj2xy0i7qr8rsmp";
     "NNPDF30_nlo_as_0118_mc" = "12nnyzh2f6mv4gq4x4b8nlqx34lbj5y2y60zivfdbcpyg2spj5y8";
@@ -510,7 +573,7 @@ in
     "NNPDF30_nnlo_as_0118_atlas" = "013jm6f2hnmzc2di7spf6zp31fwhm6c9sddwql36hww63w8sys71";
     "NNPDF30_nnlo_as_0118_cms" = "1w0ax68rg5877s35zlg13c451fcz2rij4adzwhz4yf4skkbgflng";
     "NNPDF30_nnlo_as_0118_cons" = "1qniswwj6cmcs7bm4n11jx2disqcwszl08cb7im824nvrcjka2pg";
-    "NNPDF30_nnlo_as_0118_hera" = "07k4wlfd63zmhnxq06avdpfrgfnc2ziqhsgyy3w4lvara9i27il0";
+    "NNPDF30_nnlo_as_0118_hera" = "05j5yrra93dxh1nah19hszd0q3pj4zfica8a7vm5akbfn02rccj6";
     "NNPDF30_nnlo_as_0118_hera_1000" = "0ssiw9fk5fqwg77rbycrxrclldws35n6gj4a4sj6d9yc87vz1g7z";
     "NNPDF30_nnlo_as_0118_hessian" = "1hb32bamwlx5il8g2sf5gy6xjr7r4rky7xgvdhf5ndq7v3n1ncx1";
     "NNPDF30_nnlo_as_0118_mc" = "1gxl4c5z2vh382y8l2kpr8vy4fqvbxvrw6xjc6dp229ak89cd6c2";
@@ -536,6 +599,72 @@ in
     "NNPDF30_nnlo_as_0121_nf_6" = "1kln7zjgl0hwl621wnhhsih0m8f9ir2i8ligfg2s0qp8s3787lrg";
     "NNPDF30_nnlo_nf_4_pdfas" = "0s460v9712ahz09fhzhlnsnkl9arsy3l82g1z6xjz4la8fwkr9wq";
     "NNPDF30_nnlo_nf_5_pdfas" = "1vjfm9j39m4389b0r51axlbzdbkpk2vbs3vks3yqcr3hr09g9myk";
+    "NNPDF31_lo_as_0118" = "0xdxn21k08vrb1pdpafkb7cqrjq7z08ydmbxplgl9dyn4mcqk4jg";
+    "NNPDF31_lo_as_0130" = "0xkljqnkrq542vjxapnzx5ba5m6ixyqqkfdcn73m576zlkslx0md";
+    "NNPDF31_lo_pch_as_0118" = "1y6nidprll6as4ygpvxld71b9ksn5mjci3dc6cjamijarcdpgpsq";
+    "NNPDF31_lo_pch_as_0130" = "0lbb7906lx7fxj346h7apdmhi85biaknh8vzkf8z11mh1dy7hm3w";
+    "NNPDF31_nlo_as_0116" = "00qlx5xdl0g99hb0vycpmflbsw73i952w1qpf84hraqd9xs9wq0w";
+    "NNPDF31_nlo_as_0118" = "01jsfvd3bl0lca93hwlm5lngarlgkn8nmj048yj3qjj5vs98w7rx";
+    "NNPDF31_nlo_as_0118_1000" = "1ms69qgi3mhrwi3jxapykfsiqwq3cfpx38jwmsv4pq2g2hhawvfq";
+    "NNPDF31_nlo_as_0118_C1p6" = "0xig1dyf9sr72c2daksy6wicgfj8gxnyjbvxz1w8f1m0ww0mlwkx";
+    "NNPDF31_nlo_as_0118_hessian" = "11kc9waf3c28ncb4irwvpnlbp5p6bzs6l9hfkix6v9c4z5d804rq";
+    "NNPDF31_nlo_as_0118_mc" = "0xjrv6p4qanvx7l44cggj4jc29pnnf3lrnsa7sijzfardwsp60az";
+    "NNPDF31_nlo_as_0118_nf_4" = "0ciasq6r5j424b1qgz6z4s1s9zycj8z9syws9cjc6c65warjcca7";
+    "NNPDF31_nlo_as_0118_nf_6" = "0li61z1c83cjxgnsqp5hnd272w5wljj06ad73w1jmxv8jplb1l2m";
+    "NNPDF31_nlo_as_0120" = "18b3acwhykwacf4av0a5cn77d0wvwxbjljh96nxmj0pdg8rs2v9s";
+    "NNPDF31_nlo_hessian_pdfas" = "0yffdh37sxxfhaylg5rczyggx2313h4wzhig4j37nby35cj13dmr";
+    "NNPDF31_nlo_pch_as_0116" = "04wl2n4iil8svxk6k970dc2c0gpbyvw23lvl5w522imahrc0kmph";
+    "NNPDF31_nlo_pch_as_0118" = "0hcaaxd01769pvjqp92wqch6hqlnf3wddik13gp3rr9rcg8rf31l";
+    "NNPDF31_nlo_pch_as_0118_1000" = "1mnfyvlnwz0ga985nkn7px0b7mzai6jx74j8pyy8mdpjbgkmwpq6";
+    "NNPDF31_nlo_pch_as_0118_hessian" = "13z0icvq1ryix0kg7p5c4569v4hiv2mins2b2ai88jf16rj99n4r";
+    "NNPDF31_nlo_pch_as_0118_mc" = "1wg1wlzf8qi1h83y9aajglacvhs9zm68p9dvn4w6fmqrj0hppd3g";
+    "NNPDF31_nlo_pch_as_0118_nf_3" = "0xvqms66myq84bpszs04apfbc66i4jq2qdkkbp4cy3pq573bpvmr";
+    "NNPDF31_nlo_pch_as_0118_nf_4" = "0yylm6zbrm4j9lh05vmwxbkdn6b83zxbpj7s43ygi1bl7jnsxmnh";
+    "NNPDF31_nlo_pch_as_0118_nf_6" = "1j3a3blikmz36a8nraaak9ax6rykirx14lghvszs6zjnfxr44h5m";
+    "NNPDF31_nlo_pch_as_0120" = "1hmzaar0ri15w37hagpn9jzq4kxs1231cwqn9zz2pr6a9rk99k8m";
+    "NNPDF31_nlo_pch_hessian_pdfas" = "19fc6fyp4i761nl3f4vxrcy0rpgnhvaqh4w0sq44j1dfnsn0y4lr";
+    "NNPDF31_nlo_pch_pdfas" = "1ql7j0xb49id82ab51ppphyrkag2m39jpsb3whna88bal3jh1710";
+    "NNPDF31_nlo_pdfas" = "1xdzrwbfax9q492a63agx7a4jd4jp5r3pwgyyyqagvfxi4f1q17n";
+    "NNPDF31_nnlo_as_0108" = "0gjwk058lbhmkmfmxkvxndnda10nih7zc711wp4c5gk70nhp1m6k";
+    "NNPDF31_nnlo_as_0110" = "1lmi58ljspxs04zwx6bax6gf9221y1algrz7hjv63glc4j23q9h5";
+    "NNPDF31_nnlo_as_0112" = "0qz79ljj9javl940bvpidiy9fqv91d53g1l9i2gbxd72rgr52h1w";
+    "NNPDF31_nnlo_as_0114" = "1wjvwdl8mp36x5cqrgny15lnm696k5nxpwax0ry1win3gy7mb2kp";
+    "NNPDF31_nnlo_as_0116" = "1zkxzdfgklpxy3bwvjlhpqq2s2g40q2f9wzibf9qb294c69wm886";
+    "NNPDF31_nnlo_as_0117" = "1vwqqxwzx1cwy9ndr0aav6xxi4n18px6n0rsvwbrz0v4gsyr6mh1";
+    "NNPDF31_nnlo_as_0118" = "0mi9ln96xy3pjifrjmw9mvgwlb81229spa9x1df084rpy8hab80f";
+    "NNPDF31_nnlo_as_0118_1000" = "1bcjsxnp205v9ipf0j57pfnzl7kd89ds3w0gnjdsq8q86s0c5k23";
+    "NNPDF31_nnlo_as_0118_collider" = "071ddwk53axsg7zdyf287nyqk3g3ayr95irp8kh8fsql3kvaw5hn";
+    "NNPDF31_nnlo_as_0118_hessian" = "1g4cp3y54yn38c9kiljrqvq4201pikwd58sa4ngw0vbasp8hn612";
+    "NNPDF31_nnlo_as_0118_mc" = "1x8ai1a8gv1if0l66596fwi4qdwla3aci27c23n5i60g83lf6hza";
+    "NNPDF31_nnlo_as_0118_mc_138" = "0jbwmiqfcf36p5mbqp7gzvrr8s9k7a7wrkbhr8nymipr9yczd51h";
+    "NNPDF31_nnlo_as_0118_mc_164" = "1myybl60kkdxaxlij9r3i3l090m4m4709g1dnp85k90vjryafwkc";
+    "NNPDF31_nnlo_as_0118_nf_4" = "05hglnfv1d9gl4m34c2hwzf96pl39mihwly6sffq7dxsjdbr8yhw";
+    "NNPDF31_nnlo_as_0118_nf_6" = "1bzfgcyphhpdizd307d91syg0xf0ki5cv0n9kij9a366ixf3m14z";
+    "NNPDF31_nnlo_as_0118_noLHC" = "0ibvp81ys8dajhxbv7cjdsybvgs258yh45a99xskm3jknzg90a36";
+    "NNPDF31_nnlo_as_0118_noZpt" = "0xszskydvzaw7ipyzslirimfys9vnm3nsyrimb8kzcnwnhviq7p7";
+    "NNPDF31_nnlo_as_0118_nojets" = "0kci82bxd8njgb6w9zr7mcy8sswg6ldfvs0jclqm09yjl05nl3p2";
+    "NNPDF31_nnlo_as_0118_notop" = "15wl949pdmfp3ikxkzcaqgqqmifs6d81z2smxg4m7hq1hg56y5lf";
+    "NNPDF31_nnlo_as_0118_proton" = "1gx94jhavk9fvs0klqnkq152b23mvd2y68jpvfzhg7jvcl10fqal";
+    "NNPDF31_nnlo_as_0118_wEMC" = "1z3yv8i7yb2ng1ap3qqy5qxkkq7ds19dzp76qrivrcfqh0ymdq8m";
+    "NNPDF31_nnlo_as_0119" = "1c4ymkshqp70713p6n9kjmrqr1pjsb1gjw20pmy47azr0a6pcryy";
+    "NNPDF31_nnlo_as_0120" = "12bgvx6kk5bw30ng81b6hcqdqn2vi3zc60xn21z6nv1995ky44mm";
+    "NNPDF31_nnlo_as_0122" = "0kmaxwxrk5yrrj00z8fkl4y7n08yrx1159zp6p450vcnwx512p10";
+    "NNPDF31_nnlo_as_0124" = "01gxfwsxqvng8d6kbmz6jq05l00d2gw4snjmcsj76lk9xcmkjmwi";
+    "NNPDF31_nnlo_hessian_pdfas" = "1dd4yzh5vhr11qh5w1wfb1ppda4sk9f78h781p1ds165qsw2vcqj";
+    "NNPDF31_nnlo_pch_as_0116" = "0zaigf1dhcidlqyyffjq193p1xcc94dbkqjfppmpdzwd4q283ydz";
+    "NNPDF31_nnlo_pch_as_0118" = "0x2s5v0p7k3a3v01wr8rvp2al0x4l2bx9wwmvfjcm4k2f2m011s5";
+    "NNPDF31_nnlo_pch_as_0118_1000" = "1kwc21p2s383973k5jqciqjpmp4xlvj59zsxjs9nvsywzp9k7vaq";
+    "NNPDF31_nnlo_pch_as_0118_hessian" = "15wb8yap14mqbawbifgl57dkn8iwvby7pkn0yvrb0rrpgyivgxhr";
+    "NNPDF31_nnlo_pch_as_0118_mc" = "0f2ymg5sd78531pxyvprqaw1dg9sbys5di46zjz1qycs8r3kcznm";
+    "NNPDF31_nnlo_pch_as_0118_mc_138" = "0mzwhsp3xid0s32cpzq5z6vq7w90v3xr5nfdvhgbpqvl992gxbvb";
+    "NNPDF31_nnlo_pch_as_0118_mc_164" = "13a4wsn2pv5w7847asjk30nzm9kcscsxcnjx4ygzdvk9938z7rxb";
+    "NNPDF31_nnlo_pch_as_0118_nf_3" = "07v7n9yxbnmnyxngncfiy9v1k2njsy1bqvzchjqpzd9l3w751dpk";
+    "NNPDF31_nnlo_pch_as_0118_nf_4" = "0lsa5zjyg0qx23fjx6lyi0bwkq7did4lbxwbi3d5gibnrr917lnq";
+    "NNPDF31_nnlo_pch_as_0118_nf_6" = "0drb8ylkfs18sc5k3ynwrydwgcyv55f7la2m6cl412gbrwkbhina";
+    "NNPDF31_nnlo_pch_as_0120" = "0ckflm3s97c9vgf5klnscf51dyhqcjsm83a7kqxq4085q1rwwixj";
+    "NNPDF31_nnlo_pch_hessian_pdfas" = "010yzzhqay4mkyn5had3sdrfwd9qfm65y6w0riiamdcx561mwjcv";
+    "NNPDF31_nnlo_pch_pdfas" = "1yp113p6kzqw8cizxawgnhmkz6xw27mqi76jy417c9lvmy4mq43p";
+    "NNPDF31_nnlo_pdfas" = "0ixj0bmwv1hjg2kvmpyd8r2jykh7a5ng1d469wd3amqkc4ww9kcq";
     "NNPDFpol10_100" = "0r5qfa8cyanalphgjdsh57s3viqv9i10v51p1pyamj1f90gb9pr8";
     "NNPDFpol11_100" = "0nny1lpw37jcillpfxjx82hq7wlzp4yksxialmc2ivr192qqdda8";
     "PDF4LHC15_nlo_30" = "05n0i1mr7v7ssvxvdmv9fn621rinl08frz71apjj7wfdm7s7bk72";
@@ -567,10 +696,10 @@ in
     "abm11_5n_as_nnlo" = "0091vwjkc686d1dnfn2dpa7jb56p8gli2z687fpx5f8yhjzpbh80";
     "abm11_5n_nlo" = "1bpf37mg5wgcf1id2am98l5mj162xrnb8k16ppfx3qxlakp0iabl";
     "abm11_5n_nnlo" = "1mpk322mqs078pk2nxxk8fa29ka6cxzsf65ffiny38678djmfqd2";
-    "abm12lhc_3_nnlo" = "0hwgspbp6dpw5lz211i0vjgg45hag7zr3djfdk16gkr86sra7ba6";
+    "abm12lhc_3_nnlo" = "09k90vhjq7p0i0aaq2697pq2dc86bkmnv4q8zyqxjp3wnqx1v95f";
-    "abm12lhc_4_nnlo" = "161qdm0axsqhg6lizx0h4kdg714kl2d6mb8y7wrvanr0v0db9zkl";
+    "abm12lhc_4_nnlo" = "1hciv1z9b5fiz7swv21gr0rshijj9yj2n8x4l54v9g0jyd061jaz";
-    "abm12lhc_5_nnlo" = "0vshq0fx5nigzdf0vryr2v4kggc37byalzfjswm70l3nnjhxp6xs";
+    "abm12lhc_5_nnlo" = "00xxkrhbfkxhg33mkpwwk5nsdp4nmi0zmllx5z5ygxl24rinsq9j";
-    "cteq6" = "0wk6fmajvbdh8wmx1wmyd9n53m82vvh2gj4iric4b4ig9ssmbjx9";
+    "cteq6" = "0lp110wldhliad354v29f0rhdzf5qrs1ibklj0cmzp2rcbp8zrix";
     "cteq6l1" = "1b5m7g7wawk72h76l9yr3gx3n67jggna1004lwffvj43gffwkjap";
     "cteq66" = "09i69ac3gkrai5jmazjyjvi5sl8k2vm48m90ijn6pl24p31qf68y";
     "nCTEQ15FullNuc_1_1" = "0nx1n814mkikd01pxmpndk2qxpwqwd55cbn6z1kgxm8qlhhhd2zw";

pkgs/development/libraries/physics/rivet/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "rivet-${version}";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchurl {
     url = "http://www.hepforge.org/archive/rivet/Rivet-${version}.tar.bz2";
-    sha256 = "1r0x575ivvm68nnh9qlfvdra5298i047qcbxcg37ki2aaqq07qcr";
+    sha256 = "1qi7am60f2l4krd3sbj95mbzfk82lir0wy8z27yr9ncq6qcm48kp";
   };
 
   postPatch = "patchShebangs ./src/Analyses/cat_with_lines";

pkgs/development/libraries/physics/thepeg/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "thepeg-${version}";
-  version = "2.0.3";
+  version = "2.1.1";
 
   src = fetchurl {
     url = "http://www.hepforge.org/archive/thepeg/ThePEG-${version}.tar.bz2";
-    sha256 = "0d26linwv92iq23n4gx154jvyd0lz5vg41kf4nxa01nspy7scyy5";
+    sha256 = "1082n4q036sah5r4asyl3hpcyc05cymg40dnk3jsdjgv2v0vvc71";
   };
 
   buildInputs = [ boost fastjet gsl hepmc lhapdf rivet zlib ];

pkgs/development/libraries/physics/yoda/default.nix

@@ -2,26 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "yoda-${version}";
-  version = "1.6.6";
+  version = "1.6.7";
 
   src = fetchurl {
     url = "http://www.hepforge.org/archive/yoda/YODA-${version}.tar.bz2";
-    sha256 = "088xx4q6b03bnj6xg5189m8wsznhal8aj3jk40sbj24idm4jl5yg";
+    sha256 = "05jyv5dypa6d4q1m8wm2qycgq1i0bgzwzzm9qqdj0b43ff2kggra";
   };
 
   pythonPath = []; # python wrapper support
 
-  patches = [
-    (fetchpatch {
-      url = "https://yoda.hepforge.org/hg/yoda/rev/3dbc8927e715?style=raw";
-      sha256 = "02rm34z9lbab66p7gpij12qwdph5fddpksg80qz0m537wjwy2ddy";
-    })
-    (fetchpatch {
-      url = "https://yoda.hepforge.org/hg/yoda/rev/669c2be582ef?style=raw";
-      sha256 = "0s705cl3bazpvpvy46vv1k223knwxq2yy5na1c6lv217sq9w86wj";
-    })
-  ];
-
   buildInputs = with python2Packages; [ python numpy matplotlib makeWrapper ]
     ++ stdenv.lib.optional withRootSupport root;
 

pkgs/development/libraries/poppler/default.nix

@@ -10,8 +10,8 @@
 }:
 
 let # beware: updates often break cups-filters build
-  version = "0.50.0";
+  version = "0.56.0";
-  sha256 = "0dmwnh59m75vhii6dw63x8l0qa0ha733pb8bdqzr7lw9nwc37jf9";
+  sha256 = "0wviayidfv2ix2ql0d4nl9r1ia6qi5kc1nybd9vjx27dk7gvm7c6";
 in
 stdenv.mkDerivation rec {
   name = "poppler-${suffix}-${version}";

pkgs/development/libraries/science/biology/elastix/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     homepage = http://elastix.isi.uu.nl/;
     description = "Image registration toolkit based on ITK";
     maintainers = with maintainers; [ bcdarwin ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     license = licenses.asl20;
   };
 }

pkgs/development/libraries/wolfssl/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "wolfssl-${version}";
-  version = "3.10.3";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
-    rev = "v${version}";
+    rev = "v${version}-stable";
-    sha256 = "05j3sg4vdzir89qy6y566wyfpqaz3mn53fiqg7ia4r7wjwhzbzrw";
+    sha256 = "0s4s9adni2q1sgqpavbmxhkl8i98bmlw6gla6dnifgsm1dirv75w";
   };
 
   outputs = [ "out" "dev" "doc" "lib" ];

pkgs/development/python-modules/acme-tiny/default.nix

@@ -0,0 +1,39 @@
+{ stdenv, buildPythonPackage, fetchFromGitHub
+, python, openssl }:
+
+buildPythonPackage rec {
+  pname = "acme-tiny";
+  version = "2016-03-26";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    sha256 = "0ngmr3kxcvlqa9mrv3gx0rg4r67xvdjplqfminxliri3ipak853g";
+    rev = "7a5a2558c8d6e5ab2a59b9fec9633d9e63127971";
+    repo = "acme-tiny";
+    owner = "diafygi";
+  };
+
+  # source doesn't have any python "packaging" as such
+  configurePhase = " ";
+  buildPhase = " ";
+  # the tests are... complex
+  doCheck = false;
+
+  patchPhase = ''
+    substituteInPlace acme_tiny.py --replace "openssl" "${openssl.bin}/bin/openssl"
+  '';
+
+  installPhase = ''
+    mkdir -p $out/${python.sitePackages}/
+    cp acme_tiny.py $out/${python.sitePackages}/
+    mkdir -p $out/bin
+    ln -s $out/${python.sitePackages}/acme_tiny.py $out/bin/acme_tiny
+    chmod +x $out/bin/acme_tiny
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A tiny script to issue and renew TLS certs from Let's Encrypt";
+    homepage = https://github.com/diafygi/acme-tiny;
+    license = licenses.mit;
+  };
+}

pkgs/development/python-modules/actdiag/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, buildPythonPackage, fetchPypi
+, pep8, nose, unittest2, docutils, blockdiag  }:
+
+buildPythonPackage rec {
+  pname = "actdiag";
+  version = "0.5.3";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1vr4hnkr0gcvvpaycd8q3vcx029b2f5yv8swhdr8kwspaqb0dvfa";
+  };
+
+  buildInputs = [ pep8 nose unittest2 docutils ];
+
+  propagatedBuildInputs = [ blockdiag ];
+
+  # One test fails:
+  #   UnicodeEncodeError: 'ascii' codec can't encode character u'\u3042' in position 0: ordinal not in range(128)
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Generate activity-diagram image from spec-text file (similar to Graphviz)";
+    homepage = http://blockdiag.com/;
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ bjornfor ];
+  };
+}